From: Sasha Levin Date: Mon, 22 Aug 2022 13:27:02 +0000 (-0400) Subject: Fixes for 5.19 X-Git-Tag: v4.9.326~29^2~6 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=9b70e1cf3a09515e9feabe9637786530a5704c21;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.19 Signed-off-by: Sasha Levin --- diff --git a/queue-5.19/acpi-pptt-leave-the-table-mapped-for-the-runtime-usa.patch b/queue-5.19/acpi-pptt-leave-the-table-mapped-for-the-runtime-usa.patch new file mode 100644 index 00000000000..d2d80993bfe --- /dev/null +++ b/queue-5.19/acpi-pptt-leave-the-table-mapped-for-the-runtime-usa.patch @@ -0,0 +1,243 @@ +From 539b513b17fd51e0c9c42647ebd227213e90c6e1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Jul 2022 13:55:39 +0100 +Subject: ACPI: PPTT: Leave the table mapped for the runtime usage + +From: Sudeep Holla + +[ Upstream commit 0c80f9e165f8f9cca743d7b6cbdb54362da297e0 ] + +Currently, everytime an information needs to be fetched from the PPTT, +the table is mapped via acpi_get_table() and unmapped after the use via +acpi_put_table() which is fine. However we do this at runtime especially +when the CPU is hotplugged out and plugged in back since we re-populate +the cache topology and other information. + +However, with the support to fetch LLC information from the PPTT in the +cpuhotplug path which is executed in the atomic context, it is preferred +to avoid mapping and unmapping of the PPTT for every single use as the +acpi_get_table() might sleep waiting for a mutex. + +In order to avoid the same, the table is needs to just mapped once on +the boot CPU and is never unmapped allowing it to be used at runtime +with out the hassle of mapping and unmapping the table. + +Reported-by: Guenter Roeck +Cc: Rafael J. Wysocki +Signed-off-by: Sudeep Holla + +-- + +Hi Rafael, + +Sorry to bother you again on this PPTT changes. Guenter reported an issue +with lockdep enabled in -next that include my cacheinfo/arch_topology changes +to utilise LLC from PPTT in the CPU hotplug path. + +Please ack the change once you are happy so that I can get it merged with +other fixes via Greg's tree. + +Regards, +Sudeep + +Acked-by: Rafael J. Wysocki +Link: https://lore.kernel.org/r/20220720-arch_topo_fixes-v3-2-43d696288e84@arm.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/acpi/pptt.c | 102 ++++++++++++++++++++------------------------ + 1 file changed, 47 insertions(+), 55 deletions(-) + +diff --git a/drivers/acpi/pptt.c b/drivers/acpi/pptt.c +index 701f61c01359..3ad2823eb6f8 100644 +--- a/drivers/acpi/pptt.c ++++ b/drivers/acpi/pptt.c +@@ -532,21 +532,37 @@ static int topology_get_acpi_cpu_tag(struct acpi_table_header *table, + return -ENOENT; + } + ++ ++static struct acpi_table_header *acpi_get_pptt(void) ++{ ++ static struct acpi_table_header *pptt; ++ acpi_status status; ++ ++ /* ++ * PPTT will be used at runtime on every CPU hotplug in path, so we ++ * don't need to call acpi_put_table() to release the table mapping. ++ */ ++ if (!pptt) { ++ status = acpi_get_table(ACPI_SIG_PPTT, 0, &pptt); ++ if (ACPI_FAILURE(status)) ++ acpi_pptt_warn_missing(); ++ } ++ ++ return pptt; ++} ++ + static int find_acpi_cpu_topology_tag(unsigned int cpu, int level, int flag) + { + struct acpi_table_header *table; +- acpi_status status; + int retval; + +- status = acpi_get_table(ACPI_SIG_PPTT, 0, &table); +- if (ACPI_FAILURE(status)) { +- acpi_pptt_warn_missing(); ++ table = acpi_get_pptt(); ++ if (!table) + return -ENOENT; +- } ++ + retval = topology_get_acpi_cpu_tag(table, cpu, level, flag); + pr_debug("Topology Setup ACPI CPU %d, level %d ret = %d\n", + cpu, level, retval); +- acpi_put_table(table); + + return retval; + } +@@ -567,16 +583,13 @@ static int find_acpi_cpu_topology_tag(unsigned int cpu, int level, int flag) + static int check_acpi_cpu_flag(unsigned int cpu, int rev, u32 flag) + { + struct acpi_table_header *table; +- acpi_status status; + u32 acpi_cpu_id = get_acpi_id_for_cpu(cpu); + struct acpi_pptt_processor *cpu_node = NULL; + int ret = -ENOENT; + +- status = acpi_get_table(ACPI_SIG_PPTT, 0, &table); +- if (ACPI_FAILURE(status)) { +- acpi_pptt_warn_missing(); +- return ret; +- } ++ table = acpi_get_pptt(); ++ if (!table) ++ return -ENOENT; + + if (table->revision >= rev) + cpu_node = acpi_find_processor_node(table, acpi_cpu_id); +@@ -584,8 +597,6 @@ static int check_acpi_cpu_flag(unsigned int cpu, int rev, u32 flag) + if (cpu_node) + ret = (cpu_node->flags & flag) != 0; + +- acpi_put_table(table); +- + return ret; + } + +@@ -604,18 +615,15 @@ int acpi_find_last_cache_level(unsigned int cpu) + u32 acpi_cpu_id; + struct acpi_table_header *table; + int number_of_levels = 0; +- acpi_status status; ++ ++ table = acpi_get_pptt(); ++ if (!table) ++ return -ENOENT; + + pr_debug("Cache Setup find last level CPU=%d\n", cpu); + + acpi_cpu_id = get_acpi_id_for_cpu(cpu); +- status = acpi_get_table(ACPI_SIG_PPTT, 0, &table); +- if (ACPI_FAILURE(status)) { +- acpi_pptt_warn_missing(); +- } else { +- number_of_levels = acpi_find_cache_levels(table, acpi_cpu_id); +- acpi_put_table(table); +- } ++ number_of_levels = acpi_find_cache_levels(table, acpi_cpu_id); + pr_debug("Cache Setup find last level level=%d\n", number_of_levels); + + return number_of_levels; +@@ -637,20 +645,16 @@ int acpi_find_last_cache_level(unsigned int cpu) + int cache_setup_acpi(unsigned int cpu) + { + struct acpi_table_header *table; +- acpi_status status; + +- pr_debug("Cache Setup ACPI CPU %d\n", cpu); +- +- status = acpi_get_table(ACPI_SIG_PPTT, 0, &table); +- if (ACPI_FAILURE(status)) { +- acpi_pptt_warn_missing(); ++ table = acpi_get_pptt(); ++ if (!table) + return -ENOENT; +- } ++ ++ pr_debug("Cache Setup ACPI CPU %d\n", cpu); + + cache_setup_acpi_cpu(table, cpu); +- acpi_put_table(table); + +- return status; ++ return 0; + } + + /** +@@ -766,50 +770,38 @@ int find_acpi_cpu_topology_package(unsigned int cpu) + int find_acpi_cpu_topology_cluster(unsigned int cpu) + { + struct acpi_table_header *table; +- acpi_status status; + struct acpi_pptt_processor *cpu_node, *cluster_node; + u32 acpi_cpu_id; + int retval; + int is_thread; + +- status = acpi_get_table(ACPI_SIG_PPTT, 0, &table); +- if (ACPI_FAILURE(status)) { +- acpi_pptt_warn_missing(); ++ table = acpi_get_pptt(); ++ if (!table) + return -ENOENT; +- } + + acpi_cpu_id = get_acpi_id_for_cpu(cpu); + cpu_node = acpi_find_processor_node(table, acpi_cpu_id); +- if (cpu_node == NULL || !cpu_node->parent) { +- retval = -ENOENT; +- goto put_table; +- } ++ if (!cpu_node || !cpu_node->parent) ++ return -ENOENT; + + is_thread = cpu_node->flags & ACPI_PPTT_ACPI_PROCESSOR_IS_THREAD; + cluster_node = fetch_pptt_node(table, cpu_node->parent); +- if (cluster_node == NULL) { +- retval = -ENOENT; +- goto put_table; +- } ++ if (!cluster_node) ++ return -ENOENT; ++ + if (is_thread) { +- if (!cluster_node->parent) { +- retval = -ENOENT; +- goto put_table; +- } ++ if (!cluster_node->parent) ++ return -ENOENT; ++ + cluster_node = fetch_pptt_node(table, cluster_node->parent); +- if (cluster_node == NULL) { +- retval = -ENOENT; +- goto put_table; +- } ++ if (!cluster_node) ++ return -ENOENT; + } + if (cluster_node->flags & ACPI_PPTT_ACPI_PROCESSOR_ID_VALID) + retval = cluster_node->acpi_processor_id; + else + retval = ACPI_PTR_DIFF(cluster_node, table); + +-put_table: +- acpi_put_table(table); +- + return retval; + } + +-- +2.35.1 + diff --git a/queue-5.19/alsa-control-use-deferred-fasync-helper.patch b/queue-5.19/alsa-control-use-deferred-fasync-helper.patch new file mode 100644 index 00000000000..604df4d0c55 --- /dev/null +++ b/queue-5.19/alsa-control-use-deferred-fasync-helper.patch @@ -0,0 +1,81 @@ +From 55c02a68360db9a6be002b473c4f71472f095cfe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Jul 2022 14:59:45 +0200 +Subject: ALSA: control: Use deferred fasync helper + +From: Takashi Iwai + +[ Upstream commit 4a971e84a7ae10a38d875cd2d4e487c8d1682ca3 ] + +For avoiding the potential deadlock via kill_fasync() call, use the +new fasync helpers to defer the invocation from the control API. Note +that it's merely a workaround. + +Another note: although we haven't received reports about the deadlock +with the control API, the deadlock is still potentially possible, and +it's better to align the behavior with other core APIs (PCM and +timer); so let's move altogether. + +Link: https://lore.kernel.org/r/20220728125945.29533-5-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + include/sound/control.h | 2 +- + sound/core/control.c | 7 ++++--- + 2 files changed, 5 insertions(+), 4 deletions(-) + +diff --git a/include/sound/control.h b/include/sound/control.h +index 985c51a8fb74..a1fc7e0a47d9 100644 +--- a/include/sound/control.h ++++ b/include/sound/control.h +@@ -109,7 +109,7 @@ struct snd_ctl_file { + int preferred_subdevice[SND_CTL_SUBDEV_ITEMS]; + wait_queue_head_t change_sleep; + spinlock_t read_lock; +- struct fasync_struct *fasync; ++ struct snd_fasync *fasync; + int subscribed; /* read interface is activated */ + struct list_head events; /* waiting events for read */ + }; +diff --git a/sound/core/control.c b/sound/core/control.c +index a25c0d64d104..f66fe4be30d3 100644 +--- a/sound/core/control.c ++++ b/sound/core/control.c +@@ -127,6 +127,7 @@ static int snd_ctl_release(struct inode *inode, struct file *file) + if (control->vd[idx].owner == ctl) + control->vd[idx].owner = NULL; + up_write(&card->controls_rwsem); ++ snd_fasync_free(ctl->fasync); + snd_ctl_empty_read_queue(ctl); + put_pid(ctl->pid); + kfree(ctl); +@@ -181,7 +182,7 @@ void snd_ctl_notify(struct snd_card *card, unsigned int mask, + _found: + wake_up(&ctl->change_sleep); + spin_unlock(&ctl->read_lock); +- kill_fasync(&ctl->fasync, SIGIO, POLL_IN); ++ snd_kill_fasync(ctl->fasync, SIGIO, POLL_IN); + } + read_unlock_irqrestore(&card->ctl_files_rwlock, flags); + } +@@ -2002,7 +2003,7 @@ static int snd_ctl_fasync(int fd, struct file * file, int on) + struct snd_ctl_file *ctl; + + ctl = file->private_data; +- return fasync_helper(fd, file, on, &ctl->fasync); ++ return snd_fasync_helper(fd, file, on, &ctl->fasync); + } + + /* return the preferred subdevice number if already assigned; +@@ -2170,7 +2171,7 @@ static int snd_ctl_dev_disconnect(struct snd_device *device) + read_lock_irqsave(&card->ctl_files_rwlock, flags); + list_for_each_entry(ctl, &card->ctl_files, list) { + wake_up(&ctl->change_sleep); +- kill_fasync(&ctl->fasync, SIGIO, POLL_ERR); ++ snd_kill_fasync(ctl->fasync, SIGIO, POLL_ERR); + } + read_unlock_irqrestore(&card->ctl_files_rwlock, flags); + +-- +2.35.1 + diff --git a/queue-5.19/alsa-core-add-async-signal-helpers.patch b/queue-5.19/alsa-core-add-async-signal-helpers.patch new file mode 100644 index 00000000000..685d8d73bf7 --- /dev/null +++ b/queue-5.19/alsa-core-add-async-signal-helpers.patch @@ -0,0 +1,158 @@ +From 399543085d41a91ce2a7e4a4eb9485c04ff666de Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Jul 2022 14:59:42 +0200 +Subject: ALSA: core: Add async signal helpers + +From: Takashi Iwai + +[ Upstream commit ef34a0ae7a2654bc9e58675e36898217fb2799d8 ] + +Currently the call of kill_fasync() from an interrupt handler might +lead to potential spin deadlocks, as spotted by syzkaller. +Unfortunately, it's not so trivial to fix this lock chain as it's +involved with the tasklist_lock that is touched in allover places. + +As a temporary workaround, this patch provides the way to defer the +async signal notification in a work. The new helper functions, +snd_fasync_helper() and snd_kill_faync() are replacements for +fasync_helper() and kill_fasync(), respectively. In addition, +snd_fasync_free() needs to be called at the destructor of the relevant +file object. + +Link: https://lore.kernel.org/r/20220728125945.29533-2-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + include/sound/core.h | 8 ++++ + sound/core/misc.c | 94 ++++++++++++++++++++++++++++++++++++++++++++ + 2 files changed, 102 insertions(+) + +diff --git a/include/sound/core.h b/include/sound/core.h +index 6d4cc49584c6..39cee40ac22e 100644 +--- a/include/sound/core.h ++++ b/include/sound/core.h +@@ -501,4 +501,12 @@ snd_pci_quirk_lookup_id(u16 vendor, u16 device, + } + #endif + ++/* async signal helpers */ ++struct snd_fasync; ++ ++int snd_fasync_helper(int fd, struct file *file, int on, ++ struct snd_fasync **fasyncp); ++void snd_kill_fasync(struct snd_fasync *fasync, int signal, int poll); ++void snd_fasync_free(struct snd_fasync *fasync); ++ + #endif /* __SOUND_CORE_H */ +diff --git a/sound/core/misc.c b/sound/core/misc.c +index 50e4aaa6270d..d32a19976a2b 100644 +--- a/sound/core/misc.c ++++ b/sound/core/misc.c +@@ -10,6 +10,7 @@ + #include + #include + #include ++#include + #include + + #ifdef CONFIG_SND_DEBUG +@@ -145,3 +146,96 @@ snd_pci_quirk_lookup(struct pci_dev *pci, const struct snd_pci_quirk *list) + } + EXPORT_SYMBOL(snd_pci_quirk_lookup); + #endif ++ ++/* ++ * Deferred async signal helpers ++ * ++ * Below are a few helper functions to wrap the async signal handling ++ * in the deferred work. The main purpose is to avoid the messy deadlock ++ * around tasklist_lock and co at the kill_fasync() invocation. ++ * fasync_helper() and kill_fasync() are replaced with snd_fasync_helper() ++ * and snd_kill_fasync(), respectively. In addition, snd_fasync_free() has ++ * to be called at releasing the relevant file object. ++ */ ++struct snd_fasync { ++ struct fasync_struct *fasync; ++ int signal; ++ int poll; ++ int on; ++ struct list_head list; ++}; ++ ++static DEFINE_SPINLOCK(snd_fasync_lock); ++static LIST_HEAD(snd_fasync_list); ++ ++static void snd_fasync_work_fn(struct work_struct *work) ++{ ++ struct snd_fasync *fasync; ++ ++ spin_lock_irq(&snd_fasync_lock); ++ while (!list_empty(&snd_fasync_list)) { ++ fasync = list_first_entry(&snd_fasync_list, struct snd_fasync, list); ++ list_del_init(&fasync->list); ++ spin_unlock_irq(&snd_fasync_lock); ++ if (fasync->on) ++ kill_fasync(&fasync->fasync, fasync->signal, fasync->poll); ++ spin_lock_irq(&snd_fasync_lock); ++ } ++ spin_unlock_irq(&snd_fasync_lock); ++} ++ ++static DECLARE_WORK(snd_fasync_work, snd_fasync_work_fn); ++ ++int snd_fasync_helper(int fd, struct file *file, int on, ++ struct snd_fasync **fasyncp) ++{ ++ struct snd_fasync *fasync = NULL; ++ ++ if (on) { ++ fasync = kzalloc(sizeof(*fasync), GFP_KERNEL); ++ if (!fasync) ++ return -ENOMEM; ++ INIT_LIST_HEAD(&fasync->list); ++ } ++ ++ spin_lock_irq(&snd_fasync_lock); ++ if (*fasyncp) { ++ kfree(fasync); ++ fasync = *fasyncp; ++ } else { ++ if (!fasync) { ++ spin_unlock_irq(&snd_fasync_lock); ++ return 0; ++ } ++ *fasyncp = fasync; ++ } ++ fasync->on = on; ++ spin_unlock_irq(&snd_fasync_lock); ++ return fasync_helper(fd, file, on, &fasync->fasync); ++} ++EXPORT_SYMBOL_GPL(snd_fasync_helper); ++ ++void snd_kill_fasync(struct snd_fasync *fasync, int signal, int poll) ++{ ++ unsigned long flags; ++ ++ if (!fasync || !fasync->on) ++ return; ++ spin_lock_irqsave(&snd_fasync_lock, flags); ++ fasync->signal = signal; ++ fasync->poll = poll; ++ list_move(&fasync->list, &snd_fasync_list); ++ schedule_work(&snd_fasync_work); ++ spin_unlock_irqrestore(&snd_fasync_lock, flags); ++} ++EXPORT_SYMBOL_GPL(snd_kill_fasync); ++ ++void snd_fasync_free(struct snd_fasync *fasync) ++{ ++ if (!fasync) ++ return; ++ fasync->on = 0; ++ flush_work(&snd_fasync_work); ++ kfree(fasync); ++} ++EXPORT_SYMBOL_GPL(snd_fasync_free); +-- +2.35.1 + diff --git a/queue-5.19/alsa-hda-fix-page-fault-in-snd_hda_codec_shutdown.patch b/queue-5.19/alsa-hda-fix-page-fault-in-snd_hda_codec_shutdown.patch new file mode 100644 index 00000000000..5964c36da3c --- /dev/null +++ b/queue-5.19/alsa-hda-fix-page-fault-in-snd_hda_codec_shutdown.patch @@ -0,0 +1,106 @@ +From 8ba3691f41ad5344c85fe37a14df72bd5002862a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Jul 2022 14:02:27 +0200 +Subject: ALSA: hda: Fix page fault in snd_hda_codec_shutdown() + +From: Cezary Rojewski + +[ Upstream commit 980b3a8790b402e959a6d773b38b771019682be1 ] + +If early probe of HDAudio bus driver fails e.g.: due to missing +firmware file, snd_hda_codec_shutdown() ends in manipulating +uninitialized codec->pcm_list_head causing page fault. + +Iinitialization of HDAudio codec in ASoC is split in two: +- snd_hda_codec_device_init() +- snd_hda_codec_device_new() + +snd_hda_codec_device_init() is called during probe_codecs() by HDAudio +bus driver while snd_hda_codec_device_new() is called by +codec-component's ->probe(). The second call will not happen until all +components required by related sound card are present within the ASoC +framework. With firmware failing to load during the PCI's deferred +initialization i.e.: probe_work(), no platform components are ever +registered. HDAudio codec enumeration is done at that point though, so +the codec components became registered to ASoC framework, calling +snd_hda_codec_device_init() in the process. + +Now, during platform reboot snd_hda_codec_shutdown() is called for every +codec found on the HDAudio bus causing oops if any of them has not +completed both of their initialization steps. Relocating field +initialization fixes the issue. + +Signed-off-by: Cezary Rojewski +Link: https://lore.kernel.org/r/20220706120230.427296-7-cezary.rojewski@intel.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/hda_codec.c | 41 +++++++++++++++++++-------------------- + 1 file changed, 20 insertions(+), 21 deletions(-) + +diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c +index ccb195b7cb08..8828fc3a5c3f 100644 +--- a/sound/pci/hda/hda_codec.c ++++ b/sound/pci/hda/hda_codec.c +@@ -931,8 +931,28 @@ snd_hda_codec_device_init(struct hda_bus *bus, unsigned int codec_addr, + } + + codec->bus = bus; ++ codec->depop_delay = -1; ++ codec->fixup_id = HDA_FIXUP_ID_NOT_SET; ++ codec->core.dev.release = snd_hda_codec_dev_release; ++ codec->core.exec_verb = codec_exec_verb; + codec->core.type = HDA_DEV_LEGACY; + ++ mutex_init(&codec->spdif_mutex); ++ mutex_init(&codec->control_mutex); ++ snd_array_init(&codec->mixers, sizeof(struct hda_nid_item), 32); ++ snd_array_init(&codec->nids, sizeof(struct hda_nid_item), 32); ++ snd_array_init(&codec->init_pins, sizeof(struct hda_pincfg), 16); ++ snd_array_init(&codec->driver_pins, sizeof(struct hda_pincfg), 16); ++ snd_array_init(&codec->cvt_setups, sizeof(struct hda_cvt_setup), 8); ++ snd_array_init(&codec->spdif_out, sizeof(struct hda_spdif_out), 16); ++ snd_array_init(&codec->jacktbl, sizeof(struct hda_jack_tbl), 16); ++ snd_array_init(&codec->verbs, sizeof(struct hda_verb *), 8); ++ INIT_LIST_HEAD(&codec->conn_list); ++ INIT_LIST_HEAD(&codec->pcm_list_head); ++ INIT_DELAYED_WORK(&codec->jackpoll_work, hda_jackpoll_work); ++ refcount_set(&codec->pcm_ref, 1); ++ init_waitqueue_head(&codec->remove_sleep); ++ + return codec; + } + EXPORT_SYMBOL_GPL(snd_hda_codec_device_init); +@@ -980,29 +1000,8 @@ int snd_hda_codec_device_new(struct hda_bus *bus, struct snd_card *card, + if (snd_BUG_ON(codec_addr > HDA_MAX_CODEC_ADDRESS)) + return -EINVAL; + +- codec->core.dev.release = snd_hda_codec_dev_release; +- codec->core.exec_verb = codec_exec_verb; +- + codec->card = card; + codec->addr = codec_addr; +- mutex_init(&codec->spdif_mutex); +- mutex_init(&codec->control_mutex); +- snd_array_init(&codec->mixers, sizeof(struct hda_nid_item), 32); +- snd_array_init(&codec->nids, sizeof(struct hda_nid_item), 32); +- snd_array_init(&codec->init_pins, sizeof(struct hda_pincfg), 16); +- snd_array_init(&codec->driver_pins, sizeof(struct hda_pincfg), 16); +- snd_array_init(&codec->cvt_setups, sizeof(struct hda_cvt_setup), 8); +- snd_array_init(&codec->spdif_out, sizeof(struct hda_spdif_out), 16); +- snd_array_init(&codec->jacktbl, sizeof(struct hda_jack_tbl), 16); +- snd_array_init(&codec->verbs, sizeof(struct hda_verb *), 8); +- INIT_LIST_HEAD(&codec->conn_list); +- INIT_LIST_HEAD(&codec->pcm_list_head); +- refcount_set(&codec->pcm_ref, 1); +- init_waitqueue_head(&codec->remove_sleep); +- +- INIT_DELAYED_WORK(&codec->jackpoll_work, hda_jackpoll_work); +- codec->depop_delay = -1; +- codec->fixup_id = HDA_FIXUP_ID_NOT_SET; + + #ifdef CONFIG_PM + codec->power_jiffies = jiffies; +-- +2.35.1 + diff --git a/queue-5.19/alsa-hda-realtek-enable-speaker-and-mute-leds-for-hp.patch b/queue-5.19/alsa-hda-realtek-enable-speaker-and-mute-leds-for-hp.patch new file mode 100644 index 00000000000..e94ac5d89d6 --- /dev/null +++ b/queue-5.19/alsa-hda-realtek-enable-speaker-and-mute-leds-for-hp.patch @@ -0,0 +1,41 @@ +From c2cfa524a41e2117c77e3d9fec46f2b360aeb8b1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Jul 2022 22:20:14 +0800 +Subject: ALSA: hda/realtek: Enable speaker and mute LEDs for HP laptops + +From: Kai-Heng Feng + +[ Upstream commit c578d5da10dc429c6676ab09f3fec0b79b31633a ] + +Two more HP laptops that use cs35l41 AMP for speaker and GPIO for mute +LEDs. + +So use the existing quirk to enable them accordingly. + +[ Sort the entries at the SSID order by tiwai ] + +Signed-off-by: Kai-Heng Feng +Reviewed-by: Lucas Tanure +Link: https://lore.kernel.org/r/20220719142015.244426-1-kai.heng.feng@canonical.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/patch_realtek.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 09d97a8afdda..1ae9674fa8a3 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -9234,6 +9234,8 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x103c, 0x8aa3, "HP ProBook 450 G9 (MB 8AA1)", ALC236_FIXUP_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x8aa8, "HP EliteBook 640 G9 (MB 8AA6)", ALC236_FIXUP_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x8aab, "HP EliteBook 650 G9 (MB 8AA9)", ALC236_FIXUP_HP_GPIO_LED), ++ SND_PCI_QUIRK(0x103c, 0x8ad1, "HP EliteBook 840 14 inch G9 Notebook PC", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED), ++ SND_PCI_QUIRK(0x103c, 0x8ad2, "HP EliteBook 860 16 inch G9 Notebook PC", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED), + SND_PCI_QUIRK(0x1043, 0x103e, "ASUS X540SA", ALC256_FIXUP_ASUS_MIC), + SND_PCI_QUIRK(0x1043, 0x103f, "ASUS TX300", ALC282_FIXUP_ASUS_TX300), + SND_PCI_QUIRK(0x1043, 0x106d, "Asus K53BE", ALC269_FIXUP_LIMIT_INT_MIC_BOOST), +-- +2.35.1 + diff --git a/queue-5.19/alsa-pcm-use-deferred-fasync-helper.patch b/queue-5.19/alsa-pcm-use-deferred-fasync-helper.patch new file mode 100644 index 00000000000..60601d816ac --- /dev/null +++ b/queue-5.19/alsa-pcm-use-deferred-fasync-helper.patch @@ -0,0 +1,79 @@ +From b0b17c8a6078b31400518c75c0ee338b1d501ab6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Jul 2022 14:59:44 +0200 +Subject: ALSA: pcm: Use deferred fasync helper + +From: Takashi Iwai + +[ Upstream commit 96b097091c66df4f6fbf5cbff21df6cc02a2f055 ] + +For avoiding the potential deadlock via kill_fasync() call, use the +new fasync helpers to defer the invocation from timer API. Note that +it's merely a workaround. + +Reported-by: syzbot+8285e973a41b5aa68902@syzkaller.appspotmail.com +Reported-by: syzbot+669c9abf11a6a011dd09@syzkaller.appspotmail.com +Link: https://lore.kernel.org/r/20220728125945.29533-4-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + include/sound/pcm.h | 2 +- + sound/core/pcm.c | 1 + + sound/core/pcm_lib.c | 2 +- + sound/core/pcm_native.c | 2 +- + 4 files changed, 4 insertions(+), 3 deletions(-) + +diff --git a/include/sound/pcm.h b/include/sound/pcm.h +index 6b99310b5b88..6987110843f0 100644 +--- a/include/sound/pcm.h ++++ b/include/sound/pcm.h +@@ -399,7 +399,7 @@ struct snd_pcm_runtime { + snd_pcm_uframes_t twake; /* do transfer (!poll) wakeup if non-zero */ + wait_queue_head_t sleep; /* poll sleep */ + wait_queue_head_t tsleep; /* transfer sleep */ +- struct fasync_struct *fasync; ++ struct snd_fasync *fasync; + bool stop_operating; /* sync_stop will be called */ + struct mutex buffer_mutex; /* protect for buffer changes */ + atomic_t buffer_accessing; /* >0: in r/w operation, <0: blocked */ +diff --git a/sound/core/pcm.c b/sound/core/pcm.c +index 977d54320a5c..c917ac84a7e5 100644 +--- a/sound/core/pcm.c ++++ b/sound/core/pcm.c +@@ -1005,6 +1005,7 @@ void snd_pcm_detach_substream(struct snd_pcm_substream *substream) + substream->runtime = NULL; + } + mutex_destroy(&runtime->buffer_mutex); ++ snd_fasync_free(runtime->fasync); + kfree(runtime); + put_pid(substream->pid); + substream->pid = NULL; +diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c +index 1fc7c50ffa62..40751e5aff09 100644 +--- a/sound/core/pcm_lib.c ++++ b/sound/core/pcm_lib.c +@@ -1822,7 +1822,7 @@ void snd_pcm_period_elapsed_under_stream_lock(struct snd_pcm_substream *substrea + snd_timer_interrupt(substream->timer, 1); + #endif + _end: +- kill_fasync(&runtime->fasync, SIGIO, POLL_IN); ++ snd_kill_fasync(runtime->fasync, SIGIO, POLL_IN); + } + EXPORT_SYMBOL(snd_pcm_period_elapsed_under_stream_lock); + +diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c +index 4adaee62ef33..16fcf57c6f03 100644 +--- a/sound/core/pcm_native.c ++++ b/sound/core/pcm_native.c +@@ -3945,7 +3945,7 @@ static int snd_pcm_fasync(int fd, struct file * file, int on) + runtime = substream->runtime; + if (runtime->status->state == SNDRV_PCM_STATE_DISCONNECTED) + return -EBADFD; +- return fasync_helper(fd, file, on, &runtime->fasync); ++ return snd_fasync_helper(fd, file, on, &runtime->fasync); + } + + /* +-- +2.35.1 + diff --git a/queue-5.19/alsa-timer-use-deferred-fasync-helper.patch b/queue-5.19/alsa-timer-use-deferred-fasync-helper.patch new file mode 100644 index 00000000000..e914449961c --- /dev/null +++ b/queue-5.19/alsa-timer-use-deferred-fasync-helper.patch @@ -0,0 +1,83 @@ +From abeb03a112b84f7815d9b4e9421c8b8a86fd3c99 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Jul 2022 14:59:43 +0200 +Subject: ALSA: timer: Use deferred fasync helper + +From: Takashi Iwai + +[ Upstream commit 95cc637c1afd83fb7dd3d7c8a53710488f4caf9c ] + +For avoiding the potential deadlock via kill_fasync() call, use the +new fasync helpers to defer the invocation from PCI API. Note that +it's merely a workaround. + +Reported-by: syzbot+1ee0910eca9c94f71f25@syzkaller.appspotmail.com +Reported-by: syzbot+49b10793b867871ee26f@syzkaller.appspotmail.com +Reported-by: syzbot+8285e973a41b5aa68902@syzkaller.appspotmail.com +Link: https://lore.kernel.org/r/20220728125945.29533-3-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/core/timer.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +diff --git a/sound/core/timer.c b/sound/core/timer.c +index b3214baa8919..e08a37c23add 100644 +--- a/sound/core/timer.c ++++ b/sound/core/timer.c +@@ -83,7 +83,7 @@ struct snd_timer_user { + unsigned int filter; + struct timespec64 tstamp; /* trigger tstamp */ + wait_queue_head_t qchange_sleep; +- struct fasync_struct *fasync; ++ struct snd_fasync *fasync; + struct mutex ioctl_lock; + }; + +@@ -1345,7 +1345,7 @@ static void snd_timer_user_interrupt(struct snd_timer_instance *timeri, + } + __wake: + spin_unlock(&tu->qlock); +- kill_fasync(&tu->fasync, SIGIO, POLL_IN); ++ snd_kill_fasync(tu->fasync, SIGIO, POLL_IN); + wake_up(&tu->qchange_sleep); + } + +@@ -1383,7 +1383,7 @@ static void snd_timer_user_ccallback(struct snd_timer_instance *timeri, + spin_lock_irqsave(&tu->qlock, flags); + snd_timer_user_append_to_tqueue(tu, &r1); + spin_unlock_irqrestore(&tu->qlock, flags); +- kill_fasync(&tu->fasync, SIGIO, POLL_IN); ++ snd_kill_fasync(tu->fasync, SIGIO, POLL_IN); + wake_up(&tu->qchange_sleep); + } + +@@ -1453,7 +1453,7 @@ static void snd_timer_user_tinterrupt(struct snd_timer_instance *timeri, + spin_unlock(&tu->qlock); + if (append == 0) + return; +- kill_fasync(&tu->fasync, SIGIO, POLL_IN); ++ snd_kill_fasync(tu->fasync, SIGIO, POLL_IN); + wake_up(&tu->qchange_sleep); + } + +@@ -1521,6 +1521,7 @@ static int snd_timer_user_release(struct inode *inode, struct file *file) + snd_timer_instance_free(tu->timeri); + } + mutex_unlock(&tu->ioctl_lock); ++ snd_fasync_free(tu->fasync); + kfree(tu->queue); + kfree(tu->tqueue); + kfree(tu); +@@ -2135,7 +2136,7 @@ static int snd_timer_user_fasync(int fd, struct file * file, int on) + struct snd_timer_user *tu; + + tu = file->private_data; +- return fasync_helper(fd, file, on, &tu->fasync); ++ return snd_fasync_helper(fd, file, on, &tu->fasync); + } + + static ssize_t snd_timer_user_read(struct file *file, char __user *buffer, +-- +2.35.1 + diff --git a/queue-5.19/asoc-codecs-va-macro-use-fsgen-as-clock.patch b/queue-5.19/asoc-codecs-va-macro-use-fsgen-as-clock.patch new file mode 100644 index 00000000000..91e0504e26e --- /dev/null +++ b/queue-5.19/asoc-codecs-va-macro-use-fsgen-as-clock.patch @@ -0,0 +1,70 @@ +From a0bd72bd03dbf77cb242d4fa29744b8e56657b04 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Jul 2022 13:47:49 +0100 +Subject: ASoC: codecs: va-macro: use fsgen as clock + +From: Srinivas Kandagatla + +[ Upstream commit 30097967e0566cac817273ef76add100f6b0f463 ] + +VA Macro fsgen clock is supplied to other LPASS Macros using proper +clock apis, however the internal user uses the registers directly without +clk apis. This approch has race condition where in external users of +the clock might cut the clock while VA macro is actively using this. + +Moving the internal usage to clk apis would provide a proper refcounting +and avoid such race conditions. + +This issue was noticed while headset was pulled out while recording is +in progress and shifting record patch to DMIC. + +Reported-by: Srinivasa Rao Mandadapu +Signed-off-by: Srinivas Kandagatla +Tested-by: Srinivasa Rao Mandadapu +Link: https://lore.kernel.org/r/20220727124749.4604-1-srinivas.kandagatla@linaro.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/lpass-va-macro.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/lpass-va-macro.c b/sound/soc/codecs/lpass-va-macro.c +index d18b56e60433..1ea10dc70748 100644 +--- a/sound/soc/codecs/lpass-va-macro.c ++++ b/sound/soc/codecs/lpass-va-macro.c +@@ -199,6 +199,7 @@ struct va_macro { + struct clk *mclk; + struct clk *macro; + struct clk *dcodec; ++ struct clk *fsgen; + struct clk_hw hw; + struct lpass_macro *pds; + +@@ -467,9 +468,9 @@ static int va_macro_mclk_event(struct snd_soc_dapm_widget *w, + + switch (event) { + case SND_SOC_DAPM_PRE_PMU: +- return va_macro_mclk_enable(va, true); ++ return clk_prepare_enable(va->fsgen); + case SND_SOC_DAPM_POST_PMD: +- return va_macro_mclk_enable(va, false); ++ clk_disable_unprepare(va->fsgen); + } + + return 0; +@@ -1473,6 +1474,12 @@ static int va_macro_probe(struct platform_device *pdev) + if (ret) + goto err_clkout; + ++ va->fsgen = clk_hw_get_clk(&va->hw, "fsgen"); ++ if (IS_ERR(va->fsgen)) { ++ ret = PTR_ERR(va->fsgen); ++ goto err_clkout; ++ } ++ + ret = devm_snd_soc_register_component(dev, &va_macro_component_drv, + va_macro_dais, + ARRAY_SIZE(va_macro_dais)); +-- +2.35.1 + diff --git a/queue-5.19/asoc-intel-avs-set-max-dma-segment-size.patch b/queue-5.19/asoc-intel-avs-set-max-dma-segment-size.patch new file mode 100644 index 00000000000..cd048879b08 --- /dev/null +++ b/queue-5.19/asoc-intel-avs-set-max-dma-segment-size.patch @@ -0,0 +1,43 @@ +From 1e0bbb787d40fd871b855b8be699abd40af32641 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Jul 2022 14:41:48 +0200 +Subject: ASoC: Intel: avs: Set max DMA segment size +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Amadeusz Sławiński + +[ Upstream commit 8544eebc78c96f1834a46b26ade3e7ebe785d10c ] + +Apparently it is possible for code to allocate large buffers which may +cause warnings as reported in [1]. This was fixed for HDA, SOF and +skylake in patchset [2], fix it also for avs driver. + +[1] https://github.com/thesofproject/linux/issues/3430 +[2] https://lore.kernel.org/all/20220215132756.31236-1-tiwai@suse.de/ + +Signed-off-by: Amadeusz Sławiński +Signed-off-by: Cezary Rojewski +Link: https://lore.kernel.org/r/20220707124153.1858249-8-cezary.rojewski@intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/avs/core.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/soc/intel/avs/core.c b/sound/soc/intel/avs/core.c +index 3a0997c3af2b..cf373969bb69 100644 +--- a/sound/soc/intel/avs/core.c ++++ b/sound/soc/intel/avs/core.c +@@ -445,6 +445,7 @@ static int avs_pci_probe(struct pci_dev *pci, const struct pci_device_id *id) + dma_set_mask(dev, DMA_BIT_MASK(32)); + dma_set_coherent_mask(dev, DMA_BIT_MASK(32)); + } ++ dma_set_max_seg_size(dev, UINT_MAX); + + ret = avs_hdac_bus_init_streams(bus); + if (ret < 0) { +-- +2.35.1 + diff --git a/queue-5.19/asoc-intel-sof_es8336-fix-gpio-quirks-set-via-module.patch b/queue-5.19/asoc-intel-sof_es8336-fix-gpio-quirks-set-via-module.patch new file mode 100644 index 00000000000..b8e5dc6a0f7 --- /dev/null +++ b/queue-5.19/asoc-intel-sof_es8336-fix-gpio-quirks-set-via-module.patch @@ -0,0 +1,81 @@ +From 79cbc64f5bbda051dbda205928dd67c783f31661 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Jul 2022 14:49:02 -0500 +Subject: ASoC: Intel: sof_es8336: Fix GPIO quirks set via module option + +From: Andrey Turkin + +[ Upstream commit 5e60f1cfb830342304200437121f440b72b54f54 ] + +The two GPIO quirk bits only affected actual GPIO selection +when set by the quirks table. They were reported as being +in effect when set via module options but actually did nothing. + +Reviewed-by: Andy Shevchenko +Signed-off-by: Andrey Turkin +Signed-off-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20220725194909.145418-4-pierre-louis.bossart@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/sof_es8336.c | 23 ++++++++++++----------- + 1 file changed, 12 insertions(+), 11 deletions(-) + +diff --git a/sound/soc/intel/boards/sof_es8336.c b/sound/soc/intel/boards/sof_es8336.c +index 23d03e0f7759..4d0c361fc277 100644 +--- a/sound/soc/intel/boards/sof_es8336.c ++++ b/sound/soc/intel/boards/sof_es8336.c +@@ -77,8 +77,6 @@ static const struct acpi_gpio_mapping acpi_enable_both_gpios_rev_order[] = { + { } + }; + +-static const struct acpi_gpio_mapping *gpio_mapping = acpi_speakers_enable_gpio0; +- + static void log_quirks(struct device *dev) + { + dev_info(dev, "quirk mask %#lx\n", quirk); +@@ -272,15 +270,6 @@ static int sof_es8336_quirk_cb(const struct dmi_system_id *id) + { + quirk = (unsigned long)id->driver_data; + +- if (quirk & SOF_ES8336_HEADPHONE_GPIO) { +- if (quirk & SOF_ES8336_SPEAKERS_EN_GPIO1_QUIRK) +- gpio_mapping = acpi_enable_both_gpios; +- else +- gpio_mapping = acpi_enable_both_gpios_rev_order; +- } else if (quirk & SOF_ES8336_SPEAKERS_EN_GPIO1_QUIRK) { +- gpio_mapping = acpi_speakers_enable_gpio1; +- } +- + return 1; + } + +@@ -529,6 +518,7 @@ static int sof_es8336_probe(struct platform_device *pdev) + struct acpi_device *adev; + struct snd_soc_dai_link *dai_links; + struct device *codec_dev; ++ const struct acpi_gpio_mapping *gpio_mapping; + unsigned int cnt = 0; + int dmic_be_num = 0; + int hdmi_num = 3; +@@ -635,6 +625,17 @@ static int sof_es8336_probe(struct platform_device *pdev) + } + + /* get speaker enable GPIO */ ++ if (quirk & SOF_ES8336_HEADPHONE_GPIO) { ++ if (quirk & SOF_ES8336_SPEAKERS_EN_GPIO1_QUIRK) ++ gpio_mapping = acpi_enable_both_gpios; ++ else ++ gpio_mapping = acpi_enable_both_gpios_rev_order; ++ } else if (quirk & SOF_ES8336_SPEAKERS_EN_GPIO1_QUIRK) { ++ gpio_mapping = acpi_speakers_enable_gpio1; ++ } else { ++ gpio_mapping = acpi_speakers_enable_gpio0; ++ } ++ + ret = devm_acpi_dev_add_driver_gpios(codec_dev, gpio_mapping); + if (ret) + dev_warn(codec_dev, "unable to add GPIO mapping table\n"); +-- +2.35.1 + diff --git a/queue-5.19/asoc-intel-sof_es8336-ignore-gpioint-when-looking-fo.patch b/queue-5.19/asoc-intel-sof_es8336-ignore-gpioint-when-looking-fo.patch new file mode 100644 index 00000000000..2c02a564ff5 --- /dev/null +++ b/queue-5.19/asoc-intel-sof_es8336-ignore-gpioint-when-looking-fo.patch @@ -0,0 +1,62 @@ +From ee53231c52f69c2eb5397f142cef2100ef5c2440 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Jul 2022 14:49:03 -0500 +Subject: ASoC: Intel: sof_es8336: ignore GpioInt when looking for + speaker/headset GPIO lines + +From: Andrey Turkin + +[ Upstream commit 751e77011f7a43a204bf2a5d02fbf5f8219bc531 ] + +This fixes speaker GPIO detection on machines those ACPI tables +list their jack detection GpioInt before output GpioIo. +GpioInt entry can never be the speaker/headphone amplifier control +so it makes sense to only look for GpioIo entries when looking for them. + +Reviewed-by: Andy Shevchenko +Signed-off-by: Andrey Turkin +Signed-off-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20220725194909.145418-5-pierre-louis.bossart@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/sof_es8336.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/sound/soc/intel/boards/sof_es8336.c b/sound/soc/intel/boards/sof_es8336.c +index 4d0c361fc277..d70d8255b8c7 100644 +--- a/sound/soc/intel/boards/sof_es8336.c ++++ b/sound/soc/intel/boards/sof_es8336.c +@@ -57,23 +57,23 @@ static const struct acpi_gpio_params enable_gpio0 = { 0, 0, true }; + static const struct acpi_gpio_params enable_gpio1 = { 1, 0, true }; + + static const struct acpi_gpio_mapping acpi_speakers_enable_gpio0[] = { +- { "speakers-enable-gpios", &enable_gpio0, 1 }, ++ { "speakers-enable-gpios", &enable_gpio0, 1, ACPI_GPIO_QUIRK_ONLY_GPIOIO }, + { } + }; + + static const struct acpi_gpio_mapping acpi_speakers_enable_gpio1[] = { +- { "speakers-enable-gpios", &enable_gpio1, 1 }, ++ { "speakers-enable-gpios", &enable_gpio1, 1, ACPI_GPIO_QUIRK_ONLY_GPIOIO }, + }; + + static const struct acpi_gpio_mapping acpi_enable_both_gpios[] = { +- { "speakers-enable-gpios", &enable_gpio0, 1 }, +- { "headphone-enable-gpios", &enable_gpio1, 1 }, ++ { "speakers-enable-gpios", &enable_gpio0, 1, ACPI_GPIO_QUIRK_ONLY_GPIOIO }, ++ { "headphone-enable-gpios", &enable_gpio1, 1, ACPI_GPIO_QUIRK_ONLY_GPIOIO }, + { } + }; + + static const struct acpi_gpio_mapping acpi_enable_both_gpios_rev_order[] = { +- { "speakers-enable-gpios", &enable_gpio1, 1 }, +- { "headphone-enable-gpios", &enable_gpio0, 1 }, ++ { "speakers-enable-gpios", &enable_gpio1, 1, ACPI_GPIO_QUIRK_ONLY_GPIOIO }, ++ { "headphone-enable-gpios", &enable_gpio0, 1, ACPI_GPIO_QUIRK_ONLY_GPIOIO }, + { } + }; + +-- +2.35.1 + diff --git a/queue-5.19/asoc-intel-sof_nau8825-move-quirk-check-to-the-front.patch b/queue-5.19/asoc-intel-sof_nau8825-move-quirk-check-to-the-front.patch new file mode 100644 index 00000000000..a71caf9d025 --- /dev/null +++ b/queue-5.19/asoc-intel-sof_nau8825-move-quirk-check-to-the-front.patch @@ -0,0 +1,54 @@ +From c5fba0e46cac996f7aaeb279b63a998d44989758 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Jul 2022 14:49:09 -0500 +Subject: ASoC: Intel: sof_nau8825: Move quirk check to the front in late probe + +From: Yong Zhi + +[ Upstream commit 5b56db90bbaf9d8581e5e6268727d8ad706555e4 ] + +The sof_rt5682_quirk check was placed in the middle of +hdmi handling code, move it to the front to be consistent +with sof_rt5682.c/sof_card_late_probe(). + +Reviewed-by: Ranjani Sridharan +Signed-off-by: Yong Zhi +Signed-off-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20220725194909.145418-11-pierre-louis.bossart@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/sof_nau8825.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/sound/soc/intel/boards/sof_nau8825.c b/sound/soc/intel/boards/sof_nau8825.c +index 97dcd204a246..9b3a2ff4d9cd 100644 +--- a/sound/soc/intel/boards/sof_nau8825.c ++++ b/sound/soc/intel/boards/sof_nau8825.c +@@ -177,11 +177,6 @@ static int sof_card_late_probe(struct snd_soc_card *card) + struct sof_hdmi_pcm *pcm; + int err; + +- if (list_empty(&ctx->hdmi_pcm_list)) +- return -EINVAL; +- +- pcm = list_first_entry(&ctx->hdmi_pcm_list, struct sof_hdmi_pcm, head); +- + if (sof_nau8825_quirk & SOF_MAX98373_SPEAKER_AMP_PRESENT) { + /* Disable Left and Right Spk pin after boot */ + snd_soc_dapm_disable_pin(dapm, "Left Spk"); +@@ -191,6 +186,11 @@ static int sof_card_late_probe(struct snd_soc_card *card) + return err; + } + ++ if (list_empty(&ctx->hdmi_pcm_list)) ++ return -EINVAL; ++ ++ pcm = list_first_entry(&ctx->hdmi_pcm_list, struct sof_hdmi_pcm, head); ++ + return hda_dsp_hdmi_build_controls(card, pcm->codec_dai->component); + } + +-- +2.35.1 + diff --git a/queue-5.19/asoc-nau8821-don-t-unconditionally-free-interrupt.patch b/queue-5.19/asoc-nau8821-don-t-unconditionally-free-interrupt.patch new file mode 100644 index 00000000000..f553d0fc757 --- /dev/null +++ b/queue-5.19/asoc-nau8821-don-t-unconditionally-free-interrupt.patch @@ -0,0 +1,56 @@ +From 5281dd2aea5ee8ebaadcf2c5b17a16081535ef83 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Jul 2022 15:04:05 +0100 +Subject: ASoC: nau8821: Don't unconditionally free interrupt + +From: Mark Brown + +[ Upstream commit 2d86cef353b8f3d20b16f8c5615742fd6938c801 ] + +The remove() operation unconditionally frees the interrupt for the device +but we may not actually have an interrupt so there might be nothing to +free. Since the interrupt is requested after all other resources we don't +need the explicit free anyway, unwinding is guaranteed to be safe, so just +delete the remove() function and let devm take care of things. + +Reported-by: Zheyu Ma +Signed-off-by: Mark Brown +Tested-by: Zheyu Ma +Link: https://lore.kernel.org/r/20220718140405.57233-1-broonie@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/nau8821.c | 10 ---------- + 1 file changed, 10 deletions(-) + +diff --git a/sound/soc/codecs/nau8821.c b/sound/soc/codecs/nau8821.c +index ce4e7f46bb06..e078d2ffb3f6 100644 +--- a/sound/soc/codecs/nau8821.c ++++ b/sound/soc/codecs/nau8821.c +@@ -1665,15 +1665,6 @@ static int nau8821_i2c_probe(struct i2c_client *i2c) + return ret; + } + +-static int nau8821_i2c_remove(struct i2c_client *i2c_client) +-{ +- struct nau8821 *nau8821 = i2c_get_clientdata(i2c_client); +- +- devm_free_irq(nau8821->dev, nau8821->irq, nau8821); +- +- return 0; +-} +- + static const struct i2c_device_id nau8821_i2c_ids[] = { + { "nau8821", 0 }, + { } +@@ -1703,7 +1694,6 @@ static struct i2c_driver nau8821_driver = { + .acpi_match_table = ACPI_PTR(nau8821_acpi_match), + }, + .probe_new = nau8821_i2c_probe, +- .remove = nau8821_i2c_remove, + .id_table = nau8821_i2c_ids, + }; + module_i2c_driver(nau8821_driver); +-- +2.35.1 + diff --git a/queue-5.19/asoc-rsnd-care-default-case-on-rsnd_ssiu_busif_err_i.patch b/queue-5.19/asoc-rsnd-care-default-case-on-rsnd_ssiu_busif_err_i.patch new file mode 100644 index 00000000000..1e00abf3d8f --- /dev/null +++ b/queue-5.19/asoc-rsnd-care-default-case-on-rsnd_ssiu_busif_err_i.patch @@ -0,0 +1,42 @@ +From 1a3c94cf88cc8638477afea2efb4ac0edd2a165b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Jul 2022 06:28:15 +0000 +Subject: ASoC: rsnd: care default case on rsnd_ssiu_busif_err_irq_ctrl() + +From: Kuninori Morimoto + +[ Upstream commit ef30911d3c39fd57884c348c29b9cbff88def155 ] + +Before, ssiu.c didn't care SSI5-8, thus, +commit b1384d4c95088d0 ("ASoC: rsnd: care default case on +rsnd_ssiu_busif_err_status_clear()") cares it for status clear. + +But we should care it for error irq handling, too. +This patch cares it. + +Reported-by: Nguyen Bao Nguyen +Reported-by: Nishiyama Kunihiko +Signed-off-by: Kuninori Morimoto +Link: https://lore.kernel.org/r/871quocio1.wl-kuninori.morimoto.gx@renesas.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sh/rcar/ssiu.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/sound/soc/sh/rcar/ssiu.c b/sound/soc/sh/rcar/ssiu.c +index 4b8a63e336c7..d7f4646ee029 100644 +--- a/sound/soc/sh/rcar/ssiu.c ++++ b/sound/soc/sh/rcar/ssiu.c +@@ -67,6 +67,8 @@ static void rsnd_ssiu_busif_err_irq_ctrl(struct rsnd_mod *mod, int enable) + shift = 1; + offset = 1; + break; ++ default: ++ return; + } + + for (i = 0; i < 4; i++) { +-- +2.35.1 + diff --git a/queue-5.19/asoc-sof-intel-cnl-do-not-process-ipc-reply-before-f.patch b/queue-5.19/asoc-sof-intel-cnl-do-not-process-ipc-reply-before-f.patch new file mode 100644 index 00000000000..d8153b61985 --- /dev/null +++ b/queue-5.19/asoc-sof-intel-cnl-do-not-process-ipc-reply-before-f.patch @@ -0,0 +1,94 @@ +From 3850543fee9c9de2e8472fd4aa734a0e09709496 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Jul 2022 15:23:55 +0300 +Subject: ASoC: SOF: Intel: cnl: Do not process IPC reply before firmware boot + +From: Peter Ujfalusi + +[ Upstream commit acacd9eefd0def5a83244d88e5483b5f38ee7287 ] + +It is not yet clear, but it is possible to create a firmware so broken +that it will send a reply message before a FW_READY message (it is not +yet clear if FW_READY will arrive later). +Since the reply_data is allocated only after the FW_READY message, this +will lead to a NULL pointer dereference if not filtered out. + +The issue was reported with IPC4 firmware but the same condition is present +for IPC3. + +Reported-by: Kai Vehmanen +Signed-off-by: Peter Ujfalusi +Reviewed-by: Ranjani Sridharan +Reviewed-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20220712122357.31282-2-peter.ujfalusi@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/intel/cnl.c | 37 ++++++++++++++++++++++++------------- + 1 file changed, 24 insertions(+), 13 deletions(-) + +diff --git a/sound/soc/sof/intel/cnl.c b/sound/soc/sof/intel/cnl.c +index cd6e5f8a5eb4..6c98f65635fc 100644 +--- a/sound/soc/sof/intel/cnl.c ++++ b/sound/soc/sof/intel/cnl.c +@@ -60,17 +60,23 @@ irqreturn_t cnl_ipc4_irq_thread(int irq, void *context) + + if (primary & SOF_IPC4_MSG_DIR_MASK) { + /* Reply received */ +- struct sof_ipc4_msg *data = sdev->ipc->msg.reply_data; ++ if (likely(sdev->fw_state == SOF_FW_BOOT_COMPLETE)) { ++ struct sof_ipc4_msg *data = sdev->ipc->msg.reply_data; + +- data->primary = primary; +- data->extension = extension; ++ data->primary = primary; ++ data->extension = extension; + +- spin_lock_irq(&sdev->ipc_lock); ++ spin_lock_irq(&sdev->ipc_lock); + +- snd_sof_ipc_get_reply(sdev); +- snd_sof_ipc_reply(sdev, data->primary); ++ snd_sof_ipc_get_reply(sdev); ++ snd_sof_ipc_reply(sdev, data->primary); + +- spin_unlock_irq(&sdev->ipc_lock); ++ spin_unlock_irq(&sdev->ipc_lock); ++ } else { ++ dev_dbg_ratelimited(sdev->dev, ++ "IPC reply before FW_READY: %#x|%#x\n", ++ primary, extension); ++ } + } else { + /* Notification received */ + notification_data.primary = primary; +@@ -124,15 +130,20 @@ irqreturn_t cnl_ipc_irq_thread(int irq, void *context) + CNL_DSP_REG_HIPCCTL, + CNL_DSP_REG_HIPCCTL_DONE, 0); + +- spin_lock_irq(&sdev->ipc_lock); ++ if (likely(sdev->fw_state == SOF_FW_BOOT_COMPLETE)) { ++ spin_lock_irq(&sdev->ipc_lock); + +- /* handle immediate reply from DSP core */ +- hda_dsp_ipc_get_reply(sdev); +- snd_sof_ipc_reply(sdev, msg); ++ /* handle immediate reply from DSP core */ ++ hda_dsp_ipc_get_reply(sdev); ++ snd_sof_ipc_reply(sdev, msg); + +- cnl_ipc_dsp_done(sdev); ++ cnl_ipc_dsp_done(sdev); + +- spin_unlock_irq(&sdev->ipc_lock); ++ spin_unlock_irq(&sdev->ipc_lock); ++ } else { ++ dev_dbg_ratelimited(sdev->dev, "IPC reply before FW_READY: %#x\n", ++ msg); ++ } + + ipc_irq = true; + } +-- +2.35.1 + diff --git a/queue-5.19/asoc-sof-intel-hda-add-sanity-check-on-ssp-index-rep.patch b/queue-5.19/asoc-sof-intel-hda-add-sanity-check-on-ssp-index-rep.patch new file mode 100644 index 00000000000..f725b74caa5 --- /dev/null +++ b/queue-5.19/asoc-sof-intel-hda-add-sanity-check-on-ssp-index-rep.patch @@ -0,0 +1,50 @@ +From 7b3e48bab2a5e30e324d570bebb2ab29155ceb30 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Jul 2022 14:53:41 -0500 +Subject: ASoC: SOF: Intel: hda: add sanity check on SSP index reported by NHLT + +From: Pierre-Louis Bossart + +[ Upstream commit e51699505042fb365df3a0ce68b850ccd9ad0108 ] + +We should have a limited trust in the BIOS and verify that the SSP +index reported in NHLT is valid for each platform. + +Signed-off-by: Pierre-Louis Bossart +Reviewed-by: Ranjani Sridharan +Reviewed-by: Bard Liao +Link: https://lore.kernel.org/r/20220725195343.145603-2-pierre-louis.bossart@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/intel/hda.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/sound/soc/sof/intel/hda.c b/sound/soc/sof/intel/hda.c +index ed495b7ad1a9..17f2f3a982c3 100644 +--- a/sound/soc/sof/intel/hda.c ++++ b/sound/soc/sof/intel/hda.c +@@ -1395,6 +1395,7 @@ struct snd_soc_acpi_mach *hda_machine_select(struct snd_sof_dev *sdev) + + if (mach->tplg_quirk_mask & SND_SOC_ACPI_TPLG_INTEL_SSP_NUMBER && + mach->mach_params.i2s_link_mask) { ++ const struct sof_intel_dsp_desc *chip = get_chip_info(sdev->pdata); + int ssp_num; + + if (hweight_long(mach->mach_params.i2s_link_mask) > 1 && +@@ -1404,6 +1405,12 @@ struct snd_soc_acpi_mach *hda_machine_select(struct snd_sof_dev *sdev) + /* fls returns 1-based results, SSPs indices are 0-based */ + ssp_num = fls(mach->mach_params.i2s_link_mask) - 1; + ++ if (ssp_num >= chip->ssp_count) { ++ dev_err(sdev->dev, "Invalid SSP %d, max on this platform is %d\n", ++ ssp_num, chip->ssp_count); ++ return NULL; ++ } ++ + tplg_filename = devm_kasprintf(sdev->dev, GFP_KERNEL, + "%s%s%d", + sof_pdata->tplg_filename, +-- +2.35.1 + diff --git a/queue-5.19/asoc-sof-intel-hda-ipc-do-not-process-ipc-reply-befo.patch b/queue-5.19/asoc-sof-intel-hda-ipc-do-not-process-ipc-reply-befo.patch new file mode 100644 index 00000000000..2c86aeeddd3 --- /dev/null +++ b/queue-5.19/asoc-sof-intel-hda-ipc-do-not-process-ipc-reply-befo.patch @@ -0,0 +1,97 @@ +From a0292afc0874b5eafad38275e5d4ff8f69c3ba3b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Jul 2022 15:23:56 +0300 +Subject: ASoC: SOF: Intel: hda-ipc: Do not process IPC reply before firmware + boot + +From: Peter Ujfalusi + +[ Upstream commit 499cc881b09c8283ab5e75b0d6d21cb427722161 ] + +It is not yet clear, but it is possible to create a firmware so broken +that it will send a reply message before a FW_READY message (it is not +yet clear if FW_READY will arrive later). +Since the reply_data is allocated only after the FW_READY message, this +will lead to a NULL pointer dereference if not filtered out. + +The issue was reported with IPC4 firmware but the same condition is present +for IPC3. + +Reported-by: Kai Vehmanen +Signed-off-by: Peter Ujfalusi +Reviewed-by: Ranjani Sridharan +Reviewed-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20220712122357.31282-3-peter.ujfalusi@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/intel/hda-ipc.c | 39 ++++++++++++++++++++++------------- + 1 file changed, 25 insertions(+), 14 deletions(-) + +diff --git a/sound/soc/sof/intel/hda-ipc.c b/sound/soc/sof/intel/hda-ipc.c +index f08011249955..65e688f749ea 100644 +--- a/sound/soc/sof/intel/hda-ipc.c ++++ b/sound/soc/sof/intel/hda-ipc.c +@@ -148,17 +148,23 @@ irqreturn_t hda_dsp_ipc4_irq_thread(int irq, void *context) + + if (primary & SOF_IPC4_MSG_DIR_MASK) { + /* Reply received */ +- struct sof_ipc4_msg *data = sdev->ipc->msg.reply_data; ++ if (likely(sdev->fw_state == SOF_FW_BOOT_COMPLETE)) { ++ struct sof_ipc4_msg *data = sdev->ipc->msg.reply_data; + +- data->primary = primary; +- data->extension = extension; ++ data->primary = primary; ++ data->extension = extension; + +- spin_lock_irq(&sdev->ipc_lock); ++ spin_lock_irq(&sdev->ipc_lock); + +- snd_sof_ipc_get_reply(sdev); +- snd_sof_ipc_reply(sdev, data->primary); ++ snd_sof_ipc_get_reply(sdev); ++ snd_sof_ipc_reply(sdev, data->primary); + +- spin_unlock_irq(&sdev->ipc_lock); ++ spin_unlock_irq(&sdev->ipc_lock); ++ } else { ++ dev_dbg_ratelimited(sdev->dev, ++ "IPC reply before FW_READY: %#x|%#x\n", ++ primary, extension); ++ } + } else { + /* Notification received */ + +@@ -225,16 +231,21 @@ irqreturn_t hda_dsp_ipc_irq_thread(int irq, void *context) + * place, the message might not yet be marked as expecting a + * reply. + */ +- spin_lock_irq(&sdev->ipc_lock); ++ if (likely(sdev->fw_state == SOF_FW_BOOT_COMPLETE)) { ++ spin_lock_irq(&sdev->ipc_lock); + +- /* handle immediate reply from DSP core */ +- hda_dsp_ipc_get_reply(sdev); +- snd_sof_ipc_reply(sdev, msg); ++ /* handle immediate reply from DSP core */ ++ hda_dsp_ipc_get_reply(sdev); ++ snd_sof_ipc_reply(sdev, msg); + +- /* set the done bit */ +- hda_dsp_ipc_dsp_done(sdev); ++ /* set the done bit */ ++ hda_dsp_ipc_dsp_done(sdev); + +- spin_unlock_irq(&sdev->ipc_lock); ++ spin_unlock_irq(&sdev->ipc_lock); ++ } else { ++ dev_dbg_ratelimited(sdev->dev, "IPC reply before FW_READY: %#x\n", ++ msg); ++ } + + ipc_irq = true; + } +-- +2.35.1 + diff --git a/queue-5.19/asoc-sof-sof-client-probes-only-load-the-driver-if-i.patch b/queue-5.19/asoc-sof-sof-client-probes-only-load-the-driver-if-i.patch new file mode 100644 index 00000000000..697bf00b651 --- /dev/null +++ b/queue-5.19/asoc-sof-sof-client-probes-only-load-the-driver-if-i.patch @@ -0,0 +1,40 @@ +From c0c6f40d13f12519a476f3aea9c86459d527e83e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Jul 2022 16:10:22 +0300 +Subject: ASoC: SOF: sof-client-probes: Only load the driver if IPC3 is used + +From: Peter Ujfalusi + +[ Upstream commit 9b93eda355089b36482f7a2f134bdd24be70f907 ] + +The current implementation of probes only supports IPC3 and should not be +loaded for other IPC implementation. + +Signed-off-by: Peter Ujfalusi +Reviewed-by: Pierre-Louis Bossart +Reviewed-by: Ranjani Sridharan +Link: https://lore.kernel.org/r/20220712131022.1124-1-peter.ujfalusi@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/sof-client-probes.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/sound/soc/sof/sof-client-probes.c b/sound/soc/sof/sof-client-probes.c +index 34e6bd356e71..60e4250fac87 100644 +--- a/sound/soc/sof/sof-client-probes.c ++++ b/sound/soc/sof/sof-client-probes.c +@@ -693,6 +693,10 @@ static int sof_probes_client_probe(struct auxiliary_device *auxdev, + if (!sof_probes_enabled) + return -ENXIO; + ++ /* only ipc3 is supported */ ++ if (sof_client_get_ipc_type(cdev) != SOF_IPC) ++ return -ENXIO; ++ + if (!dev->platform_data) { + dev_err(dev, "missing platform data\n"); + return -ENODEV; +-- +2.35.1 + diff --git a/queue-5.19/clk-qcom-clk-alpha-pll-fix-clk_trion_pll_configure-d.patch b/queue-5.19/clk-qcom-clk-alpha-pll-fix-clk_trion_pll_configure-d.patch new file mode 100644 index 00000000000..1b06eb8c5a6 --- /dev/null +++ b/queue-5.19/clk-qcom-clk-alpha-pll-fix-clk_trion_pll_configure-d.patch @@ -0,0 +1,40 @@ +From e03ac36a8d597b99e33f6423b2df914415a5673f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Jul 2022 09:27:11 +0300 +Subject: clk: qcom: clk-alpha-pll: fix clk_trion_pll_configure description + +From: Vladimir Zapolskiy + +[ Upstream commit 94bed9bb05c7850ff5d80b87cc29004901f37956 ] + +After merging lucid and trion pll functions in commit 0b01489475c6 +("clk: qcom: clk-alpha-pll: same regs and ops for trion and lucid") +the function clk_trion_pll_configure() is left with an old description +header, which results in a W=2 compile time warning, fix it. + +Acked-by: Stephen Boyd +Reviewed-by: Vinod Koul +Signed-off-by: Vladimir Zapolskiy +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20220701062711.2757855-1-vladimir.zapolskiy@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/clk-alpha-pll.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/qcom/clk-alpha-pll.c b/drivers/clk/qcom/clk-alpha-pll.c +index 4406cf609aae..288692f0ea39 100644 +--- a/drivers/clk/qcom/clk-alpha-pll.c ++++ b/drivers/clk/qcom/clk-alpha-pll.c +@@ -1439,7 +1439,7 @@ const struct clk_ops clk_alpha_pll_postdiv_fabia_ops = { + EXPORT_SYMBOL_GPL(clk_alpha_pll_postdiv_fabia_ops); + + /** +- * clk_lucid_pll_configure - configure the lucid pll ++ * clk_trion_pll_configure - configure the trion pll + * + * @pll: clk alpha pll + * @regmap: register map +-- +2.35.1 + diff --git a/queue-5.19/clk-qcom-ipq8074-dont-disable-gcc_sleep_clk_src.patch b/queue-5.19/clk-qcom-ipq8074-dont-disable-gcc_sleep_clk_src.patch new file mode 100644 index 00000000000..7d69aeaacb4 --- /dev/null +++ b/queue-5.19/clk-qcom-ipq8074-dont-disable-gcc_sleep_clk_src.patch @@ -0,0 +1,85 @@ +From 5f8256e3c75dc67393372bee5586d2432276776f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 15 May 2022 23:00:47 +0200 +Subject: clk: qcom: ipq8074: dont disable gcc_sleep_clk_src + +From: Robert Marko + +[ Upstream commit 1bf7305e79aab095196131bdc87a97796e0e3fac ] + +Once the usb sleep clocks are disabled, clock framework is trying to +disable the sleep clock source also. + +However, it seems that it cannot be disabled and trying to do so produces: +[ 245.436390] ------------[ cut here ]------------ +[ 245.441233] gcc_sleep_clk_src status stuck at 'on' +[ 245.441254] WARNING: CPU: 2 PID: 223 at clk_branch_wait+0x130/0x140 +[ 245.450435] Modules linked in: xhci_plat_hcd xhci_hcd dwc3 dwc3_qcom leds_gpio +[ 245.456601] CPU: 2 PID: 223 Comm: sh Not tainted 5.18.0-rc4 #215 +[ 245.463889] Hardware name: Xiaomi AX9000 (DT) +[ 245.470050] pstate: 204000c5 (nzCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) +[ 245.474307] pc : clk_branch_wait+0x130/0x140 +[ 245.481073] lr : clk_branch_wait+0x130/0x140 +[ 245.485588] sp : ffffffc009f2bad0 +[ 245.489838] x29: ffffffc009f2bad0 x28: ffffff8003e6c800 x27: 0000000000000000 +[ 245.493057] x26: 0000000000000000 x25: 0000000000000000 x24: ffffff800226ef20 +[ 245.500175] x23: ffffffc0089ff550 x22: 0000000000000000 x21: ffffffc008476ad0 +[ 245.507294] x20: 0000000000000000 x19: ffffffc00965ac70 x18: fffffffffffc51a7 +[ 245.514413] x17: 68702e3030303837 x16: 3a6d726f6674616c x15: ffffffc089f2b777 +[ 245.521531] x14: ffffffc0095c9d18 x13: 0000000000000129 x12: 0000000000000129 +[ 245.528649] x11: 00000000ffffffea x10: ffffffc009621d18 x9 : 0000000000000001 +[ 245.535767] x8 : 0000000000000001 x7 : 0000000000017fe8 x6 : 0000000000000001 +[ 245.542885] x5 : ffffff803fdca6d8 x4 : 0000000000000000 x3 : 0000000000000027 +[ 245.550002] x2 : 0000000000000027 x1 : 0000000000000023 x0 : 0000000000000026 +[ 245.557122] Call trace: +[ 245.564229] clk_branch_wait+0x130/0x140 +[ 245.566490] clk_branch2_disable+0x2c/0x40 +[ 245.570656] clk_core_disable+0x60/0xb0 +[ 245.574561] clk_core_disable+0x68/0xb0 +[ 245.578293] clk_disable+0x30/0x50 +[ 245.582113] dwc3_qcom_remove+0x60/0xc0 [dwc3_qcom] +[ 245.585588] platform_remove+0x28/0x60 +[ 245.590361] device_remove+0x4c/0x80 +[ 245.594179] device_release_driver_internal+0x1dc/0x230 +[ 245.597914] device_driver_detach+0x18/0x30 +[ 245.602861] unbind_store+0xec/0x110 +[ 245.607027] drv_attr_store+0x24/0x40 +[ 245.610847] sysfs_kf_write+0x44/0x60 +[ 245.614405] kernfs_fop_write_iter+0x128/0x1c0 +[ 245.618052] new_sync_write+0xc0/0x130 +[ 245.622391] vfs_write+0x1d4/0x2a0 +[ 245.626123] ksys_write+0x58/0xe0 +[ 245.629508] __arm64_sys_write+0x1c/0x30 +[ 245.632895] invoke_syscall.constprop.0+0x5c/0x110 +[ 245.636890] do_el0_svc+0xa0/0x150 +[ 245.641488] el0_svc+0x18/0x60 +[ 245.644872] el0t_64_sync_handler+0xa4/0x130 +[ 245.647914] el0t_64_sync+0x174/0x178 +[ 245.652340] ---[ end trace 0000000000000000 ]--- + +So, add CLK_IS_CRITICAL flag to the clock so that the kernel won't try +to disable the sleep clock. + +Signed-off-by: Robert Marko +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20220515210048.483898-10-robimarko@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/gcc-ipq8074.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/clk/qcom/gcc-ipq8074.c b/drivers/clk/qcom/gcc-ipq8074.c +index 2c2ecfc5e61f..d6d5defb82c9 100644 +--- a/drivers/clk/qcom/gcc-ipq8074.c ++++ b/drivers/clk/qcom/gcc-ipq8074.c +@@ -662,6 +662,7 @@ static struct clk_branch gcc_sleep_clk_src = { + }, + .num_parents = 1, + .ops = &clk_branch2_ops, ++ .flags = CLK_IS_CRITICAL, + }, + }, + }; +-- +2.35.1 + diff --git a/queue-5.19/clk-ti-stop-using-legacy-clkctrl-names-for-omap4-and.patch b/queue-5.19/clk-ti-stop-using-legacy-clkctrl-names-for-omap4-and.patch new file mode 100644 index 00000000000..49adba6a20b --- /dev/null +++ b/queue-5.19/clk-ti-stop-using-legacy-clkctrl-names-for-omap4-and.patch @@ -0,0 +1,682 @@ +From 7058b3526542083de4810ad1af11677243bf8efb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Jun 2022 09:43:06 +0300 +Subject: clk: ti: Stop using legacy clkctrl names for omap4 and 5 + +From: Tony Lindgren + +[ Upstream commit 255584b138343d4a28c6d25bd82d04b09460d672 ] + +With the addition of clock-output-names, we can now unify the internal +clock naming for omap4 and 5 to follow the other TI SoCs. + +We are still using legacy clkctrl names for omap4 and 5 based on the clock +manager name which is wrong. Instead, we want to use the clkctrl clock +based naming. + +We must now also drop the legacy TI_CLK_CLKCTRL_COMPAT quirk for the +clkctrl clock. + +This change will allow further devicetree warning cleanup as already +done for am3/4 and dra7. + +Cc: linux-clk@vger.kernel.org +Cc: Stephen Boyd +Cc: Tero Kristo +Signed-off-by: Tony Lindgren +Link: https://lore.kernel.org/r/20220615064306.22254-1-tony@atomide.com +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/ti/clk-44xx.c | 210 +++++++++++++++++++------------------- + drivers/clk/ti/clk-54xx.c | 160 ++++++++++++++--------------- + drivers/clk/ti/clkctrl.c | 4 - + 3 files changed, 185 insertions(+), 189 deletions(-) + +diff --git a/drivers/clk/ti/clk-44xx.c b/drivers/clk/ti/clk-44xx.c +index d078e5d73ed9..868bc7af21b0 100644 +--- a/drivers/clk/ti/clk-44xx.c ++++ b/drivers/clk/ti/clk-44xx.c +@@ -56,7 +56,7 @@ static const struct omap_clkctrl_bit_data omap4_aess_bit_data[] __initconst = { + }; + + static const char * const omap4_func_dmic_abe_gfclk_parents[] __initconst = { +- "abe_cm:clk:0018:26", ++ "abe-clkctrl:0018:26", + "pad_clks_ck", + "slimbus_clk", + NULL, +@@ -76,7 +76,7 @@ static const struct omap_clkctrl_bit_data omap4_dmic_bit_data[] __initconst = { + }; + + static const char * const omap4_func_mcasp_abe_gfclk_parents[] __initconst = { +- "abe_cm:clk:0020:26", ++ "abe-clkctrl:0020:26", + "pad_clks_ck", + "slimbus_clk", + NULL, +@@ -89,7 +89,7 @@ static const struct omap_clkctrl_bit_data omap4_mcasp_bit_data[] __initconst = { + }; + + static const char * const omap4_func_mcbsp1_gfclk_parents[] __initconst = { +- "abe_cm:clk:0028:26", ++ "abe-clkctrl:0028:26", + "pad_clks_ck", + "slimbus_clk", + NULL, +@@ -102,7 +102,7 @@ static const struct omap_clkctrl_bit_data omap4_mcbsp1_bit_data[] __initconst = + }; + + static const char * const omap4_func_mcbsp2_gfclk_parents[] __initconst = { +- "abe_cm:clk:0030:26", ++ "abe-clkctrl:0030:26", + "pad_clks_ck", + "slimbus_clk", + NULL, +@@ -115,7 +115,7 @@ static const struct omap_clkctrl_bit_data omap4_mcbsp2_bit_data[] __initconst = + }; + + static const char * const omap4_func_mcbsp3_gfclk_parents[] __initconst = { +- "abe_cm:clk:0038:26", ++ "abe-clkctrl:0038:26", + "pad_clks_ck", + "slimbus_clk", + NULL, +@@ -183,18 +183,18 @@ static const struct omap_clkctrl_bit_data omap4_timer8_bit_data[] __initconst = + + static const struct omap_clkctrl_reg_data omap4_abe_clkctrl_regs[] __initconst = { + { OMAP4_L4_ABE_CLKCTRL, NULL, 0, "ocp_abe_iclk" }, +- { OMAP4_AESS_CLKCTRL, omap4_aess_bit_data, CLKF_SW_SUP, "abe_cm:clk:0008:24" }, ++ { OMAP4_AESS_CLKCTRL, omap4_aess_bit_data, CLKF_SW_SUP, "abe-clkctrl:0008:24" }, + { OMAP4_MCPDM_CLKCTRL, NULL, CLKF_SW_SUP, "pad_clks_ck" }, +- { OMAP4_DMIC_CLKCTRL, omap4_dmic_bit_data, CLKF_SW_SUP, "abe_cm:clk:0018:24" }, +- { OMAP4_MCASP_CLKCTRL, omap4_mcasp_bit_data, CLKF_SW_SUP, "abe_cm:clk:0020:24" }, +- { OMAP4_MCBSP1_CLKCTRL, omap4_mcbsp1_bit_data, CLKF_SW_SUP, "abe_cm:clk:0028:24" }, +- { OMAP4_MCBSP2_CLKCTRL, omap4_mcbsp2_bit_data, CLKF_SW_SUP, "abe_cm:clk:0030:24" }, +- { OMAP4_MCBSP3_CLKCTRL, omap4_mcbsp3_bit_data, CLKF_SW_SUP, "abe_cm:clk:0038:24" }, +- { OMAP4_SLIMBUS1_CLKCTRL, omap4_slimbus1_bit_data, CLKF_SW_SUP, "abe_cm:clk:0040:8" }, +- { OMAP4_TIMER5_CLKCTRL, omap4_timer5_bit_data, CLKF_SW_SUP, "abe_cm:clk:0048:24" }, +- { OMAP4_TIMER6_CLKCTRL, omap4_timer6_bit_data, CLKF_SW_SUP, "abe_cm:clk:0050:24" }, +- { OMAP4_TIMER7_CLKCTRL, omap4_timer7_bit_data, CLKF_SW_SUP, "abe_cm:clk:0058:24" }, +- { OMAP4_TIMER8_CLKCTRL, omap4_timer8_bit_data, CLKF_SW_SUP, "abe_cm:clk:0060:24" }, ++ { OMAP4_DMIC_CLKCTRL, omap4_dmic_bit_data, CLKF_SW_SUP, "abe-clkctrl:0018:24" }, ++ { OMAP4_MCASP_CLKCTRL, omap4_mcasp_bit_data, CLKF_SW_SUP, "abe-clkctrl:0020:24" }, ++ { OMAP4_MCBSP1_CLKCTRL, omap4_mcbsp1_bit_data, CLKF_SW_SUP, "abe-clkctrl:0028:24" }, ++ { OMAP4_MCBSP2_CLKCTRL, omap4_mcbsp2_bit_data, CLKF_SW_SUP, "abe-clkctrl:0030:24" }, ++ { OMAP4_MCBSP3_CLKCTRL, omap4_mcbsp3_bit_data, CLKF_SW_SUP, "abe-clkctrl:0038:24" }, ++ { OMAP4_SLIMBUS1_CLKCTRL, omap4_slimbus1_bit_data, CLKF_SW_SUP, "abe-clkctrl:0040:8" }, ++ { OMAP4_TIMER5_CLKCTRL, omap4_timer5_bit_data, CLKF_SW_SUP, "abe-clkctrl:0048:24" }, ++ { OMAP4_TIMER6_CLKCTRL, omap4_timer6_bit_data, CLKF_SW_SUP, "abe-clkctrl:0050:24" }, ++ { OMAP4_TIMER7_CLKCTRL, omap4_timer7_bit_data, CLKF_SW_SUP, "abe-clkctrl:0058:24" }, ++ { OMAP4_TIMER8_CLKCTRL, omap4_timer8_bit_data, CLKF_SW_SUP, "abe-clkctrl:0060:24" }, + { OMAP4_WD_TIMER3_CLKCTRL, NULL, CLKF_SW_SUP, "sys_32k_ck" }, + { 0 }, + }; +@@ -287,7 +287,7 @@ static const struct omap_clkctrl_bit_data omap4_fdif_bit_data[] __initconst = { + + static const struct omap_clkctrl_reg_data omap4_iss_clkctrl_regs[] __initconst = { + { OMAP4_ISS_CLKCTRL, omap4_iss_bit_data, CLKF_SW_SUP, "ducati_clk_mux_ck" }, +- { OMAP4_FDIF_CLKCTRL, omap4_fdif_bit_data, CLKF_SW_SUP, "iss_cm:clk:0008:24" }, ++ { OMAP4_FDIF_CLKCTRL, omap4_fdif_bit_data, CLKF_SW_SUP, "iss-clkctrl:0008:24" }, + { 0 }, + }; + +@@ -320,7 +320,7 @@ static const struct omap_clkctrl_bit_data omap4_dss_core_bit_data[] __initconst + }; + + static const struct omap_clkctrl_reg_data omap4_l3_dss_clkctrl_regs[] __initconst = { +- { OMAP4_DSS_CORE_CLKCTRL, omap4_dss_core_bit_data, CLKF_SW_SUP, "l3_dss_cm:clk:0000:8" }, ++ { OMAP4_DSS_CORE_CLKCTRL, omap4_dss_core_bit_data, CLKF_SW_SUP, "l3-dss-clkctrl:0000:8" }, + { 0 }, + }; + +@@ -336,7 +336,7 @@ static const struct omap_clkctrl_bit_data omap4_gpu_bit_data[] __initconst = { + }; + + static const struct omap_clkctrl_reg_data omap4_l3_gfx_clkctrl_regs[] __initconst = { +- { OMAP4_GPU_CLKCTRL, omap4_gpu_bit_data, CLKF_SW_SUP, "l3_gfx_cm:clk:0000:24" }, ++ { OMAP4_GPU_CLKCTRL, omap4_gpu_bit_data, CLKF_SW_SUP, "l3-gfx-clkctrl:0000:24" }, + { 0 }, + }; + +@@ -372,12 +372,12 @@ static const struct omap_clkctrl_bit_data omap4_hsi_bit_data[] __initconst = { + }; + + static const char * const omap4_usb_host_hs_utmi_p1_clk_parents[] __initconst = { +- "l3_init_cm:clk:0038:24", ++ "l3-init-clkctrl:0038:24", + NULL, + }; + + static const char * const omap4_usb_host_hs_utmi_p2_clk_parents[] __initconst = { +- "l3_init_cm:clk:0038:25", ++ "l3-init-clkctrl:0038:25", + NULL, + }; + +@@ -418,7 +418,7 @@ static const struct omap_clkctrl_bit_data omap4_usb_host_hs_bit_data[] __initcon + }; + + static const char * const omap4_usb_otg_hs_xclk_parents[] __initconst = { +- "l3_init_cm:clk:0040:24", ++ "l3-init-clkctrl:0040:24", + NULL, + }; + +@@ -452,14 +452,14 @@ static const struct omap_clkctrl_bit_data omap4_ocp2scp_usb_phy_bit_data[] __ini + }; + + static const struct omap_clkctrl_reg_data omap4_l3_init_clkctrl_regs[] __initconst = { +- { OMAP4_MMC1_CLKCTRL, omap4_mmc1_bit_data, CLKF_SW_SUP, "l3_init_cm:clk:0008:24" }, +- { OMAP4_MMC2_CLKCTRL, omap4_mmc2_bit_data, CLKF_SW_SUP, "l3_init_cm:clk:0010:24" }, +- { OMAP4_HSI_CLKCTRL, omap4_hsi_bit_data, CLKF_HW_SUP, "l3_init_cm:clk:0018:24" }, ++ { OMAP4_MMC1_CLKCTRL, omap4_mmc1_bit_data, CLKF_SW_SUP, "l3-init-clkctrl:0008:24" }, ++ { OMAP4_MMC2_CLKCTRL, omap4_mmc2_bit_data, CLKF_SW_SUP, "l3-init-clkctrl:0010:24" }, ++ { OMAP4_HSI_CLKCTRL, omap4_hsi_bit_data, CLKF_HW_SUP, "l3-init-clkctrl:0018:24" }, + { OMAP4_USB_HOST_HS_CLKCTRL, omap4_usb_host_hs_bit_data, CLKF_SW_SUP, "init_60m_fclk" }, + { OMAP4_USB_OTG_HS_CLKCTRL, omap4_usb_otg_hs_bit_data, CLKF_HW_SUP, "l3_div_ck" }, + { OMAP4_USB_TLL_HS_CLKCTRL, omap4_usb_tll_hs_bit_data, CLKF_HW_SUP, "l4_div_ck" }, + { OMAP4_USB_HOST_FS_CLKCTRL, NULL, CLKF_SW_SUP, "func_48mc_fclk" }, +- { OMAP4_OCP2SCP_USB_PHY_CLKCTRL, omap4_ocp2scp_usb_phy_bit_data, CLKF_HW_SUP, "l3_init_cm:clk:00c0:8" }, ++ { OMAP4_OCP2SCP_USB_PHY_CLKCTRL, omap4_ocp2scp_usb_phy_bit_data, CLKF_HW_SUP, "l3-init-clkctrl:00c0:8" }, + { 0 }, + }; + +@@ -530,7 +530,7 @@ static const struct omap_clkctrl_bit_data omap4_gpio6_bit_data[] __initconst = { + }; + + static const char * const omap4_per_mcbsp4_gfclk_parents[] __initconst = { +- "l4_per_cm:clk:00c0:26", ++ "l4-per-clkctrl:00c0:26", + "pad_clks_ck", + NULL, + }; +@@ -570,12 +570,12 @@ static const struct omap_clkctrl_bit_data omap4_slimbus2_bit_data[] __initconst + }; + + static const struct omap_clkctrl_reg_data omap4_l4_per_clkctrl_regs[] __initconst = { +- { OMAP4_TIMER10_CLKCTRL, omap4_timer10_bit_data, CLKF_SW_SUP, "l4_per_cm:clk:0008:24" }, +- { OMAP4_TIMER11_CLKCTRL, omap4_timer11_bit_data, CLKF_SW_SUP, "l4_per_cm:clk:0010:24" }, +- { OMAP4_TIMER2_CLKCTRL, omap4_timer2_bit_data, CLKF_SW_SUP, "l4_per_cm:clk:0018:24" }, +- { OMAP4_TIMER3_CLKCTRL, omap4_timer3_bit_data, CLKF_SW_SUP, "l4_per_cm:clk:0020:24" }, +- { OMAP4_TIMER4_CLKCTRL, omap4_timer4_bit_data, CLKF_SW_SUP, "l4_per_cm:clk:0028:24" }, +- { OMAP4_TIMER9_CLKCTRL, omap4_timer9_bit_data, CLKF_SW_SUP, "l4_per_cm:clk:0030:24" }, ++ { OMAP4_TIMER10_CLKCTRL, omap4_timer10_bit_data, CLKF_SW_SUP, "l4-per-clkctrl:0008:24" }, ++ { OMAP4_TIMER11_CLKCTRL, omap4_timer11_bit_data, CLKF_SW_SUP, "l4-per-clkctrl:0010:24" }, ++ { OMAP4_TIMER2_CLKCTRL, omap4_timer2_bit_data, CLKF_SW_SUP, "l4-per-clkctrl:0018:24" }, ++ { OMAP4_TIMER3_CLKCTRL, omap4_timer3_bit_data, CLKF_SW_SUP, "l4-per-clkctrl:0020:24" }, ++ { OMAP4_TIMER4_CLKCTRL, omap4_timer4_bit_data, CLKF_SW_SUP, "l4-per-clkctrl:0028:24" }, ++ { OMAP4_TIMER9_CLKCTRL, omap4_timer9_bit_data, CLKF_SW_SUP, "l4-per-clkctrl:0030:24" }, + { OMAP4_ELM_CLKCTRL, NULL, 0, "l4_div_ck" }, + { OMAP4_GPIO2_CLKCTRL, omap4_gpio2_bit_data, CLKF_HW_SUP, "l4_div_ck" }, + { OMAP4_GPIO3_CLKCTRL, omap4_gpio3_bit_data, CLKF_HW_SUP, "l4_div_ck" }, +@@ -588,14 +588,14 @@ static const struct omap_clkctrl_reg_data omap4_l4_per_clkctrl_regs[] __initcons + { OMAP4_I2C3_CLKCTRL, NULL, CLKF_SW_SUP, "func_96m_fclk" }, + { OMAP4_I2C4_CLKCTRL, NULL, CLKF_SW_SUP, "func_96m_fclk" }, + { OMAP4_L4_PER_CLKCTRL, NULL, 0, "l4_div_ck" }, +- { OMAP4_MCBSP4_CLKCTRL, omap4_mcbsp4_bit_data, CLKF_SW_SUP, "l4_per_cm:clk:00c0:24" }, ++ { OMAP4_MCBSP4_CLKCTRL, omap4_mcbsp4_bit_data, CLKF_SW_SUP, "l4-per-clkctrl:00c0:24" }, + { OMAP4_MCSPI1_CLKCTRL, NULL, CLKF_SW_SUP, "func_48m_fclk" }, + { OMAP4_MCSPI2_CLKCTRL, NULL, CLKF_SW_SUP, "func_48m_fclk" }, + { OMAP4_MCSPI3_CLKCTRL, NULL, CLKF_SW_SUP, "func_48m_fclk" }, + { OMAP4_MCSPI4_CLKCTRL, NULL, CLKF_SW_SUP, "func_48m_fclk" }, + { OMAP4_MMC3_CLKCTRL, NULL, CLKF_SW_SUP, "func_48m_fclk" }, + { OMAP4_MMC4_CLKCTRL, NULL, CLKF_SW_SUP, "func_48m_fclk" }, +- { OMAP4_SLIMBUS2_CLKCTRL, omap4_slimbus2_bit_data, CLKF_SW_SUP, "l4_per_cm:clk:0118:8" }, ++ { OMAP4_SLIMBUS2_CLKCTRL, omap4_slimbus2_bit_data, CLKF_SW_SUP, "l4-per-clkctrl:0118:8" }, + { OMAP4_UART1_CLKCTRL, NULL, CLKF_SW_SUP, "func_48m_fclk" }, + { OMAP4_UART2_CLKCTRL, NULL, CLKF_SW_SUP, "func_48m_fclk" }, + { OMAP4_UART3_CLKCTRL, NULL, CLKF_SW_SUP, "func_48m_fclk" }, +@@ -630,7 +630,7 @@ static const struct omap_clkctrl_reg_data omap4_l4_wkup_clkctrl_regs[] __initcon + { OMAP4_L4_WKUP_CLKCTRL, NULL, 0, "l4_wkup_clk_mux_ck" }, + { OMAP4_WD_TIMER2_CLKCTRL, NULL, CLKF_SW_SUP, "sys_32k_ck" }, + { OMAP4_GPIO1_CLKCTRL, omap4_gpio1_bit_data, CLKF_HW_SUP, "l4_wkup_clk_mux_ck" }, +- { OMAP4_TIMER1_CLKCTRL, omap4_timer1_bit_data, CLKF_SW_SUP, "l4_wkup_cm:clk:0020:24" }, ++ { OMAP4_TIMER1_CLKCTRL, omap4_timer1_bit_data, CLKF_SW_SUP, "l4-wkup-clkctrl:0020:24" }, + { OMAP4_COUNTER_32K_CLKCTRL, NULL, 0, "sys_32k_ck" }, + { OMAP4_KBD_CLKCTRL, NULL, CLKF_SW_SUP, "sys_32k_ck" }, + { 0 }, +@@ -644,7 +644,7 @@ static const char * const omap4_pmd_stm_clock_mux_ck_parents[] __initconst = { + }; + + static const char * const omap4_trace_clk_div_div_ck_parents[] __initconst = { +- "emu_sys_cm:clk:0000:22", ++ "emu-sys-clkctrl:0000:22", + NULL, + }; + +@@ -662,7 +662,7 @@ static const struct omap_clkctrl_div_data omap4_trace_clk_div_div_ck_data __init + }; + + static const char * const omap4_stm_clk_div_ck_parents[] __initconst = { +- "emu_sys_cm:clk:0000:20", ++ "emu-sys-clkctrl:0000:20", + NULL, + }; + +@@ -716,73 +716,73 @@ static struct ti_dt_clk omap44xx_clks[] = { + * hwmod support. Once hwmod is removed, these can be removed + * also. + */ +- DT_CLK(NULL, "aess_fclk", "abe_cm:0008:24"), +- DT_CLK(NULL, "cm2_dm10_mux", "l4_per_cm:0008:24"), +- DT_CLK(NULL, "cm2_dm11_mux", "l4_per_cm:0010:24"), +- DT_CLK(NULL, "cm2_dm2_mux", "l4_per_cm:0018:24"), +- DT_CLK(NULL, "cm2_dm3_mux", "l4_per_cm:0020:24"), +- DT_CLK(NULL, "cm2_dm4_mux", "l4_per_cm:0028:24"), +- DT_CLK(NULL, "cm2_dm9_mux", "l4_per_cm:0030:24"), +- DT_CLK(NULL, "dmic_sync_mux_ck", "abe_cm:0018:26"), +- DT_CLK(NULL, "dmt1_clk_mux", "l4_wkup_cm:0020:24"), +- DT_CLK(NULL, "dss_48mhz_clk", "l3_dss_cm:0000:9"), +- DT_CLK(NULL, "dss_dss_clk", "l3_dss_cm:0000:8"), +- DT_CLK(NULL, "dss_sys_clk", "l3_dss_cm:0000:10"), +- DT_CLK(NULL, "dss_tv_clk", "l3_dss_cm:0000:11"), +- DT_CLK(NULL, "fdif_fck", "iss_cm:0008:24"), +- DT_CLK(NULL, "func_dmic_abe_gfclk", "abe_cm:0018:24"), +- DT_CLK(NULL, "func_mcasp_abe_gfclk", "abe_cm:0020:24"), +- DT_CLK(NULL, "func_mcbsp1_gfclk", "abe_cm:0028:24"), +- DT_CLK(NULL, "func_mcbsp2_gfclk", "abe_cm:0030:24"), +- DT_CLK(NULL, "func_mcbsp3_gfclk", "abe_cm:0038:24"), +- DT_CLK(NULL, "gpio1_dbclk", "l4_wkup_cm:0018:8"), +- DT_CLK(NULL, "gpio2_dbclk", "l4_per_cm:0040:8"), +- DT_CLK(NULL, "gpio3_dbclk", "l4_per_cm:0048:8"), +- DT_CLK(NULL, "gpio4_dbclk", "l4_per_cm:0050:8"), +- DT_CLK(NULL, "gpio5_dbclk", "l4_per_cm:0058:8"), +- DT_CLK(NULL, "gpio6_dbclk", "l4_per_cm:0060:8"), +- DT_CLK(NULL, "hsi_fck", "l3_init_cm:0018:24"), +- DT_CLK(NULL, "hsmmc1_fclk", "l3_init_cm:0008:24"), +- DT_CLK(NULL, "hsmmc2_fclk", "l3_init_cm:0010:24"), +- DT_CLK(NULL, "iss_ctrlclk", "iss_cm:0000:8"), +- DT_CLK(NULL, "mcasp_sync_mux_ck", "abe_cm:0020:26"), +- DT_CLK(NULL, "mcbsp1_sync_mux_ck", "abe_cm:0028:26"), +- DT_CLK(NULL, "mcbsp2_sync_mux_ck", "abe_cm:0030:26"), +- DT_CLK(NULL, "mcbsp3_sync_mux_ck", "abe_cm:0038:26"), +- DT_CLK(NULL, "mcbsp4_sync_mux_ck", "l4_per_cm:00c0:26"), +- DT_CLK(NULL, "ocp2scp_usb_phy_phy_48m", "l3_init_cm:00c0:8"), +- DT_CLK(NULL, "otg_60m_gfclk", "l3_init_cm:0040:24"), +- DT_CLK(NULL, "per_mcbsp4_gfclk", "l4_per_cm:00c0:24"), +- DT_CLK(NULL, "pmd_stm_clock_mux_ck", "emu_sys_cm:0000:20"), +- DT_CLK(NULL, "pmd_trace_clk_mux_ck", "emu_sys_cm:0000:22"), +- DT_CLK(NULL, "sgx_clk_mux", "l3_gfx_cm:0000:24"), +- DT_CLK(NULL, "slimbus1_fclk_0", "abe_cm:0040:8"), +- DT_CLK(NULL, "slimbus1_fclk_1", "abe_cm:0040:9"), +- DT_CLK(NULL, "slimbus1_fclk_2", "abe_cm:0040:10"), +- DT_CLK(NULL, "slimbus1_slimbus_clk", "abe_cm:0040:11"), +- DT_CLK(NULL, "slimbus2_fclk_0", "l4_per_cm:0118:8"), +- DT_CLK(NULL, "slimbus2_fclk_1", "l4_per_cm:0118:9"), +- DT_CLK(NULL, "slimbus2_slimbus_clk", "l4_per_cm:0118:10"), +- DT_CLK(NULL, "stm_clk_div_ck", "emu_sys_cm:0000:27"), +- DT_CLK(NULL, "timer5_sync_mux", "abe_cm:0048:24"), +- DT_CLK(NULL, "timer6_sync_mux", "abe_cm:0050:24"), +- DT_CLK(NULL, "timer7_sync_mux", "abe_cm:0058:24"), +- DT_CLK(NULL, "timer8_sync_mux", "abe_cm:0060:24"), +- DT_CLK(NULL, "trace_clk_div_div_ck", "emu_sys_cm:0000:24"), +- DT_CLK(NULL, "usb_host_hs_func48mclk", "l3_init_cm:0038:15"), +- DT_CLK(NULL, "usb_host_hs_hsic480m_p1_clk", "l3_init_cm:0038:13"), +- DT_CLK(NULL, "usb_host_hs_hsic480m_p2_clk", "l3_init_cm:0038:14"), +- DT_CLK(NULL, "usb_host_hs_hsic60m_p1_clk", "l3_init_cm:0038:11"), +- DT_CLK(NULL, "usb_host_hs_hsic60m_p2_clk", "l3_init_cm:0038:12"), +- DT_CLK(NULL, "usb_host_hs_utmi_p1_clk", "l3_init_cm:0038:8"), +- DT_CLK(NULL, "usb_host_hs_utmi_p2_clk", "l3_init_cm:0038:9"), +- DT_CLK(NULL, "usb_host_hs_utmi_p3_clk", "l3_init_cm:0038:10"), +- DT_CLK(NULL, "usb_otg_hs_xclk", "l3_init_cm:0040:8"), +- DT_CLK(NULL, "usb_tll_hs_usb_ch0_clk", "l3_init_cm:0048:8"), +- DT_CLK(NULL, "usb_tll_hs_usb_ch1_clk", "l3_init_cm:0048:9"), +- DT_CLK(NULL, "usb_tll_hs_usb_ch2_clk", "l3_init_cm:0048:10"), +- DT_CLK(NULL, "utmi_p1_gfclk", "l3_init_cm:0038:24"), +- DT_CLK(NULL, "utmi_p2_gfclk", "l3_init_cm:0038:25"), ++ DT_CLK(NULL, "aess_fclk", "abe-clkctrl:0008:24"), ++ DT_CLK(NULL, "cm2_dm10_mux", "l4-per-clkctrl:0008:24"), ++ DT_CLK(NULL, "cm2_dm11_mux", "l4-per-clkctrl:0010:24"), ++ DT_CLK(NULL, "cm2_dm2_mux", "l4-per-clkctrl:0018:24"), ++ DT_CLK(NULL, "cm2_dm3_mux", "l4-per-clkctrl:0020:24"), ++ DT_CLK(NULL, "cm2_dm4_mux", "l4-per-clkctrl:0028:24"), ++ DT_CLK(NULL, "cm2_dm9_mux", "l4-per-clkctrl:0030:24"), ++ DT_CLK(NULL, "dmic_sync_mux_ck", "abe-clkctrl:0018:26"), ++ DT_CLK(NULL, "dmt1_clk_mux", "l4-wkup-clkctrl:0020:24"), ++ DT_CLK(NULL, "dss_48mhz_clk", "l3-dss-clkctrl:0000:9"), ++ DT_CLK(NULL, "dss_dss_clk", "l3-dss-clkctrl:0000:8"), ++ DT_CLK(NULL, "dss_sys_clk", "l3-dss-clkctrl:0000:10"), ++ DT_CLK(NULL, "dss_tv_clk", "l3-dss-clkctrl:0000:11"), ++ DT_CLK(NULL, "fdif_fck", "iss-clkctrl:0008:24"), ++ DT_CLK(NULL, "func_dmic_abe_gfclk", "abe-clkctrl:0018:24"), ++ DT_CLK(NULL, "func_mcasp_abe_gfclk", "abe-clkctrl:0020:24"), ++ DT_CLK(NULL, "func_mcbsp1_gfclk", "abe-clkctrl:0028:24"), ++ DT_CLK(NULL, "func_mcbsp2_gfclk", "abe-clkctrl:0030:24"), ++ DT_CLK(NULL, "func_mcbsp3_gfclk", "abe-clkctrl:0038:24"), ++ DT_CLK(NULL, "gpio1_dbclk", "l4-wkup-clkctrl:0018:8"), ++ DT_CLK(NULL, "gpio2_dbclk", "l4-per-clkctrl:0040:8"), ++ DT_CLK(NULL, "gpio3_dbclk", "l4-per-clkctrl:0048:8"), ++ DT_CLK(NULL, "gpio4_dbclk", "l4-per-clkctrl:0050:8"), ++ DT_CLK(NULL, "gpio5_dbclk", "l4-per-clkctrl:0058:8"), ++ DT_CLK(NULL, "gpio6_dbclk", "l4-per-clkctrl:0060:8"), ++ DT_CLK(NULL, "hsi_fck", "l3-init-clkctrl:0018:24"), ++ DT_CLK(NULL, "hsmmc1_fclk", "l3-init-clkctrl:0008:24"), ++ DT_CLK(NULL, "hsmmc2_fclk", "l3-init-clkctrl:0010:24"), ++ DT_CLK(NULL, "iss_ctrlclk", "iss-clkctrl:0000:8"), ++ DT_CLK(NULL, "mcasp_sync_mux_ck", "abe-clkctrl:0020:26"), ++ DT_CLK(NULL, "mcbsp1_sync_mux_ck", "abe-clkctrl:0028:26"), ++ DT_CLK(NULL, "mcbsp2_sync_mux_ck", "abe-clkctrl:0030:26"), ++ DT_CLK(NULL, "mcbsp3_sync_mux_ck", "abe-clkctrl:0038:26"), ++ DT_CLK(NULL, "mcbsp4_sync_mux_ck", "l4-per-clkctrl:00c0:26"), ++ DT_CLK(NULL, "ocp2scp_usb_phy_phy_48m", "l3-init-clkctrl:00c0:8"), ++ DT_CLK(NULL, "otg_60m_gfclk", "l3-init-clkctrl:0040:24"), ++ DT_CLK(NULL, "per_mcbsp4_gfclk", "l4-per-clkctrl:00c0:24"), ++ DT_CLK(NULL, "pmd_stm_clock_mux_ck", "emu-sys-clkctrl:0000:20"), ++ DT_CLK(NULL, "pmd_trace_clk_mux_ck", "emu-sys-clkctrl:0000:22"), ++ DT_CLK(NULL, "sgx_clk_mux", "l3-gfx-clkctrl:0000:24"), ++ DT_CLK(NULL, "slimbus1_fclk_0", "abe-clkctrl:0040:8"), ++ DT_CLK(NULL, "slimbus1_fclk_1", "abe-clkctrl:0040:9"), ++ DT_CLK(NULL, "slimbus1_fclk_2", "abe-clkctrl:0040:10"), ++ DT_CLK(NULL, "slimbus1_slimbus_clk", "abe-clkctrl:0040:11"), ++ DT_CLK(NULL, "slimbus2_fclk_0", "l4-per-clkctrl:0118:8"), ++ DT_CLK(NULL, "slimbus2_fclk_1", "l4-per-clkctrl:0118:9"), ++ DT_CLK(NULL, "slimbus2_slimbus_clk", "l4-per-clkctrl:0118:10"), ++ DT_CLK(NULL, "stm_clk_div_ck", "emu-sys-clkctrl:0000:27"), ++ DT_CLK(NULL, "timer5_sync_mux", "abe-clkctrl:0048:24"), ++ DT_CLK(NULL, "timer6_sync_mux", "abe-clkctrl:0050:24"), ++ DT_CLK(NULL, "timer7_sync_mux", "abe-clkctrl:0058:24"), ++ DT_CLK(NULL, "timer8_sync_mux", "abe-clkctrl:0060:24"), ++ DT_CLK(NULL, "trace_clk_div_div_ck", "emu-sys-clkctrl:0000:24"), ++ DT_CLK(NULL, "usb_host_hs_func48mclk", "l3-init-clkctrl:0038:15"), ++ DT_CLK(NULL, "usb_host_hs_hsic480m_p1_clk", "l3-init-clkctrl:0038:13"), ++ DT_CLK(NULL, "usb_host_hs_hsic480m_p2_clk", "l3-init-clkctrl:0038:14"), ++ DT_CLK(NULL, "usb_host_hs_hsic60m_p1_clk", "l3-init-clkctrl:0038:11"), ++ DT_CLK(NULL, "usb_host_hs_hsic60m_p2_clk", "l3-init-clkctrl:0038:12"), ++ DT_CLK(NULL, "usb_host_hs_utmi_p1_clk", "l3-init-clkctrl:0038:8"), ++ DT_CLK(NULL, "usb_host_hs_utmi_p2_clk", "l3-init-clkctrl:0038:9"), ++ DT_CLK(NULL, "usb_host_hs_utmi_p3_clk", "l3_init-clkctrl:0038:10"), ++ DT_CLK(NULL, "usb_otg_hs_xclk", "l3-init-clkctrl:0040:8"), ++ DT_CLK(NULL, "usb_tll_hs_usb_ch0_clk", "l3-init-clkctrl:0048:8"), ++ DT_CLK(NULL, "usb_tll_hs_usb_ch1_clk", "l3-init-clkctrl:0048:9"), ++ DT_CLK(NULL, "usb_tll_hs_usb_ch2_clk", "l3-init-clkctrl:0048:10"), ++ DT_CLK(NULL, "utmi_p1_gfclk", "l3-init-clkctrl:0038:24"), ++ DT_CLK(NULL, "utmi_p2_gfclk", "l3-init-clkctrl:0038:25"), + { .node_name = NULL }, + }; + +diff --git a/drivers/clk/ti/clk-54xx.c b/drivers/clk/ti/clk-54xx.c +index 90e0a9ea6351..b4aff76eb373 100644 +--- a/drivers/clk/ti/clk-54xx.c ++++ b/drivers/clk/ti/clk-54xx.c +@@ -50,7 +50,7 @@ static const struct omap_clkctrl_bit_data omap5_aess_bit_data[] __initconst = { + }; + + static const char * const omap5_dmic_gfclk_parents[] __initconst = { +- "abe_cm:clk:0018:26", ++ "abe-clkctrl:0018:26", + "pad_clks_ck", + "slimbus_clk", + NULL, +@@ -70,7 +70,7 @@ static const struct omap_clkctrl_bit_data omap5_dmic_bit_data[] __initconst = { + }; + + static const char * const omap5_mcbsp1_gfclk_parents[] __initconst = { +- "abe_cm:clk:0028:26", ++ "abe-clkctrl:0028:26", + "pad_clks_ck", + "slimbus_clk", + NULL, +@@ -83,7 +83,7 @@ static const struct omap_clkctrl_bit_data omap5_mcbsp1_bit_data[] __initconst = + }; + + static const char * const omap5_mcbsp2_gfclk_parents[] __initconst = { +- "abe_cm:clk:0030:26", ++ "abe-clkctrl:0030:26", + "pad_clks_ck", + "slimbus_clk", + NULL, +@@ -96,7 +96,7 @@ static const struct omap_clkctrl_bit_data omap5_mcbsp2_bit_data[] __initconst = + }; + + static const char * const omap5_mcbsp3_gfclk_parents[] __initconst = { +- "abe_cm:clk:0038:26", ++ "abe-clkctrl:0038:26", + "pad_clks_ck", + "slimbus_clk", + NULL, +@@ -136,16 +136,16 @@ static const struct omap_clkctrl_bit_data omap5_timer8_bit_data[] __initconst = + + static const struct omap_clkctrl_reg_data omap5_abe_clkctrl_regs[] __initconst = { + { OMAP5_L4_ABE_CLKCTRL, NULL, 0, "abe_iclk" }, +- { OMAP5_AESS_CLKCTRL, omap5_aess_bit_data, CLKF_SW_SUP, "abe_cm:clk:0008:24" }, ++ { OMAP5_AESS_CLKCTRL, omap5_aess_bit_data, CLKF_SW_SUP, "abe-clkctrl:0008:24" }, + { OMAP5_MCPDM_CLKCTRL, NULL, CLKF_SW_SUP, "pad_clks_ck" }, +- { OMAP5_DMIC_CLKCTRL, omap5_dmic_bit_data, CLKF_SW_SUP, "abe_cm:clk:0018:24" }, +- { OMAP5_MCBSP1_CLKCTRL, omap5_mcbsp1_bit_data, CLKF_SW_SUP, "abe_cm:clk:0028:24" }, +- { OMAP5_MCBSP2_CLKCTRL, omap5_mcbsp2_bit_data, CLKF_SW_SUP, "abe_cm:clk:0030:24" }, +- { OMAP5_MCBSP3_CLKCTRL, omap5_mcbsp3_bit_data, CLKF_SW_SUP, "abe_cm:clk:0038:24" }, +- { OMAP5_TIMER5_CLKCTRL, omap5_timer5_bit_data, CLKF_SW_SUP, "abe_cm:clk:0048:24" }, +- { OMAP5_TIMER6_CLKCTRL, omap5_timer6_bit_data, CLKF_SW_SUP, "abe_cm:clk:0050:24" }, +- { OMAP5_TIMER7_CLKCTRL, omap5_timer7_bit_data, CLKF_SW_SUP, "abe_cm:clk:0058:24" }, +- { OMAP5_TIMER8_CLKCTRL, omap5_timer8_bit_data, CLKF_SW_SUP, "abe_cm:clk:0060:24" }, ++ { OMAP5_DMIC_CLKCTRL, omap5_dmic_bit_data, CLKF_SW_SUP, "abe-clkctrl:0018:24" }, ++ { OMAP5_MCBSP1_CLKCTRL, omap5_mcbsp1_bit_data, CLKF_SW_SUP, "abe-clkctrl:0028:24" }, ++ { OMAP5_MCBSP2_CLKCTRL, omap5_mcbsp2_bit_data, CLKF_SW_SUP, "abe-clkctrl:0030:24" }, ++ { OMAP5_MCBSP3_CLKCTRL, omap5_mcbsp3_bit_data, CLKF_SW_SUP, "abe-clkctrl:0038:24" }, ++ { OMAP5_TIMER5_CLKCTRL, omap5_timer5_bit_data, CLKF_SW_SUP, "abe-clkctrl:0048:24" }, ++ { OMAP5_TIMER6_CLKCTRL, omap5_timer6_bit_data, CLKF_SW_SUP, "abe-clkctrl:0050:24" }, ++ { OMAP5_TIMER7_CLKCTRL, omap5_timer7_bit_data, CLKF_SW_SUP, "abe-clkctrl:0058:24" }, ++ { OMAP5_TIMER8_CLKCTRL, omap5_timer8_bit_data, CLKF_SW_SUP, "abe-clkctrl:0060:24" }, + { 0 }, + }; + +@@ -268,12 +268,12 @@ static const struct omap_clkctrl_bit_data omap5_gpio8_bit_data[] __initconst = { + }; + + static const struct omap_clkctrl_reg_data omap5_l4per_clkctrl_regs[] __initconst = { +- { OMAP5_TIMER10_CLKCTRL, omap5_timer10_bit_data, CLKF_SW_SUP, "l4per_cm:clk:0008:24" }, +- { OMAP5_TIMER11_CLKCTRL, omap5_timer11_bit_data, CLKF_SW_SUP, "l4per_cm:clk:0010:24" }, +- { OMAP5_TIMER2_CLKCTRL, omap5_timer2_bit_data, CLKF_SW_SUP, "l4per_cm:clk:0018:24" }, +- { OMAP5_TIMER3_CLKCTRL, omap5_timer3_bit_data, CLKF_SW_SUP, "l4per_cm:clk:0020:24" }, +- { OMAP5_TIMER4_CLKCTRL, omap5_timer4_bit_data, CLKF_SW_SUP, "l4per_cm:clk:0028:24" }, +- { OMAP5_TIMER9_CLKCTRL, omap5_timer9_bit_data, CLKF_SW_SUP, "l4per_cm:clk:0030:24" }, ++ { OMAP5_TIMER10_CLKCTRL, omap5_timer10_bit_data, CLKF_SW_SUP, "l4per-clkctrl:0008:24" }, ++ { OMAP5_TIMER11_CLKCTRL, omap5_timer11_bit_data, CLKF_SW_SUP, "l4per-clkctrl:0010:24" }, ++ { OMAP5_TIMER2_CLKCTRL, omap5_timer2_bit_data, CLKF_SW_SUP, "l4per-clkctrl:0018:24" }, ++ { OMAP5_TIMER3_CLKCTRL, omap5_timer3_bit_data, CLKF_SW_SUP, "l4per-clkctrl:0020:24" }, ++ { OMAP5_TIMER4_CLKCTRL, omap5_timer4_bit_data, CLKF_SW_SUP, "l4per-clkctrl:0028:24" }, ++ { OMAP5_TIMER9_CLKCTRL, omap5_timer9_bit_data, CLKF_SW_SUP, "l4per-clkctrl:0030:24" }, + { OMAP5_GPIO2_CLKCTRL, omap5_gpio2_bit_data, CLKF_HW_SUP, "l4_root_clk_div" }, + { OMAP5_GPIO3_CLKCTRL, omap5_gpio3_bit_data, CLKF_HW_SUP, "l4_root_clk_div" }, + { OMAP5_GPIO4_CLKCTRL, omap5_gpio4_bit_data, CLKF_HW_SUP, "l4_root_clk_div" }, +@@ -345,7 +345,7 @@ static const struct omap_clkctrl_bit_data omap5_dss_core_bit_data[] __initconst + }; + + static const struct omap_clkctrl_reg_data omap5_dss_clkctrl_regs[] __initconst = { +- { OMAP5_DSS_CORE_CLKCTRL, omap5_dss_core_bit_data, CLKF_SW_SUP, "dss_cm:clk:0000:8" }, ++ { OMAP5_DSS_CORE_CLKCTRL, omap5_dss_core_bit_data, CLKF_SW_SUP, "dss-clkctrl:0000:8" }, + { 0 }, + }; + +@@ -378,7 +378,7 @@ static const struct omap_clkctrl_bit_data omap5_gpu_core_bit_data[] __initconst + }; + + static const struct omap_clkctrl_reg_data omap5_gpu_clkctrl_regs[] __initconst = { +- { OMAP5_GPU_CLKCTRL, omap5_gpu_core_bit_data, CLKF_SW_SUP, "gpu_cm:clk:0000:24" }, ++ { OMAP5_GPU_CLKCTRL, omap5_gpu_core_bit_data, CLKF_SW_SUP, "gpu-clkctrl:0000:24" }, + { 0 }, + }; + +@@ -389,7 +389,7 @@ static const char * const omap5_mmc1_fclk_mux_parents[] __initconst = { + }; + + static const char * const omap5_mmc1_fclk_parents[] __initconst = { +- "l3init_cm:clk:0008:24", ++ "l3init-clkctrl:0008:24", + NULL, + }; + +@@ -405,7 +405,7 @@ static const struct omap_clkctrl_bit_data omap5_mmc1_bit_data[] __initconst = { + }; + + static const char * const omap5_mmc2_fclk_parents[] __initconst = { +- "l3init_cm:clk:0010:24", ++ "l3init-clkctrl:0010:24", + NULL, + }; + +@@ -430,12 +430,12 @@ static const char * const omap5_usb_host_hs_hsic480m_p3_clk_parents[] __initcons + }; + + static const char * const omap5_usb_host_hs_utmi_p1_clk_parents[] __initconst = { +- "l3init_cm:clk:0038:24", ++ "l3init-clkctrl:0038:24", + NULL, + }; + + static const char * const omap5_usb_host_hs_utmi_p2_clk_parents[] __initconst = { +- "l3init_cm:clk:0038:25", ++ "l3init-clkctrl:0038:25", + NULL, + }; + +@@ -494,8 +494,8 @@ static const struct omap_clkctrl_bit_data omap5_usb_otg_ss_bit_data[] __initcons + }; + + static const struct omap_clkctrl_reg_data omap5_l3init_clkctrl_regs[] __initconst = { +- { OMAP5_MMC1_CLKCTRL, omap5_mmc1_bit_data, CLKF_SW_SUP, "l3init_cm:clk:0008:25" }, +- { OMAP5_MMC2_CLKCTRL, omap5_mmc2_bit_data, CLKF_SW_SUP, "l3init_cm:clk:0010:25" }, ++ { OMAP5_MMC1_CLKCTRL, omap5_mmc1_bit_data, CLKF_SW_SUP, "l3init-clkctrl:0008:25" }, ++ { OMAP5_MMC2_CLKCTRL, omap5_mmc2_bit_data, CLKF_SW_SUP, "l3init-clkctrl:0010:25" }, + { OMAP5_USB_HOST_HS_CLKCTRL, omap5_usb_host_hs_bit_data, CLKF_SW_SUP, "l3init_60m_fclk" }, + { OMAP5_USB_TLL_HS_CLKCTRL, omap5_usb_tll_hs_bit_data, CLKF_HW_SUP, "l4_root_clk_div" }, + { OMAP5_SATA_CLKCTRL, omap5_sata_bit_data, CLKF_SW_SUP, "func_48m_fclk" }, +@@ -519,7 +519,7 @@ static const struct omap_clkctrl_reg_data omap5_wkupaon_clkctrl_regs[] __initcon + { OMAP5_L4_WKUP_CLKCTRL, NULL, 0, "wkupaon_iclk_mux" }, + { OMAP5_WD_TIMER2_CLKCTRL, NULL, CLKF_SW_SUP, "sys_32k_ck" }, + { OMAP5_GPIO1_CLKCTRL, omap5_gpio1_bit_data, CLKF_HW_SUP, "wkupaon_iclk_mux" }, +- { OMAP5_TIMER1_CLKCTRL, omap5_timer1_bit_data, CLKF_SW_SUP, "wkupaon_cm:clk:0020:24" }, ++ { OMAP5_TIMER1_CLKCTRL, omap5_timer1_bit_data, CLKF_SW_SUP, "wkupaon-clkctrl:0020:24" }, + { OMAP5_COUNTER_32K_CLKCTRL, NULL, 0, "wkupaon_iclk_mux" }, + { OMAP5_KBD_CLKCTRL, NULL, CLKF_SW_SUP, "sys_32k_ck" }, + { 0 }, +@@ -549,58 +549,58 @@ const struct omap_clkctrl_data omap5_clkctrl_data[] __initconst = { + static struct ti_dt_clk omap54xx_clks[] = { + DT_CLK(NULL, "timer_32k_ck", "sys_32k_ck"), + DT_CLK(NULL, "sys_clkin_ck", "sys_clkin"), +- DT_CLK(NULL, "dmic_gfclk", "abe_cm:0018:24"), +- DT_CLK(NULL, "dmic_sync_mux_ck", "abe_cm:0018:26"), +- DT_CLK(NULL, "dss_32khz_clk", "dss_cm:0000:11"), +- DT_CLK(NULL, "dss_48mhz_clk", "dss_cm:0000:9"), +- DT_CLK(NULL, "dss_dss_clk", "dss_cm:0000:8"), +- DT_CLK(NULL, "dss_sys_clk", "dss_cm:0000:10"), +- DT_CLK(NULL, "gpio1_dbclk", "wkupaon_cm:0018:8"), +- DT_CLK(NULL, "gpio2_dbclk", "l4per_cm:0040:8"), +- DT_CLK(NULL, "gpio3_dbclk", "l4per_cm:0048:8"), +- DT_CLK(NULL, "gpio4_dbclk", "l4per_cm:0050:8"), +- DT_CLK(NULL, "gpio5_dbclk", "l4per_cm:0058:8"), +- DT_CLK(NULL, "gpio6_dbclk", "l4per_cm:0060:8"), +- DT_CLK(NULL, "gpio7_dbclk", "l4per_cm:00f0:8"), +- DT_CLK(NULL, "gpio8_dbclk", "l4per_cm:00f8:8"), +- DT_CLK(NULL, "mcbsp1_gfclk", "abe_cm:0028:24"), +- DT_CLK(NULL, "mcbsp1_sync_mux_ck", "abe_cm:0028:26"), +- DT_CLK(NULL, "mcbsp2_gfclk", "abe_cm:0030:24"), +- DT_CLK(NULL, "mcbsp2_sync_mux_ck", "abe_cm:0030:26"), +- DT_CLK(NULL, "mcbsp3_gfclk", "abe_cm:0038:24"), +- DT_CLK(NULL, "mcbsp3_sync_mux_ck", "abe_cm:0038:26"), +- DT_CLK(NULL, "mmc1_32khz_clk", "l3init_cm:0008:8"), +- DT_CLK(NULL, "mmc1_fclk", "l3init_cm:0008:25"), +- DT_CLK(NULL, "mmc1_fclk_mux", "l3init_cm:0008:24"), +- DT_CLK(NULL, "mmc2_fclk", "l3init_cm:0010:25"), +- DT_CLK(NULL, "mmc2_fclk_mux", "l3init_cm:0010:24"), +- DT_CLK(NULL, "sata_ref_clk", "l3init_cm:0068:8"), +- DT_CLK(NULL, "timer10_gfclk_mux", "l4per_cm:0008:24"), +- DT_CLK(NULL, "timer11_gfclk_mux", "l4per_cm:0010:24"), +- DT_CLK(NULL, "timer1_gfclk_mux", "wkupaon_cm:0020:24"), +- DT_CLK(NULL, "timer2_gfclk_mux", "l4per_cm:0018:24"), +- DT_CLK(NULL, "timer3_gfclk_mux", "l4per_cm:0020:24"), +- DT_CLK(NULL, "timer4_gfclk_mux", "l4per_cm:0028:24"), +- DT_CLK(NULL, "timer5_gfclk_mux", "abe_cm:0048:24"), +- DT_CLK(NULL, "timer6_gfclk_mux", "abe_cm:0050:24"), +- DT_CLK(NULL, "timer7_gfclk_mux", "abe_cm:0058:24"), +- DT_CLK(NULL, "timer8_gfclk_mux", "abe_cm:0060:24"), +- DT_CLK(NULL, "timer9_gfclk_mux", "l4per_cm:0030:24"), +- DT_CLK(NULL, "usb_host_hs_hsic480m_p1_clk", "l3init_cm:0038:13"), +- DT_CLK(NULL, "usb_host_hs_hsic480m_p2_clk", "l3init_cm:0038:14"), +- DT_CLK(NULL, "usb_host_hs_hsic480m_p3_clk", "l3init_cm:0038:7"), +- DT_CLK(NULL, "usb_host_hs_hsic60m_p1_clk", "l3init_cm:0038:11"), +- DT_CLK(NULL, "usb_host_hs_hsic60m_p2_clk", "l3init_cm:0038:12"), +- DT_CLK(NULL, "usb_host_hs_hsic60m_p3_clk", "l3init_cm:0038:6"), +- DT_CLK(NULL, "usb_host_hs_utmi_p1_clk", "l3init_cm:0038:8"), +- DT_CLK(NULL, "usb_host_hs_utmi_p2_clk", "l3init_cm:0038:9"), +- DT_CLK(NULL, "usb_host_hs_utmi_p3_clk", "l3init_cm:0038:10"), +- DT_CLK(NULL, "usb_otg_ss_refclk960m", "l3init_cm:00d0:8"), +- DT_CLK(NULL, "usb_tll_hs_usb_ch0_clk", "l3init_cm:0048:8"), +- DT_CLK(NULL, "usb_tll_hs_usb_ch1_clk", "l3init_cm:0048:9"), +- DT_CLK(NULL, "usb_tll_hs_usb_ch2_clk", "l3init_cm:0048:10"), +- DT_CLK(NULL, "utmi_p1_gfclk", "l3init_cm:0038:24"), +- DT_CLK(NULL, "utmi_p2_gfclk", "l3init_cm:0038:25"), ++ DT_CLK(NULL, "dmic_gfclk", "abe-clkctrl:0018:24"), ++ DT_CLK(NULL, "dmic_sync_mux_ck", "abe-clkctrl:0018:26"), ++ DT_CLK(NULL, "dss_32khz_clk", "dss-clkctrl:0000:11"), ++ DT_CLK(NULL, "dss_48mhz_clk", "dss-clkctrl:0000:9"), ++ DT_CLK(NULL, "dss_dss_clk", "dss-clkctrl:0000:8"), ++ DT_CLK(NULL, "dss_sys_clk", "dss-clkctrl:0000:10"), ++ DT_CLK(NULL, "gpio1_dbclk", "wkupaon-clkctrl:0018:8"), ++ DT_CLK(NULL, "gpio2_dbclk", "l4per-clkctrl:0040:8"), ++ DT_CLK(NULL, "gpio3_dbclk", "l4per-clkctrl:0048:8"), ++ DT_CLK(NULL, "gpio4_dbclk", "l4per-clkctrl:0050:8"), ++ DT_CLK(NULL, "gpio5_dbclk", "l4per-clkctrl:0058:8"), ++ DT_CLK(NULL, "gpio6_dbclk", "l4per-clkctrl:0060:8"), ++ DT_CLK(NULL, "gpio7_dbclk", "l4per-clkctrl:00f0:8"), ++ DT_CLK(NULL, "gpio8_dbclk", "l4per-clkctrl:00f8:8"), ++ DT_CLK(NULL, "mcbsp1_gfclk", "abe-clkctrl:0028:24"), ++ DT_CLK(NULL, "mcbsp1_sync_mux_ck", "abe-clkctrl:0028:26"), ++ DT_CLK(NULL, "mcbsp2_gfclk", "abe-clkctrl:0030:24"), ++ DT_CLK(NULL, "mcbsp2_sync_mux_ck", "abe-clkctrl:0030:26"), ++ DT_CLK(NULL, "mcbsp3_gfclk", "abe-clkctrl:0038:24"), ++ DT_CLK(NULL, "mcbsp3_sync_mux_ck", "abe-clkctrl:0038:26"), ++ DT_CLK(NULL, "mmc1_32khz_clk", "l3init-clkctrl:0008:8"), ++ DT_CLK(NULL, "mmc1_fclk", "l3init-clkctrl:0008:25"), ++ DT_CLK(NULL, "mmc1_fclk_mux", "l3init-clkctrl:0008:24"), ++ DT_CLK(NULL, "mmc2_fclk", "l3init-clkctrl:0010:25"), ++ DT_CLK(NULL, "mmc2_fclk_mux", "l3init-clkctrl:0010:24"), ++ DT_CLK(NULL, "sata_ref_clk", "l3init-clkctrl:0068:8"), ++ DT_CLK(NULL, "timer10_gfclk_mux", "l4per-clkctrl:0008:24"), ++ DT_CLK(NULL, "timer11_gfclk_mux", "l4per-clkctrl:0010:24"), ++ DT_CLK(NULL, "timer1_gfclk_mux", "wkupaon-clkctrl:0020:24"), ++ DT_CLK(NULL, "timer2_gfclk_mux", "l4per-clkctrl:0018:24"), ++ DT_CLK(NULL, "timer3_gfclk_mux", "l4per-clkctrl:0020:24"), ++ DT_CLK(NULL, "timer4_gfclk_mux", "l4per-clkctrl:0028:24"), ++ DT_CLK(NULL, "timer5_gfclk_mux", "abe-clkctrl:0048:24"), ++ DT_CLK(NULL, "timer6_gfclk_mux", "abe-clkctrl:0050:24"), ++ DT_CLK(NULL, "timer7_gfclk_mux", "abe-clkctrl:0058:24"), ++ DT_CLK(NULL, "timer8_gfclk_mux", "abe-clkctrl:0060:24"), ++ DT_CLK(NULL, "timer9_gfclk_mux", "l4per-clkctrl:0030:24"), ++ DT_CLK(NULL, "usb_host_hs_hsic480m_p1_clk", "l3init-clkctrl:0038:13"), ++ DT_CLK(NULL, "usb_host_hs_hsic480m_p2_clk", "l3init-clkctrl:0038:14"), ++ DT_CLK(NULL, "usb_host_hs_hsic480m_p3_clk", "l3init-clkctrl:0038:7"), ++ DT_CLK(NULL, "usb_host_hs_hsic60m_p1_clk", "l3init-clkctrl:0038:11"), ++ DT_CLK(NULL, "usb_host_hs_hsic60m_p2_clk", "l3init-clkctrl:0038:12"), ++ DT_CLK(NULL, "usb_host_hs_hsic60m_p3_clk", "l3init-clkctrl:0038:6"), ++ DT_CLK(NULL, "usb_host_hs_utmi_p1_clk", "l3init-clkctrl:0038:8"), ++ DT_CLK(NULL, "usb_host_hs_utmi_p2_clk", "l3init-clkctrl:0038:9"), ++ DT_CLK(NULL, "usb_host_hs_utmi_p3_clk", "l3init-clkctrl:0038:10"), ++ DT_CLK(NULL, "usb_otg_ss_refclk960m", "l3init-clkctrl:00d0:8"), ++ DT_CLK(NULL, "usb_tll_hs_usb_ch0_clk", "l3init-clkctrl:0048:8"), ++ DT_CLK(NULL, "usb_tll_hs_usb_ch1_clk", "l3init-clkctrl:0048:9"), ++ DT_CLK(NULL, "usb_tll_hs_usb_ch2_clk", "l3init-clkctrl:0048:10"), ++ DT_CLK(NULL, "utmi_p1_gfclk", "l3init-clkctrl:0038:24"), ++ DT_CLK(NULL, "utmi_p2_gfclk", "l3init-clkctrl:0038:25"), + { .node_name = NULL }, + }; + +diff --git a/drivers/clk/ti/clkctrl.c b/drivers/clk/ti/clkctrl.c +index 617360e20d86..e23bf0458632 100644 +--- a/drivers/clk/ti/clkctrl.c ++++ b/drivers/clk/ti/clkctrl.c +@@ -528,10 +528,6 @@ static void __init _ti_omap4_clkctrl_setup(struct device_node *node) + char *c; + u16 soc_mask = 0; + +- if (!(ti_clk_get_features()->flags & TI_CLK_CLKCTRL_COMPAT) && +- of_node_name_eq(node, "clk")) +- ti_clk_features.flags |= TI_CLK_CLKCTRL_COMPAT; +- + addrp = of_get_address(node, 0, NULL, NULL); + addr = (u32)of_translate_address(node, addrp); + +-- +2.35.1 + diff --git a/queue-5.19/coresight-etm4x-avoid-build-failure-with-unrolled-lo.patch b/queue-5.19/coresight-etm4x-avoid-build-failure-with-unrolled-lo.patch new file mode 100644 index 00000000000..8a4b25ad5e1 --- /dev/null +++ b/queue-5.19/coresight-etm4x-avoid-build-failure-with-unrolled-lo.patch @@ -0,0 +1,116 @@ +From f45700a2bb8134211236db73f16457398bb565c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Jul 2022 16:15:20 -0700 +Subject: coresight: etm4x: avoid build failure with unrolled loops + +From: Nick Desaulniers + +[ Upstream commit 4d45bc82df667ad9e9cb8361830e54fc1264e993 ] + +When the following configs are enabled: +* CORESIGHT +* CORESIGHT_SOURCE_ETM4X +* UBSAN +* UBSAN_TRAP + +Clang fails assemble the kernel with the error: +:1:7: error: expected constant expression in '.inst' directive +.inst (0xd5200000|((((2) << 19) | ((1) << 16) | (((((((((((0x160 + (i * 4))))) >> 2))) >> 7) & 0x7)) << 12) | ((((((((((0x160 + (i * 4))))) >> 2))) & 0xf)) << 8) | (((((((((((0x160 + (i * 4))))) >> 2))) >> 4) & 0x7)) << 5)))|(.L__reg_num_x8)) + ^ +drivers/hwtracing/coresight/coresight-etm4x-core.c:702:4: note: while in +macro instantiation +etm4x_relaxed_read32(csa, TRCCNTVRn(i)); +^ +drivers/hwtracing/coresight/coresight-etm4x.h:403:4: note: expanded from +macro 'etm4x_relaxed_read32' +read_etm4x_sysreg_offset((offset), false))) +^ +drivers/hwtracing/coresight/coresight-etm4x.h:383:12: note: expanded +from macro 'read_etm4x_sysreg_offset' +__val = read_etm4x_sysreg_const_offset((offset)); \ + ^ +drivers/hwtracing/coresight/coresight-etm4x.h:149:2: note: expanded from +macro 'read_etm4x_sysreg_const_offset' +READ_ETM4x_REG(ETM4x_OFFSET_TO_REG(offset)) +^ +drivers/hwtracing/coresight/coresight-etm4x.h:144:2: note: expanded from +macro 'READ_ETM4x_REG' +read_sysreg_s(ETM4x_REG_NUM_TO_SYSREG((reg))) +^ +arch/arm64/include/asm/sysreg.h:1108:15: note: expanded from macro +'read_sysreg_s' +asm volatile(__mrs_s("%0", r) : "=r" (__val)); \ + ^ +arch/arm64/include/asm/sysreg.h:1074:2: note: expanded from macro '__mrs_s' +" mrs_s " v ", " __stringify(r) "\n" \ + ^ + +Consider the definitions of TRCSSCSRn and TRCCNTVRn: +drivers/hwtracing/coresight/coresight-etm4x.h:56 + #define TRCCNTVRn(n) (0x160 + (n * 4)) +drivers/hwtracing/coresight/coresight-etm4x.h:81 + #define TRCSSCSRn(n) (0x2A0 + (n * 4)) + +Where the macro parameter is expanded to i; a loop induction variable +from etm4_disable_hw. + +When any compiler can determine that loops may be unrolled, then the +__builtin_constant_p check in read_etm4x_sysreg_offset() defined in +drivers/hwtracing/coresight/coresight-etm4x.h may evaluate to true. This +can lead to the expression `(0x160 + (i * 4))` being passed to +read_etm4x_sysreg_const_offset. Via the trace above, this is passed +through READ_ETM4x_REG, read_sysreg_s, and finally to __mrs_s where it +is string-ified and used directly in inline asm. + +Regardless of which compiler or compiler options determine whether a +loop can or can't be unrolled, which determines whether +__builtin_constant_p evaluates to true when passed an expression using a +loop induction variable, it is NEVER safe to allow the preprocessor to +construct inline asm like: + asm volatile (".inst (0x160 + (i * 4))" : "=r"(__val)); + ^ expected constant expression + +Instead of read_etm4x_sysreg_offset() using __builtin_constant_p(), use +__is_constexpr from include/linux/const.h instead to ensure only +expressions that are valid integer constant expressions get passed +through to read_sysreg_s(). + +This is not a bug in clang; it's a potentially unsafe use of the macro +arguments in read_etm4x_sysreg_offset dependent on __builtin_constant_p. + +Link: https://github.com/ClangBuiltLinux/linux/issues/1310 +Reported-by: Arnd Bergmann +Reported-by: Tao Zhang +Signed-off-by: Nick Desaulniers +Acked-by: Arnd Bergmann +Signed-off-by: Suzuki K Poulose +Link: https://lore.kernel.org/r/20220708231520.3958391-1-ndesaulniers@google.com +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/coresight/coresight-etm4x.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/hwtracing/coresight/coresight-etm4x.h b/drivers/hwtracing/coresight/coresight-etm4x.h +index 33869c1d20c3..a7bfea31f7d8 100644 +--- a/drivers/hwtracing/coresight/coresight-etm4x.h ++++ b/drivers/hwtracing/coresight/coresight-etm4x.h +@@ -7,6 +7,7 @@ + #define _CORESIGHT_CORESIGHT_ETM_H + + #include ++#include + #include + #include + #include "coresight-priv.h" +@@ -515,7 +516,7 @@ + ({ \ + u64 __val; \ + \ +- if (__builtin_constant_p((offset))) \ ++ if (__is_constexpr((offset))) \ + __val = read_etm4x_sysreg_const_offset((offset)); \ + else \ + __val = etm4x_sysreg_read((offset), true, (_64bit)); \ +-- +2.35.1 + diff --git a/queue-5.19/csky-kprobe-reclaim-insn_slot-on-kprobe-unregistrati.patch b/queue-5.19/csky-kprobe-reclaim-insn_slot-on-kprobe-unregistrati.patch new file mode 100644 index 00000000000..63ef8bb0813 --- /dev/null +++ b/queue-5.19/csky-kprobe-reclaim-insn_slot-on-kprobe-unregistrati.patch @@ -0,0 +1,40 @@ +From e5057f01b3e93a5046966536d637e8e8fbbecaf8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 May 2022 16:02:41 +0800 +Subject: csky/kprobe: reclaim insn_slot on kprobe unregistration + +From: Liao Chang + +[ Upstream commit a2310c74d418deca0f1d749c45f1f43162510f51 ] + +On kprobe registration kernel allocate one insn_slot for new kprobe, +but it forget to reclaim the insn_slot on unregistration, leading to a +potential leakage. + +Reported-by: Chen Guokai +Reviewed-by: Masami Hiramatsu (Google) +Signed-off-by: Liao Chang +Signed-off-by: Guo Ren +Signed-off-by: Sasha Levin +--- + arch/csky/kernel/probes/kprobes.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/arch/csky/kernel/probes/kprobes.c b/arch/csky/kernel/probes/kprobes.c +index 34ba684d5962..3c6e5c725d81 100644 +--- a/arch/csky/kernel/probes/kprobes.c ++++ b/arch/csky/kernel/probes/kprobes.c +@@ -124,6 +124,10 @@ void __kprobes arch_disarm_kprobe(struct kprobe *p) + + void __kprobes arch_remove_kprobe(struct kprobe *p) + { ++ if (p->ainsn.api.insn) { ++ free_insn_slot(p->ainsn.api.insn, 0); ++ p->ainsn.api.insn = NULL; ++ } + } + + static void __kprobes save_previous_kprobe(struct kprobe_ctlblk *kcb) +-- +2.35.1 + diff --git a/queue-5.19/cxl-fix-a-memory-leak-in-an-error-handling-path.patch b/queue-5.19/cxl-fix-a-memory-leak-in-an-error-handling-path.patch new file mode 100644 index 00000000000..63accbc53ba --- /dev/null +++ b/queue-5.19/cxl-fix-a-memory-leak-in-an-error-handling-path.patch @@ -0,0 +1,36 @@ +From 7ea2221243932210e42099e8cb509d54441214df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Jul 2022 21:14:48 +0200 +Subject: cxl: Fix a memory leak in an error handling path + +From: Christophe JAILLET + +[ Upstream commit 3a15b45b5454da862376b5d69a4967f5c6fa1368 ] + +A bitmap_zalloc() must be balanced by a corresponding bitmap_free() in the +error handling path of afu_allocate_irqs(). + +Acked-by: Andrew Donnellan +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/ce5869418f5838187946eb6b11a52715a93ece3d.1657566849.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/misc/cxl/irq.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/misc/cxl/irq.c b/drivers/misc/cxl/irq.c +index 5f0e2dcebb34..ac3795a7e1f6 100644 +--- a/drivers/misc/cxl/irq.c ++++ b/drivers/misc/cxl/irq.c +@@ -350,6 +350,7 @@ int afu_allocate_irqs(struct cxl_context *ctx, u32 count) + + out: + cxl_ops->release_irq_ranges(&ctx->irqs, ctx->afu->adapter); ++ bitmap_free(ctx->irq_bitmap); + afu_irq_name_free(ctx); + return -ENOMEM; + } +-- +2.35.1 + diff --git a/queue-5.19/dmaengine-dw-axi-dmac-do-not-print-null-lli-during-e.patch b/queue-5.19/dmaengine-dw-axi-dmac-do-not-print-null-lli-during-e.patch new file mode 100644 index 00000000000..da1d3acc2d3 --- /dev/null +++ b/queue-5.19/dmaengine-dw-axi-dmac-do-not-print-null-lli-during-e.patch @@ -0,0 +1,41 @@ +From 119d620610aea4ed5c19f3354c736f9ebf0896eb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Jul 2022 18:01:52 +0100 +Subject: dmaengine: dw-axi-dmac: do not print NULL LLI during error + +From: Ben Dooks + +[ Upstream commit 86cb0defe0e275453bc39e856bb523eb425a6537 ] + +During debugging we have seen an issue where axi_chan_dump_lli() +is passed a NULL LLI pointer which ends up causing an OOPS due +to trying to get fields from it. Simply print NULL LLI and exit +to avoid this. + +Signed-off-by: Ben Dooks +Link: https://lore.kernel.org/r/20220708170153.269991-3-ben.dooks@sifive.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c b/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c +index c741da02b67e..41583f01a360 100644 +--- a/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c ++++ b/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c +@@ -982,6 +982,11 @@ static int dw_axi_dma_chan_slave_config(struct dma_chan *dchan, + static void axi_chan_dump_lli(struct axi_dma_chan *chan, + struct axi_dma_hw_desc *desc) + { ++ if (!desc->lli) { ++ dev_err(dchan2dev(&chan->vc.chan), "NULL LLI\n"); ++ return; ++ } ++ + dev_err(dchan2dev(&chan->vc.chan), + "SAR: 0x%llx DAR: 0x%llx LLP: 0x%llx BTS 0x%x CTL: 0x%x:%08x", + le64_to_cpu(desc->lli->sar), +-- +2.35.1 + diff --git a/queue-5.19/dmaengine-dw-axi-dmac-ignore-interrupt-if-no-descrip.patch b/queue-5.19/dmaengine-dw-axi-dmac-ignore-interrupt-if-no-descrip.patch new file mode 100644 index 00000000000..f277043bb6c --- /dev/null +++ b/queue-5.19/dmaengine-dw-axi-dmac-ignore-interrupt-if-no-descrip.patch @@ -0,0 +1,48 @@ +From e1d410535622944a2c3b9eff3178d2a07cb685f9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Jul 2022 18:01:53 +0100 +Subject: dmaengine: dw-axi-dmac: ignore interrupt if no descriptor + +From: Ben Dooks + +[ Upstream commit 820f5ce999d2f99961e88c16d65cd26764df0590 ] + +If the channel has no descriptor and the interrupt is raised then the +kernel will OOPS. Check the result of vchan_next_desc() in the handler +axi_chan_block_xfer_complete() to avoid the error happening. + +Signed-off-by: Ben Dooks +Link: https://lore.kernel.org/r/20220708170153.269991-4-ben.dooks@sifive.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c b/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c +index 41583f01a360..a183d93bd7e2 100644 +--- a/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c ++++ b/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c +@@ -1054,6 +1054,11 @@ static void axi_chan_block_xfer_complete(struct axi_dma_chan *chan) + + /* The completed descriptor currently is in the head of vc list */ + vd = vchan_next_desc(&chan->vc); ++ if (!vd) { ++ dev_err(chan2dev(chan), "BUG: %s, IRQ with no descriptors\n", ++ axi_chan_name(chan)); ++ goto out; ++ } + + if (chan->cyclic) { + desc = vd_to_axi_desc(vd); +@@ -1083,6 +1088,7 @@ static void axi_chan_block_xfer_complete(struct axi_dma_chan *chan) + axi_chan_start_first_queued(chan); + } + ++out: + spin_unlock_irqrestore(&chan->vc.lock, flags); + } + +-- +2.35.1 + diff --git a/queue-5.19/dmaengine-sprd-cleanup-in-.remove-after-pm_runtime_g.patch b/queue-5.19/dmaengine-sprd-cleanup-in-.remove-after-pm_runtime_g.patch new file mode 100644 index 00000000000..7c643c918e6 --- /dev/null +++ b/queue-5.19/dmaengine-sprd-cleanup-in-.remove-after-pm_runtime_g.patch @@ -0,0 +1,51 @@ +From 9a519efe8e0783eaf7416b86eda0b6341189de75 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Jul 2022 22:40:54 +0200 +Subject: dmaengine: sprd: Cleanup in .remove() after pm_runtime_get_sync() + failed +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 1e42f82cbec7b2cc4873751e7791e6611901c5fc ] + +It's not allowed to quit remove early without cleaning up completely. +Otherwise this results in resource leaks that probably yield graver +problems later. Here for example some tasklets might survive the lifetime +of the sprd-dma device and access sdev which is freed after .remove() +returns. + +As none of the device freeing requires an active device, just ignore the +return value of pm_runtime_get_sync(). + +Signed-off-by: Uwe Kleine-König +Reviewed-by: Baolin Wang +Link: https://lore.kernel.org/r/20220721204054.323602-1-u.kleine-koenig@pengutronix.de +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/sprd-dma.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/drivers/dma/sprd-dma.c b/drivers/dma/sprd-dma.c +index 2138b80435ab..474d3ba8ec9f 100644 +--- a/drivers/dma/sprd-dma.c ++++ b/drivers/dma/sprd-dma.c +@@ -1237,11 +1237,8 @@ static int sprd_dma_remove(struct platform_device *pdev) + { + struct sprd_dma_dev *sdev = platform_get_drvdata(pdev); + struct sprd_dma_chn *c, *cn; +- int ret; + +- ret = pm_runtime_get_sync(&pdev->dev); +- if (ret < 0) +- return ret; ++ pm_runtime_get_sync(&pdev->dev); + + /* explicitly free the irq */ + if (sdev->irq > 0) +-- +2.35.1 + diff --git a/queue-5.19/dmaengine-tegra-add-terminate-for-tegra234.patch b/queue-5.19/dmaengine-tegra-add-terminate-for-tegra234.patch new file mode 100644 index 00000000000..d0e6aca3c78 --- /dev/null +++ b/queue-5.19/dmaengine-tegra-add-terminate-for-tegra234.patch @@ -0,0 +1,91 @@ +From 8144258630f5ff210c859401591d06991be29594 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Jul 2022 16:10:44 +0530 +Subject: dmaengine: tegra: Add terminate() for Tegra234 + +From: Akhil R + +[ Upstream commit 36834c67016794b8fa03d7672a5b7f2cc4529298 ] + +In certain cases where the DMA client bus gets corrupted or if the +end device ceases to send/receive data, DMA can wait indefinitely +for the data to be received/sent. Attempting to terminate the transfer +will put the DMA in pause flush mode and it remains there. + +The channel is irrecoverable once this pause times out in Tegra194 and +earlier chips. Whereas, from Tegra234, it can be recovered by disabling +the channel and reprograming it. + +Hence add a new terminate() function that ignores the outcome of +dma_pause() so that terminate_all() can proceed to disable the channel. + +Signed-off-by: Akhil R +Reviewed-by: Jon Hunter +Link: https://lore.kernel.org/r/20220720104045.16099-3-akhilrajeev@nvidia.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/tegra186-gpc-dma.c | 26 ++++++++++++++++++++++++-- + 1 file changed, 24 insertions(+), 2 deletions(-) + +diff --git a/drivers/dma/tegra186-gpc-dma.c b/drivers/dma/tegra186-gpc-dma.c +index 05cd451f541d..fa9bda4a2bc6 100644 +--- a/drivers/dma/tegra186-gpc-dma.c ++++ b/drivers/dma/tegra186-gpc-dma.c +@@ -157,8 +157,8 @@ + * If any burst is in flight and DMA paused then this is the time to complete + * on-flight burst and update DMA status register. + */ +-#define TEGRA_GPCDMA_BURST_COMPLETE_TIME 20 +-#define TEGRA_GPCDMA_BURST_COMPLETION_TIMEOUT 100 ++#define TEGRA_GPCDMA_BURST_COMPLETE_TIME 10 ++#define TEGRA_GPCDMA_BURST_COMPLETION_TIMEOUT 5000 /* 5 msec */ + + /* Channel base address offset from GPCDMA base address */ + #define TEGRA_GPCDMA_CHANNEL_BASE_ADD_OFFSET 0x20000 +@@ -432,6 +432,17 @@ static int tegra_dma_device_resume(struct dma_chan *dc) + return 0; + } + ++static inline int tegra_dma_pause_noerr(struct tegra_dma_channel *tdc) ++{ ++ /* Return 0 irrespective of PAUSE status. ++ * This is useful to recover channels that can exit out of flush ++ * state when the channel is disabled. ++ */ ++ ++ tegra_dma_pause(tdc); ++ return 0; ++} ++ + static void tegra_dma_disable(struct tegra_dma_channel *tdc) + { + u32 csr, status; +@@ -1292,6 +1303,14 @@ static const struct tegra_dma_chip_data tegra194_dma_chip_data = { + .terminate = tegra_dma_pause, + }; + ++static const struct tegra_dma_chip_data tegra234_dma_chip_data = { ++ .nr_channels = 31, ++ .channel_reg_size = SZ_64K, ++ .max_dma_count = SZ_1G, ++ .hw_support_pause = true, ++ .terminate = tegra_dma_pause_noerr, ++}; ++ + static const struct of_device_id tegra_dma_of_match[] = { + { + .compatible = "nvidia,tegra186-gpcdma", +@@ -1299,6 +1318,9 @@ static const struct of_device_id tegra_dma_of_match[] = { + }, { + .compatible = "nvidia,tegra194-gpcdma", + .data = &tegra194_dma_chip_data, ++ }, { ++ .compatible = "nvidia,tegra234-gpcdma", ++ .data = &tegra234_dma_chip_data, + }, { + }, + }; +-- +2.35.1 + diff --git a/queue-5.19/drivers-md-fix-a-potential-use-after-free-bug.patch b/queue-5.19/drivers-md-fix-a-potential-use-after-free-bug.patch new file mode 100644 index 00000000000..1ff2addf8d0 --- /dev/null +++ b/queue-5.19/drivers-md-fix-a-potential-use-after-free-bug.patch @@ -0,0 +1,44 @@ +From 2462453efbabffb727c255977060d7215389bb28 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Jul 2022 19:39:19 +0800 +Subject: drivers:md:fix a potential use-after-free bug + +From: Wentao_Liang + +[ Upstream commit 104212471b1c1817b311771d817fb692af983173 ] + +In line 2884, "raid5_release_stripe(sh);" drops the reference to sh and +may cause sh to be released. However, sh is subsequently used in lines +2886 "if (sh->batch_head && sh != sh->batch_head)". This may result in an +use-after-free bug. + +It can be fixed by moving "raid5_release_stripe(sh);" to the bottom of +the function. + +Signed-off-by: Wentao_Liang +Signed-off-by: Song Liu +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/md/raid5.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c +index 45482cebacdb..1c1310d539f2 100644 +--- a/drivers/md/raid5.c ++++ b/drivers/md/raid5.c +@@ -2881,10 +2881,10 @@ static void raid5_end_write_request(struct bio *bi) + if (!test_and_clear_bit(R5_DOUBLE_LOCKED, &sh->dev[i].flags)) + clear_bit(R5_LOCKED, &sh->dev[i].flags); + set_bit(STRIPE_HANDLE, &sh->state); +- raid5_release_stripe(sh); + + if (sh->batch_head && sh != sh->batch_head) + raid5_release_stripe(sh->batch_head); ++ raid5_release_stripe(sh); + } + + static void raid5_error(struct mddev *mddev, struct md_rdev *rdev) +-- +2.35.1 + diff --git a/queue-5.19/drm-amdgpu-avoid-another-list-of-reset-devices.patch b/queue-5.19/drm-amdgpu-avoid-another-list-of-reset-devices.patch new file mode 100644 index 00000000000..b255683fef4 --- /dev/null +++ b/queue-5.19/drm-amdgpu-avoid-another-list-of-reset-devices.patch @@ -0,0 +1,157 @@ +From dee7746f527b3ac5587d3b5969efd623e5ecec72 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Aug 2022 16:54:24 +0530 +Subject: drm/amdgpu: Avoid another list of reset devices + +From: Lijo Lazar + +[ Upstream commit 0a83bb35d8a6ff3d18c2772afe616780c23293a6 ] + +A list of devices to be reset is already created in +amdgpu_device_gpu_recover function. Creating another list with the +same nodes is incorrect and not supported in list_head. Instead, pass +the device list as part of reset context. + +Fixes: 9e08564727fc (drm/amdgpu: Refactor mode2 reset logic for v13.0.2) +Signed-off-by: Lijo Lazar +Reviewed-by: Hawking Zhang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/aldebaran.c | 45 +++++++--------------- + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 2 + + drivers/gpu/drm/amd/amdgpu/amdgpu_reset.h | 1 + + 3 files changed, 17 insertions(+), 31 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/aldebaran.c b/drivers/gpu/drm/amd/amdgpu/aldebaran.c +index c6cc493a5486..2b97b8a96fb4 100644 +--- a/drivers/gpu/drm/amd/amdgpu/aldebaran.c ++++ b/drivers/gpu/drm/amd/amdgpu/aldebaran.c +@@ -148,30 +148,22 @@ aldebaran_mode2_perform_reset(struct amdgpu_reset_control *reset_ctl, + struct amdgpu_reset_context *reset_context) + { + struct amdgpu_device *adev = (struct amdgpu_device *)reset_ctl->handle; ++ struct list_head *reset_device_list = reset_context->reset_device_list; + struct amdgpu_device *tmp_adev = NULL; +- struct list_head reset_device_list; + int r = 0; + + dev_dbg(adev->dev, "aldebaran perform hw reset\n"); ++ ++ if (reset_device_list == NULL) ++ return -EINVAL; ++ + if (adev->ip_versions[MP1_HWIP][0] == IP_VERSION(13, 0, 2) && + reset_context->hive == NULL) { + /* Wrong context, return error */ + return -EINVAL; + } + +- INIT_LIST_HEAD(&reset_device_list); +- if (reset_context->hive) { +- list_for_each_entry (tmp_adev, +- &reset_context->hive->device_list, +- gmc.xgmi.head) +- list_add_tail(&tmp_adev->reset_list, +- &reset_device_list); +- } else { +- list_add_tail(&reset_context->reset_req_dev->reset_list, +- &reset_device_list); +- } +- +- list_for_each_entry (tmp_adev, &reset_device_list, reset_list) { ++ list_for_each_entry(tmp_adev, reset_device_list, reset_list) { + mutex_lock(&tmp_adev->reset_cntl->reset_lock); + tmp_adev->reset_cntl->active_reset = AMD_RESET_METHOD_MODE2; + } +@@ -179,7 +171,7 @@ aldebaran_mode2_perform_reset(struct amdgpu_reset_control *reset_ctl, + * Mode2 reset doesn't need any sync between nodes in XGMI hive, instead launch + * them together so that they can be completed asynchronously on multiple nodes + */ +- list_for_each_entry (tmp_adev, &reset_device_list, reset_list) { ++ list_for_each_entry(tmp_adev, reset_device_list, reset_list) { + /* For XGMI run all resets in parallel to speed up the process */ + if (tmp_adev->gmc.xgmi.num_physical_nodes > 1) { + if (!queue_work(system_unbound_wq, +@@ -197,7 +189,7 @@ aldebaran_mode2_perform_reset(struct amdgpu_reset_control *reset_ctl, + + /* For XGMI wait for all resets to complete before proceed */ + if (!r) { +- list_for_each_entry (tmp_adev, &reset_device_list, reset_list) { ++ list_for_each_entry(tmp_adev, reset_device_list, reset_list) { + if (tmp_adev->gmc.xgmi.num_physical_nodes > 1) { + flush_work(&tmp_adev->reset_cntl->reset_work); + r = tmp_adev->asic_reset_res; +@@ -207,7 +199,7 @@ aldebaran_mode2_perform_reset(struct amdgpu_reset_control *reset_ctl, + } + } + +- list_for_each_entry (tmp_adev, &reset_device_list, reset_list) { ++ list_for_each_entry(tmp_adev, reset_device_list, reset_list) { + mutex_unlock(&tmp_adev->reset_cntl->reset_lock); + tmp_adev->reset_cntl->active_reset = AMD_RESET_METHOD_NONE; + } +@@ -339,10 +331,13 @@ static int + aldebaran_mode2_restore_hwcontext(struct amdgpu_reset_control *reset_ctl, + struct amdgpu_reset_context *reset_context) + { ++ struct list_head *reset_device_list = reset_context->reset_device_list; + struct amdgpu_device *tmp_adev = NULL; +- struct list_head reset_device_list; + int r; + ++ if (reset_device_list == NULL) ++ return -EINVAL; ++ + if (reset_context->reset_req_dev->ip_versions[MP1_HWIP][0] == + IP_VERSION(13, 0, 2) && + reset_context->hive == NULL) { +@@ -350,19 +345,7 @@ aldebaran_mode2_restore_hwcontext(struct amdgpu_reset_control *reset_ctl, + return -EINVAL; + } + +- INIT_LIST_HEAD(&reset_device_list); +- if (reset_context->hive) { +- list_for_each_entry (tmp_adev, +- &reset_context->hive->device_list, +- gmc.xgmi.head) +- list_add_tail(&tmp_adev->reset_list, +- &reset_device_list); +- } else { +- list_add_tail(&reset_context->reset_req_dev->reset_list, +- &reset_device_list); +- } +- +- list_for_each_entry (tmp_adev, &reset_device_list, reset_list) { ++ list_for_each_entry(tmp_adev, reset_device_list, reset_list) { + dev_info(tmp_adev->dev, + "GPU reset succeeded, trying to resume\n"); + r = aldebaran_mode2_restore_ip(tmp_adev); +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +index 58df107e3beb..3adebb63680e 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +@@ -4746,6 +4746,8 @@ int amdgpu_do_asic_reset(struct list_head *device_list_handle, + tmp_adev = list_first_entry(device_list_handle, struct amdgpu_device, + reset_list); + amdgpu_reset_reg_dumps(tmp_adev); ++ ++ reset_context->reset_device_list = device_list_handle; + r = amdgpu_reset_perform_reset(tmp_adev, reset_context); + /* If reset handler not implemented, continue; otherwise return */ + if (r == -ENOSYS) +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_reset.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_reset.h +index 1949dbe28a86..0c3ad85d84a4 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_reset.h ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_reset.h +@@ -37,6 +37,7 @@ struct amdgpu_reset_context { + struct amdgpu_device *reset_req_dev; + struct amdgpu_job *job; + struct amdgpu_hive_info *hive; ++ struct list_head *reset_device_list; + unsigned long flags; + }; + +-- +2.35.1 + diff --git a/queue-5.19/drm-amdgpu-fix-use-after-free-on-amdgpu_bo_list-mute.patch b/queue-5.19/drm-amdgpu-fix-use-after-free-on-amdgpu_bo_list-mute.patch new file mode 100644 index 00000000000..4724651c960 --- /dev/null +++ b/queue-5.19/drm-amdgpu-fix-use-after-free-on-amdgpu_bo_list-mute.patch @@ -0,0 +1,120 @@ +From c951319e40a49e0866bd4b7639ca513cc6e9b603 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Aug 2022 08:39:31 -0300 +Subject: drm/amdgpu: Fix use-after-free on amdgpu_bo_list mutex +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Maíra Canal + +[ Upstream commit bbca24d0a3c11193bafb9e174f89f52a379006e3 ] + +If amdgpu_cs_vm_handling returns r != 0, then it will unlock the +bo_list_mutex inside the function amdgpu_cs_vm_handling and again on +amdgpu_cs_parser_fini. This problem results in the following +use-after-free problem: + +[ 220.280990] ------------[ cut here ]------------ +[ 220.281000] refcount_t: underflow; use-after-free. +[ 220.281019] WARNING: CPU: 1 PID: 3746 at lib/refcount.c:28 refcount_warn_saturate+0xba/0x110 +[ 220.281029] ------------[ cut here ]------------ +[ 220.281415] CPU: 1 PID: 3746 Comm: chrome:cs0 Tainted: G W L ------- --- 5.20.0-0.rc0.20220812git7ebfc85e2cd7.10.fc38.x86_64 #1 +[ 220.281421] Hardware name: System manufacturer System Product Name/ROG STRIX X570-I GAMING, BIOS 4403 04/27/2022 +[ 220.281426] RIP: 0010:refcount_warn_saturate+0xba/0x110 +[ 220.281431] Code: 01 01 e8 79 4a 6f 00 0f 0b e9 42 47 a5 00 80 3d de +7e be 01 00 75 85 48 c7 c7 f8 98 8e 98 c6 05 ce 7e be 01 01 e8 56 4a +6f 00 <0f> 0b e9 1f 47 a5 00 80 3d b9 7e be 01 00 0f 85 5e ff ff ff 48 +c7 +[ 220.281437] RSP: 0018:ffffb4b0d18d7a80 EFLAGS: 00010282 +[ 220.281443] RAX: 0000000000000026 RBX: 0000000000000003 RCX: 0000000000000000 +[ 220.281448] RDX: 0000000000000001 RSI: ffffffff988d06dc RDI: 00000000ffffffff +[ 220.281452] RBP: 00000000ffffffff R08: 0000000000000000 R09: ffffb4b0d18d7930 +[ 220.281457] R10: 0000000000000003 R11: ffffa0672e2fffe8 R12: ffffa058ca360400 +[ 220.281461] R13: ffffa05846c50a18 R14: 00000000fffffe00 R15: 0000000000000003 +[ 220.281465] FS: 00007f82683e06c0(0000) GS:ffffa066e2e00000(0000) knlGS:0000000000000000 +[ 220.281470] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 220.281475] CR2: 00003590005cc000 CR3: 00000001fca46000 CR4: 0000000000350ee0 +[ 220.281480] Call Trace: +[ 220.281485] +[ 220.281490] amdgpu_cs_ioctl+0x4e2/0x2070 [amdgpu] +[ 220.281806] ? amdgpu_cs_find_mapping+0xe0/0xe0 [amdgpu] +[ 220.282028] drm_ioctl_kernel+0xa4/0x150 +[ 220.282043] drm_ioctl+0x21f/0x420 +[ 220.282053] ? amdgpu_cs_find_mapping+0xe0/0xe0 [amdgpu] +[ 220.282275] ? lock_release+0x14f/0x460 +[ 220.282282] ? _raw_spin_unlock_irqrestore+0x30/0x60 +[ 220.282290] ? _raw_spin_unlock_irqrestore+0x30/0x60 +[ 220.282297] ? lockdep_hardirqs_on+0x7d/0x100 +[ 220.282305] ? _raw_spin_unlock_irqrestore+0x40/0x60 +[ 220.282317] amdgpu_drm_ioctl+0x4a/0x80 [amdgpu] +[ 220.282534] __x64_sys_ioctl+0x90/0xd0 +[ 220.282545] do_syscall_64+0x5b/0x80 +[ 220.282551] ? futex_wake+0x6c/0x150 +[ 220.282568] ? lock_is_held_type+0xe8/0x140 +[ 220.282580] ? do_syscall_64+0x67/0x80 +[ 220.282585] ? lockdep_hardirqs_on+0x7d/0x100 +[ 220.282592] ? do_syscall_64+0x67/0x80 +[ 220.282597] ? do_syscall_64+0x67/0x80 +[ 220.282602] ? lockdep_hardirqs_on+0x7d/0x100 +[ 220.282609] entry_SYSCALL_64_after_hwframe+0x63/0xcd +[ 220.282616] RIP: 0033:0x7f8282a4f8bf +[ 220.282639] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 +00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 +0f 05 <89> c2 3d 00 f0 ff ff 77 18 48 8b 44 24 18 64 48 2b 04 25 28 00 +00 +[ 220.282644] RSP: 002b:00007f82683df410 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 +[ 220.282651] RAX: ffffffffffffffda RBX: 00007f82683df588 RCX: 00007f8282a4f8bf +[ 220.282655] RDX: 00007f82683df4d0 RSI: 00000000c0186444 RDI: 0000000000000018 +[ 220.282659] RBP: 00007f82683df4d0 R08: 00007f82683df5e0 R09: 00007f82683df4b0 +[ 220.282663] R10: 00001d04000a0600 R11: 0000000000000246 R12: 00000000c0186444 +[ 220.282667] R13: 0000000000000018 R14: 00007f82683df588 R15: 0000000000000003 +[ 220.282689] +[ 220.282693] irq event stamp: 6232311 +[ 220.282697] hardirqs last enabled at (6232319): [] __up_console_sem+0x5e/0x70 +[ 220.282704] hardirqs last disabled at (6232326): [] __up_console_sem+0x43/0x70 +[ 220.282709] softirqs last enabled at (6232072): [] __irq_exit_rcu+0xf9/0x170 +[ 220.282716] softirqs last disabled at (6232061): [] __irq_exit_rcu+0xf9/0x170 +[ 220.282722] ---[ end trace 0000000000000000 ]--- + +Therefore, remove the mutex_unlock from the amdgpu_cs_vm_handling +function, so that amdgpu_cs_submit and amdgpu_cs_parser_fini can handle +the unlock. + +Fixes: 90af0ca047f3 ("drm/amdgpu: Protect the amdgpu_bo_list list with a mutex v2") +Reported-by: Mikhail Gavrilov +Reviewed-by: Christian König +Reviewed-by: Melissa Wen +Signed-off-by: Maíra Canal +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 8 ++------ + 1 file changed, 2 insertions(+), 6 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c +index d8f1335bc68f..b7bae833c804 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c +@@ -837,16 +837,12 @@ static int amdgpu_cs_vm_handling(struct amdgpu_cs_parser *p) + continue; + + r = amdgpu_vm_bo_update(adev, bo_va, false); +- if (r) { +- mutex_unlock(&p->bo_list->bo_list_mutex); ++ if (r) + return r; +- } + + r = amdgpu_sync_fence(&p->job->sync, bo_va->last_pt_update); +- if (r) { +- mutex_unlock(&p->bo_list->bo_list_mutex); ++ if (r) + return r; +- } + } + + r = amdgpu_vm_handle_moved(adev, vm); +-- +2.35.1 + diff --git a/queue-5.19/drm-bridge-lvds-codec-fix-error-checking-of-drm_of_l.patch b/queue-5.19/drm-bridge-lvds-codec-fix-error-checking-of-drm_of_l.patch new file mode 100644 index 00000000000..d00c364878a --- /dev/null +++ b/queue-5.19/drm-bridge-lvds-codec-fix-error-checking-of-drm_of_l.patch @@ -0,0 +1,43 @@ +From c945c118eb2ac76e5ef95a6b6f6ab3cb6ea5aecd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Aug 2022 14:54:19 +0200 +Subject: drm/bridge: lvds-codec: Fix error checking of + drm_of_lvds_get_data_mapping() + +From: Marek Vasut + +[ Upstream commit 2bba782002c5dab6ca8d608b778b386fb912adff ] + +The drm_of_lvds_get_data_mapping() returns either negative value on +error or MEDIA_BUS_FMT_* otherwise. The check for 'ret' would also +catch the positive case of MEDIA_BUS_FMT_* and lead to probe failure +every time 'data-mapping' DT property is specified. + +Fixes: 7c4dd0a266527 ("drm: of: Add drm_of_lvds_get_data_mapping") +Signed-off-by: Marek Vasut +Cc: Laurent Pinchart +Cc: Sam Ravnborg +To: dri-devel@lists.freedesktop.org +Reviewed-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/20220801125419.167562-1-marex@denx.de +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/lvds-codec.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/bridge/lvds-codec.c b/drivers/gpu/drm/bridge/lvds-codec.c +index 702ea803a743..39e7004de720 100644 +--- a/drivers/gpu/drm/bridge/lvds-codec.c ++++ b/drivers/gpu/drm/bridge/lvds-codec.c +@@ -180,7 +180,7 @@ static int lvds_codec_probe(struct platform_device *pdev) + of_node_put(bus_node); + if (ret == -ENODEV) { + dev_warn(dev, "missing 'data-mapping' DT property\n"); +- } else if (ret) { ++ } else if (ret < 0) { + dev_err(dev, "invalid 'data-mapping' DT property\n"); + return ret; + } else { +-- +2.35.1 + diff --git a/queue-5.19/drm-i915-ttm-don-t-leak-the-ccs-state.patch b/queue-5.19/drm-i915-ttm-don-t-leak-the-ccs-state.patch new file mode 100644 index 00000000000..e38f49f1f48 --- /dev/null +++ b/queue-5.19/drm-i915-ttm-don-t-leak-the-ccs-state.patch @@ -0,0 +1,80 @@ +From 5bc73b481d4abcedfb43d8460b28cc331966332f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Jul 2022 17:43:46 +0100 +Subject: drm/i915/ttm: don't leak the ccs state +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Matthew Auld + +[ Upstream commit 232d150fa15606e96c0e01e5c7a2d4e03f621787 ] + +The kernel only manages the ccs state with lmem-only objects, however +the kernel should still take care not to leak the CCS state from the +previous user. + +Fixes: 48760ffe923a ("drm/i915/gt: Clear compress metadata for Flat-ccs objects") +Signed-off-by: Matthew Auld +Cc: Thomas Hellström +Cc: Ramalingam C +Reviewed-by: Ramalingam C +Link: https://patchwork.freedesktop.org/patch/msgid/20220727164346.282407-1-matthew.auld@intel.com +(cherry picked from commit 353819d85f87be46aeb9c1dd929d445a006fc6ec) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/gt/intel_migrate.c | 23 ++++++++++++++++++++++- + 1 file changed, 22 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/i915/gt/intel_migrate.c b/drivers/gpu/drm/i915/gt/intel_migrate.c +index 2c35324b5f68..2b10b96b17b5 100644 +--- a/drivers/gpu/drm/i915/gt/intel_migrate.c ++++ b/drivers/gpu/drm/i915/gt/intel_migrate.c +@@ -708,7 +708,7 @@ intel_context_migrate_copy(struct intel_context *ce, + u8 src_access, dst_access; + struct i915_request *rq; + int src_sz, dst_sz; +- bool ccs_is_src; ++ bool ccs_is_src, overwrite_ccs; + int err; + + GEM_BUG_ON(ce->vm != ce->engine->gt->migrate.context->vm); +@@ -749,6 +749,8 @@ intel_context_migrate_copy(struct intel_context *ce, + get_ccs_sg_sgt(&it_ccs, bytes_to_cpy); + } + ++ overwrite_ccs = HAS_FLAT_CCS(i915) && !ccs_bytes_to_cpy && dst_is_lmem; ++ + src_offset = 0; + dst_offset = CHUNK_SZ; + if (HAS_64K_PAGES(ce->engine->i915)) { +@@ -852,6 +854,25 @@ intel_context_migrate_copy(struct intel_context *ce, + if (err) + goto out_rq; + ccs_bytes_to_cpy -= ccs_sz; ++ } else if (overwrite_ccs) { ++ err = rq->engine->emit_flush(rq, EMIT_INVALIDATE); ++ if (err) ++ goto out_rq; ++ ++ /* ++ * While we can't always restore/manage the CCS state, ++ * we still need to ensure we don't leak the CCS state ++ * from the previous user, so make sure we overwrite it ++ * with something. ++ */ ++ err = emit_copy_ccs(rq, dst_offset, INDIRECT_ACCESS, ++ dst_offset, DIRECT_ACCESS, len); ++ if (err) ++ goto out_rq; ++ ++ err = rq->engine->emit_flush(rq, EMIT_INVALIDATE); ++ if (err) ++ goto out_rq; + } + + /* Arbitration is re-enabled between requests. */ +-- +2.35.1 + diff --git a/queue-5.19/drm-imx-dcss-get-rid-of-hpd-warning-message.patch b/queue-5.19/drm-imx-dcss-get-rid-of-hpd-warning-message.patch new file mode 100644 index 00000000000..586bee45266 --- /dev/null +++ b/queue-5.19/drm-imx-dcss-get-rid-of-hpd-warning-message.patch @@ -0,0 +1,43 @@ +From 486ea1fa27f9e21d7f8f64c0315ee1afcfb031ca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Jul 2022 15:09:12 +0300 +Subject: drm/imx/dcss: get rid of HPD warning message + +From: Laurentiu Palcu + +[ Upstream commit 30bdc36b8c776cd4fce5de2a96ff28b37f96942f ] + +When DCSS + MIPI_DSI is used, and the last bridge in the chain supports +HPD, we can see a "Hot plug detection already enabled" warning stack +trace dump that's thrown when DCSS is initialized. + +The problem appeared when HPD was enabled by default in the +bridge_connector initialization, which made the +drm_bridge_connector_enable_hpd() call, in DCSS init path, redundant. +So, let's remove that call. + +Fixes: 09077bc311658 ("drm/bridge_connector: enable HPD by default if supported") +Signed-off-by: Laurentiu Palcu +Reviewed-by: Laurent Pinchart +Link: https://patchwork.freedesktop.org/patch/msgid/20220721120912.6639-1-laurentiu.palcu@oss.nxp.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/imx/dcss/dcss-kms.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/gpu/drm/imx/dcss/dcss-kms.c b/drivers/gpu/drm/imx/dcss/dcss-kms.c +index 9b84df34a6a1..8cf3352d8858 100644 +--- a/drivers/gpu/drm/imx/dcss/dcss-kms.c ++++ b/drivers/gpu/drm/imx/dcss/dcss-kms.c +@@ -142,8 +142,6 @@ struct dcss_kms_dev *dcss_kms_attach(struct dcss_dev *dcss) + + drm_kms_helper_poll_init(drm); + +- drm_bridge_connector_enable_hpd(kms->connector); +- + ret = drm_dev_register(drm, 0); + if (ret) + goto cleanup_crtc; +-- +2.35.1 + diff --git a/queue-5.19/drm-meson-fix-overflow-implicit-truncation-warnings.patch b/queue-5.19/drm-meson-fix-overflow-implicit-truncation-warnings.patch new file mode 100644 index 00000000000..d0107c029b8 --- /dev/null +++ b/queue-5.19/drm-meson-fix-overflow-implicit-truncation-warnings.patch @@ -0,0 +1,72 @@ +From 6ae8f48c948cca6f8581a14c5549a84a8adc8313 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 May 2022 22:14:13 +0530 +Subject: drm/meson: Fix overflow implicit truncation warnings +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Sai Prakash Ranjan + +[ Upstream commit 98692f52c588225034cbff458622c2c06dfcb544 ] + +Fix -Woverflow warnings for drm/meson driver which is a result +of moving arm64 custom MMIO accessor macros to asm-generic function +implementations giving a bonus type-checking now and uncovering these +overflow warnings. + +drivers/gpu/drm/meson/meson_viu.c: In function ‘meson_viu_init’: +drivers/gpu/drm/meson/meson_registers.h:1826:48: error: large integer implicitly truncated to unsigned type [-Werror=overflow] + #define VIU_OSD_BLEND_REORDER(dest, src) ((src) << (dest * 4)) + ^ +drivers/gpu/drm/meson/meson_viu.c:472:18: note: in expansion of macro ‘VIU_OSD_BLEND_REORDER’ + writel_relaxed(VIU_OSD_BLEND_REORDER(0, 1) | + ^~~~~~~~~~~~~~~~~~~~~ + +Reported-by: kernel test robot +Signed-off-by: Sai Prakash Ranjan +Reviewed-by: Arnd Bergmann +Cc: Arnd Bergmann +Cc: Neil Armstrong +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/meson/meson_viu.c | 22 +++++++++++----------- + 1 file changed, 11 insertions(+), 11 deletions(-) + +diff --git a/drivers/gpu/drm/meson/meson_viu.c b/drivers/gpu/drm/meson/meson_viu.c +index 259f3e6bec90..bb7e109534de 100644 +--- a/drivers/gpu/drm/meson/meson_viu.c ++++ b/drivers/gpu/drm/meson/meson_viu.c +@@ -469,17 +469,17 @@ void meson_viu_init(struct meson_drm *priv) + priv->io_base + _REG(VD2_IF0_LUMA_FIFO_SIZE)); + + if (meson_vpu_is_compatible(priv, VPU_COMPATIBLE_G12A)) { +- writel_relaxed(VIU_OSD_BLEND_REORDER(0, 1) | +- VIU_OSD_BLEND_REORDER(1, 0) | +- VIU_OSD_BLEND_REORDER(2, 0) | +- VIU_OSD_BLEND_REORDER(3, 0) | +- VIU_OSD_BLEND_DIN_EN(1) | +- VIU_OSD_BLEND1_DIN3_BYPASS_TO_DOUT1 | +- VIU_OSD_BLEND1_DOUT_BYPASS_TO_BLEND2 | +- VIU_OSD_BLEND_DIN0_BYPASS_TO_DOUT0 | +- VIU_OSD_BLEND_BLEN2_PREMULT_EN(1) | +- VIU_OSD_BLEND_HOLD_LINES(4), +- priv->io_base + _REG(VIU_OSD_BLEND_CTRL)); ++ u32 val = (u32)VIU_OSD_BLEND_REORDER(0, 1) | ++ (u32)VIU_OSD_BLEND_REORDER(1, 0) | ++ (u32)VIU_OSD_BLEND_REORDER(2, 0) | ++ (u32)VIU_OSD_BLEND_REORDER(3, 0) | ++ (u32)VIU_OSD_BLEND_DIN_EN(1) | ++ (u32)VIU_OSD_BLEND1_DIN3_BYPASS_TO_DOUT1 | ++ (u32)VIU_OSD_BLEND1_DOUT_BYPASS_TO_BLEND2 | ++ (u32)VIU_OSD_BLEND_DIN0_BYPASS_TO_DOUT0 | ++ (u32)VIU_OSD_BLEND_BLEN2_PREMULT_EN(1) | ++ (u32)VIU_OSD_BLEND_HOLD_LINES(4); ++ writel_relaxed(val, priv->io_base + _REG(VIU_OSD_BLEND_CTRL)); + + writel_relaxed(OSD_BLEND_PATH_SEL_ENABLE, + priv->io_base + _REG(OSD1_BLEND_SRC_CTRL)); +-- +2.35.1 + diff --git a/queue-5.19/drm-meson-fix-refcount-bugs-in-meson_vpu_has_availab.patch b/queue-5.19/drm-meson-fix-refcount-bugs-in-meson_vpu_has_availab.patch new file mode 100644 index 00000000000..4628abe7e4e --- /dev/null +++ b/queue-5.19/drm-meson-fix-refcount-bugs-in-meson_vpu_has_availab.patch @@ -0,0 +1,46 @@ +From c57068000da67a47d909cb143e11bc196f896792 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Jul 2022 09:07:22 +0800 +Subject: drm/meson: Fix refcount bugs in meson_vpu_has_available_connectors() + +From: Liang He + +[ Upstream commit 91b3c8dbe898df158fd2a84675f3a284ff6666f7 ] + +In this function, there are two refcount leak bugs: +(1) when breaking out of for_each_endpoint_of_node(), we need call +the of_node_put() for the 'ep'; +(2) we should call of_node_put() for the reference returned by +of_graph_get_remote_port() when it is not used anymore. + +Fixes: bbbe775ec5b5 ("drm: Add support for Amlogic Meson Graphic Controller") +Signed-off-by: Liang He +Acked-by: Martin Blumenstingl +Acked-by: Neil Armstrong +Signed-off-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/20220726010722.1319416-1-windhl@126.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/meson/meson_drv.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/meson/meson_drv.c b/drivers/gpu/drm/meson/meson_drv.c +index 1b70938cfd2c..bd4ca11d3ff5 100644 +--- a/drivers/gpu/drm/meson/meson_drv.c ++++ b/drivers/gpu/drm/meson/meson_drv.c +@@ -115,8 +115,11 @@ static bool meson_vpu_has_available_connectors(struct device *dev) + for_each_endpoint_of_node(dev->of_node, ep) { + /* If the endpoint node exists, consider it enabled */ + remote = of_graph_get_remote_port(ep); +- if (remote) ++ if (remote) { ++ of_node_put(remote); ++ of_node_put(ep); + return true; ++ } + } + + return false; +-- +2.35.1 + diff --git a/queue-5.19/drm-sun4i-dsi-prevent-underflow-when-computing-packe.patch b/queue-5.19/drm-sun4i-dsi-prevent-underflow-when-computing-packe.patch new file mode 100644 index 00000000000..699dba7c502 --- /dev/null +++ b/queue-5.19/drm-sun4i-dsi-prevent-underflow-when-computing-packe.patch @@ -0,0 +1,79 @@ +From 3cd74eff9b31a7e7092d43c9168830e298672fe7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Aug 2022 22:16:23 -0500 +Subject: drm/sun4i: dsi: Prevent underflow when computing packet sizes + +From: Samuel Holland + +[ Upstream commit 82a1356a933d8443139f8886f11b63c974a09a67 ] + +Currently, the packet overhead is subtracted using unsigned arithmetic. +With a short sync pulse, this could underflow and wrap around to near +the maximal u16 value. Fix this by using signed subtraction. The call to +max() will correctly handle any negative numbers that are produced. + +Apply the same fix to the other timings, even though those subtractions +are less likely to underflow. + +Fixes: 133add5b5ad4 ("drm/sun4i: Add Allwinner A31 MIPI-DSI controller support") +Signed-off-by: Samuel Holland +Reviewed-by: Jernej Skrabec +Signed-off-by: Maxime Ripard +Link: https://lore.kernel.org/r/20220812031623.34057-1-samuel@sholland.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c b/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c +index b4dfa166eccd..34234a144e87 100644 +--- a/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c ++++ b/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c +@@ -531,7 +531,7 @@ static void sun6i_dsi_setup_timings(struct sun6i_dsi *dsi, + struct drm_display_mode *mode) + { + struct mipi_dsi_device *device = dsi->device; +- unsigned int Bpp = mipi_dsi_pixel_format_to_bpp(device->format) / 8; ++ int Bpp = mipi_dsi_pixel_format_to_bpp(device->format) / 8; + u16 hbp = 0, hfp = 0, hsa = 0, hblk = 0, vblk = 0; + u32 basic_ctl = 0; + size_t bytes; +@@ -555,7 +555,7 @@ static void sun6i_dsi_setup_timings(struct sun6i_dsi *dsi, + * (4 bytes). Its minimal size is therefore 10 bytes + */ + #define HSA_PACKET_OVERHEAD 10 +- hsa = max((unsigned int)HSA_PACKET_OVERHEAD, ++ hsa = max(HSA_PACKET_OVERHEAD, + (mode->hsync_end - mode->hsync_start) * Bpp - HSA_PACKET_OVERHEAD); + + /* +@@ -564,7 +564,7 @@ static void sun6i_dsi_setup_timings(struct sun6i_dsi *dsi, + * therefore 6 bytes + */ + #define HBP_PACKET_OVERHEAD 6 +- hbp = max((unsigned int)HBP_PACKET_OVERHEAD, ++ hbp = max(HBP_PACKET_OVERHEAD, + (mode->htotal - mode->hsync_end) * Bpp - HBP_PACKET_OVERHEAD); + + /* +@@ -574,7 +574,7 @@ static void sun6i_dsi_setup_timings(struct sun6i_dsi *dsi, + * 16 bytes + */ + #define HFP_PACKET_OVERHEAD 16 +- hfp = max((unsigned int)HFP_PACKET_OVERHEAD, ++ hfp = max(HFP_PACKET_OVERHEAD, + (mode->hsync_start - mode->hdisplay) * Bpp - HFP_PACKET_OVERHEAD); + + /* +@@ -583,7 +583,7 @@ static void sun6i_dsi_setup_timings(struct sun6i_dsi *dsi, + * bytes). Its minimal size is therefore 10 bytes. + */ + #define HBLK_PACKET_OVERHEAD 10 +- hblk = max((unsigned int)HBLK_PACKET_OVERHEAD, ++ hblk = max(HBLK_PACKET_OVERHEAD, + (mode->htotal - (mode->hsync_end - mode->hsync_start)) * Bpp - + HBLK_PACKET_OVERHEAD); + +-- +2.35.1 + diff --git a/queue-5.19/ext4-avoid-remove-directory-when-directory-is-corrup.patch b/queue-5.19/ext4-avoid-remove-directory-when-directory-is-corrup.patch new file mode 100644 index 00000000000..db2832cfe78 --- /dev/null +++ b/queue-5.19/ext4-avoid-remove-directory-when-directory-is-corrup.patch @@ -0,0 +1,43 @@ +From 17073c072075984f2dd7f919bef62dc49c49b884 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Jun 2022 17:02:23 +0800 +Subject: ext4: avoid remove directory when directory is corrupted + +From: Ye Bin + +[ Upstream commit b24e77ef1c6d4dbf42749ad4903c97539cc9755a ] + +Now if check directoy entry is corrupted, ext4_empty_dir may return true +then directory will be removed when file system mounted with "errors=continue". +In order not to make things worse just return false when directory is corrupted. + +Signed-off-by: Ye Bin +Reviewed-by: Jan Kara +Link: https://lore.kernel.org/r/20220622090223.682234-1-yebin10@huawei.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/namei.c | 7 ++----- + 1 file changed, 2 insertions(+), 5 deletions(-) + +diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c +index 4af441494e09..3a31b662f661 100644 +--- a/fs/ext4/namei.c ++++ b/fs/ext4/namei.c +@@ -3090,11 +3090,8 @@ bool ext4_empty_dir(struct inode *inode) + de = (struct ext4_dir_entry_2 *) (bh->b_data + + (offset & (sb->s_blocksize - 1))); + if (ext4_check_dir_entry(inode, NULL, de, bh, +- bh->b_data, bh->b_size, offset)) { +- offset = (offset | (sb->s_blocksize - 1)) + 1; +- continue; +- } +- if (le32_to_cpu(de->inode)) { ++ bh->b_data, bh->b_size, offset) || ++ le32_to_cpu(de->inode)) { + brelse(bh); + return false; + } +-- +2.35.1 + diff --git a/queue-5.19/ext4-avoid-resizing-to-a-partial-cluster-size.patch b/queue-5.19/ext4-avoid-resizing-to-a-partial-cluster-size.patch new file mode 100644 index 00000000000..8f0db491963 --- /dev/null +++ b/queue-5.19/ext4-avoid-resizing-to-a-partial-cluster-size.patch @@ -0,0 +1,47 @@ +From 8c6329cbee8ca211e98a3fcbddba3631d2e7725c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Jul 2022 04:27:48 +0000 +Subject: ext4: avoid resizing to a partial cluster size + +From: Kiselev, Oleg + +[ Upstream commit 69cb8e9d8cd97cdf5e293b26d70a9dee3e35e6bd ] + +This patch avoids an attempt to resize the filesystem to an +unaligned cluster boundary. An online resize to a size that is not +integral to cluster size results in the last iteration attempting to +grow the fs by a negative amount, which trips a BUG_ON and leaves the fs +with a corrupted in-memory superblock. + +Signed-off-by: Oleg Kiselev +Link: https://lore.kernel.org/r/0E92A0AB-4F16-4F1A-94B7-702CC6504FDE@amazon.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/resize.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c +index e5c2713aa11a..cb5a64293881 100644 +--- a/fs/ext4/resize.c ++++ b/fs/ext4/resize.c +@@ -1989,6 +1989,16 @@ int ext4_resize_fs(struct super_block *sb, ext4_fsblk_t n_blocks_count) + } + brelse(bh); + ++ /* ++ * For bigalloc, trim the requested size to the nearest cluster ++ * boundary to avoid creating an unusable filesystem. We do this ++ * silently, instead of returning an error, to avoid breaking ++ * callers that blindly resize the filesystem to the full size of ++ * the underlying block device. ++ */ ++ if (ext4_has_feature_bigalloc(sb)) ++ n_blocks_count &= ~((1 << EXT4_CLUSTER_BITS(sb)) - 1); ++ + retry: + o_blocks_count = ext4_blocks_count(es); + +-- +2.35.1 + diff --git a/queue-5.19/ext4-block-range-must-be-validated-before-use-in-ext.patch b/queue-5.19/ext4-block-range-must-be-validated-before-use-in-ext.patch new file mode 100644 index 00000000000..941d5ff02e3 --- /dev/null +++ b/queue-5.19/ext4-block-range-must-be-validated-before-use-in-ext.patch @@ -0,0 +1,147 @@ +From 0f47fa7dcfa0691c0ae42afc8f3d78e981e1ba8e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Jul 2022 18:59:03 +0200 +Subject: ext4: block range must be validated before use in ext4_mb_clear_bb() + +From: Lukas Czerner + +[ Upstream commit 1e1c2b86ef86a8477fd9b9a4f48a6bfe235606f6 ] + +Block range to free is validated in ext4_free_blocks() using +ext4_inode_block_valid() and then it's passed to ext4_mb_clear_bb(). +However in some situations on bigalloc file system the range might be +adjusted after the validation in ext4_free_blocks() which can lead to +troubles on corrupted file systems such as one found by syzkaller that +resulted in the following BUG + +kernel BUG at fs/ext4/ext4.h:3319! +PREEMPT SMP NOPTI +CPU: 28 PID: 4243 Comm: repro Kdump: loaded Not tainted 5.19.0-rc6+ #1 +Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1.fc35 04/01/2014 +RIP: 0010:ext4_free_blocks+0x95e/0xa90 +Call Trace: + + ? lock_timer_base+0x61/0x80 + ? __es_remove_extent+0x5a/0x760 + ? __mod_timer+0x256/0x380 + ? ext4_ind_truncate_ensure_credits+0x90/0x220 + ext4_clear_blocks+0x107/0x1b0 + ext4_free_data+0x15b/0x170 + ext4_ind_truncate+0x214/0x2c0 + ? _raw_spin_unlock+0x15/0x30 + ? ext4_discard_preallocations+0x15a/0x410 + ? ext4_journal_check_start+0xe/0x90 + ? __ext4_journal_start_sb+0x2f/0x110 + ext4_truncate+0x1b5/0x460 + ? __ext4_journal_start_sb+0x2f/0x110 + ext4_evict_inode+0x2b4/0x6f0 + evict+0xd0/0x1d0 + ext4_enable_quotas+0x11f/0x1f0 + ext4_orphan_cleanup+0x3de/0x430 + ? proc_create_seq_private+0x43/0x50 + ext4_fill_super+0x295f/0x3ae0 + ? snprintf+0x39/0x40 + ? sget_fc+0x19c/0x330 + ? ext4_reconfigure+0x850/0x850 + get_tree_bdev+0x16d/0x260 + vfs_get_tree+0x25/0xb0 + path_mount+0x431/0xa70 + __x64_sys_mount+0xe2/0x120 + do_syscall_64+0x5b/0x80 + ? do_user_addr_fault+0x1e2/0x670 + ? exc_page_fault+0x70/0x170 + entry_SYSCALL_64_after_hwframe+0x46/0xb0 +RIP: 0033:0x7fdf4e512ace + +Fix it by making sure that the block range is properly validated before +used every time it changes in ext4_free_blocks() or ext4_mb_clear_bb(). + +Link: https://syzkaller.appspot.com/bug?id=5266d464285a03cee9dbfda7d2452a72c3c2ae7c +Reported-by: syzbot+15cd994e273307bf5cfa@syzkaller.appspotmail.com +Signed-off-by: Lukas Czerner +Cc: Tadeusz Struk +Tested-by: Tadeusz Struk +Link: https://lore.kernel.org/r/20220714165903.58260-1-lczerner@redhat.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/mballoc.c | 21 ++++++++++++++++++++- + 1 file changed, 20 insertions(+), 1 deletion(-) + +diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c +index 9e06334771a3..38e7dc2531b1 100644 +--- a/fs/ext4/mballoc.c ++++ b/fs/ext4/mballoc.c +@@ -5928,6 +5928,15 @@ static void ext4_mb_clear_bb(handle_t *handle, struct inode *inode, + + sbi = EXT4_SB(sb); + ++ if (!(flags & EXT4_FREE_BLOCKS_VALIDATED) && ++ !ext4_inode_block_valid(inode, block, count)) { ++ ext4_error(sb, "Freeing blocks in system zone - " ++ "Block = %llu, count = %lu", block, count); ++ /* err = 0. ext4_std_error should be a no op */ ++ goto error_return; ++ } ++ flags |= EXT4_FREE_BLOCKS_VALIDATED; ++ + do_more: + overflow = 0; + ext4_get_group_no_and_offset(sb, block, &block_group, &bit); +@@ -5944,6 +5953,8 @@ static void ext4_mb_clear_bb(handle_t *handle, struct inode *inode, + overflow = EXT4_C2B(sbi, bit) + count - + EXT4_BLOCKS_PER_GROUP(sb); + count -= overflow; ++ /* The range changed so it's no longer validated */ ++ flags &= ~EXT4_FREE_BLOCKS_VALIDATED; + } + count_clusters = EXT4_NUM_B2C(sbi, count); + bitmap_bh = ext4_read_block_bitmap(sb, block_group); +@@ -5958,7 +5969,8 @@ static void ext4_mb_clear_bb(handle_t *handle, struct inode *inode, + goto error_return; + } + +- if (!ext4_inode_block_valid(inode, block, count)) { ++ if (!(flags & EXT4_FREE_BLOCKS_VALIDATED) && ++ !ext4_inode_block_valid(inode, block, count)) { + ext4_error(sb, "Freeing blocks in system zone - " + "Block = %llu, count = %lu", block, count); + /* err = 0. ext4_std_error should be a no op */ +@@ -6081,6 +6093,8 @@ static void ext4_mb_clear_bb(handle_t *handle, struct inode *inode, + block += count; + count = overflow; + put_bh(bitmap_bh); ++ /* The range changed so it's no longer validated */ ++ flags &= ~EXT4_FREE_BLOCKS_VALIDATED; + goto do_more; + } + error_return: +@@ -6127,6 +6141,7 @@ void ext4_free_blocks(handle_t *handle, struct inode *inode, + "block = %llu, count = %lu", block, count); + return; + } ++ flags |= EXT4_FREE_BLOCKS_VALIDATED; + + ext4_debug("freeing block %llu\n", block); + trace_ext4_free_blocks(inode, block, count, flags); +@@ -6158,6 +6173,8 @@ void ext4_free_blocks(handle_t *handle, struct inode *inode, + block -= overflow; + count += overflow; + } ++ /* The range changed so it's no longer validated */ ++ flags &= ~EXT4_FREE_BLOCKS_VALIDATED; + } + overflow = EXT4_LBLK_COFF(sbi, count); + if (overflow) { +@@ -6168,6 +6185,8 @@ void ext4_free_blocks(handle_t *handle, struct inode *inode, + return; + } else + count += sbi->s_cluster_ratio - overflow; ++ /* The range changed so it's no longer validated */ ++ flags &= ~EXT4_FREE_BLOCKS_VALIDATED; + } + + if (!bh && (flags & EXT4_FREE_BLOCKS_FORGET)) { +-- +2.35.1 + diff --git a/queue-5.19/f2fs-fix-null-ptr-deref-in-f2fs_get_dnode_of_data.patch b/queue-5.19/f2fs-fix-null-ptr-deref-in-f2fs_get_dnode_of_data.patch new file mode 100644 index 00000000000..27734eaf470 --- /dev/null +++ b/queue-5.19/f2fs-fix-null-ptr-deref-in-f2fs_get_dnode_of_data.patch @@ -0,0 +1,124 @@ +From eed55d04d4185ca2f32fad85385ca5c91a79253b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Aug 2022 19:26:04 +0800 +Subject: f2fs: fix null-ptr-deref in f2fs_get_dnode_of_data + +From: Ye Bin + +[ Upstream commit 4a2c5b7994960fac29cf8a3f4e62855bae1b27d4 ] + +There is issue as follows when test f2fs atomic write: +F2FS-fs (loop0): Can't find valid F2FS filesystem in 2th superblock +F2FS-fs (loop0): invalid crc_offset: 0 +F2FS-fs (loop0): f2fs_check_nid_range: out-of-range nid=1, run fsck to fix. +F2FS-fs (loop0): f2fs_check_nid_range: out-of-range nid=2, run fsck to fix. +================================================================== +BUG: KASAN: null-ptr-deref in f2fs_get_dnode_of_data+0xac/0x16d0 +Read of size 8 at addr 0000000000000028 by task rep/1990 + +CPU: 4 PID: 1990 Comm: rep Not tainted 5.19.0-rc6-next-20220715 #266 +Call Trace: + + dump_stack_lvl+0x6e/0x91 + print_report.cold+0x49a/0x6bb + kasan_report+0xa8/0x130 + f2fs_get_dnode_of_data+0xac/0x16d0 + f2fs_do_write_data_page+0x2a5/0x1030 + move_data_page+0x3c5/0xdf0 + do_garbage_collect+0x2015/0x36c0 + f2fs_gc+0x554/0x1d30 + f2fs_balance_fs+0x7f5/0xda0 + f2fs_write_single_data_page+0xb66/0xdc0 + f2fs_write_cache_pages+0x716/0x1420 + f2fs_write_data_pages+0x84f/0x9a0 + do_writepages+0x130/0x3a0 + filemap_fdatawrite_wbc+0x87/0xa0 + file_write_and_wait_range+0x157/0x1c0 + f2fs_do_sync_file+0x206/0x12d0 + f2fs_sync_file+0x99/0xc0 + vfs_fsync_range+0x75/0x140 + f2fs_file_write_iter+0xd7b/0x1850 + vfs_write+0x645/0x780 + ksys_write+0xf1/0x1e0 + do_syscall_64+0x3b/0x90 + entry_SYSCALL_64_after_hwframe+0x63/0xcd + +As 3db1de0e582c commit changed atomic write way which new a cow_inode for +atomic write file, and also mark cow_inode as FI_ATOMIC_FILE. +When f2fs_do_write_data_page write cow_inode will use cow_inode's cow_inode +which is NULL. Then will trigger null-ptr-deref. +To solve above issue, introduce FI_COW_FILE flag for COW inode. + +Fiexes: 3db1de0e582c("f2fs: change the current atomic write way") +Signed-off-by: Ye Bin +Reviewed-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/f2fs.h | 6 ++++++ + fs/f2fs/file.c | 2 +- + fs/f2fs/segment.c | 4 ++-- + 3 files changed, 9 insertions(+), 3 deletions(-) + +diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h +index 5c950298837f..7006fa7dd5cb 100644 +--- a/fs/f2fs/f2fs.h ++++ b/fs/f2fs/f2fs.h +@@ -757,6 +757,7 @@ enum { + FI_ENABLE_COMPRESS, /* enable compression in "user" compression mode */ + FI_COMPRESS_RELEASED, /* compressed blocks were released */ + FI_ALIGNED_WRITE, /* enable aligned write */ ++ FI_COW_FILE, /* indicate COW file */ + FI_MAX, /* max flag, never be used */ + }; + +@@ -3208,6 +3209,11 @@ static inline bool f2fs_is_atomic_file(struct inode *inode) + return is_inode_flag_set(inode, FI_ATOMIC_FILE); + } + ++static inline bool f2fs_is_cow_file(struct inode *inode) ++{ ++ return is_inode_flag_set(inode, FI_COW_FILE); ++} ++ + static inline bool f2fs_is_first_block_written(struct inode *inode) + { + return is_inode_flag_set(inode, FI_FIRST_BLOCK_WRITTEN); +diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c +index 41547604f192..ecd833ba35fc 100644 +--- a/fs/f2fs/file.c ++++ b/fs/f2fs/file.c +@@ -2061,7 +2061,7 @@ static int f2fs_ioc_start_atomic_write(struct file *filp) + spin_unlock(&sbi->inode_lock[ATOMIC_FILE]); + + set_inode_flag(inode, FI_ATOMIC_FILE); +- set_inode_flag(fi->cow_inode, FI_ATOMIC_FILE); ++ set_inode_flag(fi->cow_inode, FI_COW_FILE); + clear_inode_flag(fi->cow_inode, FI_INLINE_DATA); + f2fs_up_write(&fi->i_gc_rwsem[WRITE]); + +diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c +index ac890c9fa8a1..52df19a0638b 100644 +--- a/fs/f2fs/segment.c ++++ b/fs/f2fs/segment.c +@@ -193,7 +193,7 @@ void f2fs_abort_atomic_write(struct inode *inode, bool clean) + if (f2fs_is_atomic_file(inode)) { + if (clean) + truncate_inode_pages_final(inode->i_mapping); +- clear_inode_flag(fi->cow_inode, FI_ATOMIC_FILE); ++ clear_inode_flag(fi->cow_inode, FI_COW_FILE); + iput(fi->cow_inode); + fi->cow_inode = NULL; + clear_inode_flag(inode, FI_ATOMIC_FILE); +@@ -3166,7 +3166,7 @@ static int __get_segment_type_6(struct f2fs_io_info *fio) + return CURSEG_COLD_DATA; + if (file_is_hot(inode) || + is_inode_flag_set(inode, FI_HOT_DATA) || +- f2fs_is_atomic_file(inode)) ++ f2fs_is_cow_file(inode)) + return CURSEG_HOT_DATA; + return f2fs_rw_hint_to_seg_type(inode->i_write_hint); + } else { +-- +2.35.1 + diff --git a/queue-5.19/f2fs-fix-to-avoid-use-f2fs_bug_on-in-f2fs_new_node_p.patch b/queue-5.19/f2fs-fix-to-avoid-use-f2fs_bug_on-in-f2fs_new_node_p.patch new file mode 100644 index 00000000000..ee3cdd6e644 --- /dev/null +++ b/queue-5.19/f2fs-fix-to-avoid-use-f2fs_bug_on-in-f2fs_new_node_p.patch @@ -0,0 +1,63 @@ +From 84aac8b3a09404badd69aaab62ded09b2e42e43a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Jul 2022 00:03:23 +0800 +Subject: f2fs: fix to avoid use f2fs_bug_on() in f2fs_new_node_page() + +From: Chao Yu + +[ Upstream commit 141170b759e03958f296033bb7001be62d1d363b ] + +As Dipanjan Das reported, syzkaller +found a f2fs bug as below: + +RIP: 0010:f2fs_new_node_page+0x19ac/0x1fc0 fs/f2fs/node.c:1295 +Call Trace: + write_all_xattrs fs/f2fs/xattr.c:487 [inline] + __f2fs_setxattr+0xe76/0x2e10 fs/f2fs/xattr.c:743 + f2fs_setxattr+0x233/0xab0 fs/f2fs/xattr.c:790 + f2fs_xattr_generic_set+0x133/0x170 fs/f2fs/xattr.c:86 + __vfs_setxattr+0x115/0x180 fs/xattr.c:182 + __vfs_setxattr_noperm+0x125/0x5f0 fs/xattr.c:216 + __vfs_setxattr_locked+0x1cf/0x260 fs/xattr.c:277 + vfs_setxattr+0x13f/0x330 fs/xattr.c:303 + setxattr+0x146/0x160 fs/xattr.c:611 + path_setxattr+0x1a7/0x1d0 fs/xattr.c:630 + __do_sys_lsetxattr fs/xattr.c:653 [inline] + __se_sys_lsetxattr fs/xattr.c:649 [inline] + __x64_sys_lsetxattr+0xbd/0x150 fs/xattr.c:649 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x46/0xb0 + +NAT entry and nat bitmap can be inconsistent, e.g. one nid is free +in nat bitmap, and blkaddr in its NAT entry is not NULL_ADDR, it +may trigger BUG_ON() in f2fs_new_node_page(), fix it. + +Reported-by: Dipanjan Das +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/node.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c +index cf6f7fc83c08..02e92a72511b 100644 +--- a/fs/f2fs/node.c ++++ b/fs/f2fs/node.c +@@ -1292,7 +1292,11 @@ struct page *f2fs_new_node_page(struct dnode_of_data *dn, unsigned int ofs) + dec_valid_node_count(sbi, dn->inode, !ofs); + goto fail; + } +- f2fs_bug_on(sbi, new_ni.blk_addr != NULL_ADDR); ++ if (unlikely(new_ni.blk_addr != NULL_ADDR)) { ++ err = -EFSCORRUPTED; ++ set_sbi_flag(sbi, SBI_NEED_FSCK); ++ goto fail; ++ } + #endif + new_ni.nid = dn->nid; + new_ni.ino = dn->inode->i_ino; +-- +2.35.1 + diff --git a/queue-5.19/f2fs-fix-to-do-sanity-check-on-segment-type-in-build.patch b/queue-5.19/f2fs-fix-to-do-sanity-check-on-segment-type-in-build.patch new file mode 100644 index 00000000000..d8160554907 --- /dev/null +++ b/queue-5.19/f2fs-fix-to-do-sanity-check-on-segment-type-in-build.patch @@ -0,0 +1,78 @@ +From ca7a549a0d8761037df603d77756a9699f24e95d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Jul 2022 22:51:05 +0800 +Subject: f2fs: fix to do sanity check on segment type in build_sit_entries() + +From: Chao Yu + +[ Upstream commit 09beadf289d6e300553e60d6e76f13c0427ecab3 ] + +As Wenqing Liu reported in bugzilla: + +https://bugzilla.kernel.org/show_bug.cgi?id=216285 + +RIP: 0010:memcpy_erms+0x6/0x10 + f2fs_update_meta_page+0x84/0x570 [f2fs] + change_curseg.constprop.0+0x159/0xbd0 [f2fs] + f2fs_do_replace_block+0x5c7/0x18a0 [f2fs] + f2fs_replace_block+0xeb/0x180 [f2fs] + recover_data+0x1abd/0x6f50 [f2fs] + f2fs_recover_fsync_data+0x12ce/0x3250 [f2fs] + f2fs_fill_super+0x4459/0x6190 [f2fs] + mount_bdev+0x2cf/0x3b0 + legacy_get_tree+0xed/0x1d0 + vfs_get_tree+0x81/0x2b0 + path_mount+0x47e/0x19d0 + do_mount+0xce/0xf0 + __x64_sys_mount+0x12c/0x1a0 + do_syscall_64+0x38/0x90 + entry_SYSCALL_64_after_hwframe+0x63/0xcd + +The root cause is segment type is invalid, so in f2fs_do_replace_block(), +f2fs accesses f2fs_sm_info::curseg_array with out-of-range segment type, +result in accessing invalid curseg->sum_blk during memcpy in +f2fs_update_meta_page(). Fix this by adding sanity check on segment type +in build_sit_entries(). + +Reported-by: Wenqing Liu +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/segment.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c +index 874c1b9c41a2..ac890c9fa8a1 100644 +--- a/fs/f2fs/segment.c ++++ b/fs/f2fs/segment.c +@@ -4362,6 +4362,12 @@ static int build_sit_entries(struct f2fs_sb_info *sbi) + return err; + seg_info_from_raw_sit(se, &sit); + ++ if (se->type >= NR_PERSISTENT_LOG) { ++ f2fs_err(sbi, "Invalid segment type: %u, segno: %u", ++ se->type, start); ++ return -EFSCORRUPTED; ++ } ++ + sit_valid_blocks[SE_PAGETYPE(se)] += se->valid_blocks; + + if (f2fs_block_unit_discard(sbi)) { +@@ -4410,6 +4416,13 @@ static int build_sit_entries(struct f2fs_sb_info *sbi) + break; + seg_info_from_raw_sit(se, &sit); + ++ if (se->type >= NR_PERSISTENT_LOG) { ++ f2fs_err(sbi, "Invalid segment type: %u, segno: %u", ++ se->type, start); ++ err = -EFSCORRUPTED; ++ break; ++ } ++ + sit_valid_blocks[SE_PAGETYPE(se)] += se->valid_blocks; + + if (f2fs_block_unit_discard(sbi)) { +-- +2.35.1 + diff --git a/queue-5.19/f2fs-revive-f2fs_ioc_abort_volatile_write.patch b/queue-5.19/f2fs-revive-f2fs_ioc_abort_volatile_write.patch new file mode 100644 index 00000000000..1f97645887c --- /dev/null +++ b/queue-5.19/f2fs-revive-f2fs_ioc_abort_volatile_write.patch @@ -0,0 +1,96 @@ +From ffc931d64638e53ec0504c9d2d3e57045fcd70d1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Aug 2022 10:08:08 -0700 +Subject: f2fs: revive F2FS_IOC_ABORT_VOLATILE_WRITE + +From: Daeho Jeong + +[ Upstream commit 23339e5752d01a4b5e122759b002cf896d26f6c1 ] + +F2FS_IOC_ABORT_VOLATILE_WRITE was used to abort a atomic write before. +However it was removed accidentally. So revive it by changing the name, +since volatile write had gone. + +Signed-off-by: Daeho Jeong +Fiexes: 7bc155fec5b3("f2fs: kill volatile write support") +Reviewed-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/file.c | 30 ++++++++++++++++++++++++++++-- + include/uapi/linux/f2fs.h | 2 +- + 2 files changed, 29 insertions(+), 3 deletions(-) + +diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c +index fc0f30738b21..41547604f192 100644 +--- a/fs/f2fs/file.c ++++ b/fs/f2fs/file.c +@@ -2108,6 +2108,31 @@ static int f2fs_ioc_commit_atomic_write(struct file *filp) + return ret; + } + ++static int f2fs_ioc_abort_atomic_write(struct file *filp) ++{ ++ struct inode *inode = file_inode(filp); ++ struct user_namespace *mnt_userns = file_mnt_user_ns(filp); ++ int ret; ++ ++ if (!inode_owner_or_capable(mnt_userns, inode)) ++ return -EACCES; ++ ++ ret = mnt_want_write_file(filp); ++ if (ret) ++ return ret; ++ ++ inode_lock(inode); ++ ++ if (f2fs_is_atomic_file(inode)) ++ f2fs_abort_atomic_write(inode, true); ++ ++ inode_unlock(inode); ++ ++ mnt_drop_write_file(filp); ++ f2fs_update_time(F2FS_I_SB(inode), REQ_TIME); ++ return ret; ++} ++ + static int f2fs_ioc_shutdown(struct file *filp, unsigned long arg) + { + struct inode *inode = file_inode(filp); +@@ -4063,9 +4088,10 @@ static long __f2fs_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) + return f2fs_ioc_start_atomic_write(filp); + case F2FS_IOC_COMMIT_ATOMIC_WRITE: + return f2fs_ioc_commit_atomic_write(filp); ++ case F2FS_IOC_ABORT_ATOMIC_WRITE: ++ return f2fs_ioc_abort_atomic_write(filp); + case F2FS_IOC_START_VOLATILE_WRITE: + case F2FS_IOC_RELEASE_VOLATILE_WRITE: +- case F2FS_IOC_ABORT_VOLATILE_WRITE: + return -EOPNOTSUPP; + case F2FS_IOC_SHUTDOWN: + return f2fs_ioc_shutdown(filp, arg); +@@ -4734,7 +4760,7 @@ long f2fs_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg) + case F2FS_IOC_COMMIT_ATOMIC_WRITE: + case F2FS_IOC_START_VOLATILE_WRITE: + case F2FS_IOC_RELEASE_VOLATILE_WRITE: +- case F2FS_IOC_ABORT_VOLATILE_WRITE: ++ case F2FS_IOC_ABORT_ATOMIC_WRITE: + case F2FS_IOC_SHUTDOWN: + case FITRIM: + case FS_IOC_SET_ENCRYPTION_POLICY: +diff --git a/include/uapi/linux/f2fs.h b/include/uapi/linux/f2fs.h +index 352a822d4370..3121d127d5aa 100644 +--- a/include/uapi/linux/f2fs.h ++++ b/include/uapi/linux/f2fs.h +@@ -13,7 +13,7 @@ + #define F2FS_IOC_COMMIT_ATOMIC_WRITE _IO(F2FS_IOCTL_MAGIC, 2) + #define F2FS_IOC_START_VOLATILE_WRITE _IO(F2FS_IOCTL_MAGIC, 3) + #define F2FS_IOC_RELEASE_VOLATILE_WRITE _IO(F2FS_IOCTL_MAGIC, 4) +-#define F2FS_IOC_ABORT_VOLATILE_WRITE _IO(F2FS_IOCTL_MAGIC, 5) ++#define F2FS_IOC_ABORT_ATOMIC_WRITE _IO(F2FS_IOCTL_MAGIC, 5) + #define F2FS_IOC_GARBAGE_COLLECT _IOW(F2FS_IOCTL_MAGIC, 6, __u32) + #define F2FS_IOC_WRITE_CHECKPOINT _IO(F2FS_IOCTL_MAGIC, 7) + #define F2FS_IOC_DEFRAGMENT _IOWR(F2FS_IOCTL_MAGIC, 8, \ +-- +2.35.1 + diff --git a/queue-5.19/gadgetfs-ep_io-wait-until-irq-finishes.patch b/queue-5.19/gadgetfs-ep_io-wait-until-irq-finishes.patch new file mode 100644 index 00000000000..be7ce38de58 --- /dev/null +++ b/queue-5.19/gadgetfs-ep_io-wait-until-irq-finishes.patch @@ -0,0 +1,37 @@ +From 02daf2437f6a7e7f12e4577c57f1a0c085566899 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Jul 2022 09:06:44 +0200 +Subject: gadgetfs: ep_io - wait until IRQ finishes + +From: Jozef Martiniak + +[ Upstream commit 04cb742d4d8f30dc2e83b46ac317eec09191c68e ] + +after usb_ep_queue() if wait_for_completion_interruptible() is +interrupted we need to wait until IRQ gets finished. + +Otherwise complete() from epio_complete() can corrupt stack. + +Signed-off-by: Jozef Martiniak +Link: https://lore.kernel.org/r/20220708070645.6130-1-jomajm@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/legacy/inode.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c +index 79990597c39f..01c3ead7d1b4 100644 +--- a/drivers/usb/gadget/legacy/inode.c ++++ b/drivers/usb/gadget/legacy/inode.c +@@ -362,6 +362,7 @@ ep_io (struct ep_data *epdata, void *buf, unsigned len) + spin_unlock_irq (&epdata->dev->lock); + + DBG (epdata->dev, "endpoint gone\n"); ++ wait_for_completion(&done); + epdata->status = -ENODEV; + } + } +-- +2.35.1 + diff --git a/queue-5.19/habanalabs-add-terminating-null-to-attrs-arrays.patch b/queue-5.19/habanalabs-add-terminating-null-to-attrs-arrays.patch new file mode 100644 index 00000000000..8e137d69855 --- /dev/null +++ b/queue-5.19/habanalabs-add-terminating-null-to-attrs-arrays.patch @@ -0,0 +1,78 @@ +From a9ad6dadd5b79eb16149dcfff6145b496d3f87a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 May 2022 10:54:30 +0300 +Subject: habanalabs: add terminating NULL to attrs arrays + +From: Dafna Hirschfeld + +[ Upstream commit 78d503087be190eab36290644ccec050135e7c70 ] + +Arrays of struct attribute are expected to be NULL terminated. +This is required by API methods such as device_add_groups. +This fixes a crash when loading the driver for Goya device. + +Signed-off-by: Dafna Hirschfeld +Reviewed-by: Oded Gabbay +Signed-off-by: Oded Gabbay +Signed-off-by: Sasha Levin +--- + drivers/misc/habanalabs/common/sysfs.c | 2 ++ + drivers/misc/habanalabs/gaudi/gaudi.c | 1 + + drivers/misc/habanalabs/goya/goya_hwmgr.c | 2 ++ + 3 files changed, 5 insertions(+) + +diff --git a/drivers/misc/habanalabs/common/sysfs.c b/drivers/misc/habanalabs/common/sysfs.c +index 9ebeb18ab85e..da8181068895 100644 +--- a/drivers/misc/habanalabs/common/sysfs.c ++++ b/drivers/misc/habanalabs/common/sysfs.c +@@ -73,6 +73,7 @@ static DEVICE_ATTR_RO(clk_cur_freq_mhz); + static struct attribute *hl_dev_clk_attrs[] = { + &dev_attr_clk_max_freq_mhz.attr, + &dev_attr_clk_cur_freq_mhz.attr, ++ NULL, + }; + + static ssize_t vrm_ver_show(struct device *dev, struct device_attribute *attr, char *buf) +@@ -93,6 +94,7 @@ static DEVICE_ATTR_RO(vrm_ver); + + static struct attribute *hl_dev_vrm_attrs[] = { + &dev_attr_vrm_ver.attr, ++ NULL, + }; + + static ssize_t uboot_ver_show(struct device *dev, struct device_attribute *attr, +diff --git a/drivers/misc/habanalabs/gaudi/gaudi.c b/drivers/misc/habanalabs/gaudi/gaudi.c +index fba322241096..25d735aee6a3 100644 +--- a/drivers/misc/habanalabs/gaudi/gaudi.c ++++ b/drivers/misc/habanalabs/gaudi/gaudi.c +@@ -9187,6 +9187,7 @@ static DEVICE_ATTR_RO(infineon_ver); + + static struct attribute *gaudi_vrm_dev_attrs[] = { + &dev_attr_infineon_ver.attr, ++ NULL, + }; + + static void gaudi_add_device_attr(struct hl_device *hdev, struct attribute_group *dev_clk_attr_grp, +diff --git a/drivers/misc/habanalabs/goya/goya_hwmgr.c b/drivers/misc/habanalabs/goya/goya_hwmgr.c +index 6580fc6a486a..b595721751c1 100644 +--- a/drivers/misc/habanalabs/goya/goya_hwmgr.c ++++ b/drivers/misc/habanalabs/goya/goya_hwmgr.c +@@ -359,6 +359,7 @@ static struct attribute *goya_clk_dev_attrs[] = { + &dev_attr_pm_mng_profile.attr, + &dev_attr_tpc_clk.attr, + &dev_attr_tpc_clk_curr.attr, ++ NULL, + }; + + static ssize_t infineon_ver_show(struct device *dev, struct device_attribute *attr, char *buf) +@@ -375,6 +376,7 @@ static DEVICE_ATTR_RO(infineon_ver); + + static struct attribute *goya_vrm_dev_attrs[] = { + &dev_attr_infineon_ver.attr, ++ NULL, + }; + + void goya_add_device_attr(struct hl_device *hdev, struct attribute_group *dev_clk_attr_grp, +-- +2.35.1 + diff --git a/queue-5.19/habanalabs-gaudi-fix-shift-out-of-bounds.patch b/queue-5.19/habanalabs-gaudi-fix-shift-out-of-bounds.patch new file mode 100644 index 00000000000..7db7a959eef --- /dev/null +++ b/queue-5.19/habanalabs-gaudi-fix-shift-out-of-bounds.patch @@ -0,0 +1,52 @@ +From c0175ed49cb1a873a552bac110bccc6d4b21182f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Jun 2022 16:11:31 +0300 +Subject: habanalabs/gaudi: fix shift out of bounds + +From: Ofir Bitton + +[ Upstream commit 01622098aeb05a5efbb727199bbc2a4653393255 ] + +When validating NIC queues, queue offset calculation must be +performed only for NIC queues. + +Signed-off-by: Ofir Bitton +Reviewed-by: Oded Gabbay +Signed-off-by: Oded Gabbay +Signed-off-by: Sasha Levin +--- + drivers/misc/habanalabs/gaudi/gaudi.c | 16 +++++++++------- + 1 file changed, 9 insertions(+), 7 deletions(-) + +diff --git a/drivers/misc/habanalabs/gaudi/gaudi.c b/drivers/misc/habanalabs/gaudi/gaudi.c +index e6bfaf55c6b6..3fb221f2e393 100644 +--- a/drivers/misc/habanalabs/gaudi/gaudi.c ++++ b/drivers/misc/habanalabs/gaudi/gaudi.c +@@ -5654,15 +5654,17 @@ static int gaudi_parse_cb_no_ext_queue(struct hl_device *hdev, + { + struct asic_fixed_properties *asic_prop = &hdev->asic_prop; + struct gaudi_device *gaudi = hdev->asic_specific; +- u32 nic_mask_q_id = 1 << (HW_CAP_NIC_SHIFT + +- ((parser->hw_queue_id - GAUDI_QUEUE_ID_NIC_0_0) >> 2)); ++ u32 nic_queue_offset, nic_mask_q_id; + + if ((parser->hw_queue_id >= GAUDI_QUEUE_ID_NIC_0_0) && +- (parser->hw_queue_id <= GAUDI_QUEUE_ID_NIC_9_3) && +- (!(gaudi->hw_cap_initialized & nic_mask_q_id))) { +- dev_err(hdev->dev, "h/w queue %d is disabled\n", +- parser->hw_queue_id); +- return -EINVAL; ++ (parser->hw_queue_id <= GAUDI_QUEUE_ID_NIC_9_3)) { ++ nic_queue_offset = parser->hw_queue_id - GAUDI_QUEUE_ID_NIC_0_0; ++ nic_mask_q_id = 1 << (HW_CAP_NIC_SHIFT + (nic_queue_offset >> 2)); ++ ++ if (!(gaudi->hw_cap_initialized & nic_mask_q_id)) { ++ dev_err(hdev->dev, "h/w queue %d is disabled\n", parser->hw_queue_id); ++ return -EINVAL; ++ } + } + + /* For internal queue jobs just check if CB address is valid */ +-- +2.35.1 + diff --git a/queue-5.19/habanalabs-gaudi-invoke-device-reset-from-one-code-b.patch b/queue-5.19/habanalabs-gaudi-invoke-device-reset-from-one-code-b.patch new file mode 100644 index 00000000000..3d1a8f8ddf3 --- /dev/null +++ b/queue-5.19/habanalabs-gaudi-invoke-device-reset-from-one-code-b.patch @@ -0,0 +1,88 @@ +From 624981f2eaffbdf5a9824c24afa7992224ae93e3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Jun 2022 16:02:09 +0300 +Subject: habanalabs/gaudi: invoke device reset from one code block + +From: Tal Cohen + +[ Upstream commit be572e67dafbf8004d46a2c9d97338c107efb60e ] + +In order to prepare the driver code for device reset event +notification, change the event handler function flow to call +device reset from one code block. + +In addition, the commit fixes an issue that reset was performed +w/o checking the 'hard_reset_on_fw_event' state and w/o setting +the HL_DRV_RESET_DELAY flag. + +Signed-off-by: Tal Cohen +Reviewed-by: Oded Gabbay +Signed-off-by: Oded Gabbay +Signed-off-by: Sasha Levin +--- + drivers/misc/habanalabs/gaudi/gaudi.c | 25 ++++++++++++++++--------- + 1 file changed, 16 insertions(+), 9 deletions(-) + +diff --git a/drivers/misc/habanalabs/gaudi/gaudi.c b/drivers/misc/habanalabs/gaudi/gaudi.c +index 25d735aee6a3..e6bfaf55c6b6 100644 +--- a/drivers/misc/habanalabs/gaudi/gaudi.c ++++ b/drivers/misc/habanalabs/gaudi/gaudi.c +@@ -7717,10 +7717,10 @@ static void gaudi_handle_eqe(struct hl_device *hdev, + struct gaudi_device *gaudi = hdev->asic_specific; + u64 data = le64_to_cpu(eq_entry->data[0]); + u32 ctl = le32_to_cpu(eq_entry->hdr.ctl); +- u32 fw_fatal_err_flag = 0; ++ u32 fw_fatal_err_flag = 0, flags = 0; + u16 event_type = ((ctl & EQ_CTL_EVENT_TYPE_MASK) + >> EQ_CTL_EVENT_TYPE_SHIFT); +- bool reset_required; ++ bool reset_required, reset_direct = false; + u8 cause; + int rc; + +@@ -7808,7 +7808,8 @@ static void gaudi_handle_eqe(struct hl_device *hdev, + dev_err(hdev->dev, "reset required due to %s\n", + gaudi_irq_map_table[event_type].name); + +- hl_device_reset(hdev, 0); ++ reset_direct = true; ++ goto reset_device; + } else { + hl_fw_unmask_irq(hdev, event_type); + } +@@ -7830,7 +7831,8 @@ static void gaudi_handle_eqe(struct hl_device *hdev, + dev_err(hdev->dev, "reset required due to %s\n", + gaudi_irq_map_table[event_type].name); + +- hl_device_reset(hdev, 0); ++ reset_direct = true; ++ goto reset_device; + } else { + hl_fw_unmask_irq(hdev, event_type); + } +@@ -7981,12 +7983,17 @@ static void gaudi_handle_eqe(struct hl_device *hdev, + return; + + reset_device: +- if (hdev->asic_prop.fw_security_enabled) +- hl_device_reset(hdev, HL_DRV_RESET_HARD +- | HL_DRV_RESET_BYPASS_REQ_TO_FW +- | fw_fatal_err_flag); ++ reset_required = true; ++ ++ if (hdev->asic_prop.fw_security_enabled && !reset_direct) ++ flags = HL_DRV_RESET_HARD | HL_DRV_RESET_BYPASS_REQ_TO_FW | fw_fatal_err_flag; + else if (hdev->hard_reset_on_fw_events) +- hl_device_reset(hdev, HL_DRV_RESET_HARD | HL_DRV_RESET_DELAY | fw_fatal_err_flag); ++ flags = HL_DRV_RESET_HARD | HL_DRV_RESET_DELAY | fw_fatal_err_flag; ++ else ++ reset_required = false; ++ ++ if (reset_required) ++ hl_device_reset(hdev, flags); + else + hl_fw_unmask_irq(hdev, event_type); + } +-- +2.35.1 + diff --git a/queue-5.19/habanalabs-gaudi-mask-constant-value-before-cast.patch b/queue-5.19/habanalabs-gaudi-mask-constant-value-before-cast.patch new file mode 100644 index 00000000000..cf940e90587 --- /dev/null +++ b/queue-5.19/habanalabs-gaudi-mask-constant-value-before-cast.patch @@ -0,0 +1,49 @@ +From 908f80ac92bd7a09c2ed4eec3967433a42aad72d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Jun 2022 16:45:02 +0300 +Subject: habanalabs/gaudi: mask constant value before cast + +From: Oded Gabbay + +[ Upstream commit e3f49437a2e0221a387ecd192d742ae1434e1e3a ] + +This fixes a sparse warning of +"cast truncates bits from constant value" + +Signed-off-by: Oded Gabbay +Signed-off-by: Sasha Levin +--- + drivers/misc/habanalabs/gaudi/gaudi.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/misc/habanalabs/gaudi/gaudi.c b/drivers/misc/habanalabs/gaudi/gaudi.c +index 3fb221f2e393..b33616aacb33 100644 +--- a/drivers/misc/habanalabs/gaudi/gaudi.c ++++ b/drivers/misc/habanalabs/gaudi/gaudi.c +@@ -3339,19 +3339,19 @@ static void gaudi_init_nic_qman(struct hl_device *hdev, u32 nic_offset, + u32 nic_qm_err_cfg, irq_handler_offset; + u32 q_off; + +- mtr_base_en_lo = lower_32_bits(CFG_BASE + ++ mtr_base_en_lo = lower_32_bits((CFG_BASE & U32_MAX) + + mmSYNC_MNGR_E_N_SYNC_MNGR_OBJS_MON_PAY_ADDRL_0); + mtr_base_en_hi = upper_32_bits(CFG_BASE + + mmSYNC_MNGR_E_N_SYNC_MNGR_OBJS_MON_PAY_ADDRL_0); +- so_base_en_lo = lower_32_bits(CFG_BASE + ++ so_base_en_lo = lower_32_bits((CFG_BASE & U32_MAX) + + mmSYNC_MNGR_E_N_SYNC_MNGR_OBJS_SOB_OBJ_0); + so_base_en_hi = upper_32_bits(CFG_BASE + + mmSYNC_MNGR_E_N_SYNC_MNGR_OBJS_SOB_OBJ_0); +- mtr_base_ws_lo = lower_32_bits(CFG_BASE + ++ mtr_base_ws_lo = lower_32_bits((CFG_BASE & U32_MAX) + + mmSYNC_MNGR_W_S_SYNC_MNGR_OBJS_MON_PAY_ADDRL_0); + mtr_base_ws_hi = upper_32_bits(CFG_BASE + + mmSYNC_MNGR_W_S_SYNC_MNGR_OBJS_MON_PAY_ADDRL_0); +- so_base_ws_lo = lower_32_bits(CFG_BASE + ++ so_base_ws_lo = lower_32_bits((CFG_BASE & U32_MAX) + + mmSYNC_MNGR_W_S_SYNC_MNGR_OBJS_SOB_OBJ_0); + so_base_ws_hi = upper_32_bits(CFG_BASE + + mmSYNC_MNGR_W_S_SYNC_MNGR_OBJS_SOB_OBJ_0); +-- +2.35.1 + diff --git a/queue-5.19/hid-multitouch-new-device-class-fix-lenovo-x12-track.patch b/queue-5.19/hid-multitouch-new-device-class-fix-lenovo-x12-track.patch new file mode 100644 index 00000000000..9913569ff94 --- /dev/null +++ b/queue-5.19/hid-multitouch-new-device-class-fix-lenovo-x12-track.patch @@ -0,0 +1,82 @@ +From 5103cbc7f16f247eefc38b68fd69c2b1655affd0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 May 2022 23:51:32 -0400 +Subject: HID: multitouch: new device class fix Lenovo X12 trackpad sticky + +From: Tao Jin + +[ Upstream commit 54eed5c7b938dc4ef6b14d4ee048bbdafdbce352 ] + +The trackpad of the given device sends continuous report of pointers +status as per wxn8 spec. However, the spec did not clarify when the +fingers are lifted so fast that between the interval of two report +frames fingers on pad reduced from >=2 to 0. The second last report +contains >=2 fingers with tip state 1 and the last report contains only +1 finger with tip state 0. Although this can happen unfrequently, a + quick fix will be improve the consistency to 100%. A quick fix is to +disable MT_QUIRK_ALWAYS_VALID and enable MT_QUIRK_NOT_SEEN_MEANS_UP. + +Test for hid-tools is added in [1] + +In addition to this, I2C device 04CA:00B1 may also need similar class +but with MT_QUIRK_FORCE_MULTI_INPUT disabled (but it does not harm to + enable it on non-multi-input device either). The respective owner has +been notified and a patch may coming soon after test. + +[1]: https://gitlab.freedesktop.org/libevdev/hid-tools/-/merge_requests/130 + +Signed-off-by: Tao Jin +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-multitouch.c | 13 ++++++++++++- + 1 file changed, 12 insertions(+), 1 deletion(-) + +diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c +index 6bb3890b0f2c..2e72922e36f5 100644 +--- a/drivers/hid/hid-multitouch.c ++++ b/drivers/hid/hid-multitouch.c +@@ -194,6 +194,7 @@ static void mt_post_parse(struct mt_device *td, struct mt_application *app); + #define MT_CLS_WIN_8_FORCE_MULTI_INPUT 0x0015 + #define MT_CLS_WIN_8_DISABLE_WAKEUP 0x0016 + #define MT_CLS_WIN_8_NO_STICKY_FINGERS 0x0017 ++#define MT_CLS_WIN_8_FORCE_MULTI_INPUT_NSMU 0x0018 + + /* vendor specific classes */ + #define MT_CLS_3M 0x0101 +@@ -286,6 +287,15 @@ static const struct mt_class mt_classes[] = { + MT_QUIRK_WIN8_PTP_BUTTONS | + MT_QUIRK_FORCE_MULTI_INPUT, + .export_all_inputs = true }, ++ { .name = MT_CLS_WIN_8_FORCE_MULTI_INPUT_NSMU, ++ .quirks = MT_QUIRK_IGNORE_DUPLICATES | ++ MT_QUIRK_HOVERING | ++ MT_QUIRK_CONTACT_CNT_ACCURATE | ++ MT_QUIRK_STICKY_FINGERS | ++ MT_QUIRK_WIN8_PTP_BUTTONS | ++ MT_QUIRK_FORCE_MULTI_INPUT | ++ MT_QUIRK_NOT_SEEN_MEANS_UP, ++ .export_all_inputs = true }, + { .name = MT_CLS_WIN_8_DISABLE_WAKEUP, + .quirks = MT_QUIRK_ALWAYS_VALID | + MT_QUIRK_IGNORE_DUPLICATES | +@@ -783,6 +793,7 @@ static int mt_touch_input_mapping(struct hid_device *hdev, struct hid_input *hi, + case HID_DG_CONFIDENCE: + if ((cls->name == MT_CLS_WIN_8 || + cls->name == MT_CLS_WIN_8_FORCE_MULTI_INPUT || ++ cls->name == MT_CLS_WIN_8_FORCE_MULTI_INPUT_NSMU || + cls->name == MT_CLS_WIN_8_DISABLE_WAKEUP) && + (field->application == HID_DG_TOUCHPAD || + field->application == HID_DG_TOUCHSCREEN)) +@@ -2035,7 +2046,7 @@ static const struct hid_device_id mt_devices[] = { + USB_DEVICE_ID_LENOVO_X1_TAB3) }, + + /* Lenovo X12 TAB Gen 1 */ +- { .driver_data = MT_CLS_WIN_8_FORCE_MULTI_INPUT, ++ { .driver_data = MT_CLS_WIN_8_FORCE_MULTI_INPUT_NSMU, + HID_DEVICE(BUS_USB, HID_GROUP_MULTITOUCH_WIN_8, + USB_VENDOR_ID_LENOVO, + USB_DEVICE_ID_LENOVO_X12_TAB) }, +-- +2.35.1 + diff --git a/queue-5.19/ice-fix-clearing-of-promisc-mode-with-bridge-over-bo.patch b/queue-5.19/ice-fix-clearing-of-promisc-mode-with-bridge-over-bo.patch new file mode 100644 index 00000000000..3c10034212c --- /dev/null +++ b/queue-5.19/ice-fix-clearing-of-promisc-mode-with-bridge-over-bo.patch @@ -0,0 +1,59 @@ +From 2b787cc9f3c69b1ed63cfc01181f77208f18da48 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Aug 2022 15:25:49 +0200 +Subject: ice: Fix clearing of promisc mode with bridge over bond + +From: Grzegorz Siwik + +[ Upstream commit abddafd4585cc825d454da3cf308ad1226f6c554 ] + +When at least two interfaces are bonded and a bridge is enabled on the +bond, an error can occur when the bridge is removed and re-added. The +reason for the error is because promiscuous mode was not fully cleared from +the VLAN VSI in the hardware. With this change, promiscuous mode is +properly removed when the bridge disconnects from bonding. + +[ 1033.676359] bond1: link status definitely down for interface enp95s0f0, disabling it +[ 1033.676366] bond1: making interface enp175s0f0 the new active one +[ 1033.676369] device enp95s0f0 left promiscuous mode +[ 1033.676522] device enp175s0f0 entered promiscuous mode +[ 1033.676901] ice 0000:af:00.0 enp175s0f0: Error setting Multicast promiscuous mode on VSI 6 +[ 1041.795662] ice 0000:af:00.0 enp175s0f0: Error setting Multicast promiscuous mode on VSI 6 +[ 1041.944826] bond1: link status definitely down for interface enp175s0f0, disabling it +[ 1041.944874] device enp175s0f0 left promiscuous mode +[ 1041.944918] bond1: now running without any active interface! + +Fixes: c31af68a1b94 ("ice: Add outer_vlan_ops and VSI specific VLAN ops implementations") +Co-developed-by: Jesse Brandeburg +Signed-off-by: Jesse Brandeburg +Signed-off-by: Grzegorz Siwik +Link: https://lore.kernel.org/all/CAK8fFZ7m-KR57M_rYX6xZN39K89O=LGooYkKsu6HKt0Bs+x6xQ@mail.gmail.com/ +Tested-by: Jaroslav Pulchart +Tested-by: Igor Raits +Tested-by: Gurucharan (A Contingent worker at Intel) +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ice/ice_lib.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/ice/ice_lib.c b/drivers/net/ethernet/intel/ice/ice_lib.c +index f5f744345fe7..da1a9cc47bd9 100644 +--- a/drivers/net/ethernet/intel/ice/ice_lib.c ++++ b/drivers/net/ethernet/intel/ice/ice_lib.c +@@ -4082,7 +4082,11 @@ int ice_vsi_del_vlan_zero(struct ice_vsi *vsi) + if (err && err != -EEXIST) + return err; + +- return 0; ++ /* when deleting the last VLAN filter, make sure to disable the VLAN ++ * promisc mode so the filter isn't left by accident ++ */ ++ return ice_clear_vsi_promisc(&vsi->back->hw, vsi->idx, ++ ICE_MCAST_VLAN_PROMISC_BITS, 0); + } + + /** +-- +2.35.1 + diff --git a/queue-5.19/iommu-io-pgtable-arm-v7s-add-a-quirk-to-allow-pgtabl.patch b/queue-5.19/iommu-io-pgtable-arm-v7s-add-a-quirk-to-allow-pgtabl.patch new file mode 100644 index 00000000000..f4eb2d67c75 --- /dev/null +++ b/queue-5.19/iommu-io-pgtable-arm-v7s-add-a-quirk-to-allow-pgtabl.patch @@ -0,0 +1,217 @@ +From 83868e96436314a3f2e9abe54e56ec136e7d7b8e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Jun 2022 17:29:25 +0800 +Subject: iommu/io-pgtable-arm-v7s: Add a quirk to allow pgtable PA up to 35bit + +From: Yunfei Wang + +[ Upstream commit bfdd231374181254742c5e2faef0bef2d30c0ee4 ] + +Single memory zone feature will remove ZONE_DMA32 and ZONE_DMA and +cause pgtable PA size larger than 32bit. + +Since Mediatek IOMMU hardware support at most 35bit PA in pgtable, +so add a quirk to allow the PA of pgtables support up to bit35. + +Signed-off-by: Ning Li +Signed-off-by: Yunfei Wang +Reviewed-by: Robin Murphy +Acked-by: Will Deacon +Link: https://lore.kernel.org/r/20220630092927.24925-2-yf.wang@mediatek.com +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/io-pgtable-arm-v7s.c | 75 ++++++++++++++++++++++-------- + include/linux/io-pgtable.h | 15 ++++-- + 2 files changed, 66 insertions(+), 24 deletions(-) + +diff --git a/drivers/iommu/io-pgtable-arm-v7s.c b/drivers/iommu/io-pgtable-arm-v7s.c +index be066c1503d3..ba3115fd0f86 100644 +--- a/drivers/iommu/io-pgtable-arm-v7s.c ++++ b/drivers/iommu/io-pgtable-arm-v7s.c +@@ -182,14 +182,8 @@ static bool arm_v7s_is_mtk_enabled(struct io_pgtable_cfg *cfg) + (cfg->quirks & IO_PGTABLE_QUIRK_ARM_MTK_EXT); + } + +-static arm_v7s_iopte paddr_to_iopte(phys_addr_t paddr, int lvl, +- struct io_pgtable_cfg *cfg) ++static arm_v7s_iopte to_mtk_iopte(phys_addr_t paddr, arm_v7s_iopte pte) + { +- arm_v7s_iopte pte = paddr & ARM_V7S_LVL_MASK(lvl); +- +- if (!arm_v7s_is_mtk_enabled(cfg)) +- return pte; +- + if (paddr & BIT_ULL(32)) + pte |= ARM_V7S_ATTR_MTK_PA_BIT32; + if (paddr & BIT_ULL(33)) +@@ -199,6 +193,17 @@ static arm_v7s_iopte paddr_to_iopte(phys_addr_t paddr, int lvl, + return pte; + } + ++static arm_v7s_iopte paddr_to_iopte(phys_addr_t paddr, int lvl, ++ struct io_pgtable_cfg *cfg) ++{ ++ arm_v7s_iopte pte = paddr & ARM_V7S_LVL_MASK(lvl); ++ ++ if (arm_v7s_is_mtk_enabled(cfg)) ++ return to_mtk_iopte(paddr, pte); ++ ++ return pte; ++} ++ + static phys_addr_t iopte_to_paddr(arm_v7s_iopte pte, int lvl, + struct io_pgtable_cfg *cfg) + { +@@ -240,10 +245,17 @@ static void *__arm_v7s_alloc_table(int lvl, gfp_t gfp, + dma_addr_t dma; + size_t size = ARM_V7S_TABLE_SIZE(lvl, cfg); + void *table = NULL; ++ gfp_t gfp_l1; ++ ++ /* ++ * ARM_MTK_TTBR_EXT extend the translation table base support larger ++ * memory address. ++ */ ++ gfp_l1 = cfg->quirks & IO_PGTABLE_QUIRK_ARM_MTK_TTBR_EXT ? ++ GFP_KERNEL : ARM_V7S_TABLE_GFP_DMA; + + if (lvl == 1) +- table = (void *)__get_free_pages( +- __GFP_ZERO | ARM_V7S_TABLE_GFP_DMA, get_order(size)); ++ table = (void *)__get_free_pages(gfp_l1 | __GFP_ZERO, get_order(size)); + else if (lvl == 2) + table = kmem_cache_zalloc(data->l2_tables, gfp); + +@@ -251,7 +263,8 @@ static void *__arm_v7s_alloc_table(int lvl, gfp_t gfp, + return NULL; + + phys = virt_to_phys(table); +- if (phys != (arm_v7s_iopte)phys) { ++ if (cfg->quirks & IO_PGTABLE_QUIRK_ARM_MTK_TTBR_EXT ? ++ phys >= (1ULL << cfg->oas) : phys != (arm_v7s_iopte)phys) { + /* Doesn't fit in PTE */ + dev_err(dev, "Page table does not fit in PTE: %pa", &phys); + goto out_free; +@@ -457,9 +470,14 @@ static arm_v7s_iopte arm_v7s_install_table(arm_v7s_iopte *table, + arm_v7s_iopte curr, + struct io_pgtable_cfg *cfg) + { ++ phys_addr_t phys = virt_to_phys(table); + arm_v7s_iopte old, new; + +- new = virt_to_phys(table) | ARM_V7S_PTE_TYPE_TABLE; ++ new = phys | ARM_V7S_PTE_TYPE_TABLE; ++ ++ if (cfg->quirks & IO_PGTABLE_QUIRK_ARM_MTK_TTBR_EXT) ++ new = to_mtk_iopte(phys, new); ++ + if (cfg->quirks & IO_PGTABLE_QUIRK_ARM_NS) + new |= ARM_V7S_ATTR_NS_TABLE; + +@@ -779,6 +797,8 @@ static struct io_pgtable *arm_v7s_alloc_pgtable(struct io_pgtable_cfg *cfg, + void *cookie) + { + struct arm_v7s_io_pgtable *data; ++ slab_flags_t slab_flag; ++ phys_addr_t paddr; + + if (cfg->ias > (arm_v7s_is_mtk_enabled(cfg) ? 34 : ARM_V7S_ADDR_BITS)) + return NULL; +@@ -788,7 +808,8 @@ static struct io_pgtable *arm_v7s_alloc_pgtable(struct io_pgtable_cfg *cfg, + + if (cfg->quirks & ~(IO_PGTABLE_QUIRK_ARM_NS | + IO_PGTABLE_QUIRK_NO_PERMS | +- IO_PGTABLE_QUIRK_ARM_MTK_EXT)) ++ IO_PGTABLE_QUIRK_ARM_MTK_EXT | ++ IO_PGTABLE_QUIRK_ARM_MTK_TTBR_EXT)) + return NULL; + + /* If ARM_MTK_4GB is enabled, the NO_PERMS is also expected. */ +@@ -796,15 +817,27 @@ static struct io_pgtable *arm_v7s_alloc_pgtable(struct io_pgtable_cfg *cfg, + !(cfg->quirks & IO_PGTABLE_QUIRK_NO_PERMS)) + return NULL; + ++ if ((cfg->quirks & IO_PGTABLE_QUIRK_ARM_MTK_TTBR_EXT) && ++ !arm_v7s_is_mtk_enabled(cfg)) ++ return NULL; ++ + data = kmalloc(sizeof(*data), GFP_KERNEL); + if (!data) + return NULL; + + spin_lock_init(&data->split_lock); ++ ++ /* ++ * ARM_MTK_TTBR_EXT extend the translation table base support larger ++ * memory address. ++ */ ++ slab_flag = cfg->quirks & IO_PGTABLE_QUIRK_ARM_MTK_TTBR_EXT ? ++ 0 : ARM_V7S_TABLE_SLAB_FLAGS; ++ + data->l2_tables = kmem_cache_create("io-pgtable_armv7s_l2", + ARM_V7S_TABLE_SIZE(2, cfg), + ARM_V7S_TABLE_SIZE(2, cfg), +- ARM_V7S_TABLE_SLAB_FLAGS, NULL); ++ slab_flag, NULL); + if (!data->l2_tables) + goto out_free_data; + +@@ -850,12 +883,16 @@ static struct io_pgtable *arm_v7s_alloc_pgtable(struct io_pgtable_cfg *cfg, + wmb(); + + /* TTBR */ +- cfg->arm_v7s_cfg.ttbr = virt_to_phys(data->pgd) | ARM_V7S_TTBR_S | +- (cfg->coherent_walk ? (ARM_V7S_TTBR_NOS | +- ARM_V7S_TTBR_IRGN_ATTR(ARM_V7S_RGN_WBWA) | +- ARM_V7S_TTBR_ORGN_ATTR(ARM_V7S_RGN_WBWA)) : +- (ARM_V7S_TTBR_IRGN_ATTR(ARM_V7S_RGN_NC) | +- ARM_V7S_TTBR_ORGN_ATTR(ARM_V7S_RGN_NC))); ++ paddr = virt_to_phys(data->pgd); ++ if (arm_v7s_is_mtk_enabled(cfg)) ++ cfg->arm_v7s_cfg.ttbr = paddr | upper_32_bits(paddr); ++ else ++ cfg->arm_v7s_cfg.ttbr = paddr | ARM_V7S_TTBR_S | ++ (cfg->coherent_walk ? (ARM_V7S_TTBR_NOS | ++ ARM_V7S_TTBR_IRGN_ATTR(ARM_V7S_RGN_WBWA) | ++ ARM_V7S_TTBR_ORGN_ATTR(ARM_V7S_RGN_WBWA)) : ++ (ARM_V7S_TTBR_IRGN_ATTR(ARM_V7S_RGN_NC) | ++ ARM_V7S_TTBR_ORGN_ATTR(ARM_V7S_RGN_NC))); + return &data->iop; + + out_free_data: +diff --git a/include/linux/io-pgtable.h b/include/linux/io-pgtable.h +index 86af6f0a00a2..ca98aeadcc80 100644 +--- a/include/linux/io-pgtable.h ++++ b/include/linux/io-pgtable.h +@@ -74,17 +74,22 @@ struct io_pgtable_cfg { + * to support up to 35 bits PA where the bit32, bit33 and bit34 are + * encoded in the bit9, bit4 and bit5 of the PTE respectively. + * ++ * IO_PGTABLE_QUIRK_ARM_MTK_TTBR_EXT: (ARM v7s format) MediaTek IOMMUs ++ * extend the translation table base support up to 35 bits PA, the ++ * encoding format is same with IO_PGTABLE_QUIRK_ARM_MTK_EXT. ++ * + * IO_PGTABLE_QUIRK_ARM_TTBR1: (ARM LPAE format) Configure the table + * for use in the upper half of a split address space. + * + * IO_PGTABLE_QUIRK_ARM_OUTER_WBWA: Override the outer-cacheability + * attributes set in the TCR for a non-coherent page-table walker. + */ +- #define IO_PGTABLE_QUIRK_ARM_NS BIT(0) +- #define IO_PGTABLE_QUIRK_NO_PERMS BIT(1) +- #define IO_PGTABLE_QUIRK_ARM_MTK_EXT BIT(3) +- #define IO_PGTABLE_QUIRK_ARM_TTBR1 BIT(5) +- #define IO_PGTABLE_QUIRK_ARM_OUTER_WBWA BIT(6) ++ #define IO_PGTABLE_QUIRK_ARM_NS BIT(0) ++ #define IO_PGTABLE_QUIRK_NO_PERMS BIT(1) ++ #define IO_PGTABLE_QUIRK_ARM_MTK_EXT BIT(3) ++ #define IO_PGTABLE_QUIRK_ARM_MTK_TTBR_EXT BIT(4) ++ #define IO_PGTABLE_QUIRK_ARM_TTBR1 BIT(5) ++ #define IO_PGTABLE_QUIRK_ARM_OUTER_WBWA BIT(6) + unsigned long quirks; + unsigned long pgsize_bitmap; + unsigned int ias; +-- +2.35.1 + diff --git a/queue-5.19/irqchip-tegra-fix-overflow-implicit-truncation-warni.patch b/queue-5.19/irqchip-tegra-fix-overflow-implicit-truncation-warni.patch new file mode 100644 index 00000000000..2b97b699543 --- /dev/null +++ b/queue-5.19/irqchip-tegra-fix-overflow-implicit-truncation-warni.patch @@ -0,0 +1,76 @@ +From ed7987e7a851b5d55c4bb279bd5bcdef4494c86b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 May 2022 22:14:12 +0530 +Subject: irqchip/tegra: Fix overflow implicit truncation warnings +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Sai Prakash Ranjan + +[ Upstream commit 443685992bda9bb4f8b17fc02c9f6c60e62b1461 ] + +Fix -Woverflow warnings for tegra irqchip driver which is a result +of moving arm64 custom MMIO accessor macros to asm-generic function +implementations giving a bonus type-checking now and uncovering these +overflow warnings. + +drivers/irqchip/irq-tegra.c: In function ‘tegra_ictlr_suspend’: +drivers/irqchip/irq-tegra.c:151:18: warning: large integer implicitly truncated to unsigned type [-Woverflow] + writel_relaxed(~0ul, ictlr + ICTLR_COP_IER_CLR); + ^ + +Suggested-by: Marc Zyngier +Signed-off-by: Sai Prakash Ranjan +Reviewed-by: Arnd Bergmann +Cc: Marc Zyngier +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + drivers/irqchip/irq-tegra.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/irqchip/irq-tegra.c b/drivers/irqchip/irq-tegra.c +index e1f771c72fc4..ad3e2c1b3c87 100644 +--- a/drivers/irqchip/irq-tegra.c ++++ b/drivers/irqchip/irq-tegra.c +@@ -148,10 +148,10 @@ static int tegra_ictlr_suspend(void) + lic->cop_iep[i] = readl_relaxed(ictlr + ICTLR_COP_IEP_CLASS); + + /* Disable COP interrupts */ +- writel_relaxed(~0ul, ictlr + ICTLR_COP_IER_CLR); ++ writel_relaxed(GENMASK(31, 0), ictlr + ICTLR_COP_IER_CLR); + + /* Disable CPU interrupts */ +- writel_relaxed(~0ul, ictlr + ICTLR_CPU_IER_CLR); ++ writel_relaxed(GENMASK(31, 0), ictlr + ICTLR_CPU_IER_CLR); + + /* Enable the wakeup sources of ictlr */ + writel_relaxed(lic->ictlr_wake_mask[i], ictlr + ICTLR_CPU_IER_SET); +@@ -172,12 +172,12 @@ static void tegra_ictlr_resume(void) + + writel_relaxed(lic->cpu_iep[i], + ictlr + ICTLR_CPU_IEP_CLASS); +- writel_relaxed(~0ul, ictlr + ICTLR_CPU_IER_CLR); ++ writel_relaxed(GENMASK(31, 0), ictlr + ICTLR_CPU_IER_CLR); + writel_relaxed(lic->cpu_ier[i], + ictlr + ICTLR_CPU_IER_SET); + writel_relaxed(lic->cop_iep[i], + ictlr + ICTLR_COP_IEP_CLASS); +- writel_relaxed(~0ul, ictlr + ICTLR_COP_IER_CLR); ++ writel_relaxed(GENMASK(31, 0), ictlr + ICTLR_COP_IER_CLR); + writel_relaxed(lic->cop_ier[i], + ictlr + ICTLR_COP_IER_SET); + } +@@ -312,7 +312,7 @@ static int __init tegra_ictlr_init(struct device_node *node, + lic->base[i] = base; + + /* Disable all interrupts */ +- writel_relaxed(~0UL, base + ICTLR_CPU_IER_CLR); ++ writel_relaxed(GENMASK(31, 0), base + ICTLR_CPU_IER_CLR); + /* All interrupts target IRQ */ + writel_relaxed(0, base + ICTLR_CPU_IEP_CLASS); + +-- +2.35.1 + diff --git a/queue-5.19/kvm-arm64-reject-32bit-user-pstate-on-asymmetric-sys.patch b/queue-5.19/kvm-arm64-reject-32bit-user-pstate-on-asymmetric-sys.patch new file mode 100644 index 00000000000..0eaad627fd8 --- /dev/null +++ b/queue-5.19/kvm-arm64-reject-32bit-user-pstate-on-asymmetric-sys.patch @@ -0,0 +1,43 @@ +From 3bd897d4dea1079aa9ab8d0abfbeb1e528e3d846 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Aug 2022 19:25:54 +0000 +Subject: KVM: arm64: Reject 32bit user PSTATE on asymmetric systems + +From: Oliver Upton + +[ Upstream commit b10d86fb8e46cc812171728bcd326df2f34e9ed5 ] + +KVM does not support AArch32 EL0 on asymmetric systems. To that end, +prevent userspace from configuring a vCPU in such a state through +setting PSTATE. + +It is already ABI that KVM rejects such a write on a system where +AArch32 EL0 is unsupported. Though the kernel's definition of a 32bit +system changed in commit 2122a833316f ("arm64: Allow mismatched +32-bit EL0 support"), KVM's did not. + +Fixes: 2122a833316f ("arm64: Allow mismatched 32-bit EL0 support") +Signed-off-by: Oliver Upton +Signed-off-by: Marc Zyngier +Link: https://lore.kernel.org/r/20220816192554.1455559-3-oliver.upton@linux.dev +Signed-off-by: Sasha Levin +--- + arch/arm64/kvm/guest.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/kvm/guest.c b/arch/arm64/kvm/guest.c +index 8c607199cad1..f802a3b3f8db 100644 +--- a/arch/arm64/kvm/guest.c ++++ b/arch/arm64/kvm/guest.c +@@ -242,7 +242,7 @@ static int set_core_reg(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg) + u64 mode = (*(u64 *)valp) & PSR_AA32_MODE_MASK; + switch (mode) { + case PSR_AA32_MODE_USR: +- if (!system_supports_32bit_el0()) ++ if (!kvm_supports_32bit_el0()) + return -EINVAL; + break; + case PSR_AA32_MODE_FIQ: +-- +2.35.1 + diff --git a/queue-5.19/kvm-arm64-treat-pmcr_el1.lc-as-res1-on-asymmetric-sy.patch b/queue-5.19/kvm-arm64-treat-pmcr_el1.lc-as-res1-on-asymmetric-sy.patch new file mode 100644 index 00000000000..81b1e309729 --- /dev/null +++ b/queue-5.19/kvm-arm64-treat-pmcr_el1.lc-as-res1-on-asymmetric-sy.patch @@ -0,0 +1,77 @@ +From 248e5f093be0410db173806119269ea519ffb784 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Aug 2022 19:25:53 +0000 +Subject: KVM: arm64: Treat PMCR_EL1.LC as RES1 on asymmetric systems + +From: Oliver Upton + +[ Upstream commit f3c6efc72f3b20ec23566e768979802f0a398f04 ] + +KVM does not support AArch32 on asymmetric systems. To that end, enforce +AArch64-only behavior on PMCR_EL1.LC when on an asymmetric system. + +Fixes: 2122a833316f ("arm64: Allow mismatched 32-bit EL0 support") +Signed-off-by: Oliver Upton +Signed-off-by: Marc Zyngier +Link: https://lore.kernel.org/r/20220816192554.1455559-2-oliver.upton@linux.dev +Signed-off-by: Sasha Levin +--- + arch/arm64/include/asm/kvm_host.h | 4 ++++ + arch/arm64/kvm/arm.c | 3 +-- + arch/arm64/kvm/sys_regs.c | 4 ++-- + 3 files changed, 7 insertions(+), 4 deletions(-) + +diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h +index de32152cea04..7aaf75577096 100644 +--- a/arch/arm64/include/asm/kvm_host.h ++++ b/arch/arm64/include/asm/kvm_host.h +@@ -838,6 +838,10 @@ bool kvm_arm_vcpu_is_finalized(struct kvm_vcpu *vcpu); + (system_supports_mte() && \ + test_bit(KVM_ARCH_FLAG_MTE_ENABLED, &(kvm)->arch.flags)) + ++#define kvm_supports_32bit_el0() \ ++ (system_supports_32bit_el0() && \ ++ !static_branch_unlikely(&arm64_mismatched_32bit_el0)) ++ + int kvm_trng_call(struct kvm_vcpu *vcpu); + #ifdef CONFIG_KVM + extern phys_addr_t hyp_mem_base; +diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c +index 83a7f61354d3..e21b24574118 100644 +--- a/arch/arm64/kvm/arm.c ++++ b/arch/arm64/kvm/arm.c +@@ -751,8 +751,7 @@ static bool vcpu_mode_is_bad_32bit(struct kvm_vcpu *vcpu) + if (likely(!vcpu_mode_is_32bit(vcpu))) + return false; + +- return !system_supports_32bit_el0() || +- static_branch_unlikely(&arm64_mismatched_32bit_el0); ++ return !kvm_supports_32bit_el0(); + } + + /** +diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c +index c06c0477fab5..be7edd21537f 100644 +--- a/arch/arm64/kvm/sys_regs.c ++++ b/arch/arm64/kvm/sys_regs.c +@@ -692,7 +692,7 @@ static void reset_pmcr(struct kvm_vcpu *vcpu, const struct sys_reg_desc *r) + */ + val = ((pmcr & ~ARMV8_PMU_PMCR_MASK) + | (ARMV8_PMU_PMCR_MASK & 0xdecafbad)) & (~ARMV8_PMU_PMCR_E); +- if (!system_supports_32bit_el0()) ++ if (!kvm_supports_32bit_el0()) + val |= ARMV8_PMU_PMCR_LC; + __vcpu_sys_reg(vcpu, r->reg) = val; + } +@@ -741,7 +741,7 @@ static bool access_pmcr(struct kvm_vcpu *vcpu, struct sys_reg_params *p, + val = __vcpu_sys_reg(vcpu, PMCR_EL0); + val &= ~ARMV8_PMU_PMCR_MASK; + val |= p->regval & ARMV8_PMU_PMCR_MASK; +- if (!system_supports_32bit_el0()) ++ if (!kvm_supports_32bit_el0()) + val |= ARMV8_PMU_PMCR_LC; + __vcpu_sys_reg(vcpu, PMCR_EL0) = val; + kvm_pmu_handle_pmcr(vcpu, val); +-- +2.35.1 + diff --git a/queue-5.19/kvm-ppc-book3s-hv-fix-rm_exit-entry-in-debugfs-timin.patch b/queue-5.19/kvm-ppc-book3s-hv-fix-rm_exit-entry-in-debugfs-timin.patch new file mode 100644 index 00000000000..9bc93bbf2eb --- /dev/null +++ b/queue-5.19/kvm-ppc-book3s-hv-fix-rm_exit-entry-in-debugfs-timin.patch @@ -0,0 +1,69 @@ +From bbbb1c2702f4d4efc36a722c25afec980c362212 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 May 2022 10:05:50 -0300 +Subject: KVM: PPC: Book3S HV: Fix "rm_exit" entry in debugfs timings + +From: Fabiano Rosas + +[ Upstream commit 9981bace85d816ed8724ac46e49285e8488d29e6 ] + +At debugfs/kvm//vcpu0/timings we show how long each part of the +code takes to run: + +$ cat /sys/kernel/debug/kvm/*-*/vcpu0/timings +rm_entry: 123785 49398892 118 4898 +rm_intr: 123780 6075890 22 390 +rm_exit: 0 0 0 0 <-- NOK +guest: 123780 46732919988 402 9997638 +cede: 0 0 0 0 <-- OK, no cede napping in P9 + +The "rm_exit" is always showing zero because it is the last one and +end_timing does not increment the counter of the previous entry. + +We can fix it by calling accumulate_time again instead of +end_timing. That way the counter gets incremented. The rest of the +arithmetic can be ignored because there are no timing points after +this and the accumulators are reset before the next round. + +Signed-off-by: Fabiano Rosas +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20220525130554.2614394-2-farosas@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/kvm/book3s_hv_p9_entry.c | 13 ++----------- + 1 file changed, 2 insertions(+), 11 deletions(-) + +diff --git a/arch/powerpc/kvm/book3s_hv_p9_entry.c b/arch/powerpc/kvm/book3s_hv_p9_entry.c +index 112a09b33328..7f88be386b27 100644 +--- a/arch/powerpc/kvm/book3s_hv_p9_entry.c ++++ b/arch/powerpc/kvm/book3s_hv_p9_entry.c +@@ -438,15 +438,6 @@ void restore_p9_host_os_sprs(struct kvm_vcpu *vcpu, + EXPORT_SYMBOL_GPL(restore_p9_host_os_sprs); + + #ifdef CONFIG_KVM_BOOK3S_HV_EXIT_TIMING +-static void __start_timing(struct kvm_vcpu *vcpu, struct kvmhv_tb_accumulator *next) +-{ +- struct kvmppc_vcore *vc = vcpu->arch.vcore; +- u64 tb = mftb() - vc->tb_offset_applied; +- +- vcpu->arch.cur_activity = next; +- vcpu->arch.cur_tb_start = tb; +-} +- + static void __accumulate_time(struct kvm_vcpu *vcpu, struct kvmhv_tb_accumulator *next) + { + struct kvmppc_vcore *vc = vcpu->arch.vcore; +@@ -478,8 +469,8 @@ static void __accumulate_time(struct kvm_vcpu *vcpu, struct kvmhv_tb_accumulator + curr->seqcount = seq + 2; + } + +-#define start_timing(vcpu, next) __start_timing(vcpu, next) +-#define end_timing(vcpu) __start_timing(vcpu, NULL) ++#define start_timing(vcpu, next) __accumulate_time(vcpu, next) ++#define end_timing(vcpu) __accumulate_time(vcpu, NULL) + #define accumulate_time(vcpu, next) __accumulate_time(vcpu, next) + #else + #define start_timing(vcpu, next) do {} while (0) +-- +2.35.1 + diff --git a/queue-5.19/lib-list_debug.c-detect-uninitialized-lists.patch b/queue-5.19/lib-list_debug.c-detect-uninitialized-lists.patch new file mode 100644 index 00000000000..3c5ce98b654 --- /dev/null +++ b/queue-5.19/lib-list_debug.c-detect-uninitialized-lists.patch @@ -0,0 +1,80 @@ +From f9202f19c90c3a56155402fa876195c4de53940d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 May 2022 15:29:51 -0700 +Subject: lib/list_debug.c: Detect uninitialized lists + +From: Guenter Roeck + +[ Upstream commit 0cc011c576aaa4de505046f7a6c90933d7c749a9 ] + +In some circumstances, attempts are made to add entries to or to remove +entries from an uninitialized list. A prime example is +amdgpu_bo_vm_destroy(): It is indirectly called from +ttm_bo_init_reserved() if that function fails, and tries to remove an +entry from a list. However, that list is only initialized in +amdgpu_bo_create_vm() after the call to ttm_bo_init_reserved() returned +success. This results in crashes such as + + BUG: kernel NULL pointer dereference, address: 0000000000000000 + #PF: supervisor read access in kernel mode + #PF: error_code(0x0000) - not-present page + PGD 0 P4D 0 + Oops: 0000 [#1] PREEMPT SMP NOPTI + CPU: 1 PID: 1479 Comm: chrome Not tainted 5.10.110-15768-g29a72e65dae5 + Hardware name: Google Grunt/Grunt, BIOS Google_Grunt.11031.149.0 07/15/2020 + RIP: 0010:__list_del_entry_valid+0x26/0x7d + ... + Call Trace: + amdgpu_bo_vm_destroy+0x48/0x8b + ttm_bo_init_reserved+0x1d7/0x1e0 + amdgpu_bo_create+0x212/0x476 + ? amdgpu_bo_user_destroy+0x23/0x23 + ? kmem_cache_alloc+0x60/0x271 + amdgpu_bo_create_vm+0x40/0x7d + amdgpu_vm_pt_create+0xe8/0x24b + ... + +Check if the list's prev and next pointers are NULL to catch such problems. + +Link: https://lkml.kernel.org/r/20220531222951.92073-1-linux@roeck-us.net +Signed-off-by: Guenter Roeck +Cc: Steven Rostedt +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + lib/list_debug.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/lib/list_debug.c b/lib/list_debug.c +index 9daa3fb9d1cd..d98d43f80958 100644 +--- a/lib/list_debug.c ++++ b/lib/list_debug.c +@@ -20,7 +20,11 @@ + bool __list_add_valid(struct list_head *new, struct list_head *prev, + struct list_head *next) + { +- if (CHECK_DATA_CORRUPTION(next->prev != prev, ++ if (CHECK_DATA_CORRUPTION(prev == NULL, ++ "list_add corruption. prev is NULL.\n") || ++ CHECK_DATA_CORRUPTION(next == NULL, ++ "list_add corruption. next is NULL.\n") || ++ CHECK_DATA_CORRUPTION(next->prev != prev, + "list_add corruption. next->prev should be prev (%px), but was %px. (next=%px).\n", + prev, next->prev, next) || + CHECK_DATA_CORRUPTION(prev->next != next, +@@ -42,7 +46,11 @@ bool __list_del_entry_valid(struct list_head *entry) + prev = entry->prev; + next = entry->next; + +- if (CHECK_DATA_CORRUPTION(next == LIST_POISON1, ++ if (CHECK_DATA_CORRUPTION(next == NULL, ++ "list_del corruption, %px->next is NULL\n", entry) || ++ CHECK_DATA_CORRUPTION(prev == NULL, ++ "list_del corruption, %px->prev is NULL\n", entry) || ++ CHECK_DATA_CORRUPTION(next == LIST_POISON1, + "list_del corruption, %px->next is LIST_POISON1 (%px)\n", + entry, LIST_POISON1) || + CHECK_DATA_CORRUPTION(prev == LIST_POISON2, +-- +2.35.1 + diff --git a/queue-5.19/md-notify-sysfs-sync_completed-in-md_reap_sync_threa.patch b/queue-5.19/md-notify-sysfs-sync_completed-in-md_reap_sync_threa.patch new file mode 100644 index 00000000000..3c53d5de263 --- /dev/null +++ b/queue-5.19/md-notify-sysfs-sync_completed-in-md_reap_sync_threa.patch @@ -0,0 +1,50 @@ +From 903d216d6e03e3a3732e058db50a906615c55675 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Jun 2022 10:27:56 -0600 +Subject: md: Notify sysfs sync_completed in md_reap_sync_thread() + +From: Logan Gunthorpe + +[ Upstream commit 9973f0fa7d20269fe6fefe6333997fb5914449c1 ] + +The mdadm test 07layouts randomly produces a kernel hung task deadlock. +The deadlock is caused by the suspend_lo/suspend_hi files being set by +the mdadm background process during reshape and not being cleared +because the process hangs. (Leaving aside the issue of the fragility of +freezing kernel tasks by buggy userspace processes...) + +When the background mdadm process hangs it, is waiting (without a +timeout) on a change to the sync_completed file signalling that the +reshape has completed. The process is woken up a couple times when +the reshape finishes but it is woken up before MD_RECOVERY_RUNNING +is cleared so sync_completed_show() reports 0 instead of "none". + +To fix this, notify the sysfs file in md_reap_sync_thread() after +MD_RECOVERY_RUNNING has been cleared. This wakes up mdadm and causes +it to continue and write to suspend_lo/suspend_hi to allow IO to +continue. + +Signed-off-by: Logan Gunthorpe +Reviewed-by: Christoph Hellwig +Signed-off-by: Song Liu +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/md/md.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/md/md.c b/drivers/md/md.c +index 660c52d48256..522b3d6b8c46 100644 +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -9466,6 +9466,7 @@ void md_reap_sync_thread(struct mddev *mddev) + wake_up(&resync_wait); + /* flag recovery needed just to double check */ + set_bit(MD_RECOVERY_NEEDED, &mddev->recovery); ++ sysfs_notify_dirent_safe(mddev->sysfs_completed); + sysfs_notify_dirent_safe(mddev->sysfs_action); + md_new_event(); + if (mddev->event_work.func) +-- +2.35.1 + diff --git a/queue-5.19/md-raid5-make-logic-blocking-check-consistent-with-l.patch b/queue-5.19/md-raid5-make-logic-blocking-check-consistent-with-l.patch new file mode 100644 index 00000000000..d2076cc4d0c --- /dev/null +++ b/queue-5.19/md-raid5-make-logic-blocking-check-consistent-with-l.patch @@ -0,0 +1,48 @@ +From 717ec37cffd7db04106109fc722613a552926938 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Jun 2022 13:19:31 -0600 +Subject: md/raid5: Make logic blocking check consistent with logic that blocks + +From: Logan Gunthorpe + +[ Upstream commit 6e3f50d30af847bebce072182bd735e90a294c6a ] + +The check in raid5_make_request differs very slightly from the logic +that causes it to block lower down. This likely does not cause a bug +as the check is fuzzy anyway (as reshape may move on between the first +check and the subsequent check). However, make it consistent so it can +be cleaned up in a subsequent patch. + +The condition which causes the schedule is: + + !(mddev->reshape_backwards ? logical_sector < conf->reshape_progress : + logical_sector >= conf->reshape_progress) && + (mddev->reshape_backwards ? logical_sector < conf->reshape_safe : + logical_sector >= conf->reshape_safe) + +The condition that causes the early bailout is made to match this. + +Signed-off-by: Logan Gunthorpe +Signed-off-by: Song Liu +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/md/raid5.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c +index c8539d0e12dd..45482cebacdb 100644 +--- a/drivers/md/raid5.c ++++ b/drivers/md/raid5.c +@@ -5841,7 +5841,7 @@ static bool raid5_make_request(struct mddev *mddev, struct bio * bi) + if ((bi->bi_opf & REQ_NOWAIT) && + (conf->reshape_progress != MaxSector) && + (mddev->reshape_backwards +- ? (logical_sector > conf->reshape_progress && logical_sector <= conf->reshape_safe) ++ ? (logical_sector >= conf->reshape_progress && logical_sector < conf->reshape_safe) + : (logical_sector >= conf->reshape_safe && logical_sector < conf->reshape_progress))) { + bio_wouldblock_error(bi); + if (rw == WRITE) +-- +2.35.1 + diff --git a/queue-5.19/mips-cavium-octeon-fix-missing-of_node_put-in-octeon.patch b/queue-5.19/mips-cavium-octeon-fix-missing-of_node_put-in-octeon.patch new file mode 100644 index 00000000000..c3ea6851bf4 --- /dev/null +++ b/queue-5.19/mips-cavium-octeon-fix-missing-of_node_put-in-octeon.patch @@ -0,0 +1,42 @@ +From 5ea5ca1f1042f86c59fe7b92de44f71fffb0f18a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Jul 2022 20:41:12 +0800 +Subject: mips: cavium-octeon: Fix missing of_node_put() in + octeon2_usb_clocks_start + +From: Liang He + +[ Upstream commit 7a9f743ceead60ed454c46fbc3085ee9a79cbebb ] + +We should call of_node_put() for the reference 'uctl_node' returned by +of_get_parent() which will increase the refcount. Otherwise, there will +be a refcount leak bug. + +Signed-off-by: Liang He +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/cavium-octeon/octeon-platform.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/arch/mips/cavium-octeon/octeon-platform.c b/arch/mips/cavium-octeon/octeon-platform.c +index a994022e32c9..ce05c0dd3acd 100644 +--- a/arch/mips/cavium-octeon/octeon-platform.c ++++ b/arch/mips/cavium-octeon/octeon-platform.c +@@ -86,11 +86,12 @@ static void octeon2_usb_clocks_start(struct device *dev) + "refclk-frequency", &clock_rate); + if (i) { + dev_err(dev, "No UCTL \"refclk-frequency\"\n"); ++ of_node_put(uctl_node); + goto exit; + } + i = of_property_read_string(uctl_node, + "refclk-type", &clock_type); +- ++ of_node_put(uctl_node); + if (!i && strcmp("crystal", clock_type) == 0) + is_crystal_clock = true; + } +-- +2.35.1 + diff --git a/queue-5.19/mips-tlbex-explicitly-compare-_page_no_exec-against-.patch b/queue-5.19/mips-tlbex-explicitly-compare-_page_no_exec-against-.patch new file mode 100644 index 00000000000..9e13b91ffc7 --- /dev/null +++ b/queue-5.19/mips-tlbex-explicitly-compare-_page_no_exec-against-.patch @@ -0,0 +1,70 @@ +From 33cf03fea7ff5400262557ef585477bb8a1c7fc3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Aug 2022 10:59:36 -0700 +Subject: MIPS: tlbex: Explicitly compare _PAGE_NO_EXEC against 0 + +From: Nathan Chancellor + +[ Upstream commit 74de14fe05dd6b151d73cb0c73c8ec874cbdcde6 ] + +When CONFIG_XPA is enabled, Clang warns: + + arch/mips/mm/tlbex.c:629:24: error: converting the result of '<<' to a boolean; did you mean '(1 << _PAGE_NO_EXEC_SHIFT) != 0'? [-Werror,-Wint-in-bool-context] + if (cpu_has_rixi && !!_PAGE_NO_EXEC) { + ^ + arch/mips/include/asm/pgtable-bits.h:174:28: note: expanded from macro '_PAGE_NO_EXEC' + # define _PAGE_NO_EXEC (1 << _PAGE_NO_EXEC_SHIFT) + ^ + arch/mips/mm/tlbex.c:2568:24: error: converting the result of '<<' to a boolean; did you mean '(1 << _PAGE_NO_EXEC_SHIFT) != 0'? [-Werror,-Wint-in-bool-context] + if (!cpu_has_rixi || !_PAGE_NO_EXEC) { + ^ + arch/mips/include/asm/pgtable-bits.h:174:28: note: expanded from macro '_PAGE_NO_EXEC' + # define _PAGE_NO_EXEC (1 << _PAGE_NO_EXEC_SHIFT) + ^ + 2 errors generated. + +_PAGE_NO_EXEC can be '0' or '1 << _PAGE_NO_EXEC_SHIFT' depending on the +build and runtime configuration, which is what the negation operators +are trying to convey. To silence the warning, explicitly compare against +0 so the result of the '<<' operator is not implicitly converted to a +boolean. + +According to its documentation, GCC enables -Wint-in-bool-context with +-Wall but this warning is not visible when building the same +configuration with GCC. It appears GCC only warns when compiling C++, +not C, although the documentation makes no note of this: +https://godbolt.org/z/x39q3brxf + +Reported-by: Sudip Mukherjee (Codethink) +Signed-off-by: Nathan Chancellor +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/mm/tlbex.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/mips/mm/tlbex.c b/arch/mips/mm/tlbex.c +index 8dbbd99fc7e8..be4d4670d649 100644 +--- a/arch/mips/mm/tlbex.c ++++ b/arch/mips/mm/tlbex.c +@@ -626,7 +626,7 @@ static __maybe_unused void build_convert_pte_to_entrylo(u32 **p, + return; + } + +- if (cpu_has_rixi && !!_PAGE_NO_EXEC) { ++ if (cpu_has_rixi && _PAGE_NO_EXEC != 0) { + if (fill_includes_sw_bits) { + UASM_i_ROTR(p, reg, reg, ilog2(_PAGE_GLOBAL)); + } else { +@@ -2565,7 +2565,7 @@ static void check_pabits(void) + unsigned long entry; + unsigned pabits, fillbits; + +- if (!cpu_has_rixi || !_PAGE_NO_EXEC) { ++ if (!cpu_has_rixi || _PAGE_NO_EXEC == 0) { + /* + * We'll only be making use of the fact that we can rotate bits + * into the fill if the CPU supports RIXI, so don't bother +-- +2.35.1 + diff --git a/queue-5.19/mmc-renesas_sdhi-newer-socs-don-t-need-manual-tap-co.patch b/queue-5.19/mmc-renesas_sdhi-newer-socs-don-t-need-manual-tap-co.patch new file mode 100644 index 00000000000..f0e5b40c9b6 --- /dev/null +++ b/queue-5.19/mmc-renesas_sdhi-newer-socs-don-t-need-manual-tap-co.patch @@ -0,0 +1,108 @@ +From aebd6d3090c016f17d1d8c49e974d6e901de7d83 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Jul 2022 09:29:01 +0200 +Subject: mmc: renesas_sdhi: newer SoCs don't need manual tap correction + +From: Takeshi Saito + +[ Upstream commit 00e8c11c137b2e4b2bf54dc9881cf32e3441ddb4 ] + +The newest Gen3 SoCs and Gen4 SoCs do not need manual tap correction +with HS400 anymore. So, instead of checking the SDHI version, add a +quirk flag and set manual tap correction only for affected SoCs. + +Signed-off-by: Takeshi Saito +[wsa: rebased, renamed the quirk variable, removed stale comment] +Signed-off-by: Wolfram Sang +Reviewed-by: Yoshihiro Shimoda +Tested-by: Yoshihiro Shimoda +Link: https://lore.kernel.org/r/20220720072901.1266-1-wsa+renesas@sang-engineering.com +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/renesas_sdhi.h | 1 + + drivers/mmc/host/renesas_sdhi_core.c | 5 ++--- + drivers/mmc/host/renesas_sdhi_internal_dmac.c | 6 ++++++ + 3 files changed, 9 insertions(+), 3 deletions(-) + +diff --git a/drivers/mmc/host/renesas_sdhi.h b/drivers/mmc/host/renesas_sdhi.h +index 1a1e3e020a8c..c4abfee1ebae 100644 +--- a/drivers/mmc/host/renesas_sdhi.h ++++ b/drivers/mmc/host/renesas_sdhi.h +@@ -43,6 +43,7 @@ struct renesas_sdhi_quirks { + bool hs400_4taps; + bool fixed_addr_mode; + bool dma_one_rx_only; ++ bool manual_tap_correction; + u32 hs400_bad_taps; + const u8 (*hs400_calib_table)[SDHI_CALIB_TABLE_MAX]; + }; +diff --git a/drivers/mmc/host/renesas_sdhi_core.c b/drivers/mmc/host/renesas_sdhi_core.c +index 55f7b27c3de7..6edbf5c161ab 100644 +--- a/drivers/mmc/host/renesas_sdhi_core.c ++++ b/drivers/mmc/host/renesas_sdhi_core.c +@@ -380,8 +380,7 @@ static void renesas_sdhi_hs400_complete(struct mmc_host *mmc) + sd_scc_write32(host, priv, SH_MOBILE_SDHI_SCC_DT2FF, + priv->scc_tappos_hs400); + +- /* Gen3 can't do automatic tap correction with HS400, so disable it */ +- if (sd_ctrl_read16(host, CTL_VERSION) == SDHI_VER_GEN3_SDMMC) ++ if (priv->quirks && priv->quirks->manual_tap_correction) + sd_scc_write32(host, priv, SH_MOBILE_SDHI_SCC_RVSCNTL, + ~SH_MOBILE_SDHI_SCC_RVSCNTL_RVSEN & + sd_scc_read32(host, priv, SH_MOBILE_SDHI_SCC_RVSCNTL)); +@@ -718,7 +717,7 @@ static bool renesas_sdhi_manual_correction(struct tmio_mmc_host *host, bool use_ + sd_scc_write32(host, priv, SH_MOBILE_SDHI_SCC_RVSREQ, 0); + + /* Change TAP position according to correction status */ +- if (sd_ctrl_read16(host, CTL_VERSION) == SDHI_VER_GEN3_SDMMC && ++ if (priv->quirks && priv->quirks->manual_tap_correction && + host->mmc->ios.timing == MMC_TIMING_MMC_HS400) { + u32 bad_taps = priv->quirks ? priv->quirks->hs400_bad_taps : 0; + /* +diff --git a/drivers/mmc/host/renesas_sdhi_internal_dmac.c b/drivers/mmc/host/renesas_sdhi_internal_dmac.c +index 3084b15ae2cb..52915404eb07 100644 +--- a/drivers/mmc/host/renesas_sdhi_internal_dmac.c ++++ b/drivers/mmc/host/renesas_sdhi_internal_dmac.c +@@ -170,6 +170,7 @@ static const struct renesas_sdhi_quirks sdhi_quirks_4tap_nohs400_one_rx = { + static const struct renesas_sdhi_quirks sdhi_quirks_4tap = { + .hs400_4taps = true, + .hs400_bad_taps = BIT(2) | BIT(3) | BIT(6) | BIT(7), ++ .manual_tap_correction = true, + }; + + static const struct renesas_sdhi_quirks sdhi_quirks_nohs400 = { +@@ -182,25 +183,30 @@ static const struct renesas_sdhi_quirks sdhi_quirks_fixed_addr = { + + static const struct renesas_sdhi_quirks sdhi_quirks_bad_taps1357 = { + .hs400_bad_taps = BIT(1) | BIT(3) | BIT(5) | BIT(7), ++ .manual_tap_correction = true, + }; + + static const struct renesas_sdhi_quirks sdhi_quirks_bad_taps2367 = { + .hs400_bad_taps = BIT(2) | BIT(3) | BIT(6) | BIT(7), ++ .manual_tap_correction = true, + }; + + static const struct renesas_sdhi_quirks sdhi_quirks_r8a7796_es13 = { + .hs400_4taps = true, + .hs400_bad_taps = BIT(2) | BIT(3) | BIT(6) | BIT(7), + .hs400_calib_table = r8a7796_es13_calib_table, ++ .manual_tap_correction = true, + }; + + static const struct renesas_sdhi_quirks sdhi_quirks_r8a77965 = { + .hs400_bad_taps = BIT(2) | BIT(3) | BIT(6) | BIT(7), + .hs400_calib_table = r8a77965_calib_table, ++ .manual_tap_correction = true, + }; + + static const struct renesas_sdhi_quirks sdhi_quirks_r8a77990 = { + .hs400_calib_table = r8a77990_calib_table, ++ .manual_tap_correction = true, + }; + + /* +-- +2.35.1 + diff --git a/queue-5.19/mmc-tmio-avoid-glitches-when-resetting.patch b/queue-5.19/mmc-tmio-avoid-glitches-when-resetting.patch new file mode 100644 index 00000000000..32aa9a11314 --- /dev/null +++ b/queue-5.19/mmc-tmio-avoid-glitches-when-resetting.patch @@ -0,0 +1,210 @@ +From 145663909dfe644881cda8daddb0e54d1bf02c53 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 25 Jun 2022 15:17:22 +0200 +Subject: mmc: tmio: avoid glitches when resetting + +From: Wolfram Sang + +[ Upstream commit 2e586f8a5b0ed4a525014a692923ac96f6647816 ] + +If we reset because of an error, we need to preserve values for the +clock frequency. Otherwise, glitches may be seen on the bus. + +To achieve that, we introduce a 'preserve' parameter to the reset +function and the IP core specific reset callbacks to handle everything +accordingly. + +Reported-by: Yoshihiro Shimoda +Signed-off-by: Wolfram Sang +Tested-by: Yoshihiro Shimoda +Link: https://lore.kernel.org/r/20220625131722.1397-1-wsa@kernel.org +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/renesas_sdhi_core.c | 29 ++++++++++++++-------------- + drivers/mmc/host/tmio_mmc.c | 2 +- + drivers/mmc/host/tmio_mmc.h | 6 +++++- + drivers/mmc/host/tmio_mmc_core.c | 28 +++++++++++++++++++++------ + 4 files changed, 42 insertions(+), 23 deletions(-) + +diff --git a/drivers/mmc/host/renesas_sdhi_core.c b/drivers/mmc/host/renesas_sdhi_core.c +index 0d258b6e1a43..55f7b27c3de7 100644 +--- a/drivers/mmc/host/renesas_sdhi_core.c ++++ b/drivers/mmc/host/renesas_sdhi_core.c +@@ -49,9 +49,6 @@ + #define HOST_MODE_GEN3_32BIT (HOST_MODE_GEN3_WMODE | HOST_MODE_GEN3_BUSWIDTH) + #define HOST_MODE_GEN3_64BIT 0 + +-#define CTL_SDIF_MODE 0xe6 +-#define SDIF_MODE_HS400 BIT(0) +- + #define SDHI_VER_GEN2_SDR50 0x490c + #define SDHI_VER_RZ_A1 0x820b + /* very old datasheets said 0x490c for SDR104, too. They are wrong! */ +@@ -562,23 +559,25 @@ static void renesas_sdhi_scc_reset(struct tmio_mmc_host *host, struct renesas_sd + } + + /* only populated for TMIO_MMC_MIN_RCAR2 */ +-static void renesas_sdhi_reset(struct tmio_mmc_host *host) ++static void renesas_sdhi_reset(struct tmio_mmc_host *host, bool preserve) + { + struct renesas_sdhi *priv = host_to_priv(host); + int ret; + u16 val; + +- if (priv->rstc) { +- reset_control_reset(priv->rstc); +- /* Unknown why but without polling reset status, it will hang */ +- read_poll_timeout(reset_control_status, ret, ret == 0, 1, 100, +- false, priv->rstc); +- /* At least SDHI_VER_GEN2_SDR50 needs manual release of reset */ +- sd_ctrl_write16(host, CTL_RESET_SD, 0x0001); +- priv->needs_adjust_hs400 = false; +- renesas_sdhi_set_clock(host, host->clk_cache); +- } else if (priv->scc_ctl) { +- renesas_sdhi_scc_reset(host, priv); ++ if (!preserve) { ++ if (priv->rstc) { ++ reset_control_reset(priv->rstc); ++ /* Unknown why but without polling reset status, it will hang */ ++ read_poll_timeout(reset_control_status, ret, ret == 0, 1, 100, ++ false, priv->rstc); ++ /* At least SDHI_VER_GEN2_SDR50 needs manual release of reset */ ++ sd_ctrl_write16(host, CTL_RESET_SD, 0x0001); ++ priv->needs_adjust_hs400 = false; ++ renesas_sdhi_set_clock(host, host->clk_cache); ++ } else if (priv->scc_ctl) { ++ renesas_sdhi_scc_reset(host, priv); ++ } + } + + if (sd_ctrl_read16(host, CTL_VERSION) >= SDHI_VER_GEN3_SD) { +diff --git a/drivers/mmc/host/tmio_mmc.c b/drivers/mmc/host/tmio_mmc.c +index b55a29c53d9c..53a2ad9a24b8 100644 +--- a/drivers/mmc/host/tmio_mmc.c ++++ b/drivers/mmc/host/tmio_mmc.c +@@ -75,7 +75,7 @@ static void tmio_mmc_set_clock(struct tmio_mmc_host *host, + tmio_mmc_clk_start(host); + } + +-static void tmio_mmc_reset(struct tmio_mmc_host *host) ++static void tmio_mmc_reset(struct tmio_mmc_host *host, bool preserve) + { + sd_ctrl_write16(host, CTL_RESET_SDIO, 0x0000); + usleep_range(10000, 11000); +diff --git a/drivers/mmc/host/tmio_mmc.h b/drivers/mmc/host/tmio_mmc.h +index e754bb3f5c32..501613c74406 100644 +--- a/drivers/mmc/host/tmio_mmc.h ++++ b/drivers/mmc/host/tmio_mmc.h +@@ -42,6 +42,7 @@ + #define CTL_DMA_ENABLE 0xd8 + #define CTL_RESET_SD 0xe0 + #define CTL_VERSION 0xe2 ++#define CTL_SDIF_MODE 0xe6 /* only known on R-Car 2+ */ + + /* Definitions for values the CTL_STOP_INTERNAL_ACTION register can take */ + #define TMIO_STOP_STP BIT(0) +@@ -98,6 +99,9 @@ + /* Definitions for values the CTL_DMA_ENABLE register can take */ + #define DMA_ENABLE_DMASDRW BIT(1) + ++/* Definitions for values the CTL_SDIF_MODE register can take */ ++#define SDIF_MODE_HS400 BIT(0) /* only known on R-Car 2+ */ ++ + /* Define some IRQ masks */ + /* This is the mask used at reset by the chip */ + #define TMIO_MASK_ALL 0x837f031d +@@ -181,7 +185,7 @@ struct tmio_mmc_host { + int (*multi_io_quirk)(struct mmc_card *card, + unsigned int direction, int blk_size); + int (*write16_hook)(struct tmio_mmc_host *host, int addr); +- void (*reset)(struct tmio_mmc_host *host); ++ void (*reset)(struct tmio_mmc_host *host, bool preserve); + bool (*check_retune)(struct tmio_mmc_host *host, struct mmc_request *mrq); + void (*fixup_request)(struct tmio_mmc_host *host, struct mmc_request *mrq); + unsigned int (*get_timeout_cycles)(struct tmio_mmc_host *host); +diff --git a/drivers/mmc/host/tmio_mmc_core.c b/drivers/mmc/host/tmio_mmc_core.c +index a5850d83908b..437048bb8027 100644 +--- a/drivers/mmc/host/tmio_mmc_core.c ++++ b/drivers/mmc/host/tmio_mmc_core.c +@@ -179,8 +179,17 @@ static void tmio_mmc_set_bus_width(struct tmio_mmc_host *host, + sd_ctrl_write16(host, CTL_SD_MEM_CARD_OPT, reg); + } + +-static void tmio_mmc_reset(struct tmio_mmc_host *host) ++static void tmio_mmc_reset(struct tmio_mmc_host *host, bool preserve) + { ++ u16 card_opt, clk_ctrl, sdif_mode; ++ ++ if (preserve) { ++ card_opt = sd_ctrl_read16(host, CTL_SD_MEM_CARD_OPT); ++ clk_ctrl = sd_ctrl_read16(host, CTL_SD_CARD_CLK_CTL); ++ if (host->pdata->flags & TMIO_MMC_MIN_RCAR2) ++ sdif_mode = sd_ctrl_read16(host, CTL_SDIF_MODE); ++ } ++ + /* FIXME - should we set stop clock reg here */ + sd_ctrl_write16(host, CTL_RESET_SD, 0x0000); + usleep_range(10000, 11000); +@@ -190,7 +199,7 @@ static void tmio_mmc_reset(struct tmio_mmc_host *host) + tmio_mmc_abort_dma(host); + + if (host->reset) +- host->reset(host); ++ host->reset(host, preserve); + + sd_ctrl_write32_as_16_and_16(host, CTL_IRQ_MASK, host->sdcard_irq_mask_all); + host->sdcard_irq_mask = host->sdcard_irq_mask_all; +@@ -206,6 +215,13 @@ static void tmio_mmc_reset(struct tmio_mmc_host *host) + sd_ctrl_write16(host, CTL_TRANSACTION_CTL, 0x0001); + } + ++ if (preserve) { ++ sd_ctrl_write16(host, CTL_SD_MEM_CARD_OPT, card_opt); ++ sd_ctrl_write16(host, CTL_SD_CARD_CLK_CTL, clk_ctrl); ++ if (host->pdata->flags & TMIO_MMC_MIN_RCAR2) ++ sd_ctrl_write16(host, CTL_SDIF_MODE, sdif_mode); ++ } ++ + if (host->mmc->card) + mmc_retune_needed(host->mmc); + } +@@ -248,7 +264,7 @@ static void tmio_mmc_reset_work(struct work_struct *work) + + spin_unlock_irqrestore(&host->lock, flags); + +- tmio_mmc_reset(host); ++ tmio_mmc_reset(host, true); + + /* Ready for new calls */ + host->mrq = NULL; +@@ -961,7 +977,7 @@ static void tmio_mmc_set_ios(struct mmc_host *mmc, struct mmc_ios *ios) + tmio_mmc_power_off(host); + /* For R-Car Gen2+, we need to reset SDHI specific SCC */ + if (host->pdata->flags & TMIO_MMC_MIN_RCAR2) +- tmio_mmc_reset(host); ++ tmio_mmc_reset(host, false); + + host->set_clock(host, 0); + break; +@@ -1189,7 +1205,7 @@ int tmio_mmc_host_probe(struct tmio_mmc_host *_host) + _host->sdcard_irq_mask_all = TMIO_MASK_ALL; + + _host->set_clock(_host, 0); +- tmio_mmc_reset(_host); ++ tmio_mmc_reset(_host, false); + + spin_lock_init(&_host->lock); + mutex_init(&_host->ios_lock); +@@ -1285,7 +1301,7 @@ int tmio_mmc_host_runtime_resume(struct device *dev) + struct tmio_mmc_host *host = dev_get_drvdata(dev); + + tmio_mmc_clk_enable(host); +- tmio_mmc_reset(host); ++ tmio_mmc_reset(host, false); + + if (host->clk_cache) + host->set_clock(host, host->clk_cache); +-- +2.35.1 + diff --git a/queue-5.19/modules-ensure-natural-alignment-for-.altinstruction.patch b/queue-5.19/modules-ensure-natural-alignment-for-.altinstruction.patch new file mode 100644 index 00000000000..6cc822ede9b --- /dev/null +++ b/queue-5.19/modules-ensure-natural-alignment-for-.altinstruction.patch @@ -0,0 +1,57 @@ +From fa911db0bf34c1140d85bd57937eb2c244f7f332 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Jul 2022 11:44:54 +0200 +Subject: modules: Ensure natural alignment for .altinstructions and + __bug_table sections + +From: Helge Deller + +[ Upstream commit 87c482bdfa79f378297d92af49cdf265be199df5 ] + +In the kernel image vmlinux.lds.S linker scripts the .altinstructions +and __bug_table sections are 4- or 8-byte aligned because they hold 32- +and/or 64-bit values. + +Most architectures use altinstructions and BUG() or WARN() in modules as +well, but in the module linker script (module.lds.S) those sections are +currently missing. As consequence the linker will store their content +byte-aligned by default, which then can lead to unnecessary unaligned +memory accesses by the CPU when those tables are processed at runtime. + +Usually unaligned memory accesses are unnoticed, because either the +hardware (as on x86 CPUs) or in-kernel exception handlers (e.g. on +parisc or sparc) emulate and fix them up at runtime. Nevertheless, such +unaligned accesses introduce a performance penalty and can even crash +the kernel if there is a bug in the unalignment exception handlers +(which happened once to me on the parisc architecture and which is why I +noticed that issue at all). + +This patch fixes a non-critical issue and might be backported at any time. +It's trivial and shouldn't introduce any regression because it simply +tells the linker to use a different (8-byte alignment) for those +sections by default. + +Signed-off-by: Helge Deller +Link: https://lore.kernel.org/all/Yr8%2Fgr8e8I7tVX4d@p100/ +Signed-off-by: Luis Chamberlain +Signed-off-by: Sasha Levin +--- + scripts/module.lds.S | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/scripts/module.lds.S b/scripts/module.lds.S +index 1d0e1e4dc3d2..3a3aa2354ed8 100644 +--- a/scripts/module.lds.S ++++ b/scripts/module.lds.S +@@ -27,6 +27,8 @@ SECTIONS { + .ctors 0 : ALIGN(8) { *(SORT(.ctors.*)) *(.ctors) } + .init_array 0 : ALIGN(8) { *(SORT(.init_array.*)) *(.init_array) } + ++ .altinstructions 0 : ALIGN(8) { KEEP(*(.altinstructions)) } ++ __bug_table 0 : ALIGN(8) { KEEP(*(__bug_table)) } + __jump_table 0 : ALIGN(8) { KEEP(*(__jump_table)) } + + __patchable_function_entries : { *(__patchable_function_entries) } +-- +2.35.1 + diff --git a/queue-5.19/net-mscc-ocelot-fix-race-between-ndo_get_stats64-and.patch b/queue-5.19/net-mscc-ocelot-fix-race-between-ndo_get_stats64-and.patch new file mode 100644 index 00000000000..6f2a428992a --- /dev/null +++ b/queue-5.19/net-mscc-ocelot-fix-race-between-ndo_get_stats64-and.patch @@ -0,0 +1,48 @@ +From f50e3a71780a66871c652ba8646fdb322529eed3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Aug 2022 16:53:49 +0300 +Subject: net: mscc: ocelot: fix race between ndo_get_stats64 and + ocelot_check_stats_work + +From: Vladimir Oltean + +[ Upstream commit 18d8e67df184081bc6ce6220a2dd965cfd3d7e6b ] + +The 2 methods can run concurrently, and one will change the window of +counters (SYS_STAT_CFG_STAT_VIEW) that the other sees. The fix is +similar to what commit 7fbf6795d127 ("net: mscc: ocelot: fix mutex lock +error during ethtool stats read") has done for ethtool -S. + +Fixes: a556c76adc05 ("net: mscc: Add initial Ocelot switch support") +Signed-off-by: Vladimir Oltean +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mscc/ocelot_net.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/net/ethernet/mscc/ocelot_net.c b/drivers/net/ethernet/mscc/ocelot_net.c +index 9d8cea16245e..6b9d37138844 100644 +--- a/drivers/net/ethernet/mscc/ocelot_net.c ++++ b/drivers/net/ethernet/mscc/ocelot_net.c +@@ -726,6 +726,8 @@ static void ocelot_get_stats64(struct net_device *dev, + struct ocelot *ocelot = priv->port.ocelot; + int port = priv->port.index; + ++ spin_lock(&ocelot->stats_lock); ++ + /* Configure the port to read the stats from */ + ocelot_write(ocelot, SYS_STAT_CFG_STAT_VIEW(port), + SYS_STAT_CFG); +@@ -758,6 +760,8 @@ static void ocelot_get_stats64(struct net_device *dev, + stats->tx_dropped = ocelot_read(ocelot, SYS_COUNT_TX_DROPS) + + ocelot_read(ocelot, SYS_COUNT_TX_AGING); + stats->collisions = ocelot_read(ocelot, SYS_COUNT_TX_COLLISION); ++ ++ spin_unlock(&ocelot->stats_lock); + } + + static int ocelot_port_fdb_add(struct ndmsg *ndm, struct nlattr *tb[], +-- +2.35.1 + diff --git a/queue-5.19/net-mscc-ocelot-make-struct-ocelot_stat_layout-array.patch b/queue-5.19/net-mscc-ocelot-make-struct-ocelot_stat_layout-array.patch new file mode 100644 index 00000000000..e43ef4b1726 --- /dev/null +++ b/queue-5.19/net-mscc-ocelot-make-struct-ocelot_stat_layout-array.patch @@ -0,0 +1,1717 @@ +From 42ddc918d20d34268eb774cfb7a28ae0e3256826 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Aug 2022 16:53:50 +0300 +Subject: net: mscc: ocelot: make struct ocelot_stat_layout array indexable + +From: Vladimir Oltean + +[ Upstream commit 9190460084ddd0e9235f55eab0fdd5456b5f2fd5 ] + +The ocelot counters are 32-bit and require periodic reading, every 2 +seconds, by ocelot_port_update_stats(), so that wraparounds are +detected. + +Currently, the counters reported by ocelot_get_stats64() come from the +32-bit hardware counters directly, rather than from the 64-bit +accumulated ocelot->stats, and this is a problem for their integrity. + +The strategy is to make ocelot_get_stats64() able to cherry-pick +individual stats from ocelot->stats the way in which it currently reads +them out from SYS_COUNT_* registers. But currently it can't, because +ocelot->stats is an opaque u64 array that's used only to feed data into +ethtool -S. + +To solve that problem, we need to make ocelot->stats indexable, and +associate each element with an element of struct ocelot_stat_layout used +by ethtool -S. + +This makes ocelot_stat_layout a fat (and possibly sparse) array, so we +need to change the way in which we access it. We no longer need +OCELOT_STAT_END as a sentinel, because we know the array's size +(OCELOT_NUM_STATS). We just need to skip the array elements that were +left unpopulated for the switch revision (ocelot, felix, seville). + +Signed-off-by: Vladimir Oltean +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/ocelot/felix_vsc9959.c | 468 ++++++++++++++++----- + drivers/net/dsa/ocelot/seville_vsc9953.c | 468 ++++++++++++++++----- + drivers/net/ethernet/mscc/ocelot.c | 40 +- + drivers/net/ethernet/mscc/ocelot_vsc7514.c | 468 ++++++++++++++++----- + include/soc/mscc/ocelot.h | 105 ++++- + 5 files changed, 1243 insertions(+), 306 deletions(-) + +diff --git a/drivers/net/dsa/ocelot/felix_vsc9959.c b/drivers/net/dsa/ocelot/felix_vsc9959.c +index 601fae886b26..6439b56f381f 100644 +--- a/drivers/net/dsa/ocelot/felix_vsc9959.c ++++ b/drivers/net/dsa/ocelot/felix_vsc9959.c +@@ -550,101 +550,379 @@ static const struct reg_field vsc9959_regfields[REGFIELD_MAX] = { + [SYS_PAUSE_CFG_PAUSE_ENA] = REG_FIELD_ID(SYS_PAUSE_CFG, 0, 1, 7, 4), + }; + +-static const struct ocelot_stat_layout vsc9959_stats_layout[] = { +- { .offset = 0x00, .name = "rx_octets", }, +- { .offset = 0x01, .name = "rx_unicast", }, +- { .offset = 0x02, .name = "rx_multicast", }, +- { .offset = 0x03, .name = "rx_broadcast", }, +- { .offset = 0x04, .name = "rx_shorts", }, +- { .offset = 0x05, .name = "rx_fragments", }, +- { .offset = 0x06, .name = "rx_jabbers", }, +- { .offset = 0x07, .name = "rx_crc_align_errs", }, +- { .offset = 0x08, .name = "rx_sym_errs", }, +- { .offset = 0x09, .name = "rx_frames_below_65_octets", }, +- { .offset = 0x0A, .name = "rx_frames_65_to_127_octets", }, +- { .offset = 0x0B, .name = "rx_frames_128_to_255_octets", }, +- { .offset = 0x0C, .name = "rx_frames_256_to_511_octets", }, +- { .offset = 0x0D, .name = "rx_frames_512_to_1023_octets", }, +- { .offset = 0x0E, .name = "rx_frames_1024_to_1526_octets", }, +- { .offset = 0x0F, .name = "rx_frames_over_1526_octets", }, +- { .offset = 0x10, .name = "rx_pause", }, +- { .offset = 0x11, .name = "rx_control", }, +- { .offset = 0x12, .name = "rx_longs", }, +- { .offset = 0x13, .name = "rx_classified_drops", }, +- { .offset = 0x14, .name = "rx_red_prio_0", }, +- { .offset = 0x15, .name = "rx_red_prio_1", }, +- { .offset = 0x16, .name = "rx_red_prio_2", }, +- { .offset = 0x17, .name = "rx_red_prio_3", }, +- { .offset = 0x18, .name = "rx_red_prio_4", }, +- { .offset = 0x19, .name = "rx_red_prio_5", }, +- { .offset = 0x1A, .name = "rx_red_prio_6", }, +- { .offset = 0x1B, .name = "rx_red_prio_7", }, +- { .offset = 0x1C, .name = "rx_yellow_prio_0", }, +- { .offset = 0x1D, .name = "rx_yellow_prio_1", }, +- { .offset = 0x1E, .name = "rx_yellow_prio_2", }, +- { .offset = 0x1F, .name = "rx_yellow_prio_3", }, +- { .offset = 0x20, .name = "rx_yellow_prio_4", }, +- { .offset = 0x21, .name = "rx_yellow_prio_5", }, +- { .offset = 0x22, .name = "rx_yellow_prio_6", }, +- { .offset = 0x23, .name = "rx_yellow_prio_7", }, +- { .offset = 0x24, .name = "rx_green_prio_0", }, +- { .offset = 0x25, .name = "rx_green_prio_1", }, +- { .offset = 0x26, .name = "rx_green_prio_2", }, +- { .offset = 0x27, .name = "rx_green_prio_3", }, +- { .offset = 0x28, .name = "rx_green_prio_4", }, +- { .offset = 0x29, .name = "rx_green_prio_5", }, +- { .offset = 0x2A, .name = "rx_green_prio_6", }, +- { .offset = 0x2B, .name = "rx_green_prio_7", }, +- { .offset = 0x80, .name = "tx_octets", }, +- { .offset = 0x81, .name = "tx_unicast", }, +- { .offset = 0x82, .name = "tx_multicast", }, +- { .offset = 0x83, .name = "tx_broadcast", }, +- { .offset = 0x84, .name = "tx_collision", }, +- { .offset = 0x85, .name = "tx_drops", }, +- { .offset = 0x86, .name = "tx_pause", }, +- { .offset = 0x87, .name = "tx_frames_below_65_octets", }, +- { .offset = 0x88, .name = "tx_frames_65_to_127_octets", }, +- { .offset = 0x89, .name = "tx_frames_128_255_octets", }, +- { .offset = 0x8A, .name = "tx_frames_256_511_octets", }, +- { .offset = 0x8B, .name = "tx_frames_512_1023_octets", }, +- { .offset = 0x8C, .name = "tx_frames_1024_1526_octets", }, +- { .offset = 0x8D, .name = "tx_frames_over_1526_octets", }, +- { .offset = 0x8E, .name = "tx_yellow_prio_0", }, +- { .offset = 0x8F, .name = "tx_yellow_prio_1", }, +- { .offset = 0x90, .name = "tx_yellow_prio_2", }, +- { .offset = 0x91, .name = "tx_yellow_prio_3", }, +- { .offset = 0x92, .name = "tx_yellow_prio_4", }, +- { .offset = 0x93, .name = "tx_yellow_prio_5", }, +- { .offset = 0x94, .name = "tx_yellow_prio_6", }, +- { .offset = 0x95, .name = "tx_yellow_prio_7", }, +- { .offset = 0x96, .name = "tx_green_prio_0", }, +- { .offset = 0x97, .name = "tx_green_prio_1", }, +- { .offset = 0x98, .name = "tx_green_prio_2", }, +- { .offset = 0x99, .name = "tx_green_prio_3", }, +- { .offset = 0x9A, .name = "tx_green_prio_4", }, +- { .offset = 0x9B, .name = "tx_green_prio_5", }, +- { .offset = 0x9C, .name = "tx_green_prio_6", }, +- { .offset = 0x9D, .name = "tx_green_prio_7", }, +- { .offset = 0x9E, .name = "tx_aged", }, +- { .offset = 0x100, .name = "drop_local", }, +- { .offset = 0x101, .name = "drop_tail", }, +- { .offset = 0x102, .name = "drop_yellow_prio_0", }, +- { .offset = 0x103, .name = "drop_yellow_prio_1", }, +- { .offset = 0x104, .name = "drop_yellow_prio_2", }, +- { .offset = 0x105, .name = "drop_yellow_prio_3", }, +- { .offset = 0x106, .name = "drop_yellow_prio_4", }, +- { .offset = 0x107, .name = "drop_yellow_prio_5", }, +- { .offset = 0x108, .name = "drop_yellow_prio_6", }, +- { .offset = 0x109, .name = "drop_yellow_prio_7", }, +- { .offset = 0x10A, .name = "drop_green_prio_0", }, +- { .offset = 0x10B, .name = "drop_green_prio_1", }, +- { .offset = 0x10C, .name = "drop_green_prio_2", }, +- { .offset = 0x10D, .name = "drop_green_prio_3", }, +- { .offset = 0x10E, .name = "drop_green_prio_4", }, +- { .offset = 0x10F, .name = "drop_green_prio_5", }, +- { .offset = 0x110, .name = "drop_green_prio_6", }, +- { .offset = 0x111, .name = "drop_green_prio_7", }, +- OCELOT_STAT_END ++static const struct ocelot_stat_layout vsc9959_stats_layout[OCELOT_NUM_STATS] = { ++ [OCELOT_STAT_RX_OCTETS] = { ++ .name = "rx_octets", ++ .offset = 0x00, ++ }, ++ [OCELOT_STAT_RX_UNICAST] = { ++ .name = "rx_unicast", ++ .offset = 0x01, ++ }, ++ [OCELOT_STAT_RX_MULTICAST] = { ++ .name = "rx_multicast", ++ .offset = 0x02, ++ }, ++ [OCELOT_STAT_RX_BROADCAST] = { ++ .name = "rx_broadcast", ++ .offset = 0x03, ++ }, ++ [OCELOT_STAT_RX_SHORTS] = { ++ .name = "rx_shorts", ++ .offset = 0x04, ++ }, ++ [OCELOT_STAT_RX_FRAGMENTS] = { ++ .name = "rx_fragments", ++ .offset = 0x05, ++ }, ++ [OCELOT_STAT_RX_JABBERS] = { ++ .name = "rx_jabbers", ++ .offset = 0x06, ++ }, ++ [OCELOT_STAT_RX_CRC_ALIGN_ERRS] = { ++ .name = "rx_crc_align_errs", ++ .offset = 0x07, ++ }, ++ [OCELOT_STAT_RX_SYM_ERRS] = { ++ .name = "rx_sym_errs", ++ .offset = 0x08, ++ }, ++ [OCELOT_STAT_RX_64] = { ++ .name = "rx_frames_below_65_octets", ++ .offset = 0x09, ++ }, ++ [OCELOT_STAT_RX_65_127] = { ++ .name = "rx_frames_65_to_127_octets", ++ .offset = 0x0A, ++ }, ++ [OCELOT_STAT_RX_128_255] = { ++ .name = "rx_frames_128_to_255_octets", ++ .offset = 0x0B, ++ }, ++ [OCELOT_STAT_RX_256_511] = { ++ .name = "rx_frames_256_to_511_octets", ++ .offset = 0x0C, ++ }, ++ [OCELOT_STAT_RX_512_1023] = { ++ .name = "rx_frames_512_to_1023_octets", ++ .offset = 0x0D, ++ }, ++ [OCELOT_STAT_RX_1024_1526] = { ++ .name = "rx_frames_1024_to_1526_octets", ++ .offset = 0x0E, ++ }, ++ [OCELOT_STAT_RX_1527_MAX] = { ++ .name = "rx_frames_over_1526_octets", ++ .offset = 0x0F, ++ }, ++ [OCELOT_STAT_RX_PAUSE] = { ++ .name = "rx_pause", ++ .offset = 0x10, ++ }, ++ [OCELOT_STAT_RX_CONTROL] = { ++ .name = "rx_control", ++ .offset = 0x11, ++ }, ++ [OCELOT_STAT_RX_LONGS] = { ++ .name = "rx_longs", ++ .offset = 0x12, ++ }, ++ [OCELOT_STAT_RX_CLASSIFIED_DROPS] = { ++ .name = "rx_classified_drops", ++ .offset = 0x13, ++ }, ++ [OCELOT_STAT_RX_RED_PRIO_0] = { ++ .name = "rx_red_prio_0", ++ .offset = 0x14, ++ }, ++ [OCELOT_STAT_RX_RED_PRIO_1] = { ++ .name = "rx_red_prio_1", ++ .offset = 0x15, ++ }, ++ [OCELOT_STAT_RX_RED_PRIO_2] = { ++ .name = "rx_red_prio_2", ++ .offset = 0x16, ++ }, ++ [OCELOT_STAT_RX_RED_PRIO_3] = { ++ .name = "rx_red_prio_3", ++ .offset = 0x17, ++ }, ++ [OCELOT_STAT_RX_RED_PRIO_4] = { ++ .name = "rx_red_prio_4", ++ .offset = 0x18, ++ }, ++ [OCELOT_STAT_RX_RED_PRIO_5] = { ++ .name = "rx_red_prio_5", ++ .offset = 0x19, ++ }, ++ [OCELOT_STAT_RX_RED_PRIO_6] = { ++ .name = "rx_red_prio_6", ++ .offset = 0x1A, ++ }, ++ [OCELOT_STAT_RX_RED_PRIO_7] = { ++ .name = "rx_red_prio_7", ++ .offset = 0x1B, ++ }, ++ [OCELOT_STAT_RX_YELLOW_PRIO_0] = { ++ .name = "rx_yellow_prio_0", ++ .offset = 0x1C, ++ }, ++ [OCELOT_STAT_RX_YELLOW_PRIO_1] = { ++ .name = "rx_yellow_prio_1", ++ .offset = 0x1D, ++ }, ++ [OCELOT_STAT_RX_YELLOW_PRIO_2] = { ++ .name = "rx_yellow_prio_2", ++ .offset = 0x1E, ++ }, ++ [OCELOT_STAT_RX_YELLOW_PRIO_3] = { ++ .name = "rx_yellow_prio_3", ++ .offset = 0x1F, ++ }, ++ [OCELOT_STAT_RX_YELLOW_PRIO_4] = { ++ .name = "rx_yellow_prio_4", ++ .offset = 0x20, ++ }, ++ [OCELOT_STAT_RX_YELLOW_PRIO_5] = { ++ .name = "rx_yellow_prio_5", ++ .offset = 0x21, ++ }, ++ [OCELOT_STAT_RX_YELLOW_PRIO_6] = { ++ .name = "rx_yellow_prio_6", ++ .offset = 0x22, ++ }, ++ [OCELOT_STAT_RX_YELLOW_PRIO_7] = { ++ .name = "rx_yellow_prio_7", ++ .offset = 0x23, ++ }, ++ [OCELOT_STAT_RX_GREEN_PRIO_0] = { ++ .name = "rx_green_prio_0", ++ .offset = 0x24, ++ }, ++ [OCELOT_STAT_RX_GREEN_PRIO_1] = { ++ .name = "rx_green_prio_1", ++ .offset = 0x25, ++ }, ++ [OCELOT_STAT_RX_GREEN_PRIO_2] = { ++ .name = "rx_green_prio_2", ++ .offset = 0x26, ++ }, ++ [OCELOT_STAT_RX_GREEN_PRIO_3] = { ++ .name = "rx_green_prio_3", ++ .offset = 0x27, ++ }, ++ [OCELOT_STAT_RX_GREEN_PRIO_4] = { ++ .name = "rx_green_prio_4", ++ .offset = 0x28, ++ }, ++ [OCELOT_STAT_RX_GREEN_PRIO_5] = { ++ .name = "rx_green_prio_5", ++ .offset = 0x29, ++ }, ++ [OCELOT_STAT_RX_GREEN_PRIO_6] = { ++ .name = "rx_green_prio_6", ++ .offset = 0x2A, ++ }, ++ [OCELOT_STAT_RX_GREEN_PRIO_7] = { ++ .name = "rx_green_prio_7", ++ .offset = 0x2B, ++ }, ++ [OCELOT_STAT_TX_OCTETS] = { ++ .name = "tx_octets", ++ .offset = 0x80, ++ }, ++ [OCELOT_STAT_TX_UNICAST] = { ++ .name = "tx_unicast", ++ .offset = 0x81, ++ }, ++ [OCELOT_STAT_TX_MULTICAST] = { ++ .name = "tx_multicast", ++ .offset = 0x82, ++ }, ++ [OCELOT_STAT_TX_BROADCAST] = { ++ .name = "tx_broadcast", ++ .offset = 0x83, ++ }, ++ [OCELOT_STAT_TX_COLLISION] = { ++ .name = "tx_collision", ++ .offset = 0x84, ++ }, ++ [OCELOT_STAT_TX_DROPS] = { ++ .name = "tx_drops", ++ .offset = 0x85, ++ }, ++ [OCELOT_STAT_TX_PAUSE] = { ++ .name = "tx_pause", ++ .offset = 0x86, ++ }, ++ [OCELOT_STAT_TX_64] = { ++ .name = "tx_frames_below_65_octets", ++ .offset = 0x87, ++ }, ++ [OCELOT_STAT_TX_65_127] = { ++ .name = "tx_frames_65_to_127_octets", ++ .offset = 0x88, ++ }, ++ [OCELOT_STAT_TX_128_255] = { ++ .name = "tx_frames_128_255_octets", ++ .offset = 0x89, ++ }, ++ [OCELOT_STAT_TX_256_511] = { ++ .name = "tx_frames_256_511_octets", ++ .offset = 0x8A, ++ }, ++ [OCELOT_STAT_TX_512_1023] = { ++ .name = "tx_frames_512_1023_octets", ++ .offset = 0x8B, ++ }, ++ [OCELOT_STAT_TX_1024_1526] = { ++ .name = "tx_frames_1024_1526_octets", ++ .offset = 0x8C, ++ }, ++ [OCELOT_STAT_TX_1527_MAX] = { ++ .name = "tx_frames_over_1526_octets", ++ .offset = 0x8D, ++ }, ++ [OCELOT_STAT_TX_YELLOW_PRIO_0] = { ++ .name = "tx_yellow_prio_0", ++ .offset = 0x8E, ++ }, ++ [OCELOT_STAT_TX_YELLOW_PRIO_1] = { ++ .name = "tx_yellow_prio_1", ++ .offset = 0x8F, ++ }, ++ [OCELOT_STAT_TX_YELLOW_PRIO_2] = { ++ .name = "tx_yellow_prio_2", ++ .offset = 0x90, ++ }, ++ [OCELOT_STAT_TX_YELLOW_PRIO_3] = { ++ .name = "tx_yellow_prio_3", ++ .offset = 0x91, ++ }, ++ [OCELOT_STAT_TX_YELLOW_PRIO_4] = { ++ .name = "tx_yellow_prio_4", ++ .offset = 0x92, ++ }, ++ [OCELOT_STAT_TX_YELLOW_PRIO_5] = { ++ .name = "tx_yellow_prio_5", ++ .offset = 0x93, ++ }, ++ [OCELOT_STAT_TX_YELLOW_PRIO_6] = { ++ .name = "tx_yellow_prio_6", ++ .offset = 0x94, ++ }, ++ [OCELOT_STAT_TX_YELLOW_PRIO_7] = { ++ .name = "tx_yellow_prio_7", ++ .offset = 0x95, ++ }, ++ [OCELOT_STAT_TX_GREEN_PRIO_0] = { ++ .name = "tx_green_prio_0", ++ .offset = 0x96, ++ }, ++ [OCELOT_STAT_TX_GREEN_PRIO_1] = { ++ .name = "tx_green_prio_1", ++ .offset = 0x97, ++ }, ++ [OCELOT_STAT_TX_GREEN_PRIO_2] = { ++ .name = "tx_green_prio_2", ++ .offset = 0x98, ++ }, ++ [OCELOT_STAT_TX_GREEN_PRIO_3] = { ++ .name = "tx_green_prio_3", ++ .offset = 0x99, ++ }, ++ [OCELOT_STAT_TX_GREEN_PRIO_4] = { ++ .name = "tx_green_prio_4", ++ .offset = 0x9A, ++ }, ++ [OCELOT_STAT_TX_GREEN_PRIO_5] = { ++ .name = "tx_green_prio_5", ++ .offset = 0x9B, ++ }, ++ [OCELOT_STAT_TX_GREEN_PRIO_6] = { ++ .name = "tx_green_prio_6", ++ .offset = 0x9C, ++ }, ++ [OCELOT_STAT_TX_GREEN_PRIO_7] = { ++ .name = "tx_green_prio_7", ++ .offset = 0x9D, ++ }, ++ [OCELOT_STAT_TX_AGED] = { ++ .name = "tx_aged", ++ .offset = 0x9E, ++ }, ++ [OCELOT_STAT_DROP_LOCAL] = { ++ .name = "drop_local", ++ .offset = 0x100, ++ }, ++ [OCELOT_STAT_DROP_TAIL] = { ++ .name = "drop_tail", ++ .offset = 0x101, ++ }, ++ [OCELOT_STAT_DROP_YELLOW_PRIO_0] = { ++ .name = "drop_yellow_prio_0", ++ .offset = 0x102, ++ }, ++ [OCELOT_STAT_DROP_YELLOW_PRIO_1] = { ++ .name = "drop_yellow_prio_1", ++ .offset = 0x103, ++ }, ++ [OCELOT_STAT_DROP_YELLOW_PRIO_2] = { ++ .name = "drop_yellow_prio_2", ++ .offset = 0x104, ++ }, ++ [OCELOT_STAT_DROP_YELLOW_PRIO_3] = { ++ .name = "drop_yellow_prio_3", ++ .offset = 0x105, ++ }, ++ [OCELOT_STAT_DROP_YELLOW_PRIO_4] = { ++ .name = "drop_yellow_prio_4", ++ .offset = 0x106, ++ }, ++ [OCELOT_STAT_DROP_YELLOW_PRIO_5] = { ++ .name = "drop_yellow_prio_5", ++ .offset = 0x107, ++ }, ++ [OCELOT_STAT_DROP_YELLOW_PRIO_6] = { ++ .name = "drop_yellow_prio_6", ++ .offset = 0x108, ++ }, ++ [OCELOT_STAT_DROP_YELLOW_PRIO_7] = { ++ .name = "drop_yellow_prio_7", ++ .offset = 0x109, ++ }, ++ [OCELOT_STAT_DROP_GREEN_PRIO_0] = { ++ .name = "drop_green_prio_0", ++ .offset = 0x10A, ++ }, ++ [OCELOT_STAT_DROP_GREEN_PRIO_1] = { ++ .name = "drop_green_prio_1", ++ .offset = 0x10B, ++ }, ++ [OCELOT_STAT_DROP_GREEN_PRIO_2] = { ++ .name = "drop_green_prio_2", ++ .offset = 0x10C, ++ }, ++ [OCELOT_STAT_DROP_GREEN_PRIO_3] = { ++ .name = "drop_green_prio_3", ++ .offset = 0x10D, ++ }, ++ [OCELOT_STAT_DROP_GREEN_PRIO_4] = { ++ .name = "drop_green_prio_4", ++ .offset = 0x10E, ++ }, ++ [OCELOT_STAT_DROP_GREEN_PRIO_5] = { ++ .name = "drop_green_prio_5", ++ .offset = 0x10F, ++ }, ++ [OCELOT_STAT_DROP_GREEN_PRIO_6] = { ++ .name = "drop_green_prio_6", ++ .offset = 0x110, ++ }, ++ [OCELOT_STAT_DROP_GREEN_PRIO_7] = { ++ .name = "drop_green_prio_7", ++ .offset = 0x111, ++ }, + }; + + static const struct vcap_field vsc9959_vcap_es0_keys[] = { +diff --git a/drivers/net/dsa/ocelot/seville_vsc9953.c b/drivers/net/dsa/ocelot/seville_vsc9953.c +index ebe9ddbbe2b7..fe5d4642d0bc 100644 +--- a/drivers/net/dsa/ocelot/seville_vsc9953.c ++++ b/drivers/net/dsa/ocelot/seville_vsc9953.c +@@ -545,101 +545,379 @@ static const struct reg_field vsc9953_regfields[REGFIELD_MAX] = { + [SYS_PAUSE_CFG_PAUSE_ENA] = REG_FIELD_ID(SYS_PAUSE_CFG, 0, 1, 11, 4), + }; + +-static const struct ocelot_stat_layout vsc9953_stats_layout[] = { +- { .offset = 0x00, .name = "rx_octets", }, +- { .offset = 0x01, .name = "rx_unicast", }, +- { .offset = 0x02, .name = "rx_multicast", }, +- { .offset = 0x03, .name = "rx_broadcast", }, +- { .offset = 0x04, .name = "rx_shorts", }, +- { .offset = 0x05, .name = "rx_fragments", }, +- { .offset = 0x06, .name = "rx_jabbers", }, +- { .offset = 0x07, .name = "rx_crc_align_errs", }, +- { .offset = 0x08, .name = "rx_sym_errs", }, +- { .offset = 0x09, .name = "rx_frames_below_65_octets", }, +- { .offset = 0x0A, .name = "rx_frames_65_to_127_octets", }, +- { .offset = 0x0B, .name = "rx_frames_128_to_255_octets", }, +- { .offset = 0x0C, .name = "rx_frames_256_to_511_octets", }, +- { .offset = 0x0D, .name = "rx_frames_512_to_1023_octets", }, +- { .offset = 0x0E, .name = "rx_frames_1024_to_1526_octets", }, +- { .offset = 0x0F, .name = "rx_frames_over_1526_octets", }, +- { .offset = 0x10, .name = "rx_pause", }, +- { .offset = 0x11, .name = "rx_control", }, +- { .offset = 0x12, .name = "rx_longs", }, +- { .offset = 0x13, .name = "rx_classified_drops", }, +- { .offset = 0x14, .name = "rx_red_prio_0", }, +- { .offset = 0x15, .name = "rx_red_prio_1", }, +- { .offset = 0x16, .name = "rx_red_prio_2", }, +- { .offset = 0x17, .name = "rx_red_prio_3", }, +- { .offset = 0x18, .name = "rx_red_prio_4", }, +- { .offset = 0x19, .name = "rx_red_prio_5", }, +- { .offset = 0x1A, .name = "rx_red_prio_6", }, +- { .offset = 0x1B, .name = "rx_red_prio_7", }, +- { .offset = 0x1C, .name = "rx_yellow_prio_0", }, +- { .offset = 0x1D, .name = "rx_yellow_prio_1", }, +- { .offset = 0x1E, .name = "rx_yellow_prio_2", }, +- { .offset = 0x1F, .name = "rx_yellow_prio_3", }, +- { .offset = 0x20, .name = "rx_yellow_prio_4", }, +- { .offset = 0x21, .name = "rx_yellow_prio_5", }, +- { .offset = 0x22, .name = "rx_yellow_prio_6", }, +- { .offset = 0x23, .name = "rx_yellow_prio_7", }, +- { .offset = 0x24, .name = "rx_green_prio_0", }, +- { .offset = 0x25, .name = "rx_green_prio_1", }, +- { .offset = 0x26, .name = "rx_green_prio_2", }, +- { .offset = 0x27, .name = "rx_green_prio_3", }, +- { .offset = 0x28, .name = "rx_green_prio_4", }, +- { .offset = 0x29, .name = "rx_green_prio_5", }, +- { .offset = 0x2A, .name = "rx_green_prio_6", }, +- { .offset = 0x2B, .name = "rx_green_prio_7", }, +- { .offset = 0x40, .name = "tx_octets", }, +- { .offset = 0x41, .name = "tx_unicast", }, +- { .offset = 0x42, .name = "tx_multicast", }, +- { .offset = 0x43, .name = "tx_broadcast", }, +- { .offset = 0x44, .name = "tx_collision", }, +- { .offset = 0x45, .name = "tx_drops", }, +- { .offset = 0x46, .name = "tx_pause", }, +- { .offset = 0x47, .name = "tx_frames_below_65_octets", }, +- { .offset = 0x48, .name = "tx_frames_65_to_127_octets", }, +- { .offset = 0x49, .name = "tx_frames_128_255_octets", }, +- { .offset = 0x4A, .name = "tx_frames_256_511_octets", }, +- { .offset = 0x4B, .name = "tx_frames_512_1023_octets", }, +- { .offset = 0x4C, .name = "tx_frames_1024_1526_octets", }, +- { .offset = 0x4D, .name = "tx_frames_over_1526_octets", }, +- { .offset = 0x4E, .name = "tx_yellow_prio_0", }, +- { .offset = 0x4F, .name = "tx_yellow_prio_1", }, +- { .offset = 0x50, .name = "tx_yellow_prio_2", }, +- { .offset = 0x51, .name = "tx_yellow_prio_3", }, +- { .offset = 0x52, .name = "tx_yellow_prio_4", }, +- { .offset = 0x53, .name = "tx_yellow_prio_5", }, +- { .offset = 0x54, .name = "tx_yellow_prio_6", }, +- { .offset = 0x55, .name = "tx_yellow_prio_7", }, +- { .offset = 0x56, .name = "tx_green_prio_0", }, +- { .offset = 0x57, .name = "tx_green_prio_1", }, +- { .offset = 0x58, .name = "tx_green_prio_2", }, +- { .offset = 0x59, .name = "tx_green_prio_3", }, +- { .offset = 0x5A, .name = "tx_green_prio_4", }, +- { .offset = 0x5B, .name = "tx_green_prio_5", }, +- { .offset = 0x5C, .name = "tx_green_prio_6", }, +- { .offset = 0x5D, .name = "tx_green_prio_7", }, +- { .offset = 0x5E, .name = "tx_aged", }, +- { .offset = 0x80, .name = "drop_local", }, +- { .offset = 0x81, .name = "drop_tail", }, +- { .offset = 0x82, .name = "drop_yellow_prio_0", }, +- { .offset = 0x83, .name = "drop_yellow_prio_1", }, +- { .offset = 0x84, .name = "drop_yellow_prio_2", }, +- { .offset = 0x85, .name = "drop_yellow_prio_3", }, +- { .offset = 0x86, .name = "drop_yellow_prio_4", }, +- { .offset = 0x87, .name = "drop_yellow_prio_5", }, +- { .offset = 0x88, .name = "drop_yellow_prio_6", }, +- { .offset = 0x89, .name = "drop_yellow_prio_7", }, +- { .offset = 0x8A, .name = "drop_green_prio_0", }, +- { .offset = 0x8B, .name = "drop_green_prio_1", }, +- { .offset = 0x8C, .name = "drop_green_prio_2", }, +- { .offset = 0x8D, .name = "drop_green_prio_3", }, +- { .offset = 0x8E, .name = "drop_green_prio_4", }, +- { .offset = 0x8F, .name = "drop_green_prio_5", }, +- { .offset = 0x90, .name = "drop_green_prio_6", }, +- { .offset = 0x91, .name = "drop_green_prio_7", }, +- OCELOT_STAT_END ++static const struct ocelot_stat_layout vsc9953_stats_layout[OCELOT_NUM_STATS] = { ++ [OCELOT_STAT_RX_OCTETS] = { ++ .name = "rx_octets", ++ .offset = 0x00, ++ }, ++ [OCELOT_STAT_RX_UNICAST] = { ++ .name = "rx_unicast", ++ .offset = 0x01, ++ }, ++ [OCELOT_STAT_RX_MULTICAST] = { ++ .name = "rx_multicast", ++ .offset = 0x02, ++ }, ++ [OCELOT_STAT_RX_BROADCAST] = { ++ .name = "rx_broadcast", ++ .offset = 0x03, ++ }, ++ [OCELOT_STAT_RX_SHORTS] = { ++ .name = "rx_shorts", ++ .offset = 0x04, ++ }, ++ [OCELOT_STAT_RX_FRAGMENTS] = { ++ .name = "rx_fragments", ++ .offset = 0x05, ++ }, ++ [OCELOT_STAT_RX_JABBERS] = { ++ .name = "rx_jabbers", ++ .offset = 0x06, ++ }, ++ [OCELOT_STAT_RX_CRC_ALIGN_ERRS] = { ++ .name = "rx_crc_align_errs", ++ .offset = 0x07, ++ }, ++ [OCELOT_STAT_RX_SYM_ERRS] = { ++ .name = "rx_sym_errs", ++ .offset = 0x08, ++ }, ++ [OCELOT_STAT_RX_64] = { ++ .name = "rx_frames_below_65_octets", ++ .offset = 0x09, ++ }, ++ [OCELOT_STAT_RX_65_127] = { ++ .name = "rx_frames_65_to_127_octets", ++ .offset = 0x0A, ++ }, ++ [OCELOT_STAT_RX_128_255] = { ++ .name = "rx_frames_128_to_255_octets", ++ .offset = 0x0B, ++ }, ++ [OCELOT_STAT_RX_256_511] = { ++ .name = "rx_frames_256_to_511_octets", ++ .offset = 0x0C, ++ }, ++ [OCELOT_STAT_RX_512_1023] = { ++ .name = "rx_frames_512_to_1023_octets", ++ .offset = 0x0D, ++ }, ++ [OCELOT_STAT_RX_1024_1526] = { ++ .name = "rx_frames_1024_to_1526_octets", ++ .offset = 0x0E, ++ }, ++ [OCELOT_STAT_RX_1527_MAX] = { ++ .name = "rx_frames_over_1526_octets", ++ .offset = 0x0F, ++ }, ++ [OCELOT_STAT_RX_PAUSE] = { ++ .name = "rx_pause", ++ .offset = 0x10, ++ }, ++ [OCELOT_STAT_RX_CONTROL] = { ++ .name = "rx_control", ++ .offset = 0x11, ++ }, ++ [OCELOT_STAT_RX_LONGS] = { ++ .name = "rx_longs", ++ .offset = 0x12, ++ }, ++ [OCELOT_STAT_RX_CLASSIFIED_DROPS] = { ++ .name = "rx_classified_drops", ++ .offset = 0x13, ++ }, ++ [OCELOT_STAT_RX_RED_PRIO_0] = { ++ .name = "rx_red_prio_0", ++ .offset = 0x14, ++ }, ++ [OCELOT_STAT_RX_RED_PRIO_1] = { ++ .name = "rx_red_prio_1", ++ .offset = 0x15, ++ }, ++ [OCELOT_STAT_RX_RED_PRIO_2] = { ++ .name = "rx_red_prio_2", ++ .offset = 0x16, ++ }, ++ [OCELOT_STAT_RX_RED_PRIO_3] = { ++ .name = "rx_red_prio_3", ++ .offset = 0x17, ++ }, ++ [OCELOT_STAT_RX_RED_PRIO_4] = { ++ .name = "rx_red_prio_4", ++ .offset = 0x18, ++ }, ++ [OCELOT_STAT_RX_RED_PRIO_5] = { ++ .name = "rx_red_prio_5", ++ .offset = 0x19, ++ }, ++ [OCELOT_STAT_RX_RED_PRIO_6] = { ++ .name = "rx_red_prio_6", ++ .offset = 0x1A, ++ }, ++ [OCELOT_STAT_RX_RED_PRIO_7] = { ++ .name = "rx_red_prio_7", ++ .offset = 0x1B, ++ }, ++ [OCELOT_STAT_RX_YELLOW_PRIO_0] = { ++ .name = "rx_yellow_prio_0", ++ .offset = 0x1C, ++ }, ++ [OCELOT_STAT_RX_YELLOW_PRIO_1] = { ++ .name = "rx_yellow_prio_1", ++ .offset = 0x1D, ++ }, ++ [OCELOT_STAT_RX_YELLOW_PRIO_2] = { ++ .name = "rx_yellow_prio_2", ++ .offset = 0x1E, ++ }, ++ [OCELOT_STAT_RX_YELLOW_PRIO_3] = { ++ .name = "rx_yellow_prio_3", ++ .offset = 0x1F, ++ }, ++ [OCELOT_STAT_RX_YELLOW_PRIO_4] = { ++ .name = "rx_yellow_prio_4", ++ .offset = 0x20, ++ }, ++ [OCELOT_STAT_RX_YELLOW_PRIO_5] = { ++ .name = "rx_yellow_prio_5", ++ .offset = 0x21, ++ }, ++ [OCELOT_STAT_RX_YELLOW_PRIO_6] = { ++ .name = "rx_yellow_prio_6", ++ .offset = 0x22, ++ }, ++ [OCELOT_STAT_RX_YELLOW_PRIO_7] = { ++ .name = "rx_yellow_prio_7", ++ .offset = 0x23, ++ }, ++ [OCELOT_STAT_RX_GREEN_PRIO_0] = { ++ .name = "rx_green_prio_0", ++ .offset = 0x24, ++ }, ++ [OCELOT_STAT_RX_GREEN_PRIO_1] = { ++ .name = "rx_green_prio_1", ++ .offset = 0x25, ++ }, ++ [OCELOT_STAT_RX_GREEN_PRIO_2] = { ++ .name = "rx_green_prio_2", ++ .offset = 0x26, ++ }, ++ [OCELOT_STAT_RX_GREEN_PRIO_3] = { ++ .name = "rx_green_prio_3", ++ .offset = 0x27, ++ }, ++ [OCELOT_STAT_RX_GREEN_PRIO_4] = { ++ .name = "rx_green_prio_4", ++ .offset = 0x28, ++ }, ++ [OCELOT_STAT_RX_GREEN_PRIO_5] = { ++ .name = "rx_green_prio_5", ++ .offset = 0x29, ++ }, ++ [OCELOT_STAT_RX_GREEN_PRIO_6] = { ++ .name = "rx_green_prio_6", ++ .offset = 0x2A, ++ }, ++ [OCELOT_STAT_RX_GREEN_PRIO_7] = { ++ .name = "rx_green_prio_7", ++ .offset = 0x2B, ++ }, ++ [OCELOT_STAT_TX_OCTETS] = { ++ .name = "tx_octets", ++ .offset = 0x40, ++ }, ++ [OCELOT_STAT_TX_UNICAST] = { ++ .name = "tx_unicast", ++ .offset = 0x41, ++ }, ++ [OCELOT_STAT_TX_MULTICAST] = { ++ .name = "tx_multicast", ++ .offset = 0x42, ++ }, ++ [OCELOT_STAT_TX_BROADCAST] = { ++ .name = "tx_broadcast", ++ .offset = 0x43, ++ }, ++ [OCELOT_STAT_TX_COLLISION] = { ++ .name = "tx_collision", ++ .offset = 0x44, ++ }, ++ [OCELOT_STAT_TX_DROPS] = { ++ .name = "tx_drops", ++ .offset = 0x45, ++ }, ++ [OCELOT_STAT_TX_PAUSE] = { ++ .name = "tx_pause", ++ .offset = 0x46, ++ }, ++ [OCELOT_STAT_TX_64] = { ++ .name = "tx_frames_below_65_octets", ++ .offset = 0x47, ++ }, ++ [OCELOT_STAT_TX_65_127] = { ++ .name = "tx_frames_65_to_127_octets", ++ .offset = 0x48, ++ }, ++ [OCELOT_STAT_TX_128_255] = { ++ .name = "tx_frames_128_255_octets", ++ .offset = 0x49, ++ }, ++ [OCELOT_STAT_TX_256_511] = { ++ .name = "tx_frames_256_511_octets", ++ .offset = 0x4A, ++ }, ++ [OCELOT_STAT_TX_512_1023] = { ++ .name = "tx_frames_512_1023_octets", ++ .offset = 0x4B, ++ }, ++ [OCELOT_STAT_TX_1024_1526] = { ++ .name = "tx_frames_1024_1526_octets", ++ .offset = 0x4C, ++ }, ++ [OCELOT_STAT_TX_1527_MAX] = { ++ .name = "tx_frames_over_1526_octets", ++ .offset = 0x4D, ++ }, ++ [OCELOT_STAT_TX_YELLOW_PRIO_0] = { ++ .name = "tx_yellow_prio_0", ++ .offset = 0x4E, ++ }, ++ [OCELOT_STAT_TX_YELLOW_PRIO_1] = { ++ .name = "tx_yellow_prio_1", ++ .offset = 0x4F, ++ }, ++ [OCELOT_STAT_TX_YELLOW_PRIO_2] = { ++ .name = "tx_yellow_prio_2", ++ .offset = 0x50, ++ }, ++ [OCELOT_STAT_TX_YELLOW_PRIO_3] = { ++ .name = "tx_yellow_prio_3", ++ .offset = 0x51, ++ }, ++ [OCELOT_STAT_TX_YELLOW_PRIO_4] = { ++ .name = "tx_yellow_prio_4", ++ .offset = 0x52, ++ }, ++ [OCELOT_STAT_TX_YELLOW_PRIO_5] = { ++ .name = "tx_yellow_prio_5", ++ .offset = 0x53, ++ }, ++ [OCELOT_STAT_TX_YELLOW_PRIO_6] = { ++ .name = "tx_yellow_prio_6", ++ .offset = 0x54, ++ }, ++ [OCELOT_STAT_TX_YELLOW_PRIO_7] = { ++ .name = "tx_yellow_prio_7", ++ .offset = 0x55, ++ }, ++ [OCELOT_STAT_TX_GREEN_PRIO_0] = { ++ .name = "tx_green_prio_0", ++ .offset = 0x56, ++ }, ++ [OCELOT_STAT_TX_GREEN_PRIO_1] = { ++ .name = "tx_green_prio_1", ++ .offset = 0x57, ++ }, ++ [OCELOT_STAT_TX_GREEN_PRIO_2] = { ++ .name = "tx_green_prio_2", ++ .offset = 0x58, ++ }, ++ [OCELOT_STAT_TX_GREEN_PRIO_3] = { ++ .name = "tx_green_prio_3", ++ .offset = 0x59, ++ }, ++ [OCELOT_STAT_TX_GREEN_PRIO_4] = { ++ .name = "tx_green_prio_4", ++ .offset = 0x5A, ++ }, ++ [OCELOT_STAT_TX_GREEN_PRIO_5] = { ++ .name = "tx_green_prio_5", ++ .offset = 0x5B, ++ }, ++ [OCELOT_STAT_TX_GREEN_PRIO_6] = { ++ .name = "tx_green_prio_6", ++ .offset = 0x5C, ++ }, ++ [OCELOT_STAT_TX_GREEN_PRIO_7] = { ++ .name = "tx_green_prio_7", ++ .offset = 0x5D, ++ }, ++ [OCELOT_STAT_TX_AGED] = { ++ .name = "tx_aged", ++ .offset = 0x5E, ++ }, ++ [OCELOT_STAT_DROP_LOCAL] = { ++ .name = "drop_local", ++ .offset = 0x80, ++ }, ++ [OCELOT_STAT_DROP_TAIL] = { ++ .name = "drop_tail", ++ .offset = 0x81, ++ }, ++ [OCELOT_STAT_DROP_YELLOW_PRIO_0] = { ++ .name = "drop_yellow_prio_0", ++ .offset = 0x82, ++ }, ++ [OCELOT_STAT_DROP_YELLOW_PRIO_1] = { ++ .name = "drop_yellow_prio_1", ++ .offset = 0x83, ++ }, ++ [OCELOT_STAT_DROP_YELLOW_PRIO_2] = { ++ .name = "drop_yellow_prio_2", ++ .offset = 0x84, ++ }, ++ [OCELOT_STAT_DROP_YELLOW_PRIO_3] = { ++ .name = "drop_yellow_prio_3", ++ .offset = 0x85, ++ }, ++ [OCELOT_STAT_DROP_YELLOW_PRIO_4] = { ++ .name = "drop_yellow_prio_4", ++ .offset = 0x86, ++ }, ++ [OCELOT_STAT_DROP_YELLOW_PRIO_5] = { ++ .name = "drop_yellow_prio_5", ++ .offset = 0x87, ++ }, ++ [OCELOT_STAT_DROP_YELLOW_PRIO_6] = { ++ .name = "drop_yellow_prio_6", ++ .offset = 0x88, ++ }, ++ [OCELOT_STAT_DROP_YELLOW_PRIO_7] = { ++ .name = "drop_yellow_prio_7", ++ .offset = 0x89, ++ }, ++ [OCELOT_STAT_DROP_GREEN_PRIO_0] = { ++ .name = "drop_green_prio_0", ++ .offset = 0x8A, ++ }, ++ [OCELOT_STAT_DROP_GREEN_PRIO_1] = { ++ .name = "drop_green_prio_1", ++ .offset = 0x8B, ++ }, ++ [OCELOT_STAT_DROP_GREEN_PRIO_2] = { ++ .name = "drop_green_prio_2", ++ .offset = 0x8C, ++ }, ++ [OCELOT_STAT_DROP_GREEN_PRIO_3] = { ++ .name = "drop_green_prio_3", ++ .offset = 0x8D, ++ }, ++ [OCELOT_STAT_DROP_GREEN_PRIO_4] = { ++ .name = "drop_green_prio_4", ++ .offset = 0x8E, ++ }, ++ [OCELOT_STAT_DROP_GREEN_PRIO_5] = { ++ .name = "drop_green_prio_5", ++ .offset = 0x8F, ++ }, ++ [OCELOT_STAT_DROP_GREEN_PRIO_6] = { ++ .name = "drop_green_prio_6", ++ .offset = 0x90, ++ }, ++ [OCELOT_STAT_DROP_GREEN_PRIO_7] = { ++ .name = "drop_green_prio_7", ++ .offset = 0x91, ++ }, + }; + + static const struct vcap_field vsc9953_vcap_es0_keys[] = { +diff --git a/drivers/net/ethernet/mscc/ocelot.c b/drivers/net/ethernet/mscc/ocelot.c +index c67f162f8ab5..68991b021c56 100644 +--- a/drivers/net/ethernet/mscc/ocelot.c ++++ b/drivers/net/ethernet/mscc/ocelot.c +@@ -1860,16 +1860,20 @@ void ocelot_get_strings(struct ocelot *ocelot, int port, u32 sset, u8 *data) + if (sset != ETH_SS_STATS) + return; + +- for (i = 0; i < ocelot->num_stats; i++) ++ for (i = 0; i < OCELOT_NUM_STATS; i++) { ++ if (ocelot->stats_layout[i].name[0] == '\0') ++ continue; ++ + memcpy(data + i * ETH_GSTRING_LEN, ocelot->stats_layout[i].name, + ETH_GSTRING_LEN); ++ } + } + EXPORT_SYMBOL(ocelot_get_strings); + + /* Caller must hold &ocelot->stats_lock */ + static int ocelot_port_update_stats(struct ocelot *ocelot, int port) + { +- unsigned int idx = port * ocelot->num_stats; ++ unsigned int idx = port * OCELOT_NUM_STATS; + struct ocelot_stats_region *region; + int err, j; + +@@ -1930,9 +1934,15 @@ void ocelot_get_ethtool_stats(struct ocelot *ocelot, int port, u64 *data) + /* check and update now */ + err = ocelot_port_update_stats(ocelot, port); + +- /* Copy all counters */ +- for (i = 0; i < ocelot->num_stats; i++) +- *data++ = ocelot->stats[port * ocelot->num_stats + i]; ++ /* Copy all supported counters */ ++ for (i = 0; i < OCELOT_NUM_STATS; i++) { ++ int index = port * OCELOT_NUM_STATS + i; ++ ++ if (ocelot->stats_layout[i].name[0] == '\0') ++ continue; ++ ++ *data++ = ocelot->stats[index]; ++ } + + spin_unlock(&ocelot->stats_lock); + +@@ -1943,10 +1953,16 @@ EXPORT_SYMBOL(ocelot_get_ethtool_stats); + + int ocelot_get_sset_count(struct ocelot *ocelot, int port, int sset) + { ++ int i, num_stats = 0; ++ + if (sset != ETH_SS_STATS) + return -EOPNOTSUPP; + +- return ocelot->num_stats; ++ for (i = 0; i < OCELOT_NUM_STATS; i++) ++ if (ocelot->stats_layout[i].name[0] != '\0') ++ num_stats++; ++ ++ return num_stats; + } + EXPORT_SYMBOL(ocelot_get_sset_count); + +@@ -1958,7 +1974,10 @@ static int ocelot_prepare_stats_regions(struct ocelot *ocelot) + + INIT_LIST_HEAD(&ocelot->stats_regions); + +- for (i = 0; i < ocelot->num_stats; i++) { ++ for (i = 0; i < OCELOT_NUM_STATS; i++) { ++ if (ocelot->stats_layout[i].name[0] == '\0') ++ continue; ++ + if (region && ocelot->stats_layout[i].offset == last + 1) { + region->count++; + } else { +@@ -3340,7 +3359,6 @@ static void ocelot_detect_features(struct ocelot *ocelot) + + int ocelot_init(struct ocelot *ocelot) + { +- const struct ocelot_stat_layout *stat; + char queue_name[32]; + int i, ret; + u32 port; +@@ -3353,12 +3371,8 @@ int ocelot_init(struct ocelot *ocelot) + } + } + +- ocelot->num_stats = 0; +- for_each_stat(ocelot, stat) +- ocelot->num_stats++; +- + ocelot->stats = devm_kcalloc(ocelot->dev, +- ocelot->num_phys_ports * ocelot->num_stats, ++ ocelot->num_phys_ports * OCELOT_NUM_STATS, + sizeof(u64), GFP_KERNEL); + if (!ocelot->stats) + return -ENOMEM; +diff --git a/drivers/net/ethernet/mscc/ocelot_vsc7514.c b/drivers/net/ethernet/mscc/ocelot_vsc7514.c +index 961f803aca19..9ff910560043 100644 +--- a/drivers/net/ethernet/mscc/ocelot_vsc7514.c ++++ b/drivers/net/ethernet/mscc/ocelot_vsc7514.c +@@ -96,101 +96,379 @@ static const struct reg_field ocelot_regfields[REGFIELD_MAX] = { + [SYS_PAUSE_CFG_PAUSE_ENA] = REG_FIELD_ID(SYS_PAUSE_CFG, 0, 1, 12, 4), + }; + +-static const struct ocelot_stat_layout ocelot_stats_layout[] = { +- { .name = "rx_octets", .offset = 0x00, }, +- { .name = "rx_unicast", .offset = 0x01, }, +- { .name = "rx_multicast", .offset = 0x02, }, +- { .name = "rx_broadcast", .offset = 0x03, }, +- { .name = "rx_shorts", .offset = 0x04, }, +- { .name = "rx_fragments", .offset = 0x05, }, +- { .name = "rx_jabbers", .offset = 0x06, }, +- { .name = "rx_crc_align_errs", .offset = 0x07, }, +- { .name = "rx_sym_errs", .offset = 0x08, }, +- { .name = "rx_frames_below_65_octets", .offset = 0x09, }, +- { .name = "rx_frames_65_to_127_octets", .offset = 0x0A, }, +- { .name = "rx_frames_128_to_255_octets", .offset = 0x0B, }, +- { .name = "rx_frames_256_to_511_octets", .offset = 0x0C, }, +- { .name = "rx_frames_512_to_1023_octets", .offset = 0x0D, }, +- { .name = "rx_frames_1024_to_1526_octets", .offset = 0x0E, }, +- { .name = "rx_frames_over_1526_octets", .offset = 0x0F, }, +- { .name = "rx_pause", .offset = 0x10, }, +- { .name = "rx_control", .offset = 0x11, }, +- { .name = "rx_longs", .offset = 0x12, }, +- { .name = "rx_classified_drops", .offset = 0x13, }, +- { .name = "rx_red_prio_0", .offset = 0x14, }, +- { .name = "rx_red_prio_1", .offset = 0x15, }, +- { .name = "rx_red_prio_2", .offset = 0x16, }, +- { .name = "rx_red_prio_3", .offset = 0x17, }, +- { .name = "rx_red_prio_4", .offset = 0x18, }, +- { .name = "rx_red_prio_5", .offset = 0x19, }, +- { .name = "rx_red_prio_6", .offset = 0x1A, }, +- { .name = "rx_red_prio_7", .offset = 0x1B, }, +- { .name = "rx_yellow_prio_0", .offset = 0x1C, }, +- { .name = "rx_yellow_prio_1", .offset = 0x1D, }, +- { .name = "rx_yellow_prio_2", .offset = 0x1E, }, +- { .name = "rx_yellow_prio_3", .offset = 0x1F, }, +- { .name = "rx_yellow_prio_4", .offset = 0x20, }, +- { .name = "rx_yellow_prio_5", .offset = 0x21, }, +- { .name = "rx_yellow_prio_6", .offset = 0x22, }, +- { .name = "rx_yellow_prio_7", .offset = 0x23, }, +- { .name = "rx_green_prio_0", .offset = 0x24, }, +- { .name = "rx_green_prio_1", .offset = 0x25, }, +- { .name = "rx_green_prio_2", .offset = 0x26, }, +- { .name = "rx_green_prio_3", .offset = 0x27, }, +- { .name = "rx_green_prio_4", .offset = 0x28, }, +- { .name = "rx_green_prio_5", .offset = 0x29, }, +- { .name = "rx_green_prio_6", .offset = 0x2A, }, +- { .name = "rx_green_prio_7", .offset = 0x2B, }, +- { .name = "tx_octets", .offset = 0x40, }, +- { .name = "tx_unicast", .offset = 0x41, }, +- { .name = "tx_multicast", .offset = 0x42, }, +- { .name = "tx_broadcast", .offset = 0x43, }, +- { .name = "tx_collision", .offset = 0x44, }, +- { .name = "tx_drops", .offset = 0x45, }, +- { .name = "tx_pause", .offset = 0x46, }, +- { .name = "tx_frames_below_65_octets", .offset = 0x47, }, +- { .name = "tx_frames_65_to_127_octets", .offset = 0x48, }, +- { .name = "tx_frames_128_255_octets", .offset = 0x49, }, +- { .name = "tx_frames_256_511_octets", .offset = 0x4A, }, +- { .name = "tx_frames_512_1023_octets", .offset = 0x4B, }, +- { .name = "tx_frames_1024_1526_octets", .offset = 0x4C, }, +- { .name = "tx_frames_over_1526_octets", .offset = 0x4D, }, +- { .name = "tx_yellow_prio_0", .offset = 0x4E, }, +- { .name = "tx_yellow_prio_1", .offset = 0x4F, }, +- { .name = "tx_yellow_prio_2", .offset = 0x50, }, +- { .name = "tx_yellow_prio_3", .offset = 0x51, }, +- { .name = "tx_yellow_prio_4", .offset = 0x52, }, +- { .name = "tx_yellow_prio_5", .offset = 0x53, }, +- { .name = "tx_yellow_prio_6", .offset = 0x54, }, +- { .name = "tx_yellow_prio_7", .offset = 0x55, }, +- { .name = "tx_green_prio_0", .offset = 0x56, }, +- { .name = "tx_green_prio_1", .offset = 0x57, }, +- { .name = "tx_green_prio_2", .offset = 0x58, }, +- { .name = "tx_green_prio_3", .offset = 0x59, }, +- { .name = "tx_green_prio_4", .offset = 0x5A, }, +- { .name = "tx_green_prio_5", .offset = 0x5B, }, +- { .name = "tx_green_prio_6", .offset = 0x5C, }, +- { .name = "tx_green_prio_7", .offset = 0x5D, }, +- { .name = "tx_aged", .offset = 0x5E, }, +- { .name = "drop_local", .offset = 0x80, }, +- { .name = "drop_tail", .offset = 0x81, }, +- { .name = "drop_yellow_prio_0", .offset = 0x82, }, +- { .name = "drop_yellow_prio_1", .offset = 0x83, }, +- { .name = "drop_yellow_prio_2", .offset = 0x84, }, +- { .name = "drop_yellow_prio_3", .offset = 0x85, }, +- { .name = "drop_yellow_prio_4", .offset = 0x86, }, +- { .name = "drop_yellow_prio_5", .offset = 0x87, }, +- { .name = "drop_yellow_prio_6", .offset = 0x88, }, +- { .name = "drop_yellow_prio_7", .offset = 0x89, }, +- { .name = "drop_green_prio_0", .offset = 0x8A, }, +- { .name = "drop_green_prio_1", .offset = 0x8B, }, +- { .name = "drop_green_prio_2", .offset = 0x8C, }, +- { .name = "drop_green_prio_3", .offset = 0x8D, }, +- { .name = "drop_green_prio_4", .offset = 0x8E, }, +- { .name = "drop_green_prio_5", .offset = 0x8F, }, +- { .name = "drop_green_prio_6", .offset = 0x90, }, +- { .name = "drop_green_prio_7", .offset = 0x91, }, +- OCELOT_STAT_END ++static const struct ocelot_stat_layout ocelot_stats_layout[OCELOT_NUM_STATS] = { ++ [OCELOT_STAT_RX_OCTETS] = { ++ .name = "rx_octets", ++ .offset = 0x00, ++ }, ++ [OCELOT_STAT_RX_UNICAST] = { ++ .name = "rx_unicast", ++ .offset = 0x01, ++ }, ++ [OCELOT_STAT_RX_MULTICAST] = { ++ .name = "rx_multicast", ++ .offset = 0x02, ++ }, ++ [OCELOT_STAT_RX_BROADCAST] = { ++ .name = "rx_broadcast", ++ .offset = 0x03, ++ }, ++ [OCELOT_STAT_RX_SHORTS] = { ++ .name = "rx_shorts", ++ .offset = 0x04, ++ }, ++ [OCELOT_STAT_RX_FRAGMENTS] = { ++ .name = "rx_fragments", ++ .offset = 0x05, ++ }, ++ [OCELOT_STAT_RX_JABBERS] = { ++ .name = "rx_jabbers", ++ .offset = 0x06, ++ }, ++ [OCELOT_STAT_RX_CRC_ALIGN_ERRS] = { ++ .name = "rx_crc_align_errs", ++ .offset = 0x07, ++ }, ++ [OCELOT_STAT_RX_SYM_ERRS] = { ++ .name = "rx_sym_errs", ++ .offset = 0x08, ++ }, ++ [OCELOT_STAT_RX_64] = { ++ .name = "rx_frames_below_65_octets", ++ .offset = 0x09, ++ }, ++ [OCELOT_STAT_RX_65_127] = { ++ .name = "rx_frames_65_to_127_octets", ++ .offset = 0x0A, ++ }, ++ [OCELOT_STAT_RX_128_255] = { ++ .name = "rx_frames_128_to_255_octets", ++ .offset = 0x0B, ++ }, ++ [OCELOT_STAT_RX_256_511] = { ++ .name = "rx_frames_256_to_511_octets", ++ .offset = 0x0C, ++ }, ++ [OCELOT_STAT_RX_512_1023] = { ++ .name = "rx_frames_512_to_1023_octets", ++ .offset = 0x0D, ++ }, ++ [OCELOT_STAT_RX_1024_1526] = { ++ .name = "rx_frames_1024_to_1526_octets", ++ .offset = 0x0E, ++ }, ++ [OCELOT_STAT_RX_1527_MAX] = { ++ .name = "rx_frames_over_1526_octets", ++ .offset = 0x0F, ++ }, ++ [OCELOT_STAT_RX_PAUSE] = { ++ .name = "rx_pause", ++ .offset = 0x10, ++ }, ++ [OCELOT_STAT_RX_CONTROL] = { ++ .name = "rx_control", ++ .offset = 0x11, ++ }, ++ [OCELOT_STAT_RX_LONGS] = { ++ .name = "rx_longs", ++ .offset = 0x12, ++ }, ++ [OCELOT_STAT_RX_CLASSIFIED_DROPS] = { ++ .name = "rx_classified_drops", ++ .offset = 0x13, ++ }, ++ [OCELOT_STAT_RX_RED_PRIO_0] = { ++ .name = "rx_red_prio_0", ++ .offset = 0x14, ++ }, ++ [OCELOT_STAT_RX_RED_PRIO_1] = { ++ .name = "rx_red_prio_1", ++ .offset = 0x15, ++ }, ++ [OCELOT_STAT_RX_RED_PRIO_2] = { ++ .name = "rx_red_prio_2", ++ .offset = 0x16, ++ }, ++ [OCELOT_STAT_RX_RED_PRIO_3] = { ++ .name = "rx_red_prio_3", ++ .offset = 0x17, ++ }, ++ [OCELOT_STAT_RX_RED_PRIO_4] = { ++ .name = "rx_red_prio_4", ++ .offset = 0x18, ++ }, ++ [OCELOT_STAT_RX_RED_PRIO_5] = { ++ .name = "rx_red_prio_5", ++ .offset = 0x19, ++ }, ++ [OCELOT_STAT_RX_RED_PRIO_6] = { ++ .name = "rx_red_prio_6", ++ .offset = 0x1A, ++ }, ++ [OCELOT_STAT_RX_RED_PRIO_7] = { ++ .name = "rx_red_prio_7", ++ .offset = 0x1B, ++ }, ++ [OCELOT_STAT_RX_YELLOW_PRIO_0] = { ++ .name = "rx_yellow_prio_0", ++ .offset = 0x1C, ++ }, ++ [OCELOT_STAT_RX_YELLOW_PRIO_1] = { ++ .name = "rx_yellow_prio_1", ++ .offset = 0x1D, ++ }, ++ [OCELOT_STAT_RX_YELLOW_PRIO_2] = { ++ .name = "rx_yellow_prio_2", ++ .offset = 0x1E, ++ }, ++ [OCELOT_STAT_RX_YELLOW_PRIO_3] = { ++ .name = "rx_yellow_prio_3", ++ .offset = 0x1F, ++ }, ++ [OCELOT_STAT_RX_YELLOW_PRIO_4] = { ++ .name = "rx_yellow_prio_4", ++ .offset = 0x20, ++ }, ++ [OCELOT_STAT_RX_YELLOW_PRIO_5] = { ++ .name = "rx_yellow_prio_5", ++ .offset = 0x21, ++ }, ++ [OCELOT_STAT_RX_YELLOW_PRIO_6] = { ++ .name = "rx_yellow_prio_6", ++ .offset = 0x22, ++ }, ++ [OCELOT_STAT_RX_YELLOW_PRIO_7] = { ++ .name = "rx_yellow_prio_7", ++ .offset = 0x23, ++ }, ++ [OCELOT_STAT_RX_GREEN_PRIO_0] = { ++ .name = "rx_green_prio_0", ++ .offset = 0x24, ++ }, ++ [OCELOT_STAT_RX_GREEN_PRIO_1] = { ++ .name = "rx_green_prio_1", ++ .offset = 0x25, ++ }, ++ [OCELOT_STAT_RX_GREEN_PRIO_2] = { ++ .name = "rx_green_prio_2", ++ .offset = 0x26, ++ }, ++ [OCELOT_STAT_RX_GREEN_PRIO_3] = { ++ .name = "rx_green_prio_3", ++ .offset = 0x27, ++ }, ++ [OCELOT_STAT_RX_GREEN_PRIO_4] = { ++ .name = "rx_green_prio_4", ++ .offset = 0x28, ++ }, ++ [OCELOT_STAT_RX_GREEN_PRIO_5] = { ++ .name = "rx_green_prio_5", ++ .offset = 0x29, ++ }, ++ [OCELOT_STAT_RX_GREEN_PRIO_6] = { ++ .name = "rx_green_prio_6", ++ .offset = 0x2A, ++ }, ++ [OCELOT_STAT_RX_GREEN_PRIO_7] = { ++ .name = "rx_green_prio_7", ++ .offset = 0x2B, ++ }, ++ [OCELOT_STAT_TX_OCTETS] = { ++ .name = "tx_octets", ++ .offset = 0x40, ++ }, ++ [OCELOT_STAT_TX_UNICAST] = { ++ .name = "tx_unicast", ++ .offset = 0x41, ++ }, ++ [OCELOT_STAT_TX_MULTICAST] = { ++ .name = "tx_multicast", ++ .offset = 0x42, ++ }, ++ [OCELOT_STAT_TX_BROADCAST] = { ++ .name = "tx_broadcast", ++ .offset = 0x43, ++ }, ++ [OCELOT_STAT_TX_COLLISION] = { ++ .name = "tx_collision", ++ .offset = 0x44, ++ }, ++ [OCELOT_STAT_TX_DROPS] = { ++ .name = "tx_drops", ++ .offset = 0x45, ++ }, ++ [OCELOT_STAT_TX_PAUSE] = { ++ .name = "tx_pause", ++ .offset = 0x46, ++ }, ++ [OCELOT_STAT_TX_64] = { ++ .name = "tx_frames_below_65_octets", ++ .offset = 0x47, ++ }, ++ [OCELOT_STAT_TX_65_127] = { ++ .name = "tx_frames_65_to_127_octets", ++ .offset = 0x48, ++ }, ++ [OCELOT_STAT_TX_128_255] = { ++ .name = "tx_frames_128_255_octets", ++ .offset = 0x49, ++ }, ++ [OCELOT_STAT_TX_256_511] = { ++ .name = "tx_frames_256_511_octets", ++ .offset = 0x4A, ++ }, ++ [OCELOT_STAT_TX_512_1023] = { ++ .name = "tx_frames_512_1023_octets", ++ .offset = 0x4B, ++ }, ++ [OCELOT_STAT_TX_1024_1526] = { ++ .name = "tx_frames_1024_1526_octets", ++ .offset = 0x4C, ++ }, ++ [OCELOT_STAT_TX_1527_MAX] = { ++ .name = "tx_frames_over_1526_octets", ++ .offset = 0x4D, ++ }, ++ [OCELOT_STAT_TX_YELLOW_PRIO_0] = { ++ .name = "tx_yellow_prio_0", ++ .offset = 0x4E, ++ }, ++ [OCELOT_STAT_TX_YELLOW_PRIO_1] = { ++ .name = "tx_yellow_prio_1", ++ .offset = 0x4F, ++ }, ++ [OCELOT_STAT_TX_YELLOW_PRIO_2] = { ++ .name = "tx_yellow_prio_2", ++ .offset = 0x50, ++ }, ++ [OCELOT_STAT_TX_YELLOW_PRIO_3] = { ++ .name = "tx_yellow_prio_3", ++ .offset = 0x51, ++ }, ++ [OCELOT_STAT_TX_YELLOW_PRIO_4] = { ++ .name = "tx_yellow_prio_4", ++ .offset = 0x52, ++ }, ++ [OCELOT_STAT_TX_YELLOW_PRIO_5] = { ++ .name = "tx_yellow_prio_5", ++ .offset = 0x53, ++ }, ++ [OCELOT_STAT_TX_YELLOW_PRIO_6] = { ++ .name = "tx_yellow_prio_6", ++ .offset = 0x54, ++ }, ++ [OCELOT_STAT_TX_YELLOW_PRIO_7] = { ++ .name = "tx_yellow_prio_7", ++ .offset = 0x55, ++ }, ++ [OCELOT_STAT_TX_GREEN_PRIO_0] = { ++ .name = "tx_green_prio_0", ++ .offset = 0x56, ++ }, ++ [OCELOT_STAT_TX_GREEN_PRIO_1] = { ++ .name = "tx_green_prio_1", ++ .offset = 0x57, ++ }, ++ [OCELOT_STAT_TX_GREEN_PRIO_2] = { ++ .name = "tx_green_prio_2", ++ .offset = 0x58, ++ }, ++ [OCELOT_STAT_TX_GREEN_PRIO_3] = { ++ .name = "tx_green_prio_3", ++ .offset = 0x59, ++ }, ++ [OCELOT_STAT_TX_GREEN_PRIO_4] = { ++ .name = "tx_green_prio_4", ++ .offset = 0x5A, ++ }, ++ [OCELOT_STAT_TX_GREEN_PRIO_5] = { ++ .name = "tx_green_prio_5", ++ .offset = 0x5B, ++ }, ++ [OCELOT_STAT_TX_GREEN_PRIO_6] = { ++ .name = "tx_green_prio_6", ++ .offset = 0x5C, ++ }, ++ [OCELOT_STAT_TX_GREEN_PRIO_7] = { ++ .name = "tx_green_prio_7", ++ .offset = 0x5D, ++ }, ++ [OCELOT_STAT_TX_AGED] = { ++ .name = "tx_aged", ++ .offset = 0x5E, ++ }, ++ [OCELOT_STAT_DROP_LOCAL] = { ++ .name = "drop_local", ++ .offset = 0x80, ++ }, ++ [OCELOT_STAT_DROP_TAIL] = { ++ .name = "drop_tail", ++ .offset = 0x81, ++ }, ++ [OCELOT_STAT_DROP_YELLOW_PRIO_0] = { ++ .name = "drop_yellow_prio_0", ++ .offset = 0x82, ++ }, ++ [OCELOT_STAT_DROP_YELLOW_PRIO_1] = { ++ .name = "drop_yellow_prio_1", ++ .offset = 0x83, ++ }, ++ [OCELOT_STAT_DROP_YELLOW_PRIO_2] = { ++ .name = "drop_yellow_prio_2", ++ .offset = 0x84, ++ }, ++ [OCELOT_STAT_DROP_YELLOW_PRIO_3] = { ++ .name = "drop_yellow_prio_3", ++ .offset = 0x85, ++ }, ++ [OCELOT_STAT_DROP_YELLOW_PRIO_4] = { ++ .name = "drop_yellow_prio_4", ++ .offset = 0x86, ++ }, ++ [OCELOT_STAT_DROP_YELLOW_PRIO_5] = { ++ .name = "drop_yellow_prio_5", ++ .offset = 0x87, ++ }, ++ [OCELOT_STAT_DROP_YELLOW_PRIO_6] = { ++ .name = "drop_yellow_prio_6", ++ .offset = 0x88, ++ }, ++ [OCELOT_STAT_DROP_YELLOW_PRIO_7] = { ++ .name = "drop_yellow_prio_7", ++ .offset = 0x89, ++ }, ++ [OCELOT_STAT_DROP_GREEN_PRIO_0] = { ++ .name = "drop_green_prio_0", ++ .offset = 0x8A, ++ }, ++ [OCELOT_STAT_DROP_GREEN_PRIO_1] = { ++ .name = "drop_green_prio_1", ++ .offset = 0x8B, ++ }, ++ [OCELOT_STAT_DROP_GREEN_PRIO_2] = { ++ .name = "drop_green_prio_2", ++ .offset = 0x8C, ++ }, ++ [OCELOT_STAT_DROP_GREEN_PRIO_3] = { ++ .name = "drop_green_prio_3", ++ .offset = 0x8D, ++ }, ++ [OCELOT_STAT_DROP_GREEN_PRIO_4] = { ++ .name = "drop_green_prio_4", ++ .offset = 0x8E, ++ }, ++ [OCELOT_STAT_DROP_GREEN_PRIO_5] = { ++ .name = "drop_green_prio_5", ++ .offset = 0x8F, ++ }, ++ [OCELOT_STAT_DROP_GREEN_PRIO_6] = { ++ .name = "drop_green_prio_6", ++ .offset = 0x90, ++ }, ++ [OCELOT_STAT_DROP_GREEN_PRIO_7] = { ++ .name = "drop_green_prio_7", ++ .offset = 0x91, ++ }, + }; + + static void ocelot_pll5_init(struct ocelot *ocelot) +diff --git a/include/soc/mscc/ocelot.h b/include/soc/mscc/ocelot.h +index 72b9474391da..2428bc64cb1d 100644 +--- a/include/soc/mscc/ocelot.h ++++ b/include/soc/mscc/ocelot.h +@@ -105,11 +105,6 @@ + #define REG_RESERVED_ADDR 0xffffffff + #define REG_RESERVED(reg) REG(reg, REG_RESERVED_ADDR) + +-#define for_each_stat(ocelot, stat) \ +- for ((stat) = (ocelot)->stats_layout; \ +- ((stat)->name[0] != '\0'); \ +- (stat)++) +- + enum ocelot_target { + ANA = 1, + QS, +@@ -540,13 +535,108 @@ enum ocelot_ptp_pins { + TOD_ACC_PIN + }; + ++enum ocelot_stat { ++ OCELOT_STAT_RX_OCTETS, ++ OCELOT_STAT_RX_UNICAST, ++ OCELOT_STAT_RX_MULTICAST, ++ OCELOT_STAT_RX_BROADCAST, ++ OCELOT_STAT_RX_SHORTS, ++ OCELOT_STAT_RX_FRAGMENTS, ++ OCELOT_STAT_RX_JABBERS, ++ OCELOT_STAT_RX_CRC_ALIGN_ERRS, ++ OCELOT_STAT_RX_SYM_ERRS, ++ OCELOT_STAT_RX_64, ++ OCELOT_STAT_RX_65_127, ++ OCELOT_STAT_RX_128_255, ++ OCELOT_STAT_RX_256_511, ++ OCELOT_STAT_RX_512_1023, ++ OCELOT_STAT_RX_1024_1526, ++ OCELOT_STAT_RX_1527_MAX, ++ OCELOT_STAT_RX_PAUSE, ++ OCELOT_STAT_RX_CONTROL, ++ OCELOT_STAT_RX_LONGS, ++ OCELOT_STAT_RX_CLASSIFIED_DROPS, ++ OCELOT_STAT_RX_RED_PRIO_0, ++ OCELOT_STAT_RX_RED_PRIO_1, ++ OCELOT_STAT_RX_RED_PRIO_2, ++ OCELOT_STAT_RX_RED_PRIO_3, ++ OCELOT_STAT_RX_RED_PRIO_4, ++ OCELOT_STAT_RX_RED_PRIO_5, ++ OCELOT_STAT_RX_RED_PRIO_6, ++ OCELOT_STAT_RX_RED_PRIO_7, ++ OCELOT_STAT_RX_YELLOW_PRIO_0, ++ OCELOT_STAT_RX_YELLOW_PRIO_1, ++ OCELOT_STAT_RX_YELLOW_PRIO_2, ++ OCELOT_STAT_RX_YELLOW_PRIO_3, ++ OCELOT_STAT_RX_YELLOW_PRIO_4, ++ OCELOT_STAT_RX_YELLOW_PRIO_5, ++ OCELOT_STAT_RX_YELLOW_PRIO_6, ++ OCELOT_STAT_RX_YELLOW_PRIO_7, ++ OCELOT_STAT_RX_GREEN_PRIO_0, ++ OCELOT_STAT_RX_GREEN_PRIO_1, ++ OCELOT_STAT_RX_GREEN_PRIO_2, ++ OCELOT_STAT_RX_GREEN_PRIO_3, ++ OCELOT_STAT_RX_GREEN_PRIO_4, ++ OCELOT_STAT_RX_GREEN_PRIO_5, ++ OCELOT_STAT_RX_GREEN_PRIO_6, ++ OCELOT_STAT_RX_GREEN_PRIO_7, ++ OCELOT_STAT_TX_OCTETS, ++ OCELOT_STAT_TX_UNICAST, ++ OCELOT_STAT_TX_MULTICAST, ++ OCELOT_STAT_TX_BROADCAST, ++ OCELOT_STAT_TX_COLLISION, ++ OCELOT_STAT_TX_DROPS, ++ OCELOT_STAT_TX_PAUSE, ++ OCELOT_STAT_TX_64, ++ OCELOT_STAT_TX_65_127, ++ OCELOT_STAT_TX_128_255, ++ OCELOT_STAT_TX_256_511, ++ OCELOT_STAT_TX_512_1023, ++ OCELOT_STAT_TX_1024_1526, ++ OCELOT_STAT_TX_1527_MAX, ++ OCELOT_STAT_TX_YELLOW_PRIO_0, ++ OCELOT_STAT_TX_YELLOW_PRIO_1, ++ OCELOT_STAT_TX_YELLOW_PRIO_2, ++ OCELOT_STAT_TX_YELLOW_PRIO_3, ++ OCELOT_STAT_TX_YELLOW_PRIO_4, ++ OCELOT_STAT_TX_YELLOW_PRIO_5, ++ OCELOT_STAT_TX_YELLOW_PRIO_6, ++ OCELOT_STAT_TX_YELLOW_PRIO_7, ++ OCELOT_STAT_TX_GREEN_PRIO_0, ++ OCELOT_STAT_TX_GREEN_PRIO_1, ++ OCELOT_STAT_TX_GREEN_PRIO_2, ++ OCELOT_STAT_TX_GREEN_PRIO_3, ++ OCELOT_STAT_TX_GREEN_PRIO_4, ++ OCELOT_STAT_TX_GREEN_PRIO_5, ++ OCELOT_STAT_TX_GREEN_PRIO_6, ++ OCELOT_STAT_TX_GREEN_PRIO_7, ++ OCELOT_STAT_TX_AGED, ++ OCELOT_STAT_DROP_LOCAL, ++ OCELOT_STAT_DROP_TAIL, ++ OCELOT_STAT_DROP_YELLOW_PRIO_0, ++ OCELOT_STAT_DROP_YELLOW_PRIO_1, ++ OCELOT_STAT_DROP_YELLOW_PRIO_2, ++ OCELOT_STAT_DROP_YELLOW_PRIO_3, ++ OCELOT_STAT_DROP_YELLOW_PRIO_4, ++ OCELOT_STAT_DROP_YELLOW_PRIO_5, ++ OCELOT_STAT_DROP_YELLOW_PRIO_6, ++ OCELOT_STAT_DROP_YELLOW_PRIO_7, ++ OCELOT_STAT_DROP_GREEN_PRIO_0, ++ OCELOT_STAT_DROP_GREEN_PRIO_1, ++ OCELOT_STAT_DROP_GREEN_PRIO_2, ++ OCELOT_STAT_DROP_GREEN_PRIO_3, ++ OCELOT_STAT_DROP_GREEN_PRIO_4, ++ OCELOT_STAT_DROP_GREEN_PRIO_5, ++ OCELOT_STAT_DROP_GREEN_PRIO_6, ++ OCELOT_STAT_DROP_GREEN_PRIO_7, ++ OCELOT_NUM_STATS, ++}; ++ + struct ocelot_stat_layout { + u32 offset; + char name[ETH_GSTRING_LEN]; + }; + +-#define OCELOT_STAT_END { .name = "" } +- + struct ocelot_stats_region { + struct list_head node; + u32 offset; +@@ -709,7 +799,6 @@ struct ocelot { + const u32 *const *map; + const struct ocelot_stat_layout *stats_layout; + struct list_head stats_regions; +- unsigned int num_stats; + + u32 pool_size[OCELOT_SB_NUM][OCELOT_SB_POOL_NUM]; + int packet_buffer_size; +-- +2.35.1 + diff --git a/queue-5.19/net-mscc-ocelot-report-ndo_get_stats64-from-the-wrap.patch b/queue-5.19/net-mscc-ocelot-report-ndo_get_stats64-from-the-wrap.patch new file mode 100644 index 00000000000..321380aeffc --- /dev/null +++ b/queue-5.19/net-mscc-ocelot-report-ndo_get_stats64-from-the-wrap.patch @@ -0,0 +1,111 @@ +From 437cec7104ac4f8f5b1fe69d0923bd301b308298 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Aug 2022 16:53:52 +0300 +Subject: net: mscc: ocelot: report ndo_get_stats64 from the + wraparound-resistant ocelot->stats + +From: Vladimir Oltean + +[ Upstream commit e780e3193e889fd8358b862f7cd18ec5a4901caf ] + +Rather than reading the stats64 counters directly from the 32-bit +hardware, it's better to rely on the output produced by the periodic +ocelot_port_update_stats(). + +It would be even better to call ocelot_port_update_stats() right from +ocelot_get_stats64() to make sure we report the current values rather +than the ones from 2 seconds ago. But we need to export +ocelot_port_update_stats() from the switch lib towards the switchdev +driver for that, and future work will largely undo that. + +There are more ocelot-based drivers waiting to be introduced, an example +of which is the SPI-controlled VSC7512. In that driver's case, it will +be impossible to call ocelot_port_update_stats() from ndo_get_stats64 +context, since the latter is atomic, and reading the stats over SPI is +sleepable. So the compromise taken here, which will also hold going +forward, is to report 64-bit counters to stats64, which are not 100% up +to date. + +Fixes: a556c76adc05 ("net: mscc: Add initial Ocelot switch support") +Signed-off-by: Vladimir Oltean +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mscc/ocelot_net.c | 53 +++++++++++++------------- + 1 file changed, 26 insertions(+), 27 deletions(-) + +diff --git a/drivers/net/ethernet/mscc/ocelot_net.c b/drivers/net/ethernet/mscc/ocelot_net.c +index 6b9d37138844..330d30841cdc 100644 +--- a/drivers/net/ethernet/mscc/ocelot_net.c ++++ b/drivers/net/ethernet/mscc/ocelot_net.c +@@ -725,41 +725,40 @@ static void ocelot_get_stats64(struct net_device *dev, + struct ocelot_port_private *priv = netdev_priv(dev); + struct ocelot *ocelot = priv->port.ocelot; + int port = priv->port.index; ++ u64 *s; + + spin_lock(&ocelot->stats_lock); + +- /* Configure the port to read the stats from */ +- ocelot_write(ocelot, SYS_STAT_CFG_STAT_VIEW(port), +- SYS_STAT_CFG); ++ s = &ocelot->stats[port * OCELOT_NUM_STATS]; + + /* Get Rx stats */ +- stats->rx_bytes = ocelot_read(ocelot, SYS_COUNT_RX_OCTETS); +- stats->rx_packets = ocelot_read(ocelot, SYS_COUNT_RX_SHORTS) + +- ocelot_read(ocelot, SYS_COUNT_RX_FRAGMENTS) + +- ocelot_read(ocelot, SYS_COUNT_RX_JABBERS) + +- ocelot_read(ocelot, SYS_COUNT_RX_LONGS) + +- ocelot_read(ocelot, SYS_COUNT_RX_64) + +- ocelot_read(ocelot, SYS_COUNT_RX_65_127) + +- ocelot_read(ocelot, SYS_COUNT_RX_128_255) + +- ocelot_read(ocelot, SYS_COUNT_RX_256_511) + +- ocelot_read(ocelot, SYS_COUNT_RX_512_1023) + +- ocelot_read(ocelot, SYS_COUNT_RX_1024_1526) + +- ocelot_read(ocelot, SYS_COUNT_RX_1527_MAX); +- stats->multicast = ocelot_read(ocelot, SYS_COUNT_RX_MULTICAST); ++ stats->rx_bytes = s[OCELOT_STAT_RX_OCTETS]; ++ stats->rx_packets = s[OCELOT_STAT_RX_SHORTS] + ++ s[OCELOT_STAT_RX_FRAGMENTS] + ++ s[OCELOT_STAT_RX_JABBERS] + ++ s[OCELOT_STAT_RX_LONGS] + ++ s[OCELOT_STAT_RX_64] + ++ s[OCELOT_STAT_RX_65_127] + ++ s[OCELOT_STAT_RX_128_255] + ++ s[OCELOT_STAT_RX_256_511] + ++ s[OCELOT_STAT_RX_512_1023] + ++ s[OCELOT_STAT_RX_1024_1526] + ++ s[OCELOT_STAT_RX_1527_MAX]; ++ stats->multicast = s[OCELOT_STAT_RX_MULTICAST]; + stats->rx_dropped = dev->stats.rx_dropped; + + /* Get Tx stats */ +- stats->tx_bytes = ocelot_read(ocelot, SYS_COUNT_TX_OCTETS); +- stats->tx_packets = ocelot_read(ocelot, SYS_COUNT_TX_64) + +- ocelot_read(ocelot, SYS_COUNT_TX_65_127) + +- ocelot_read(ocelot, SYS_COUNT_TX_128_255) + +- ocelot_read(ocelot, SYS_COUNT_TX_256_511) + +- ocelot_read(ocelot, SYS_COUNT_TX_512_1023) + +- ocelot_read(ocelot, SYS_COUNT_TX_1024_1526) + +- ocelot_read(ocelot, SYS_COUNT_TX_1527_MAX); +- stats->tx_dropped = ocelot_read(ocelot, SYS_COUNT_TX_DROPS) + +- ocelot_read(ocelot, SYS_COUNT_TX_AGING); +- stats->collisions = ocelot_read(ocelot, SYS_COUNT_TX_COLLISION); ++ stats->tx_bytes = s[OCELOT_STAT_TX_OCTETS]; ++ stats->tx_packets = s[OCELOT_STAT_TX_64] + ++ s[OCELOT_STAT_TX_65_127] + ++ s[OCELOT_STAT_TX_128_255] + ++ s[OCELOT_STAT_TX_256_511] + ++ s[OCELOT_STAT_TX_512_1023] + ++ s[OCELOT_STAT_TX_1024_1526] + ++ s[OCELOT_STAT_TX_1527_MAX]; ++ stats->tx_dropped = s[OCELOT_STAT_TX_DROPS] + ++ s[OCELOT_STAT_TX_AGED]; ++ stats->collisions = s[OCELOT_STAT_TX_COLLISION]; + + spin_unlock(&ocelot->stats_lock); + } +-- +2.35.1 + diff --git a/queue-5.19/net-mscc-ocelot-turn-stats_lock-into-a-spinlock.patch b/queue-5.19/net-mscc-ocelot-turn-stats_lock-into-a-spinlock.patch new file mode 100644 index 00000000000..7bfdad05d45 --- /dev/null +++ b/queue-5.19/net-mscc-ocelot-turn-stats_lock-into-a-spinlock.patch @@ -0,0 +1,117 @@ +From 66184dc0617f0e2421a73f3f116274de765b2f8c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Aug 2022 16:53:48 +0300 +Subject: net: mscc: ocelot: turn stats_lock into a spinlock + +From: Vladimir Oltean + +[ Upstream commit 22d842e3efe56402c33b5e6e303bb71ce9bf9334 ] + +ocelot_get_stats64() currently runs unlocked and therefore may collide +with ocelot_port_update_stats() which indirectly accesses the same +counters. However, ocelot_get_stats64() runs in atomic context, and we +cannot simply take the sleepable ocelot->stats_lock mutex. We need to +convert it to an atomic spinlock first. Do that as a preparatory change. + +Signed-off-by: Vladimir Oltean +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/ocelot/felix_vsc9959.c | 4 ++-- + drivers/net/ethernet/mscc/ocelot.c | 11 +++++------ + include/soc/mscc/ocelot.h | 2 +- + 3 files changed, 8 insertions(+), 9 deletions(-) + +diff --git a/drivers/net/dsa/ocelot/felix_vsc9959.c b/drivers/net/dsa/ocelot/felix_vsc9959.c +index 61b1bf4399c4..601fae886b26 100644 +--- a/drivers/net/dsa/ocelot/felix_vsc9959.c ++++ b/drivers/net/dsa/ocelot/felix_vsc9959.c +@@ -2177,7 +2177,7 @@ static void vsc9959_psfp_sgi_table_del(struct ocelot *ocelot, + static void vsc9959_psfp_counters_get(struct ocelot *ocelot, u32 index, + struct felix_stream_filter_counters *counters) + { +- mutex_lock(&ocelot->stats_lock); ++ spin_lock(&ocelot->stats_lock); + + ocelot_rmw(ocelot, SYS_STAT_CFG_STAT_VIEW(index), + SYS_STAT_CFG_STAT_VIEW_M, +@@ -2194,7 +2194,7 @@ static void vsc9959_psfp_counters_get(struct ocelot *ocelot, u32 index, + SYS_STAT_CFG_STAT_CLEAR_SHOT(0x10), + SYS_STAT_CFG); + +- mutex_unlock(&ocelot->stats_lock); ++ spin_unlock(&ocelot->stats_lock); + } + + static int vsc9959_psfp_filter_add(struct ocelot *ocelot, int port, +diff --git a/drivers/net/ethernet/mscc/ocelot.c b/drivers/net/ethernet/mscc/ocelot.c +index d4649e4ee0e7..c67f162f8ab5 100644 +--- a/drivers/net/ethernet/mscc/ocelot.c ++++ b/drivers/net/ethernet/mscc/ocelot.c +@@ -1906,13 +1906,13 @@ static void ocelot_check_stats_work(struct work_struct *work) + stats_work); + int i, err; + +- mutex_lock(&ocelot->stats_lock); ++ spin_lock(&ocelot->stats_lock); + for (i = 0; i < ocelot->num_phys_ports; i++) { + err = ocelot_port_update_stats(ocelot, i); + if (err) + break; + } +- mutex_unlock(&ocelot->stats_lock); ++ spin_unlock(&ocelot->stats_lock); + + if (err) + dev_err(ocelot->dev, "Error %d updating ethtool stats\n", err); +@@ -1925,7 +1925,7 @@ void ocelot_get_ethtool_stats(struct ocelot *ocelot, int port, u64 *data) + { + int i, err; + +- mutex_lock(&ocelot->stats_lock); ++ spin_lock(&ocelot->stats_lock); + + /* check and update now */ + err = ocelot_port_update_stats(ocelot, port); +@@ -1934,7 +1934,7 @@ void ocelot_get_ethtool_stats(struct ocelot *ocelot, int port, u64 *data) + for (i = 0; i < ocelot->num_stats; i++) + *data++ = ocelot->stats[port * ocelot->num_stats + i]; + +- mutex_unlock(&ocelot->stats_lock); ++ spin_unlock(&ocelot->stats_lock); + + if (err) + dev_err(ocelot->dev, "Error %d updating ethtool stats\n", err); +@@ -3363,7 +3363,7 @@ int ocelot_init(struct ocelot *ocelot) + if (!ocelot->stats) + return -ENOMEM; + +- mutex_init(&ocelot->stats_lock); ++ spin_lock_init(&ocelot->stats_lock); + mutex_init(&ocelot->ptp_lock); + mutex_init(&ocelot->mact_lock); + mutex_init(&ocelot->fwd_domain_lock); +@@ -3511,7 +3511,6 @@ void ocelot_deinit(struct ocelot *ocelot) + cancel_delayed_work(&ocelot->stats_work); + destroy_workqueue(ocelot->stats_queue); + destroy_workqueue(ocelot->owq); +- mutex_destroy(&ocelot->stats_lock); + } + EXPORT_SYMBOL(ocelot_deinit); + +diff --git a/include/soc/mscc/ocelot.h b/include/soc/mscc/ocelot.h +index e7e5b06deb2d..72b9474391da 100644 +--- a/include/soc/mscc/ocelot.h ++++ b/include/soc/mscc/ocelot.h +@@ -752,7 +752,7 @@ struct ocelot { + struct ocelot_psfp_list psfp; + + /* Workqueue to check statistics for overflow with its lock */ +- struct mutex stats_lock; ++ spinlock_t stats_lock; + u64 *stats; + struct delayed_work stats_work; + struct workqueue_struct *stats_queue; +-- +2.35.1 + diff --git a/queue-5.19/nvmet-tcp-fix-lockdep-complaint-on-nvmet_tcp_wq-flus.patch b/queue-5.19/nvmet-tcp-fix-lockdep-complaint-on-nvmet_tcp_wq-flus.patch new file mode 100644 index 00000000000..18c1697d0d4 --- /dev/null +++ b/queue-5.19/nvmet-tcp-fix-lockdep-complaint-on-nvmet_tcp_wq-flus.patch @@ -0,0 +1,46 @@ +From 77f653352f64a3fdc1ca0220ac9a2c4dc9f733ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 24 Jul 2022 11:58:43 +0300 +Subject: nvmet-tcp: fix lockdep complaint on nvmet_tcp_wq flush during queue + teardown + +From: Sagi Grimberg + +[ Upstream commit 533d2e8b4d5e4c89772a0adce913525fb86cbbee ] + +We probably need nvmet_tcp_wq to have MEM_RECLAIM as we are +sending/receiving for the socket from works on this workqueue. +Also this eliminates lockdep complaints: +-- +[ 6174.010200] workqueue: WQ_MEM_RECLAIM +nvmet-wq:nvmet_tcp_release_queue_work [nvmet_tcp] is flushing +!WQ_MEM_RECLAIM nvmet_tcp_wq:nvmet_tcp_io_work [nvmet_tcp] +[ 6174.010216] WARNING: CPU: 20 PID: 14456 at kernel/workqueue.c:2628 +check_flush_dependency+0x110/0x14c + +Reported-by: Yi Zhang +Signed-off-by: Sagi Grimberg +Signed-off-by: Christoph Hellwig +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/tcp.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c +index 0a9542599ad1..dc3b4dc8fe08 100644 +--- a/drivers/nvme/target/tcp.c ++++ b/drivers/nvme/target/tcp.c +@@ -1839,7 +1839,8 @@ static int __init nvmet_tcp_init(void) + { + int ret; + +- nvmet_tcp_wq = alloc_workqueue("nvmet_tcp_wq", WQ_HIGHPRI, 0); ++ nvmet_tcp_wq = alloc_workqueue("nvmet_tcp_wq", ++ WQ_MEM_RECLAIM | WQ_HIGHPRI, 0); + if (!nvmet_tcp_wq) + return -ENOMEM; + +-- +2.35.1 + diff --git a/queue-5.19/of-overlay-move-devicetree_corrupt-check-up.patch b/queue-5.19/of-overlay-move-devicetree_corrupt-check-up.patch new file mode 100644 index 00000000000..3959e80cdb6 --- /dev/null +++ b/queue-5.19/of-overlay-move-devicetree_corrupt-check-up.patch @@ -0,0 +1,58 @@ +From c67b01176c056f8cd3c32e235ad2e3b21792e396 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Jul 2022 16:03:14 +0200 +Subject: of: overlay: Move devicetree_corrupt() check up + +From: Geert Uytterhoeven + +[ Upstream commit e385b0ba6a137f34953e746d70d543660c2de1a0 ] + +There is no point in doing several preparatory steps in +of_overlay_fdt_apply(), only to see of_overlay_apply() return early +because of a corrupt device tree. + +Move the check for a corrupt device tree from of_overlay_apply() to +of_overlay_fdt_apply(), to check for this as early as possible. + +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Frank Rowand +Tested-by: Frank Rowand +Signed-off-by: Rob Herring +Link: https://lore.kernel.org/r/c91ce7112eb5167ea46a43d8a980e76b920010ba.1657893306.git.geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + drivers/of/overlay.c | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +diff --git a/drivers/of/overlay.c b/drivers/of/overlay.c +index 4044ddcb02c6..84a8d402009c 100644 +--- a/drivers/of/overlay.c ++++ b/drivers/of/overlay.c +@@ -903,12 +903,6 @@ static int of_overlay_apply(struct overlay_changeset *ovcs) + { + int ret = 0, ret_revert, ret_tmp; + +- if (devicetree_corrupt()) { +- pr_err("devicetree state suspect, refuse to apply overlay\n"); +- ret = -EBUSY; +- goto out; +- } +- + ret = of_resolve_phandles(ovcs->overlay_root); + if (ret) + goto out; +@@ -983,6 +977,11 @@ int of_overlay_fdt_apply(const void *overlay_fdt, u32 overlay_fdt_size, + + *ret_ovcs_id = 0; + ++ if (devicetree_corrupt()) { ++ pr_err("devicetree state suspect, refuse to apply overlay\n"); ++ return -EBUSY; ++ } ++ + if (overlay_fdt_size < sizeof(struct fdt_header) || + fdt_check_header(overlay_fdt)) { + pr_err("Invalid overlay_fdt header\n"); +-- +2.35.1 + diff --git a/queue-5.19/openrisc-io-define-iounmap-argument-as-volatile.patch b/queue-5.19/openrisc-io-define-iounmap-argument-as-volatile.patch new file mode 100644 index 00000000000..16b1bbf3f0c --- /dev/null +++ b/queue-5.19/openrisc-io-define-iounmap-argument-as-volatile.patch @@ -0,0 +1,67 @@ +From f6ed7d27b2ddaaf8ae28d66de19f938c694f02f6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Jul 2022 19:54:08 +0900 +Subject: openrisc: io: Define iounmap argument as volatile + +From: Stafford Horne + +[ Upstream commit 52e0ea900202d23843daee8f7089817e81dd3dd7 ] + +When OpenRISC enables PCI it allows for more drivers to be compiled +resulting in exposing the following with -Werror. + + drivers/video/fbdev/riva/fbdev.c: In function 'rivafb_probe': + drivers/video/fbdev/riva/fbdev.c:2062:42: error: + passing argument 1 of 'iounmap' discards 'volatile' qualifier from pointer target type + + drivers/video/fbdev/nvidia/nvidia.c: In function 'nvidiafb_probe': + drivers/video/fbdev/nvidia/nvidia.c:1414:20: error: + passing argument 1 of 'iounmap' discards 'volatile' qualifier from pointer target type + + drivers/scsi/aic7xxx/aic7xxx_osm.c: In function 'ahc_platform_free': + drivers/scsi/aic7xxx/aic7xxx_osm.c:1231:41: error: + passing argument 1 of 'iounmap' discards 'volatile' qualifier from pointer target type + +Most architectures define the iounmap argument to be volatile. To fix this +issue we do the same for OpenRISC. This patch must go before PCI is enabled on +OpenRISC to avoid any compile failures. + +Link: https://lore.kernel.org/lkml/20220729033728.GA2195022@roeck-us.net/ +Reported-by: Guenter Roeck +Tested-by: Guenter Roeck +Signed-off-by: Stafford Horne +Signed-off-by: Sasha Levin +--- + arch/openrisc/include/asm/io.h | 2 +- + arch/openrisc/mm/ioremap.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/openrisc/include/asm/io.h b/arch/openrisc/include/asm/io.h +index c298061c70a7..8aa3e78181e9 100644 +--- a/arch/openrisc/include/asm/io.h ++++ b/arch/openrisc/include/asm/io.h +@@ -31,7 +31,7 @@ + void __iomem *ioremap(phys_addr_t offset, unsigned long size); + + #define iounmap iounmap +-extern void iounmap(void __iomem *addr); ++extern void iounmap(volatile void __iomem *addr); + + #include + +diff --git a/arch/openrisc/mm/ioremap.c b/arch/openrisc/mm/ioremap.c +index daae13a76743..8ec0dafecf25 100644 +--- a/arch/openrisc/mm/ioremap.c ++++ b/arch/openrisc/mm/ioremap.c +@@ -77,7 +77,7 @@ void __iomem *__ref ioremap(phys_addr_t addr, unsigned long size) + } + EXPORT_SYMBOL(ioremap); + +-void iounmap(void __iomem *addr) ++void iounmap(volatile void __iomem *addr) + { + /* If the page is from the fixmap pool then we just clear out + * the fixmap mapping. +-- +2.35.1 + diff --git a/queue-5.19/ovl-warn-if-trusted-xattr-creation-fails.patch b/queue-5.19/ovl-warn-if-trusted-xattr-creation-fails.patch new file mode 100644 index 00000000000..955731d560a --- /dev/null +++ b/queue-5.19/ovl-warn-if-trusted-xattr-creation-fails.patch @@ -0,0 +1,68 @@ +From bb22b6b364a25aa8b80e1d73f430a8031530cdea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Jul 2022 16:31:30 +0200 +Subject: ovl: warn if trusted xattr creation fails + +From: Miklos Szeredi + +[ Upstream commit b10b85fe5149ee8b39fbbf86095b303632dde2cd ] + +When mounting overlayfs in an unprivileged user namespace, trusted xattr +creation will fail. This will lead to failures in some file operations, +e.g. in the following situation: + + mkdir lower upper work merged + mkdir lower/directory + mount -toverlay -olowerdir=lower,upperdir=upper,workdir=work none merged + rmdir merged/directory + mkdir merged/directory + +The last mkdir will fail: + + mkdir: cannot create directory 'merged/directory': Input/output error + +The cause for these failures is currently extremely non-obvious and hard to +debug. Hence, warn the user and suggest using the userxattr mount option, +if it is not already supplied and xattr creation fails during the +self-check. + +Reported-by: Alois Wohlschlager +Signed-off-by: Miklos Szeredi +Signed-off-by: Sasha Levin +--- + fs/overlayfs/super.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c +index 1ce5c9698393..4c2096130209 100644 +--- a/fs/overlayfs/super.c ++++ b/fs/overlayfs/super.c +@@ -1418,11 +1418,12 @@ static int ovl_make_workdir(struct super_block *sb, struct ovl_fs *ofs, + */ + err = ovl_setxattr(ofs, ofs->workdir, OVL_XATTR_OPAQUE, "0", 1); + if (err) { ++ pr_warn("failed to set xattr on upper\n"); + ofs->noxattr = true; + if (ofs->config.index || ofs->config.metacopy) { + ofs->config.index = false; + ofs->config.metacopy = false; +- pr_warn("upper fs does not support xattr, falling back to index=off,metacopy=off.\n"); ++ pr_warn("...falling back to index=off,metacopy=off.\n"); + } + /* + * xattr support is required for persistent st_ino. +@@ -1430,8 +1431,10 @@ static int ovl_make_workdir(struct super_block *sb, struct ovl_fs *ofs, + */ + if (ofs->config.xino == OVL_XINO_AUTO) { + ofs->config.xino = OVL_XINO_OFF; +- pr_warn("upper fs does not support xattr, falling back to xino=off.\n"); ++ pr_warn("...falling back to xino=off.\n"); + } ++ if (err == -EPERM && !ofs->config.userxattr) ++ pr_info("try mounting with 'userxattr' option\n"); + err = 0; + } else { + ovl_removexattr(ofs, ofs->workdir, OVL_XATTR_OPAQUE); +-- +2.35.1 + diff --git a/queue-5.19/pci-aardvark-fix-reporting-slot-capabilities-on-emul.patch b/queue-5.19/pci-aardvark-fix-reporting-slot-capabilities-on-emul.patch new file mode 100644 index 00000000000..20ec4e24313 --- /dev/null +++ b/queue-5.19/pci-aardvark-fix-reporting-slot-capabilities-on-emul.patch @@ -0,0 +1,102 @@ +From e87994fcce71622e5787340de315fbb6f9a2247d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 May 2022 15:28:27 +0200 +Subject: PCI: aardvark: Fix reporting Slot capabilities on emulated bridge +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pali Rohár + +[ Upstream commit bcdb6fd4f3e9ac1097698c8d8f56b70853b49873 ] + +Slot capabilities are currently not reported because emulated bridge does +not report the PCI_EXP_FLAGS_SLOT flag. + +Set PCI_EXP_FLAGS_SLOT to let the kernel know that PCI_EXP_SLT* registers +are supported. + +Move setting of PCI_EXP_SLTCTL register from "dynamic" pcie_conf_read +function to static buffer as it is only statically filled the +PCI_EXP_SLTSTA_PDS flag and dynamic read callback is not needed for this +register. + +Set Presence State Bit to 1 since there is no support for unplugging the +card and there is currently no platform able to detect presence of a card - +in such a case the bit needs to be set to 1. + +Finally correctly set Physical Slot Number to 1 since there is only one +port and zero value is reserved for ports within the same silicon as Root +Port which is not our case for Aardvark HW. + +Link: https://lore.kernel.org/r/20220524132827.8837-3-kabel@kernel.org +Signed-off-by: Pali Rohár +Signed-off-by: Marek Behún +Signed-off-by: Bjorn Helgaas +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/pci-aardvark.c | 33 +++++++++++++++++++-------- + 1 file changed, 24 insertions(+), 9 deletions(-) + +diff --git a/drivers/pci/controller/pci-aardvark.c b/drivers/pci/controller/pci-aardvark.c +index ffec82c8a523..62db476a8651 100644 +--- a/drivers/pci/controller/pci-aardvark.c ++++ b/drivers/pci/controller/pci-aardvark.c +@@ -8,6 +8,7 @@ + * Author: Hezi Shahmoon + */ + ++#include + #include + #include + #include +@@ -857,14 +858,11 @@ advk_pci_bridge_emul_pcie_conf_read(struct pci_bridge_emul *bridge, + + + switch (reg) { +- case PCI_EXP_SLTCTL: +- *value = PCI_EXP_SLTSTA_PDS << 16; +- return PCI_BRIDGE_EMUL_HANDLED; +- + /* +- * PCI_EXP_RTCTL and PCI_EXP_RTSTA are also supported, but do not need +- * to be handled here, because their values are stored in emulated +- * config space buffer, and we read them from there when needed. ++ * PCI_EXP_SLTCAP, PCI_EXP_SLTCTL, PCI_EXP_RTCTL and PCI_EXP_RTSTA are ++ * also supported, but do not need to be handled here, because their ++ * values are stored in emulated config space buffer, and we read them ++ * from there when needed. + */ + + case PCI_EXP_LNKCAP: { +@@ -977,8 +975,25 @@ static int advk_sw_pci_bridge_init(struct advk_pcie *pcie) + /* Support interrupt A for MSI feature */ + bridge->conf.intpin = PCI_INTERRUPT_INTA; + +- /* Aardvark HW provides PCIe Capability structure in version 2 */ +- bridge->pcie_conf.cap = cpu_to_le16(2); ++ /* ++ * Aardvark HW provides PCIe Capability structure in version 2 and ++ * indicate slot support, which is emulated. ++ */ ++ bridge->pcie_conf.cap = cpu_to_le16(2 | PCI_EXP_FLAGS_SLOT); ++ ++ /* ++ * Set Presence Detect State bit permanently since there is no support ++ * for unplugging the card nor detecting whether it is plugged. (If a ++ * platform exists in the future that supports it, via a GPIO for ++ * example, it should be implemented via this bit.) ++ * ++ * Set physical slot number to 1 since there is only one port and zero ++ * value is reserved for ports within the same silicon as Root Port ++ * which is not our case. ++ */ ++ bridge->pcie_conf.slotcap = cpu_to_le32(FIELD_PREP(PCI_EXP_SLTCAP_PSN, ++ 1)); ++ bridge->pcie_conf.slotsta = cpu_to_le16(PCI_EXP_SLTSTA_PDS); + + /* Indicates supports for Completion Retry Status */ + bridge->pcie_conf.rootcap = cpu_to_le16(PCI_EXP_RTCAP_CRSVIS); +-- +2.35.1 + diff --git a/queue-5.19/pci-acpi-guard-arm64-specific-mcfg_quirks.patch b/queue-5.19/pci-acpi-guard-arm64-specific-mcfg_quirks.patch new file mode 100644 index 00000000000..9c78dcc0d2d --- /dev/null +++ b/queue-5.19/pci-acpi-guard-arm64-specific-mcfg_quirks.patch @@ -0,0 +1,44 @@ +From 7651239ee27f17ef960516ec4948d492f67ce734 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Jul 2022 20:42:10 +0800 +Subject: PCI/ACPI: Guard ARM64-specific mcfg_quirks + +From: Huacai Chen + +[ Upstream commit 40a6cc141b4b9580de140bcb3e893445708acc5d ] + +Guard ARM64-specific quirks with CONFIG_ARM64 to avoid build errors, +since mcfg_quirks will be shared by more than one architectures. + +Link: https://lore.kernel.org/r/20220714124216.1489304-2-chenhuacai@loongson.cn +Signed-off-by: Huacai Chen +Signed-off-by: Bjorn Helgaas +Signed-off-by: Sasha Levin +--- + drivers/acpi/pci_mcfg.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/acpi/pci_mcfg.c b/drivers/acpi/pci_mcfg.c +index 53cab975f612..63b98eae5e75 100644 +--- a/drivers/acpi/pci_mcfg.c ++++ b/drivers/acpi/pci_mcfg.c +@@ -41,6 +41,8 @@ struct mcfg_fixup { + static struct mcfg_fixup mcfg_quirks[] = { + /* { OEM_ID, OEM_TABLE_ID, REV, SEGMENT, BUS_RANGE, ops, cfgres }, */ + ++#ifdef CONFIG_ARM64 ++ + #define AL_ECAM(table_id, rev, seg, ops) \ + { "AMAZON", table_id, rev, seg, MCFG_BUS_ANY, ops } + +@@ -169,6 +171,7 @@ static struct mcfg_fixup mcfg_quirks[] = { + ALTRA_ECAM_QUIRK(1, 13), + ALTRA_ECAM_QUIRK(1, 14), + ALTRA_ECAM_QUIRK(1, 15), ++#endif /* ARM64 */ + }; + + static char mcfg_oem_id[ACPI_OEM_ID_SIZE]; +-- +2.35.1 + diff --git a/queue-5.19/pci-add-acs-quirk-for-broadcom-bcm5750x-nics.patch b/queue-5.19/pci-add-acs-quirk-for-broadcom-bcm5750x-nics.patch new file mode 100644 index 00000000000..9a4098d88f0 --- /dev/null +++ b/queue-5.19/pci-add-acs-quirk-for-broadcom-bcm5750x-nics.patch @@ -0,0 +1,44 @@ +From 007cd12df04d5059e9af5dd8459179bd8fa644cc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Jun 2022 13:41:47 -0400 +Subject: PCI: Add ACS quirk for Broadcom BCM5750x NICs + +From: Pavan Chebbi + +[ Upstream commit afd306a65cedb9589564bdb23a0c368abc4215fd ] + +The Broadcom BCM5750x NICs may be multi-function devices. They do not +advertise ACS capability. Peer-to-peer transactions are not possible +between the individual functions, so it is safe to treat them as fully +isolated. + +Add an ACS quirk for these devices so the functions can be in independent +IOMMU groups and attached individually to userspace applications using +VFIO. + +Link: https://lore.kernel.org/r/1654796507-28610-1-git-send-email-michael.chan@broadcom.com +Signed-off-by: Pavan Chebbi +Signed-off-by: Michael Chan +Signed-off-by: Bjorn Helgaas +Signed-off-by: Sasha Levin +--- + drivers/pci/quirks.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c +index 41aeaa235132..2e68f50bc7ae 100644 +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -4924,6 +4924,9 @@ static const struct pci_dev_acs_enabled { + { PCI_VENDOR_ID_AMPERE, 0xE00C, pci_quirk_xgene_acs }, + /* Broadcom multi-function device */ + { PCI_VENDOR_ID_BROADCOM, 0x16D7, pci_quirk_mf_endpoint_acs }, ++ { PCI_VENDOR_ID_BROADCOM, 0x1750, pci_quirk_mf_endpoint_acs }, ++ { PCI_VENDOR_ID_BROADCOM, 0x1751, pci_quirk_mf_endpoint_acs }, ++ { PCI_VENDOR_ID_BROADCOM, 0x1752, pci_quirk_mf_endpoint_acs }, + { PCI_VENDOR_ID_BROADCOM, 0xD714, pci_quirk_brcm_acs }, + /* Amazon Annapurna Labs */ + { PCI_VENDOR_ID_AMAZON_ANNAPURNA_LABS, 0x0031, pci_quirk_al_acs }, +-- +2.35.1 + diff --git a/queue-5.19/phy-samsung-phy-exynos-pcie-sanitize-init-power_on-c.patch b/queue-5.19/phy-samsung-phy-exynos-pcie-sanitize-init-power_on-c.patch new file mode 100644 index 00000000000..be044d18ac2 --- /dev/null +++ b/queue-5.19/phy-samsung-phy-exynos-pcie-sanitize-init-power_on-c.patch @@ -0,0 +1,87 @@ +From 2f81365aaf3eb426d56c63f9ac383f4fe3fb46a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Jun 2022 00:04:08 +0200 +Subject: phy: samsung: phy-exynos-pcie: sanitize init/power_on callbacks + +From: Marek Szyprowski + +[ Upstream commit f2812227bb07e2eaee74253f11cea1576945df31 ] + +The exynos-pcie driver called phy_power_on() before phy_init() for some +historical reasons. However the generic PHY framework assumes that the +proper sequence is to call phy_init() first, then phy_power_on(). The +operations done by both functions should be considered as one action and as +such they are called by the exynos-pcie driver (without doing anything +between them). The initialization is just a sequence of register writes, +which cannot be altered without breaking the hardware operation. + +To match the generic PHY framework requirement, simply move all register +writes to the phy_init()/phy_exit() and drop power_on()/power_off() +callbacks. This way the driver will also work with the old (incorrect) +PHY initialization call sequence. + +Link: https://lore.kernel.org/r/20220628220409.26545-1-m.szyprowski@samsung.com +Reported-by: Bjorn Helgaas +Signed-off-by: Marek Szyprowski +Signed-off-by: Bjorn Helgaas +Reviewed-by: Chanho Park +Acked-by: Krzysztof Kozlowski +Acked-By: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/samsung/phy-exynos-pcie.c | 25 +++++++++---------------- + 1 file changed, 9 insertions(+), 16 deletions(-) + +diff --git a/drivers/phy/samsung/phy-exynos-pcie.c b/drivers/phy/samsung/phy-exynos-pcie.c +index 578cfe07d07a..53c9230c2907 100644 +--- a/drivers/phy/samsung/phy-exynos-pcie.c ++++ b/drivers/phy/samsung/phy-exynos-pcie.c +@@ -51,6 +51,13 @@ static int exynos5433_pcie_phy_init(struct phy *phy) + { + struct exynos_pcie_phy *ep = phy_get_drvdata(phy); + ++ regmap_update_bits(ep->pmureg, EXYNOS5433_PMU_PCIE_PHY_OFFSET, ++ BIT(0), 1); ++ regmap_update_bits(ep->fsysreg, PCIE_EXYNOS5433_PHY_GLOBAL_RESET, ++ PCIE_APP_REQ_EXIT_L1_MODE, 0); ++ regmap_update_bits(ep->fsysreg, PCIE_EXYNOS5433_PHY_L1SUB_CM_CON, ++ PCIE_REFCLK_GATING_EN, 0); ++ + regmap_update_bits(ep->fsysreg, PCIE_EXYNOS5433_PHY_COMMON_RESET, + PCIE_PHY_RESET, 1); + regmap_update_bits(ep->fsysreg, PCIE_EXYNOS5433_PHY_MAC_RESET, +@@ -109,20 +116,7 @@ static int exynos5433_pcie_phy_init(struct phy *phy) + return 0; + } + +-static int exynos5433_pcie_phy_power_on(struct phy *phy) +-{ +- struct exynos_pcie_phy *ep = phy_get_drvdata(phy); +- +- regmap_update_bits(ep->pmureg, EXYNOS5433_PMU_PCIE_PHY_OFFSET, +- BIT(0), 1); +- regmap_update_bits(ep->fsysreg, PCIE_EXYNOS5433_PHY_GLOBAL_RESET, +- PCIE_APP_REQ_EXIT_L1_MODE, 0); +- regmap_update_bits(ep->fsysreg, PCIE_EXYNOS5433_PHY_L1SUB_CM_CON, +- PCIE_REFCLK_GATING_EN, 0); +- return 0; +-} +- +-static int exynos5433_pcie_phy_power_off(struct phy *phy) ++static int exynos5433_pcie_phy_exit(struct phy *phy) + { + struct exynos_pcie_phy *ep = phy_get_drvdata(phy); + +@@ -135,8 +129,7 @@ static int exynos5433_pcie_phy_power_off(struct phy *phy) + + static const struct phy_ops exynos5433_phy_ops = { + .init = exynos5433_pcie_phy_init, +- .power_on = exynos5433_pcie_phy_power_on, +- .power_off = exynos5433_pcie_phy_power_off, ++ .exit = exynos5433_pcie_phy_exit, + .owner = THIS_MODULE, + }; + +-- +2.35.1 + diff --git a/queue-5.19/pinctrl-intel-check-against-matching-data-instead-of.patch b/queue-5.19/pinctrl-intel-check-against-matching-data-instead-of.patch new file mode 100644 index 00000000000..8124d3be845 --- /dev/null +++ b/queue-5.19/pinctrl-intel-check-against-matching-data-instead-of.patch @@ -0,0 +1,67 @@ +From d8c59ecff638cfc0be7eaea549a4a51cebf08f94 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Jun 2022 19:41:28 +0300 +Subject: pinctrl: intel: Check against matching data instead of ACPI companion + +From: Andy Shevchenko + +[ Upstream commit c551bd81d198bf1dcd4398d5454acdc0309dbe77 ] + +In some cases we may get a platform device that has ACPI companion +which is different to the pin control described in the ACPI tables. +This is primarily happens when device is instantiated by board file. + +In order to allow this device being enumerated, refactor +intel_pinctrl_get_soc_data() to check the matching data instead of +ACPI companion. + +Reported-by: Henning Schild +Signed-off-by: Andy Shevchenko +Tested-by: Henning Schild +Acked-by: Hans de Goede +Acked-by: Mika Westerberg +Acked-by: Linus Walleij +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/intel/pinctrl-intel.c | 14 ++++++-------- + 1 file changed, 6 insertions(+), 8 deletions(-) + +diff --git a/drivers/pinctrl/intel/pinctrl-intel.c b/drivers/pinctrl/intel/pinctrl-intel.c +index ffc045f7bf00..fd093e36c3a8 100644 +--- a/drivers/pinctrl/intel/pinctrl-intel.c ++++ b/drivers/pinctrl/intel/pinctrl-intel.c +@@ -1641,16 +1641,14 @@ EXPORT_SYMBOL_GPL(intel_pinctrl_probe_by_uid); + + const struct intel_pinctrl_soc_data *intel_pinctrl_get_soc_data(struct platform_device *pdev) + { ++ const struct intel_pinctrl_soc_data * const *table; + const struct intel_pinctrl_soc_data *data = NULL; +- const struct intel_pinctrl_soc_data **table; +- struct acpi_device *adev; +- unsigned int i; + +- adev = ACPI_COMPANION(&pdev->dev); +- if (adev) { +- const void *match = device_get_match_data(&pdev->dev); ++ table = device_get_match_data(&pdev->dev); ++ if (table) { ++ struct acpi_device *adev = ACPI_COMPANION(&pdev->dev); ++ unsigned int i; + +- table = (const struct intel_pinctrl_soc_data **)match; + for (i = 0; table[i]; i++) { + if (!strcmp(adev->pnp.unique_id, table[i]->uid)) { + data = table[i]; +@@ -1664,7 +1662,7 @@ const struct intel_pinctrl_soc_data *intel_pinctrl_get_soc_data(struct platform_ + if (!id) + return ERR_PTR(-ENODEV); + +- table = (const struct intel_pinctrl_soc_data **)id->driver_data; ++ table = (const struct intel_pinctrl_soc_data * const *)id->driver_data; + data = table[pdev->id]; + } + +-- +2.35.1 + diff --git a/queue-5.19/platform-chrome-cros_ec_proto-don-t-show-mkbp-versio.patch b/queue-5.19/platform-chrome-cros_ec_proto-don-t-show-mkbp-versio.patch new file mode 100644 index 00000000000..f1000ff9d0c --- /dev/null +++ b/queue-5.19/platform-chrome-cros_ec_proto-don-t-show-mkbp-versio.patch @@ -0,0 +1,48 @@ +From c63aee284d646e6f705cf2e79a5d70966cb65125 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Jun 2022 08:49:49 +0000 +Subject: platform/chrome: cros_ec_proto: don't show MKBP version if + unsupported + +From: Tzung-Bi Shih + +[ Upstream commit b36f0643ff14a2fb281b105418e4e73c9d7c11d0 ] + +It wrongly showed the following message when it doesn't support MKBP: +"MKBP support version 4294967295". + +Fix it. + +Reviewed-by: Guenter Roeck +Signed-off-by: Tzung-Bi Shih +Link: https://lore.kernel.org/r/20220609084957.3684698-14-tzungbi@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/platform/chrome/cros_ec_proto.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/platform/chrome/cros_ec_proto.c b/drivers/platform/chrome/cros_ec_proto.c +index ff767dccdf0f..40dc048d18ad 100644 +--- a/drivers/platform/chrome/cros_ec_proto.c ++++ b/drivers/platform/chrome/cros_ec_proto.c +@@ -509,13 +509,13 @@ int cros_ec_query_all(struct cros_ec_device *ec_dev) + ret = cros_ec_get_host_command_version_mask(ec_dev, + EC_CMD_GET_NEXT_EVENT, + &ver_mask); +- if (ret < 0 || ver_mask == 0) ++ if (ret < 0 || ver_mask == 0) { + ec_dev->mkbp_event_supported = 0; +- else ++ } else { + ec_dev->mkbp_event_supported = fls(ver_mask); + +- dev_dbg(ec_dev->dev, "MKBP support version %u\n", +- ec_dev->mkbp_event_supported - 1); ++ dev_dbg(ec_dev->dev, "MKBP support version %u\n", ec_dev->mkbp_event_supported - 1); ++ } + + /* Probe if host sleep v1 is supported for S0ix failure detection. */ + ret = cros_ec_get_host_command_version_mask(ec_dev, +-- +2.35.1 + diff --git a/queue-5.19/powerpc-32-don-t-always-pass-mcpu-powerpc-to-the-com.patch b/queue-5.19/powerpc-32-don-t-always-pass-mcpu-powerpc-to-the-com.patch new file mode 100644 index 00000000000..53677212dfd --- /dev/null +++ b/queue-5.19/powerpc-32-don-t-always-pass-mcpu-powerpc-to-the-com.patch @@ -0,0 +1,151 @@ +From ffef0b505c4a499d4ed24f8a4e75d958ba931fe6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Jul 2022 16:19:30 +0200 +Subject: powerpc/32: Don't always pass -mcpu=powerpc to the compiler +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Christophe Leroy + +[ Upstream commit 446cda1b21d9a6b3697fe399c6a3a00ff4a285f5 ] + +Since commit 4bf4f42a2feb ("powerpc/kbuild: Set default generic +machine type for 32-bit compile"), when building a 32 bits kernel +with a bi-arch version of GCC, or when building a book3s/32 kernel, +the option -mcpu=powerpc is passed to GCC at all time, relying on it +being eventually overriden by a subsequent -mcpu=xxxx. + +But when building the same kernel with a 32 bits only version of GCC, +that is not done, relying on gcc being built with the expected default +CPU. + +This logic has two problems. First, it is a bit fragile to rely on +whether the GCC version is bi-arch or not, because today we can have +bi-arch versions of GCC configured with a 32 bits default. Second, +there are some versions of GCC which don't support -mcpu=powerpc, +for instance for e500 SPE-only versions. + +So, stop relying on this approximative logic and allow the user to +decide whether he/she wants to use the toolchain's default CPU or if +he/she wants to set one, and allow only possible CPUs based on the +selected target. + +Reported-by: Pali Rohár +Signed-off-by: Christophe Leroy +Tested-by: Pali Rohár +Reviewed-by: Arnd Bergmann +Reviewed-by: Segher Boessenkool +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/d4df724691351531bf46d685d654689e5dfa0d74.1657549153.git.christophe.leroy@csgroup.eu +Signed-off-by: Sasha Levin +--- + arch/powerpc/Makefile | 26 +------------------------- + arch/powerpc/platforms/Kconfig.cputype | 21 ++++++++++++++++++--- + 2 files changed, 19 insertions(+), 28 deletions(-) + +diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile +index a0cd70712061..d54e1fe03551 100644 +--- a/arch/powerpc/Makefile ++++ b/arch/powerpc/Makefile +@@ -15,23 +15,6 @@ HAS_BIARCH := $(call cc-option-yn, -m32) + # Set default 32 bits cross compilers for vdso and boot wrapper + CROSS32_COMPILE ?= + +-ifeq ($(HAS_BIARCH),y) +-ifeq ($(CROSS32_COMPILE),) +-ifdef CONFIG_PPC32 +-# These options will be overridden by any -mcpu option that the CPU +-# or platform code sets later on the command line, but they are needed +-# to set a sane 32-bit cpu target for the 64-bit cross compiler which +-# may default to the wrong ISA. +-KBUILD_CFLAGS += -mcpu=powerpc +-KBUILD_AFLAGS += -mcpu=powerpc +-endif +-endif +-endif +- +-ifdef CONFIG_PPC_BOOK3S_32 +-KBUILD_CFLAGS += -mcpu=powerpc +-endif +- + # If we're on a ppc/ppc64/ppc64le machine use that defconfig, otherwise just use + # ppc64_defconfig because we have nothing better to go on. + uname := $(shell uname -m) +@@ -183,6 +166,7 @@ endif + endif + + CFLAGS-$(CONFIG_TARGET_CPU_BOOL) += $(call cc-option,-mcpu=$(CONFIG_TARGET_CPU)) ++AFLAGS-$(CONFIG_TARGET_CPU_BOOL) += $(call cc-option,-mcpu=$(CONFIG_TARGET_CPU)) + + # Altivec option not allowed with e500mc64 in GCC. + ifdef CONFIG_ALTIVEC +@@ -193,14 +177,6 @@ endif + CFLAGS-$(CONFIG_E5500_CPU) += $(E5500_CPU) + CFLAGS-$(CONFIG_E6500_CPU) += $(call cc-option,-mcpu=e6500,$(E5500_CPU)) + +-ifdef CONFIG_PPC32 +-ifdef CONFIG_PPC_E500MC +-CFLAGS-y += $(call cc-option,-mcpu=e500mc,-mcpu=powerpc) +-else +-CFLAGS-$(CONFIG_E500) += $(call cc-option,-mcpu=8540 -msoft-float,-mcpu=powerpc) +-endif +-endif +- + asinstr := $(call as-instr,lis 9$(comma)foo@high,-DHAVE_AS_ATHIGH=1) + + KBUILD_CPPFLAGS += -I $(srctree)/arch/$(ARCH) $(asinstr) +diff --git a/arch/powerpc/platforms/Kconfig.cputype b/arch/powerpc/platforms/Kconfig.cputype +index 3629fd73083e..18115cabaedf 100644 +--- a/arch/powerpc/platforms/Kconfig.cputype ++++ b/arch/powerpc/platforms/Kconfig.cputype +@@ -136,9 +136,9 @@ config GENERIC_CPU + select ARCH_HAS_FAST_MULTIPLIER + select PPC_64S_HASH_MMU + +-config GENERIC_CPU ++config POWERPC_CPU + bool "Generic 32 bits powerpc" +- depends on PPC32 && !PPC_8xx ++ depends on PPC32 && !PPC_8xx && !PPC_85xx + + config CELL_CPU + bool "Cell Broadband Engine" +@@ -197,11 +197,23 @@ config G4_CPU + depends on PPC_BOOK3S_32 + select ALTIVEC + ++config E500_CPU ++ bool "e500 (8540)" ++ depends on PPC_85xx && !PPC_E500MC ++ ++config E500MC_CPU ++ bool "e500mc" ++ depends on PPC_85xx && PPC_E500MC ++ ++config TOOLCHAIN_DEFAULT_CPU ++ bool "Rely on the toolchain's implicit default CPU" ++ depends on PPC32 ++ + endchoice + + config TARGET_CPU_BOOL + bool +- default !GENERIC_CPU ++ default !GENERIC_CPU && !TOOLCHAIN_DEFAULT_CPU + + config TARGET_CPU + string +@@ -216,6 +228,9 @@ config TARGET_CPU + default "e300c2" if E300C2_CPU + default "e300c3" if E300C3_CPU + default "G4" if G4_CPU ++ default "8540" if E500_CPU ++ default "e500mc" if E500MC_CPU ++ default "powerpc" if POWERPC_CPU + + config PPC_BOOK3S + def_bool y +-- +2.35.1 + diff --git a/queue-5.19/powerpc-32-set-an-ibat-covering-up-to-_einittext-dur.patch b/queue-5.19/powerpc-32-set-an-ibat-covering-up-to-_einittext-dur.patch new file mode 100644 index 00000000000..ffa122099a1 --- /dev/null +++ b/queue-5.19/powerpc-32-set-an-ibat-covering-up-to-_einittext-dur.patch @@ -0,0 +1,91 @@ +From f4e59c0a886f9fd23e90f69d4d4ce7177e2f3d58 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Jun 2022 12:34:09 +0200 +Subject: powerpc/32: Set an IBAT covering up to _einittext during init + +From: Christophe Leroy + +[ Upstream commit 2a0fb3c155c97c75176e557d61f8e66c1bd9b735 ] + +Always set an IBAT covering up to _einittext during init because when +CONFIG_MODULES is not selected there is no reason to have an exception +handler for kernel instruction TLB misses. + +It implies DBAT and IBAT are now totaly independent, IBATs are set +by setibat() and DBAT by setbat(). + +This allows to revert commit 9bb162fa26ed ("powerpc/603: Fix +boot failure with DEBUG_PAGEALLOC and KFENCE") + +Reported-by: Maxime Bizon +Signed-off-by: Christophe Leroy +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/ce7f04a39593934d9b1ee68c69144ccd3d4da4a1.1655202804.git.christophe.leroy@csgroup.eu +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/head_book3s_32.S | 4 ++-- + arch/powerpc/mm/book3s32/mmu.c | 10 ++++------ + 2 files changed, 6 insertions(+), 8 deletions(-) + +diff --git a/arch/powerpc/kernel/head_book3s_32.S b/arch/powerpc/kernel/head_book3s_32.S +index 6c739beb938c..519b60695167 100644 +--- a/arch/powerpc/kernel/head_book3s_32.S ++++ b/arch/powerpc/kernel/head_book3s_32.S +@@ -418,14 +418,14 @@ InstructionTLBMiss: + */ + /* Get PTE (linux-style) and check access */ + mfspr r3,SPRN_IMISS +-#if defined(CONFIG_MODULES) || defined(CONFIG_DEBUG_PAGEALLOC) || defined(CONFIG_KFENCE) ++#ifdef CONFIG_MODULES + lis r1, TASK_SIZE@h /* check if kernel address */ + cmplw 0,r1,r3 + #endif + mfspr r2, SPRN_SDR1 + li r1,_PAGE_PRESENT | _PAGE_ACCESSED | _PAGE_EXEC | _PAGE_USER + rlwinm r2, r2, 28, 0xfffff000 +-#if defined(CONFIG_MODULES) || defined(CONFIG_DEBUG_PAGEALLOC) || defined(CONFIG_KFENCE) ++#ifdef CONFIG_MODULES + bgt- 112f + lis r2, (swapper_pg_dir - PAGE_OFFSET)@ha /* if kernel address, use */ + li r1,_PAGE_PRESENT | _PAGE_ACCESSED | _PAGE_EXEC +diff --git a/arch/powerpc/mm/book3s32/mmu.c b/arch/powerpc/mm/book3s32/mmu.c +index 49a737fbbd18..40029280c320 100644 +--- a/arch/powerpc/mm/book3s32/mmu.c ++++ b/arch/powerpc/mm/book3s32/mmu.c +@@ -159,7 +159,10 @@ unsigned long __init mmu_mapin_ram(unsigned long base, unsigned long top) + { + unsigned long done; + unsigned long border = (unsigned long)__init_begin - PAGE_OFFSET; ++ unsigned long size; + ++ size = roundup_pow_of_two((unsigned long)_einittext - PAGE_OFFSET); ++ setibat(0, PAGE_OFFSET, 0, size, PAGE_KERNEL_X); + + if (debug_pagealloc_enabled_or_kfence() || __map_without_bats) { + pr_debug_once("Read-Write memory mapped without BATs\n"); +@@ -245,10 +248,9 @@ void mmu_mark_rodata_ro(void) + } + + /* +- * Set up one of the I/D BAT (block address translation) register pairs. ++ * Set up one of the D BAT (block address translation) register pairs. + * The parameters are not checked; in particular size must be a power + * of 2 between 128k and 256M. +- * On 603+, only set IBAT when _PAGE_EXEC is set + */ + void __init setbat(int index, unsigned long virt, phys_addr_t phys, + unsigned int size, pgprot_t prot) +@@ -284,10 +286,6 @@ void __init setbat(int index, unsigned long virt, phys_addr_t phys, + /* G bit must be zero in IBATs */ + flags &= ~_PAGE_EXEC; + } +- if (flags & _PAGE_EXEC) +- bat[0] = bat[1]; +- else +- bat[0].batu = bat[0].batl = 0; + + bat_addrs[index].start = virt; + bat_addrs[index].limit = virt + ((bl + 1) << 17) - 1; +-- +2.35.1 + diff --git a/queue-5.19/powerpc-64-init-jump-labels-before-parse_early_param.patch b/queue-5.19/powerpc-64-init-jump-labels-before-parse_early_param.patch new file mode 100644 index 00000000000..461ddfc5245 --- /dev/null +++ b/queue-5.19/powerpc-64-init-jump-labels-before-parse_early_param.patch @@ -0,0 +1,65 @@ +From 3d921c71675b891e4726db58b2b1256dc4f49c4f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Jul 2022 09:57:47 +0800 +Subject: powerpc/64: Init jump labels before parse_early_param() + +From: Zhouyi Zhou + +[ Upstream commit ca829e05d3d4f728810cc5e4b468d9ebc7745eb3 ] + +On 64-bit, calling jump_label_init() in setup_feature_keys() is too +late because static keys may be used in subroutines of +parse_early_param() which is again subroutine of early_init_devtree(). + +For example booting with "threadirqs": + + static_key_enable_cpuslocked(): static key '0xc000000002953260' used before call to jump_label_init() + WARNING: CPU: 0 PID: 0 at kernel/jump_label.c:166 static_key_enable_cpuslocked+0xfc/0x120 + ... + NIP static_key_enable_cpuslocked+0xfc/0x120 + LR static_key_enable_cpuslocked+0xf8/0x120 + Call Trace: + static_key_enable_cpuslocked+0xf8/0x120 (unreliable) + static_key_enable+0x30/0x50 + setup_forced_irqthreads+0x28/0x40 + do_early_param+0xa0/0x108 + parse_args+0x290/0x4e0 + parse_early_options+0x48/0x5c + parse_early_param+0x58/0x84 + early_init_devtree+0xd4/0x518 + early_setup+0xb4/0x214 + +So call jump_label_init() just before parse_early_param() in +early_init_devtree(). + +Suggested-by: Michael Ellerman +Signed-off-by: Zhouyi Zhou +[mpe: Add call trace to change log and minor wording edits.] +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20220726015747.11754-1-zhouzhouyi@gmail.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/prom.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/arch/powerpc/kernel/prom.c b/arch/powerpc/kernel/prom.c +index feae8509b59c..b64c3f06c069 100644 +--- a/arch/powerpc/kernel/prom.c ++++ b/arch/powerpc/kernel/prom.c +@@ -751,6 +751,13 @@ void __init early_init_devtree(void *params) + early_init_dt_scan_root(); + early_init_dt_scan_memory_ppc(); + ++ /* ++ * As generic code authors expect to be able to use static keys ++ * in early_param() handlers, we initialize the static keys just ++ * before parsing early params (it's fine to call jump_label_init() ++ * more than once). ++ */ ++ jump_label_init(); + parse_early_param(); + + /* make sure we've parsed cmdline for mem= before this */ +-- +2.35.1 + diff --git a/queue-5.19/powerpc-ioda-iommu-debugfs-generate-unique-debugfs-e.patch b/queue-5.19/powerpc-ioda-iommu-debugfs-generate-unique-debugfs-e.patch new file mode 100644 index 00000000000..a1fbe3246e8 --- /dev/null +++ b/queue-5.19/powerpc-ioda-iommu-debugfs-generate-unique-debugfs-e.patch @@ -0,0 +1,48 @@ +From 89b6310d05a6d55badaacf306a928798b0add106 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Jul 2022 18:08:00 +1000 +Subject: powerpc/ioda/iommu/debugfs: Generate unique debugfs entries + +From: Alexey Kardashevskiy + +[ Upstream commit d73b46c3c1449bf27f793b9d9ee86ed70c7a7163 ] + +The iommu_table::it_index is a LIOBN which is not initialized on PowerNV +as it is not used except IOMMU debugfs where it is used for a node name. + +This initializes it_index witn a unique number to avoid warnings and +have a node for every iommu_table. + +This should not cause any behavioral change without CONFIG_IOMMU_DEBUGFS. + +Signed-off-by: Alexey Kardashevskiy +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20220714080800.3712998-1-aik@ozlabs.ru +Signed-off-by: Sasha Levin +--- + arch/powerpc/platforms/powernv/pci-ioda.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/powerpc/platforms/powernv/pci-ioda.c b/arch/powerpc/platforms/powernv/pci-ioda.c +index c8cf2728031a..9de9b2fb163d 100644 +--- a/arch/powerpc/platforms/powernv/pci-ioda.c ++++ b/arch/powerpc/platforms/powernv/pci-ioda.c +@@ -1609,6 +1609,7 @@ static void pnv_pci_ioda1_setup_dma_pe(struct pnv_phb *phb, + tbl->it_ops = &pnv_ioda1_iommu_ops; + pe->table_group.tce32_start = tbl->it_offset << tbl->it_page_shift; + pe->table_group.tce32_size = tbl->it_size << tbl->it_page_shift; ++ tbl->it_index = (phb->hose->global_number << 16) | pe->pe_number; + if (!iommu_init_table(tbl, phb->hose->node, 0, 0)) + panic("Failed to initialize iommu table"); + +@@ -1779,6 +1780,7 @@ static long pnv_pci_ioda2_setup_default_config(struct pnv_ioda_pe *pe) + res_end = min(window_size, SZ_4G) >> tbl->it_page_shift; + } + ++ tbl->it_index = (pe->phb->hose->global_number << 16) | pe->pe_number; + if (iommu_init_table(tbl, pe->phb->hose->node, res_start, res_end)) + rc = pnv_pci_ioda2_set_window(&pe->table_group, 0, tbl); + else +-- +2.35.1 + diff --git a/queue-5.19/powerpc-pseries-mobility-set-nmi-watchdog-factor-dur.patch b/queue-5.19/powerpc-pseries-mobility-set-nmi-watchdog-factor-dur.patch new file mode 100644 index 00000000000..3067bfae6db --- /dev/null +++ b/queue-5.19/powerpc-pseries-mobility-set-nmi-watchdog-factor-dur.patch @@ -0,0 +1,141 @@ +From 1a5e0b1b1a00a79dab77a3903ebfa8434b7939c1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Jul 2022 17:47:29 +0200 +Subject: powerpc/pseries/mobility: set NMI watchdog factor during an LPM + +From: Laurent Dufour + +[ Upstream commit 118b1366930c8c833b8b36abef657f40d4e26610 ] + +During an LPM, while the memory transfer is in progress on the arrival +side, some latencies are generated when accessing not yet transferred +pages on the arrival side. Thus, the NMI watchdog may be triggered too +frequently, which increases the risk to hit an NMI interrupt in a bad +place in the kernel, leading to a kernel panic. + +Disabling the Hard Lockup Watchdog until the memory transfer could be a +too strong work around, some users would want this timeout to be +eventually triggered if the system is hanging even during an LPM. + +Introduce a new sysctl variable nmi_watchdog_factor. It allows to apply +a factor to the NMI watchdog timeout during an LPM. Just before the CPUs +are stopped for the switchover sequence, the NMI watchdog timer is set +to watchdog_thresh + factor% + +A value of 0 has no effect. The default value is 200, meaning that the +NMI watchdog is set to 30s during LPM (based on a 10s watchdog_thresh +value). Once the memory transfer is achieved, the factor is reset to 0. + +Setting this value to a high number is like disabling the NMI watchdog +during an LPM. + +Signed-off-by: Laurent Dufour +Reviewed-by: Nicholas Piggin +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20220713154729.80789-5-ldufour@linux.ibm.com +Signed-off-by: Sasha Levin +--- + Documentation/admin-guide/sysctl/kernel.rst | 12 ++++++ + arch/powerpc/platforms/pseries/mobility.c | 43 +++++++++++++++++++++ + 2 files changed, 55 insertions(+) + +diff --git a/Documentation/admin-guide/sysctl/kernel.rst b/Documentation/admin-guide/sysctl/kernel.rst +index ddccd1077462..9b7fa1baf225 100644 +--- a/Documentation/admin-guide/sysctl/kernel.rst ++++ b/Documentation/admin-guide/sysctl/kernel.rst +@@ -592,6 +592,18 @@ to the guest kernel command line (see + Documentation/admin-guide/kernel-parameters.rst). + + ++nmi_wd_lpm_factor (PPC only) ++============================ ++ ++Factor to apply to the NMI watchdog timeout (only when ``nmi_watchdog`` is ++set to 1). This factor represents the percentage added to ++``watchdog_thresh`` when calculating the NMI watchdog timeout during an ++LPM. The soft lockup timeout is not impacted. ++ ++A value of 0 means no change. The default value is 200 meaning the NMI ++watchdog is set to 30s (based on ``watchdog_thresh`` equal to 10). ++ ++ + numa_balancing + ============== + +diff --git a/arch/powerpc/platforms/pseries/mobility.c b/arch/powerpc/platforms/pseries/mobility.c +index 78f3f74c7056..cbe0989239bf 100644 +--- a/arch/powerpc/platforms/pseries/mobility.c ++++ b/arch/powerpc/platforms/pseries/mobility.c +@@ -48,6 +48,39 @@ struct update_props_workarea { + #define MIGRATION_SCOPE (1) + #define PRRN_SCOPE -2 + ++#ifdef CONFIG_PPC_WATCHDOG ++static unsigned int nmi_wd_lpm_factor = 200; ++ ++#ifdef CONFIG_SYSCTL ++static struct ctl_table nmi_wd_lpm_factor_ctl_table[] = { ++ { ++ .procname = "nmi_wd_lpm_factor", ++ .data = &nmi_wd_lpm_factor, ++ .maxlen = sizeof(int), ++ .mode = 0644, ++ .proc_handler = proc_douintvec_minmax, ++ }, ++ {} ++}; ++static struct ctl_table nmi_wd_lpm_factor_sysctl_root[] = { ++ { ++ .procname = "kernel", ++ .mode = 0555, ++ .child = nmi_wd_lpm_factor_ctl_table, ++ }, ++ {} ++}; ++ ++static int __init register_nmi_wd_lpm_factor_sysctl(void) ++{ ++ register_sysctl_table(nmi_wd_lpm_factor_sysctl_root); ++ ++ return 0; ++} ++device_initcall(register_nmi_wd_lpm_factor_sysctl); ++#endif /* CONFIG_SYSCTL */ ++#endif /* CONFIG_PPC_WATCHDOG */ ++ + static int mobility_rtas_call(int token, char *buf, s32 scope) + { + int rc; +@@ -665,19 +698,29 @@ static int pseries_suspend(u64 handle) + static int pseries_migrate_partition(u64 handle) + { + int ret; ++ unsigned int factor = 0; + ++#ifdef CONFIG_PPC_WATCHDOG ++ factor = nmi_wd_lpm_factor; ++#endif + ret = wait_for_vasi_session_suspending(handle); + if (ret) + return ret; + + vas_migration_handler(VAS_SUSPEND); + ++ if (factor) ++ watchdog_nmi_set_timeout_pct(factor); ++ + ret = pseries_suspend(handle); + if (ret == 0) + post_mobility_fixup(); + else + pseries_cancel_migration(handle, ret); + ++ if (factor) ++ watchdog_nmi_set_timeout_pct(0); ++ + vas_migration_handler(VAS_RESUME); + + return ret; +-- +2.35.1 + diff --git a/queue-5.19/powerpc-watchdog-introduce-a-nmi-watchdog-s-factor.patch b/queue-5.19/powerpc-watchdog-introduce-a-nmi-watchdog-s-factor.patch new file mode 100644 index 00000000000..c24cb57eea5 --- /dev/null +++ b/queue-5.19/powerpc-watchdog-introduce-a-nmi-watchdog-s-factor.patch @@ -0,0 +1,89 @@ +From 3d6f38ac6923f55cc7407f72cccc0a4e4a3e30b6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Jul 2022 17:47:28 +0200 +Subject: powerpc/watchdog: introduce a NMI watchdog's factor + +From: Laurent Dufour + +[ Upstream commit f5e74e836097d1004077390717d4bd95d4a2c27a ] + +Introduce a factor which would apply to the NMI watchdog timeout. + +This factor is a percentage added to the watchdog_tresh value. The value is +set under the watchdog_mutex protection and lockup_detector_reconfigure() +is called to recompute wd_panic_timeout_tb. + +Once the factor is set, it remains until it is set back to 0, which means +no impact. + +Signed-off-by: Laurent Dufour +Reviewed-by: Nicholas Piggin +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20220713154729.80789-4-ldufour@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/include/asm/nmi.h | 2 ++ + arch/powerpc/kernel/watchdog.c | 21 ++++++++++++++++++++- + 2 files changed, 22 insertions(+), 1 deletion(-) + +diff --git a/arch/powerpc/include/asm/nmi.h b/arch/powerpc/include/asm/nmi.h +index ea0e487f87b1..c3c7adef74de 100644 +--- a/arch/powerpc/include/asm/nmi.h ++++ b/arch/powerpc/include/asm/nmi.h +@@ -5,8 +5,10 @@ + #ifdef CONFIG_PPC_WATCHDOG + extern void arch_touch_nmi_watchdog(void); + long soft_nmi_interrupt(struct pt_regs *regs); ++void watchdog_nmi_set_timeout_pct(u64 pct); + #else + static inline void arch_touch_nmi_watchdog(void) {} ++static inline void watchdog_nmi_set_timeout_pct(u64 pct) {} + #endif + + #ifdef CONFIG_NMI_IPI +diff --git a/arch/powerpc/kernel/watchdog.c b/arch/powerpc/kernel/watchdog.c +index 7d28b9553654..5d903e63f932 100644 +--- a/arch/powerpc/kernel/watchdog.c ++++ b/arch/powerpc/kernel/watchdog.c +@@ -91,6 +91,10 @@ static cpumask_t wd_smp_cpus_pending; + static cpumask_t wd_smp_cpus_stuck; + static u64 wd_smp_last_reset_tb; + ++#ifdef CONFIG_PPC_PSERIES ++static u64 wd_timeout_pct; ++#endif ++ + /* + * Try to take the exclusive watchdog action / NMI IPI / printing lock. + * wd_smp_lock must be held. If this fails, we should return and wait +@@ -527,7 +531,13 @@ static int stop_watchdog_on_cpu(unsigned int cpu) + + static void watchdog_calc_timeouts(void) + { +- wd_panic_timeout_tb = watchdog_thresh * ppc_tb_freq; ++ u64 threshold = watchdog_thresh; ++ ++#ifdef CONFIG_PPC_PSERIES ++ threshold += (READ_ONCE(wd_timeout_pct) * threshold) / 100; ++#endif ++ ++ wd_panic_timeout_tb = threshold * ppc_tb_freq; + + /* Have the SMP detector trigger a bit later */ + wd_smp_panic_timeout_tb = wd_panic_timeout_tb * 3 / 2; +@@ -570,3 +580,12 @@ int __init watchdog_nmi_probe(void) + } + return 0; + } ++ ++#ifdef CONFIG_PPC_PSERIES ++void watchdog_nmi_set_timeout_pct(u64 pct) ++{ ++ pr_info("Set the NMI watchdog timeout factor to %llu%%\n", pct); ++ WRITE_ONCE(wd_timeout_pct, pct); ++ lockup_detector_reconfigure(); ++} ++#endif +-- +2.35.1 + diff --git a/queue-5.19/rdma-rxe-limit-the-number-of-calls-to-each-tasklet.patch b/queue-5.19/rdma-rxe-limit-the-number-of-calls-to-each-tasklet.patch new file mode 100644 index 00000000000..94c1f47780b --- /dev/null +++ b/queue-5.19/rdma-rxe-limit-the-number-of-calls-to-each-tasklet.patch @@ -0,0 +1,88 @@ +From e9ec2e35fa6f3bf4d016069cbc2f9b9cffd8ccb2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Jun 2022 14:04:25 -0500 +Subject: RDMA/rxe: Limit the number of calls to each tasklet + +From: Bob Pearson + +[ Upstream commit eff6d998ca297cb0b2e53b032a56cf8e04dd8b17 ] + +Limit the maximum number of calls to each tasklet from rxe_do_task() +before yielding the cpu. When the limit is reached reschedule the tasklet +and exit the calling loop. This patch prevents one tasklet from consuming +100% of a cpu core and causing a deadlock or soft lockup. + +Link: https://lore.kernel.org/r/20220630190425.2251-9-rpearsonhpe@gmail.com +Signed-off-by: Bob Pearson +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/rxe/rxe_param.h | 6 ++++++ + drivers/infiniband/sw/rxe/rxe_task.c | 16 ++++++++++++---- + 2 files changed, 18 insertions(+), 4 deletions(-) + +diff --git a/drivers/infiniband/sw/rxe/rxe_param.h b/drivers/infiniband/sw/rxe/rxe_param.h +index 568a7cbd13d4..86c7a8bf3cbb 100644 +--- a/drivers/infiniband/sw/rxe/rxe_param.h ++++ b/drivers/infiniband/sw/rxe/rxe_param.h +@@ -105,6 +105,12 @@ enum rxe_device_param { + RXE_INFLIGHT_SKBS_PER_QP_HIGH = 64, + RXE_INFLIGHT_SKBS_PER_QP_LOW = 16, + ++ /* Max number of interations of each tasklet ++ * before yielding the cpu to let other ++ * work make progress ++ */ ++ RXE_MAX_ITERATIONS = 1024, ++ + /* Delay before calling arbiter timer */ + RXE_NSEC_ARB_TIMER_DELAY = 200, + +diff --git a/drivers/infiniband/sw/rxe/rxe_task.c b/drivers/infiniband/sw/rxe/rxe_task.c +index 0c4db5bb17d7..2248cf33d776 100644 +--- a/drivers/infiniband/sw/rxe/rxe_task.c ++++ b/drivers/infiniband/sw/rxe/rxe_task.c +@@ -8,7 +8,7 @@ + #include + #include + +-#include "rxe_task.h" ++#include "rxe.h" + + int __rxe_do_task(struct rxe_task *task) + +@@ -33,6 +33,7 @@ void rxe_do_task(struct tasklet_struct *t) + int cont; + int ret; + struct rxe_task *task = from_tasklet(task, t, tasklet); ++ unsigned int iterations = RXE_MAX_ITERATIONS; + + spin_lock_bh(&task->state_lock); + switch (task->state) { +@@ -61,13 +62,20 @@ void rxe_do_task(struct tasklet_struct *t) + spin_lock_bh(&task->state_lock); + switch (task->state) { + case TASK_STATE_BUSY: +- if (ret) ++ if (ret) { + task->state = TASK_STATE_START; +- else ++ } else if (iterations--) { + cont = 1; ++ } else { ++ /* reschedule the tasklet and exit ++ * the loop to give up the cpu ++ */ ++ tasklet_schedule(&task->tasklet); ++ task->state = TASK_STATE_START; ++ } + break; + +- /* soneone tried to run the task since the last time we called ++ /* someone tried to run the task since the last time we called + * func, so we will call one more time regardless of the + * return value + */ +-- +2.35.1 + diff --git a/queue-5.19/revert-rdma-rxe-create-duplicate-mapping-tables-for-.patch b/queue-5.19/revert-rdma-rxe-create-duplicate-mapping-tables-for-.patch new file mode 100644 index 00000000000..7bb88461d38 --- /dev/null +++ b/queue-5.19/revert-rdma-rxe-create-duplicate-mapping-tables-for-.patch @@ -0,0 +1,651 @@ +From b1cd217ed16f9c08d58bf36b702e336f1707b38e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Jul 2022 03:16:26 +0000 +Subject: Revert "RDMA/rxe: Create duplicate mapping tables for FMRs" + +From: Li Zhijian + +[ Upstream commit 1e75550648da1fa1cd1969e7597355de8fe8caf6 ] + +Below 2 commits will be reverted: + commit 8ff5f5d9d8cf ("RDMA/rxe: Prevent double freeing rxe_map_set()") + commit 647bf13ce944 ("RDMA/rxe: Create duplicate mapping tables for FMRs") + +The community has a few bug reports which pointed this commit at last. +Some proposals are raised up in the meantime but all of them have no +follow-up operation. + +The previous commit led the map_set of FMR to be not available any more if +the MR is registered again after invalidating. Although the mentioned +patch try to fix a potential race in building/accessing the same table +for fast memory regions, it broke rtrs etc ULPs. Since the latter could +be worse, revert this patch. + +With previous commit, it's observed that a same MR in rnbd server will +trigger below code path: + -> rxe_mr_init_fast() + |-> alloc map_set() # map_set is uninitialized + |...-> rxe_map_mr_sg() # build the map_set + |-> rxe_mr_set_page() + |...-> rxe_reg_fast_mr() # mr->state change to VALID from FREE that means + # we can access host memory(such rxe_mr_copy) + |...-> rxe_invalidate_mr() # mr->state change to FREE from VALID + |...-> rxe_reg_fast_mr() # mr->state change to VALID from FREE, + # but map_set was not built again + |...-> rxe_mr_copy() # kernel crash due to access wild addresses + # that lookup from the map_set + +The backtraces are not always identical. +[1st]---------- + RIP: 0010:lookup_iova+0x66/0xa0 [rdma_rxe] + Code: 00 00 00 48 d3 ee 89 32 c3 4c 8b 18 49 8b 3b 48 8b 47 08 48 39 c6 72 38 48 29 c6 45 31 d2 b8 01 00 00 00 48 63 c8 48 c1 e1 04 <48> 8b 4c 0f 08 48 39 f1 77 21 83 c0 01 48 29 ce 3d 00 01 00 00 75 + RSP: 0018:ffffb7ff80063bf0 EFLAGS: 00010246 + RAX: 0000000000000000 RBX: ffff9b9949d86800 RCX: 0000000000000000 + RDX: ffffb7ff80063c00 RSI: 0000000049f6b378 RDI: 002818da00000004 + RBP: 0000000000000120 R08: ffffb7ff80063c08 R09: ffffb7ff80063c04 + R10: 0000000000000002 R11: ffff9b9916f7eef8 R12: ffff9b99488a0038 + R13: ffff9b99488a0038 R14: ffff9b9914fb346a R15: ffff9b990ab27000 + FS: 0000000000000000(0000) GS:ffff9b997dc00000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 00007efc33a98ed0 CR3: 0000000014f32004 CR4: 00000000001706f0 + DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 + DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 + Call Trace: + + rxe_mr_copy.part.0+0x6f/0x140 [rdma_rxe] + rxe_responder+0x12ee/0x1b60 [rdma_rxe] + ? rxe_icrc_check+0x7e/0x100 [rdma_rxe] + ? rxe_rcv+0x1d0/0x780 [rdma_rxe] + ? rxe_icrc_hdr.isra.0+0xf6/0x160 [rdma_rxe] + rxe_do_task+0x67/0xb0 [rdma_rxe] + rxe_xmit_packet+0xc7/0x210 [rdma_rxe] + rxe_requester+0x680/0xee0 [rdma_rxe] + ? update_load_avg+0x5f/0x690 + ? update_load_avg+0x5f/0x690 + ? rtrs_clt_recv_done+0x1b/0x30 [rtrs_client] + +[2nd]---------- + RIP: 0010:rxe_mr_copy.part.0+0xa8/0x140 [rdma_rxe] + Code: 00 00 49 c1 e7 04 48 8b 00 4c 8d 2c d0 48 8b 44 24 10 4d 03 7d 00 85 ed 7f 10 eb 6c 89 54 24 0c 49 83 c7 10 31 c0 85 ed 7e 5e <49> 8b 3f 8b 14 24 4c 89 f6 48 01 c7 85 d2 74 06 48 89 fe 4c 89 f7 + RSP: 0018:ffffae3580063bf8 EFLAGS: 00010202 + RAX: 0000000000018978 RBX: ffff9d7ef7a03600 RCX: 0000000000000008 + RDX: 000000000000007c RSI: 000000000000007c RDI: ffff9d7ef7a03600 + RBP: 0000000000000120 R08: ffffae3580063c08 R09: ffffae3580063c04 + R10: ffff9d7efece0038 R11: ffff9d7ec4b1db00 R12: ffff9d7efece0038 + R13: ffff9d7ef4098260 R14: ffff9d7f11e23c6a R15: 4c79500065708144 + FS: 0000000000000000(0000) GS:ffff9d7f3dc00000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 00007fce47276c60 CR3: 0000000003f66004 CR4: 00000000001706f0 + DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 + DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 + Call Trace: + + rxe_responder+0x12ee/0x1b60 [rdma_rxe] + ? rxe_icrc_check+0x7e/0x100 [rdma_rxe] + ? rxe_rcv+0x1d0/0x780 [rdma_rxe] + ? rxe_icrc_hdr.isra.0+0xf6/0x160 [rdma_rxe] + rxe_do_task+0x67/0xb0 [rdma_rxe] + rxe_xmit_packet+0xc7/0x210 [rdma_rxe] + rxe_requester+0x680/0xee0 [rdma_rxe] + ? update_load_avg+0x5f/0x690 + ? update_load_avg+0x5f/0x690 + ? rtrs_clt_recv_done+0x1b/0x30 [rtrs_client] + rxe_do_task+0x67/0xb0 [rdma_rxe] + tasklet_action_common.constprop.0+0x92/0xc0 + __do_softirq+0xe1/0x2d8 + run_ksoftirqd+0x21/0x30 + smpboot_thread_fn+0x183/0x220 + ? sort_range+0x20/0x20 + kthread+0xe2/0x110 + ? kthread_complete_and_exit+0x20/0x20 + ret_from_fork+0x22/0x30 + +Link: https://lore.kernel.org/r/1658805386-2-1-git-send-email-lizhijian@fujitsu.com +Link: https://lore.kernel.org/all/20220210073655.42281-1-guoqing.jiang@linux.dev/T/ +Link: https://www.spinics.net/lists/linux-rdma/msg110836.html +Link: https://lore.kernel.org/lkml/94a5ea93-b8bb-3a01-9497-e2021f29598a@linux.dev/t/ +Tested-by: Md Haris Iqbal +Reviewed-by: Bob Pearson +Signed-off-by: Li Zhijian +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/rxe/rxe_loc.h | 1 - + drivers/infiniband/sw/rxe/rxe_mr.c | 199 +++++++++----------------- + drivers/infiniband/sw/rxe/rxe_mw.c | 6 +- + drivers/infiniband/sw/rxe/rxe_verbs.c | 39 +++-- + drivers/infiniband/sw/rxe/rxe_verbs.h | 21 ++- + 5 files changed, 104 insertions(+), 162 deletions(-) + +diff --git a/drivers/infiniband/sw/rxe/rxe_loc.h b/drivers/infiniband/sw/rxe/rxe_loc.h +index 37484a559d20..d86253c6d6b5 100644 +--- a/drivers/infiniband/sw/rxe/rxe_loc.h ++++ b/drivers/infiniband/sw/rxe/rxe_loc.h +@@ -79,7 +79,6 @@ int mr_check_range(struct rxe_mr *mr, u64 iova, size_t length); + int advance_dma_data(struct rxe_dma_info *dma, unsigned int length); + int rxe_invalidate_mr(struct rxe_qp *qp, u32 key); + int rxe_reg_fast_mr(struct rxe_qp *qp, struct rxe_send_wqe *wqe); +-int rxe_mr_set_page(struct ib_mr *ibmr, u64 addr); + int rxe_dereg_mr(struct ib_mr *ibmr, struct ib_udata *udata); + void rxe_mr_cleanup(struct rxe_pool_elem *elem); + +diff --git a/drivers/infiniband/sw/rxe/rxe_mr.c b/drivers/infiniband/sw/rxe/rxe_mr.c +index 3add52129006..c28b18d59a06 100644 +--- a/drivers/infiniband/sw/rxe/rxe_mr.c ++++ b/drivers/infiniband/sw/rxe/rxe_mr.c +@@ -24,7 +24,7 @@ u8 rxe_get_next_key(u32 last_key) + + int mr_check_range(struct rxe_mr *mr, u64 iova, size_t length) + { +- struct rxe_map_set *set = mr->cur_map_set; ++ + + switch (mr->type) { + case IB_MR_TYPE_DMA: +@@ -32,8 +32,8 @@ int mr_check_range(struct rxe_mr *mr, u64 iova, size_t length) + + case IB_MR_TYPE_USER: + case IB_MR_TYPE_MEM_REG: +- if (iova < set->iova || length > set->length || +- iova > set->iova + set->length - length) ++ if (iova < mr->iova || length > mr->length || ++ iova > mr->iova + mr->length - length) + return -EFAULT; + return 0; + +@@ -65,89 +65,41 @@ static void rxe_mr_init(int access, struct rxe_mr *mr) + mr->map_shift = ilog2(RXE_BUF_PER_MAP); + } + +-static void rxe_mr_free_map_set(int num_map, struct rxe_map_set *set) +-{ +- int i; +- +- for (i = 0; i < num_map; i++) +- kfree(set->map[i]); +- +- kfree(set->map); +- kfree(set); +-} +- +-static int rxe_mr_alloc_map_set(int num_map, struct rxe_map_set **setp) ++static int rxe_mr_alloc(struct rxe_mr *mr, int num_buf) + { + int i; +- struct rxe_map_set *set; ++ int num_map; ++ struct rxe_map **map = mr->map; + +- set = kmalloc(sizeof(*set), GFP_KERNEL); +- if (!set) +- goto err_out; ++ num_map = (num_buf + RXE_BUF_PER_MAP - 1) / RXE_BUF_PER_MAP; + +- set->map = kmalloc_array(num_map, sizeof(struct rxe_map *), GFP_KERNEL); +- if (!set->map) +- goto err_free_set; ++ mr->map = kmalloc_array(num_map, sizeof(*map), GFP_KERNEL); ++ if (!mr->map) ++ goto err1; + + for (i = 0; i < num_map; i++) { +- set->map[i] = kmalloc(sizeof(struct rxe_map), GFP_KERNEL); +- if (!set->map[i]) +- goto err_free_map; ++ mr->map[i] = kmalloc(sizeof(**map), GFP_KERNEL); ++ if (!mr->map[i]) ++ goto err2; + } + +- *setp = set; +- +- return 0; +- +-err_free_map: +- for (i--; i >= 0; i--) +- kfree(set->map[i]); +- +- kfree(set->map); +-err_free_set: +- kfree(set); +-err_out: +- return -ENOMEM; +-} +- +-/** +- * rxe_mr_alloc() - Allocate memory map array(s) for MR +- * @mr: Memory region +- * @num_buf: Number of buffer descriptors to support +- * @both: If non zero allocate both mr->map and mr->next_map +- * else just allocate mr->map. Used for fast MRs +- * +- * Return: 0 on success else an error +- */ +-static int rxe_mr_alloc(struct rxe_mr *mr, int num_buf, int both) +-{ +- int ret; +- int num_map; +- + BUILD_BUG_ON(!is_power_of_2(RXE_BUF_PER_MAP)); +- num_map = (num_buf + RXE_BUF_PER_MAP - 1) / RXE_BUF_PER_MAP; + + mr->map_shift = ilog2(RXE_BUF_PER_MAP); + mr->map_mask = RXE_BUF_PER_MAP - 1; ++ + mr->num_buf = num_buf; +- mr->max_buf = num_map * RXE_BUF_PER_MAP; + mr->num_map = num_map; +- +- ret = rxe_mr_alloc_map_set(num_map, &mr->cur_map_set); +- if (ret) +- return -ENOMEM; +- +- if (both) { +- ret = rxe_mr_alloc_map_set(num_map, &mr->next_map_set); +- if (ret) +- goto err_free; +- } ++ mr->max_buf = num_map * RXE_BUF_PER_MAP; + + return 0; + +-err_free: +- rxe_mr_free_map_set(mr->num_map, mr->cur_map_set); +- mr->cur_map_set = NULL; ++err2: ++ for (i--; i >= 0; i--) ++ kfree(mr->map[i]); ++ ++ kfree(mr->map); ++err1: + return -ENOMEM; + } + +@@ -164,7 +116,6 @@ void rxe_mr_init_dma(struct rxe_pd *pd, int access, struct rxe_mr *mr) + int rxe_mr_init_user(struct rxe_pd *pd, u64 start, u64 length, u64 iova, + int access, struct rxe_mr *mr) + { +- struct rxe_map_set *set; + struct rxe_map **map; + struct rxe_phys_buf *buf = NULL; + struct ib_umem *umem; +@@ -172,6 +123,7 @@ int rxe_mr_init_user(struct rxe_pd *pd, u64 start, u64 length, u64 iova, + int num_buf; + void *vaddr; + int err; ++ int i; + + umem = ib_umem_get(pd->ibpd.device, start, length, access); + if (IS_ERR(umem)) { +@@ -185,20 +137,18 @@ int rxe_mr_init_user(struct rxe_pd *pd, u64 start, u64 length, u64 iova, + + rxe_mr_init(access, mr); + +- err = rxe_mr_alloc(mr, num_buf, 0); ++ err = rxe_mr_alloc(mr, num_buf); + if (err) { + pr_warn("%s: Unable to allocate memory for map\n", + __func__); + goto err_release_umem; + } + +- set = mr->cur_map_set; +- set->page_shift = PAGE_SHIFT; +- set->page_mask = PAGE_SIZE - 1; +- +- num_buf = 0; +- map = set->map; ++ mr->page_shift = PAGE_SHIFT; ++ mr->page_mask = PAGE_SIZE - 1; + ++ num_buf = 0; ++ map = mr->map; + if (length > 0) { + buf = map[0]->buf; + +@@ -214,29 +164,33 @@ int rxe_mr_init_user(struct rxe_pd *pd, u64 start, u64 length, u64 iova, + pr_warn("%s: Unable to get virtual address\n", + __func__); + err = -ENOMEM; +- goto err_release_umem; ++ goto err_cleanup_map; + } + + buf->addr = (uintptr_t)vaddr; + buf->size = PAGE_SIZE; + num_buf++; + buf++; ++ + } + } + + mr->ibmr.pd = &pd->ibpd; + mr->umem = umem; + mr->access = access; ++ mr->length = length; ++ mr->iova = iova; ++ mr->va = start; ++ mr->offset = ib_umem_offset(umem); + mr->state = RXE_MR_STATE_VALID; + mr->type = IB_MR_TYPE_USER; + +- set->length = length; +- set->iova = iova; +- set->va = start; +- set->offset = ib_umem_offset(umem); +- + return 0; + ++err_cleanup_map: ++ for (i = 0; i < mr->num_map; i++) ++ kfree(mr->map[i]); ++ kfree(mr->map); + err_release_umem: + ib_umem_release(umem); + err_out: +@@ -250,7 +204,7 @@ int rxe_mr_init_fast(struct rxe_pd *pd, int max_pages, struct rxe_mr *mr) + /* always allow remote access for FMRs */ + rxe_mr_init(IB_ACCESS_REMOTE, mr); + +- err = rxe_mr_alloc(mr, max_pages, 1); ++ err = rxe_mr_alloc(mr, max_pages); + if (err) + goto err1; + +@@ -268,24 +222,21 @@ int rxe_mr_init_fast(struct rxe_pd *pd, int max_pages, struct rxe_mr *mr) + static void lookup_iova(struct rxe_mr *mr, u64 iova, int *m_out, int *n_out, + size_t *offset_out) + { +- struct rxe_map_set *set = mr->cur_map_set; +- size_t offset = iova - set->iova + set->offset; ++ size_t offset = iova - mr->iova + mr->offset; + int map_index; + int buf_index; + u64 length; +- struct rxe_map *map; + +- if (likely(set->page_shift)) { +- *offset_out = offset & set->page_mask; +- offset >>= set->page_shift; ++ if (likely(mr->page_shift)) { ++ *offset_out = offset & mr->page_mask; ++ offset >>= mr->page_shift; + *n_out = offset & mr->map_mask; + *m_out = offset >> mr->map_shift; + } else { + map_index = 0; + buf_index = 0; + +- map = set->map[map_index]; +- length = map->buf[buf_index].size; ++ length = mr->map[map_index]->buf[buf_index].size; + + while (offset >= length) { + offset -= length; +@@ -295,8 +246,7 @@ static void lookup_iova(struct rxe_mr *mr, u64 iova, int *m_out, int *n_out, + map_index++; + buf_index = 0; + } +- map = set->map[map_index]; +- length = map->buf[buf_index].size; ++ length = mr->map[map_index]->buf[buf_index].size; + } + + *m_out = map_index; +@@ -317,7 +267,7 @@ void *iova_to_vaddr(struct rxe_mr *mr, u64 iova, int length) + goto out; + } + +- if (!mr->cur_map_set) { ++ if (!mr->map) { + addr = (void *)(uintptr_t)iova; + goto out; + } +@@ -330,13 +280,13 @@ void *iova_to_vaddr(struct rxe_mr *mr, u64 iova, int length) + + lookup_iova(mr, iova, &m, &n, &offset); + +- if (offset + length > mr->cur_map_set->map[m]->buf[n].size) { ++ if (offset + length > mr->map[m]->buf[n].size) { + pr_warn("crosses page boundary\n"); + addr = NULL; + goto out; + } + +- addr = (void *)(uintptr_t)mr->cur_map_set->map[m]->buf[n].addr + offset; ++ addr = (void *)(uintptr_t)mr->map[m]->buf[n].addr + offset; + + out: + return addr; +@@ -372,7 +322,7 @@ int rxe_mr_copy(struct rxe_mr *mr, u64 iova, void *addr, int length, + return 0; + } + +- WARN_ON_ONCE(!mr->cur_map_set); ++ WARN_ON_ONCE(!mr->map); + + err = mr_check_range(mr, iova, length); + if (err) { +@@ -382,7 +332,7 @@ int rxe_mr_copy(struct rxe_mr *mr, u64 iova, void *addr, int length, + + lookup_iova(mr, iova, &m, &i, &offset); + +- map = mr->cur_map_set->map + m; ++ map = mr->map + m; + buf = map[0]->buf + i; + + while (length > 0) { +@@ -628,9 +578,8 @@ int rxe_invalidate_mr(struct rxe_qp *qp, u32 key) + int rxe_reg_fast_mr(struct rxe_qp *qp, struct rxe_send_wqe *wqe) + { + struct rxe_mr *mr = to_rmr(wqe->wr.wr.reg.mr); +- u32 key = wqe->wr.wr.reg.key & 0xff; ++ u32 key = wqe->wr.wr.reg.key; + u32 access = wqe->wr.wr.reg.access; +- struct rxe_map_set *set; + + /* user can only register MR in free state */ + if (unlikely(mr->state != RXE_MR_STATE_FREE)) { +@@ -646,36 +595,19 @@ int rxe_reg_fast_mr(struct rxe_qp *qp, struct rxe_send_wqe *wqe) + return -EINVAL; + } + ++ /* user is only allowed to change key portion of l/rkey */ ++ if (unlikely((mr->lkey & ~0xff) != (key & ~0xff))) { ++ pr_warn("%s: key = 0x%x has wrong index mr->lkey = 0x%x\n", ++ __func__, key, mr->lkey); ++ return -EINVAL; ++ } ++ + mr->access = access; +- mr->lkey = (mr->lkey & ~0xff) | key; +- mr->rkey = (access & IB_ACCESS_REMOTE) ? mr->lkey : 0; ++ mr->lkey = key; ++ mr->rkey = (access & IB_ACCESS_REMOTE) ? key : 0; ++ mr->iova = wqe->wr.wr.reg.mr->iova; + mr->state = RXE_MR_STATE_VALID; + +- set = mr->cur_map_set; +- mr->cur_map_set = mr->next_map_set; +- mr->cur_map_set->iova = wqe->wr.wr.reg.mr->iova; +- mr->next_map_set = set; +- +- return 0; +-} +- +-int rxe_mr_set_page(struct ib_mr *ibmr, u64 addr) +-{ +- struct rxe_mr *mr = to_rmr(ibmr); +- struct rxe_map_set *set = mr->next_map_set; +- struct rxe_map *map; +- struct rxe_phys_buf *buf; +- +- if (unlikely(set->nbuf == mr->num_buf)) +- return -ENOMEM; +- +- map = set->map[set->nbuf / RXE_BUF_PER_MAP]; +- buf = &map->buf[set->nbuf % RXE_BUF_PER_MAP]; +- +- buf->addr = addr; +- buf->size = ibmr->page_size; +- set->nbuf++; +- + return 0; + } + +@@ -695,14 +627,15 @@ int rxe_dereg_mr(struct ib_mr *ibmr, struct ib_udata *udata) + void rxe_mr_cleanup(struct rxe_pool_elem *elem) + { + struct rxe_mr *mr = container_of(elem, typeof(*mr), elem); ++ int i; + + rxe_put(mr_pd(mr)); +- + ib_umem_release(mr->umem); + +- if (mr->cur_map_set) +- rxe_mr_free_map_set(mr->num_map, mr->cur_map_set); ++ if (mr->map) { ++ for (i = 0; i < mr->num_map; i++) ++ kfree(mr->map[i]); + +- if (mr->next_map_set) +- rxe_mr_free_map_set(mr->num_map, mr->next_map_set); ++ kfree(mr->map); ++ } + } +diff --git a/drivers/infiniband/sw/rxe/rxe_mw.c b/drivers/infiniband/sw/rxe/rxe_mw.c +index 824739008d5b..6c24bc4318e8 100644 +--- a/drivers/infiniband/sw/rxe/rxe_mw.c ++++ b/drivers/infiniband/sw/rxe/rxe_mw.c +@@ -112,15 +112,15 @@ static int rxe_check_bind_mw(struct rxe_qp *qp, struct rxe_send_wqe *wqe, + + /* C10-75 */ + if (mw->access & IB_ZERO_BASED) { +- if (unlikely(wqe->wr.wr.mw.length > mr->cur_map_set->length)) { ++ if (unlikely(wqe->wr.wr.mw.length > mr->length)) { + pr_err_once( + "attempt to bind a ZB MW outside of the MR\n"); + return -EINVAL; + } + } else { +- if (unlikely((wqe->wr.wr.mw.addr < mr->cur_map_set->iova) || ++ if (unlikely((wqe->wr.wr.mw.addr < mr->iova) || + ((wqe->wr.wr.mw.addr + wqe->wr.wr.mw.length) > +- (mr->cur_map_set->iova + mr->cur_map_set->length)))) { ++ (mr->iova + mr->length)))) { + pr_err_once( + "attempt to bind a VA MW outside of the MR\n"); + return -EINVAL; +diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.c b/drivers/infiniband/sw/rxe/rxe_verbs.c +index 9d995854a174..d2b4e68402d4 100644 +--- a/drivers/infiniband/sw/rxe/rxe_verbs.c ++++ b/drivers/infiniband/sw/rxe/rxe_verbs.c +@@ -967,26 +967,41 @@ static struct ib_mr *rxe_alloc_mr(struct ib_pd *ibpd, enum ib_mr_type mr_type, + return ERR_PTR(err); + } + +-/* build next_map_set from scatterlist +- * The IB_WR_REG_MR WR will swap map_sets +- */ ++static int rxe_set_page(struct ib_mr *ibmr, u64 addr) ++{ ++ struct rxe_mr *mr = to_rmr(ibmr); ++ struct rxe_map *map; ++ struct rxe_phys_buf *buf; ++ ++ if (unlikely(mr->nbuf == mr->num_buf)) ++ return -ENOMEM; ++ ++ map = mr->map[mr->nbuf / RXE_BUF_PER_MAP]; ++ buf = &map->buf[mr->nbuf % RXE_BUF_PER_MAP]; ++ ++ buf->addr = addr; ++ buf->size = ibmr->page_size; ++ mr->nbuf++; ++ ++ return 0; ++} ++ + static int rxe_map_mr_sg(struct ib_mr *ibmr, struct scatterlist *sg, + int sg_nents, unsigned int *sg_offset) + { + struct rxe_mr *mr = to_rmr(ibmr); +- struct rxe_map_set *set = mr->next_map_set; + int n; + +- set->nbuf = 0; ++ mr->nbuf = 0; + +- n = ib_sg_to_pages(ibmr, sg, sg_nents, sg_offset, rxe_mr_set_page); ++ n = ib_sg_to_pages(ibmr, sg, sg_nents, sg_offset, rxe_set_page); + +- set->va = ibmr->iova; +- set->iova = ibmr->iova; +- set->length = ibmr->length; +- set->page_shift = ilog2(ibmr->page_size); +- set->page_mask = ibmr->page_size - 1; +- set->offset = set->iova & set->page_mask; ++ mr->va = ibmr->iova; ++ mr->iova = ibmr->iova; ++ mr->length = ibmr->length; ++ mr->page_shift = ilog2(ibmr->page_size); ++ mr->page_mask = ibmr->page_size - 1; ++ mr->offset = mr->iova & mr->page_mask; + + return n; + } +diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.h b/drivers/infiniband/sw/rxe/rxe_verbs.h +index 9bdf33346511..3d524238e5c4 100644 +--- a/drivers/infiniband/sw/rxe/rxe_verbs.h ++++ b/drivers/infiniband/sw/rxe/rxe_verbs.h +@@ -289,17 +289,6 @@ struct rxe_map { + struct rxe_phys_buf buf[RXE_BUF_PER_MAP]; + }; + +-struct rxe_map_set { +- struct rxe_map **map; +- u64 va; +- u64 iova; +- size_t length; +- u32 offset; +- u32 nbuf; +- int page_shift; +- int page_mask; +-}; +- + static inline int rkey_is_mw(u32 rkey) + { + u32 index = rkey >> 8; +@@ -317,20 +306,26 @@ struct rxe_mr { + u32 rkey; + enum rxe_mr_state state; + enum ib_mr_type type; ++ u64 va; ++ u64 iova; ++ size_t length; ++ u32 offset; + int access; + ++ int page_shift; ++ int page_mask; + int map_shift; + int map_mask; + + u32 num_buf; ++ u32 nbuf; + + u32 max_buf; + u32 num_map; + + atomic_t num_mw; + +- struct rxe_map_set *cur_map_set; +- struct rxe_map_set *next_map_set; ++ struct rxe_map **map; + }; + + enum rxe_mw_state { +-- +2.35.1 + diff --git a/queue-5.19/risc-v-add-fast-call-path-of-crash_kexec.patch b/queue-5.19/risc-v-add-fast-call-path-of-crash_kexec.patch new file mode 100644 index 00000000000..9fbbfeac31a --- /dev/null +++ b/queue-5.19/risc-v-add-fast-call-path-of-crash_kexec.patch @@ -0,0 +1,73 @@ +From d847e4279a89042b82956333338ab5e499a18010 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Jun 2022 16:23:08 +0800 +Subject: RISC-V: Add fast call path of crash_kexec() + +From: Xianting Tian + +[ Upstream commit 3f1901110a89b0e2e13adb2ac8d1a7102879ea98 ] + +Currently, almost all archs (x86, arm64, mips...) support fast call +of crash_kexec() when "regs && kexec_should_crash()" is true. But +RISC-V not, it can only enter crash system via panic(). However panic() +doesn't pass the regs of the real accident scene to crash_kexec(), +it caused we can't get accurate backtrace via gdb, + $ riscv64-linux-gnu-gdb vmlinux vmcore + Reading symbols from vmlinux... + [New LWP 95] + #0 console_unlock () at kernel/printk/printk.c:2557 + 2557 if (do_cond_resched) + (gdb) bt + #0 console_unlock () at kernel/printk/printk.c:2557 + #1 0x0000000000000000 in ?? () + +With the patch we can get the accurate backtrace, + $ riscv64-linux-gnu-gdb vmlinux vmcore + Reading symbols from vmlinux... + [New LWP 95] + #0 0xffffffe00063a4e0 in test_thread (data=) at drivers/test_crash.c:81 + 81 *(int *)p = 0xdead; + (gdb) + (gdb) bt + #0 0xffffffe00064d5c0 in test_thread (data=) at drivers/test_crash.c:81 + #1 0x0000000000000000 in ?? () + +Test code to produce NULL address dereference in test_crash.c, + void *p = NULL; + *(int *)p = 0xdead; + +Reviewed-by: Guo Ren +Tested-by: Xianting Tian +Signed-off-by: Xianting Tian +Link: https://lore.kernel.org/r/20220606082308.2883458-1-xianting.tian@linux.alibaba.com +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + arch/riscv/kernel/traps.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/arch/riscv/kernel/traps.c b/arch/riscv/kernel/traps.c +index b40426509244..39d0f8bba4b4 100644 +--- a/arch/riscv/kernel/traps.c ++++ b/arch/riscv/kernel/traps.c +@@ -16,6 +16,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -44,6 +45,9 @@ void die(struct pt_regs *regs, const char *str) + + ret = notify_die(DIE_OOPS, str, regs, 0, regs->cause, SIGSEGV); + ++ if (regs && kexec_should_crash(current)) ++ crash_kexec(regs); ++ + bust_spinlocks(0); + add_taint(TAINT_DIE, LOCKDEP_NOW_UNRELIABLE); + spin_unlock_irq(&die_lock); +-- +2.35.1 + diff --git a/queue-5.19/riscv-dts-canaan-add-k210-topology-information.patch b/queue-5.19/riscv-dts-canaan-add-k210-topology-information.patch new file mode 100644 index 00000000000..c2270abdf88 --- /dev/null +++ b/queue-5.19/riscv-dts-canaan-add-k210-topology-information.patch @@ -0,0 +1,49 @@ +From 07a757b5156c56daa0464fb46eff1bc582a02da9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Jul 2022 20:04:36 +0100 +Subject: riscv: dts: canaan: Add k210 topology information + +From: Conor Dooley + +[ Upstream commit d9d193dea8666bbf69fc21c5bdcdabaa34a466e3 ] + +The k210 has no cpu-map node, so tools like hwloc cannot correctly +parse the topology. Add the node using the existing node labels. + +Reported-by: Brice Goglin +Link: https://github.com/open-mpi/hwloc/issues/536 +Signed-off-by: Conor Dooley +Reviewed-by: Damien Le Moal +Link: https://lore.kernel.org/r/20220705190435.1790466-6-mail@conchuod.ie +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + arch/riscv/boot/dts/canaan/k210.dtsi | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/arch/riscv/boot/dts/canaan/k210.dtsi b/arch/riscv/boot/dts/canaan/k210.dtsi +index 44d338514761..ec944d1537dc 100644 +--- a/arch/riscv/boot/dts/canaan/k210.dtsi ++++ b/arch/riscv/boot/dts/canaan/k210.dtsi +@@ -65,6 +65,18 @@ + compatible = "riscv,cpu-intc"; + }; + }; ++ ++ cpu-map { ++ cluster0 { ++ core0 { ++ cpu = <&cpu0>; ++ }; ++ ++ core1 { ++ cpu = <&cpu1>; ++ }; ++ }; ++ }; + }; + + sram: memory@80000000 { +-- +2.35.1 + diff --git a/queue-5.19/riscv-dts-sifive-add-fu540-topology-information.patch b/queue-5.19/riscv-dts-sifive-add-fu540-topology-information.patch new file mode 100644 index 00000000000..ffe29c48808 --- /dev/null +++ b/queue-5.19/riscv-dts-sifive-add-fu540-topology-information.patch @@ -0,0 +1,60 @@ +From 58273c019874f786105c5cb914c2cf6d702f3408 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Jul 2022 20:04:33 +0100 +Subject: riscv: dts: sifive: Add fu540 topology information + +From: Conor Dooley + +[ Upstream commit af8f260abc608c06e4466a282b53f1e2dc09f042 ] + +The fu540 has no cpu-map node, so tools like hwloc cannot correctly +parse the topology. Add the node using the existing node labels. + +Reported-by: Brice Goglin +Link: https://github.com/open-mpi/hwloc/issues/536 +Signed-off-by: Conor Dooley +Link: https://lore.kernel.org/r/20220705190435.1790466-3-mail@conchuod.ie +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + arch/riscv/boot/dts/sifive/fu540-c000.dtsi | 24 ++++++++++++++++++++++ + 1 file changed, 24 insertions(+) + +diff --git a/arch/riscv/boot/dts/sifive/fu540-c000.dtsi b/arch/riscv/boot/dts/sifive/fu540-c000.dtsi +index e3172d0ffac4..24bba83bec77 100644 +--- a/arch/riscv/boot/dts/sifive/fu540-c000.dtsi ++++ b/arch/riscv/boot/dts/sifive/fu540-c000.dtsi +@@ -133,6 +133,30 @@ + interrupt-controller; + }; + }; ++ ++ cpu-map { ++ cluster0 { ++ core0 { ++ cpu = <&cpu0>; ++ }; ++ ++ core1 { ++ cpu = <&cpu1>; ++ }; ++ ++ core2 { ++ cpu = <&cpu2>; ++ }; ++ ++ core3 { ++ cpu = <&cpu3>; ++ }; ++ ++ core4 { ++ cpu = <&cpu4>; ++ }; ++ }; ++ }; + }; + soc { + #address-cells = <2>; +-- +2.35.1 + diff --git a/queue-5.19/riscv-dts-sifive-add-fu740-topology-information.patch b/queue-5.19/riscv-dts-sifive-add-fu740-topology-information.patch new file mode 100644 index 00000000000..240e9e92386 --- /dev/null +++ b/queue-5.19/riscv-dts-sifive-add-fu740-topology-information.patch @@ -0,0 +1,60 @@ +From 8ddefa7540c98f8937bae935b1616028e8484844 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Jul 2022 20:04:34 +0100 +Subject: riscv: dts: sifive: Add fu740 topology information + +From: Conor Dooley + +[ Upstream commit bf6cd1c01c959a31002dfa6784c0d8caffed4cf1 ] + +The fu740 has no cpu-map node, so tools like hwloc cannot correctly +parse the topology. Add the node using the existing node labels. + +Reported-by: Brice Goglin +Link: https://github.com/open-mpi/hwloc/issues/536 +Signed-off-by: Conor Dooley +Link: https://lore.kernel.org/r/20220705190435.1790466-4-mail@conchuod.ie +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + arch/riscv/boot/dts/sifive/fu740-c000.dtsi | 24 ++++++++++++++++++++++ + 1 file changed, 24 insertions(+) + +diff --git a/arch/riscv/boot/dts/sifive/fu740-c000.dtsi b/arch/riscv/boot/dts/sifive/fu740-c000.dtsi +index 7b77c13496d8..43bed6c0a84f 100644 +--- a/arch/riscv/boot/dts/sifive/fu740-c000.dtsi ++++ b/arch/riscv/boot/dts/sifive/fu740-c000.dtsi +@@ -134,6 +134,30 @@ + interrupt-controller; + }; + }; ++ ++ cpu-map { ++ cluster0 { ++ core0 { ++ cpu = <&cpu0>; ++ }; ++ ++ core1 { ++ cpu = <&cpu1>; ++ }; ++ ++ core2 { ++ cpu = <&cpu2>; ++ }; ++ ++ core3 { ++ cpu = <&cpu3>; ++ }; ++ ++ core4 { ++ cpu = <&cpu4>; ++ }; ++ }; ++ }; + }; + soc { + #address-cells = <2>; +-- +2.35.1 + diff --git a/queue-5.19/riscv-mmap-with-prot_write-but-no-prot_read-is-inval.patch b/queue-5.19/riscv-mmap-with-prot_write-but-no-prot_read-is-inval.patch new file mode 100644 index 00000000000..ccb6bf431c7 --- /dev/null +++ b/queue-5.19/riscv-mmap-with-prot_write-but-no-prot_read-is-inval.patch @@ -0,0 +1,47 @@ +From e7f16a387a2cecc92614fa4cecf85ed8c6021c2c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 May 2022 15:56:52 +0800 +Subject: riscv: mmap with PROT_WRITE but no PROT_READ is invalid + +From: Celeste Liu + +[ Upstream commit 2139619bcad7ac44cc8f6f749089120594056613 ] + +As mentioned in Table 4.5 in RISC-V spec Volume 2 Section 4.3, write +but not read is "Reserved for future use.". For now, they are not valid. +In the current code, -wx is marked as invalid, but -w- is not marked +as invalid. +This patch refines that judgment. + +Reported-by: xctan +Co-developed-by: dram +Signed-off-by: dram +Co-developed-by: Ruizhe Pan +Signed-off-by: Ruizhe Pan +Signed-off-by: Celeste Liu +Link: https://lore.kernel.org/r/PH7PR14MB559464DBDD310E755F5B21E8CEDC9@PH7PR14MB5594.namprd14.prod.outlook.com +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + arch/riscv/kernel/sys_riscv.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/arch/riscv/kernel/sys_riscv.c b/arch/riscv/kernel/sys_riscv.c +index 9c0194f176fc..571556bb9261 100644 +--- a/arch/riscv/kernel/sys_riscv.c ++++ b/arch/riscv/kernel/sys_riscv.c +@@ -18,9 +18,8 @@ static long riscv_sys_mmap(unsigned long addr, unsigned long len, + if (unlikely(offset & (~PAGE_MASK >> page_shift_offset))) + return -EINVAL; + +- if ((prot & PROT_WRITE) && (prot & PROT_EXEC)) +- if (unlikely(!(prot & PROT_READ))) +- return -EINVAL; ++ if (unlikely((prot & PROT_WRITE) && !(prot & PROT_READ))) ++ return -EINVAL; + + return ksys_mmap_pgoff(addr, len, prot, flags, fd, + offset >> (PAGE_SHIFT - page_shift_offset)); +-- +2.35.1 + diff --git a/queue-5.19/scsi-iscsi-fix-hw-conn-removal-use-after-free.patch b/queue-5.19/scsi-iscsi-fix-hw-conn-removal-use-after-free.patch new file mode 100644 index 00000000000..c643dc54d3b --- /dev/null +++ b/queue-5.19/scsi-iscsi-fix-hw-conn-removal-use-after-free.patch @@ -0,0 +1,41 @@ +From 6f1e028b9437bcd78a763dd04b0bd59876fdbe9e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Jun 2022 17:27:33 -0500 +Subject: scsi: iscsi: Fix HW conn removal use after free + +From: Mike Christie + +[ Upstream commit c577ab7ba5f3bf9062db8a58b6e89d4fe370447e ] + +If qla4xxx doesn't remove the connection before the session, the iSCSI +class tries to remove the connection for it. We were doing a +iscsi_put_conn() in the iter function which is not needed and will result +in a use after free because iscsi_remove_conn() will free the connection. + +Link: https://lore.kernel.org/r/20220616222738.5722-2-michael.christie@oracle.com +Tested-by: Nilesh Javali +Reviewed-by: Lee Duncan +Reviewed-by: Nilesh Javali +Signed-off-by: Mike Christie +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/scsi_transport_iscsi.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c +index 2a38cd2d24ef..02899e8849dd 100644 +--- a/drivers/scsi/scsi_transport_iscsi.c ++++ b/drivers/scsi/scsi_transport_iscsi.c +@@ -2143,8 +2143,6 @@ static int iscsi_iter_destroy_conn_fn(struct device *dev, void *data) + return 0; + + iscsi_remove_conn(iscsi_dev_to_conn(dev)); +- iscsi_put_conn(iscsi_dev_to_conn(dev)); +- + return 0; + } + +-- +2.35.1 + diff --git a/queue-5.19/scsi-lpfc-fix-possible-memory-leak-when-failing-to-i.patch b/queue-5.19/scsi-lpfc-fix-possible-memory-leak-when-failing-to-i.patch new file mode 100644 index 00000000000..b445e4e1fe5 --- /dev/null +++ b/queue-5.19/scsi-lpfc-fix-possible-memory-leak-when-failing-to-i.patch @@ -0,0 +1,45 @@ +From b98cdb5d1a7158cb2581f86bfc9b93000ef45c8d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Jul 2022 14:14:18 -0700 +Subject: scsi: lpfc: Fix possible memory leak when failing to issue CMF WQE + +From: James Smart + +[ Upstream commit 2f67dc7970bce3529edce93a0a14234d88b3fcd5 ] + +There is no corresponding free routine if lpfc_sli4_issue_wqe fails to +issue the CMF WQE in lpfc_issue_cmf_sync_wqe. + +If ret_val is non-zero, then free the iocbq request structure. + +Link: https://lore.kernel.org/r/20220701211425.2708-6-jsmart2021@gmail.com +Co-developed-by: Justin Tee +Signed-off-by: Justin Tee +Signed-off-by: James Smart +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/lpfc/lpfc_sli.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c +index 80ac3a051c19..e2127e85ff32 100644 +--- a/drivers/scsi/lpfc/lpfc_sli.c ++++ b/drivers/scsi/lpfc/lpfc_sli.c +@@ -2003,10 +2003,12 @@ lpfc_issue_cmf_sync_wqe(struct lpfc_hba *phba, u32 ms, u64 total) + + sync_buf->cmd_flag |= LPFC_IO_CMF; + ret_val = lpfc_sli4_issue_wqe(phba, &phba->sli4_hba.hdwq[0], sync_buf); +- if (ret_val) ++ if (ret_val) { + lpfc_printf_log(phba, KERN_INFO, LOG_CGN_MGMT, + "6214 Cannot issue CMF_SYNC_WQE: x%x\n", + ret_val); ++ __lpfc_sli_release_iocbq(phba, sync_buf); ++ } + out_unlock: + spin_unlock_irqrestore(&phba->hbalock, iflags); + return ret_val; +-- +2.35.1 + diff --git a/queue-5.19/scsi-lpfc-prevent-buffer-overflow-crashes-in-debugfs.patch b/queue-5.19/scsi-lpfc-prevent-buffer-overflow-crashes-in-debugfs.patch new file mode 100644 index 00000000000..9e8891c7d97 --- /dev/null +++ b/queue-5.19/scsi-lpfc-prevent-buffer-overflow-crashes-in-debugfs.patch @@ -0,0 +1,86 @@ +From 52ba92f3a3e55cf3d2716a6e0d84672e062a08bf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Jul 2022 14:14:15 -0700 +Subject: scsi: lpfc: Prevent buffer overflow crashes in debugfs with malformed + user input + +From: James Smart + +[ Upstream commit f8191d40aa612981ce897e66cda6a88db8df17bb ] + +Malformed user input to debugfs results in buffer overflow crashes. Adapt +input string lengths to fit within internal buffers, leaving space for NULL +terminators. + +Link: https://lore.kernel.org/r/20220701211425.2708-3-jsmart2021@gmail.com +Co-developed-by: Justin Tee +Signed-off-by: Justin Tee +Signed-off-by: James Smart +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/lpfc/lpfc_debugfs.c | 20 ++++++++++---------- + 1 file changed, 10 insertions(+), 10 deletions(-) + +diff --git a/drivers/scsi/lpfc/lpfc_debugfs.c b/drivers/scsi/lpfc/lpfc_debugfs.c +index 7b24c932e812..25deacc92b02 100644 +--- a/drivers/scsi/lpfc/lpfc_debugfs.c ++++ b/drivers/scsi/lpfc/lpfc_debugfs.c +@@ -2607,8 +2607,8 @@ lpfc_debugfs_multixripools_write(struct file *file, const char __user *buf, + struct lpfc_sli4_hdw_queue *qp; + struct lpfc_multixri_pool *multixri_pool; + +- if (nbytes > 64) +- nbytes = 64; ++ if (nbytes > sizeof(mybuf) - 1) ++ nbytes = sizeof(mybuf) - 1; + + memset(mybuf, 0, sizeof(mybuf)); + +@@ -2688,8 +2688,8 @@ lpfc_debugfs_nvmestat_write(struct file *file, const char __user *buf, + if (!phba->targetport) + return -ENXIO; + +- if (nbytes > 64) +- nbytes = 64; ++ if (nbytes > sizeof(mybuf) - 1) ++ nbytes = sizeof(mybuf) - 1; + + memset(mybuf, 0, sizeof(mybuf)); + +@@ -2826,8 +2826,8 @@ lpfc_debugfs_ioktime_write(struct file *file, const char __user *buf, + char mybuf[64]; + char *pbuf; + +- if (nbytes > 64) +- nbytes = 64; ++ if (nbytes > sizeof(mybuf) - 1) ++ nbytes = sizeof(mybuf) - 1; + + memset(mybuf, 0, sizeof(mybuf)); + +@@ -2954,8 +2954,8 @@ lpfc_debugfs_nvmeio_trc_write(struct file *file, const char __user *buf, + char mybuf[64]; + char *pbuf; + +- if (nbytes > 63) +- nbytes = 63; ++ if (nbytes > sizeof(mybuf) - 1) ++ nbytes = sizeof(mybuf) - 1; + + memset(mybuf, 0, sizeof(mybuf)); + +@@ -3060,8 +3060,8 @@ lpfc_debugfs_hdwqstat_write(struct file *file, const char __user *buf, + char *pbuf; + int i; + +- if (nbytes > 64) +- nbytes = 64; ++ if (nbytes > sizeof(mybuf) - 1) ++ nbytes = sizeof(mybuf) - 1; + + memset(mybuf, 0, sizeof(mybuf)); + +-- +2.35.1 + diff --git a/queue-5.19/scsi-ufs-core-add-ufshcd_quirk_broken_64bit_address.patch b/queue-5.19/scsi-ufs-core-add-ufshcd_quirk_broken_64bit_address.patch new file mode 100644 index 00000000000..686a2124d91 --- /dev/null +++ b/queue-5.19/scsi-ufs-core-add-ufshcd_quirk_broken_64bit_address.patch @@ -0,0 +1,54 @@ +From 1a94aaef5cdfa168fa0a74ee642f4176f06dfffe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Jun 2022 20:05:19 +0900 +Subject: scsi: ufs: core: Add UFSHCD_QUIRK_BROKEN_64BIT_ADDRESS + +From: Yoshihiro Shimoda + +[ Upstream commit 6554400d6f66b9494a0c0f07712ab0a9d307eb01 ] + +Add UFSHCD_QUIRK_BROKEN_64BIT_ADDRESS for host controllers which do not +support 64-bit addressing. + +Link: https://lore.kernel.org/r/20220603110524.1997825-3-yoshihiro.shimoda.uh@renesas.com +Signed-off-by: Yoshihiro Shimoda +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/ufs/core/ufshcd.c | 2 ++ + include/ufs/ufshcd.h | 6 ++++++ + 2 files changed, 8 insertions(+) + +diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c +index 8d91be0fd1a4..141fff01a662 100644 +--- a/drivers/ufs/core/ufshcd.c ++++ b/drivers/ufs/core/ufshcd.c +@@ -2227,6 +2227,8 @@ static inline int ufshcd_hba_capabilities(struct ufs_hba *hba) + int err; + + hba->capabilities = ufshcd_readl(hba, REG_CONTROLLER_CAPABILITIES); ++ if (hba->quirks & UFSHCD_QUIRK_BROKEN_64BIT_ADDRESS) ++ hba->capabilities &= ~MASK_64_ADDRESSING_SUPPORT; + + /* nutrs and nutmrs are 0 based values */ + hba->nutrs = (hba->capabilities & MASK_TRANSFER_REQUESTS_SLOTS) + 1; +diff --git a/include/ufs/ufshcd.h b/include/ufs/ufshcd.h +index a92271421718..795c8951341d 100644 +--- a/include/ufs/ufshcd.h ++++ b/include/ufs/ufshcd.h +@@ -577,6 +577,12 @@ enum ufshcd_quirks { + * support physical host configuration. + */ + UFSHCD_QUIRK_SKIP_PH_CONFIGURATION = 1 << 16, ++ ++ /* ++ * This quirk needs to be enabled if the host controller has ++ * 64-bit addressing supported capability but it doesn't work. ++ */ ++ UFSHCD_QUIRK_BROKEN_64BIT_ADDRESS = 1 << 17, + }; + + enum ufshcd_caps { +-- +2.35.1 + diff --git a/queue-5.19/scsi-ufs-core-add-ufshcd_quirk_hibern_fastauto.patch b/queue-5.19/scsi-ufs-core-add-ufshcd_quirk_hibern_fastauto.patch new file mode 100644 index 00000000000..9af6357b72a --- /dev/null +++ b/queue-5.19/scsi-ufs-core-add-ufshcd_quirk_hibern_fastauto.patch @@ -0,0 +1,61 @@ +From 00f78f9ed5198049534ee8c2ad0de74015861cd9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Jun 2022 20:05:20 +0900 +Subject: scsi: ufs: core: Add UFSHCD_QUIRK_HIBERN_FASTAUTO + +From: Yoshihiro Shimoda + +[ Upstream commit 2f11bbc2c7f37e3a6151ac548b1c0679cc90ea83 ] + +Add UFSHCD_QUIRK_HIBERN_FASTAUTO quirk for host controllers which supports +auto-hibernate the capability but only FASTAUTO mode. + +Link: https://lore.kernel.org/r/20220603110524.1997825-4-yoshihiro.shimoda.uh@renesas.com +Signed-off-by: Yoshihiro Shimoda +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/ufs/core/ufshcd.c | 9 +++++++-- + include/ufs/ufshcd.h | 6 ++++++ + 2 files changed, 13 insertions(+), 2 deletions(-) + +diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c +index 141fff01a662..a51ca56a0ebe 100644 +--- a/drivers/ufs/core/ufshcd.c ++++ b/drivers/ufs/core/ufshcd.c +@@ -4292,8 +4292,13 @@ static int ufshcd_get_max_pwr_mode(struct ufs_hba *hba) + if (hba->max_pwr_info.is_valid) + return 0; + +- pwr_info->pwr_tx = FAST_MODE; +- pwr_info->pwr_rx = FAST_MODE; ++ if (hba->quirks & UFSHCD_QUIRK_HIBERN_FASTAUTO) { ++ pwr_info->pwr_tx = FASTAUTO_MODE; ++ pwr_info->pwr_rx = FASTAUTO_MODE; ++ } else { ++ pwr_info->pwr_tx = FAST_MODE; ++ pwr_info->pwr_rx = FAST_MODE; ++ } + pwr_info->hs_rate = PA_HS_MODE_B; + + /* Get the connected lane count */ +diff --git a/include/ufs/ufshcd.h b/include/ufs/ufshcd.h +index 795c8951341d..991aea081ec7 100644 +--- a/include/ufs/ufshcd.h ++++ b/include/ufs/ufshcd.h +@@ -583,6 +583,12 @@ enum ufshcd_quirks { + * 64-bit addressing supported capability but it doesn't work. + */ + UFSHCD_QUIRK_BROKEN_64BIT_ADDRESS = 1 << 17, ++ ++ /* ++ * This quirk needs to be enabled if the host controller has ++ * auto-hibernate capability but it's FASTAUTO only. ++ */ ++ UFSHCD_QUIRK_HIBERN_FASTAUTO = 1 << 18, + }; + + enum ufshcd_caps { +-- +2.35.1 + diff --git a/queue-5.19/scsi-ufs-ufs-exynos-change-ufs-phy-control-sequence.patch b/queue-5.19/scsi-ufs-ufs-exynos-change-ufs-phy-control-sequence.patch new file mode 100644 index 00000000000..31742fd8cd5 --- /dev/null +++ b/queue-5.19/scsi-ufs-ufs-exynos-change-ufs-phy-control-sequence.patch @@ -0,0 +1,84 @@ +From a866442d55cdc7dd169c9b4fa37d21b91fb4e093 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Jul 2022 11:02:55 +0900 +Subject: scsi: ufs: ufs-exynos: Change ufs phy control sequence + +From: Chanho Park + +[ Upstream commit 3d73b200f9893d8f5ba5d105e8b69c8d16744fa2 ] + +Since commit 1599069a62c6 ("phy: core: Warn when phy_power_on is called +before phy_init"), the following warning has been reported: + + phy_power_on was called before phy_init + +To address this, we need to remove phy_power_on from exynos_ufs_phy_init() +and move it after phy_init. phy_power_off and phy_exit are also necessary +in exynos_ufs_remove(). + +Link: https://lore.kernel.org/r/20220706020255.151177-4-chanho61.park@samsung.com +Reviewed-by: Krzysztof Kozlowski +Signed-off-by: Chanho Park +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/ufs/host/ufs-exynos.c | 17 ++++++++++------- + 1 file changed, 10 insertions(+), 7 deletions(-) + +diff --git a/drivers/ufs/host/ufs-exynos.c b/drivers/ufs/host/ufs-exynos.c +index a81d8cbd542f..25995667c832 100644 +--- a/drivers/ufs/host/ufs-exynos.c ++++ b/drivers/ufs/host/ufs-exynos.c +@@ -910,9 +910,13 @@ static int exynos_ufs_phy_init(struct exynos_ufs *ufs) + if (ret) { + dev_err(hba->dev, "%s: phy init failed, ret = %d\n", + __func__, ret); +- goto out_exit_phy; ++ return ret; + } + ++ ret = phy_power_on(generic_phy); ++ if (ret) ++ goto out_exit_phy; ++ + return 0; + + out_exit_phy: +@@ -1174,10 +1178,6 @@ static int exynos_ufs_init(struct ufs_hba *hba) + goto out; + } + +- ret = phy_power_on(ufs->phy); +- if (ret) +- goto phy_off; +- + exynos_ufs_priv_init(hba, ufs); + + if (ufs->drv_data->drv_init) { +@@ -1195,8 +1195,6 @@ static int exynos_ufs_init(struct ufs_hba *hba) + exynos_ufs_config_smu(ufs); + return 0; + +-phy_off: +- phy_power_off(ufs->phy); + out: + hba->priv = NULL; + return ret; +@@ -1514,9 +1512,14 @@ static int exynos_ufs_probe(struct platform_device *pdev) + static int exynos_ufs_remove(struct platform_device *pdev) + { + struct ufs_hba *hba = platform_get_drvdata(pdev); ++ struct exynos_ufs *ufs = ufshcd_get_variant(hba); + + pm_runtime_get_sync(&(pdev)->dev); + ufshcd_remove(hba); ++ ++ phy_power_off(ufs->phy); ++ phy_exit(ufs->phy); ++ + return 0; + } + +-- +2.35.1 + diff --git a/queue-5.19/scsi-ufs-ufs-mediatek-fix-the-timing-of-configuring-.patch b/queue-5.19/scsi-ufs-ufs-mediatek-fix-the-timing-of-configuring-.patch new file mode 100644 index 00000000000..99ff04e34a4 --- /dev/null +++ b/queue-5.19/scsi-ufs-ufs-mediatek-fix-the-timing-of-configuring-.patch @@ -0,0 +1,116 @@ +From 7457ab3e8bd4388bc2f54fe41202c98a97f71621 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Jun 2022 13:37:18 +0800 +Subject: scsi: ufs: ufs-mediatek: Fix the timing of configuring device + regulators + +From: Po-Wen Kao + +[ Upstream commit 3fd23b8dfb54d9b74eba6dfdd3225db3ac116785 ] + +Currently the LPM configurations of device regulators may not work since +VCC is not disabled yet while ufs_mtk_vreg_set_lpm() is executed. + +Fix this by changing the timing of invoking ufs_mtk_vreg_set_lpm(). + +Link: https://lore.kernel.org/r/20220616053725.5681-5-stanley.chu@mediatek.com +Reviewed-by: Stanley Chu +Signed-off-by: Po-Wen Kao +Signed-off-by: Stanley Chu +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/ufs/host/ufs-mediatek.c | 58 ++++++++++++++++++++++++++++++--- + 1 file changed, 53 insertions(+), 5 deletions(-) + +diff --git a/drivers/ufs/host/ufs-mediatek.c b/drivers/ufs/host/ufs-mediatek.c +index beabc3ccd30b..8b9daa281cc4 100644 +--- a/drivers/ufs/host/ufs-mediatek.c ++++ b/drivers/ufs/host/ufs-mediatek.c +@@ -1026,7 +1026,6 @@ static int ufs_mtk_suspend(struct ufs_hba *hba, enum ufs_pm_op pm_op, + * ufshcd_suspend() re-enabling regulators while vreg is still + * in low-power mode. + */ +- ufs_mtk_vreg_set_lpm(hba, true); + err = ufs_mtk_mphy_power_on(hba, false); + if (err) + goto fail; +@@ -1050,12 +1049,13 @@ static int ufs_mtk_resume(struct ufs_hba *hba, enum ufs_pm_op pm_op) + { + int err; + ++ if (hba->ufshcd_state != UFSHCD_STATE_OPERATIONAL) ++ ufs_mtk_vreg_set_lpm(hba, false); ++ + err = ufs_mtk_mphy_power_on(hba, true); + if (err) + goto fail; + +- ufs_mtk_vreg_set_lpm(hba, false); +- + if (ufshcd_is_link_hibern8(hba)) { + err = ufs_mtk_link_set_hpm(hba); + if (err) +@@ -1220,9 +1220,57 @@ static int ufs_mtk_remove(struct platform_device *pdev) + return 0; + } + ++int ufs_mtk_system_suspend(struct device *dev) ++{ ++ struct ufs_hba *hba = dev_get_drvdata(dev); ++ int ret; ++ ++ ret = ufshcd_system_suspend(dev); ++ if (ret) ++ return ret; ++ ++ ufs_mtk_vreg_set_lpm(hba, true); ++ ++ return 0; ++} ++ ++int ufs_mtk_system_resume(struct device *dev) ++{ ++ struct ufs_hba *hba = dev_get_drvdata(dev); ++ ++ ufs_mtk_vreg_set_lpm(hba, false); ++ ++ return ufshcd_system_resume(dev); ++} ++ ++int ufs_mtk_runtime_suspend(struct device *dev) ++{ ++ struct ufs_hba *hba = dev_get_drvdata(dev); ++ int ret = 0; ++ ++ ret = ufshcd_runtime_suspend(dev); ++ if (ret) ++ return ret; ++ ++ ufs_mtk_vreg_set_lpm(hba, true); ++ ++ return 0; ++} ++ ++int ufs_mtk_runtime_resume(struct device *dev) ++{ ++ struct ufs_hba *hba = dev_get_drvdata(dev); ++ ++ ufs_mtk_vreg_set_lpm(hba, false); ++ ++ return ufshcd_runtime_resume(dev); ++} ++ + static const struct dev_pm_ops ufs_mtk_pm_ops = { +- SET_SYSTEM_SLEEP_PM_OPS(ufshcd_system_suspend, ufshcd_system_resume) +- SET_RUNTIME_PM_OPS(ufshcd_runtime_suspend, ufshcd_runtime_resume, NULL) ++ SET_SYSTEM_SLEEP_PM_OPS(ufs_mtk_system_suspend, ++ ufs_mtk_system_resume) ++ SET_RUNTIME_PM_OPS(ufs_mtk_runtime_suspend, ++ ufs_mtk_runtime_resume, NULL) + .prepare = ufshcd_suspend_prepare, + .complete = ufshcd_resume_complete, + }; +-- +2.35.1 + diff --git a/queue-5.19/selftests-kprobe-do-not-test-for-grp-without-event-f.patch b/queue-5.19/selftests-kprobe-do-not-test-for-grp-without-event-f.patch new file mode 100644 index 00000000000..ffa383fe419 --- /dev/null +++ b/queue-5.19/selftests-kprobe-do-not-test-for-grp-without-event-f.patch @@ -0,0 +1,50 @@ +From 0af199520c2580f5e828362cb5831e34458dea56 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Jul 2022 16:17:07 -0400 +Subject: selftests/kprobe: Do not test for GRP/ without event failures + +From: Steven Rostedt (Google) + +[ Upstream commit f5eab65ff2b76449286d18efc7fee3e0b72f7d9b ] + +A new feature is added where kprobes (and other probes) do not need to +explicitly state the event name when creating a probe. The event name will +come from what is being attached. + +That is: + + # echo 'p:foo/ vfs_read' > kprobe_events + +Will no longer error, but instead create an event: + + # cat kprobe_events + p:foo/p_vfs_read_0 vfs_read + +This should not be tested as an error case anymore. Remove it from the +selftest as now this feature "breaks" the selftest as it no longer fails +as expected. + +Link: https://lore.kernel.org/all/1656296348-16111-1-git-send-email-quic_linyyuan@quicinc.com/ +Link: https://lkml.kernel.org/r/20220712161707.6dc08a14@gandalf.local.home + +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +--- + .../selftests/ftrace/test.d/kprobe/kprobe_syntax_errors.tc | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_syntax_errors.tc b/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_syntax_errors.tc +index fa928b431555..7c02509c71d0 100644 +--- a/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_syntax_errors.tc ++++ b/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_syntax_errors.tc +@@ -21,7 +21,6 @@ check_error 'p:^/bar vfs_read' # NO_GROUP_NAME + check_error 'p:^12345678901234567890123456789012345678901234567890123456789012345/bar vfs_read' # GROUP_TOO_LONG + + check_error 'p:^foo.1/bar vfs_read' # BAD_GROUP_NAME +-check_error 'p:foo/^ vfs_read' # NO_EVENT_NAME + check_error 'p:foo/^12345678901234567890123456789012345678901234567890123456789012345 vfs_read' # EVENT_TOO_LONG + check_error 'p:foo/^bar.1 vfs_read' # BAD_EVENT_NAME + +-- +2.35.1 + diff --git a/queue-5.19/series b/queue-5.19/series index 2200ea2d132..7556691ecf8 100644 --- a/queue-5.19/series +++ b/queue-5.19/series @@ -238,3 +238,126 @@ stmmac-intel-add-a-missing-clk_disable_unprepare-call-in-intel_eth_pci_remove.pa igb-add-lock-to-avoid-data-race.patch kbuild-fix-the-modules-order-between-drivers-and-libs.patch gcc-plugins-undefine-latent_entropy_plugin-when-plugin-disabled-for-a-file.patch +drm-imx-dcss-get-rid-of-hpd-warning-message.patch +drm-meson-fix-refcount-bugs-in-meson_vpu_has_availab.patch +drm-i915-ttm-don-t-leak-the-ccs-state.patch +drm-amdgpu-avoid-another-list-of-reset-devices.patch +drm-bridge-lvds-codec-fix-error-checking-of-drm_of_l.patch +drm-sun4i-dsi-prevent-underflow-when-computing-packe.patch +drm-amdgpu-fix-use-after-free-on-amdgpu_bo_list-mute.patch +kvm-arm64-treat-pmcr_el1.lc-as-res1-on-asymmetric-sy.patch +kvm-arm64-reject-32bit-user-pstate-on-asymmetric-sys.patch +ice-fix-clearing-of-promisc-mode-with-bridge-over-bo.patch +net-mscc-ocelot-turn-stats_lock-into-a-spinlock.patch +net-mscc-ocelot-fix-race-between-ndo_get_stats64-and.patch +net-mscc-ocelot-make-struct-ocelot_stat_layout-array.patch +net-mscc-ocelot-report-ndo_get_stats64-from-the-wrap.patch +x86-ibt-objtool-add-ibt_noseal.patch +x86-kvm-fix-missing-endbr-bug-for-fastop-functions.patch +thunderbolt-change-downstream-router-s-tmu-rate-in-b.patch +hid-multitouch-new-device-class-fix-lenovo-x12-track.patch +pci-add-acs-quirk-for-broadcom-bcm5750x-nics.patch +platform-chrome-cros_ec_proto-don-t-show-mkbp-versio.patch +staging-r8188eu-add-error-handling-of-rtw_read8.patch +staging-r8188eu-add-error-handling-of-rtw_read16.patch +staging-r8188eu-add-error-handling-of-rtw_read32.patch +usb-cdns3-fix-use-after-free-at-workaround-2.patch +usb-gadget-uvc-calculate-the-number-of-request-depen.patch +usb-gadget-uvc-call-uvc-uvcg_warn-on-completed-statu.patch +pci-aardvark-fix-reporting-slot-capabilities-on-emul.patch +scsi-ufs-core-add-ufshcd_quirk_broken_64bit_address.patch +scsi-ufs-core-add-ufshcd_quirk_hibern_fastauto.patch +irqchip-tegra-fix-overflow-implicit-truncation-warni.patch +drm-meson-fix-overflow-implicit-truncation-warnings.patch +clk-ti-stop-using-legacy-clkctrl-names-for-omap4-and.patch +scsi-ufs-ufs-mediatek-fix-the-timing-of-configuring-.patch +usb-typec-mux-add-config-guards-for-functions.patch +usb-host-ohci-ppc-of-fix-refcount-leak-bug.patch +usb-renesas-fix-refcount-leak-bug.patch +scsi-iscsi-fix-hw-conn-removal-use-after-free.patch +usb-dwc2-gadget-remove-d-pull-up-while-no-vbus-with-.patch +vboxguest-do-not-use-devm-for-irq.patch +clk-qcom-ipq8074-dont-disable-gcc_sleep_clk_src.patch +uacce-handle-parent-device-removal-or-parent-driver-.patch +zram-do-not-lookup-algorithm-in-backends-table.patch +clk-qcom-clk-alpha-pll-fix-clk_trion_pll_configure-d.patch +scsi-lpfc-prevent-buffer-overflow-crashes-in-debugfs.patch +scsi-lpfc-fix-possible-memory-leak-when-failing-to-i.patch +gadgetfs-ep_io-wait-until-irq-finishes.patch +coresight-etm4x-avoid-build-failure-with-unrolled-lo.patch +habanalabs-add-terminating-null-to-attrs-arrays.patch +habanalabs-gaudi-invoke-device-reset-from-one-code-b.patch +habanalabs-gaudi-fix-shift-out-of-bounds.patch +habanalabs-gaudi-mask-constant-value-before-cast.patch +mmc-tmio-avoid-glitches-when-resetting.patch +scsi-ufs-ufs-exynos-change-ufs-phy-control-sequence.patch +pinctrl-intel-check-against-matching-data-instead-of.patch +cxl-fix-a-memory-leak-in-an-error-handling-path.patch +pci-acpi-guard-arm64-specific-mcfg_quirks.patch +um-add-noreboot-command-line-option-for-panic_timeou.patch +of-overlay-move-devicetree_corrupt-check-up.patch +dmaengine-dw-axi-dmac-do-not-print-null-lli-during-e.patch +dmaengine-dw-axi-dmac-ignore-interrupt-if-no-descrip.patch +mmc-renesas_sdhi-newer-socs-don-t-need-manual-tap-co.patch +acpi-pptt-leave-the-table-mapped-for-the-runtime-usa.patch +rdma-rxe-limit-the-number-of-calls-to-each-tasklet.patch +csky-kprobe-reclaim-insn_slot-on-kprobe-unregistrati.patch +selftests-kprobe-do-not-test-for-grp-without-event-f.patch +dmaengine-tegra-add-terminate-for-tegra234.patch +dmaengine-sprd-cleanup-in-.remove-after-pm_runtime_g.patch +revert-rdma-rxe-create-duplicate-mapping-tables-for-.patch +openrisc-io-define-iounmap-argument-as-volatile.patch +phy-samsung-phy-exynos-pcie-sanitize-init-power_on-c.patch +md-notify-sysfs-sync_completed-in-md_reap_sync_threa.patch +md-raid5-make-logic-blocking-check-consistent-with-l.patch +nvmet-tcp-fix-lockdep-complaint-on-nvmet_tcp_wq-flus.patch +drivers-md-fix-a-potential-use-after-free-bug.patch +ext4-avoid-remove-directory-when-directory-is-corrup.patch +ext4-block-range-must-be-validated-before-use-in-ext.patch +ext4-avoid-resizing-to-a-partial-cluster-size.patch +lib-list_debug.c-detect-uninitialized-lists.patch +swiotlb-panic-if-nslabs-is-too-small.patch +tty-serial-fix-refcount-leak-bug-in-ucc_uart.c.patch +kvm-ppc-book3s-hv-fix-rm_exit-entry-in-debugfs-timin.patch +vfio-clear-the-caps-buf-to-null-after-free.patch +mips-cavium-octeon-fix-missing-of_node_put-in-octeon.patch +iommu-io-pgtable-arm-v7s-add-a-quirk-to-allow-pgtabl.patch +asoc-intel-avs-set-max-dma-segment-size.patch +alsa-hda-fix-page-fault-in-snd_hda_codec_shutdown.patch +modules-ensure-natural-alignment-for-.altinstruction.patch +asoc-sof-intel-cnl-do-not-process-ipc-reply-before-f.patch +asoc-sof-intel-hda-ipc-do-not-process-ipc-reply-befo.patch +asoc-sof-sof-client-probes-only-load-the-driver-if-i.patch +asoc-rsnd-care-default-case-on-rsnd_ssiu_busif_err_i.patch +riscv-dts-sifive-add-fu540-topology-information.patch +riscv-dts-sifive-add-fu740-topology-information.patch +riscv-dts-canaan-add-k210-topology-information.patch +asoc-nau8821-don-t-unconditionally-free-interrupt.patch +riscv-mmap-with-prot_write-but-no-prot_read-is-inval.patch +risc-v-add-fast-call-path-of-crash_kexec.patch +alsa-hda-realtek-enable-speaker-and-mute-leds-for-hp.patch +asoc-sof-intel-hda-add-sanity-check-on-ssp-index-rep.patch +asoc-intel-sof_es8336-fix-gpio-quirks-set-via-module.patch +asoc-intel-sof_es8336-ignore-gpioint-when-looking-fo.patch +asoc-intel-sof_nau8825-move-quirk-check-to-the-front.patch +watchdog-export-lockup_detector_reconfigure.patch +powerpc-watchdog-introduce-a-nmi-watchdog-s-factor.patch +powerpc-pseries-mobility-set-nmi-watchdog-factor-dur.patch +powerpc-32-set-an-ibat-covering-up-to-_einittext-dur.patch +powerpc-32-don-t-always-pass-mcpu-powerpc-to-the-com.patch +asoc-codecs-va-macro-use-fsgen-as-clock.patch +ovl-warn-if-trusted-xattr-creation-fails.patch +powerpc-ioda-iommu-debugfs-generate-unique-debugfs-e.patch +alsa-core-add-async-signal-helpers.patch +alsa-timer-use-deferred-fasync-helper.patch +alsa-pcm-use-deferred-fasync-helper.patch +alsa-control-use-deferred-fasync-helper.patch +f2fs-fix-to-avoid-use-f2fs_bug_on-in-f2fs_new_node_p.patch +f2fs-fix-to-do-sanity-check-on-segment-type-in-build.patch +smb3-check-xattr-value-length-earlier.patch +powerpc-64-init-jump-labels-before-parse_early_param.patch +venus-pm_helpers-fix-warning-in-opp-during-probe.patch +video-fbdev-i740fb-check-the-argument-of-i740_calc_v.patch +mips-tlbex-explicitly-compare-_page_no_exec-against-.patch +f2fs-revive-f2fs_ioc_abort_volatile_write.patch +f2fs-fix-null-ptr-deref-in-f2fs_get_dnode_of_data.patch diff --git a/queue-5.19/smb3-check-xattr-value-length-earlier.patch b/queue-5.19/smb3-check-xattr-value-length-earlier.patch new file mode 100644 index 00000000000..bb627e34039 --- /dev/null +++ b/queue-5.19/smb3-check-xattr-value-length-earlier.patch @@ -0,0 +1,51 @@ +From bae2a11961ba3f56b064e262bb5db4bc77a9274a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Jul 2022 11:43:44 -0500 +Subject: smb3: check xattr value length earlier + +From: Steve French + +[ Upstream commit 5fa2cffba0b82336a2244d941322eb1627ff787b ] + +Coverity complains about assigning a pointer based on +value length before checking that value length goes +beyond the end of the SMB. Although this is even more +unlikely as value length is a single byte, and the +pointer is not dereferenced until laterm, it is clearer +to check the lengths first. + +Addresses-Coverity: 1467704 ("Speculative execution data leak") +Reviewed-by: Ronnie Sahlberg +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/cifs/smb2ops.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c +index 8802995b2d3d..aa4c1d403708 100644 +--- a/fs/cifs/smb2ops.c ++++ b/fs/cifs/smb2ops.c +@@ -1145,9 +1145,7 @@ move_smb2_ea_to_cifs(char *dst, size_t dst_size, + size_t name_len, value_len, user_name_len; + + while (src_size > 0) { +- name = &src->ea_data[0]; + name_len = (size_t)src->ea_name_length; +- value = &src->ea_data[src->ea_name_length + 1]; + value_len = (size_t)le16_to_cpu(src->ea_value_length); + + if (name_len == 0) +@@ -1159,6 +1157,9 @@ move_smb2_ea_to_cifs(char *dst, size_t dst_size, + goto out; + } + ++ name = &src->ea_data[0]; ++ value = &src->ea_data[src->ea_name_length + 1]; ++ + if (ea_name) { + if (ea_name_len == name_len && + memcmp(ea_name, name, name_len) == 0) { +-- +2.35.1 + diff --git a/queue-5.19/staging-r8188eu-add-error-handling-of-rtw_read16.patch b/queue-5.19/staging-r8188eu-add-error-handling-of-rtw_read16.patch new file mode 100644 index 00000000000..434afdf5696 --- /dev/null +++ b/queue-5.19/staging-r8188eu-add-error-handling-of-rtw_read16.patch @@ -0,0 +1,310 @@ +From a247e885cfc58984d79840b22c4d2c8f60a53d7a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Jun 2022 22:26:12 +0300 +Subject: staging: r8188eu: add error handling of rtw_read16 + +From: Pavel Skripkin + +[ Upstream commit fed9e604eeb6150847d9757f6b056c12912d468b ] + +rtw_read16() reads data from device via USB API which may fail. In case +of any failure previous code returned stack data to callers, which is +wrong. + +Fix it by changing rtw_read16() prototype and prevent caller from +touching random stack data + +Signed-off-by: Pavel Skripkin +Link: https://lore.kernel.org/r/06b45afda048d0aeddeed983c2318680fe6265f5.1654629778.git.paskripkin@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + .../staging/r8188eu/hal/rtl8188e_hal_init.c | 29 +++++++++++++++---- + drivers/staging/r8188eu/hal/rtl8188e_phycfg.c | 8 +++-- + drivers/staging/r8188eu/hal/usb_halinit.c | 27 ++++++++++++++--- + drivers/staging/r8188eu/hal/usb_ops_linux.c | 13 ++++++--- + drivers/staging/r8188eu/include/rtw_io.h | 2 +- + drivers/staging/r8188eu/os_dep/ioctl_linux.c | 9 ++++-- + drivers/staging/r8188eu/os_dep/os_intfs.c | 6 +++- + 7 files changed, 73 insertions(+), 21 deletions(-) + +diff --git a/drivers/staging/r8188eu/hal/rtl8188e_hal_init.c b/drivers/staging/r8188eu/hal/rtl8188e_hal_init.c +index e67ecbd1ba79..8215ed8b506d 100644 +--- a/drivers/staging/r8188eu/hal/rtl8188e_hal_init.c ++++ b/drivers/staging/r8188eu/hal/rtl8188e_hal_init.c +@@ -200,7 +200,8 @@ efuse_phymap_to_logical(u8 *phymap, u16 _offset, u16 _size_byte, u8 *pbuf) + kfree(eFuseWord); + } + +-static void efuse_read_phymap_from_txpktbuf( ++/* FIXME: add error handling in callers */ ++static int efuse_read_phymap_from_txpktbuf( + struct adapter *adapter, + int bcnhead, /* beacon head, where FW store len(2-byte) and efuse physical map. */ + u8 *content, /* buffer to store efuse physical map */ +@@ -219,7 +220,7 @@ static void efuse_read_phymap_from_txpktbuf( + if (bcnhead < 0) { /* if not valid */ + res = rtw_read8(adapter, REG_TDECTRL + 1, ®); + if (res) +- return; ++ return res; + + bcnhead = reg; + } +@@ -249,11 +250,15 @@ static void efuse_read_phymap_from_txpktbuf( + hi32 = cpu_to_le32(rtw_read32(adapter, REG_PKTBUF_DBG_DATA_H)); + + if (i == 0) { ++ u16 reg; ++ + /* Although lenc is only used in a debug statement, + * do not remove it as the rtw_read16() call consumes + * 2 bytes from the EEPROM source. + */ +- rtw_read16(adapter, REG_PKTBUF_DBG_DATA_L); ++ res = rtw_read16(adapter, REG_PKTBUF_DBG_DATA_L, ®); ++ if (res) ++ return res; + + len = le32_to_cpu(lo32) & 0x0000ffff; + +@@ -280,6 +285,8 @@ static void efuse_read_phymap_from_txpktbuf( + } + rtw_write8(adapter, REG_PKT_BUFF_ACCESS_CTRL, DISABLE_TRXPKT_BUF_ACCESS); + *size = count; ++ ++ return 0; + } + + static s32 iol_read_efuse(struct adapter *padapter, u8 txpktbuf_bndy, u16 offset, u16 size_byte, u8 *logical_map) +@@ -355,25 +362,35 @@ int rtl8188e_IOL_exec_cmds_sync(struct adapter *adapter, struct xmit_frame *xmit + void rtl8188e_EfusePowerSwitch(struct adapter *pAdapter, u8 PwrState) + { + u16 tmpV16; ++ int res; + + if (PwrState) { + rtw_write8(pAdapter, REG_EFUSE_ACCESS, EFUSE_ACCESS_ON); + + /* 1.2V Power: From VDDON with Power Cut(0x0000h[15]), defualt valid */ +- tmpV16 = rtw_read16(pAdapter, REG_SYS_ISO_CTRL); ++ res = rtw_read16(pAdapter, REG_SYS_ISO_CTRL, &tmpV16); ++ if (res) ++ return; ++ + if (!(tmpV16 & PWC_EV12V)) { + tmpV16 |= PWC_EV12V; + rtw_write16(pAdapter, REG_SYS_ISO_CTRL, tmpV16); + } + /* Reset: 0x0000h[28], default valid */ +- tmpV16 = rtw_read16(pAdapter, REG_SYS_FUNC_EN); ++ res = rtw_read16(pAdapter, REG_SYS_FUNC_EN, &tmpV16); ++ if (res) ++ return; ++ + if (!(tmpV16 & FEN_ELDR)) { + tmpV16 |= FEN_ELDR; + rtw_write16(pAdapter, REG_SYS_FUNC_EN, tmpV16); + } + + /* Clock: Gated(0x0008h[5]) 8M(0x0008h[1]) clock from ANA, default valid */ +- tmpV16 = rtw_read16(pAdapter, REG_SYS_CLKR); ++ res = rtw_read16(pAdapter, REG_SYS_CLKR, &tmpV16); ++ if (res) ++ return; ++ + if ((!(tmpV16 & LOADER_CLK_EN)) || (!(tmpV16 & ANA8M))) { + tmpV16 |= (LOADER_CLK_EN | ANA8M); + rtw_write16(pAdapter, REG_SYS_CLKR, tmpV16); +diff --git a/drivers/staging/r8188eu/hal/rtl8188e_phycfg.c b/drivers/staging/r8188eu/hal/rtl8188e_phycfg.c +index 985339a974fc..298c3d9bc7be 100644 +--- a/drivers/staging/r8188eu/hal/rtl8188e_phycfg.c ++++ b/drivers/staging/r8188eu/hal/rtl8188e_phycfg.c +@@ -484,13 +484,17 @@ PHY_BBConfig8188E( + { + int rtStatus = _SUCCESS; + struct hal_data_8188e *pHalData = &Adapter->haldata; +- u32 RegVal; ++ u16 RegVal; + u8 CrystalCap; ++ int res; + + phy_InitBBRFRegisterDefinition(Adapter); + + /* Enable BB and RF */ +- RegVal = rtw_read16(Adapter, REG_SYS_FUNC_EN); ++ res = rtw_read16(Adapter, REG_SYS_FUNC_EN, &RegVal); ++ if (res) ++ return _FAIL; ++ + rtw_write16(Adapter, REG_SYS_FUNC_EN, (u16)(RegVal | BIT(13) | BIT(0) | BIT(1))); + + /* 20090923 Joseph: Advised by Steven and Jenyu. Power sequence before init RF. */ +diff --git a/drivers/staging/r8188eu/hal/usb_halinit.c b/drivers/staging/r8188eu/hal/usb_halinit.c +index 01422d548748..e7b51b427e8f 100644 +--- a/drivers/staging/r8188eu/hal/usb_halinit.c ++++ b/drivers/staging/r8188eu/hal/usb_halinit.c +@@ -52,6 +52,8 @@ void rtl8188eu_interface_configure(struct adapter *adapt) + u32 rtl8188eu_InitPowerOn(struct adapter *adapt) + { + u16 value16; ++ int res; ++ + /* HW Power on sequence */ + struct hal_data_8188e *haldata = &adapt->haldata; + if (haldata->bMacPwrCtrlOn) +@@ -65,7 +67,10 @@ u32 rtl8188eu_InitPowerOn(struct adapter *adapt) + rtw_write16(adapt, REG_CR, 0x00); /* suggseted by zhouzhou, by page, 20111230 */ + + /* Enable MAC DMA/WMAC/SCHEDULE/SEC block */ +- value16 = rtw_read16(adapt, REG_CR); ++ res = rtw_read16(adapt, REG_CR, &value16); ++ if (res) ++ return _FAIL; ++ + value16 |= (HCI_TXDMA_EN | HCI_RXDMA_EN | TXDMA_EN | RXDMA_EN + | PROTOCOL_EN | SCHEDULE_EN | ENSEC | CALTMR_EN); + /* for SDIO - Set CR bit10 to enable 32k calibration. Suggested by SD1 Gimmy. Added by tynli. 2011.08.31. */ +@@ -166,7 +171,14 @@ static void _InitNormalChipRegPriority(struct adapter *Adapter, u16 beQ, + u16 bkQ, u16 viQ, u16 voQ, u16 mgtQ, + u16 hiQ) + { +- u16 value16 = (rtw_read16(Adapter, REG_TRXDMA_CTRL) & 0x7); ++ u16 value16; ++ int res; ++ ++ res = rtw_read16(Adapter, REG_TRXDMA_CTRL, &value16); ++ if (res) ++ return; ++ ++ value16 &= 0x7; + + value16 |= _TXDMA_BEQ_MAP(beQ) | _TXDMA_BKQ_MAP(bkQ) | + _TXDMA_VIQ_MAP(viQ) | _TXDMA_VOQ_MAP(voQ) | +@@ -640,7 +652,10 @@ u32 rtl8188eu_hal_init(struct adapter *Adapter) + /* Hw bug which Hw initials RxFF boundary size to a value which is larger than the real Rx buffer size in 88E. */ + /* */ + /* Enable MACTXEN/MACRXEN block */ +- value16 = rtw_read16(Adapter, REG_CR); ++ res = rtw_read16(Adapter, REG_CR, &value16); ++ if (res) ++ return _FAIL; ++ + value16 |= (MACTXEN | MACRXEN); + rtw_write8(Adapter, REG_CR, value16); + +@@ -713,7 +728,11 @@ u32 rtl8188eu_hal_init(struct adapter *Adapter) + rtw_write16(Adapter, REG_TX_RPT_TIME, 0x3DF0); + + /* enable tx DMA to drop the redundate data of packet */ +- rtw_write16(Adapter, REG_TXDMA_OFFSET_CHK, (rtw_read16(Adapter, REG_TXDMA_OFFSET_CHK) | DROP_DATA_EN)); ++ res = rtw_read16(Adapter, REG_TXDMA_OFFSET_CHK, &value16); ++ if (res) ++ return _FAIL; ++ ++ rtw_write16(Adapter, REG_TXDMA_OFFSET_CHK, (value16 | DROP_DATA_EN)); + + /* 2010/08/26 MH Merge from 8192CE. */ + if (pwrctrlpriv->rf_pwrstate == rf_on) { +diff --git a/drivers/staging/r8188eu/hal/usb_ops_linux.c b/drivers/staging/r8188eu/hal/usb_ops_linux.c +index f399a7fd8b97..7d62f1f3d26e 100644 +--- a/drivers/staging/r8188eu/hal/usb_ops_linux.c ++++ b/drivers/staging/r8188eu/hal/usb_ops_linux.c +@@ -103,16 +103,21 @@ int __must_check rtw_read8(struct adapter *adapter, u32 addr, u8 *data) + return usb_read(intf, value, data, 1); + } + +-u16 rtw_read16(struct adapter *adapter, u32 addr) ++int __must_check rtw_read16(struct adapter *adapter, u32 addr, u16 *data) + { + struct io_priv *io_priv = &adapter->iopriv; + struct intf_hdl *intf = &io_priv->intf; + u16 value = addr & 0xffff; +- __le16 data; ++ __le16 le_data; ++ int res; + +- usb_read(intf, value, &data, 2); ++ res = usb_read(intf, value, &le_data, 2); ++ if (res) ++ return res; + +- return le16_to_cpu(data); ++ *data = le16_to_cpu(le_data); ++ ++ return 0; + } + + u32 rtw_read32(struct adapter *adapter, u32 addr) +diff --git a/drivers/staging/r8188eu/include/rtw_io.h b/drivers/staging/r8188eu/include/rtw_io.h +index 1198d3850a6d..ce3369e33d66 100644 +--- a/drivers/staging/r8188eu/include/rtw_io.h ++++ b/drivers/staging/r8188eu/include/rtw_io.h +@@ -221,7 +221,7 @@ void _rtw_attrib_read(struct adapter *adapter, u32 addr, u32 cnt, u8 *pmem); + void _rtw_attrib_write(struct adapter *adapter, u32 addr, u32 cnt, u8 *pmem); + + int __must_check rtw_read8(struct adapter *adapter, u32 addr, u8 *data); +-u16 rtw_read16(struct adapter *adapter, u32 addr); ++int __must_check rtw_read16(struct adapter *adapter, u32 addr, u16 *data); + u32 rtw_read32(struct adapter *adapter, u32 addr); + void _rtw_read_mem(struct adapter *adapter, u32 addr, u32 cnt, u8 *pmem); + u32 rtw_read_port(struct adapter *adapter, u8 *pmem); +diff --git a/drivers/staging/r8188eu/os_dep/ioctl_linux.c b/drivers/staging/r8188eu/os_dep/ioctl_linux.c +index 19a60d47f7c0..7ec363089ae0 100644 +--- a/drivers/staging/r8188eu/os_dep/ioctl_linux.c ++++ b/drivers/staging/r8188eu/os_dep/ioctl_linux.c +@@ -3349,6 +3349,7 @@ static int rtw_dbg_port(struct net_device *dev, + + /* FIXME: is this read necessary? */ + res = rtw_read8(padapter, reg, &val8); ++ (void)res; + } + break; + +@@ -3357,8 +3358,8 @@ static int rtw_dbg_port(struct net_device *dev, + u16 reg = arg; + u16 start_value = 200; + u32 write_num = extra_arg; +- +- int i; ++ u16 val16; ++ int i, res; + struct xmit_frame *xmit_frame; + + xmit_frame = rtw_IOL_accquire_xmit_frame(padapter); +@@ -3372,7 +3373,9 @@ static int rtw_dbg_port(struct net_device *dev, + if (rtl8188e_IOL_exec_cmds_sync(padapter, xmit_frame, 5000, 0) != _SUCCESS) + ret = -EPERM; + +- rtw_read16(padapter, reg); ++ /* FIXME: is this read necessary? */ ++ res = rtw_read16(padapter, reg, &val16); ++ (void)res; + } + break; + case 0x08: /* continuous write dword test */ +diff --git a/drivers/staging/r8188eu/os_dep/os_intfs.c b/drivers/staging/r8188eu/os_dep/os_intfs.c +index 891c85b088ca..d9325ef6ac28 100644 +--- a/drivers/staging/r8188eu/os_dep/os_intfs.c ++++ b/drivers/staging/r8188eu/os_dep/os_intfs.c +@@ -740,12 +740,16 @@ static void rtw_fifo_cleanup(struct adapter *adapter) + { + struct pwrctrl_priv *pwrpriv = &adapter->pwrctrlpriv; + u8 trycnt = 100; ++ int res; + + /* pause tx */ + rtw_write8(adapter, REG_TXPAUSE, 0xff); + + /* keep sn */ +- adapter->xmitpriv.nqos_ssn = rtw_read16(adapter, REG_NQOS_SEQ); ++ /* FIXME: return an error to caller */ ++ res = rtw_read16(adapter, REG_NQOS_SEQ, &adapter->xmitpriv.nqos_ssn); ++ if (res) ++ return; + + if (!pwrpriv->bkeepfwalive) { + /* RX DMA stop */ +-- +2.35.1 + diff --git a/queue-5.19/staging-r8188eu-add-error-handling-of-rtw_read32.patch b/queue-5.19/staging-r8188eu-add-error-handling-of-rtw_read32.patch new file mode 100644 index 00000000000..8df7a7d2d73 --- /dev/null +++ b/queue-5.19/staging-r8188eu-add-error-handling-of-rtw_read32.patch @@ -0,0 +1,684 @@ +From b3e9571a60df2f1a3f2b5c14b8a2917a88e8a8d8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Jun 2022 22:26:21 +0300 +Subject: staging: r8188eu: add error handling of rtw_read32 + +From: Pavel Skripkin + +[ Upstream commit b9c5e272062708680d47df433bfbfe5299ad1a63 ] + +rtw_read32() reads data from device via USB API which may fail. In case +of any failure previous code returned stack data to callers, which is +wrong. + +Fix it by changing rtw_read32() prototype and prevent caller from +touching random stack data + +Signed-off-by: Pavel Skripkin +Link: https://lore.kernel.org/r/583c3d21c46066275e4fc8da5ba4fd0e3679335b.1654629778.git.paskripkin@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/r8188eu/core/rtw_cmd.c | 15 +++++- + drivers/staging/r8188eu/core/rtw_efuse.c | 20 ++++--- + drivers/staging/r8188eu/core/rtw_fw.c | 16 ++++-- + drivers/staging/r8188eu/core/rtw_mlme_ext.c | 14 ++++- + drivers/staging/r8188eu/core/rtw_pwrctrl.c | 9 +++- + .../r8188eu/hal/Hal8188ERateAdaptive.c | 21 ++++++-- + drivers/staging/r8188eu/hal/HalPhyRf_8188e.c | 3 +- + .../staging/r8188eu/hal/rtl8188e_hal_init.c | 40 +++++++++----- + drivers/staging/r8188eu/hal/rtl8188e_phycfg.c | 12 ++++- + drivers/staging/r8188eu/hal/usb_halinit.c | 53 ++++++++++++++++--- + drivers/staging/r8188eu/hal/usb_ops_linux.c | 13 +++-- + drivers/staging/r8188eu/include/rtw_io.h | 2 +- + drivers/staging/r8188eu/os_dep/ioctl_linux.c | 27 ++++++++-- + drivers/staging/r8188eu/os_dep/os_intfs.c | 13 ++++- + 14 files changed, 202 insertions(+), 56 deletions(-) + +diff --git a/drivers/staging/r8188eu/core/rtw_cmd.c b/drivers/staging/r8188eu/core/rtw_cmd.c +index 06523d91939a..5b6a891b5d67 100644 +--- a/drivers/staging/r8188eu/core/rtw_cmd.c ++++ b/drivers/staging/r8188eu/core/rtw_cmd.c +@@ -898,8 +898,12 @@ static void traffic_status_watchdog(struct adapter *padapter) + static void rtl8188e_sreset_xmit_status_check(struct adapter *padapter) + { + u32 txdma_status; ++ int res; ++ ++ res = rtw_read32(padapter, REG_TXDMA_STATUS, &txdma_status); ++ if (res) ++ return; + +- txdma_status = rtw_read32(padapter, REG_TXDMA_STATUS); + if (txdma_status != 0x00) + rtw_write32(padapter, REG_TXDMA_STATUS, txdma_status); + /* total xmit irp = 4 */ +@@ -1177,7 +1181,14 @@ u8 rtw_ps_cmd(struct adapter *padapter) + + static bool rtw_is_hi_queue_empty(struct adapter *adapter) + { +- return (rtw_read32(adapter, REG_HGQ_INFORMATION) & 0x0000ff00) == 0; ++ int res; ++ u32 reg; ++ ++ res = rtw_read32(adapter, REG_HGQ_INFORMATION, ®); ++ if (res) ++ return false; ++ ++ return (reg & 0x0000ff00) == 0; + } + + static void rtw_chk_hi_queue_hdl(struct adapter *padapter) +diff --git a/drivers/staging/r8188eu/core/rtw_efuse.c b/drivers/staging/r8188eu/core/rtw_efuse.c +index a2691c7f96f6..8005ed8d3a20 100644 +--- a/drivers/staging/r8188eu/core/rtw_efuse.c ++++ b/drivers/staging/r8188eu/core/rtw_efuse.c +@@ -46,11 +46,17 @@ ReadEFuseByte( + rtw_write8(Adapter, EFUSE_CTRL + 3, (readbyte & 0x7f)); + + /* Check bit 32 read-ready */ +- retry = 0; +- value32 = rtw_read32(Adapter, EFUSE_CTRL); +- while (!(((value32 >> 24) & 0xff) & 0x80) && (retry < 10000)) { +- value32 = rtw_read32(Adapter, EFUSE_CTRL); +- retry++; ++ res = rtw_read32(Adapter, EFUSE_CTRL, &value32); ++ if (res) ++ return; ++ ++ for (retry = 0; retry < 10000; retry++) { ++ res = rtw_read32(Adapter, EFUSE_CTRL, &value32); ++ if (res) ++ continue; ++ ++ if (((value32 >> 24) & 0xff) & 0x80) ++ break; + } + + /* 20100205 Joseph: Add delay suggested by SD1 Victor. */ +@@ -58,7 +64,9 @@ ReadEFuseByte( + /* Designer says that there shall be some delay after ready bit is set, or the */ + /* result will always stay on last data we read. */ + udelay(50); +- value32 = rtw_read32(Adapter, EFUSE_CTRL); ++ res = rtw_read32(Adapter, EFUSE_CTRL, &value32); ++ if (res) ++ return; + + *pbuf = (u8)(value32 & 0xff); + +diff --git a/drivers/staging/r8188eu/core/rtw_fw.c b/drivers/staging/r8188eu/core/rtw_fw.c +index 7cf8525595c6..04f25e0b3bca 100644 +--- a/drivers/staging/r8188eu/core/rtw_fw.c ++++ b/drivers/staging/r8188eu/core/rtw_fw.c +@@ -194,10 +194,14 @@ static int fw_free_to_go(struct adapter *padapter) + { + u32 counter = 0; + u32 value32; ++ int res; + + /* polling CheckSum report */ + do { +- value32 = rtw_read32(padapter, REG_MCUFWDL); ++ res = rtw_read32(padapter, REG_MCUFWDL, &value32); ++ if (res) ++ continue; ++ + if (value32 & FWDL_CHKSUM_RPT) + break; + } while (counter++ < POLLING_READY_TIMEOUT_COUNT); +@@ -205,7 +209,10 @@ static int fw_free_to_go(struct adapter *padapter) + if (counter >= POLLING_READY_TIMEOUT_COUNT) + return _FAIL; + +- value32 = rtw_read32(padapter, REG_MCUFWDL); ++ res = rtw_read32(padapter, REG_MCUFWDL, &value32); ++ if (res) ++ return _FAIL; ++ + value32 |= MCUFWDL_RDY; + value32 &= ~WINTINI_RDY; + rtw_write32(padapter, REG_MCUFWDL, value32); +@@ -215,9 +222,10 @@ static int fw_free_to_go(struct adapter *padapter) + /* polling for FW ready */ + counter = 0; + do { +- value32 = rtw_read32(padapter, REG_MCUFWDL); +- if (value32 & WINTINI_RDY) ++ res = rtw_read32(padapter, REG_MCUFWDL, &value32); ++ if (!res && value32 & WINTINI_RDY) + return _SUCCESS; ++ + udelay(5); + } while (counter++ < POLLING_READY_TIMEOUT_COUNT); + +diff --git a/drivers/staging/r8188eu/core/rtw_mlme_ext.c b/drivers/staging/r8188eu/core/rtw_mlme_ext.c +index fdb5a8cb9d69..88a4953d31d8 100644 +--- a/drivers/staging/r8188eu/core/rtw_mlme_ext.c ++++ b/drivers/staging/r8188eu/core/rtw_mlme_ext.c +@@ -6017,6 +6017,7 @@ static void mlme_join(struct adapter *adapter, int type) + { + struct mlme_priv *mlmepriv = &adapter->mlmepriv; + u8 retry_limit = 0x30, reg; ++ u32 reg32; + int res; + + switch (type) { +@@ -6025,8 +6026,12 @@ static void mlme_join(struct adapter *adapter, int type) + /* enable to rx data frame, accept all data frame */ + rtw_write16(adapter, REG_RXFLTMAP2, 0xFFFF); + ++ res = rtw_read32(adapter, REG_RCR, ®32); ++ if (res) ++ return; ++ + rtw_write32(adapter, REG_RCR, +- rtw_read32(adapter, REG_RCR) | RCR_CBSSID_DATA | RCR_CBSSID_BCN); ++ reg32 | RCR_CBSSID_DATA | RCR_CBSSID_BCN); + + if (check_fwstate(mlmepriv, WIFI_STATION_STATE)) { + retry_limit = 48; +@@ -6839,9 +6844,14 @@ static u8 chk_ap_is_alive(struct sta_info *psta) + + static int rtl8188e_sreset_linked_status_check(struct adapter *padapter) + { +- u32 rx_dma_status = rtw_read32(padapter, REG_RXDMA_STATUS); ++ u32 rx_dma_status; ++ int res; + u8 reg; + ++ res = rtw_read32(padapter, REG_RXDMA_STATUS, &rx_dma_status); ++ if (res) ++ return res; ++ + if (rx_dma_status != 0x00) + rtw_write32(padapter, REG_RXDMA_STATUS, rx_dma_status); + +diff --git a/drivers/staging/r8188eu/core/rtw_pwrctrl.c b/drivers/staging/r8188eu/core/rtw_pwrctrl.c +index 7b816b824947..45e85b593665 100644 +--- a/drivers/staging/r8188eu/core/rtw_pwrctrl.c ++++ b/drivers/staging/r8188eu/core/rtw_pwrctrl.c +@@ -229,6 +229,9 @@ void rtw_set_ps_mode(struct adapter *padapter, u8 ps_mode, u8 smart_ps, u8 bcn_a + + static bool lps_rf_on(struct adapter *adapter) + { ++ int res; ++ u32 reg; ++ + /* When we halt NIC, we should check if FW LPS is leave. */ + if (adapter->pwrctrlpriv.rf_pwrstate == rf_off) { + /* If it is in HW/SW Radio OFF or IPS state, we do not check Fw LPS Leave, */ +@@ -236,7 +239,11 @@ static bool lps_rf_on(struct adapter *adapter) + return true; + } + +- if (rtw_read32(adapter, REG_RCR) & 0x00070000) ++ res = rtw_read32(adapter, REG_RCR, ®); ++ if (res) ++ return false; ++ ++ if (reg & 0x00070000) + return false; + + return true; +diff --git a/drivers/staging/r8188eu/hal/Hal8188ERateAdaptive.c b/drivers/staging/r8188eu/hal/Hal8188ERateAdaptive.c +index 57e8f5573846..3cefdf90d6e0 100644 +--- a/drivers/staging/r8188eu/hal/Hal8188ERateAdaptive.c ++++ b/drivers/staging/r8188eu/hal/Hal8188ERateAdaptive.c +@@ -279,6 +279,7 @@ static int odm_ARFBRefresh_8188E(struct odm_dm_struct *dm_odm, struct odm_ra_inf + { /* Wilson 2011/10/26 */ + u32 MaskFromReg; + s8 i; ++ int res; + + switch (pRaInfo->RateID) { + case RATR_INX_WIRELESS_NGB: +@@ -303,19 +304,31 @@ static int odm_ARFBRefresh_8188E(struct odm_dm_struct *dm_odm, struct odm_ra_inf + pRaInfo->RAUseRate = (pRaInfo->RateMask) & 0x0000000d; + break; + case 12: +- MaskFromReg = rtw_read32(dm_odm->Adapter, REG_ARFR0); ++ res = rtw_read32(dm_odm->Adapter, REG_ARFR0, &MaskFromReg); ++ if (res) ++ return res; ++ + pRaInfo->RAUseRate = (pRaInfo->RateMask) & MaskFromReg; + break; + case 13: +- MaskFromReg = rtw_read32(dm_odm->Adapter, REG_ARFR1); ++ res = rtw_read32(dm_odm->Adapter, REG_ARFR1, &MaskFromReg); ++ if (res) ++ return res; ++ + pRaInfo->RAUseRate = (pRaInfo->RateMask) & MaskFromReg; + break; + case 14: +- MaskFromReg = rtw_read32(dm_odm->Adapter, REG_ARFR2); ++ res = rtw_read32(dm_odm->Adapter, REG_ARFR2, &MaskFromReg); ++ if (res) ++ return res; ++ + pRaInfo->RAUseRate = (pRaInfo->RateMask) & MaskFromReg; + break; + case 15: +- MaskFromReg = rtw_read32(dm_odm->Adapter, REG_ARFR3); ++ res = rtw_read32(dm_odm->Adapter, REG_ARFR3, &MaskFromReg); ++ if (res) ++ return res; ++ + pRaInfo->RAUseRate = (pRaInfo->RateMask) & MaskFromReg; + break; + default: +diff --git a/drivers/staging/r8188eu/hal/HalPhyRf_8188e.c b/drivers/staging/r8188eu/hal/HalPhyRf_8188e.c +index a5b7980dfcee..525deab10820 100644 +--- a/drivers/staging/r8188eu/hal/HalPhyRf_8188e.c ++++ b/drivers/staging/r8188eu/hal/HalPhyRf_8188e.c +@@ -483,7 +483,8 @@ static void _PHY_SaveMACRegisters( + MACBackup[i] = reg; + } + +- MACBackup[i] = rtw_read32(adapt, MACReg[i]); ++ res = rtw_read32(adapt, MACReg[i], MACBackup + i); ++ (void)res; + } + + static void reload_adda_reg(struct adapter *adapt, u32 *ADDAReg, u32 *ADDABackup, u32 RegiesterNum) +diff --git a/drivers/staging/r8188eu/hal/rtl8188e_hal_init.c b/drivers/staging/r8188eu/hal/rtl8188e_hal_init.c +index 8215ed8b506d..5549e7be334a 100644 +--- a/drivers/staging/r8188eu/hal/rtl8188e_hal_init.c ++++ b/drivers/staging/r8188eu/hal/rtl8188e_hal_init.c +@@ -216,6 +216,7 @@ static int efuse_read_phymap_from_txpktbuf( + u16 limit = *size; + u8 reg; + u8 *pos = content; ++ u32 reg32; + + if (bcnhead < 0) { /* if not valid */ + res = rtw_read8(adapter, REG_TDECTRL + 1, ®); +@@ -246,8 +247,17 @@ static int efuse_read_phymap_from_txpktbuf( + } while (time_before(jiffies, timeout)); + + /* data from EEPROM needs to be in LE */ +- lo32 = cpu_to_le32(rtw_read32(adapter, REG_PKTBUF_DBG_DATA_L)); +- hi32 = cpu_to_le32(rtw_read32(adapter, REG_PKTBUF_DBG_DATA_H)); ++ res = rtw_read32(adapter, REG_PKTBUF_DBG_DATA_L, ®32); ++ if (res) ++ return res; ++ ++ lo32 = cpu_to_le32(reg32); ++ ++ res = rtw_read32(adapter, REG_PKTBUF_DBG_DATA_H, ®32); ++ if (res) ++ return res; ++ ++ hi32 = cpu_to_le32(reg32); + + if (i == 0) { + u16 reg; +@@ -548,8 +558,12 @@ void rtl8188e_read_chip_version(struct adapter *padapter) + u32 value32; + struct HAL_VERSION ChipVersion; + struct hal_data_8188e *pHalData = &padapter->haldata; ++ int res; ++ ++ res = rtw_read32(padapter, REG_SYS_CFG, &value32); ++ if (res) ++ return; + +- value32 = rtw_read32(padapter, REG_SYS_CFG); + ChipVersion.ChipType = ((value32 & RTL_ID) ? TEST_CHIP : NORMAL_CHIP); + + ChipVersion.VendorType = ((value32 & VENDOR_ID) ? CHIP_VENDOR_UMC : CHIP_VENDOR_TSMC); +@@ -596,26 +610,24 @@ void hal_notch_filter_8188e(struct adapter *adapter, bool enable) + /* */ + static s32 _LLTWrite(struct adapter *padapter, u32 address, u32 data) + { +- s32 status = _SUCCESS; +- s32 count = 0; ++ s32 count; + u32 value = _LLT_INIT_ADDR(address) | _LLT_INIT_DATA(data) | _LLT_OP(_LLT_WRITE_ACCESS); + u16 LLTReg = REG_LLT_INIT; ++ int res; + + rtw_write32(padapter, LLTReg, value); + + /* polling */ +- do { +- value = rtw_read32(padapter, LLTReg); +- if (_LLT_NO_ACTIVE == _LLT_OP_VALUE(value)) +- break; ++ for (count = 0; count <= POLLING_LLT_THRESHOLD; count++) { ++ res = rtw_read32(padapter, LLTReg, &value); ++ if (res) ++ continue; + +- if (count > POLLING_LLT_THRESHOLD) { +- status = _FAIL; ++ if (_LLT_NO_ACTIVE == _LLT_OP_VALUE(value)) + break; +- } +- } while (count++); ++ } + +- return status; ++ return count > POLLING_LLT_THRESHOLD ? _FAIL : _SUCCESS; + } + + s32 InitLLTTable(struct adapter *padapter, u8 txpktbuf_bndy) +diff --git a/drivers/staging/r8188eu/hal/rtl8188e_phycfg.c b/drivers/staging/r8188eu/hal/rtl8188e_phycfg.c +index 298c3d9bc7be..dea6d915a1f4 100644 +--- a/drivers/staging/r8188eu/hal/rtl8188e_phycfg.c ++++ b/drivers/staging/r8188eu/hal/rtl8188e_phycfg.c +@@ -56,8 +56,12 @@ rtl8188e_PHY_QueryBBReg( + ) + { + u32 ReturnValue = 0, OriginalValue, BitShift; ++ int res; ++ ++ res = rtw_read32(Adapter, RegAddr, &OriginalValue); ++ if (res) ++ return 0; + +- OriginalValue = rtw_read32(Adapter, RegAddr); + BitShift = phy_CalculateBitShift(BitMask); + ReturnValue = (OriginalValue & BitMask) >> BitShift; + return ReturnValue; +@@ -84,9 +88,13 @@ rtl8188e_PHY_QueryBBReg( + void rtl8188e_PHY_SetBBReg(struct adapter *Adapter, u32 RegAddr, u32 BitMask, u32 Data) + { + u32 OriginalValue, BitShift; ++ int res; + + if (BitMask != bMaskDWord) { /* if not "double word" write */ +- OriginalValue = rtw_read32(Adapter, RegAddr); ++ res = rtw_read32(Adapter, RegAddr, &OriginalValue); ++ if (res) ++ return; ++ + BitShift = phy_CalculateBitShift(BitMask); + Data = ((OriginalValue & (~BitMask)) | (Data << BitShift)); + } +diff --git a/drivers/staging/r8188eu/hal/usb_halinit.c b/drivers/staging/r8188eu/hal/usb_halinit.c +index e7b51b427e8f..0afde5038b3f 100644 +--- a/drivers/staging/r8188eu/hal/usb_halinit.c ++++ b/drivers/staging/r8188eu/hal/usb_halinit.c +@@ -297,8 +297,12 @@ static void _InitQueuePriority(struct adapter *Adapter) + static void _InitNetworkType(struct adapter *Adapter) + { + u32 value32; ++ int res; ++ ++ res = rtw_read32(Adapter, REG_CR, &value32); ++ if (res) ++ return; + +- value32 = rtw_read32(Adapter, REG_CR); + /* TODO: use the other function to set network type */ + value32 = (value32 & ~MASK_NETTYPE) | _NETTYPE(NT_LINK_AP); + +@@ -338,9 +342,13 @@ static void _InitAdaptiveCtrl(struct adapter *Adapter) + { + u16 value16; + u32 value32; ++ int res; + + /* Response Rate Set */ +- value32 = rtw_read32(Adapter, REG_RRSR); ++ res = rtw_read32(Adapter, REG_RRSR, &value32); ++ if (res) ++ return; ++ + value32 &= ~RATE_BITMAP_ALL; + value32 |= RATE_RRSR_CCK_ONLY_1M; + rtw_write32(Adapter, REG_RRSR, value32); +@@ -409,11 +417,15 @@ static void _InitRetryFunction(struct adapter *Adapter) + static void usb_AggSettingTxUpdate(struct adapter *Adapter) + { + u32 value32; ++ int res; + + if (Adapter->registrypriv.wifi_spec) + return; + +- value32 = rtw_read32(Adapter, REG_TDECTRL); ++ res = rtw_read32(Adapter, REG_TDECTRL, &value32); ++ if (res) ++ return; ++ + value32 = value32 & ~(BLK_DESC_NUM_MASK << BLK_DESC_NUM_SHIFT); + value32 |= ((USB_TXAGG_DESC_NUM & BLK_DESC_NUM_MASK) << BLK_DESC_NUM_SHIFT); + +@@ -521,11 +533,17 @@ static void _BBTurnOnBlock(struct adapter *Adapter) + static void _InitAntenna_Selection(struct adapter *Adapter) + { + struct hal_data_8188e *haldata = &Adapter->haldata; ++ int res; ++ u32 reg; + + if (haldata->AntDivCfg == 0) + return; + +- rtw_write32(Adapter, REG_LEDCFG0, rtw_read32(Adapter, REG_LEDCFG0) | BIT(23)); ++ res = rtw_read32(Adapter, REG_LEDCFG0, ®); ++ if (res) ++ return; ++ ++ rtw_write32(Adapter, REG_LEDCFG0, reg | BIT(23)); + rtl8188e_PHY_SetBBReg(Adapter, rFPGA0_XAB_RFParameter, BIT(13), 0x01); + + if (rtl8188e_PHY_QueryBBReg(Adapter, rFPGA0_XA_RFInterfaceOE, 0x300) == Antenna_A) +@@ -555,6 +573,7 @@ u32 rtl8188eu_hal_init(struct adapter *Adapter) + struct hal_data_8188e *haldata = &Adapter->haldata; + struct pwrctrl_priv *pwrctrlpriv = &Adapter->pwrctrlpriv; + struct registry_priv *pregistrypriv = &Adapter->registrypriv; ++ u32 reg; + + if (Adapter->pwrctrlpriv.bkeepfwalive) { + if (haldata->odmpriv.RFCalibrateInfo.bIQKInitialized) { +@@ -752,7 +771,11 @@ u32 rtl8188eu_hal_init(struct adapter *Adapter) + rtw_write8(Adapter, REG_USB_HRPWM, 0); + + /* ack for xmit mgmt frames. */ +- rtw_write32(Adapter, REG_FWHW_TXQ_CTRL, rtw_read32(Adapter, REG_FWHW_TXQ_CTRL) | BIT(12)); ++ res = rtw_read32(Adapter, REG_FWHW_TXQ_CTRL, ®); ++ if (res) ++ return _FAIL; ++ ++ rtw_write32(Adapter, REG_FWHW_TXQ_CTRL, reg | BIT(12)); + + exit: + return status; +@@ -1121,7 +1144,12 @@ void SetHwReg8188EU(struct adapter *Adapter, u8 variable, u8 *val) + case HW_VAR_MLME_SITESURVEY: + if (*((u8 *)val)) { /* under sitesurvey */ + /* config RCR to receive different BSSID & not to receive data frame */ +- u32 v = rtw_read32(Adapter, REG_RCR); ++ u32 v; ++ ++ res = rtw_read32(Adapter, REG_RCR, &v); ++ if (res) ++ return; ++ + v &= ~(RCR_CBSSID_BCN); + rtw_write32(Adapter, REG_RCR, v); + /* reject all data frame */ +@@ -1136,6 +1164,7 @@ void SetHwReg8188EU(struct adapter *Adapter, u8 variable, u8 *val) + } else { /* sitesurvey done */ + struct mlme_ext_priv *pmlmeext = &Adapter->mlmeextpriv; + struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info; ++ u32 reg32; + + if ((is_client_associated_to_ap(Adapter)) || + ((pmlmeinfo->state & 0x03) == WIFI_FW_ADHOC_STATE)) { +@@ -1157,7 +1186,12 @@ void SetHwReg8188EU(struct adapter *Adapter, u8 variable, u8 *val) + + rtw_write8(Adapter, REG_BCN_CTRL, reg & (~BIT(4))); + } +- rtw_write32(Adapter, REG_RCR, rtw_read32(Adapter, REG_RCR) | RCR_CBSSID_BCN); ++ ++ res = rtw_read32(Adapter, REG_RCR, ®32); ++ if (res) ++ return; ++ ++ rtw_write32(Adapter, REG_RCR, reg32 | RCR_CBSSID_BCN); + } + break; + case HW_VAR_SLOT_TIME: +@@ -1326,7 +1360,10 @@ void SetBeaconRelatedRegisters8188EUsb(struct adapter *adapt) + + rtw_write8(adapt, REG_SLOT, 0x09); + +- value32 = rtw_read32(adapt, REG_TCR); ++ res = rtw_read32(adapt, REG_TCR, &value32); ++ if (res) ++ return; ++ + value32 &= ~TSFRST; + rtw_write32(adapt, REG_TCR, value32); + +diff --git a/drivers/staging/r8188eu/hal/usb_ops_linux.c b/drivers/staging/r8188eu/hal/usb_ops_linux.c +index 7d62f1f3d26e..c1a4d023f627 100644 +--- a/drivers/staging/r8188eu/hal/usb_ops_linux.c ++++ b/drivers/staging/r8188eu/hal/usb_ops_linux.c +@@ -120,16 +120,21 @@ int __must_check rtw_read16(struct adapter *adapter, u32 addr, u16 *data) + return 0; + } + +-u32 rtw_read32(struct adapter *adapter, u32 addr) ++int __must_check rtw_read32(struct adapter *adapter, u32 addr, u32 *data) + { + struct io_priv *io_priv = &adapter->iopriv; + struct intf_hdl *intf = &io_priv->intf; + u16 value = addr & 0xffff; +- __le32 data; ++ __le32 le_data; ++ int res; + +- usb_read(intf, value, &data, 4); ++ res = usb_read(intf, value, &le_data, 4); ++ if (res) ++ return res; + +- return le32_to_cpu(data); ++ *data = le32_to_cpu(le_data); ++ ++ return 0; + } + + int rtw_write8(struct adapter *adapter, u32 addr, u8 val) +diff --git a/drivers/staging/r8188eu/include/rtw_io.h b/drivers/staging/r8188eu/include/rtw_io.h +index ce3369e33d66..1c6097367a67 100644 +--- a/drivers/staging/r8188eu/include/rtw_io.h ++++ b/drivers/staging/r8188eu/include/rtw_io.h +@@ -222,7 +222,7 @@ void _rtw_attrib_write(struct adapter *adapter, u32 addr, u32 cnt, u8 *pmem); + + int __must_check rtw_read8(struct adapter *adapter, u32 addr, u8 *data); + int __must_check rtw_read16(struct adapter *adapter, u32 addr, u16 *data); +-u32 rtw_read32(struct adapter *adapter, u32 addr); ++int __must_check rtw_read32(struct adapter *adapter, u32 addr, u32 *data); + void _rtw_read_mem(struct adapter *adapter, u32 addr, u32 cnt, u8 *pmem); + u32 rtw_read_port(struct adapter *adapter, u8 *pmem); + void rtw_read_port_cancel(struct adapter *adapter); +diff --git a/drivers/staging/r8188eu/os_dep/ioctl_linux.c b/drivers/staging/r8188eu/os_dep/ioctl_linux.c +index 7ec363089ae0..f486870965ac 100644 +--- a/drivers/staging/r8188eu/os_dep/ioctl_linux.c ++++ b/drivers/staging/r8188eu/os_dep/ioctl_linux.c +@@ -3126,18 +3126,29 @@ static int rtw_rereg_nd_name(struct net_device *dev, + static void mac_reg_dump(struct adapter *padapter) + { + int i, j = 1; ++ u32 reg; ++ int res; ++ + pr_info("\n ======= MAC REG =======\n"); + for (i = 0x0; i < 0x300; i += 4) { + if (j % 4 == 1) + pr_info("0x%02x", i); +- pr_info(" 0x%08x ", rtw_read32(padapter, i)); ++ ++ res = rtw_read32(padapter, i, ®); ++ if (!res) ++ pr_info(" 0x%08x ", reg); ++ + if ((j++) % 4 == 0) + pr_info("\n"); + } + for (i = 0x400; i < 0x800; i += 4) { + if (j % 4 == 1) + pr_info("0x%02x", i); +- pr_info(" 0x%08x ", rtw_read32(padapter, i)); ++ ++ res = rtw_read32(padapter, i, ®); ++ if (!res) ++ pr_info(" 0x%08x ", reg); ++ + if ((j++) % 4 == 0) + pr_info("\n"); + } +@@ -3145,13 +3156,18 @@ static void mac_reg_dump(struct adapter *padapter) + + static void bb_reg_dump(struct adapter *padapter) + { +- int i, j = 1; ++ int i, j = 1, res; ++ u32 reg; ++ + pr_info("\n ======= BB REG =======\n"); + for (i = 0x800; i < 0x1000; i += 4) { + if (j % 4 == 1) + pr_info("0x%02x", i); + +- pr_info(" 0x%08x ", rtw_read32(padapter, i)); ++ res = rtw_read32(padapter, i, ®); ++ if (!res) ++ pr_info(" 0x%08x ", reg); ++ + if ((j++) % 4 == 0) + pr_info("\n"); + } +@@ -3398,7 +3414,8 @@ static int rtw_dbg_port(struct net_device *dev, + if (rtl8188e_IOL_exec_cmds_sync(padapter, xmit_frame, 5000, 0) != _SUCCESS) + ret = -EPERM; + +- rtw_read32(padapter, reg); ++ /* FIXME: is this read necessary? */ ++ ret = rtw_read32(padapter, reg, &write_num); + } + break; + } +diff --git a/drivers/staging/r8188eu/os_dep/os_intfs.c b/drivers/staging/r8188eu/os_dep/os_intfs.c +index d9325ef6ac28..cac9553666e6 100644 +--- a/drivers/staging/r8188eu/os_dep/os_intfs.c ++++ b/drivers/staging/r8188eu/os_dep/os_intfs.c +@@ -741,6 +741,7 @@ static void rtw_fifo_cleanup(struct adapter *adapter) + struct pwrctrl_priv *pwrpriv = &adapter->pwrctrlpriv; + u8 trycnt = 100; + int res; ++ u32 reg; + + /* pause tx */ + rtw_write8(adapter, REG_TXPAUSE, 0xff); +@@ -753,10 +754,18 @@ static void rtw_fifo_cleanup(struct adapter *adapter) + + if (!pwrpriv->bkeepfwalive) { + /* RX DMA stop */ ++ res = rtw_read32(adapter, REG_RXPKT_NUM, ®); ++ if (res) ++ return; ++ + rtw_write32(adapter, REG_RXPKT_NUM, +- (rtw_read32(adapter, REG_RXPKT_NUM) | RW_RELEASE_EN)); ++ (reg | RW_RELEASE_EN)); + do { +- if (!(rtw_read32(adapter, REG_RXPKT_NUM) & RXDMA_IDLE)) ++ res = rtw_read32(adapter, REG_RXPKT_NUM, ®); ++ if (res) ++ continue; ++ ++ if (!(reg & RXDMA_IDLE)) + break; + } while (trycnt--); + +-- +2.35.1 + diff --git a/queue-5.19/staging-r8188eu-add-error-handling-of-rtw_read8.patch b/queue-5.19/staging-r8188eu-add-error-handling-of-rtw_read8.patch new file mode 100644 index 00000000000..eb2329ccd20 --- /dev/null +++ b/queue-5.19/staging-r8188eu-add-error-handling-of-rtw_read8.patch @@ -0,0 +1,1235 @@ +From 16e08b15ef6190d943bba257bdfc228b053b5713 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Jun 2022 22:26:05 +0300 +Subject: staging: r8188eu: add error handling of rtw_read8 + +From: Pavel Skripkin + +[ Upstream commit 857fe9e5efc09833fe1110e99d8baba954a86abb ] + +rtw_read8() reads data from device via USB API which may fail. In case +of any failure previous code returned stack data to callers, which is +wrong. + +Fix it by changing rtw_read8() prototype and prevent caller from +touching random stack data + +Signed-off-by: Pavel Skripkin +Link: https://lore.kernel.org/r/c8f8ef4f14db3ba2478a87d5be6eb768a093dfaf.1654629778.git.paskripkin@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/r8188eu/core/rtw_efuse.c | 13 +- + drivers/staging/r8188eu/core/rtw_fw.c | 56 ++++-- + drivers/staging/r8188eu/core/rtw_led.c | 16 +- + drivers/staging/r8188eu/core/rtw_mlme_ext.c | 48 ++++- + drivers/staging/r8188eu/core/rtw_wlan_util.c | 20 +- + drivers/staging/r8188eu/hal/HalPhyRf_8188e.c | 18 +- + drivers/staging/r8188eu/hal/HalPwrSeqCmd.c | 9 +- + drivers/staging/r8188eu/hal/hal_com.c | 27 ++- + drivers/staging/r8188eu/hal/rtl8188e_cmd.c | 37 +++- + drivers/staging/r8188eu/hal/rtl8188e_dm.c | 6 +- + .../staging/r8188eu/hal/rtl8188e_hal_init.c | 69 +++++-- + drivers/staging/r8188eu/hal/rtl8188e_phycfg.c | 10 +- + drivers/staging/r8188eu/hal/usb_halinit.c | 171 +++++++++++++++--- + drivers/staging/r8188eu/hal/usb_ops_linux.c | 7 +- + drivers/staging/r8188eu/include/rtw_io.h | 2 +- + drivers/staging/r8188eu/os_dep/ioctl_linux.c | 11 +- + 16 files changed, 418 insertions(+), 102 deletions(-) + +diff --git a/drivers/staging/r8188eu/core/rtw_efuse.c b/drivers/staging/r8188eu/core/rtw_efuse.c +index 0e0e60638880..a2691c7f96f6 100644 +--- a/drivers/staging/r8188eu/core/rtw_efuse.c ++++ b/drivers/staging/r8188eu/core/rtw_efuse.c +@@ -28,14 +28,21 @@ ReadEFuseByte( + u32 value32; + u8 readbyte; + u16 retry; ++ int res; + + /* Write Address */ + rtw_write8(Adapter, EFUSE_CTRL + 1, (_offset & 0xff)); +- readbyte = rtw_read8(Adapter, EFUSE_CTRL + 2); ++ res = rtw_read8(Adapter, EFUSE_CTRL + 2, &readbyte); ++ if (res) ++ return; ++ + rtw_write8(Adapter, EFUSE_CTRL + 2, ((_offset >> 8) & 0x03) | (readbyte & 0xfc)); + + /* Write bit 32 0 */ +- readbyte = rtw_read8(Adapter, EFUSE_CTRL + 3); ++ res = rtw_read8(Adapter, EFUSE_CTRL + 3, &readbyte); ++ if (res) ++ return; ++ + rtw_write8(Adapter, EFUSE_CTRL + 3, (readbyte & 0x7f)); + + /* Check bit 32 read-ready */ +@@ -54,6 +61,8 @@ ReadEFuseByte( + value32 = rtw_read32(Adapter, EFUSE_CTRL); + + *pbuf = (u8)(value32 & 0xff); ++ ++ /* FIXME: return an error to caller */ + } + + /*----------------------------------------------------------------------------- +diff --git a/drivers/staging/r8188eu/core/rtw_fw.c b/drivers/staging/r8188eu/core/rtw_fw.c +index 0451e5177644..7cf8525595c6 100644 +--- a/drivers/staging/r8188eu/core/rtw_fw.c ++++ b/drivers/staging/r8188eu/core/rtw_fw.c +@@ -44,18 +44,28 @@ static_assert(sizeof(struct rt_firmware_hdr) == 32); + static void fw_download_enable(struct adapter *padapter, bool enable) + { + u8 tmp; ++ int res; + + if (enable) { + /* MCU firmware download enable. */ +- tmp = rtw_read8(padapter, REG_MCUFWDL); ++ res = rtw_read8(padapter, REG_MCUFWDL, &tmp); ++ if (res) ++ return; ++ + rtw_write8(padapter, REG_MCUFWDL, tmp | 0x01); + + /* 8051 reset */ +- tmp = rtw_read8(padapter, REG_MCUFWDL + 2); ++ res = rtw_read8(padapter, REG_MCUFWDL + 2, &tmp); ++ if (res) ++ return; ++ + rtw_write8(padapter, REG_MCUFWDL + 2, tmp & 0xf7); + } else { + /* MCU firmware download disable. */ +- tmp = rtw_read8(padapter, REG_MCUFWDL); ++ res = rtw_read8(padapter, REG_MCUFWDL, &tmp); ++ if (res) ++ return; ++ + rtw_write8(padapter, REG_MCUFWDL, tmp & 0xfe); + + /* Reserved for fw extension. */ +@@ -125,8 +135,13 @@ static int page_write(struct adapter *padapter, u32 page, u8 *buffer, u32 size) + { + u8 value8; + u8 u8Page = (u8)(page & 0x07); ++ int res; ++ ++ res = rtw_read8(padapter, REG_MCUFWDL + 2, &value8); ++ if (res) ++ return _FAIL; + +- value8 = (rtw_read8(padapter, REG_MCUFWDL + 2) & 0xF8) | u8Page; ++ value8 = (value8 & 0xF8) | u8Page; + rtw_write8(padapter, REG_MCUFWDL + 2, value8); + + return block_write(padapter, buffer, size); +@@ -165,8 +180,12 @@ static int write_fw(struct adapter *padapter, u8 *buffer, u32 size) + void rtw_reset_8051(struct adapter *padapter) + { + u8 val8; ++ int res; ++ ++ res = rtw_read8(padapter, REG_SYS_FUNC_EN + 1, &val8); ++ if (res) ++ return; + +- val8 = rtw_read8(padapter, REG_SYS_FUNC_EN + 1); + rtw_write8(padapter, REG_SYS_FUNC_EN + 1, val8 & (~BIT(2))); + rtw_write8(padapter, REG_SYS_FUNC_EN + 1, val8 | (BIT(2))); + } +@@ -239,7 +258,7 @@ static int load_firmware(struct rt_firmware *rtfw, struct device *device) + int rtl8188e_firmware_download(struct adapter *padapter) + { + int ret = _SUCCESS; +- u8 write_fw_retry = 0; ++ u8 reg; + unsigned long fwdl_timeout; + struct dvobj_priv *dvobj = adapter_to_dvobj(padapter); + struct device *device = dvobj_to_dev(dvobj); +@@ -269,23 +288,34 @@ int rtl8188e_firmware_download(struct adapter *padapter) + + /* Suggested by Filen. If 8051 is running in RAM code, driver should inform Fw to reset by itself, */ + /* or it will cause download Fw fail. 2010.02.01. by tynli. */ +- if (rtw_read8(padapter, REG_MCUFWDL) & RAM_DL_SEL) { /* 8051 RAM code */ ++ ret = rtw_read8(padapter, REG_MCUFWDL, ®); ++ if (ret) { ++ ret = _FAIL; ++ goto exit; ++ } ++ ++ if (reg & RAM_DL_SEL) { /* 8051 RAM code */ + rtw_write8(padapter, REG_MCUFWDL, 0x00); + rtw_reset_8051(padapter); + } + + fw_download_enable(padapter, true); + fwdl_timeout = jiffies + msecs_to_jiffies(500); +- while (1) { ++ do { + /* reset the FWDL chksum */ +- rtw_write8(padapter, REG_MCUFWDL, rtw_read8(padapter, REG_MCUFWDL) | FWDL_CHKSUM_RPT); ++ ret = rtw_read8(padapter, REG_MCUFWDL, ®); ++ if (ret) { ++ ret = _FAIL; ++ continue; ++ } + +- ret = write_fw(padapter, fw_data, fw_size); ++ rtw_write8(padapter, REG_MCUFWDL, reg | FWDL_CHKSUM_RPT); + +- if (ret == _SUCCESS || +- (time_after(jiffies, fwdl_timeout) && write_fw_retry++ >= 3)) ++ ret = write_fw(padapter, fw_data, fw_size); ++ if (ret == _SUCCESS) + break; +- } ++ } while (!time_after(jiffies, fwdl_timeout)); ++ + fw_download_enable(padapter, false); + if (ret != _SUCCESS) + goto exit; +diff --git a/drivers/staging/r8188eu/core/rtw_led.c b/drivers/staging/r8188eu/core/rtw_led.c +index 2f3000428af7..25989acf5259 100644 +--- a/drivers/staging/r8188eu/core/rtw_led.c ++++ b/drivers/staging/r8188eu/core/rtw_led.c +@@ -35,11 +35,15 @@ static void ResetLedStatus(struct LED_871x *pLed) + static void SwLedOn(struct adapter *padapter, struct LED_871x *pLed) + { + u8 LedCfg; ++ int res; + + if (padapter->bSurpriseRemoved || padapter->bDriverStopped) + return; + +- LedCfg = rtw_read8(padapter, REG_LEDCFG2); ++ res = rtw_read8(padapter, REG_LEDCFG2, &LedCfg); ++ if (res) ++ return; ++ + rtw_write8(padapter, REG_LEDCFG2, (LedCfg & 0xf0) | BIT(5) | BIT(6)); /* SW control led0 on. */ + pLed->bLedOn = true; + } +@@ -47,15 +51,21 @@ static void SwLedOn(struct adapter *padapter, struct LED_871x *pLed) + static void SwLedOff(struct adapter *padapter, struct LED_871x *pLed) + { + u8 LedCfg; ++ int res; + + if (padapter->bSurpriseRemoved || padapter->bDriverStopped) + goto exit; + +- LedCfg = rtw_read8(padapter, REG_LEDCFG2);/* 0x4E */ ++ res = rtw_read8(padapter, REG_LEDCFG2, &LedCfg);/* 0x4E */ ++ if (res) ++ goto exit; + + LedCfg &= 0x90; /* Set to software control. */ + rtw_write8(padapter, REG_LEDCFG2, (LedCfg | BIT(3))); +- LedCfg = rtw_read8(padapter, REG_MAC_PINMUX_CFG); ++ res = rtw_read8(padapter, REG_MAC_PINMUX_CFG, &LedCfg); ++ if (res) ++ goto exit; ++ + LedCfg &= 0xFE; + rtw_write8(padapter, REG_MAC_PINMUX_CFG, LedCfg); + exit: +diff --git a/drivers/staging/r8188eu/core/rtw_mlme_ext.c b/drivers/staging/r8188eu/core/rtw_mlme_ext.c +index faf23fc950c5..fdb5a8cb9d69 100644 +--- a/drivers/staging/r8188eu/core/rtw_mlme_ext.c ++++ b/drivers/staging/r8188eu/core/rtw_mlme_ext.c +@@ -5667,14 +5667,28 @@ unsigned int send_beacon(struct adapter *padapter) + + bool get_beacon_valid_bit(struct adapter *adapter) + { ++ int res; ++ u8 reg; ++ ++ res = rtw_read8(adapter, REG_TDECTRL + 2, ®); ++ if (res) ++ return false; ++ + /* BIT(16) of REG_TDECTRL = BIT(0) of REG_TDECTRL+2 */ +- return BIT(0) & rtw_read8(adapter, REG_TDECTRL + 2); ++ return BIT(0) & reg; + } + + void clear_beacon_valid_bit(struct adapter *adapter) + { ++ int res; ++ u8 reg; ++ ++ res = rtw_read8(adapter, REG_TDECTRL + 2, ®); ++ if (res) ++ return; ++ + /* BIT(16) of REG_TDECTRL = BIT(0) of REG_TDECTRL+2, write 1 to clear, Clear by sw */ +- rtw_write8(adapter, REG_TDECTRL + 2, rtw_read8(adapter, REG_TDECTRL + 2) | BIT(0)); ++ rtw_write8(adapter, REG_TDECTRL + 2, reg | BIT(0)); + } + + /**************************************************************************** +@@ -6002,7 +6016,8 @@ static void rtw_set_bssid(struct adapter *adapter, u8 *bssid) + static void mlme_join(struct adapter *adapter, int type) + { + struct mlme_priv *mlmepriv = &adapter->mlmepriv; +- u8 retry_limit = 0x30; ++ u8 retry_limit = 0x30, reg; ++ int res; + + switch (type) { + case 0: +@@ -6027,7 +6042,11 @@ static void mlme_join(struct adapter *adapter, int type) + case 2: + /* sta add event call back */ + /* enable update TSF */ +- rtw_write8(adapter, REG_BCN_CTRL, rtw_read8(adapter, REG_BCN_CTRL) & (~BIT(4))); ++ res = rtw_read8(adapter, REG_BCN_CTRL, ®); ++ if (res) ++ return; ++ ++ rtw_write8(adapter, REG_BCN_CTRL, reg & (~BIT(4))); + + if (check_fwstate(mlmepriv, WIFI_ADHOC_STATE | WIFI_ADHOC_MASTER_STATE)) + retry_limit = 0x7; +@@ -6748,6 +6767,9 @@ void mlmeext_sta_add_event_callback(struct adapter *padapter, struct sta_info *p + + static void mlme_disconnect(struct adapter *adapter) + { ++ int res; ++ u8 reg; ++ + /* Set RCR to not to receive data frame when NO LINK state */ + /* reject all data frames */ + rtw_write16(adapter, REG_RXFLTMAP2, 0x00); +@@ -6756,7 +6778,12 @@ static void mlme_disconnect(struct adapter *adapter) + rtw_write8(adapter, REG_DUAL_TSF_RST, (BIT(0) | BIT(1))); + + /* disable update TSF */ +- rtw_write8(adapter, REG_BCN_CTRL, rtw_read8(adapter, REG_BCN_CTRL) | BIT(4)); ++ ++ res = rtw_read8(adapter, REG_BCN_CTRL, ®); ++ if (res) ++ return; ++ ++ rtw_write8(adapter, REG_BCN_CTRL, reg | BIT(4)); + } + + void mlmeext_sta_del_event_callback(struct adapter *padapter) +@@ -6810,14 +6837,15 @@ static u8 chk_ap_is_alive(struct sta_info *psta) + return ret; + } + +-static void rtl8188e_sreset_linked_status_check(struct adapter *padapter) ++static int rtl8188e_sreset_linked_status_check(struct adapter *padapter) + { + u32 rx_dma_status = rtw_read32(padapter, REG_RXDMA_STATUS); ++ u8 reg; + + if (rx_dma_status != 0x00) + rtw_write32(padapter, REG_RXDMA_STATUS, rx_dma_status); + +- rtw_read8(padapter, REG_FMETHR); ++ return rtw_read8(padapter, REG_FMETHR, ®); + } + + void linked_status_chk(struct adapter *padapter) +@@ -7219,6 +7247,7 @@ u8 disconnect_hdl(struct adapter *padapter, unsigned char *pbuf) + struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info; + struct wlan_bssid_ex *pnetwork = (struct wlan_bssid_ex *)(&pmlmeinfo->network); + u8 val8; ++ int res; + + if (is_client_associated_to_ap(padapter)) + issue_deauth_ex(padapter, pnetwork->MacAddress, WLAN_REASON_DEAUTH_LEAVING, param->deauth_timeout_ms / 100, 100); +@@ -7231,7 +7260,10 @@ u8 disconnect_hdl(struct adapter *padapter, unsigned char *pbuf) + + if (((pmlmeinfo->state & 0x03) == WIFI_FW_ADHOC_STATE) || ((pmlmeinfo->state & 0x03) == WIFI_FW_AP_STATE)) { + /* Stop BCN */ +- val8 = rtw_read8(padapter, REG_BCN_CTRL); ++ res = rtw_read8(padapter, REG_BCN_CTRL, &val8); ++ if (res) ++ return H2C_DROPPED; ++ + rtw_write8(padapter, REG_BCN_CTRL, val8 & (~(EN_BCN_FUNCTION | EN_TXBCN_RPT))); + } + +diff --git a/drivers/staging/r8188eu/core/rtw_wlan_util.c b/drivers/staging/r8188eu/core/rtw_wlan_util.c +index 392a65783f32..9bd059b86d0c 100644 +--- a/drivers/staging/r8188eu/core/rtw_wlan_util.c ++++ b/drivers/staging/r8188eu/core/rtw_wlan_util.c +@@ -279,8 +279,13 @@ void Restore_DM_Func_Flag(struct adapter *padapter) + void Set_MSR(struct adapter *padapter, u8 type) + { + u8 val8; ++ int res; + +- val8 = rtw_read8(padapter, MSR) & 0x0c; ++ res = rtw_read8(padapter, MSR, &val8); ++ if (res) ++ return; ++ ++ val8 &= 0x0c; + val8 |= type; + rtw_write8(padapter, MSR, val8); + } +@@ -505,7 +510,11 @@ int WMM_param_handler(struct adapter *padapter, struct ndis_802_11_var_ie *pIE) + + static void set_acm_ctrl(struct adapter *adapter, u8 acm_mask) + { +- u8 acmctrl = rtw_read8(adapter, REG_ACMHWCTRL); ++ u8 acmctrl; ++ int res = rtw_read8(adapter, REG_ACMHWCTRL, &acmctrl); ++ ++ if (res) ++ return; + + if (acm_mask > 1) + acmctrl = acmctrl | 0x1; +@@ -765,6 +774,7 @@ void HT_info_handler(struct adapter *padapter, struct ndis_802_11_var_ie *pIE) + static void set_min_ampdu_spacing(struct adapter *adapter, u8 spacing) + { + u8 sec_spacing; ++ int res; + + if (spacing <= 7) { + switch (adapter->securitypriv.dot11PrivacyAlgrthm) { +@@ -786,8 +796,12 @@ static void set_min_ampdu_spacing(struct adapter *adapter, u8 spacing) + if (spacing < sec_spacing) + spacing = sec_spacing; + ++ res = rtw_read8(adapter, REG_AMPDU_MIN_SPACE, &sec_spacing); ++ if (res) ++ return; ++ + rtw_write8(adapter, REG_AMPDU_MIN_SPACE, +- (rtw_read8(adapter, REG_AMPDU_MIN_SPACE) & 0xf8) | spacing); ++ (sec_spacing & 0xf8) | spacing); + } + } + +diff --git a/drivers/staging/r8188eu/hal/HalPhyRf_8188e.c b/drivers/staging/r8188eu/hal/HalPhyRf_8188e.c +index b944c8071a3b..a5b7980dfcee 100644 +--- a/drivers/staging/r8188eu/hal/HalPhyRf_8188e.c ++++ b/drivers/staging/r8188eu/hal/HalPhyRf_8188e.c +@@ -463,6 +463,7 @@ void _PHY_SaveADDARegisters(struct adapter *adapt, u32 *ADDAReg, u32 *ADDABackup + } + } + ++/* FIXME: return an error to caller */ + static void _PHY_SaveMACRegisters( + struct adapter *adapt, + u32 *MACReg, +@@ -470,9 +471,17 @@ static void _PHY_SaveMACRegisters( + ) + { + u32 i; ++ int res; + +- for (i = 0; i < (IQK_MAC_REG_NUM - 1); i++) +- MACBackup[i] = rtw_read8(adapt, MACReg[i]); ++ for (i = 0; i < (IQK_MAC_REG_NUM - 1); i++) { ++ u8 reg; ++ ++ res = rtw_read8(adapt, MACReg[i], ®); ++ if (res) ++ return; ++ ++ MACBackup[i] = reg; ++ } + + MACBackup[i] = rtw_read32(adapt, MACReg[i]); + } +@@ -739,9 +748,12 @@ static void phy_LCCalibrate_8188E(struct adapter *adapt) + { + u8 tmpreg; + u32 RF_Amode = 0, LC_Cal; ++ int res; + + /* Check continuous TX and Packet TX */ +- tmpreg = rtw_read8(adapt, 0xd03); ++ res = rtw_read8(adapt, 0xd03, &tmpreg); ++ if (res) ++ return; + + if ((tmpreg & 0x70) != 0) /* Deal with contisuous TX case */ + rtw_write8(adapt, 0xd03, tmpreg & 0x8F); /* disable all continuous TX */ +diff --git a/drivers/staging/r8188eu/hal/HalPwrSeqCmd.c b/drivers/staging/r8188eu/hal/HalPwrSeqCmd.c +index 150ea380c39e..4a4563b900b3 100644 +--- a/drivers/staging/r8188eu/hal/HalPwrSeqCmd.c ++++ b/drivers/staging/r8188eu/hal/HalPwrSeqCmd.c +@@ -12,6 +12,7 @@ u8 HalPwrSeqCmdParsing(struct adapter *padapter, struct wl_pwr_cfg pwrseqcmd[]) + u32 offset = 0; + u32 poll_count = 0; /* polling autoload done. */ + u32 max_poll_count = 5000; ++ int res; + + do { + pwrcfgcmd = pwrseqcmd[aryidx]; +@@ -21,7 +22,9 @@ u8 HalPwrSeqCmdParsing(struct adapter *padapter, struct wl_pwr_cfg pwrseqcmd[]) + offset = GET_PWR_CFG_OFFSET(pwrcfgcmd); + + /* Read the value from system register */ +- value = rtw_read8(padapter, offset); ++ res = rtw_read8(padapter, offset, &value); ++ if (res) ++ return false; + + value &= ~(GET_PWR_CFG_MASK(pwrcfgcmd)); + value |= (GET_PWR_CFG_VALUE(pwrcfgcmd) & GET_PWR_CFG_MASK(pwrcfgcmd)); +@@ -33,7 +36,9 @@ u8 HalPwrSeqCmdParsing(struct adapter *padapter, struct wl_pwr_cfg pwrseqcmd[]) + poll_bit = false; + offset = GET_PWR_CFG_OFFSET(pwrcfgcmd); + do { +- value = rtw_read8(padapter, offset); ++ res = rtw_read8(padapter, offset, &value); ++ if (res) ++ return false; + + value &= GET_PWR_CFG_MASK(pwrcfgcmd); + if (value == (GET_PWR_CFG_VALUE(pwrcfgcmd) & GET_PWR_CFG_MASK(pwrcfgcmd))) +diff --git a/drivers/staging/r8188eu/hal/hal_com.c b/drivers/staging/r8188eu/hal/hal_com.c +index 910cc07f656c..e9a32dd84a8e 100644 +--- a/drivers/staging/r8188eu/hal/hal_com.c ++++ b/drivers/staging/r8188eu/hal/hal_com.c +@@ -303,7 +303,9 @@ s32 c2h_evt_read(struct adapter *adapter, u8 *buf) + if (!buf) + goto exit; + +- trigger = rtw_read8(adapter, REG_C2HEVT_CLEAR); ++ ret = rtw_read8(adapter, REG_C2HEVT_CLEAR, &trigger); ++ if (ret) ++ return _FAIL; + + if (trigger == C2H_EVT_HOST_CLOSE) + goto exit; /* Not ready */ +@@ -314,13 +316,26 @@ s32 c2h_evt_read(struct adapter *adapter, u8 *buf) + + memset(c2h_evt, 0, 16); + +- *buf = rtw_read8(adapter, REG_C2HEVT_MSG_NORMAL); +- *(buf + 1) = rtw_read8(adapter, REG_C2HEVT_MSG_NORMAL + 1); ++ ret = rtw_read8(adapter, REG_C2HEVT_MSG_NORMAL, buf); ++ if (ret) { ++ ret = _FAIL; ++ goto clear_evt; ++ } + ++ ret = rtw_read8(adapter, REG_C2HEVT_MSG_NORMAL + 1, buf + 1); ++ if (ret) { ++ ret = _FAIL; ++ goto clear_evt; ++ } + /* Read the content */ +- for (i = 0; i < c2h_evt->plen; i++) +- c2h_evt->payload[i] = rtw_read8(adapter, REG_C2HEVT_MSG_NORMAL + +- sizeof(*c2h_evt) + i); ++ for (i = 0; i < c2h_evt->plen; i++) { ++ ret = rtw_read8(adapter, REG_C2HEVT_MSG_NORMAL + ++ sizeof(*c2h_evt) + i, c2h_evt->payload + i); ++ if (ret) { ++ ret = _FAIL; ++ goto clear_evt; ++ } ++ } + + ret = _SUCCESS; + +diff --git a/drivers/staging/r8188eu/hal/rtl8188e_cmd.c b/drivers/staging/r8188eu/hal/rtl8188e_cmd.c +index 475650dc7301..b01ee1695fee 100644 +--- a/drivers/staging/r8188eu/hal/rtl8188e_cmd.c ++++ b/drivers/staging/r8188eu/hal/rtl8188e_cmd.c +@@ -18,13 +18,18 @@ + + static u8 _is_fw_read_cmd_down(struct adapter *adapt, u8 msgbox_num) + { +- u8 read_down = false; ++ u8 read_down = false, reg; + int retry_cnts = 100; ++ int res; + + u8 valid; + + do { +- valid = rtw_read8(adapt, REG_HMETFR) & BIT(msgbox_num); ++ res = rtw_read8(adapt, REG_HMETFR, ®); ++ if (res) ++ continue; ++ ++ valid = reg & BIT(msgbox_num); + if (0 == valid) + read_down = true; + } while ((!read_down) && (retry_cnts--)); +@@ -533,6 +538,8 @@ void rtl8188e_set_FwJoinBssReport_cmd(struct adapter *adapt, u8 mstatus) + bool bcn_valid = false; + u8 DLBcnCount = 0; + u32 poll = 0; ++ u8 reg; ++ int res; + + if (mstatus == 1) { + /* We should set AID, correct TSF, HW seq enable before set JoinBssReport to Fw in 88/92C. */ +@@ -547,8 +554,17 @@ void rtl8188e_set_FwJoinBssReport_cmd(struct adapter *adapt, u8 mstatus) + /* Disable Hw protection for a time which revserd for Hw sending beacon. */ + /* Fix download reserved page packet fail that access collision with the protection time. */ + /* 2010.05.11. Added by tynli. */ +- rtw_write8(adapt, REG_BCN_CTRL, rtw_read8(adapt, REG_BCN_CTRL) & (~BIT(3))); +- rtw_write8(adapt, REG_BCN_CTRL, rtw_read8(adapt, REG_BCN_CTRL) | BIT(4)); ++ res = rtw_read8(adapt, REG_BCN_CTRL, ®); ++ if (res) ++ return; ++ ++ rtw_write8(adapt, REG_BCN_CTRL, reg & (~BIT(3))); ++ ++ res = rtw_read8(adapt, REG_BCN_CTRL, ®); ++ if (res) ++ return; ++ ++ rtw_write8(adapt, REG_BCN_CTRL, reg | BIT(4)); + + if (haldata->RegFwHwTxQCtrl & BIT(6)) + bSendBeacon = true; +@@ -581,8 +597,17 @@ void rtl8188e_set_FwJoinBssReport_cmd(struct adapter *adapt, u8 mstatus) + /* */ + + /* Enable Bcn */ +- rtw_write8(adapt, REG_BCN_CTRL, rtw_read8(adapt, REG_BCN_CTRL) | BIT(3)); +- rtw_write8(adapt, REG_BCN_CTRL, rtw_read8(adapt, REG_BCN_CTRL) & (~BIT(4))); ++ res = rtw_read8(adapt, REG_BCN_CTRL, ®); ++ if (res) ++ return; ++ ++ rtw_write8(adapt, REG_BCN_CTRL, reg | BIT(3)); ++ ++ res = rtw_read8(adapt, REG_BCN_CTRL, ®); ++ if (res) ++ return; ++ ++ rtw_write8(adapt, REG_BCN_CTRL, reg & (~BIT(4))); + + /* To make sure that if there exists an adapter which would like to send beacon. */ + /* If exists, the origianl value of 0x422[6] will be 1, we should check this to */ +diff --git a/drivers/staging/r8188eu/hal/rtl8188e_dm.c b/drivers/staging/r8188eu/hal/rtl8188e_dm.c +index 6d28e3dc0d26..0399872c4546 100644 +--- a/drivers/staging/r8188eu/hal/rtl8188e_dm.c ++++ b/drivers/staging/r8188eu/hal/rtl8188e_dm.c +@@ -12,8 +12,12 @@ + static void dm_InitGPIOSetting(struct adapter *Adapter) + { + u8 tmp1byte; ++ int res; ++ ++ res = rtw_read8(Adapter, REG_GPIO_MUXCFG, &tmp1byte); ++ if (res) ++ return; + +- tmp1byte = rtw_read8(Adapter, REG_GPIO_MUXCFG); + tmp1byte &= (GPIOSEL_GPIO | ~GPIOSEL_ENBT); + + rtw_write8(Adapter, REG_GPIO_MUXCFG, tmp1byte); +diff --git a/drivers/staging/r8188eu/hal/rtl8188e_hal_init.c b/drivers/staging/r8188eu/hal/rtl8188e_hal_init.c +index e17375a74f17..e67ecbd1ba79 100644 +--- a/drivers/staging/r8188eu/hal/rtl8188e_hal_init.c ++++ b/drivers/staging/r8188eu/hal/rtl8188e_hal_init.c +@@ -13,10 +13,14 @@ + static void iol_mode_enable(struct adapter *padapter, u8 enable) + { + u8 reg_0xf0 = 0; ++ int res; + + if (enable) { + /* Enable initial offload */ +- reg_0xf0 = rtw_read8(padapter, REG_SYS_CFG); ++ res = rtw_read8(padapter, REG_SYS_CFG, ®_0xf0); ++ if (res) ++ return; ++ + rtw_write8(padapter, REG_SYS_CFG, reg_0xf0 | SW_OFFLOAD_EN); + + if (!padapter->bFWReady) +@@ -24,7 +28,10 @@ static void iol_mode_enable(struct adapter *padapter, u8 enable) + + } else { + /* disable initial offload */ +- reg_0xf0 = rtw_read8(padapter, REG_SYS_CFG); ++ res = rtw_read8(padapter, REG_SYS_CFG, ®_0xf0); ++ if (res) ++ return; ++ + rtw_write8(padapter, REG_SYS_CFG, reg_0xf0 & ~SW_OFFLOAD_EN); + } + } +@@ -34,17 +41,31 @@ static s32 iol_execute(struct adapter *padapter, u8 control) + s32 status = _FAIL; + u8 reg_0x88 = 0; + unsigned long timeout; ++ int res; + + control = control & 0x0f; +- reg_0x88 = rtw_read8(padapter, REG_HMEBOX_E0); ++ res = rtw_read8(padapter, REG_HMEBOX_E0, ®_0x88); ++ if (res) ++ return _FAIL; ++ + rtw_write8(padapter, REG_HMEBOX_E0, reg_0x88 | control); + + timeout = jiffies + msecs_to_jiffies(1000); +- while ((reg_0x88 = rtw_read8(padapter, REG_HMEBOX_E0)) & control && +- time_before(jiffies, timeout)) +- ; + +- reg_0x88 = rtw_read8(padapter, REG_HMEBOX_E0); ++ do { ++ res = rtw_read8(padapter, REG_HMEBOX_E0, ®_0x88); ++ if (res) ++ continue; ++ ++ if (!(reg_0x88 & control)) ++ break; ++ ++ } while (time_before(jiffies, timeout)); ++ ++ res = rtw_read8(padapter, REG_HMEBOX_E0, ®_0x88); ++ if (res) ++ return _FAIL; ++ + status = (reg_0x88 & control) ? _FAIL : _SUCCESS; + if (reg_0x88 & control << 4) + status = _FAIL; +@@ -190,13 +211,18 @@ static void efuse_read_phymap_from_txpktbuf( + u16 dbg_addr = 0; + __le32 lo32 = 0, hi32 = 0; + u16 len = 0, count = 0; +- int i = 0; ++ int i = 0, res; + u16 limit = *size; +- ++ u8 reg; + u8 *pos = content; + +- if (bcnhead < 0) /* if not valid */ +- bcnhead = rtw_read8(adapter, REG_TDECTRL + 1); ++ if (bcnhead < 0) { /* if not valid */ ++ res = rtw_read8(adapter, REG_TDECTRL + 1, ®); ++ if (res) ++ return; ++ ++ bcnhead = reg; ++ } + + rtw_write8(adapter, REG_PKT_BUFF_ACCESS_CTRL, TXPKT_BUF_SELECT); + +@@ -207,8 +233,16 @@ static void efuse_read_phymap_from_txpktbuf( + + rtw_write8(adapter, REG_TXPKTBUF_DBG, 0); + timeout = jiffies + msecs_to_jiffies(1000); +- while (!rtw_read8(adapter, REG_TXPKTBUF_DBG) && time_before(jiffies, timeout)) ++ do { ++ res = rtw_read8(adapter, REG_TXPKTBUF_DBG, ®); ++ if (res) ++ continue; ++ ++ if (reg) ++ break; ++ + rtw_usleep_os(100); ++ } while (time_before(jiffies, timeout)); + + /* data from EEPROM needs to be in LE */ + lo32 = cpu_to_le32(rtw_read32(adapter, REG_PKTBUF_DBG_DATA_L)); +@@ -525,10 +559,17 @@ void rtl8188e_SetHalODMVar(struct adapter *Adapter, void *pValue1, bool bSet) + + void hal_notch_filter_8188e(struct adapter *adapter, bool enable) + { ++ int res; ++ u8 reg; ++ ++ res = rtw_read8(adapter, rOFDM0_RxDSP + 1, ®); ++ if (res) ++ return; ++ + if (enable) +- rtw_write8(adapter, rOFDM0_RxDSP + 1, rtw_read8(adapter, rOFDM0_RxDSP + 1) | BIT(1)); ++ rtw_write8(adapter, rOFDM0_RxDSP + 1, reg | BIT(1)); + else +- rtw_write8(adapter, rOFDM0_RxDSP + 1, rtw_read8(adapter, rOFDM0_RxDSP + 1) & ~BIT(1)); ++ rtw_write8(adapter, rOFDM0_RxDSP + 1, reg & ~BIT(1)); + } + + /* */ +diff --git a/drivers/staging/r8188eu/hal/rtl8188e_phycfg.c b/drivers/staging/r8188eu/hal/rtl8188e_phycfg.c +index 4864dafd887b..985339a974fc 100644 +--- a/drivers/staging/r8188eu/hal/rtl8188e_phycfg.c ++++ b/drivers/staging/r8188eu/hal/rtl8188e_phycfg.c +@@ -594,6 +594,7 @@ _PHY_SetBWMode92C( + struct hal_data_8188e *pHalData = &Adapter->haldata; + u8 regBwOpMode; + u8 regRRSR_RSC; ++ int res; + + if (Adapter->bDriverStopped) + return; +@@ -602,8 +603,13 @@ _PHY_SetBWMode92C( + /* 3<1>Set MAC register */ + /* 3 */ + +- regBwOpMode = rtw_read8(Adapter, REG_BWOPMODE); +- regRRSR_RSC = rtw_read8(Adapter, REG_RRSR + 2); ++ res = rtw_read8(Adapter, REG_BWOPMODE, ®BwOpMode); ++ if (res) ++ return; ++ ++ res = rtw_read8(Adapter, REG_RRSR + 2, ®RRSR_RSC); ++ if (res) ++ return; + + switch (pHalData->CurrentChannelBW) { + case HT_CHANNEL_WIDTH_20: +diff --git a/drivers/staging/r8188eu/hal/usb_halinit.c b/drivers/staging/r8188eu/hal/usb_halinit.c +index a217272a07f8..01422d548748 100644 +--- a/drivers/staging/r8188eu/hal/usb_halinit.c ++++ b/drivers/staging/r8188eu/hal/usb_halinit.c +@@ -81,6 +81,7 @@ static void _InitInterrupt(struct adapter *Adapter) + { + u32 imr, imr_ex; + u8 usb_opt; ++ int res; + + /* HISR write one to clear */ + rtw_write32(Adapter, REG_HISR_88E, 0xFFFFFFFF); +@@ -94,7 +95,9 @@ static void _InitInterrupt(struct adapter *Adapter) + /* REG_USB_SPECIAL_OPTION - BIT(4) */ + /* 0; Use interrupt endpoint to upload interrupt pkt */ + /* 1; Use bulk endpoint to upload interrupt pkt, */ +- usb_opt = rtw_read8(Adapter, REG_USB_SPECIAL_OPTION); ++ res = rtw_read8(Adapter, REG_USB_SPECIAL_OPTION, &usb_opt); ++ if (res) ++ return; + + if (adapter_to_dvobj(Adapter)->pusbdev->speed == USB_SPEED_HIGH) + usb_opt = usb_opt | (INT_BULK_SEL); +@@ -363,8 +366,12 @@ static void _InitEDCA(struct adapter *Adapter) + static void _InitRetryFunction(struct adapter *Adapter) + { + u8 value8; ++ int res; ++ ++ res = rtw_read8(Adapter, REG_FWHW_TXQ_CTRL, &value8); ++ if (res) ++ return; + +- value8 = rtw_read8(Adapter, REG_FWHW_TXQ_CTRL); + value8 |= EN_AMPDU_RTY_NEW; + rtw_write8(Adapter, REG_FWHW_TXQ_CTRL, value8); + +@@ -423,9 +430,15 @@ usb_AggSettingRxUpdate( + { + u8 valueDMA; + u8 valueUSB; ++ int res; + +- valueDMA = rtw_read8(Adapter, REG_TRXDMA_CTRL); +- valueUSB = rtw_read8(Adapter, REG_USB_SPECIAL_OPTION); ++ res = rtw_read8(Adapter, REG_TRXDMA_CTRL, &valueDMA); ++ if (res) ++ return; ++ ++ res = rtw_read8(Adapter, REG_USB_SPECIAL_OPTION, &valueUSB); ++ if (res) ++ return; + + valueDMA |= RXDMA_AGG_EN; + valueUSB &= ~USB_AGG_EN; +@@ -446,9 +459,11 @@ static void InitUsbAggregationSetting(struct adapter *Adapter) + usb_AggSettingRxUpdate(Adapter); + } + +-static void _InitBeaconParameters(struct adapter *Adapter) ++/* FIXME: add error handling in callers */ ++static int _InitBeaconParameters(struct adapter *Adapter) + { + struct hal_data_8188e *haldata = &Adapter->haldata; ++ int res; + + rtw_write16(Adapter, REG_BCN_CTRL, 0x1010); + +@@ -461,9 +476,19 @@ static void _InitBeaconParameters(struct adapter *Adapter) + /* beacause test chip does not contension before sending beacon. by tynli. 2009.11.03 */ + rtw_write16(Adapter, REG_BCNTCFG, 0x660F); + +- haldata->RegFwHwTxQCtrl = rtw_read8(Adapter, REG_FWHW_TXQ_CTRL + 2); +- haldata->RegReg542 = rtw_read8(Adapter, REG_TBTT_PROHIBIT + 2); +- haldata->RegCR_1 = rtw_read8(Adapter, REG_CR + 1); ++ res = rtw_read8(Adapter, REG_FWHW_TXQ_CTRL + 2, &haldata->RegFwHwTxQCtrl); ++ if (res) ++ return res; ++ ++ res = rtw_read8(Adapter, REG_TBTT_PROHIBIT + 2, &haldata->RegReg542); ++ if (res) ++ return res; ++ ++ res = rtw_read8(Adapter, REG_CR + 1, &haldata->RegCR_1); ++ if (res) ++ return res; ++ ++ return 0; + } + + static void _BeaconFunctionEnable(struct adapter *Adapter, +@@ -514,6 +539,7 @@ u32 rtl8188eu_hal_init(struct adapter *Adapter) + u16 value16; + u8 txpktbuf_bndy; + u32 status = _SUCCESS; ++ int res; + struct hal_data_8188e *haldata = &Adapter->haldata; + struct pwrctrl_priv *pwrctrlpriv = &Adapter->pwrctrlpriv; + struct registry_priv *pregistrypriv = &Adapter->registrypriv; +@@ -620,7 +646,10 @@ u32 rtl8188eu_hal_init(struct adapter *Adapter) + + /* Enable TX Report */ + /* Enable Tx Report Timer */ +- value8 = rtw_read8(Adapter, REG_TX_RPT_CTRL); ++ res = rtw_read8(Adapter, REG_TX_RPT_CTRL, &value8); ++ if (res) ++ return _FAIL; ++ + rtw_write8(Adapter, REG_TX_RPT_CTRL, (value8 | BIT(1) | BIT(0))); + /* Set MAX RPT MACID */ + rtw_write8(Adapter, REG_TX_RPT_CTRL + 1, 2);/* FOR sta mode ,0: bc/mc ,1:AP */ +@@ -714,9 +743,13 @@ static void CardDisableRTL8188EU(struct adapter *Adapter) + { + u8 val8; + struct hal_data_8188e *haldata = &Adapter->haldata; ++ int res; + + /* Stop Tx Report Timer. 0x4EC[Bit1]=b'0 */ +- val8 = rtw_read8(Adapter, REG_TX_RPT_CTRL); ++ res = rtw_read8(Adapter, REG_TX_RPT_CTRL, &val8); ++ if (res) ++ return; ++ + rtw_write8(Adapter, REG_TX_RPT_CTRL, val8 & (~BIT(1))); + + /* stop rx */ +@@ -727,10 +760,16 @@ static void CardDisableRTL8188EU(struct adapter *Adapter) + + /* 2. 0x1F[7:0] = 0 turn off RF */ + +- val8 = rtw_read8(Adapter, REG_MCUFWDL); ++ res = rtw_read8(Adapter, REG_MCUFWDL, &val8); ++ if (res) ++ return; ++ + if ((val8 & RAM_DL_SEL) && Adapter->bFWReady) { /* 8051 RAM code */ + /* Reset MCU 0x2[10]=0. */ +- val8 = rtw_read8(Adapter, REG_SYS_FUNC_EN + 1); ++ res = rtw_read8(Adapter, REG_SYS_FUNC_EN + 1, &val8); ++ if (res) ++ return; ++ + val8 &= ~BIT(2); /* 0x2[10], FEN_CPUEN */ + rtw_write8(Adapter, REG_SYS_FUNC_EN + 1, val8); + } +@@ -740,26 +779,45 @@ static void CardDisableRTL8188EU(struct adapter *Adapter) + + /* YJ,add,111212 */ + /* Disable 32k */ +- val8 = rtw_read8(Adapter, REG_32K_CTRL); ++ res = rtw_read8(Adapter, REG_32K_CTRL, &val8); ++ if (res) ++ return; ++ + rtw_write8(Adapter, REG_32K_CTRL, val8 & (~BIT(0))); + + /* Card disable power action flow */ + HalPwrSeqCmdParsing(Adapter, Rtl8188E_NIC_DISABLE_FLOW); + + /* Reset MCU IO Wrapper */ +- val8 = rtw_read8(Adapter, REG_RSV_CTRL + 1); ++ res = rtw_read8(Adapter, REG_RSV_CTRL + 1, &val8); ++ if (res) ++ return; ++ + rtw_write8(Adapter, REG_RSV_CTRL + 1, (val8 & (~BIT(3)))); +- val8 = rtw_read8(Adapter, REG_RSV_CTRL + 1); ++ ++ res = rtw_read8(Adapter, REG_RSV_CTRL + 1, &val8); ++ if (res) ++ return; ++ + rtw_write8(Adapter, REG_RSV_CTRL + 1, val8 | BIT(3)); + + /* YJ,test add, 111207. For Power Consumption. */ +- val8 = rtw_read8(Adapter, GPIO_IN); ++ res = rtw_read8(Adapter, GPIO_IN, &val8); ++ if (res) ++ return; ++ + rtw_write8(Adapter, GPIO_OUT, val8); + rtw_write8(Adapter, GPIO_IO_SEL, 0xFF);/* Reg0x46 */ + +- val8 = rtw_read8(Adapter, REG_GPIO_IO_SEL); ++ res = rtw_read8(Adapter, REG_GPIO_IO_SEL, &val8); ++ if (res) ++ return; ++ + rtw_write8(Adapter, REG_GPIO_IO_SEL, (val8 << 4)); +- val8 = rtw_read8(Adapter, REG_GPIO_IO_SEL + 1); ++ res = rtw_read8(Adapter, REG_GPIO_IO_SEL + 1, &val8); ++ if (res) ++ return; ++ + rtw_write8(Adapter, REG_GPIO_IO_SEL + 1, val8 | 0x0F);/* Reg0x43 */ + rtw_write32(Adapter, REG_BB_PAD_CTRL, 0x00080808);/* set LNA ,TRSW,EX_PA Pin to output mode */ + haldata->bMacPwrCtrlOn = false; +@@ -830,9 +888,13 @@ void ReadAdapterInfo8188EU(struct adapter *Adapter) + struct eeprom_priv *eeprom = &Adapter->eeprompriv; + struct led_priv *ledpriv = &Adapter->ledpriv; + u8 eeValue; ++ int res; + + /* check system boot selection */ +- eeValue = rtw_read8(Adapter, REG_9346CR); ++ res = rtw_read8(Adapter, REG_9346CR, &eeValue); ++ if (res) ++ return; ++ + eeprom->EepromOrEfuse = (eeValue & BOOT_FROM_EEPROM); + eeprom->bautoload_fail_flag = !(eeValue & EEPROM_EN); + +@@ -887,12 +949,21 @@ static void hw_var_set_opmode(struct adapter *Adapter, u8 *val) + { + u8 val8; + u8 mode = *((u8 *)val); ++ int res; + + /* disable Port0 TSF update */ +- rtw_write8(Adapter, REG_BCN_CTRL, rtw_read8(Adapter, REG_BCN_CTRL) | BIT(4)); ++ res = rtw_read8(Adapter, REG_BCN_CTRL, &val8); ++ if (res) ++ return; ++ ++ rtw_write8(Adapter, REG_BCN_CTRL, val8 | BIT(4)); + + /* set net_type */ +- val8 = rtw_read8(Adapter, MSR) & 0x0c; ++ res = rtw_read8(Adapter, MSR, &val8); ++ if (res) ++ return; ++ ++ val8 &= 0x0c; + val8 |= mode; + rtw_write8(Adapter, MSR, val8); + +@@ -927,14 +998,22 @@ static void hw_var_set_opmode(struct adapter *Adapter, u8 *val) + rtw_write8(Adapter, REG_DUAL_TSF_RST, BIT(0)); + + /* BIT(3) - If set 0, hw will clr bcnq when tx becon ok/fail or port 0 */ +- rtw_write8(Adapter, REG_MBID_NUM, rtw_read8(Adapter, REG_MBID_NUM) | BIT(3) | BIT(4)); ++ res = rtw_read8(Adapter, REG_MBID_NUM, &val8); ++ if (res) ++ return; ++ ++ rtw_write8(Adapter, REG_MBID_NUM, val8 | BIT(3) | BIT(4)); + + /* enable BCN0 Function for if1 */ + /* don't enable update TSF0 for if1 (due to TSF update when beacon/probe rsp are received) */ + rtw_write8(Adapter, REG_BCN_CTRL, (DIS_TSF_UDT0_NORMAL_CHIP | EN_BCN_FUNCTION | BIT(1))); + + /* dis BCN1 ATIM WND if if2 is station */ +- rtw_write8(Adapter, REG_BCN_CTRL_1, rtw_read8(Adapter, REG_BCN_CTRL_1) | BIT(0)); ++ res = rtw_read8(Adapter, REG_BCN_CTRL_1, &val8); ++ if (res) ++ return; ++ ++ rtw_write8(Adapter, REG_BCN_CTRL_1, val8 | BIT(0)); + } + } + +@@ -943,6 +1022,8 @@ void SetHwReg8188EU(struct adapter *Adapter, u8 variable, u8 *val) + struct hal_data_8188e *haldata = &Adapter->haldata; + struct dm_priv *pdmpriv = &haldata->dmpriv; + struct odm_dm_struct *podmpriv = &haldata->odmpriv; ++ u8 reg; ++ int res; + + switch (variable) { + case HW_VAR_SET_OPMODE: +@@ -970,7 +1051,11 @@ void SetHwReg8188EU(struct adapter *Adapter, u8 variable, u8 *val) + /* Set RRSR rate table. */ + rtw_write8(Adapter, REG_RRSR, BrateCfg & 0xff); + rtw_write8(Adapter, REG_RRSR + 1, (BrateCfg >> 8) & 0xff); +- rtw_write8(Adapter, REG_RRSR + 2, rtw_read8(Adapter, REG_RRSR + 2) & 0xf0); ++ res = rtw_read8(Adapter, REG_RRSR + 2, ®); ++ if (res) ++ return; ++ ++ rtw_write8(Adapter, REG_RRSR + 2, reg & 0xf0); + + /* Set RTS initial rate */ + while (BrateCfg > 0x1) { +@@ -994,13 +1079,21 @@ void SetHwReg8188EU(struct adapter *Adapter, u8 variable, u8 *val) + StopTxBeacon(Adapter); + + /* disable related TSF function */ +- rtw_write8(Adapter, REG_BCN_CTRL, rtw_read8(Adapter, REG_BCN_CTRL) & (~BIT(3))); ++ res = rtw_read8(Adapter, REG_BCN_CTRL, ®); ++ if (res) ++ return; ++ ++ rtw_write8(Adapter, REG_BCN_CTRL, reg & (~BIT(3))); + + rtw_write32(Adapter, REG_TSFTR, tsf); + rtw_write32(Adapter, REG_TSFTR + 4, tsf >> 32); + + /* enable related TSF function */ +- rtw_write8(Adapter, REG_BCN_CTRL, rtw_read8(Adapter, REG_BCN_CTRL) | BIT(3)); ++ res = rtw_read8(Adapter, REG_BCN_CTRL, ®); ++ if (res) ++ return; ++ ++ rtw_write8(Adapter, REG_BCN_CTRL, reg | BIT(3)); + + if (((pmlmeinfo->state & 0x03) == WIFI_FW_ADHOC_STATE) || ((pmlmeinfo->state & 0x03) == WIFI_FW_AP_STATE)) + ResumeTxBeacon(Adapter); +@@ -1016,7 +1109,11 @@ void SetHwReg8188EU(struct adapter *Adapter, u8 variable, u8 *val) + rtw_write16(Adapter, REG_RXFLTMAP2, 0x00); + + /* disable update TSF */ +- rtw_write8(Adapter, REG_BCN_CTRL, rtw_read8(Adapter, REG_BCN_CTRL) | BIT(4)); ++ res = rtw_read8(Adapter, REG_BCN_CTRL, ®); ++ if (res) ++ return; ++ ++ rtw_write8(Adapter, REG_BCN_CTRL, reg | BIT(4)); + } else { /* sitesurvey done */ + struct mlme_ext_priv *pmlmeext = &Adapter->mlmeextpriv; + struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info; +@@ -1027,11 +1124,19 @@ void SetHwReg8188EU(struct adapter *Adapter, u8 variable, u8 *val) + rtw_write16(Adapter, REG_RXFLTMAP2, 0xFFFF); + + /* enable update TSF */ +- rtw_write8(Adapter, REG_BCN_CTRL, rtw_read8(Adapter, REG_BCN_CTRL) & (~BIT(4))); ++ res = rtw_read8(Adapter, REG_BCN_CTRL, ®); ++ if (res) ++ return; ++ ++ rtw_write8(Adapter, REG_BCN_CTRL, reg & (~BIT(4))); + } else if ((pmlmeinfo->state & 0x03) == WIFI_FW_AP_STATE) { + rtw_write16(Adapter, REG_RXFLTMAP2, 0xFFFF); + /* enable update TSF */ +- rtw_write8(Adapter, REG_BCN_CTRL, rtw_read8(Adapter, REG_BCN_CTRL) & (~BIT(4))); ++ res = rtw_read8(Adapter, REG_BCN_CTRL, ®); ++ if (res) ++ return; ++ ++ rtw_write8(Adapter, REG_BCN_CTRL, reg & (~BIT(4))); + } + rtw_write32(Adapter, REG_RCR, rtw_read32(Adapter, REG_RCR) | RCR_CBSSID_BCN); + } +@@ -1190,6 +1295,8 @@ void SetBeaconRelatedRegisters8188EUsb(struct adapter *adapt) + struct mlme_ext_priv *pmlmeext = &adapt->mlmeextpriv; + struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info; + u32 bcn_ctrl_reg = REG_BCN_CTRL; ++ int res; ++ u8 reg; + /* reset TSF, enable update TSF, correcting TSF On Beacon */ + + /* BCN interval */ +@@ -1215,7 +1322,11 @@ void SetBeaconRelatedRegisters8188EUsb(struct adapter *adapt) + + ResumeTxBeacon(adapt); + +- rtw_write8(adapt, bcn_ctrl_reg, rtw_read8(adapt, bcn_ctrl_reg) | BIT(1)); ++ res = rtw_read8(adapt, bcn_ctrl_reg, ®); ++ if (res) ++ return; ++ ++ rtw_write8(adapt, bcn_ctrl_reg, reg | BIT(1)); + } + + void rtl8188eu_init_default_value(struct adapter *adapt) +diff --git a/drivers/staging/r8188eu/hal/usb_ops_linux.c b/drivers/staging/r8188eu/hal/usb_ops_linux.c +index d5e674542a78..f399a7fd8b97 100644 +--- a/drivers/staging/r8188eu/hal/usb_ops_linux.c ++++ b/drivers/staging/r8188eu/hal/usb_ops_linux.c +@@ -94,16 +94,13 @@ static int usb_write(struct intf_hdl *intf, u16 value, void *data, u8 size) + return status; + } + +-u8 rtw_read8(struct adapter *adapter, u32 addr) ++int __must_check rtw_read8(struct adapter *adapter, u32 addr, u8 *data) + { + struct io_priv *io_priv = &adapter->iopriv; + struct intf_hdl *intf = &io_priv->intf; + u16 value = addr & 0xffff; +- u8 data; + +- usb_read(intf, value, &data, 1); +- +- return data; ++ return usb_read(intf, value, data, 1); + } + + u16 rtw_read16(struct adapter *adapter, u32 addr) +diff --git a/drivers/staging/r8188eu/include/rtw_io.h b/drivers/staging/r8188eu/include/rtw_io.h +index 6910e2b430e2..1198d3850a6d 100644 +--- a/drivers/staging/r8188eu/include/rtw_io.h ++++ b/drivers/staging/r8188eu/include/rtw_io.h +@@ -220,7 +220,7 @@ void unregister_intf_hdl(struct intf_hdl *pintfhdl); + void _rtw_attrib_read(struct adapter *adapter, u32 addr, u32 cnt, u8 *pmem); + void _rtw_attrib_write(struct adapter *adapter, u32 addr, u32 cnt, u8 *pmem); + +-u8 rtw_read8(struct adapter *adapter, u32 addr); ++int __must_check rtw_read8(struct adapter *adapter, u32 addr, u8 *data); + u16 rtw_read16(struct adapter *adapter, u32 addr); + u32 rtw_read32(struct adapter *adapter, u32 addr); + void _rtw_read_mem(struct adapter *adapter, u32 addr, u32 cnt, u8 *pmem); +diff --git a/drivers/staging/r8188eu/os_dep/ioctl_linux.c b/drivers/staging/r8188eu/os_dep/ioctl_linux.c +index 8dd280e2739a..19a60d47f7c0 100644 +--- a/drivers/staging/r8188eu/os_dep/ioctl_linux.c ++++ b/drivers/staging/r8188eu/os_dep/ioctl_linux.c +@@ -3178,6 +3178,7 @@ static void rtw_set_dynamic_functions(struct adapter *adapter, u8 dm_func) + { + struct hal_data_8188e *haldata = &adapter->haldata; + struct odm_dm_struct *odmpriv = &haldata->odmpriv; ++ int res; + + switch (dm_func) { + case 0: +@@ -3193,7 +3194,9 @@ static void rtw_set_dynamic_functions(struct adapter *adapter, u8 dm_func) + if (!(odmpriv->SupportAbility & DYNAMIC_BB_DIG)) { + struct rtw_dig *digtable = &odmpriv->DM_DigTable; + +- digtable->CurIGValue = rtw_read8(adapter, 0xc50); ++ res = rtw_read8(adapter, 0xc50, &digtable->CurIGValue); ++ (void)res; ++ /* FIXME: return an error to caller */ + } + odmpriv->SupportAbility = DYNAMIC_ALL_FUNC_ENABLE; + break; +@@ -3329,8 +3332,9 @@ static int rtw_dbg_port(struct net_device *dev, + u16 reg = arg; + u16 start_value = 0; + u32 write_num = extra_arg; +- int i; ++ int i, res; + struct xmit_frame *xmit_frame; ++ u8 val8; + + xmit_frame = rtw_IOL_accquire_xmit_frame(padapter); + if (!xmit_frame) { +@@ -3343,7 +3347,8 @@ static int rtw_dbg_port(struct net_device *dev, + if (rtl8188e_IOL_exec_cmds_sync(padapter, xmit_frame, 5000, 0) != _SUCCESS) + ret = -EPERM; + +- rtw_read8(padapter, reg); ++ /* FIXME: is this read necessary? */ ++ res = rtw_read8(padapter, reg, &val8); + } + break; + +-- +2.35.1 + diff --git a/queue-5.19/swiotlb-panic-if-nslabs-is-too-small.patch b/queue-5.19/swiotlb-panic-if-nslabs-is-too-small.patch new file mode 100644 index 00000000000..aeac9abde47 --- /dev/null +++ b/queue-5.19/swiotlb-panic-if-nslabs-is-too-small.patch @@ -0,0 +1,48 @@ +From 01161d81b226bd77445ec23ea604114ae29daa4c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 11 Jun 2022 01:25:14 -0700 +Subject: swiotlb: panic if nslabs is too small + +From: Dongli Zhang + +[ Upstream commit 0bf28fc40d89b1a3e00d1b79473bad4e9ca20ad1 ] + +Panic on purpose if nslabs is too small, in order to sync with the remap +retry logic. + +In addition, print the number of bytes for tlb alloc failure. + +Signed-off-by: Dongli Zhang +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + kernel/dma/swiotlb.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/kernel/dma/swiotlb.c b/kernel/dma/swiotlb.c +index 5830dce6081b..f5304e2f6a35 100644 +--- a/kernel/dma/swiotlb.c ++++ b/kernel/dma/swiotlb.c +@@ -242,6 +242,9 @@ void __init swiotlb_init_remap(bool addressing_limit, unsigned int flags, + if (swiotlb_force_disable) + return; + ++ if (nslabs < IO_TLB_MIN_SLABS) ++ panic("%s: nslabs = %lu too small\n", __func__, nslabs); ++ + /* + * By default allocate the bounce buffer memory from low memory, but + * allow to pick a location everywhere for hypervisors with guest +@@ -254,7 +257,8 @@ void __init swiotlb_init_remap(bool addressing_limit, unsigned int flags, + else + tlb = memblock_alloc_low(bytes, PAGE_SIZE); + if (!tlb) { +- pr_warn("%s: failed to allocate tlb structure\n", __func__); ++ pr_warn("%s: Failed to allocate %zu bytes tlb structure\n", ++ __func__, bytes); + return; + } + +-- +2.35.1 + diff --git a/queue-5.19/thunderbolt-change-downstream-router-s-tmu-rate-in-b.patch b/queue-5.19/thunderbolt-change-downstream-router-s-tmu-rate-in-b.patch new file mode 100644 index 00000000000..deebab78a1e --- /dev/null +++ b/queue-5.19/thunderbolt-change-downstream-router-s-tmu-rate-in-b.patch @@ -0,0 +1,54 @@ +From d43bfc9e58a9fbfed27888dac4c59a1db53b906d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 May 2022 13:59:19 +0300 +Subject: thunderbolt: Change downstream router's TMU rate in both TMU + uni/bidir mode + +From: Gil Fine + +[ Upstream commit 5fd6b9a5cbe63fea4c490fee8af34144a139a266 ] + +In case of uni-directional time sync, TMU handshake is +initiated by upstream router. In case of bi-directional +time sync, TMU handshake is initiated by downstream router. +In order to handle correctly the case of uni-directional mode, +we avoid changing the upstream router's rate to off, +because it might have another downstream router plugged that is set to +uni-directional mode (and we don't want to change its mode). +Instead, we always change downstream router's rate. + +Signed-off-by: Gil Fine +Signed-off-by: Mika Westerberg +Signed-off-by: Sasha Levin +--- + drivers/thunderbolt/tmu.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +diff --git a/drivers/thunderbolt/tmu.c b/drivers/thunderbolt/tmu.c +index e4a07a26f693..93ba1d00335b 100644 +--- a/drivers/thunderbolt/tmu.c ++++ b/drivers/thunderbolt/tmu.c +@@ -359,13 +359,14 @@ int tb_switch_tmu_disable(struct tb_switch *sw) + * In case of uni-directional time sync, TMU handshake is + * initiated by upstream router. In case of bi-directional + * time sync, TMU handshake is initiated by downstream router. +- * Therefore, we change the rate to off in the respective +- * router. ++ * We change downstream router's rate to off for both uni/bidir ++ * cases although it is needed only for the bi-directional mode. ++ * We avoid changing upstream router's mode since it might ++ * have another downstream router plugged, that is set to ++ * uni-directional mode and we don't want to change it's TMU ++ * mode. + */ +- if (unidirectional) +- tb_switch_tmu_rate_write(parent, TB_SWITCH_TMU_RATE_OFF); +- else +- tb_switch_tmu_rate_write(sw, TB_SWITCH_TMU_RATE_OFF); ++ tb_switch_tmu_rate_write(sw, TB_SWITCH_TMU_RATE_OFF); + + tb_port_tmu_time_sync_disable(up); + ret = tb_port_tmu_time_sync_disable(down); +-- +2.35.1 + diff --git a/queue-5.19/tty-serial-fix-refcount-leak-bug-in-ucc_uart.c.patch b/queue-5.19/tty-serial-fix-refcount-leak-bug-in-ucc_uart.c.patch new file mode 100644 index 00000000000..2e9be63fef4 --- /dev/null +++ b/queue-5.19/tty-serial-fix-refcount-leak-bug-in-ucc_uart.c.patch @@ -0,0 +1,38 @@ +From 39425297fb95155f0923e2fd1b08d2603cd9bc95 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 18 Jun 2022 14:08:50 +0800 +Subject: tty: serial: Fix refcount leak bug in ucc_uart.c + +From: Liang He + +[ Upstream commit d24d7bb2cd947676f9b71fb944d045e09b8b282f ] + +In soc_info(), of_find_node_by_type() will return a node pointer +with refcount incremented. We should use of_node_put() when it is +not used anymore. + +Acked-by: Timur Tabi +Signed-off-by: Liang He +Link: https://lore.kernel.org/r/20220618060850.4058525-1-windhl@126.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/ucc_uart.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/tty/serial/ucc_uart.c b/drivers/tty/serial/ucc_uart.c +index 6000853973c1..3cc9ef08455c 100644 +--- a/drivers/tty/serial/ucc_uart.c ++++ b/drivers/tty/serial/ucc_uart.c +@@ -1137,6 +1137,8 @@ static unsigned int soc_info(unsigned int *rev_h, unsigned int *rev_l) + /* No compatible property, so try the name. */ + soc_string = np->name; + ++ of_node_put(np); ++ + /* Extract the SOC number from the "PowerPC," string */ + if ((sscanf(soc_string, "PowerPC,%u", &soc) != 1) || !soc) + return 0; +-- +2.35.1 + diff --git a/queue-5.19/uacce-handle-parent-device-removal-or-parent-driver-.patch b/queue-5.19/uacce-handle-parent-device-removal-or-parent-driver-.patch new file mode 100644 index 00000000000..33021d2ecb6 --- /dev/null +++ b/queue-5.19/uacce-handle-parent-device-removal-or-parent-driver-.patch @@ -0,0 +1,351 @@ +From 7b0ea5bcd19ce9935a3539c8344410a2893b25e0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Jul 2022 11:48:43 +0800 +Subject: uacce: Handle parent device removal or parent driver module rmmod + +From: Jean-Philippe Brucker + +[ Upstream commit 80fc671bcc0173836e9032b0c698ea74c13b9d7c ] + +The uacce driver must deal with a possible removal of the parent device +or parent driver module rmmod at any time. + +Although uacce_remove(), called on device removal and on driver unbind, +prevents future use of the uacce fops by removing the cdev, fops that +were called before that point may still be running. + +Serialize uacce_fops_open() and uacce_remove() with uacce->mutex. +Serialize other fops against uacce_remove() with q->mutex. +Since we need to protect uacce_fops_poll() which gets called on the fast +path, replace uacce->queues_lock with q->mutex to improve scalability. +The other fops are only used during setup. + +uacce_queue_is_valid(), checked under q->mutex or uacce->mutex, denotes +whether uacce_remove() has disabled all queues. If that is the case, +don't go any further since the parent device is being removed and +uacce->ops should not be called anymore. + +Reported-by: Yang Shen +Signed-off-by: Zhangfei Gao +Signed-off-by: Jean-Philippe Brucker +Link: https://lore.kernel.org/r/20220701034843.7502-1-zhangfei.gao@linaro.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/misc/uacce/uacce.c | 133 ++++++++++++++++++++++++------------- + include/linux/uacce.h | 6 +- + 2 files changed, 91 insertions(+), 48 deletions(-) + +diff --git a/drivers/misc/uacce/uacce.c b/drivers/misc/uacce/uacce.c +index 281c54003edc..b70a013139c7 100644 +--- a/drivers/misc/uacce/uacce.c ++++ b/drivers/misc/uacce/uacce.c +@@ -9,43 +9,38 @@ + + static struct class *uacce_class; + static dev_t uacce_devt; +-static DEFINE_MUTEX(uacce_mutex); + static DEFINE_XARRAY_ALLOC(uacce_xa); + +-static int uacce_start_queue(struct uacce_queue *q) ++/* ++ * If the parent driver or the device disappears, the queue state is invalid and ++ * ops are not usable anymore. ++ */ ++static bool uacce_queue_is_valid(struct uacce_queue *q) + { +- int ret = 0; ++ return q->state == UACCE_Q_INIT || q->state == UACCE_Q_STARTED; ++} + +- mutex_lock(&uacce_mutex); ++static int uacce_start_queue(struct uacce_queue *q) ++{ ++ int ret; + +- if (q->state != UACCE_Q_INIT) { +- ret = -EINVAL; +- goto out_with_lock; +- } ++ if (q->state != UACCE_Q_INIT) ++ return -EINVAL; + + if (q->uacce->ops->start_queue) { + ret = q->uacce->ops->start_queue(q); + if (ret < 0) +- goto out_with_lock; ++ return ret; + } + + q->state = UACCE_Q_STARTED; +- +-out_with_lock: +- mutex_unlock(&uacce_mutex); +- +- return ret; ++ return 0; + } + + static int uacce_put_queue(struct uacce_queue *q) + { + struct uacce_device *uacce = q->uacce; + +- mutex_lock(&uacce_mutex); +- +- if (q->state == UACCE_Q_ZOMBIE) +- goto out; +- + if ((q->state == UACCE_Q_STARTED) && uacce->ops->stop_queue) + uacce->ops->stop_queue(q); + +@@ -54,8 +49,6 @@ static int uacce_put_queue(struct uacce_queue *q) + uacce->ops->put_queue(q); + + q->state = UACCE_Q_ZOMBIE; +-out: +- mutex_unlock(&uacce_mutex); + + return 0; + } +@@ -65,20 +58,36 @@ static long uacce_fops_unl_ioctl(struct file *filep, + { + struct uacce_queue *q = filep->private_data; + struct uacce_device *uacce = q->uacce; ++ long ret = -ENXIO; ++ ++ /* ++ * uacce->ops->ioctl() may take the mmap_lock when copying arg to/from ++ * user. Avoid a circular lock dependency with uacce_fops_mmap(), which ++ * gets called with mmap_lock held, by taking uacce->mutex instead of ++ * q->mutex. Doing this in uacce_fops_mmap() is not possible because ++ * uacce_fops_open() calls iommu_sva_bind_device(), which takes ++ * mmap_lock, while holding uacce->mutex. ++ */ ++ mutex_lock(&uacce->mutex); ++ if (!uacce_queue_is_valid(q)) ++ goto out_unlock; + + switch (cmd) { + case UACCE_CMD_START_Q: +- return uacce_start_queue(q); +- ++ ret = uacce_start_queue(q); ++ break; + case UACCE_CMD_PUT_Q: +- return uacce_put_queue(q); +- ++ ret = uacce_put_queue(q); ++ break; + default: +- if (!uacce->ops->ioctl) +- return -EINVAL; +- +- return uacce->ops->ioctl(q, cmd, arg); ++ if (uacce->ops->ioctl) ++ ret = uacce->ops->ioctl(q, cmd, arg); ++ else ++ ret = -EINVAL; + } ++out_unlock: ++ mutex_unlock(&uacce->mutex); ++ return ret; + } + + #ifdef CONFIG_COMPAT +@@ -136,6 +145,13 @@ static int uacce_fops_open(struct inode *inode, struct file *filep) + if (!q) + return -ENOMEM; + ++ mutex_lock(&uacce->mutex); ++ ++ if (!uacce->parent) { ++ ret = -EINVAL; ++ goto out_with_mem; ++ } ++ + ret = uacce_bind_queue(uacce, q); + if (ret) + goto out_with_mem; +@@ -152,10 +168,9 @@ static int uacce_fops_open(struct inode *inode, struct file *filep) + filep->private_data = q; + uacce->inode = inode; + q->state = UACCE_Q_INIT; +- +- mutex_lock(&uacce->queues_lock); ++ mutex_init(&q->mutex); + list_add(&q->list, &uacce->queues); +- mutex_unlock(&uacce->queues_lock); ++ mutex_unlock(&uacce->mutex); + + return 0; + +@@ -163,18 +178,20 @@ static int uacce_fops_open(struct inode *inode, struct file *filep) + uacce_unbind_queue(q); + out_with_mem: + kfree(q); ++ mutex_unlock(&uacce->mutex); + return ret; + } + + static int uacce_fops_release(struct inode *inode, struct file *filep) + { + struct uacce_queue *q = filep->private_data; ++ struct uacce_device *uacce = q->uacce; + +- mutex_lock(&q->uacce->queues_lock); +- list_del(&q->list); +- mutex_unlock(&q->uacce->queues_lock); ++ mutex_lock(&uacce->mutex); + uacce_put_queue(q); + uacce_unbind_queue(q); ++ list_del(&q->list); ++ mutex_unlock(&uacce->mutex); + kfree(q); + + return 0; +@@ -217,10 +234,9 @@ static int uacce_fops_mmap(struct file *filep, struct vm_area_struct *vma) + vma->vm_private_data = q; + qfr->type = type; + +- mutex_lock(&uacce_mutex); +- +- if (q->state != UACCE_Q_INIT && q->state != UACCE_Q_STARTED) { +- ret = -EINVAL; ++ mutex_lock(&q->mutex); ++ if (!uacce_queue_is_valid(q)) { ++ ret = -ENXIO; + goto out_with_lock; + } + +@@ -248,12 +264,12 @@ static int uacce_fops_mmap(struct file *filep, struct vm_area_struct *vma) + } + + q->qfrs[type] = qfr; +- mutex_unlock(&uacce_mutex); ++ mutex_unlock(&q->mutex); + + return ret; + + out_with_lock: +- mutex_unlock(&uacce_mutex); ++ mutex_unlock(&q->mutex); + kfree(qfr); + return ret; + } +@@ -262,12 +278,20 @@ static __poll_t uacce_fops_poll(struct file *file, poll_table *wait) + { + struct uacce_queue *q = file->private_data; + struct uacce_device *uacce = q->uacce; ++ __poll_t ret = 0; ++ ++ mutex_lock(&q->mutex); ++ if (!uacce_queue_is_valid(q)) ++ goto out_unlock; + + poll_wait(file, &q->wait, wait); ++ + if (uacce->ops->is_q_updated && uacce->ops->is_q_updated(q)) +- return EPOLLIN | EPOLLRDNORM; ++ ret = EPOLLIN | EPOLLRDNORM; + +- return 0; ++out_unlock: ++ mutex_unlock(&q->mutex); ++ return ret; + } + + static const struct file_operations uacce_fops = { +@@ -450,7 +474,7 @@ struct uacce_device *uacce_alloc(struct device *parent, + goto err_with_uacce; + + INIT_LIST_HEAD(&uacce->queues); +- mutex_init(&uacce->queues_lock); ++ mutex_init(&uacce->mutex); + device_initialize(&uacce->dev); + uacce->dev.devt = MKDEV(MAJOR(uacce_devt), uacce->dev_id); + uacce->dev.class = uacce_class; +@@ -507,13 +531,23 @@ void uacce_remove(struct uacce_device *uacce) + if (uacce->inode) + unmap_mapping_range(uacce->inode->i_mapping, 0, 0, 1); + ++ /* ++ * uacce_fops_open() may be running concurrently, even after we remove ++ * the cdev. Holding uacce->mutex ensures that open() does not obtain a ++ * removed uacce device. ++ */ ++ mutex_lock(&uacce->mutex); + /* ensure no open queue remains */ +- mutex_lock(&uacce->queues_lock); + list_for_each_entry_safe(q, next_q, &uacce->queues, list) { ++ /* ++ * Taking q->mutex ensures that fops do not use the defunct ++ * uacce->ops after the queue is disabled. ++ */ ++ mutex_lock(&q->mutex); + uacce_put_queue(q); ++ mutex_unlock(&q->mutex); + uacce_unbind_queue(q); + } +- mutex_unlock(&uacce->queues_lock); + + /* disable sva now since no opened queues */ + uacce_disable_sva(uacce); +@@ -521,6 +555,13 @@ void uacce_remove(struct uacce_device *uacce) + if (uacce->cdev) + cdev_device_del(uacce->cdev, &uacce->dev); + xa_erase(&uacce_xa, uacce->dev_id); ++ /* ++ * uacce exists as long as there are open fds, but ops will be freed ++ * now. Ensure that bugs cause NULL deref rather than use-after-free. ++ */ ++ uacce->ops = NULL; ++ uacce->parent = NULL; ++ mutex_unlock(&uacce->mutex); + put_device(&uacce->dev); + } + EXPORT_SYMBOL_GPL(uacce_remove); +diff --git a/include/linux/uacce.h b/include/linux/uacce.h +index 48e319f40275..9ce88c28b0a8 100644 +--- a/include/linux/uacce.h ++++ b/include/linux/uacce.h +@@ -70,6 +70,7 @@ enum uacce_q_state { + * @wait: wait queue head + * @list: index into uacce queues list + * @qfrs: pointer of qfr regions ++ * @mutex: protects queue state + * @state: queue state machine + * @pasid: pasid associated to the mm + * @handle: iommu_sva handle returned by iommu_sva_bind_device() +@@ -80,6 +81,7 @@ struct uacce_queue { + wait_queue_head_t wait; + struct list_head list; + struct uacce_qfile_region *qfrs[UACCE_MAX_REGION]; ++ struct mutex mutex; + enum uacce_q_state state; + u32 pasid; + struct iommu_sva *handle; +@@ -97,9 +99,9 @@ struct uacce_queue { + * @dev_id: id of the uacce device + * @cdev: cdev of the uacce + * @dev: dev of the uacce ++ * @mutex: protects uacce operation + * @priv: private pointer of the uacce + * @queues: list of queues +- * @queues_lock: lock for queues list + * @inode: core vfs + */ + struct uacce_device { +@@ -113,9 +115,9 @@ struct uacce_device { + u32 dev_id; + struct cdev *cdev; + struct device dev; ++ struct mutex mutex; + void *priv; + struct list_head queues; +- struct mutex queues_lock; + struct inode *inode; + }; + +-- +2.35.1 + diff --git a/queue-5.19/um-add-noreboot-command-line-option-for-panic_timeou.patch b/queue-5.19/um-add-noreboot-command-line-option-for-panic_timeou.patch new file mode 100644 index 00000000000..4eb6606456c --- /dev/null +++ b/queue-5.19/um-add-noreboot-command-line-option-for-panic_timeou.patch @@ -0,0 +1,63 @@ +From 97f98578216f72d9450f09284f70404b09d8c88d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Jul 2022 13:56:17 +0200 +Subject: um: add "noreboot" command line option for PANIC_TIMEOUT=-1 setups + +From: Jason A. Donenfeld + +[ Upstream commit dda520d07b95072a0b63f6c52a8eb566d08ea897 ] + +QEMU has a -no-reboot option, which halts instead of reboots when the +guest asks to reboot. This is invaluable when used with +CONFIG_PANIC_TIMEOUT=-1 (and panic_on_warn), because it allows panics +and warnings to be caught immediately in CI. Implement this in UML too, +by way of a basic setup param. + +Signed-off-by: Jason A. Donenfeld +Signed-off-by: Richard Weinberger +Signed-off-by: Sasha Levin +--- + arch/um/os-Linux/skas/process.c | 17 ++++++++++++++++- + 1 file changed, 16 insertions(+), 1 deletion(-) + +diff --git a/arch/um/os-Linux/skas/process.c b/arch/um/os-Linux/skas/process.c +index c316c993a949..b24db6017ded 100644 +--- a/arch/um/os-Linux/skas/process.c ++++ b/arch/um/os-Linux/skas/process.c +@@ -5,6 +5,7 @@ + */ + + #include ++#include + #include + #include + #include +@@ -707,10 +708,24 @@ void halt_skas(void) + UML_LONGJMP(&initial_jmpbuf, INIT_JMP_HALT); + } + ++static bool noreboot; ++ ++static int __init noreboot_cmd_param(char *str, int *add) ++{ ++ noreboot = true; ++ return 0; ++} ++ ++__uml_setup("noreboot", noreboot_cmd_param, ++"noreboot\n" ++" Rather than rebooting, exit always, akin to QEMU's -no-reboot option.\n" ++" This is useful if you're using CONFIG_PANIC_TIMEOUT in order to catch\n" ++" crashes in CI\n"); ++ + void reboot_skas(void) + { + block_signals_trace(); +- UML_LONGJMP(&initial_jmpbuf, INIT_JMP_REBOOT); ++ UML_LONGJMP(&initial_jmpbuf, noreboot ? INIT_JMP_HALT : INIT_JMP_REBOOT); + } + + void __switch_mm(struct mm_id *mm_idp) +-- +2.35.1 + diff --git a/queue-5.19/usb-cdns3-fix-use-after-free-at-workaround-2.patch b/queue-5.19/usb-cdns3-fix-use-after-free-at-workaround-2.patch new file mode 100644 index 00000000000..968585529ca --- /dev/null +++ b/queue-5.19/usb-cdns3-fix-use-after-free-at-workaround-2.patch @@ -0,0 +1,53 @@ +From f4c38d80474d65b9c22a01ca408b3bb9a7411674 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Jun 2022 14:04:30 -0500 +Subject: usb: cdns3 fix use-after-free at workaround 2 + +From: Frank Li + +[ Upstream commit 7d602f30149a117eea260208b1661bc404c21dfd ] + +BUG: KFENCE: use-after-free read in __list_del_entry_valid+0x10/0xac + +cdns3_wa2_remove_old_request() +{ + ... + kfree(priv_req->request.buf); + cdns3_gadget_ep_free_request(&priv_ep->endpoint, &priv_req->request); + list_del_init(&priv_req->list); + ^^^ use after free + ... +} + +cdns3_gadget_ep_free_request() free the space pointed by priv_req, +but priv_req is used in the following list_del_init(). + +This patch move list_del_init() before cdns3_gadget_ep_free_request(). + +Signed-off-by: Frank Li +Signed-off-by: Faqiang Zhu +Link: https://lore.kernel.org/r/20220608190430.2814358-1-Frank.Li@nxp.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/cdns3/cdns3-gadget.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/cdns3/cdns3-gadget.c b/drivers/usb/cdns3/cdns3-gadget.c +index 87cfa91a758d..d21b69997e75 100644 +--- a/drivers/usb/cdns3/cdns3-gadget.c ++++ b/drivers/usb/cdns3/cdns3-gadget.c +@@ -625,9 +625,9 @@ static void cdns3_wa2_remove_old_request(struct cdns3_endpoint *priv_ep) + trace_cdns3_wa2(priv_ep, "removes eldest request"); + + kfree(priv_req->request.buf); ++ list_del_init(&priv_req->list); + cdns3_gadget_ep_free_request(&priv_ep->endpoint, + &priv_req->request); +- list_del_init(&priv_req->list); + --priv_ep->wa2_counter; + + if (!chain) +-- +2.35.1 + diff --git a/queue-5.19/usb-dwc2-gadget-remove-d-pull-up-while-no-vbus-with-.patch b/queue-5.19/usb-dwc2-gadget-remove-d-pull-up-while-no-vbus-with-.patch new file mode 100644 index 00000000000..ea6ccccaff6 --- /dev/null +++ b/queue-5.19/usb-dwc2-gadget-remove-d-pull-up-while-no-vbus-with-.patch @@ -0,0 +1,45 @@ +From b718ed862c96e079337af7886b21d54f72d9fcbc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Jun 2022 18:07:17 +0200 +Subject: usb: dwc2: gadget: remove D+ pull-up while no vbus with + usb-role-switch + +From: Amelie Delaunay + +[ Upstream commit db638c6500abaffb8f7770b2a69c40d003d54ae1 ] + +When using usb-role-switch, D+ pull-up is set as soon as DTCL_SFTDISCON is +cleared, whatever the vbus valid signal state is. The pull-up should not +be set when vbus isn't present (this is determined by the drd controller). + +This patch ensures that B-Session (so Peripheral role + vbus valid signal) +is valid before clearing the DCTL_SFTDISCON bit when role switch is used. +Keep original behavior when usb-role-switch isn't used. + +Acked-by: Minas Harutyunyan +Signed-off-by: Amelie Delaunay +Signed-off-by: Fabrice Gasnier +Link: https://lore.kernel.org/r/20220622160717.314580-1-fabrice.gasnier@foss.st.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc2/gadget.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c +index fe2a58c75861..8b15742d9e8a 100644 +--- a/drivers/usb/dwc2/gadget.c ++++ b/drivers/usb/dwc2/gadget.c +@@ -3594,7 +3594,8 @@ void dwc2_hsotg_core_disconnect(struct dwc2_hsotg *hsotg) + void dwc2_hsotg_core_connect(struct dwc2_hsotg *hsotg) + { + /* remove the soft-disconnect and let's go */ +- dwc2_clear_bit(hsotg, DCTL, DCTL_SFTDISCON); ++ if (!hsotg->role_sw || (dwc2_readl(hsotg, GOTGCTL) & GOTGCTL_BSESVLD)) ++ dwc2_clear_bit(hsotg, DCTL, DCTL_SFTDISCON); + } + + /** +-- +2.35.1 + diff --git a/queue-5.19/usb-gadget-uvc-calculate-the-number-of-request-depen.patch b/queue-5.19/usb-gadget-uvc-calculate-the-number-of-request-depen.patch new file mode 100644 index 00000000000..83987c43dc2 --- /dev/null +++ b/queue-5.19/usb-gadget-uvc-calculate-the-number-of-request-depen.patch @@ -0,0 +1,71 @@ +From 266578a0c370c45a8f990c996925be042d3dadc1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 May 2022 00:38:46 +0200 +Subject: usb: gadget: uvc: calculate the number of request depending on + framesize + +From: Michael Grzeschik + +[ Upstream commit 87d76b5f1d8eeb49efa16e2018e188864cbb9401 ] + +The current limitation of possible number of requests being handled is +dependent on the gadget speed. It makes more sense to depend on the +typical frame size when calculating the number of requests. This patch +is changing this and is using the previous limits as boundaries for +reasonable minimum and maximum number of requests. + +For a 1080p jpeg encoded video stream with a maximum imagesize of +e.g. 800kB with a maxburst of 8 and an multiplier of 1 the resulting +number of requests is calculated to 49. + + 800768 1 +nreqs = ------ * -------------- ~= 49 + 2 (1024 * 8 * 1) + +Tested-by: Dan Vacura +Signed-off-by: Michael Grzeschik +Link: https://lore.kernel.org/r/20220529223848.105914-2-m.grzeschik@pengutronix.de +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/function/uvc_queue.c | 17 ++++++++++++----- + 1 file changed, 12 insertions(+), 5 deletions(-) + +diff --git a/drivers/usb/gadget/function/uvc_queue.c b/drivers/usb/gadget/function/uvc_queue.c +index 951934aa4454..ec500ee499ee 100644 +--- a/drivers/usb/gadget/function/uvc_queue.c ++++ b/drivers/usb/gadget/function/uvc_queue.c +@@ -44,7 +44,8 @@ static int uvc_queue_setup(struct vb2_queue *vq, + { + struct uvc_video_queue *queue = vb2_get_drv_priv(vq); + struct uvc_video *video = container_of(queue, struct uvc_video, queue); +- struct usb_composite_dev *cdev = video->uvc->func.config->cdev; ++ unsigned int req_size; ++ unsigned int nreq; + + if (*nbuffers > UVC_MAX_VIDEO_BUFFERS) + *nbuffers = UVC_MAX_VIDEO_BUFFERS; +@@ -53,10 +54,16 @@ static int uvc_queue_setup(struct vb2_queue *vq, + + sizes[0] = video->imagesize; + +- if (cdev->gadget->speed < USB_SPEED_SUPER) +- video->uvc_num_requests = 4; +- else +- video->uvc_num_requests = 64; ++ req_size = video->ep->maxpacket ++ * max_t(unsigned int, video->ep->maxburst, 1) ++ * (video->ep->mult); ++ ++ /* We divide by two, to increase the chance to run ++ * into fewer requests for smaller framesizes. ++ */ ++ nreq = DIV_ROUND_UP(DIV_ROUND_UP(sizes[0], 2), req_size); ++ nreq = clamp(nreq, 4U, 64U); ++ video->uvc_num_requests = nreq; + + return 0; + } +-- +2.35.1 + diff --git a/queue-5.19/usb-gadget-uvc-call-uvc-uvcg_warn-on-completed-statu.patch b/queue-5.19/usb-gadget-uvc-call-uvc-uvcg_warn-on-completed-statu.patch new file mode 100644 index 00000000000..e1e65d95558 --- /dev/null +++ b/queue-5.19/usb-gadget-uvc-call-uvc-uvcg_warn-on-completed-statu.patch @@ -0,0 +1,39 @@ +From dba1f28d1110dc373240fa3b5a10bbbe83743f3f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 May 2022 00:38:48 +0200 +Subject: usb: gadget: uvc: call uvc uvcg_warn on completed status instead of + uvcg_info + +From: Michael Grzeschik + +[ Upstream commit a725d0f6dfc5d3739d6499f30ec865305ba3544d ] + +Likewise to the uvcvideo hostside driver, this patch is changing the +usb_request message of an non zero completion handler call from dev_info +to dev_warn. + +Reviewed-by: Laurent Pinchart +Signed-off-by: Michael Grzeschik +Link: https://lore.kernel.org/r/20220529223848.105914-4-m.grzeschik@pengutronix.de +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/function/uvc_video.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/gadget/function/uvc_video.c b/drivers/usb/gadget/function/uvc_video.c +index ce421d9cc241..c00ce0e91f5d 100644 +--- a/drivers/usb/gadget/function/uvc_video.c ++++ b/drivers/usb/gadget/function/uvc_video.c +@@ -261,7 +261,7 @@ uvc_video_complete(struct usb_ep *ep, struct usb_request *req) + break; + + default: +- uvcg_info(&video->uvc->func, ++ uvcg_warn(&video->uvc->func, + "VS request completed with status %d.\n", + req->status); + uvcg_queue_cancel(queue, 0); +-- +2.35.1 + diff --git a/queue-5.19/usb-host-ohci-ppc-of-fix-refcount-leak-bug.patch b/queue-5.19/usb-host-ohci-ppc-of-fix-refcount-leak-bug.patch new file mode 100644 index 00000000000..4e2dc1d6c81 --- /dev/null +++ b/queue-5.19/usb-host-ohci-ppc-of-fix-refcount-leak-bug.patch @@ -0,0 +1,37 @@ +From d5bf0b8fb165c7fbd8e50ecf1e8eb985a735fa79 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Jun 2022 11:46:37 +0800 +Subject: usb: host: ohci-ppc-of: Fix refcount leak bug + +From: Liang He + +[ Upstream commit 40a959d7042bb7711e404ad2318b30e9f92c6b9b ] + +In ohci_hcd_ppc_of_probe(), of_find_compatible_node() will return +a node pointer with refcount incremented. We should use of_node_put() +when it is not used anymore. + +Acked-by: Alan Stern +Signed-off-by: Liang He +Link: https://lore.kernel.org/r/20220617034637.4003115-1-windhl@126.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/host/ohci-ppc-of.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/usb/host/ohci-ppc-of.c b/drivers/usb/host/ohci-ppc-of.c +index 1960b8dfdba5..591f675cc930 100644 +--- a/drivers/usb/host/ohci-ppc-of.c ++++ b/drivers/usb/host/ohci-ppc-of.c +@@ -166,6 +166,7 @@ static int ohci_hcd_ppc_of_probe(struct platform_device *op) + release_mem_region(res.start, 0x4); + } else + pr_debug("%s: cannot get ehci offset from fdt\n", __FILE__); ++ of_node_put(np); + } + + irq_dispose_mapping(irq); +-- +2.35.1 + diff --git a/queue-5.19/usb-renesas-fix-refcount-leak-bug.patch b/queue-5.19/usb-renesas-fix-refcount-leak-bug.patch new file mode 100644 index 00000000000..79d6b2043b2 --- /dev/null +++ b/queue-5.19/usb-renesas-fix-refcount-leak-bug.patch @@ -0,0 +1,39 @@ +From 6b7d5e220cb7a6cc69d9fce47dcbc8d3b027bfb5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 18 Jun 2022 10:32:05 +0800 +Subject: usb: renesas: Fix refcount leak bug + +From: Liang He + +[ Upstream commit 9d6d5303c39b8bc182475b22f45504106a07f086 ] + +In usbhs_rza1_hardware_init(), of_find_node_by_name() will return +a node pointer with refcount incremented. We should use of_node_put() +when it is not used anymore. + +Signed-off-by: Liang He +Link: https://lore.kernel.org/r/20220618023205.4056548-1-windhl@126.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/renesas_usbhs/rza.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/usb/renesas_usbhs/rza.c b/drivers/usb/renesas_usbhs/rza.c +index 24de64edb674..2d77edefb4b3 100644 +--- a/drivers/usb/renesas_usbhs/rza.c ++++ b/drivers/usb/renesas_usbhs/rza.c +@@ -23,6 +23,10 @@ static int usbhs_rza1_hardware_init(struct platform_device *pdev) + extal_clk = of_find_node_by_name(NULL, "extal"); + of_property_read_u32(usb_x1_clk, "clock-frequency", &freq_usb); + of_property_read_u32(extal_clk, "clock-frequency", &freq_extal); ++ ++ of_node_put(usb_x1_clk); ++ of_node_put(extal_clk); ++ + if (freq_usb == 0) { + if (freq_extal == 12000000) { + /* Select 12MHz XTAL */ +-- +2.35.1 + diff --git a/queue-5.19/usb-typec-mux-add-config-guards-for-functions.patch b/queue-5.19/usb-typec-mux-add-config-guards-for-functions.patch new file mode 100644 index 00000000000..008ca82f62d --- /dev/null +++ b/queue-5.19/usb-typec-mux-add-config-guards-for-functions.patch @@ -0,0 +1,99 @@ +From b03172383ff695573e422d4e0436d6f96b7bd612 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Jun 2022 17:20:18 +0000 +Subject: usb: typec: mux: Add CONFIG guards for functions +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Prashant Malani + +[ Upstream commit a37599ebfb656c2af4ca119de556eba29b6926d6 ] + +There are some drivers that can use the Type C mux API, but don't have +to. Introduce CONFIG guards for the mux functions so that drivers can +include the header file and not run into compilation errors on systems +which don't have CONFIG_TYPEC enabled. When CONFIG_TYPEC is not enabled, +the Type C mux functions will be stub versions of the original calls. + +Reported-by: kernel test robot +Reviewed-by: Nícolas F. R. A. Prado +Reviewed-by: Heikki Krogerus +Reviewed-by: AngeloGioacchino Del Regno +Tested-by: Nícolas F. R. A. Prado +Signed-off-by: Prashant Malani +Link: https://lore.kernel.org/r/20220615172129.1314056-3-pmalani@chromium.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + include/linux/usb/typec_mux.h | 44 ++++++++++++++++++++++++++++++----- + 1 file changed, 38 insertions(+), 6 deletions(-) + +diff --git a/include/linux/usb/typec_mux.h b/include/linux/usb/typec_mux.h +index ee57781dcf28..9292f0e07846 100644 +--- a/include/linux/usb/typec_mux.h ++++ b/include/linux/usb/typec_mux.h +@@ -58,17 +58,13 @@ struct typec_mux_desc { + void *drvdata; + }; + ++#if IS_ENABLED(CONFIG_TYPEC) ++ + struct typec_mux *fwnode_typec_mux_get(struct fwnode_handle *fwnode, + const struct typec_altmode_desc *desc); + void typec_mux_put(struct typec_mux *mux); + int typec_mux_set(struct typec_mux *mux, struct typec_mux_state *state); + +-static inline struct typec_mux * +-typec_mux_get(struct device *dev, const struct typec_altmode_desc *desc) +-{ +- return fwnode_typec_mux_get(dev_fwnode(dev), desc); +-} +- + struct typec_mux_dev * + typec_mux_register(struct device *parent, const struct typec_mux_desc *desc); + void typec_mux_unregister(struct typec_mux_dev *mux); +@@ -76,4 +72,40 @@ void typec_mux_unregister(struct typec_mux_dev *mux); + void typec_mux_set_drvdata(struct typec_mux_dev *mux, void *data); + void *typec_mux_get_drvdata(struct typec_mux_dev *mux); + ++#else ++ ++static inline struct typec_mux *fwnode_typec_mux_get(struct fwnode_handle *fwnode, ++ const struct typec_altmode_desc *desc) ++{ ++ return NULL; ++} ++ ++static inline void typec_mux_put(struct typec_mux *mux) {} ++ ++static inline int typec_mux_set(struct typec_mux *mux, struct typec_mux_state *state) ++{ ++ return 0; ++} ++ ++static inline struct typec_mux_dev * ++typec_mux_register(struct device *parent, const struct typec_mux_desc *desc) ++{ ++ return ERR_PTR(-EOPNOTSUPP); ++} ++static inline void typec_mux_unregister(struct typec_mux_dev *mux) {} ++ ++static inline void typec_mux_set_drvdata(struct typec_mux_dev *mux, void *data) {} ++static inline void *typec_mux_get_drvdata(struct typec_mux_dev *mux) ++{ ++ return ERR_PTR(-EOPNOTSUPP); ++} ++ ++#endif /* CONFIG_TYPEC */ ++ ++static inline struct typec_mux * ++typec_mux_get(struct device *dev, const struct typec_altmode_desc *desc) ++{ ++ return fwnode_typec_mux_get(dev_fwnode(dev), desc); ++} ++ + #endif /* __USB_TYPEC_MUX */ +-- +2.35.1 + diff --git a/queue-5.19/vboxguest-do-not-use-devm-for-irq.patch b/queue-5.19/vboxguest-do-not-use-devm-for-irq.patch new file mode 100644 index 00000000000..c432c4332be --- /dev/null +++ b/queue-5.19/vboxguest-do-not-use-devm-for-irq.patch @@ -0,0 +1,81 @@ +From 859fae705424926826f815b038d95d09e99893f2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 12 Jun 2022 14:37:44 +0100 +Subject: vboxguest: Do not use devm for irq + +From: Pascal Terjan + +[ Upstream commit 6169525b76764acb81918aa387ac168fb9a55575 ] + +When relying on devm it doesn't get freed early enough which causes the +following warning when unloading the module: + +[249348.837181] remove_proc_entry: removing non-empty directory 'irq/20', leaking at least 'vboxguest' +[249348.837219] WARNING: CPU: 0 PID: 6708 at fs/proc/generic.c:715 remove_proc_entry+0x119/0x140 + +[249348.837379] Call Trace: +[249348.837385] unregister_irq_proc+0xbd/0xe0 +[249348.837392] free_desc+0x23/0x60 +[249348.837396] irq_free_descs+0x4a/0x70 +[249348.837401] irq_domain_free_irqs+0x160/0x1a0 +[249348.837452] mp_unmap_irq+0x5c/0x60 +[249348.837458] acpi_unregister_gsi_ioapic+0x29/0x40 +[249348.837463] acpi_unregister_gsi+0x17/0x30 +[249348.837467] acpi_pci_irq_disable+0xbf/0xe0 +[249348.837473] pcibios_disable_device+0x20/0x30 +[249348.837478] pci_disable_device+0xef/0x120 +[249348.837482] vbg_pci_remove+0x6c/0x70 [vboxguest] + +Reviewed-by: Hans de Goede +Signed-off-by: Pascal Terjan +Link: https://lore.kernel.org/r/20220612133744.4030602-1-pterjan@google.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/virt/vboxguest/vboxguest_linux.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/virt/vboxguest/vboxguest_linux.c b/drivers/virt/vboxguest/vboxguest_linux.c +index 73eb34849eab..4ccfd30c2a30 100644 +--- a/drivers/virt/vboxguest/vboxguest_linux.c ++++ b/drivers/virt/vboxguest/vboxguest_linux.c +@@ -356,8 +356,8 @@ static int vbg_pci_probe(struct pci_dev *pci, const struct pci_device_id *id) + goto err_vbg_core_exit; + } + +- ret = devm_request_irq(dev, pci->irq, vbg_core_isr, IRQF_SHARED, +- DEVICE_NAME, gdev); ++ ret = request_irq(pci->irq, vbg_core_isr, IRQF_SHARED, DEVICE_NAME, ++ gdev); + if (ret) { + vbg_err("vboxguest: Error requesting irq: %d\n", ret); + goto err_vbg_core_exit; +@@ -367,7 +367,7 @@ static int vbg_pci_probe(struct pci_dev *pci, const struct pci_device_id *id) + if (ret) { + vbg_err("vboxguest: Error misc_register %s failed: %d\n", + DEVICE_NAME, ret); +- goto err_vbg_core_exit; ++ goto err_free_irq; + } + + ret = misc_register(&gdev->misc_device_user); +@@ -403,6 +403,8 @@ static int vbg_pci_probe(struct pci_dev *pci, const struct pci_device_id *id) + misc_deregister(&gdev->misc_device_user); + err_unregister_misc_device: + misc_deregister(&gdev->misc_device); ++err_free_irq: ++ free_irq(pci->irq, gdev); + err_vbg_core_exit: + vbg_core_exit(gdev); + err_disable_pcidev: +@@ -419,6 +421,7 @@ static void vbg_pci_remove(struct pci_dev *pci) + vbg_gdev = NULL; + mutex_unlock(&vbg_gdev_mutex); + ++ free_irq(pci->irq, gdev); + device_remove_file(gdev->dev, &dev_attr_host_features); + device_remove_file(gdev->dev, &dev_attr_host_version); + misc_deregister(&gdev->misc_device_user); +-- +2.35.1 + diff --git a/queue-5.19/venus-pm_helpers-fix-warning-in-opp-during-probe.patch b/queue-5.19/venus-pm_helpers-fix-warning-in-opp-during-probe.patch new file mode 100644 index 00000000000..606b738f938 --- /dev/null +++ b/queue-5.19/venus-pm_helpers-fix-warning-in-opp-during-probe.patch @@ -0,0 +1,119 @@ +From 9463b89cc8720e1bdecc14c1fd3d5a8d5c840bd7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Aug 2022 18:16:41 +0300 +Subject: venus: pm_helpers: Fix warning in OPP during probe + +From: Stanimir Varbanov + +[ Upstream commit 1d95af02f23031c2e1cca7607c514b86ce85bc6e ] + +Fix the following WARN triggered during Venus driver probe on +5.19.0-rc8-next-20220728: + + WARNING: CPU: 7 PID: 339 at drivers/opp/core.c:2471 dev_pm_opp_set_config+0x49c/0x610 + Modules linked in: qcom_spmi_adc5 rtc_pm8xxx qcom_spmi_adc_tm5 leds_qcom_lpg led_class_multicolor + qcom_pon qcom_vadc_common venus_core(+) qcom_spmi_temp_alarm v4l2_mem2mem videobuf2_v4l2 msm(+) + videobuf2_common crct10dif_ce spi_geni_qcom snd_soc_sm8250 i2c_qcom_geni gpu_sched + snd_soc_qcom_common videodev qcom_q6v5_pas soundwire_qcom drm_dp_aux_bus qcom_stats + drm_display_helper qcom_pil_info soundwire_bus snd_soc_lpass_va_macro mc qcom_q6v5 + phy_qcom_snps_femto_v2 qcom_rng snd_soc_lpass_macro_common snd_soc_lpass_wsa_macro + lpass_gfm_sm8250 slimbus qcom_sysmon qcom_common qcom_glink_smem qmi_helpers + qcom_wdt mdt_loader socinfo icc_osm_l3 display_connector + drm_kms_helper qnoc_sm8250 drm fuse ip_tables x_tables ipv6 + CPU: 7 PID: 339 Comm: systemd-udevd Not tainted 5.19.0-rc8-next-20220728 #4 + Hardware name: Qualcomm Technologies, Inc. Robotics RB5 (DT) + pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) + pc : dev_pm_opp_set_config+0x49c/0x610 + lr : dev_pm_opp_set_config+0x58/0x610 + sp : ffff8000093c3710 + x29: ffff8000093c3710 x28: ffffbca3959d82b8 x27: ffff8000093c3d00 + x26: ffffbca3959d8e08 x25: ffff4396cac98118 x24: ffff4396c0e24810 + x23: ffff4396c4272c40 x22: ffff4396c0e24810 x21: ffff8000093c3810 + x20: ffff4396cac36800 x19: ffff4396cac96800 x18: 0000000000000000 + x17: 0000000000000003 x16: ffffbca3f4edf198 x15: 0000001cba64a858 + x14: 0000000000000180 x13: 000000000000017e x12: 0000000000000000 + x11: 0000000000000002 x10: 0000000000000a60 x9 : ffff8000093c35c0 + x8 : ffff4396c4273700 x7 : ffff43983efca6c0 x6 : ffff43983efca640 + x5 : 00000000410fd0d0 x4 : ffff4396c4272c40 x3 : ffffbca3f5d1e008 + x2 : 0000000000000000 x1 : ffff4396c2421600 x0 : ffff4396cac96860 + Call trace: + dev_pm_opp_set_config+0x49c/0x610 + devm_pm_opp_set_config+0x18/0x70 + vcodec_domains_get+0xb8/0x1638 [venus_core] + core_get_v4+0x1d8/0x218 [venus_core] + venus_probe+0xf4/0x468 [venus_core] + platform_probe+0x68/0xd8 + really_probe+0xbc/0x2a8 + __driver_probe_device+0x78/0xe0 + driver_probe_device+0x3c/0xf0 + __driver_attach+0x70/0x120 + bus_for_each_dev+0x70/0xc0 + driver_attach+0x24/0x30 + bus_add_driver+0x150/0x200 + driver_register+0x64/0x120 + __platform_driver_register+0x28/0x38 + qcom_venus_driver_init+0x24/0x1000 [venus_core] + do_one_initcall+0x54/0x1c8 + do_init_module+0x44/0x1d0 + load_module+0x16c8/0x1aa0 + __do_sys_finit_module+0xbc/0x110 + __arm64_sys_finit_module+0x20/0x30 + invoke_syscall+0x44/0x108 + el0_svc_common.constprop.0+0xcc/0xf0 + do_el0_svc+0x2c/0xb8 + el0_svc+0x2c/0x88 + el0t_64_sync_handler+0xb8/0xc0 + el0t_64_sync+0x18c/0x190 + qcom-venus: probe of aa00000.video-codec failed with error -16 + +The fix is re-ordering the code related to OPP core. The OPP core +expects all configuration options to be provided before the OPP +table is added. + +Reported-by: Linux Kernel Functional Testing +Suggested-by: Viresh Kumar +Signed-off-by: Stanimir Varbanov +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/media/platform/qcom/venus/pm_helpers.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/media/platform/qcom/venus/pm_helpers.c b/drivers/media/platform/qcom/venus/pm_helpers.c +index cb48c5ff3dee..c93d2906e4c7 100644 +--- a/drivers/media/platform/qcom/venus/pm_helpers.c ++++ b/drivers/media/platform/qcom/venus/pm_helpers.c +@@ -875,7 +875,7 @@ static int vcodec_domains_get(struct venus_core *core) + } + + skip_pmdomains: +- if (!core->has_opp_table) ++ if (!core->res->opp_pmdomain) + return 0; + + /* Attach the power domain for setting performance state */ +@@ -1007,6 +1007,10 @@ static int core_get_v4(struct venus_core *core) + if (ret) + return ret; + ++ ret = vcodec_domains_get(core); ++ if (ret) ++ return ret; ++ + if (core->res->opp_pmdomain) { + ret = devm_pm_opp_of_add_table(dev); + if (!ret) { +@@ -1017,10 +1021,6 @@ static int core_get_v4(struct venus_core *core) + } + } + +- ret = vcodec_domains_get(core); +- if (ret) +- return ret; +- + return 0; + } + +-- +2.35.1 + diff --git a/queue-5.19/vfio-clear-the-caps-buf-to-null-after-free.patch b/queue-5.19/vfio-clear-the-caps-buf-to-null-after-free.patch new file mode 100644 index 00000000000..75f66491c30 --- /dev/null +++ b/queue-5.19/vfio-clear-the-caps-buf-to-null-after-free.patch @@ -0,0 +1,38 @@ +From e100f4697ce840ac50be1e86335f3c3764c29897 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Jun 2022 10:29:48 +0800 +Subject: vfio: Clear the caps->buf to NULL after free + +From: Schspa Shi + +[ Upstream commit 6641085e8d7b3f061911517f79a2a15a0a21b97b ] + +On buffer resize failure, vfio_info_cap_add() will free the buffer, +report zero for the size, and return -ENOMEM. As additional +hardening, also clear the buffer pointer to prevent any chance of a +double free. + +Signed-off-by: Schspa Shi +Reviewed-by: Cornelia Huck +Link: https://lore.kernel.org/r/20220629022948.55608-1-schspa@gmail.com +Signed-off-by: Alex Williamson +Signed-off-by: Sasha Levin +--- + drivers/vfio/vfio.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/vfio/vfio.c b/drivers/vfio/vfio.c +index 18fc0916587e..277cd1152dd8 100644 +--- a/drivers/vfio/vfio.c ++++ b/drivers/vfio/vfio.c +@@ -1814,6 +1814,7 @@ struct vfio_info_cap_header *vfio_info_cap_add(struct vfio_info_cap *caps, + buf = krealloc(caps->buf, caps->size + size, GFP_KERNEL); + if (!buf) { + kfree(caps->buf); ++ caps->buf = NULL; + caps->size = 0; + return ERR_PTR(-ENOMEM); + } +-- +2.35.1 + diff --git a/queue-5.19/video-fbdev-i740fb-check-the-argument-of-i740_calc_v.patch b/queue-5.19/video-fbdev-i740fb-check-the-argument-of-i740_calc_v.patch new file mode 100644 index 00000000000..20e827a5984 --- /dev/null +++ b/queue-5.19/video-fbdev-i740fb-check-the-argument-of-i740_calc_v.patch @@ -0,0 +1,67 @@ +From 1cf6bd5915ba28662dfc9c6760f3b21952f237c9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Aug 2022 17:24:19 +0800 +Subject: video: fbdev: i740fb: Check the argument of i740_calc_vclk() + +From: Zheyu Ma + +[ Upstream commit 40bf722f8064f50200b8c4f8946cd625b441dda9 ] + +Since the user can control the arguments of the ioctl() from the user +space, under special arguments that may result in a divide-by-zero bug. + +If the user provides an improper 'pixclock' value that makes the argumet +of i740_calc_vclk() less than 'I740_RFREQ_FIX', it will cause a +divide-by-zero bug in: + drivers/video/fbdev/i740fb.c:353 p_best = min(15, ilog2(I740_MAX_VCO_FREQ / (freq / I740_RFREQ_FIX))); + +The following log can reveal it: + +divide error: 0000 [#1] PREEMPT SMP KASAN PTI +RIP: 0010:i740_calc_vclk drivers/video/fbdev/i740fb.c:353 [inline] +RIP: 0010:i740fb_decode_var drivers/video/fbdev/i740fb.c:646 [inline] +RIP: 0010:i740fb_set_par+0x163f/0x3b70 drivers/video/fbdev/i740fb.c:742 +Call Trace: + fb_set_var+0x604/0xeb0 drivers/video/fbdev/core/fbmem.c:1034 + do_fb_ioctl+0x234/0x670 drivers/video/fbdev/core/fbmem.c:1110 + fb_ioctl+0xdd/0x130 drivers/video/fbdev/core/fbmem.c:1189 + +Fix this by checking the argument of i740_calc_vclk() first. + +Signed-off-by: Zheyu Ma +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/i740fb.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/drivers/video/fbdev/i740fb.c b/drivers/video/fbdev/i740fb.c +index 09dd85553d4f..7f09a0daaaa2 100644 +--- a/drivers/video/fbdev/i740fb.c ++++ b/drivers/video/fbdev/i740fb.c +@@ -400,7 +400,7 @@ static int i740fb_decode_var(const struct fb_var_screeninfo *var, + u32 xres, right, hslen, left, xtotal; + u32 yres, lower, vslen, upper, ytotal; + u32 vxres, xoffset, vyres, yoffset; +- u32 bpp, base, dacspeed24, mem; ++ u32 bpp, base, dacspeed24, mem, freq; + u8 r7; + int i; + +@@ -643,7 +643,12 @@ static int i740fb_decode_var(const struct fb_var_screeninfo *var, + par->atc[VGA_ATC_OVERSCAN] = 0; + + /* Calculate VCLK that most closely matches the requested dot clock */ +- i740_calc_vclk((((u32)1e9) / var->pixclock) * (u32)(1e3), par); ++ freq = (((u32)1e9) / var->pixclock) * (u32)(1e3); ++ if (freq < I740_RFREQ_FIX) { ++ fb_dbg(info, "invalid pixclock\n"); ++ freq = I740_RFREQ_FIX; ++ } ++ i740_calc_vclk(freq, par); + + /* Since we program the clocks ourselves, always use VCLK2. */ + par->misc |= 0x0C; +-- +2.35.1 + diff --git a/queue-5.19/watchdog-export-lockup_detector_reconfigure.patch b/queue-5.19/watchdog-export-lockup_detector_reconfigure.patch new file mode 100644 index 00000000000..6c043556bb5 --- /dev/null +++ b/queue-5.19/watchdog-export-lockup_detector_reconfigure.patch @@ -0,0 +1,115 @@ +From dcecbc3bda5713ad9b65318974658777153f8f6d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Jul 2022 17:47:27 +0200 +Subject: watchdog: export lockup_detector_reconfigure + +From: Laurent Dufour + +[ Upstream commit 7c56a8733d0a2a4be2438a7512566e5ce552fccf ] + +In some circumstances it may be interesting to reconfigure the watchdog +from inside the kernel. + +On PowerPC, this may helpful before and after a LPAR migration (LPM) is +initiated, because it implies some latencies, watchdog, and especially NMI +watchdog is expected to be triggered during this operation. Reconfiguring +the watchdog with a factor, would prevent it to happen too frequently +during LPM. + +Rename lockup_detector_reconfigure() as __lockup_detector_reconfigure() and +create a new function lockup_detector_reconfigure() calling +__lockup_detector_reconfigure() under the protection of watchdog_mutex. + +Signed-off-by: Laurent Dufour +[mpe: Squash in build fix from Laurent, reported by Sachin] +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20220713154729.80789-3-ldufour@linux.ibm.com +Signed-off-by: Sasha Levin +--- + include/linux/nmi.h | 2 ++ + kernel/watchdog.c | 21 ++++++++++++++++----- + 2 files changed, 18 insertions(+), 5 deletions(-) + +diff --git a/include/linux/nmi.h b/include/linux/nmi.h +index 750c7f395ca9..f700ff2df074 100644 +--- a/include/linux/nmi.h ++++ b/include/linux/nmi.h +@@ -122,6 +122,8 @@ int watchdog_nmi_probe(void); + int watchdog_nmi_enable(unsigned int cpu); + void watchdog_nmi_disable(unsigned int cpu); + ++void lockup_detector_reconfigure(void); ++ + /** + * touch_nmi_watchdog - restart NMI watchdog timeout. + * +diff --git a/kernel/watchdog.c b/kernel/watchdog.c +index ecb0e8346e65..8e61f21e7e33 100644 +--- a/kernel/watchdog.c ++++ b/kernel/watchdog.c +@@ -537,7 +537,7 @@ int lockup_detector_offline_cpu(unsigned int cpu) + return 0; + } + +-static void lockup_detector_reconfigure(void) ++static void __lockup_detector_reconfigure(void) + { + cpus_read_lock(); + watchdog_nmi_stop(); +@@ -557,6 +557,13 @@ static void lockup_detector_reconfigure(void) + __lockup_detector_cleanup(); + } + ++void lockup_detector_reconfigure(void) ++{ ++ mutex_lock(&watchdog_mutex); ++ __lockup_detector_reconfigure(); ++ mutex_unlock(&watchdog_mutex); ++} ++ + /* + * Create the watchdog infrastructure and configure the detector(s). + */ +@@ -573,13 +580,13 @@ static __init void lockup_detector_setup(void) + return; + + mutex_lock(&watchdog_mutex); +- lockup_detector_reconfigure(); ++ __lockup_detector_reconfigure(); + softlockup_initialized = true; + mutex_unlock(&watchdog_mutex); + } + + #else /* CONFIG_SOFTLOCKUP_DETECTOR */ +-static void lockup_detector_reconfigure(void) ++static void __lockup_detector_reconfigure(void) + { + cpus_read_lock(); + watchdog_nmi_stop(); +@@ -587,9 +594,13 @@ static void lockup_detector_reconfigure(void) + watchdog_nmi_start(); + cpus_read_unlock(); + } ++void lockup_detector_reconfigure(void) ++{ ++ __lockup_detector_reconfigure(); ++} + static inline void lockup_detector_setup(void) + { +- lockup_detector_reconfigure(); ++ __lockup_detector_reconfigure(); + } + #endif /* !CONFIG_SOFTLOCKUP_DETECTOR */ + +@@ -629,7 +640,7 @@ static void proc_watchdog_update(void) + { + /* Remove impossible cpus to keep sysctl output clean. */ + cpumask_and(&watchdog_cpumask, &watchdog_cpumask, cpu_possible_mask); +- lockup_detector_reconfigure(); ++ __lockup_detector_reconfigure(); + } + + /* +-- +2.35.1 + diff --git a/queue-5.19/x86-ibt-objtool-add-ibt_noseal.patch b/queue-5.19/x86-ibt-objtool-add-ibt_noseal.patch new file mode 100644 index 00000000000..0c005e6a60c --- /dev/null +++ b/queue-5.19/x86-ibt-objtool-add-ibt_noseal.patch @@ -0,0 +1,67 @@ +From 225e4d98eba6d90a66ba8c649605922c4da87706 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Aug 2022 14:39:27 -0700 +Subject: x86/ibt, objtool: Add IBT_NOSEAL() + +From: Josh Poimboeuf + +[ Upstream commit e27e5bea956ce4d3eb15112de5fa5a3b77c2f488 ] + +Add a macro which prevents a function from getting sealed if there are +no compile-time references to it. + +Signed-off-by: Josh Poimboeuf +Message-Id: <20220818213927.e44fmxkoq4yj6ybn@treble> +Signed-off-by: Paolo Bonzini +Signed-off-by: Sasha Levin +--- + arch/x86/include/asm/ibt.h | 11 +++++++++++ + tools/objtool/check.c | 3 ++- + 2 files changed, 13 insertions(+), 1 deletion(-) + +diff --git a/arch/x86/include/asm/ibt.h b/arch/x86/include/asm/ibt.h +index 689880eca9ba..9b08082a5d9f 100644 +--- a/arch/x86/include/asm/ibt.h ++++ b/arch/x86/include/asm/ibt.h +@@ -31,6 +31,16 @@ + + #define __noendbr __attribute__((nocf_check)) + ++/* ++ * Create a dummy function pointer reference to prevent objtool from marking ++ * the function as needing to be "sealed" (i.e. ENDBR converted to NOP by ++ * apply_ibt_endbr()). ++ */ ++#define IBT_NOSEAL(fname) \ ++ ".pushsection .discard.ibt_endbr_noseal\n\t" \ ++ _ASM_PTR fname "\n\t" \ ++ ".popsection\n\t" ++ + static inline __attribute_const__ u32 gen_endbr(void) + { + u32 endbr; +@@ -84,6 +94,7 @@ extern __noendbr void ibt_restore(u64 save); + #ifndef __ASSEMBLY__ + + #define ASM_ENDBR ++#define IBT_NOSEAL(name) + + #define __noendbr + +diff --git a/tools/objtool/check.c b/tools/objtool/check.c +index b341f8a8c7c5..31c719f99f66 100644 +--- a/tools/objtool/check.c ++++ b/tools/objtool/check.c +@@ -4096,7 +4096,8 @@ static int validate_ibt(struct objtool_file *file) + * These sections can reference text addresses, but not with + * the intent to indirect branch to them. + */ +- if (!strncmp(sec->name, ".discard", 8) || ++ if ((!strncmp(sec->name, ".discard", 8) && ++ strcmp(sec->name, ".discard.ibt_endbr_noseal")) || + !strncmp(sec->name, ".debug", 6) || + !strcmp(sec->name, ".altinstructions") || + !strcmp(sec->name, ".ibt_endbr_seal") || +-- +2.35.1 + diff --git a/queue-5.19/x86-kvm-fix-missing-endbr-bug-for-fastop-functions.patch b/queue-5.19/x86-kvm-fix-missing-endbr-bug-for-fastop-functions.patch new file mode 100644 index 00000000000..b4c0e10ce0d --- /dev/null +++ b/queue-5.19/x86-kvm-fix-missing-endbr-bug-for-fastop-functions.patch @@ -0,0 +1,70 @@ +From a2683c8af14e5610023181ca4c50de88e0fc87c4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Aug 2022 08:53:43 -0700 +Subject: x86/kvm: Fix "missing ENDBR" BUG for fastop functions + +From: Josh Poimboeuf + +[ Upstream commit 3d9606b0e0f3aed4dfb61d0853ebf432fead7bba ] + +The following BUG was reported: + + traps: Missing ENDBR: andw_ax_dx+0x0/0x10 [kvm] + ------------[ cut here ]------------ + kernel BUG at arch/x86/kernel/traps.c:253! + invalid opcode: 0000 [#1] PREEMPT SMP NOPTI + + asm_exc_control_protection+0x2b/0x30 + RIP: 0010:andw_ax_dx+0x0/0x10 [kvm] + Code: c3 cc cc cc cc 0f 1f 44 00 00 66 0f 1f 00 48 19 d0 c3 cc cc cc + cc 0f 1f 40 00 f3 0f 1e fa 20 d0 c3 cc cc cc cc 0f 1f 44 00 00 + <66> 0f 1f 00 66 21 d0 c3 cc cc cc cc 0f 1f 40 00 66 0f 1f 00 21 + d0 + + ? andb_al_dl+0x10/0x10 [kvm] + ? fastop+0x5d/0xa0 [kvm] + x86_emulate_insn+0x822/0x1060 [kvm] + x86_emulate_instruction+0x46f/0x750 [kvm] + complete_emulated_mmio+0x216/0x2c0 [kvm] + kvm_arch_vcpu_ioctl_run+0x604/0x650 [kvm] + kvm_vcpu_ioctl+0x2f4/0x6b0 [kvm] + ? wake_up_q+0xa0/0xa0 + +The BUG occurred because the ENDBR in the andw_ax_dx() fastop function +had been incorrectly "sealed" (converted to a NOP) by apply_ibt_endbr(). + +Objtool marked it to be sealed because KVM has no compile-time +references to the function. Instead KVM calculates its address at +runtime. + +Prevent objtool from annotating fastop functions as sealable by creating +throwaway dummy compile-time references to the functions. + +Fixes: 6649fa876da4 ("x86/ibt,kvm: Add ENDBR to fastops") +Reported-by: Pengfei Xu +Debugged-by: Peter Zijlstra +Signed-off-by: Josh Poimboeuf +Message-Id: <0d4116f90e9d0c1b754bb90c585e6f0415a1c508.1660837839.git.jpoimboe@kernel.org> +Signed-off-by: Paolo Bonzini +Signed-off-by: Sasha Levin +--- + arch/x86/kvm/emulate.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c +index aa907cec0918..09fa8a94807b 100644 +--- a/arch/x86/kvm/emulate.c ++++ b/arch/x86/kvm/emulate.c +@@ -316,7 +316,8 @@ static int fastop(struct x86_emulate_ctxt *ctxt, fastop_t fop); + ".align " __stringify(FASTOP_SIZE) " \n\t" \ + ".type " name ", @function \n\t" \ + name ":\n\t" \ +- ASM_ENDBR ++ ASM_ENDBR \ ++ IBT_NOSEAL(name) + + #define FOP_FUNC(name) \ + __FOP_FUNC(#name) +-- +2.35.1 + diff --git a/queue-5.19/zram-do-not-lookup-algorithm-in-backends-table.patch b/queue-5.19/zram-do-not-lookup-algorithm-in-backends-table.patch new file mode 100644 index 00000000000..ecb445f2a88 --- /dev/null +++ b/queue-5.19/zram-do-not-lookup-algorithm-in-backends-table.patch @@ -0,0 +1,100 @@ +From 15f899a1e319e18d9737c9163f17554a8cab0949 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Jun 2022 11:35:01 +0900 +Subject: zram: do not lookup algorithm in backends table + +From: Sergey Senozhatsky + +[ Upstream commit dc89997264de565999a1cb55db3f295d3a8e457b ] + +Always use crypto_has_comp() so that crypto can lookup module, call +usermodhelper to load the modules, wait for usermodhelper to finish and so +on. Otherwise crypto will do all of these steps under CPU hot-plug lock +and this looks like too much stuff to handle under the CPU hot-plug lock. +Besides this can end up in a deadlock when usermodhelper triggers a code +path that attempts to lock the CPU hot-plug lock, that zram already holds. + +An example of such deadlock: + +- path A. zram grabs CPU hot-plug lock, execs /sbin/modprobe from crypto + and waits for modprobe to finish + +disksize_store + zcomp_create + __cpuhp_state_add_instance + __cpuhp_state_add_instance_cpuslocked + zcomp_cpu_up_prepare + crypto_alloc_base + crypto_alg_mod_lookup + call_usermodehelper_exec + wait_for_completion_killable + do_wait_for_common + schedule + +- path B. async work kthread that brings in scsi device. It wants to + register CPUHP states at some point, and it needs the CPU hot-plug + lock for that, which is owned by zram. + +async_run_entry_fn + scsi_probe_and_add_lun + scsi_mq_alloc_queue + blk_mq_init_queue + blk_mq_init_allocated_queue + blk_mq_realloc_hw_ctxs + __cpuhp_state_add_instance + __cpuhp_state_add_instance_cpuslocked + mutex_lock + schedule + +- path C. modprobe sleeps, waiting for all aync works to finish. + +load_module + do_init_module + async_synchronize_full + async_synchronize_cookie_domain + schedule + +[senozhatsky@chromium.org: add comment] + Link: https://lkml.kernel.org/r/20220624060606.1014474-1-senozhatsky@chromium.org +Link: https://lkml.kernel.org/r/20220622023501.517125-1-senozhatsky@chromium.org +Signed-off-by: Sergey Senozhatsky +Cc: Minchan Kim +Cc: Nitin Gupta +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + drivers/block/zram/zcomp.c | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +diff --git a/drivers/block/zram/zcomp.c b/drivers/block/zram/zcomp.c +index 052aa3f65514..0916de952e09 100644 +--- a/drivers/block/zram/zcomp.c ++++ b/drivers/block/zram/zcomp.c +@@ -63,12 +63,6 @@ static int zcomp_strm_init(struct zcomp_strm *zstrm, struct zcomp *comp) + + bool zcomp_available_algorithm(const char *comp) + { +- int i; +- +- i = sysfs_match_string(backends, comp); +- if (i >= 0) +- return true; +- + /* + * Crypto does not ignore a trailing new line symbol, + * so make sure you don't supply a string containing +@@ -217,6 +211,11 @@ struct zcomp *zcomp_create(const char *compress) + struct zcomp *comp; + int error; + ++ /* ++ * Crypto API will execute /sbin/modprobe if the compression module ++ * is not loaded yet. We must do it here, otherwise we are about to ++ * call /sbin/modprobe under CPU hot-plug lock. ++ */ + if (!zcomp_available_algorithm(compress)) + return ERR_PTR(-EINVAL); + +-- +2.35.1 +