From: Sasha Levin Date: Thu, 17 Aug 2023 14:52:44 +0000 (-0400) Subject: Fixes for 6.4 X-Git-Tag: v6.4.12~103 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=aee035ef96053646d5a7f3cdf71578bcee7df5e8;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 6.4 Signed-off-by: Sasha Levin --- diff --git a/queue-6.4/accel-habanalabs-add-pci-health-check-during-heartbe.patch b/queue-6.4/accel-habanalabs-add-pci-health-check-during-heartbe.patch new file mode 100644 index 00000000000..1f94d14a18c --- /dev/null +++ b/queue-6.4/accel-habanalabs-add-pci-health-check-during-heartbe.patch @@ -0,0 +1,87 @@ +From 84fccd999c2b4566e142091b7dbbaeb5aca9e386 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Apr 2023 14:48:22 +0300 +Subject: accel/habanalabs: add pci health check during heartbeat + +From: Ofir Bitton + +[ Upstream commit d8b9cea584661b30305cf341bf9f675dc0a25471 ] + +Currently upon a heartbeat failure, we don't know if the failure +is due to firmware hang or due to a bad PCI link. Hence, we +are reading a PCI config space register with a known value (vendor ID) +so we will know which of the two possibilities caused the heartbeat +failure. + +Signed-off-by: Ofir Bitton +Reviewed-by: Oded Gabbay +Signed-off-by: Oded Gabbay +Signed-off-by: Sasha Levin +--- + drivers/accel/habanalabs/common/device.c | 15 ++++++++++++++- + drivers/accel/habanalabs/common/habanalabs.h | 2 ++ + drivers/accel/habanalabs/common/habanalabs_drv.c | 2 -- + 3 files changed, 16 insertions(+), 3 deletions(-) + +diff --git a/drivers/accel/habanalabs/common/device.c b/drivers/accel/habanalabs/common/device.c +index fabfc501ef543..a39dd346a1678 100644 +--- a/drivers/accel/habanalabs/common/device.c ++++ b/drivers/accel/habanalabs/common/device.c +@@ -981,6 +981,18 @@ static void device_early_fini(struct hl_device *hdev) + hdev->asic_funcs->early_fini(hdev); + } + ++static bool is_pci_link_healthy(struct hl_device *hdev) ++{ ++ u16 vendor_id; ++ ++ if (!hdev->pdev) ++ return false; ++ ++ pci_read_config_word(hdev->pdev, PCI_VENDOR_ID, &vendor_id); ++ ++ return (vendor_id == PCI_VENDOR_ID_HABANALABS); ++} ++ + static void hl_device_heartbeat(struct work_struct *work) + { + struct hl_device *hdev = container_of(work, struct hl_device, +@@ -995,7 +1007,8 @@ static void hl_device_heartbeat(struct work_struct *work) + goto reschedule; + + if (hl_device_operational(hdev, NULL)) +- dev_err(hdev->dev, "Device heartbeat failed!\n"); ++ dev_err(hdev->dev, "Device heartbeat failed! PCI link is %s\n", ++ is_pci_link_healthy(hdev) ? "healthy" : "broken"); + + info.err_type = HL_INFO_FW_HEARTBEAT_ERR; + info.event_mask = &event_mask; +diff --git a/drivers/accel/habanalabs/common/habanalabs.h b/drivers/accel/habanalabs/common/habanalabs.h +index eaae69a9f8178..7f5d1b6e3fb08 100644 +--- a/drivers/accel/habanalabs/common/habanalabs.h ++++ b/drivers/accel/habanalabs/common/habanalabs.h +@@ -36,6 +36,8 @@ + struct hl_device; + struct hl_fpriv; + ++#define PCI_VENDOR_ID_HABANALABS 0x1da3 ++ + /* Use upper bits of mmap offset to store habana driver specific information. + * bits[63:59] - Encode mmap type + * bits[45:0] - mmap offset value +diff --git a/drivers/accel/habanalabs/common/habanalabs_drv.c b/drivers/accel/habanalabs/common/habanalabs_drv.c +index d9df64e75f33a..1ec97da3dddb8 100644 +--- a/drivers/accel/habanalabs/common/habanalabs_drv.c ++++ b/drivers/accel/habanalabs/common/habanalabs_drv.c +@@ -54,8 +54,6 @@ module_param(boot_error_status_mask, ulong, 0444); + MODULE_PARM_DESC(boot_error_status_mask, + "Mask of the error status during device CPU boot (If bitX is cleared then error X is masked. Default all 1's)"); + +-#define PCI_VENDOR_ID_HABANALABS 0x1da3 +- + #define PCI_IDS_GOYA 0x0001 + #define PCI_IDS_GAUDI 0x1000 + #define PCI_IDS_GAUDI_SEC 0x1010 +-- +2.40.1 + diff --git a/queue-6.4/accel-habanalabs-fix-mem-leak-in-capture-user-mappin.patch b/queue-6.4/accel-habanalabs-fix-mem-leak-in-capture-user-mappin.patch new file mode 100644 index 00000000000..5986c9d2632 --- /dev/null +++ b/queue-6.4/accel-habanalabs-fix-mem-leak-in-capture-user-mappin.patch @@ -0,0 +1,45 @@ +From f626f22820b8fe9e414750e4ac21c3f8b4477874 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 16 Apr 2023 18:36:17 +0300 +Subject: accel/habanalabs: fix mem leak in capture user mappings + +From: Moti Haimovski + +[ Upstream commit 314a7ffd7c196b27eedd50cb7553029e17789b55 ] + +This commit fixes a memory leak caused when clearing the user_mappings +info when a new context is opened immediately after user_mapping is +captured and a hard reset is performed. + +Signed-off-by: Moti Haimovski +Reviewed-by: Dani Liberman +Reviewed-by: Oded Gabbay +Signed-off-by: Oded Gabbay +Signed-off-by: Sasha Levin +--- + drivers/accel/habanalabs/common/habanalabs_drv.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/accel/habanalabs/common/habanalabs_drv.c b/drivers/accel/habanalabs/common/habanalabs_drv.c +index 1ec97da3dddb8..70fb2df9a93b8 100644 +--- a/drivers/accel/habanalabs/common/habanalabs_drv.c ++++ b/drivers/accel/habanalabs/common/habanalabs_drv.c +@@ -13,6 +13,7 @@ + + #include + #include ++#include + + #define CREATE_TRACE_POINTS + #include +@@ -218,6 +219,7 @@ int hl_device_open(struct inode *inode, struct file *filp) + + hl_debugfs_add_file(hpriv); + ++ vfree(hdev->captured_err_info.page_fault_info.user_mappings); + memset(&hdev->captured_err_info, 0, sizeof(hdev->captured_err_info)); + atomic_set(&hdev->captured_err_info.cs_timeout.write_enable, 1); + hdev->captured_err_info.undef_opcode.write_enable = true; +-- +2.40.1 + diff --git a/queue-6.4/alsa-hda-fix-a-possible-null-pointer-dereference-due.patch b/queue-6.4/alsa-hda-fix-a-possible-null-pointer-dereference-due.patch new file mode 100644 index 00000000000..a3e7993fef3 --- /dev/null +++ b/queue-6.4/alsa-hda-fix-a-possible-null-pointer-dereference-due.patch @@ -0,0 +1,62 @@ +From 943603d5def33471b79a02efe35b56ebb7d4d71e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Jul 2023 11:10:16 +0800 +Subject: ALSA: hda: fix a possible null-pointer dereference due to data race + in snd_hdac_regmap_sync() + +From: Tuo Li + +[ Upstream commit 1f4a08fed450db87fbb5ff5105354158bdbe1a22 ] + +The variable codec->regmap is often protected by the lock +codec->regmap_lock when is accessed. However, it is accessed without +holding the lock when is accessed in snd_hdac_regmap_sync(): + + if (codec->regmap) + +In my opinion, this may be a harmful race, because if codec->regmap is +set to NULL right after the condition is checked, a null-pointer +dereference can occur in the called function regcache_sync(): + + map->lock(map->lock_arg); --> Line 360 in drivers/base/regmap/regcache.c + +To fix this possible null-pointer dereference caused by data race, the +mutex_lock coverage is extended to protect the if statement as well as the +function call to regcache_sync(). + +[ Note: the lack of the regmap_lock itself is harmless for the current + codec driver implementations, as snd_hdac_regmap_sync() is only for + PM runtime resume that is prohibited during the codec probe. + But the change makes the whole code more consistent, so it's merged + as is -- tiwai ] + +Reported-by: BassCheck +Signed-off-by: Tuo Li +Link: https://lore.kernel.org/r/20230703031016.1184711-1-islituo@gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/hda/hdac_regmap.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/sound/hda/hdac_regmap.c b/sound/hda/hdac_regmap.c +index fe3587547cfec..39610a15bcc98 100644 +--- a/sound/hda/hdac_regmap.c ++++ b/sound/hda/hdac_regmap.c +@@ -597,10 +597,9 @@ EXPORT_SYMBOL_GPL(snd_hdac_regmap_update_raw_once); + */ + void snd_hdac_regmap_sync(struct hdac_device *codec) + { +- if (codec->regmap) { +- mutex_lock(&codec->regmap_lock); ++ mutex_lock(&codec->regmap_lock); ++ if (codec->regmap) + regcache_sync(codec->regmap); +- mutex_unlock(&codec->regmap_lock); +- } ++ mutex_unlock(&codec->regmap_lock); + } + EXPORT_SYMBOL_GPL(snd_hdac_regmap_sync); +-- +2.40.1 + diff --git a/queue-6.4/alsa-hda-realtek-add-quirk-for-asus-rog-g614jx.patch b/queue-6.4/alsa-hda-realtek-add-quirk-for-asus-rog-g614jx.patch new file mode 100644 index 00000000000..f19eef5a0f7 --- /dev/null +++ b/queue-6.4/alsa-hda-realtek-add-quirk-for-asus-rog-g614jx.patch @@ -0,0 +1,38 @@ +From 93e8a33384bab7441faf8a5c91783ccdc16fd8f8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Jul 2023 16:46:18 +1200 +Subject: ALSA: hda/realtek: Add quirk for ASUS ROG G614Jx + +From: Luke D. Jones + +[ Upstream commit 33d7c9c3bf70ed91191a2bedbbc03783b824b5de ] + +Adds the required quirk to enable the Cirrus amp and correct pins +on the ASUS ROG G614J series which uses an SPI connected Cirrus amp. + +While this works if the related _DSD properties are made available, these +aren't included in the ACPI of these laptops (yet). + +Signed-off-by: Luke D. Jones +Link: https://lore.kernel.org/r/20230704044619.19343-5-luke@ljones.dev +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 1d0f43017f255..9278362e4edb2 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -9657,6 +9657,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1043, 0x1c23, "Asus X55U", ALC269_FIXUP_LIMIT_INT_MIC_BOOST), + SND_PCI_QUIRK(0x1043, 0x1c62, "ASUS GU603", ALC289_FIXUP_ASUS_GA401), + SND_PCI_QUIRK(0x1043, 0x1c92, "ASUS ROG Strix G15", ALC285_FIXUP_ASUS_G533Z_PINS), ++ SND_PCI_QUIRK(0x1043, 0x1c9f, "ASUS G614JI", ALC285_FIXUP_ASUS_HEADSET_MIC), + SND_PCI_QUIRK(0x1043, 0x1caf, "ASUS G634JYR/JZR", ALC285_FIXUP_ASUS_SPI_REAR_SPEAKERS), + SND_PCI_QUIRK(0x1043, 0x1ccd, "ASUS X555UB", ALC256_FIXUP_ASUS_MIC), + SND_PCI_QUIRK(0x1043, 0x1d1f, "ASUS ROG Strix G17 2023 (G713PV)", ALC287_FIXUP_CS35L41_I2C_2), +-- +2.40.1 + diff --git a/queue-6.4/alsa-hda-realtek-add-quirk-for-asus-rog-ga402x.patch b/queue-6.4/alsa-hda-realtek-add-quirk-for-asus-rog-ga402x.patch new file mode 100644 index 00000000000..1a17132a544 --- /dev/null +++ b/queue-6.4/alsa-hda-realtek-add-quirk-for-asus-rog-ga402x.patch @@ -0,0 +1,38 @@ +From ba14608d9a0464d198fce46b50fd1819b9ddaf00 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Jul 2023 16:46:16 +1200 +Subject: ALSA: hda/realtek: Add quirk for ASUS ROG GA402X + +From: Luke D. Jones + +[ Upstream commit 9abc77fb144fe916fd2f592dc4b8c7bade02e58a ] + +Adds the required quirk to enable the Cirrus amp and correct pins +on the ASUS ROG GA402X series which uses an I2C connected Cirrus amp. + +While this works if the related _DSD properties are made available, these +aren't included in the ACPI of these laptops (yet). + +Signed-off-by: Luke D. Jones +Link: https://lore.kernel.org/r/20230704044619.19343-3-luke@ljones.dev +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index f36cbf22c29db..2e0c822d1b5d0 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -9617,6 +9617,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1043, 0x13b0, "ASUS Z550SA", ALC256_FIXUP_ASUS_MIC), + SND_PCI_QUIRK(0x1043, 0x1427, "Asus Zenbook UX31E", ALC269VB_FIXUP_ASUS_ZENBOOK), + SND_PCI_QUIRK(0x1043, 0x1433, "ASUS GX650P", ALC285_FIXUP_ASUS_I2C_HEADSET_MIC), ++ SND_PCI_QUIRK(0x1043, 0x1463, "Asus GA402X", ALC285_FIXUP_ASUS_I2C_HEADSET_MIC), + SND_PCI_QUIRK(0x1043, 0x1473, "ASUS GU604V", ALC285_FIXUP_ASUS_HEADSET_MIC), + SND_PCI_QUIRK(0x1043, 0x1483, "ASUS GU603V", ALC285_FIXUP_ASUS_HEADSET_MIC), + SND_PCI_QUIRK(0x1043, 0x1493, "ASUS GV601V", ALC285_FIXUP_ASUS_HEADSET_MIC), +-- +2.40.1 + diff --git a/queue-6.4/alsa-hda-realtek-add-quirk-for-asus-rog-gx650p.patch b/queue-6.4/alsa-hda-realtek-add-quirk-for-asus-rog-gx650p.patch new file mode 100644 index 00000000000..2aa403328e0 --- /dev/null +++ b/queue-6.4/alsa-hda-realtek-add-quirk-for-asus-rog-gx650p.patch @@ -0,0 +1,70 @@ +From 5e4125b5ac56c405bb0ec73195905e3fd5023d10 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Jul 2023 16:46:15 +1200 +Subject: ALSA: hda/realtek: Add quirk for ASUS ROG GX650P + +From: Luke D. Jones + +[ Upstream commit 8cc87c055d28320e5fa5457922f43bc07dec58bd ] + +Adds the required quirk to enable the Cirrus amp and correct pins +on the ASUS ROG GV601V series which uses an I2C connected Cirrus amp. + +While this works if the related _DSD properties are made available, these +aren't included in the ACPI of these laptops (yet). + +Signed-off-by: Luke D. Jones +Link: https://lore.kernel.org/r/20230704044619.19343-2-luke@ljones.dev +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/patch_realtek.c | 19 +++++++++++++++++++ + 1 file changed, 19 insertions(+) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index d2ed0ede0e9b7..f36cbf22c29db 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -7081,6 +7081,8 @@ enum { + ALC285_FIXUP_SPEAKER2_TO_DAC1, + ALC285_FIXUP_ASUS_SPEAKER2_TO_DAC1, + ALC285_FIXUP_ASUS_HEADSET_MIC, ++ ALC285_FIXUP_ASUS_I2C_SPEAKER2_TO_DAC1, ++ ALC285_FIXUP_ASUS_I2C_HEADSET_MIC, + ALC280_FIXUP_HP_HEADSET_MIC, + ALC221_FIXUP_HP_FRONT_MIC, + ALC292_FIXUP_TPT460, +@@ -8073,6 +8075,22 @@ static const struct hda_fixup alc269_fixups[] = { + .chained = true, + .chain_id = ALC285_FIXUP_ASUS_SPEAKER2_TO_DAC1 + }, ++ [ALC285_FIXUP_ASUS_I2C_SPEAKER2_TO_DAC1] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = alc285_fixup_speaker2_to_dac1, ++ .chained = true, ++ .chain_id = ALC287_FIXUP_CS35L41_I2C_2 ++ }, ++ [ALC285_FIXUP_ASUS_I2C_HEADSET_MIC] = { ++ .type = HDA_FIXUP_PINS, ++ .v.pins = (const struct hda_pintbl[]) { ++ { 0x19, 0x03a11050 }, ++ { 0x1b, 0x03a11c30 }, ++ { } ++ }, ++ .chained = true, ++ .chain_id = ALC285_FIXUP_ASUS_I2C_SPEAKER2_TO_DAC1 ++ }, + [ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER] = { + .type = HDA_FIXUP_PINS, + .v.pins = (const struct hda_pintbl[]) { +@@ -9598,6 +9616,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1043, 0x1313, "Asus K42JZ", ALC269VB_FIXUP_ASUS_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1043, 0x13b0, "ASUS Z550SA", ALC256_FIXUP_ASUS_MIC), + SND_PCI_QUIRK(0x1043, 0x1427, "Asus Zenbook UX31E", ALC269VB_FIXUP_ASUS_ZENBOOK), ++ SND_PCI_QUIRK(0x1043, 0x1433, "ASUS GX650P", ALC285_FIXUP_ASUS_I2C_HEADSET_MIC), + SND_PCI_QUIRK(0x1043, 0x1473, "ASUS GU604V", ALC285_FIXUP_ASUS_HEADSET_MIC), + SND_PCI_QUIRK(0x1043, 0x1483, "ASUS GU603V", ALC285_FIXUP_ASUS_HEADSET_MIC), + SND_PCI_QUIRK(0x1043, 0x1493, "ASUS GV601V", ALC285_FIXUP_ASUS_HEADSET_MIC), +-- +2.40.1 + diff --git a/queue-6.4/alsa-hda-realtek-add-quirk-for-asus-rog-gz301v.patch b/queue-6.4/alsa-hda-realtek-add-quirk-for-asus-rog-gz301v.patch new file mode 100644 index 00000000000..ca8ac6437d8 --- /dev/null +++ b/queue-6.4/alsa-hda-realtek-add-quirk-for-asus-rog-gz301v.patch @@ -0,0 +1,38 @@ +From 5051e2ff091014049b6b29bf73465a3b8a973e59 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Jul 2023 10:33:23 +1200 +Subject: ALSA: hda/realtek: Add quirk for ASUS ROG GZ301V + +From: Luke D. Jones + +[ Upstream commit 5251605f4d297a0eb5d3b7f39f9dcee9e4d0115a ] + +Adds the required quirk to enable the Cirrus amp and correct pins +on the ASUS ROG GZ301V series which uses an SPI connected Cirrus amp. + +While this works if the related _DSD properties are made available, these +aren't included in the ACPI of these laptops (yet). + +Signed-off-by: Luke D. Jones +Link: https://lore.kernel.org/r/20230706223323.30871-2-luke@ljones.dev +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 9278362e4edb2..853d1ed21facd 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -9632,6 +9632,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1043, 0x1483, "ASUS GU603V", ALC285_FIXUP_ASUS_HEADSET_MIC), + SND_PCI_QUIRK(0x1043, 0x1493, "ASUS GV601V", ALC285_FIXUP_ASUS_HEADSET_MIC), + SND_PCI_QUIRK(0x1043, 0x1517, "Asus Zenbook UX31A", ALC269VB_FIXUP_ASUS_ZENBOOK_UX31A), ++ SND_PCI_QUIRK(0x1043, 0x1573, "ASUS GZ301V", ALC285_FIXUP_ASUS_HEADSET_MIC), + SND_PCI_QUIRK(0x1043, 0x1662, "ASUS GV301QH", ALC294_FIXUP_ASUS_DUAL_SPK), + SND_PCI_QUIRK(0x1043, 0x1683, "ASUS UM3402YAR", ALC287_FIXUP_CS35L41_I2C_2), + SND_PCI_QUIRK(0x1043, 0x16b2, "ASUS GU603", ALC289_FIXUP_ASUS_GA401), +-- +2.40.1 + diff --git a/queue-6.4/alsa-hda-realtek-add-quirks-for-unis-h3c-desktop-b76.patch b/queue-6.4/alsa-hda-realtek-add-quirks-for-unis-h3c-desktop-b76.patch new file mode 100644 index 00000000000..1995c408b3e --- /dev/null +++ b/queue-6.4/alsa-hda-realtek-add-quirks-for-unis-h3c-desktop-b76.patch @@ -0,0 +1,59 @@ +From 9050a1405a182d4079ed3aa5cad2d2cf82bbf26e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Jul 2023 10:17:51 +0800 +Subject: ALSA: hda/realtek: Add quirks for Unis H3C Desktop B760 & Q760 + +From: dengxiang + +[ Upstream commit 73f1c75d5e6bd8ce2a887ef493a66ad1b16ed704 ] + +These models use NSIWAY amplifiers for internal speaker, but cannot put +sound outside from these amplifiers. So eapd verbs are needed to initialize +the amplifiers. They can be added during boot to get working sound out +of internal speaker. + +Signed-off-by: dengxiang +Link: https://lore.kernel.org/r/20230703021751.2945750-1-dengxiang@nfschina.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/patch_realtek.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index bcd548e247fc8..d2ed0ede0e9b7 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -11316,6 +11316,7 @@ enum { + ALC897_FIXUP_HP_HSMIC_VERB, + ALC897_FIXUP_LENOVO_HEADSET_MODE, + ALC897_FIXUP_HEADSET_MIC_PIN2, ++ ALC897_FIXUP_UNIS_H3C_X500S, + }; + + static const struct hda_fixup alc662_fixups[] = { +@@ -11755,6 +11756,13 @@ static const struct hda_fixup alc662_fixups[] = { + .chained = true, + .chain_id = ALC897_FIXUP_LENOVO_HEADSET_MODE + }, ++ [ALC897_FIXUP_UNIS_H3C_X500S] = { ++ .type = HDA_FIXUP_VERBS, ++ .v.verbs = (const struct hda_verb[]) { ++ { 0x14, AC_VERB_SET_EAPD_BTLENABLE, 0 }, ++ {} ++ }, ++ }, + }; + + static const struct snd_pci_quirk alc662_fixup_tbl[] = { +@@ -11916,6 +11924,7 @@ static const struct hda_model_fixup alc662_fixup_models[] = { + {.id = ALC662_FIXUP_USI_HEADSET_MODE, .name = "usi-headset"}, + {.id = ALC662_FIXUP_LENOVO_MULTI_CODECS, .name = "dual-codecs"}, + {.id = ALC669_FIXUP_ACER_ASPIRE_ETHOS, .name = "aspire-ethos"}, ++ {.id = ALC897_FIXUP_UNIS_H3C_X500S, .name = "unis-h3c-x500s"}, + {} + }; + +-- +2.40.1 + diff --git a/queue-6.4/alsa-hda-realtek-amend-g634-quirk-to-enable-rear-spe.patch b/queue-6.4/alsa-hda-realtek-amend-g634-quirk-to-enable-rear-spe.patch new file mode 100644 index 00000000000..622ed5764a0 --- /dev/null +++ b/queue-6.4/alsa-hda-realtek-amend-g634-quirk-to-enable-rear-spe.patch @@ -0,0 +1,60 @@ +From c7d53d412921d1c12ed82f566fbf498d78b7ecc0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Jul 2023 16:46:17 +1200 +Subject: ALSA: hda/realtek: Amend G634 quirk to enable rear speakers + +From: Luke D. Jones + +[ Upstream commit b759a5f097cd42c666f1ebca8da50ff507435fbe ] + +Amends the last quirk for the G634 with 0x1caf subsys to enable the rear +speakers via pincfg. + +Signed-off-by: Luke D. Jones +Link: https://lore.kernel.org/r/20230704044619.19343-4-luke@ljones.dev +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/patch_realtek.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 2e0c822d1b5d0..1d0f43017f255 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -7081,6 +7081,7 @@ enum { + ALC285_FIXUP_SPEAKER2_TO_DAC1, + ALC285_FIXUP_ASUS_SPEAKER2_TO_DAC1, + ALC285_FIXUP_ASUS_HEADSET_MIC, ++ ALC285_FIXUP_ASUS_SPI_REAR_SPEAKERS, + ALC285_FIXUP_ASUS_I2C_SPEAKER2_TO_DAC1, + ALC285_FIXUP_ASUS_I2C_HEADSET_MIC, + ALC280_FIXUP_HP_HEADSET_MIC, +@@ -8075,6 +8076,15 @@ static const struct hda_fixup alc269_fixups[] = { + .chained = true, + .chain_id = ALC285_FIXUP_ASUS_SPEAKER2_TO_DAC1 + }, ++ [ALC285_FIXUP_ASUS_SPI_REAR_SPEAKERS] = { ++ .type = HDA_FIXUP_PINS, ++ .v.pins = (const struct hda_pintbl[]) { ++ { 0x14, 0x90170120 }, ++ { } ++ }, ++ .chained = true, ++ .chain_id = ALC285_FIXUP_ASUS_HEADSET_MIC ++ }, + [ALC285_FIXUP_ASUS_I2C_SPEAKER2_TO_DAC1] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc285_fixup_speaker2_to_dac1, +@@ -9647,7 +9657,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1043, 0x1c23, "Asus X55U", ALC269_FIXUP_LIMIT_INT_MIC_BOOST), + SND_PCI_QUIRK(0x1043, 0x1c62, "ASUS GU603", ALC289_FIXUP_ASUS_GA401), + SND_PCI_QUIRK(0x1043, 0x1c92, "ASUS ROG Strix G15", ALC285_FIXUP_ASUS_G533Z_PINS), +- SND_PCI_QUIRK(0x1043, 0x1caf, "ASUS G634JYR/JZR", ALC285_FIXUP_ASUS_HEADSET_MIC), ++ SND_PCI_QUIRK(0x1043, 0x1caf, "ASUS G634JYR/JZR", ALC285_FIXUP_ASUS_SPI_REAR_SPEAKERS), + SND_PCI_QUIRK(0x1043, 0x1ccd, "ASUS X555UB", ALC256_FIXUP_ASUS_MIC), + SND_PCI_QUIRK(0x1043, 0x1d1f, "ASUS ROG Strix G17 2023 (G713PV)", ALC287_FIXUP_CS35L41_I2C_2), + SND_PCI_QUIRK(0x1043, 0x1d42, "ASUS Zephyrus G14 2022", ALC289_FIXUP_ASUS_GA401), +-- +2.40.1 + diff --git a/queue-6.4/apparmor-fix-use-of-strcpy-in-policy_unpack_test.patch b/queue-6.4/apparmor-fix-use-of-strcpy-in-policy_unpack_test.patch new file mode 100644 index 00000000000..d4d22c75396 --- /dev/null +++ b/queue-6.4/apparmor-fix-use-of-strcpy-in-policy_unpack_test.patch @@ -0,0 +1,78 @@ +From 711dd4ba0e42156e1a9a2673ac6a40733d19e760 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Jan 2023 20:12:19 +0000 +Subject: apparmor: fix use of strcpy in policy_unpack_test + +From: Rae Moar + +[ Upstream commit b54aebd4411134b525a82d663a26b2f135ecb7e8 ] + +Replace the use of strcpy() in build_aa_ext_struct() in +policy_unpack_test.c with strscpy(). + +strscpy() is the safer method to use to ensure the buffer does not +overflow. This was found by kernel test robot: +https://lore.kernel.org/all/202301040348.NbfVsXO0-lkp@intel.com/. + +Reported-by: kernel test robot + +Signed-off-by: Rae Moar +Signed-off-by: John Johansen +Signed-off-by: Sasha Levin +--- + security/apparmor/policy_unpack_test.c | 13 ++++++------- + 1 file changed, 6 insertions(+), 7 deletions(-) + +diff --git a/security/apparmor/policy_unpack_test.c b/security/apparmor/policy_unpack_test.c +index e1bfdab524b79..5c9bde25e56df 100644 +--- a/security/apparmor/policy_unpack_test.c ++++ b/security/apparmor/policy_unpack_test.c +@@ -69,31 +69,30 @@ static struct aa_ext *build_aa_ext_struct(struct policy_unpack_fixture *puf, + + *buf = AA_NAME; + *(buf + 1) = strlen(TEST_STRING_NAME) + 1; +- strcpy(buf + 3, TEST_STRING_NAME); ++ strscpy(buf + 3, TEST_STRING_NAME, e->end - (void *)(buf + 3)); + + buf = e->start + TEST_STRING_BUF_OFFSET; + *buf = AA_STRING; + *(buf + 1) = strlen(TEST_STRING_DATA) + 1; +- strcpy(buf + 3, TEST_STRING_DATA); +- ++ strscpy(buf + 3, TEST_STRING_DATA, e->end - (void *)(buf + 3)); + buf = e->start + TEST_NAMED_U32_BUF_OFFSET; + *buf = AA_NAME; + *(buf + 1) = strlen(TEST_U32_NAME) + 1; +- strcpy(buf + 3, TEST_U32_NAME); ++ strscpy(buf + 3, TEST_U32_NAME, e->end - (void *)(buf + 3)); + *(buf + 3 + strlen(TEST_U32_NAME) + 1) = AA_U32; + *((u32 *)(buf + 3 + strlen(TEST_U32_NAME) + 2)) = TEST_U32_DATA; + + buf = e->start + TEST_NAMED_U64_BUF_OFFSET; + *buf = AA_NAME; + *(buf + 1) = strlen(TEST_U64_NAME) + 1; +- strcpy(buf + 3, TEST_U64_NAME); ++ strscpy(buf + 3, TEST_U64_NAME, e->end - (void *)(buf + 3)); + *(buf + 3 + strlen(TEST_U64_NAME) + 1) = AA_U64; + *((u64 *)(buf + 3 + strlen(TEST_U64_NAME) + 2)) = TEST_U64_DATA; + + buf = e->start + TEST_NAMED_BLOB_BUF_OFFSET; + *buf = AA_NAME; + *(buf + 1) = strlen(TEST_BLOB_NAME) + 1; +- strcpy(buf + 3, TEST_BLOB_NAME); ++ strscpy(buf + 3, TEST_BLOB_NAME, e->end - (void *)(buf + 3)); + *(buf + 3 + strlen(TEST_BLOB_NAME) + 1) = AA_BLOB; + *(buf + 3 + strlen(TEST_BLOB_NAME) + 2) = TEST_BLOB_DATA_SIZE; + memcpy(buf + 3 + strlen(TEST_BLOB_NAME) + 6, +@@ -102,7 +101,7 @@ static struct aa_ext *build_aa_ext_struct(struct policy_unpack_fixture *puf, + buf = e->start + TEST_NAMED_ARRAY_BUF_OFFSET; + *buf = AA_NAME; + *(buf + 1) = strlen(TEST_ARRAY_NAME) + 1; +- strcpy(buf + 3, TEST_ARRAY_NAME); ++ strscpy(buf + 3, TEST_ARRAY_NAME, e->end - (void *)(buf + 3)); + *(buf + 3 + strlen(TEST_ARRAY_NAME) + 1) = AA_ARRAY; + *((u16 *)(buf + 3 + strlen(TEST_ARRAY_NAME) + 2)) = TEST_ARRAY_SIZE; + +-- +2.40.1 + diff --git a/queue-6.4/arm-dts-imx6dl-prtrvt-prtvt7-prti6q-prtwd2-fix-usb-r.patch b/queue-6.4/arm-dts-imx6dl-prtrvt-prtvt7-prti6q-prtwd2-fix-usb-r.patch new file mode 100644 index 00000000000..559c1a2328c --- /dev/null +++ b/queue-6.4/arm-dts-imx6dl-prtrvt-prtvt7-prti6q-prtwd2-fix-usb-r.patch @@ -0,0 +1,79 @@ +From 6952c7dae77a39a5ac38b2809ee4893c726707c0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 May 2023 14:03:44 +0200 +Subject: ARM: dts: imx6dl: prtrvt, prtvt7, prti6q, prtwd2: fix USB related + warnings + +From: Oleksij Rempel + +[ Upstream commit 1d14bd943fa2bbdfda1efbcc080b298fed5f1803 ] + +Fix USB-related warnings in prtrvt, prtvt7, prti6q and prtwd2 device trees +by disabling unused usbphynop1 and usbphynop2 USB PHYs and providing proper +configuration for the over-current detection. This fixes the following +warnings with the current kernel: + usb_phy_generic usbphynop1: dummy supplies not allowed for exclusive requests + usb_phy_generic usbphynop2: dummy supplies not allowed for exclusive requests + imx_usb 2184200.usb: No over current polarity defined + +By the way, fix over-current detection on usbotg port for prtvt7, prti6q +and prtwd2 boards. Only prtrvt do not have OC on USB OTG port. + +Signed-off-by: Oleksij Rempel +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/imx6dl-prtrvt.dts | 4 ++++ + arch/arm/boot/dts/imx6qdl-prti6q.dtsi | 11 ++++++++++- + 2 files changed, 14 insertions(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/imx6dl-prtrvt.dts b/arch/arm/boot/dts/imx6dl-prtrvt.dts +index 56bb1ca56a2df..36b031236e475 100644 +--- a/arch/arm/boot/dts/imx6dl-prtrvt.dts ++++ b/arch/arm/boot/dts/imx6dl-prtrvt.dts +@@ -124,6 +124,10 @@ &usbh1 { + status = "disabled"; + }; + ++&usbotg { ++ disable-over-current; ++}; ++ + &vpu { + status = "disabled"; + }; +diff --git a/arch/arm/boot/dts/imx6qdl-prti6q.dtsi b/arch/arm/boot/dts/imx6qdl-prti6q.dtsi +index f0db0d4471f40..36f84f4da6b0d 100644 +--- a/arch/arm/boot/dts/imx6qdl-prti6q.dtsi ++++ b/arch/arm/boot/dts/imx6qdl-prti6q.dtsi +@@ -69,6 +69,7 @@ &usbh1 { + vbus-supply = <®_usb_h1_vbus>; + phy_type = "utmi"; + dr_mode = "host"; ++ disable-over-current; + status = "okay"; + }; + +@@ -78,10 +79,18 @@ &usbotg { + pinctrl-0 = <&pinctrl_usbotg>; + phy_type = "utmi"; + dr_mode = "host"; +- disable-over-current; ++ over-current-active-low; + status = "okay"; + }; + ++&usbphynop1 { ++ status = "disabled"; ++}; ++ ++&usbphynop2 { ++ status = "disabled"; ++}; ++ + &usdhc1 { + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_usdhc1>; +-- +2.40.1 + diff --git a/queue-6.4/arm64-dts-qcom-ipq5332-add-qfprom-node.patch b/queue-6.4/arm64-dts-qcom-ipq5332-add-qfprom-node.patch new file mode 100644 index 00000000000..f923490c879 --- /dev/null +++ b/queue-6.4/arm64-dts-qcom-ipq5332-add-qfprom-node.patch @@ -0,0 +1,43 @@ +From cdfb221e43250c98aa3470699619403e667f0400 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 May 2023 18:23:03 +0530 +Subject: arm64: dts: qcom: ipq5332: add QFPROM node + +From: Kathiravan T + +[ Upstream commit 2f34a2aa4c88f4882e3c5df8c9b78f8bbd3f564f ] + +IPQ5332 has efuse region to determine the various HW quirks. Lets +add the initial support and the individual fuses will be added as they +are required. + +Reviewed-by: Konrad Dybcio +Signed-off-by: Kathiravan T +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230526125305.19626-3-quic_kathirav@quicinc.com +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/ipq5332.dtsi | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/arch/arm64/boot/dts/qcom/ipq5332.dtsi b/arch/arm64/boot/dts/qcom/ipq5332.dtsi +index af4d97143bcf5..c2d6cc65a323a 100644 +--- a/arch/arm64/boot/dts/qcom/ipq5332.dtsi ++++ b/arch/arm64/boot/dts/qcom/ipq5332.dtsi +@@ -135,6 +135,13 @@ soc@0 { + #size-cells = <1>; + ranges = <0 0 0 0xffffffff>; + ++ qfprom: efuse@a4000 { ++ compatible = "qcom,ipq5332-qfprom", "qcom,qfprom"; ++ reg = <0x000a4000 0x721>; ++ #address-cells = <1>; ++ #size-cells = <1>; ++ }; ++ + rng: rng@e3000 { + compatible = "qcom,prng-ee"; + reg = <0x000e3000 0x1000>; +-- +2.40.1 + diff --git a/queue-6.4/asoc-amd-vangogh-add-check-for-acp-config-flags-in-v.patch b/queue-6.4/asoc-amd-vangogh-add-check-for-acp-config-flags-in-v.patch new file mode 100644 index 00000000000..48bc2e5fa52 --- /dev/null +++ b/queue-6.4/asoc-amd-vangogh-add-check-for-acp-config-flags-in-v.patch @@ -0,0 +1,63 @@ +From 7df2a788c2df4eff1f4452b730089bcda8534bec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 May 2023 16:37:58 +0530 +Subject: ASoC: amd: vangogh: Add check for acp config flags in vangogh + platform + +From: Venkata Prasad Potturu + +[ Upstream commit e89f45edb747ed88e97a5771dd6d3dd1eb517873 ] + +We have SOF and generic ACP support enabled for Vangogh platform +on some machines. Since we have same PCI id used for probing, +add check for machine configuration flag to avoid conflict with +newer pci drivers. Such machine flag has been initialized via +dmi match on few Vangogh based machines. If no flag is +specified probe and register older platform device. + +Signed-off-by: Venkata Prasad Potturu +Link: https://lore.kernel.org/r/20230530110802.674939-1-venkataprasad.potturu@amd.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/amd/vangogh/acp5x.h | 2 ++ + sound/soc/amd/vangogh/pci-acp5x.c | 7 ++++++- + 2 files changed, 8 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/amd/vangogh/acp5x.h b/sound/soc/amd/vangogh/acp5x.h +index bd9f1c5684d17..ac1936a8c43ff 100644 +--- a/sound/soc/amd/vangogh/acp5x.h ++++ b/sound/soc/amd/vangogh/acp5x.h +@@ -147,6 +147,8 @@ static inline void acp_writel(u32 val, void __iomem *base_addr) + writel(val, base_addr - ACP5x_PHY_BASE_ADDRESS); + } + ++int snd_amd_acp_find_config(struct pci_dev *pci); ++ + static inline u64 acp_get_byte_count(struct i2s_stream_instance *rtd, + int direction) + { +diff --git a/sound/soc/amd/vangogh/pci-acp5x.c b/sound/soc/amd/vangogh/pci-acp5x.c +index e0df17c88e8e0..c4634a8a17cdc 100644 +--- a/sound/soc/amd/vangogh/pci-acp5x.c ++++ b/sound/soc/amd/vangogh/pci-acp5x.c +@@ -125,10 +125,15 @@ static int snd_acp5x_probe(struct pci_dev *pci, + { + struct acp5x_dev_data *adata; + struct platform_device_info pdevinfo[ACP5x_DEVS]; +- unsigned int irqflags; ++ unsigned int irqflags, flag; + int ret, i; + u32 addr, val; + ++ /* Return if acp config flag is defined */ ++ flag = snd_amd_acp_find_config(pci); ++ if (flag) ++ return -ENODEV; ++ + irqflags = IRQF_SHARED; + if (pci->revision != 0x50) + return -ENODEV; +-- +2.40.1 + diff --git a/queue-6.4/asoc-cs35l56-move-dsp-part-string-generation-so-that.patch b/queue-6.4/asoc-cs35l56-move-dsp-part-string-generation-so-that.patch new file mode 100644 index 00000000000..3b4a3927522 --- /dev/null +++ b/queue-6.4/asoc-cs35l56-move-dsp-part-string-generation-so-that.patch @@ -0,0 +1,60 @@ +From 7bdc5a7019094019e6e0a0040d146fb074f4635e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 May 2023 16:02:48 +0100 +Subject: ASoC: cs35l56: Move DSP part string generation so that it is done + only once + +From: Simon Trimmer + +[ Upstream commit 608f1b0dbddec6b2fd766c10bcce2b651995e936 ] + +Each time we go through dsp_work() it does a devm_kasprintf() to +allocate memory to hold the part name string. It's not strictly a memory +leak because devm will free it all if the driver is removed. But we keep +allocating more and more memory to hold the same string. + +Move the allocation so that it is performed after the version and +secured state information is gathered and handle allocation errors. + +Signed-off-by: Simon Trimmer +Signed-off-by: Richard Fitzgerald +Link: https://lore.kernel.org/r/Message-Id: <20230518150250.1121006-2-rf@opensource.cirrus.com> +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/cs35l56.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/sound/soc/codecs/cs35l56.c b/sound/soc/codecs/cs35l56.c +index e0d2b9bb23262..f3fee448d759e 100644 +--- a/sound/soc/codecs/cs35l56.c ++++ b/sound/soc/codecs/cs35l56.c +@@ -834,12 +834,6 @@ static void cs35l56_dsp_work(struct work_struct *work) + if (!cs35l56->init_done) + return; + +- cs35l56->dsp.part = devm_kasprintf(cs35l56->dev, GFP_KERNEL, "cs35l56%s-%02x", +- cs35l56->secured ? "s" : "", cs35l56->rev); +- +- if (!cs35l56->dsp.part) +- return; +- + pm_runtime_get_sync(cs35l56->dev); + + /* +@@ -1505,6 +1499,12 @@ int cs35l56_init(struct cs35l56_private *cs35l56) + dev_info(cs35l56->dev, "Cirrus Logic CS35L56%s Rev %02X OTP%d\n", + cs35l56->secured ? "s" : "", cs35l56->rev, otpid); + ++ /* Populate the DSP information with the revision and security state */ ++ cs35l56->dsp.part = devm_kasprintf(cs35l56->dev, GFP_KERNEL, "cs35l56%s-%02x", ++ cs35l56->secured ? "s" : "", cs35l56->rev); ++ if (!cs35l56->dsp.part) ++ return -ENOMEM; ++ + /* Wake source and *_BLOCKED interrupts default to unmasked, so mask them */ + regmap_write(cs35l56->regmap, CS35L56_IRQ1_MASK_20, 0xffffffff); + regmap_update_bits(cs35l56->regmap, CS35L56_IRQ1_MASK_1, +-- +2.40.1 + diff --git a/queue-6.4/asoc-intel-sof_sdw-add-quick-for-dell-sku-0bda.patch b/queue-6.4/asoc-intel-sof_sdw-add-quick-for-dell-sku-0bda.patch new file mode 100644 index 00000000000..1310bf9bc8d --- /dev/null +++ b/queue-6.4/asoc-intel-sof_sdw-add-quick-for-dell-sku-0bda.patch @@ -0,0 +1,47 @@ +From 21bf25280f5b639c6cb24bc515d6d80aee61bf8a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Jun 2023 15:22:13 -0500 +Subject: ASoC: Intel: sof_sdw: add quick for Dell SKU 0BDA + +From: Pierre-Louis Bossart + +[ Upstream commit 3daf02819ac3fd8d7605804a00213cf123ac880d ] + +The SKU numbering isn't quite consistent with the existing RaptorLake +SKUs but the PCI ID is definitively RaptorLake. + +Closes: https://github.com/thesofproject/linux/issues/4380 +Reviewed-by: Bard Liao +Reviewed-by: Ranjani Sridharan +Signed-off-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20230602202225.249209-17-pierre-louis.bossart@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/sof_sdw.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/sound/soc/intel/boards/sof_sdw.c b/sound/soc/intel/boards/sof_sdw.c +index 1a37f4cdc0ea7..b0b6a084837a7 100644 +--- a/sound/soc/intel/boards/sof_sdw.c ++++ b/sound/soc/intel/boards/sof_sdw.c +@@ -367,6 +367,16 @@ static const struct dmi_system_id sof_sdw_quirk_table[] = { + RT711_JD2), + }, + /* RaptorLake devices */ ++ { ++ .callback = sof_sdw_quirk_cb, ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "0BDA") ++ }, ++ .driver_data = (void *)(SOF_SDW_TGL_HDMI | ++ RT711_JD2 | ++ SOF_SDW_FOUR_SPK), ++ }, + { + .callback = sof_sdw_quirk_cb, + .matches = { +-- +2.40.1 + diff --git a/queue-6.4/asoc-intel-sof_sdw-add-quirk-for-lnl-rvp.patch b/queue-6.4/asoc-intel-sof_sdw-add-quirk-for-lnl-rvp.patch new file mode 100644 index 00000000000..999e162719b --- /dev/null +++ b/queue-6.4/asoc-intel-sof_sdw-add-quirk-for-lnl-rvp.patch @@ -0,0 +1,44 @@ +From 8d288389c97c174b313471fd62627bffbe524272 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 May 2023 12:33:05 -0500 +Subject: ASoC: Intel: sof_sdw: add quirk for LNL RVP + +From: Peter Ujfalusi + +[ Upstream commit dfe25fea968dc4884e12d471c8263f0f611b380a ] + +We should use RT711_JD2_100K for on board rt711 + +Signed-off-by: Peter Ujfalusi +--- + sound/soc/intel/boards/sof_sdw.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/sound/soc/intel/boards/sof_sdw.c b/sound/soc/intel/boards/sof_sdw.c +index 159fef20a30c8..1a37f4cdc0ea7 100644 +--- a/sound/soc/intel/boards/sof_sdw.c ++++ b/sound/soc/intel/boards/sof_sdw.c +@@ -423,6 +423,15 @@ static const struct dmi_system_id sof_sdw_quirk_table[] = { + }, + .driver_data = (void *)(RT711_JD2_100K), + }, ++ /* LunarLake devices */ ++ { ++ .callback = sof_sdw_quirk_cb, ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Intel Corporation"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Lunar Lake Client Platform"), ++ }, ++ .driver_data = (void *)(RT711_JD2_100K), ++ }, + {} + }; + +-- +2.40.1 + diff --git a/queue-6.4/asoc-intel-sof_sdw-add-quirk-for-mtl-rvp.patch b/queue-6.4/asoc-intel-sof_sdw-add-quirk-for-mtl-rvp.patch new file mode 100644 index 00000000000..edd80eb5ea5 --- /dev/null +++ b/queue-6.4/asoc-intel-sof_sdw-add-quirk-for-mtl-rvp.patch @@ -0,0 +1,43 @@ +From 5d27293200b5b1ae1089d67ae9c30d89e7beb775 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 May 2023 12:33:00 -0500 +Subject: ASoC: Intel: sof_sdw: add quirk for MTL RVP + +From: Bard Liao + +[ Upstream commit 289e1df00e49a229a1c924c059242e759a552f01 ] + +We should use RT711_JD2_100K for on board rt711. + +Signed-off-by: Bard Liao +--- + sound/soc/intel/boards/sof_sdw.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/sound/soc/intel/boards/sof_sdw.c b/sound/soc/intel/boards/sof_sdw.c +index 5fa204897a52b..159fef20a30c8 100644 +--- a/sound/soc/intel/boards/sof_sdw.c ++++ b/sound/soc/intel/boards/sof_sdw.c +@@ -415,6 +415,14 @@ static const struct dmi_system_id sof_sdw_quirk_table[] = { + }, + .driver_data = (void *)(RT711_JD1), + }, ++ { ++ .callback = sof_sdw_quirk_cb, ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Intel Corporation"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Meteor Lake Client Platform"), ++ }, ++ .driver_data = (void *)(RT711_JD2_100K), ++ }, + {} + }; + +-- +2.40.1 + diff --git a/queue-6.4/asoc-intel-sof_sdw-add-support-for-rex-soundwire.patch b/queue-6.4/asoc-intel-sof_sdw-add-support-for-rex-soundwire.patch new file mode 100644 index 00000000000..01563f4b87a --- /dev/null +++ b/queue-6.4/asoc-intel-sof_sdw-add-support-for-rex-soundwire.patch @@ -0,0 +1,45 @@ +From e25946f2bf5bccc467b39b7477b6af187263d78a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Jun 2023 15:22:24 -0500 +Subject: ASoC: Intel: sof_sdw: Add support for Rex soundwire + +From: Uday M Bhat + +[ Upstream commit 164e5dc17525181c05563f0a06796f1a363801d5 ] + +Add rex entry in the soundwire quirk table + +Reviewed-by: Ranjani Sridharan +Signed-off-by: Bard Liao +Signed-off-by: Yong Zhi +Signed-off-by: Uday M Bhat +Signed-off-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20230602202225.249209-28-pierre-louis.bossart@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/sof_sdw.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/sound/soc/intel/boards/sof_sdw.c b/sound/soc/intel/boards/sof_sdw.c +index b0b6a084837a7..a6d13aae8f720 100644 +--- a/sound/soc/intel/boards/sof_sdw.c ++++ b/sound/soc/intel/boards/sof_sdw.c +@@ -433,6 +433,14 @@ static const struct dmi_system_id sof_sdw_quirk_table[] = { + }, + .driver_data = (void *)(RT711_JD2_100K), + }, ++ { ++ .callback = sof_sdw_quirk_cb, ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Google"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Rex"), ++ }, ++ .driver_data = (void *)(SOF_SDW_PCH_DMIC), ++ }, + /* LunarLake devices */ + { + .callback = sof_sdw_quirk_cb, +-- +2.40.1 + diff --git a/queue-6.4/asoc-intel-sof_sdw_rt_sdca_jack_common-test-sof_jack.patch b/queue-6.4/asoc-intel-sof_sdw_rt_sdca_jack_common-test-sof_jack.patch new file mode 100644 index 00000000000..7d872dd2b62 --- /dev/null +++ b/queue-6.4/asoc-intel-sof_sdw_rt_sdca_jack_common-test-sof_jack.patch @@ -0,0 +1,42 @@ +From 8bc37092b7f3f88be71e9315fccd292dc47ba204 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Jun 2023 15:22:04 -0500 +Subject: ASoC: Intel: sof_sdw_rt_sdca_jack_common: test SOF_JACK_JDSRC in + _exit + +From: Bard Liao + +[ Upstream commit 526a1876fc48e2d0c0ea8ad63b58bdb2cc13047f ] + +if (!SOF_RT711_JDSRC(sof_sdw_quirk)) is tested in rt711_sdca_add_codec_ +device_props(), and we don't add software node to the device if jack +source is not set. We need to do the same test in +sof_sdw_rt711_sdca_exit(), and avoid removing software node if jack +source is not set. + +Signed-off-by: Bard Liao +Signed-off-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20230602202225.249209-8-pierre-louis.bossart@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/sof_sdw_rt711_sdca.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/sound/soc/intel/boards/sof_sdw_rt711_sdca.c b/sound/soc/intel/boards/sof_sdw_rt711_sdca.c +index 7f16304d025be..cf8b9793fe0e5 100644 +--- a/sound/soc/intel/boards/sof_sdw_rt711_sdca.c ++++ b/sound/soc/intel/boards/sof_sdw_rt711_sdca.c +@@ -143,6 +143,9 @@ int sof_sdw_rt711_sdca_exit(struct snd_soc_card *card, struct snd_soc_dai_link * + if (!ctx->headset_codec_dev) + return 0; + ++ if (!SOF_RT711_JDSRC(sof_sdw_quirk)) ++ return 0; ++ + device_remove_software_node(ctx->headset_codec_dev); + put_device(ctx->headset_codec_dev); + +-- +2.40.1 + diff --git a/queue-6.4/asoc-sof-amd-add-pci-revision-id-check.patch b/queue-6.4/asoc-sof-amd-add-pci-revision-id-check.patch new file mode 100644 index 00000000000..9bebc92cb7d --- /dev/null +++ b/queue-6.4/asoc-sof-amd-add-pci-revision-id-check.patch @@ -0,0 +1,66 @@ +From 9cea958ac5e696b4aaf340fdd14f86434d4c80d0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 May 2023 12:50:01 +0530 +Subject: ASoC: SOF: amd: Add pci revision id check + +From: Venkata Prasad Potturu + +[ Upstream commit 1d4a84632b90d88316986b05bcdfe715399a33db ] + +Add pci revision id check for renoir and rembrandt platforms. + +Signed-off-by: Venkata Prasad Potturu +Link: https://lore.kernel.org/r/20230523072009.2379198-1-venkataprasad.potturu@amd.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/amd/acp.h | 3 +++ + sound/soc/sof/amd/pci-rmb.c | 3 +++ + sound/soc/sof/amd/pci-rn.c | 3 +++ + 3 files changed, 9 insertions(+) + +diff --git a/sound/soc/sof/amd/acp.h b/sound/soc/sof/amd/acp.h +index 1c535cc6c3a95..dc624f727aa37 100644 +--- a/sound/soc/sof/amd/acp.h ++++ b/sound/soc/sof/amd/acp.h +@@ -55,6 +55,9 @@ + + #define ACP_DSP_TO_HOST_IRQ 0x04 + ++#define ACP_RN_PCI_ID 0x01 ++#define ACP_RMB_PCI_ID 0x6F ++ + #define HOST_BRIDGE_CZN 0x1630 + #define HOST_BRIDGE_RMB 0x14B5 + #define ACP_SHA_STAT 0x8000 +diff --git a/sound/soc/sof/amd/pci-rmb.c b/sound/soc/sof/amd/pci-rmb.c +index eaf70ea6e556e..58b3092425f1a 100644 +--- a/sound/soc/sof/amd/pci-rmb.c ++++ b/sound/soc/sof/amd/pci-rmb.c +@@ -65,6 +65,9 @@ static int acp_pci_rmb_probe(struct pci_dev *pci, const struct pci_device_id *pc + { + unsigned int flag; + ++ if (pci->revision != ACP_RMB_PCI_ID) ++ return -ENODEV; ++ + flag = snd_amd_acp_find_config(pci); + if (flag != FLAG_AMD_SOF && flag != FLAG_AMD_SOF_ONLY_DMIC) + return -ENODEV; +diff --git a/sound/soc/sof/amd/pci-rn.c b/sound/soc/sof/amd/pci-rn.c +index 4809cb644152b..7409e21ce5aa7 100644 +--- a/sound/soc/sof/amd/pci-rn.c ++++ b/sound/soc/sof/amd/pci-rn.c +@@ -65,6 +65,9 @@ static int acp_pci_rn_probe(struct pci_dev *pci, const struct pci_device_id *pci + { + unsigned int flag; + ++ if (pci->revision != ACP_RN_PCI_ID) ++ return -ENODEV; ++ + flag = snd_amd_acp_find_config(pci); + if (flag != FLAG_AMD_SOF && flag != FLAG_AMD_SOF_ONLY_DMIC) + return -ENODEV; +-- +2.40.1 + diff --git a/queue-6.4/asoc-sof-core-free-the-firmware-trace-before-calling.patch b/queue-6.4/asoc-sof-core-free-the-firmware-trace-before-calling.patch new file mode 100644 index 00000000000..aede4d522f3 --- /dev/null +++ b/queue-6.4/asoc-sof-core-free-the-firmware-trace-before-calling.patch @@ -0,0 +1,55 @@ +From 891652fb3423e11ea2cdcdc944268f3084fdcb3a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Jun 2023 12:00:34 +0200 +Subject: ASoC: SOF: core: Free the firmware trace before calling + snd_sof_shutdown() + +From: Peter Ujfalusi + +[ Upstream commit d389dcb3a48cec4f03c16434c0bf98a4c635372a ] + +The shutdown is called on reboot/shutdown of the machine. +At this point the firmware tracing cannot be used anymore but in case of +IPC3 it is using and keeping a DMA channel active (dtrace). + +For Tiger Lake platforms we have a quirk in place to fix rare reboot issues +when a DMA was active before rebooting the system. +If the tracing is enabled this quirk will be always used and a print +appears on the kernel log which might be misleading or not even correct. + +Release the fw tracing before executing the shutdown to make sure that this +known DMA user is cleared away. + +Reviewed-by: Kai Vehmanen +Reviewed-by: Daniel Baluta +Reviewed-by: Ranjani Sridharan +Reviewed-by: Rander Wang +Reviewed-by: Bard Liao +Signed-off-by: Peter Ujfalusi +Signed-off-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20230616100039.378150-4-pierre-louis.bossart@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/core.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/sof/core.c b/sound/soc/sof/core.c +index 9a9d82220fd0d..30db685cc5f4b 100644 +--- a/sound/soc/sof/core.c ++++ b/sound/soc/sof/core.c +@@ -504,8 +504,10 @@ int snd_sof_device_shutdown(struct device *dev) + if (IS_ENABLED(CONFIG_SND_SOC_SOF_PROBE_WORK_QUEUE)) + cancel_work_sync(&sdev->probe_work); + +- if (sdev->fw_state == SOF_FW_BOOT_COMPLETE) ++ if (sdev->fw_state == SOF_FW_BOOT_COMPLETE) { ++ sof_fw_trace_free(sdev); + return snd_sof_shutdown(sdev); ++ } + + return 0; + } +-- +2.40.1 + diff --git a/queue-6.4/asoc-sof-intel-fix-soundwire-hdaudio-mutual-exclusio.patch b/queue-6.4/asoc-sof-intel-fix-soundwire-hdaudio-mutual-exclusio.patch new file mode 100644 index 00000000000..cabc4f11216 --- /dev/null +++ b/queue-6.4/asoc-sof-intel-fix-soundwire-hdaudio-mutual-exclusio.patch @@ -0,0 +1,61 @@ +From 10ebff264005d4de71dc8334dbb862ab8ab4ecc7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Jun 2023 17:25:28 -0500 +Subject: ASoC: SOF: Intel: fix SoundWire/HDaudio mutual exclusion + +From: Pierre-Louis Bossart + +[ Upstream commit f751b99255cacd9ffe8c4bbf99767ad670cee1f7 ] + +The functionality described in Commit 61bef9e68dca ("ASoC: SOF: Intel: hda: enforce exclusion between HDaudio and SoundWire") +does not seem to be properly implemented with two issues that need to +be corrected. + +a) The test used is incorrect when DisplayAudio codecs are not supported. + +b) Conversely when only Display Audio codecs can be found, we do want +to start the SoundWire links, if any. That will help add the relevant +topologies and machine descriptors, and identify cases where the +SoundWire information in ACPI needs to be modified with a quirk. + +Signed-off-by: Pierre-Louis Bossart +Reviewed-by: Bard Liao +Reviewed-by: Ranjani Sridharan +Link: https://lore.kernel.org/r/20230606222529.57156-2-pierre-louis.bossart@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/intel/hda.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/sof/intel/hda.c b/sound/soc/sof/intel/hda.c +index 3153e21f100ab..3853582e32e12 100644 +--- a/sound/soc/sof/intel/hda.c ++++ b/sound/soc/sof/intel/hda.c +@@ -1343,12 +1343,22 @@ static void hda_generic_machine_select(struct snd_sof_dev *sdev, + hda_mach->mach_params.dmic_num = dmic_num; + pdata->tplg_filename = tplg_filename; + +- if (codec_num == 2) { ++ if (codec_num == 2 || ++ (codec_num == 1 && !HDA_IDISP_CODEC(bus->codec_mask))) { + /* + * Prevent SoundWire links from starting when an external + * HDaudio codec is used + */ + hda_mach->mach_params.link_mask = 0; ++ } else { ++ /* ++ * Allow SoundWire links to start when no external HDaudio codec ++ * was detected. This will not create a SoundWire card but ++ * will help detect if any SoundWire codec reports as ATTACHED. ++ */ ++ struct sof_intel_hda_dev *hdev = sdev->pdata->hw_pdata; ++ ++ hda_mach->mach_params.link_mask = hdev->info.link_mask; + } + + *mach = hda_mach; +-- +2.40.1 + diff --git a/queue-6.4/bluetooth-btusb-add-mt7922-bluetooth-id-for-the-asus.patch b/queue-6.4/bluetooth-btusb-add-mt7922-bluetooth-id-for-the-asus.patch new file mode 100644 index 00000000000..98bdee0556b --- /dev/null +++ b/queue-6.4/bluetooth-btusb-add-mt7922-bluetooth-id-for-the-asus.patch @@ -0,0 +1,37 @@ +From d809d2811bbba063d7cb24b67c608d30b62ea545 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 24 Jun 2023 12:08:10 -0500 +Subject: Bluetooth: btusb: Add MT7922 bluetooth ID for the Asus Ally + +From: Matthew Anderson + +[ Upstream commit fa01eba11f0e57c767a5eab5291c7a01407a00be ] + +Adding the device ID from the Asus Ally gets the bluetooth working +on the device. + +Signed-off-by: Matthew Anderson +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/btusb.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index 50e23762ec5e9..025e803ba55c2 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -613,6 +613,9 @@ static const struct usb_device_id blacklist_table[] = { + { USB_DEVICE(0x0489, 0xe0d9), .driver_info = BTUSB_MEDIATEK | + BTUSB_WIDEBAND_SPEECH | + BTUSB_VALID_LE_STATES }, ++ { USB_DEVICE(0x0489, 0xe0f5), .driver_info = BTUSB_MEDIATEK | ++ BTUSB_WIDEBAND_SPEECH | ++ BTUSB_VALID_LE_STATES }, + { USB_DEVICE(0x13d3, 0x3568), .driver_info = BTUSB_MEDIATEK | + BTUSB_WIDEBAND_SPEECH | + BTUSB_VALID_LE_STATES }, +-- +2.40.1 + diff --git a/queue-6.4/bluetooth-l2cap-fix-use-after-free.patch b/queue-6.4/bluetooth-l2cap-fix-use-after-free.patch new file mode 100644 index 00000000000..3512fae8cfe --- /dev/null +++ b/queue-6.4/bluetooth-l2cap-fix-use-after-free.patch @@ -0,0 +1,41 @@ +From e9a3a5563e69f456f9f2fa85295f726701cefde2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 May 2023 17:04:15 -0700 +Subject: Bluetooth: L2CAP: Fix use-after-free + +From: Zhengping Jiang + +[ Upstream commit f752a0b334bb95fe9b42ecb511e0864e2768046f ] + +Fix potential use-after-free in l2cap_le_command_rej. + +Signed-off-by: Zhengping Jiang +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/bluetooth/l2cap_core.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c +index c5e8798e297ca..17ca13e8c044c 100644 +--- a/net/bluetooth/l2cap_core.c ++++ b/net/bluetooth/l2cap_core.c +@@ -6374,9 +6374,14 @@ static inline int l2cap_le_command_rej(struct l2cap_conn *conn, + if (!chan) + goto done; + ++ chan = l2cap_chan_hold_unless_zero(chan); ++ if (!chan) ++ goto done; ++ + l2cap_chan_lock(chan); + l2cap_chan_del(chan, ECONNREFUSED); + l2cap_chan_unlock(chan); ++ l2cap_chan_put(chan); + + done: + mutex_unlock(&conn->chan_lock); +-- +2.40.1 + diff --git a/queue-6.4/bluetooth-mgmt-use-correct-address-for-memcpy.patch b/queue-6.4/bluetooth-mgmt-use-correct-address-for-memcpy.patch new file mode 100644 index 00000000000..300cc159bd7 --- /dev/null +++ b/queue-6.4/bluetooth-mgmt-use-correct-address-for-memcpy.patch @@ -0,0 +1,47 @@ +From a28f9f27602774acb1e607f11f9fb6b60c1e04aa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Jul 2023 12:32:14 +0300 +Subject: Bluetooth: MGMT: Use correct address for memcpy() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Andy Shevchenko + +[ Upstream commit d1f0a9816f5fbc1316355ec1aa4ddfb9b624cca5 ] + +In function ‘fortify_memcpy_chk’, + inlined from ‘get_conn_info_complete’ at net/bluetooth/mgmt.c:7281:2: +include/linux/fortify-string.h:592:25: error: call to +‘__read_overflow2_field’ declared with attribute warning: detected read +beyond size of field (2nd parameter); maybe use struct_group()? +[-Werror=attribute-warning] + 592 | __read_overflow2_field(q_size_field, size); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +cc1: all warnings being treated as errors + +This is due to the wrong member is used for memcpy(). Use correct one. + +Signed-off-by: Andy Shevchenko +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + net/bluetooth/mgmt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c +index 1e07d0f289723..d4498037fadc6 100644 +--- a/net/bluetooth/mgmt.c ++++ b/net/bluetooth/mgmt.c +@@ -7285,7 +7285,7 @@ static void get_conn_info_complete(struct hci_dev *hdev, void *data, int err) + + bt_dev_dbg(hdev, "err %d", err); + +- memcpy(&rp.addr, &cp->addr.bdaddr, sizeof(rp.addr)); ++ memcpy(&rp.addr, &cp->addr, sizeof(rp.addr)); + + status = mgmt_status(err); + if (status == MGMT_STATUS_SUCCESS) { +-- +2.40.1 + diff --git a/queue-6.4/btrfs-fix-use-after-free-of-new-block-group-that-bec.patch b/queue-6.4/btrfs-fix-use-after-free-of-new-block-group-that-bec.patch new file mode 100644 index 00000000000..527da34d862 --- /dev/null +++ b/queue-6.4/btrfs-fix-use-after-free-of-new-block-group-that-bec.patch @@ -0,0 +1,173 @@ +From c784533ec09f759df66cd89d33eca7ad0bab04ea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Jun 2023 17:13:37 +0100 +Subject: btrfs: fix use-after-free of new block group that became unused + +From: Filipe Manana + +[ Upstream commit 0657b20c5a76c938612f8409735a8830d257866e ] + +If a task creates a new block group and that block group becomes unused +before we finish its creation, at btrfs_create_pending_block_groups(), +then when btrfs_mark_bg_unused() is called against the block group, we +assume that the block group is currently in the list of block groups to +reclaim, and we move it out of the list of new block groups and into the +list of unused block groups. This has two consequences: + +1) We move it out of the list of new block groups associated to the + current transaction. So the block group creation is not finished and + if we attempt to delete the bg because it's unused, we will not find + the block group item in the extent tree (or the new block group tree), + its device extent items in the device tree etc, resulting in the + deletion to fail due to the missing items; + +2) We don't increment the reference count on the block group when we + move it to the list of unused block groups, because we assumed the + block group was on the list of block groups to reclaim, and in that + case it already has the correct reference count. However the block + group was on the list of new block groups, in which case no extra + reference was taken because it's local to the current task. This + later results in doing an extra reference count decrement when + removing the block group from the unused list, eventually leading the + reference count to 0. + +This second case was caught when running generic/297 from fstests, which +produced the following assertion failure and stack trace: + + [589.559] assertion failed: refcount_read(&block_group->refs) == 1, in fs/btrfs/block-group.c:4299 + [589.559] ------------[ cut here ]------------ + [589.559] kernel BUG at fs/btrfs/block-group.c:4299! + [589.560] invalid opcode: 0000 [#1] PREEMPT SMP PTI + [589.560] CPU: 8 PID: 2819134 Comm: umount Tainted: G W 6.4.0-rc6-btrfs-next-134+ #1 + [589.560] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-0-gea1b7a073390-prebuilt.qemu.org 04/01/2014 + [589.560] RIP: 0010:btrfs_free_block_groups+0x449/0x4a0 [btrfs] + [589.561] Code: 68 62 da c0 (...) + [589.561] RSP: 0018:ffffa55a8c3b3d98 EFLAGS: 00010246 + [589.561] RAX: 0000000000000058 RBX: ffff8f030d7f2000 RCX: 0000000000000000 + [589.562] RDX: 0000000000000000 RSI: ffffffff953f0878 RDI: 00000000ffffffff + [589.562] RBP: ffff8f030d7f2088 R08: 0000000000000000 R09: ffffa55a8c3b3c50 + [589.562] R10: 0000000000000001 R11: 0000000000000001 R12: ffff8f05850b4c00 + [589.562] R13: ffff8f030d7f2090 R14: ffff8f05850b4cd8 R15: dead000000000100 + [589.563] FS: 00007f497fd2e840(0000) GS:ffff8f09dfc00000(0000) knlGS:0000000000000000 + [589.563] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + [589.563] CR2: 00007f497ff8ec10 CR3: 0000000271472006 CR4: 0000000000370ee0 + [589.563] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 + [589.564] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 + [589.564] Call Trace: + [589.564] + [589.565] ? __die_body+0x1b/0x60 + [589.565] ? die+0x39/0x60 + [589.565] ? do_trap+0xeb/0x110 + [589.565] ? btrfs_free_block_groups+0x449/0x4a0 [btrfs] + [589.566] ? do_error_trap+0x6a/0x90 + [589.566] ? btrfs_free_block_groups+0x449/0x4a0 [btrfs] + [589.566] ? exc_invalid_op+0x4e/0x70 + [589.566] ? btrfs_free_block_groups+0x449/0x4a0 [btrfs] + [589.567] ? asm_exc_invalid_op+0x16/0x20 + [589.567] ? btrfs_free_block_groups+0x449/0x4a0 [btrfs] + [589.567] ? btrfs_free_block_groups+0x449/0x4a0 [btrfs] + [589.567] close_ctree+0x35d/0x560 [btrfs] + [589.568] ? fsnotify_sb_delete+0x13e/0x1d0 + [589.568] ? dispose_list+0x3a/0x50 + [589.568] ? evict_inodes+0x151/0x1a0 + [589.568] generic_shutdown_super+0x73/0x1a0 + [589.569] kill_anon_super+0x14/0x30 + [589.569] btrfs_kill_super+0x12/0x20 [btrfs] + [589.569] deactivate_locked_super+0x2e/0x70 + [589.569] cleanup_mnt+0x104/0x160 + [589.570] task_work_run+0x56/0x90 + [589.570] exit_to_user_mode_prepare+0x160/0x170 + [589.570] syscall_exit_to_user_mode+0x22/0x50 + [589.570] ? __x64_sys_umount+0x12/0x20 + [589.571] do_syscall_64+0x48/0x90 + [589.571] entry_SYSCALL_64_after_hwframe+0x72/0xdc + [589.571] RIP: 0033:0x7f497ff0a567 + [589.571] Code: af 98 0e (...) + [589.572] RSP: 002b:00007ffc98347358 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 + [589.572] RAX: 0000000000000000 RBX: 00007f49800b8264 RCX: 00007f497ff0a567 + [589.572] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000557f558abfa0 + [589.573] RBP: 0000557f558a6ba0 R08: 0000000000000000 R09: 00007ffc98346100 + [589.573] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 + [589.573] R13: 0000557f558abfa0 R14: 0000557f558a6cb0 R15: 0000557f558a6dd0 + [589.573] + [589.574] Modules linked in: dm_snapshot dm_thin_pool (...) + [589.576] ---[ end trace 0000000000000000 ]--- + +Fix this by adding a runtime flag to the block group to tell that the +block group is still in the list of new block groups, and therefore it +should not be moved to the list of unused block groups, at +btrfs_mark_bg_unused(), until the flag is cleared, when we finish the +creation of the block group at btrfs_create_pending_block_groups(). + +Fixes: a9f189716cf1 ("btrfs: move out now unused BG from the reclaim list") +CC: stable@vger.kernel.org # 5.15+ +Signed-off-by: Filipe Manana +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/block-group.c | 13 +++++++++++-- + fs/btrfs/block-group.h | 5 +++++ + 2 files changed, 16 insertions(+), 2 deletions(-) + +diff --git a/fs/btrfs/block-group.c b/fs/btrfs/block-group.c +index 78d57f1efe1d0..a250afa655d5c 100644 +--- a/fs/btrfs/block-group.c ++++ b/fs/btrfs/block-group.c +@@ -1665,13 +1665,14 @@ void btrfs_mark_bg_unused(struct btrfs_block_group *bg) + { + struct btrfs_fs_info *fs_info = bg->fs_info; + +- trace_btrfs_add_unused_block_group(bg); + spin_lock(&fs_info->unused_bgs_lock); + if (list_empty(&bg->bg_list)) { + btrfs_get_block_group(bg); ++ trace_btrfs_add_unused_block_group(bg); + list_add_tail(&bg->bg_list, &fs_info->unused_bgs); +- } else { ++ } else if (!test_bit(BLOCK_GROUP_FLAG_NEW, &bg->runtime_flags)) { + /* Pull out the block group from the reclaim_bgs list. */ ++ trace_btrfs_add_unused_block_group(bg); + list_move_tail(&bg->bg_list, &fs_info->unused_bgs); + } + spin_unlock(&fs_info->unused_bgs_lock); +@@ -2696,6 +2697,7 @@ void btrfs_create_pending_block_groups(struct btrfs_trans_handle *trans) + next: + btrfs_delayed_refs_rsv_release(fs_info, 1); + list_del_init(&block_group->bg_list); ++ clear_bit(BLOCK_GROUP_FLAG_NEW, &block_group->runtime_flags); + } + btrfs_trans_release_chunk_metadata(trans); + } +@@ -2735,6 +2737,13 @@ struct btrfs_block_group *btrfs_make_block_group(struct btrfs_trans_handle *tran + if (!cache) + return ERR_PTR(-ENOMEM); + ++ /* ++ * Mark it as new before adding it to the rbtree of block groups or any ++ * list, so that no other task finds it and calls btrfs_mark_bg_unused() ++ * before the new flag is set. ++ */ ++ set_bit(BLOCK_GROUP_FLAG_NEW, &cache->runtime_flags); ++ + cache->length = size; + set_free_space_tree_thresholds(cache); + cache->flags = type; +diff --git a/fs/btrfs/block-group.h b/fs/btrfs/block-group.h +index 471f591db7c0c..0852f6c101f82 100644 +--- a/fs/btrfs/block-group.h ++++ b/fs/btrfs/block-group.h +@@ -70,6 +70,11 @@ enum btrfs_block_group_flags { + BLOCK_GROUP_FLAG_NEEDS_FREE_SPACE, + /* Indicate that the block group is placed on a sequential zone */ + BLOCK_GROUP_FLAG_SEQUENTIAL_ZONE, ++ /* ++ * Indicate that block group is in the list of new block groups of a ++ * transaction. ++ */ ++ BLOCK_GROUP_FLAG_NEW, + }; + + enum btrfs_caching_type { +-- +2.40.1 + diff --git a/queue-6.4/btrfs-move-out-now-unused-bg-from-the-reclaim-list.patch b/queue-6.4/btrfs-move-out-now-unused-bg-from-the-reclaim-list.patch new file mode 100644 index 00000000000..b7f9eef4163 --- /dev/null +++ b/queue-6.4/btrfs-move-out-now-unused-bg-from-the-reclaim-list.patch @@ -0,0 +1,52 @@ +From e72c4956eedf6f4788fe79823670603226f55651 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Jun 2023 14:36:34 +0900 +Subject: btrfs: move out now unused BG from the reclaim list + +From: Naohiro Aota + +[ Upstream commit a9f189716cf15913c453299d72f69c51a9b0f86b ] + +An unused block group is easy to remove to free up space and should be +reclaimed fast. Such block group can often already be a target of the +reclaim process. As we check list_empty(&bg->bg_list), we keep it in the +reclaim list. That block group is never reclaimed until the file system +is filled e.g. up to 75%. + +Instead, we can move unused block group to the unused list and delete it +fast. + +Fixes: 18bb8bbf13c1 ("btrfs: zoned: automatically reclaim zones") +CC: stable@vger.kernel.org # 5.15+ +Reviewed-by: Filipe Manana +Reviewed-by: Johannes Thumshirn +Signed-off-by: Naohiro Aota +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/block-group.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/fs/btrfs/block-group.c b/fs/btrfs/block-group.c +index 2a60033d907bf..78d57f1efe1d0 100644 +--- a/fs/btrfs/block-group.c ++++ b/fs/btrfs/block-group.c +@@ -1665,11 +1665,14 @@ void btrfs_mark_bg_unused(struct btrfs_block_group *bg) + { + struct btrfs_fs_info *fs_info = bg->fs_info; + ++ trace_btrfs_add_unused_block_group(bg); + spin_lock(&fs_info->unused_bgs_lock); + if (list_empty(&bg->bg_list)) { + btrfs_get_block_group(bg); +- trace_btrfs_add_unused_block_group(bg); + list_add_tail(&bg->bg_list, &fs_info->unused_bgs); ++ } else { ++ /* Pull out the block group from the reclaim_bgs list. */ ++ list_move_tail(&bg->bg_list, &fs_info->unused_bgs); + } + spin_unlock(&fs_info->unused_bgs_lock); + } +-- +2.40.1 + diff --git a/queue-6.4/can-raw-fix-lockdep-issue-in-raw_release.patch b/queue-6.4/can-raw-fix-lockdep-issue-in-raw_release.patch new file mode 100644 index 00000000000..fc0a4c04528 --- /dev/null +++ b/queue-6.4/can-raw-fix-lockdep-issue-in-raw_release.patch @@ -0,0 +1,159 @@ +From e20eca62d5271222be770e64b7b19c512a2a2d86 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jul 2023 11:44:38 +0000 +Subject: can: raw: fix lockdep issue in raw_release() + +From: Eric Dumazet + +[ Upstream commit 11c9027c983e9e4b408ee5613b6504d24ebd85be ] + +syzbot complained about a lockdep issue [1] + +Since raw_bind() and raw_setsockopt() first get RTNL +before locking the socket, we must adopt the same order in raw_release() + +[1] +WARNING: possible circular locking dependency detected +6.5.0-rc1-syzkaller-00192-g78adb4bcf99e #0 Not tainted +------------------------------------------------------ +syz-executor.0/14110 is trying to acquire lock: +ffff88804e4b6130 (sk_lock-AF_CAN){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1708 [inline] +ffff88804e4b6130 (sk_lock-AF_CAN){+.+.}-{0:0}, at: raw_bind+0xb1/0xab0 net/can/raw.c:435 + +but task is already holding lock: +ffffffff8e3df368 (rtnl_mutex){+.+.}-{3:3}, at: raw_bind+0xa7/0xab0 net/can/raw.c:434 + +which lock already depends on the new lock. + +the existing dependency chain (in reverse order) is: + +-> #1 (rtnl_mutex){+.+.}-{3:3}: +__mutex_lock_common kernel/locking/mutex.c:603 [inline] +__mutex_lock+0x181/0x1340 kernel/locking/mutex.c:747 +raw_release+0x1c6/0x9b0 net/can/raw.c:391 +__sock_release+0xcd/0x290 net/socket.c:654 +sock_close+0x1c/0x20 net/socket.c:1386 +__fput+0x3fd/0xac0 fs/file_table.c:384 +task_work_run+0x14d/0x240 kernel/task_work.c:179 +resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] +exit_to_user_mode_loop kernel/entry/common.c:171 [inline] +exit_to_user_mode_prepare+0x210/0x240 kernel/entry/common.c:204 +__syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline] +syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:297 +do_syscall_64+0x44/0xb0 arch/x86/entry/common.c:86 +entry_SYSCALL_64_after_hwframe+0x63/0xcd + +-> #0 (sk_lock-AF_CAN){+.+.}-{0:0}: +check_prev_add kernel/locking/lockdep.c:3142 [inline] +check_prevs_add kernel/locking/lockdep.c:3261 [inline] +validate_chain kernel/locking/lockdep.c:3876 [inline] +__lock_acquire+0x2e3d/0x5de0 kernel/locking/lockdep.c:5144 +lock_acquire kernel/locking/lockdep.c:5761 [inline] +lock_acquire+0x1ae/0x510 kernel/locking/lockdep.c:5726 +lock_sock_nested+0x3a/0xf0 net/core/sock.c:3492 +lock_sock include/net/sock.h:1708 [inline] +raw_bind+0xb1/0xab0 net/can/raw.c:435 +__sys_bind+0x1ec/0x220 net/socket.c:1792 +__do_sys_bind net/socket.c:1803 [inline] +__se_sys_bind net/socket.c:1801 [inline] +__x64_sys_bind+0x72/0xb0 net/socket.c:1801 +do_syscall_x64 arch/x86/entry/common.c:50 [inline] +do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80 +entry_SYSCALL_64_after_hwframe+0x63/0xcd + +other info that might help us debug this: + +Possible unsafe locking scenario: + +CPU0 CPU1 +---- ---- +lock(rtnl_mutex); + lock(sk_lock-AF_CAN); + lock(rtnl_mutex); +lock(sk_lock-AF_CAN); + +*** DEADLOCK *** + +1 lock held by syz-executor.0/14110: + +stack backtrace: +CPU: 0 PID: 14110 Comm: syz-executor.0 Not tainted 6.5.0-rc1-syzkaller-00192-g78adb4bcf99e #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/03/2023 +Call Trace: + +__dump_stack lib/dump_stack.c:88 [inline] +dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106 +check_noncircular+0x311/0x3f0 kernel/locking/lockdep.c:2195 +check_prev_add kernel/locking/lockdep.c:3142 [inline] +check_prevs_add kernel/locking/lockdep.c:3261 [inline] +validate_chain kernel/locking/lockdep.c:3876 [inline] +__lock_acquire+0x2e3d/0x5de0 kernel/locking/lockdep.c:5144 +lock_acquire kernel/locking/lockdep.c:5761 [inline] +lock_acquire+0x1ae/0x510 kernel/locking/lockdep.c:5726 +lock_sock_nested+0x3a/0xf0 net/core/sock.c:3492 +lock_sock include/net/sock.h:1708 [inline] +raw_bind+0xb1/0xab0 net/can/raw.c:435 +__sys_bind+0x1ec/0x220 net/socket.c:1792 +__do_sys_bind net/socket.c:1803 [inline] +__se_sys_bind net/socket.c:1801 [inline] +__x64_sys_bind+0x72/0xb0 net/socket.c:1801 +do_syscall_x64 arch/x86/entry/common.c:50 [inline] +do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80 +entry_SYSCALL_64_after_hwframe+0x63/0xcd +RIP: 0033:0x7fd89007cb29 +Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 +RSP: 002b:00007fd890d2a0c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000031 +RAX: ffffffffffffffda RBX: 00007fd89019bf80 RCX: 00007fd89007cb29 +RDX: 0000000000000010 RSI: 0000000020000040 RDI: 0000000000000003 +RBP: 00007fd8900c847a R08: 0000000000000000 R09: 0000000000000000 +R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 +R13: 000000000000000b R14: 00007fd89019bf80 R15: 00007ffebf8124f8 + + +Fixes: ee8b94c8510c ("can: raw: fix receiver memory leak") +Reported-by: syzbot +Signed-off-by: Eric Dumazet +Cc: Ziyang Xuan +Cc: Oliver Hartkopp +Cc: stable@vger.kernel.org +Cc: Marc Kleine-Budde +Link: https://lore.kernel.org/all/20230720114438.172434-1-edumazet@google.com +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + net/can/raw.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/net/can/raw.c b/net/can/raw.c +index 9fdad12d16325..9fbbf6e00287f 100644 +--- a/net/can/raw.c ++++ b/net/can/raw.c +@@ -386,9 +386,9 @@ static int raw_release(struct socket *sock) + list_del(&ro->notifier); + spin_unlock(&raw_notifier_lock); + ++ rtnl_lock(); + lock_sock(sk); + +- rtnl_lock(); + /* remove current filters & unregister */ + if (ro->bound) { + if (ro->dev) +@@ -405,12 +405,13 @@ static int raw_release(struct socket *sock) + ro->dev = NULL; + ro->count = 0; + free_percpu(ro->uniq); +- rtnl_unlock(); + + sock_orphan(sk); + sock->sk = NULL; + + release_sock(sk); ++ rtnl_unlock(); ++ + sock_put(sk); + + return 0; +-- +2.40.1 + diff --git a/queue-6.4/can-raw-fix-receiver-memory-leak.patch b/queue-6.4/can-raw-fix-receiver-memory-leak.patch new file mode 100644 index 00000000000..448317aceb6 --- /dev/null +++ b/queue-6.4/can-raw-fix-receiver-memory-leak.patch @@ -0,0 +1,238 @@ +From c2456f5b8df8441191e1c596d4933b71425b6ac4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Jul 2023 09:17:37 +0800 +Subject: can: raw: fix receiver memory leak + +From: Ziyang Xuan + +[ Upstream commit ee8b94c8510ce64afe0b87ef548d23e00915fb10 ] + +Got kmemleak errors with the following ltp can_filter testcase: + +for ((i=1; i<=100; i++)) +do + ./can_filter & + sleep 0.1 +done + +============================================================== +[<00000000db4a4943>] can_rx_register+0x147/0x360 [can] +[<00000000a289549d>] raw_setsockopt+0x5ef/0x853 [can_raw] +[<000000006d3d9ebd>] __sys_setsockopt+0x173/0x2c0 +[<00000000407dbfec>] __x64_sys_setsockopt+0x61/0x70 +[<00000000fd468496>] do_syscall_64+0x33/0x40 +[<00000000b7e47d51>] entry_SYSCALL_64_after_hwframe+0x61/0xc6 + +It's a bug in the concurrent scenario of unregister_netdevice_many() +and raw_release() as following: + + cpu0 cpu1 +unregister_netdevice_many(can_dev) + unlist_netdevice(can_dev) // dev_get_by_index() return NULL after this + net_set_todo(can_dev) + raw_release(can_socket) + dev = dev_get_by_index(, ro->ifindex); // dev == NULL + if (dev) { // receivers in dev_rcv_lists not free because dev is NULL + raw_disable_allfilters(, dev, ); + dev_put(dev); + } + ... + ro->bound = 0; + ... + +call_netdevice_notifiers(NETDEV_UNREGISTER, ) + raw_notify(, NETDEV_UNREGISTER, ) + if (ro->bound) // invalid because ro->bound has been set 0 + raw_disable_allfilters(, dev, ); // receivers in dev_rcv_lists will never be freed + +Add a net_device pointer member in struct raw_sock to record bound +can_dev, and use rtnl_lock to serialize raw_socket members between +raw_bind(), raw_release(), raw_setsockopt() and raw_notify(). Use +ro->dev to decide whether to free receivers in dev_rcv_lists. + +Fixes: 8d0caedb7596 ("can: bcm/raw/isotp: use per module netdevice notifier") +Reviewed-by: Oliver Hartkopp +Acked-by: Oliver Hartkopp +Signed-off-by: Ziyang Xuan +Link: https://lore.kernel.org/all/20230711011737.1969582-1-william.xuanziyang@huawei.com +Cc: stable@vger.kernel.org +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + net/can/raw.c | 57 ++++++++++++++++++++++----------------------------- + 1 file changed, 24 insertions(+), 33 deletions(-) + +diff --git a/net/can/raw.c b/net/can/raw.c +index f8e3866157a33..9fdad12d16325 100644 +--- a/net/can/raw.c ++++ b/net/can/raw.c +@@ -84,6 +84,7 @@ struct raw_sock { + struct sock sk; + int bound; + int ifindex; ++ struct net_device *dev; + struct list_head notifier; + int loopback; + int recv_own_msgs; +@@ -277,7 +278,7 @@ static void raw_notify(struct raw_sock *ro, unsigned long msg, + if (!net_eq(dev_net(dev), sock_net(sk))) + return; + +- if (ro->ifindex != dev->ifindex) ++ if (ro->dev != dev) + return; + + switch (msg) { +@@ -292,6 +293,7 @@ static void raw_notify(struct raw_sock *ro, unsigned long msg, + + ro->ifindex = 0; + ro->bound = 0; ++ ro->dev = NULL; + ro->count = 0; + release_sock(sk); + +@@ -337,6 +339,7 @@ static int raw_init(struct sock *sk) + + ro->bound = 0; + ro->ifindex = 0; ++ ro->dev = NULL; + + /* set default filter to single entry dfilter */ + ro->dfilter.can_id = 0; +@@ -385,19 +388,13 @@ static int raw_release(struct socket *sock) + + lock_sock(sk); + ++ rtnl_lock(); + /* remove current filters & unregister */ + if (ro->bound) { +- if (ro->ifindex) { +- struct net_device *dev; +- +- dev = dev_get_by_index(sock_net(sk), ro->ifindex); +- if (dev) { +- raw_disable_allfilters(dev_net(dev), dev, sk); +- dev_put(dev); +- } +- } else { ++ if (ro->dev) ++ raw_disable_allfilters(dev_net(ro->dev), ro->dev, sk); ++ else + raw_disable_allfilters(sock_net(sk), NULL, sk); +- } + } + + if (ro->count > 1) +@@ -405,8 +402,10 @@ static int raw_release(struct socket *sock) + + ro->ifindex = 0; + ro->bound = 0; ++ ro->dev = NULL; + ro->count = 0; + free_percpu(ro->uniq); ++ rtnl_unlock(); + + sock_orphan(sk); + sock->sk = NULL; +@@ -422,6 +421,7 @@ static int raw_bind(struct socket *sock, struct sockaddr *uaddr, int len) + struct sockaddr_can *addr = (struct sockaddr_can *)uaddr; + struct sock *sk = sock->sk; + struct raw_sock *ro = raw_sk(sk); ++ struct net_device *dev = NULL; + int ifindex; + int err = 0; + int notify_enetdown = 0; +@@ -431,14 +431,13 @@ static int raw_bind(struct socket *sock, struct sockaddr *uaddr, int len) + if (addr->can_family != AF_CAN) + return -EINVAL; + ++ rtnl_lock(); + lock_sock(sk); + + if (ro->bound && addr->can_ifindex == ro->ifindex) + goto out; + + if (addr->can_ifindex) { +- struct net_device *dev; +- + dev = dev_get_by_index(sock_net(sk), addr->can_ifindex); + if (!dev) { + err = -ENODEV; +@@ -467,26 +466,20 @@ static int raw_bind(struct socket *sock, struct sockaddr *uaddr, int len) + if (!err) { + if (ro->bound) { + /* unregister old filters */ +- if (ro->ifindex) { +- struct net_device *dev; +- +- dev = dev_get_by_index(sock_net(sk), +- ro->ifindex); +- if (dev) { +- raw_disable_allfilters(dev_net(dev), +- dev, sk); +- dev_put(dev); +- } +- } else { ++ if (ro->dev) ++ raw_disable_allfilters(dev_net(ro->dev), ++ ro->dev, sk); ++ else + raw_disable_allfilters(sock_net(sk), NULL, sk); +- } + } + ro->ifindex = ifindex; + ro->bound = 1; ++ ro->dev = dev; + } + + out: + release_sock(sk); ++ rtnl_unlock(); + + if (notify_enetdown) { + sk->sk_err = ENETDOWN; +@@ -553,9 +546,9 @@ static int raw_setsockopt(struct socket *sock, int level, int optname, + rtnl_lock(); + lock_sock(sk); + +- if (ro->bound && ro->ifindex) { +- dev = dev_get_by_index(sock_net(sk), ro->ifindex); +- if (!dev) { ++ dev = ro->dev; ++ if (ro->bound && dev) { ++ if (dev->reg_state != NETREG_REGISTERED) { + if (count > 1) + kfree(filter); + err = -ENODEV; +@@ -596,7 +589,6 @@ static int raw_setsockopt(struct socket *sock, int level, int optname, + ro->count = count; + + out_fil: +- dev_put(dev); + release_sock(sk); + rtnl_unlock(); + +@@ -614,9 +606,9 @@ static int raw_setsockopt(struct socket *sock, int level, int optname, + rtnl_lock(); + lock_sock(sk); + +- if (ro->bound && ro->ifindex) { +- dev = dev_get_by_index(sock_net(sk), ro->ifindex); +- if (!dev) { ++ dev = ro->dev; ++ if (ro->bound && dev) { ++ if (dev->reg_state != NETREG_REGISTERED) { + err = -ENODEV; + goto out_err; + } +@@ -640,7 +632,6 @@ static int raw_setsockopt(struct socket *sock, int level, int optname, + ro->err_mask = err_mask; + + out_err: +- dev_put(dev); + release_sock(sk); + rtnl_unlock(); + +-- +2.40.1 + diff --git a/queue-6.4/ceph-try-to-dump-the-msgs-when-decoding-fails.patch b/queue-6.4/ceph-try-to-dump-the-msgs-when-decoding-fails.patch new file mode 100644 index 00000000000..bc5c2057c07 --- /dev/null +++ b/queue-6.4/ceph-try-to-dump-the-msgs-when-decoding-fails.patch @@ -0,0 +1,59 @@ +From 41d4ae930fd2b240e822205ba3ad06c9c7d4c6f3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 May 2023 09:40:14 +0800 +Subject: ceph: try to dump the msgs when decoding fails + +From: Xiubo Li + +[ Upstream commit 8b0da5c549ae63ba1debd92a350f90773cb4bfe7 ] + +When the msgs are corrupted we need to dump them and then it will +be easier to dig what has happened and where the issue is. + +Signed-off-by: Xiubo Li +Reviewed-by: Milind Changire +Signed-off-by: Ilya Dryomov +Signed-off-by: Sasha Levin +--- + fs/ceph/mds_client.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c +index 83c4abff496da..5fb367b1d4b06 100644 +--- a/fs/ceph/mds_client.c ++++ b/fs/ceph/mds_client.c +@@ -645,6 +645,7 @@ static int parse_reply_info(struct ceph_mds_session *s, struct ceph_msg *msg, + err = -EIO; + out_bad: + pr_err("mds parse_reply err %d\n", err); ++ ceph_msg_dump(msg); + return err; + } + +@@ -3538,6 +3539,7 @@ static void handle_forward(struct ceph_mds_client *mdsc, + + bad: + pr_err("mdsc_handle_forward decode error err=%d\n", err); ++ ceph_msg_dump(msg); + } + + static int __decode_session_metadata(void **p, void *end, +@@ -5258,6 +5260,7 @@ void ceph_mdsc_handle_fsmap(struct ceph_mds_client *mdsc, struct ceph_msg *msg) + bad: + pr_err("error decoding fsmap %d. Shutting down mount.\n", err); + ceph_umount_begin(mdsc->fsc->sb); ++ ceph_msg_dump(msg); + err_out: + mutex_lock(&mdsc->mutex); + mdsc->mdsmap_err = err; +@@ -5326,6 +5329,7 @@ void ceph_mdsc_handle_mdsmap(struct ceph_mds_client *mdsc, struct ceph_msg *msg) + bad: + pr_err("error decoding mdsmap %d. Shutting down mount.\n", err); + ceph_umount_begin(mdsc->fsc->sb); ++ ceph_msg_dump(msg); + return; + } + +-- +2.40.1 + diff --git a/queue-6.4/cifs-fix-session-state-check-in-reconnect-to-avoid-u.patch b/queue-6.4/cifs-fix-session-state-check-in-reconnect-to-avoid-u.patch new file mode 100644 index 00000000000..c1c641e73b1 --- /dev/null +++ b/queue-6.4/cifs-fix-session-state-check-in-reconnect-to-avoid-u.patch @@ -0,0 +1,45 @@ +From b90ab7a1b09367d279343de4a49c698a3b6731e6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Jun 2023 11:42:56 +0800 +Subject: cifs: fix session state check in reconnect to avoid use-after-free + issue + +From: Winston Wen + +[ Upstream commit 99f280700b4cc02d5f141b8d15f8e9fad0418f65 ] + +Don't collect exiting session in smb2_reconnect_server(), because it +will be released soon. + +Note that the exiting session will stay in server->smb_ses_list until +it complete the cifs_free_ipc() and logoff() and then delete itself +from the list. + +Signed-off-by: Winston Wen +Reviewed-by: Shyam Prasad N +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/smb2pdu.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/fs/smb/client/smb2pdu.c b/fs/smb/client/smb2pdu.c +index 17fe212ab895d..e04766fe6f803 100644 +--- a/fs/smb/client/smb2pdu.c ++++ b/fs/smb/client/smb2pdu.c +@@ -3797,6 +3797,12 @@ void smb2_reconnect_server(struct work_struct *work) + + spin_lock(&cifs_tcp_ses_lock); + list_for_each_entry(ses, &pserver->smb_ses_list, smb_ses_list) { ++ spin_lock(&ses->ses_lock); ++ if (ses->ses_status == SES_EXITING) { ++ spin_unlock(&ses->ses_lock); ++ continue; ++ } ++ spin_unlock(&ses->ses_lock); + + tcon_selected = false; + +-- +2.40.1 + diff --git a/queue-6.4/crypto-cifs-fix-error-handling-in-extract_iter_to_sg.patch b/queue-6.4/crypto-cifs-fix-error-handling-in-extract_iter_to_sg.patch new file mode 100644 index 00000000000..7bea5649c37 --- /dev/null +++ b/queue-6.4/crypto-cifs-fix-error-handling-in-extract_iter_to_sg.patch @@ -0,0 +1,101 @@ +From b48eb5c3aa850047c73270f7bc7cec0165987274 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Jul 2023 11:57:56 +0100 +Subject: crypto, cifs: fix error handling in extract_iter_to_sg() + +From: David Howells + +[ Upstream commit f443fd5af5dbd531f880d3645d5dd36976cf087f ] + +Fix error handling in extract_iter_to_sg(). Pages need to be unpinned, not +put in extract_user_to_sg() when handling IOVEC/UBUF sources. + +The bug may result in a warning like the following: + + WARNING: CPU: 1 PID: 20384 at mm/gup.c:229 __lse_atomic_add arch/arm64/include/asm/atomic_lse.h:27 [inline] + WARNING: CPU: 1 PID: 20384 at mm/gup.c:229 arch_atomic_add arch/arm64/include/asm/atomic.h:28 [inline] + WARNING: CPU: 1 PID: 20384 at mm/gup.c:229 raw_atomic_add include/linux/atomic/atomic-arch-fallback.h:537 [inline] + WARNING: CPU: 1 PID: 20384 at mm/gup.c:229 atomic_add include/linux/atomic/atomic-instrumented.h:105 [inline] + WARNING: CPU: 1 PID: 20384 at mm/gup.c:229 try_grab_page+0x108/0x160 mm/gup.c:252 + ... + pc : try_grab_page+0x108/0x160 mm/gup.c:229 + lr : follow_page_pte+0x174/0x3e4 mm/gup.c:651 + ... + Call trace: + __lse_atomic_add arch/arm64/include/asm/atomic_lse.h:27 [inline] + arch_atomic_add arch/arm64/include/asm/atomic.h:28 [inline] + raw_atomic_add include/linux/atomic/atomic-arch-fallback.h:537 [inline] + atomic_add include/linux/atomic/atomic-instrumented.h:105 [inline] + try_grab_page+0x108/0x160 mm/gup.c:252 + follow_pmd_mask mm/gup.c:734 [inline] + follow_pud_mask mm/gup.c:765 [inline] + follow_p4d_mask mm/gup.c:782 [inline] + follow_page_mask+0x12c/0x2e4 mm/gup.c:839 + __get_user_pages+0x174/0x30c mm/gup.c:1217 + __get_user_pages_locked mm/gup.c:1448 [inline] + __gup_longterm_locked+0x94/0x8f4 mm/gup.c:2142 + internal_get_user_pages_fast+0x970/0xb60 mm/gup.c:3140 + pin_user_pages_fast+0x4c/0x60 mm/gup.c:3246 + iov_iter_extract_user_pages lib/iov_iter.c:1768 [inline] + iov_iter_extract_pages+0xc8/0x54c lib/iov_iter.c:1831 + extract_user_to_sg lib/scatterlist.c:1123 [inline] + extract_iter_to_sg lib/scatterlist.c:1349 [inline] + extract_iter_to_sg+0x26c/0x6fc lib/scatterlist.c:1339 + hash_sendmsg+0xc0/0x43c crypto/algif_hash.c:117 + sock_sendmsg_nosec net/socket.c:725 [inline] + sock_sendmsg+0x54/0x60 net/socket.c:748 + ____sys_sendmsg+0x270/0x2ac net/socket.c:2494 + ___sys_sendmsg+0x80/0xdc net/socket.c:2548 + __sys_sendmsg+0x68/0xc4 net/socket.c:2577 + __do_sys_sendmsg net/socket.c:2586 [inline] + __se_sys_sendmsg net/socket.c:2584 [inline] + __arm64_sys_sendmsg+0x24/0x30 net/socket.c:2584 + __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] + invoke_syscall+0x48/0x114 arch/arm64/kernel/syscall.c:52 + el0_svc_common.constprop.0+0x44/0xe4 arch/arm64/kernel/syscall.c:142 + do_el0_svc+0x38/0xa4 arch/arm64/kernel/syscall.c:191 + el0_svc+0x2c/0xb0 arch/arm64/kernel/entry-common.c:647 + el0t_64_sync_handler+0xc0/0xc4 arch/arm64/kernel/entry-common.c:665 + el0t_64_sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:591 + +Link: https://lkml.kernel.org/r/20571.1690369076@warthog.procyon.org.uk +Fixes: 018584697533 ("netfs: Add a function to extract an iterator into a scatterlist") +Reported-by: syzbot+9b82859567f2e50c123e@syzkaller.appspotmail.com +Link: https://lore.kernel.org/linux-mm/000000000000273d0105ff97bf56@google.com/ +Signed-off-by: David Howells +Reviewed-by: David Hildenbrand +Acked-by: Steve French +Cc: Sven Schnelle +Cc: Herbert Xu +Cc: Jeff Layton +Cc: Shyam Prasad N +Cc: Rohith Surabattula +Cc: Jens Axboe +Cc: "David S. Miller" +Cc: Eric Dumazet +Cc: Jakub Kicinski +Cc: Paolo Abeni +Cc: Matthew Wilcox +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + lib/scatterlist.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/lib/scatterlist.c b/lib/scatterlist.c +index e97d7060329e8..f68efa8448137 100644 +--- a/lib/scatterlist.c ++++ b/lib/scatterlist.c +@@ -1148,7 +1148,7 @@ static ssize_t extract_user_to_sg(struct iov_iter *iter, + + failed: + while (sgtable->nents > sgtable->orig_nents) +- put_page(sg_page(&sgtable->sgl[--sgtable->nents])); ++ unpin_user_page(sg_page(&sgtable->sgl[--sgtable->nents])); + return res; + } + +-- +2.40.1 + diff --git a/queue-6.4/dma-remap-use-kvmalloc_array-kvfree-for-larger-dma-m.patch b/queue-6.4/dma-remap-use-kvmalloc_array-kvfree-for-larger-dma-m.patch new file mode 100644 index 00000000000..eb90d60963d --- /dev/null +++ b/queue-6.4/dma-remap-use-kvmalloc_array-kvfree-for-larger-dma-m.patch @@ -0,0 +1,63 @@ +From decb2dafcadd9d04247aadbb22a3c944b54c4f51 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Jun 2023 12:47:37 +0000 +Subject: dma-remap: use kvmalloc_array/kvfree for larger dma memory remap + +From: gaoxu + +[ Upstream commit 51ff97d54f02b4444dfc42e380ac4c058e12d5dd ] + +If dma_direct_alloc() alloc memory in size of 64MB, the inner function +dma_common_contiguous_remap() will allocate 128KB memory by invoking +the function kmalloc_array(). and the kmalloc_array seems to fail to try to +allocate 128KB mem. + +Call trace: +[14977.928623] qcrosvm: page allocation failure: order:5, mode:0x40cc0 +[14977.928638] dump_backtrace.cfi_jt+0x0/0x8 +[14977.928647] dump_stack_lvl+0x80/0xb8 +[14977.928652] warn_alloc+0x164/0x200 +[14977.928657] __alloc_pages_slowpath+0x9f0/0xb4c +[14977.928660] __alloc_pages+0x21c/0x39c +[14977.928662] kmalloc_order+0x48/0x108 +[14977.928666] kmalloc_order_trace+0x34/0x154 +[14977.928668] __kmalloc+0x548/0x7e4 +[14977.928673] dma_direct_alloc+0x11c/0x4f8 +[14977.928678] dma_alloc_attrs+0xf4/0x138 +[14977.928680] gh_vm_ioctl_set_fw_name+0x3c4/0x610 [gunyah] +[14977.928698] gh_vm_ioctl+0x90/0x14c [gunyah] +[14977.928705] __arm64_sys_ioctl+0x184/0x210 + +work around by doing kvmalloc_array instead. + +Signed-off-by: Gao Xu +Reviewed-by: Suren Baghdasaryan +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + kernel/dma/remap.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/kernel/dma/remap.c b/kernel/dma/remap.c +index b4526668072e7..27596f3b4aef3 100644 +--- a/kernel/dma/remap.c ++++ b/kernel/dma/remap.c +@@ -43,13 +43,13 @@ void *dma_common_contiguous_remap(struct page *page, size_t size, + void *vaddr; + int i; + +- pages = kmalloc_array(count, sizeof(struct page *), GFP_KERNEL); ++ pages = kvmalloc_array(count, sizeof(struct page *), GFP_KERNEL); + if (!pages) + return NULL; + for (i = 0; i < count; i++) + pages[i] = nth_page(page, i); + vaddr = vmap(pages, count, VM_DMA_COHERENT, prot); +- kfree(pages); ++ kvfree(pages); + + return vaddr; + } +-- +2.40.1 + diff --git a/queue-6.4/drm-amd-display-apply-60us-prefetch-for-dcfclk-300mh.patch b/queue-6.4/drm-amd-display-apply-60us-prefetch-for-dcfclk-300mh.patch new file mode 100644 index 00000000000..d6a1b2d948a --- /dev/null +++ b/queue-6.4/drm-amd-display-apply-60us-prefetch-for-dcfclk-300mh.patch @@ -0,0 +1,66 @@ +From c445bc727d07ca4886db80897bbaba2d339e4b57 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 May 2023 15:25:01 -0400 +Subject: drm/amd/display: Apply 60us prefetch for DCFCLK <= 300Mhz + +From: Alvin Lee + +[ Upstream commit 7e60ab4eb3e4ba2adac46d737fdbbc5732bebd58 ] + +[Description] +- Previously we wanted to apply extra 60us of prefetch for min DCFCLK + (200Mhz), but DCFCLK can be calculated to be 201Mhz which underflows + also without the extra prefetch +- Instead, apply the the extra 60us prefetch for any DCFCLK freq <= + 300Mhz + +Reviewed-by: Nevenko Stupar +Reviewed-by: Jun Lei +Acked-by: Tom Chung +Signed-off-by: Alvin Lee +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_32.c | 4 ++-- + .../gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_32.h | 2 +- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_32.c b/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_32.c +index d75248b6cae99..9a5150e96017a 100644 +--- a/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_32.c ++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_32.c +@@ -811,7 +811,7 @@ static void DISPCLKDPPCLKDCFCLKDeepSleepPrefetchParametersWatermarksAndPerforman + v->SwathHeightC[k], + TWait, + (v->DRAMSpeedPerState[mode_lib->vba.VoltageLevel] <= MEM_STROBE_FREQ_MHZ || +- v->DCFCLKPerState[mode_lib->vba.VoltageLevel] <= MIN_DCFCLK_FREQ_MHZ) ? ++ v->DCFCLKPerState[mode_lib->vba.VoltageLevel] <= DCFCLK_FREQ_EXTRA_PREFETCH_REQ_MHZ) ? + mode_lib->vba.ip.min_prefetch_in_strobe_us : 0, + /* Output */ + &v->DSTXAfterScaler[k], +@@ -3311,7 +3311,7 @@ void dml32_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode_l + v->swath_width_chroma_ub_this_state[k], + v->SwathHeightYThisState[k], + v->SwathHeightCThisState[k], v->TWait, +- (v->DRAMSpeedPerState[i] <= MEM_STROBE_FREQ_MHZ || v->DCFCLKState[i][j] <= MIN_DCFCLK_FREQ_MHZ) ? ++ (v->DRAMSpeedPerState[i] <= MEM_STROBE_FREQ_MHZ || v->DCFCLKState[i][j] <= DCFCLK_FREQ_EXTRA_PREFETCH_REQ_MHZ) ? + mode_lib->vba.ip.min_prefetch_in_strobe_us : 0, + + /* Output */ +diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_32.h b/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_32.h +index d98e36a9a09cc..c4745d63039bb 100644 +--- a/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_32.h ++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_32.h +@@ -53,7 +53,7 @@ + #define BPP_BLENDED_PIPE 0xffffffff + + #define MEM_STROBE_FREQ_MHZ 1600 +-#define MIN_DCFCLK_FREQ_MHZ 200 ++#define DCFCLK_FREQ_EXTRA_PREFETCH_REQ_MHZ 300 + #define MEM_STROBE_MAX_DELIVERY_TIME_US 60.0 + + struct display_mode_lib; +-- +2.40.1 + diff --git a/queue-6.4/drm-amd-display-enable-dcn314-dpp-rco.patch b/queue-6.4/drm-amd-display-enable-dcn314-dpp-rco.patch new file mode 100644 index 00000000000..2e021769ba3 --- /dev/null +++ b/queue-6.4/drm-amd-display-enable-dcn314-dpp-rco.patch @@ -0,0 +1,53 @@ +From 33f6d20cc7c50cec1d40121728d6b0bb0f4d0190 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 May 2023 13:02:01 -0400 +Subject: drm/amd/display: Enable dcn314 DPP RCO + +From: Daniel Miess + +[ Upstream commit 17fbdbda9cc87ff5a013898de506212d25323ed7 ] + +[Why and How] +Add back debug bits enabling RCO for dcn314 as underflow +associated with this change has been resolved + +Acked-by: Stylon Wang +Signed-off-by: Daniel Miess +Reviewed-by: Jun Lei +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../drm/amd/display/dc/dcn314/dcn314_resource.c | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_resource.c b/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_resource.c +index abeeede38fb39..049fafd3d908c 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_resource.c +@@ -921,6 +921,22 @@ static const struct dc_debug_options debug_defaults_drv = { + .afmt = true, + } + }, ++ ++ .root_clock_optimization = { ++ .bits = { ++ .dpp = true, ++ .dsc = false, ++ .hdmistream = false, ++ .hdmichar = false, ++ .dpstream = false, ++ .symclk32_se = false, ++ .symclk32_le = false, ++ .symclk_fe = false, ++ .physymclk = false, ++ .dpiasymclk = false, ++ } ++ }, ++ + .seamless_boot_odm_combine = true + }; + +-- +2.40.1 + diff --git a/queue-6.4/drm-amd-display-remove-v_startup-workaround-for-dcn3.patch b/queue-6.4/drm-amd-display-remove-v_startup-workaround-for-dcn3.patch new file mode 100644 index 00000000000..e954529be7a --- /dev/null +++ b/queue-6.4/drm-amd-display-remove-v_startup-workaround-for-dcn3.patch @@ -0,0 +1,93 @@ +From 8c82ae4bed8f9d6fa189f513e6ecb2aa3f43a4dc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Apr 2023 14:02:02 -0400 +Subject: drm/amd/display: Remove v_startup workaround for dcn3+ + +From: Daniel Miess + +[ Upstream commit 3a31e8b89b7240d9a17ace8a1ed050bdcb560f9e ] + +[Why] +Calls to dcn20_adjust_freesync_v_startup are no longer +needed as of dcn3+ and can cause underflow in some cases + +[How] +Move calls to dcn20_adjust_freesync_v_startup up into +validate_bandwidth for dcn2.x + +Reviewed-by: Jun Lei +Acked-by: Aurabindo Pillai +Signed-off-by: Daniel Miess +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../drm/amd/display/dc/dml/dcn20/dcn20_fpu.c | 24 +++++++++++++++---- + 1 file changed, 20 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn20/dcn20_fpu.c b/drivers/gpu/drm/amd/display/dc/dml/dcn20/dcn20_fpu.c +index 7661f8946aa31..9ec767ebf5d16 100644 +--- a/drivers/gpu/drm/amd/display/dc/dml/dcn20/dcn20_fpu.c ++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn20/dcn20_fpu.c +@@ -1097,10 +1097,6 @@ void dcn20_calculate_dlg_params(struct dc *dc, + context->res_ctx.pipe_ctx[i].plane_res.bw.dppclk_khz = + pipes[pipe_idx].clks_cfg.dppclk_mhz * 1000; + context->res_ctx.pipe_ctx[i].pipe_dlg_param = pipes[pipe_idx].pipe.dest; +- if (context->res_ctx.pipe_ctx[i].stream->adaptive_sync_infopacket.valid) +- dcn20_adjust_freesync_v_startup( +- &context->res_ctx.pipe_ctx[i].stream->timing, +- &context->res_ctx.pipe_ctx[i].pipe_dlg_param.vstartup_start); + + pipe_idx++; + } +@@ -1914,6 +1910,7 @@ static bool dcn20_validate_bandwidth_internal(struct dc *dc, struct dc_state *co + int vlevel = 0; + int pipe_split_from[MAX_PIPES]; + int pipe_cnt = 0; ++ int i = 0; + display_e2e_pipe_params_st *pipes = kzalloc(dc->res_pool->pipe_count * sizeof(display_e2e_pipe_params_st), GFP_ATOMIC); + DC_LOGGER_INIT(dc->ctx->logger); + +@@ -1937,6 +1934,15 @@ static bool dcn20_validate_bandwidth_internal(struct dc *dc, struct dc_state *co + dcn20_calculate_wm(dc, context, pipes, &pipe_cnt, pipe_split_from, vlevel, fast_validate); + dcn20_calculate_dlg_params(dc, context, pipes, pipe_cnt, vlevel); + ++ for (i = 0; i < dc->res_pool->pipe_count; i++) { ++ if (!context->res_ctx.pipe_ctx[i].stream) ++ continue; ++ if (context->res_ctx.pipe_ctx[i].stream->adaptive_sync_infopacket.valid) ++ dcn20_adjust_freesync_v_startup( ++ &context->res_ctx.pipe_ctx[i].stream->timing, ++ &context->res_ctx.pipe_ctx[i].pipe_dlg_param.vstartup_start); ++ } ++ + BW_VAL_TRACE_END_WATERMARKS(); + + goto validate_out; +@@ -2209,6 +2215,7 @@ bool dcn21_validate_bandwidth_fp(struct dc *dc, + int vlevel = 0; + int pipe_split_from[MAX_PIPES]; + int pipe_cnt = 0; ++ int i = 0; + display_e2e_pipe_params_st *pipes = kzalloc(dc->res_pool->pipe_count * sizeof(display_e2e_pipe_params_st), GFP_ATOMIC); + DC_LOGGER_INIT(dc->ctx->logger); + +@@ -2237,6 +2244,15 @@ bool dcn21_validate_bandwidth_fp(struct dc *dc, + dcn21_calculate_wm(dc, context, pipes, &pipe_cnt, pipe_split_from, vlevel, fast_validate); + dcn20_calculate_dlg_params(dc, context, pipes, pipe_cnt, vlevel); + ++ for (i = 0; i < dc->res_pool->pipe_count; i++) { ++ if (!context->res_ctx.pipe_ctx[i].stream) ++ continue; ++ if (context->res_ctx.pipe_ctx[i].stream->adaptive_sync_infopacket.valid) ++ dcn20_adjust_freesync_v_startup( ++ &context->res_ctx.pipe_ctx[i].stream->timing, ++ &context->res_ctx.pipe_ctx[i].pipe_dlg_param.vstartup_start); ++ } ++ + BW_VAL_TRACE_END_WATERMARKS(); + + goto validate_out; +-- +2.40.1 + diff --git a/queue-6.4/drm-amd-display-skip-dpp-dto-update-if-root-clock-is.patch b/queue-6.4/drm-amd-display-skip-dpp-dto-update-if-root-clock-is.patch new file mode 100644 index 00000000000..6ba1274f93b --- /dev/null +++ b/queue-6.4/drm-amd-display-skip-dpp-dto-update-if-root-clock-is.patch @@ -0,0 +1,98 @@ +From 75c703a42deab228c90780b5a91c999e82e6d3d1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Apr 2023 11:23:50 -0400 +Subject: drm/amd/display: Skip DPP DTO update if root clock is gated + +From: Nicholas Kazlauskas + +[ Upstream commit 30f90f3c1c2c63c2fa44f61233737d27b72637c2 ] + +[Why] +Hardware implements root clock gating by utilizing the DPP DTO registers +with a special case of DTO enabled, phase = 0, modulo = 1. This +conflicts with our policy to always update the DPPDTO for cases where +it's expected to be disabled. + +The pipes unexpectedly enter a higher power state than expected because +of this programming flow. + +[How] +Guard the upper layers of HWSS against this hardware quirk with +programming the register with an internal state flag in DCCG. + +While technically acting as global state for the DCCG, HWSS shouldn't be +expected to understand the hardware quirk for having DTO disabled +causing more power than DTO enabled with this specific setting. + +This also prevents sequencing errors from occuring in the future if +we have to program DPP DTO in multiple locations. + +Acked-by: Stylon Wang +Signed-off-by: Nicholas Kazlauskas +Reviewed-by: Jun Lei +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dcn31/dcn31_dccg.c | 8 ++++++++ + drivers/gpu/drm/amd/display/dc/dcn314/dcn314_dccg.c | 5 +++++ + drivers/gpu/drm/amd/display/dc/inc/hw/dccg.h | 1 + + 3 files changed, 14 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_dccg.c b/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_dccg.c +index 4c2fdfea162f5..65c1d754e2d6b 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_dccg.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_dccg.c +@@ -47,6 +47,14 @@ void dccg31_update_dpp_dto(struct dccg *dccg, int dpp_inst, int req_dppclk) + { + struct dcn_dccg *dccg_dcn = TO_DCN_DCCG(dccg); + ++ if (dccg->dpp_clock_gated[dpp_inst]) { ++ /* ++ * Do not update the DPPCLK DTO if the clock is stopped. ++ * It is treated the same as if the pipe itself were in PG. ++ */ ++ return; ++ } ++ + if (dccg->ref_dppclk && req_dppclk) { + int ref_dppclk = dccg->ref_dppclk; + int modulo, phase; +diff --git a/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_dccg.c b/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_dccg.c +index de7bfba2c1798..6ba24d5848b20 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_dccg.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn314/dcn314_dccg.c +@@ -322,6 +322,9 @@ static void dccg314_dpp_root_clock_control( + { + struct dcn_dccg *dccg_dcn = TO_DCN_DCCG(dccg); + ++ if (dccg->dpp_clock_gated[dpp_inst] == clock_on) ++ return; ++ + if (clock_on) { + /* turn off the DTO and leave phase/modulo at max */ + REG_UPDATE(DPPCLK_DTO_CTRL, DPPCLK_DTO_ENABLE[dpp_inst], 0); +@@ -335,6 +338,8 @@ static void dccg314_dpp_root_clock_control( + DPPCLK0_DTO_PHASE, 0, + DPPCLK0_DTO_MODULO, 1); + } ++ ++ dccg->dpp_clock_gated[dpp_inst] = !clock_on; + } + + static const struct dccg_funcs dccg314_funcs = { +diff --git a/drivers/gpu/drm/amd/display/dc/inc/hw/dccg.h b/drivers/gpu/drm/amd/display/dc/inc/hw/dccg.h +index ad6acd1b34e1d..9651cccb084a3 100644 +--- a/drivers/gpu/drm/amd/display/dc/inc/hw/dccg.h ++++ b/drivers/gpu/drm/amd/display/dc/inc/hw/dccg.h +@@ -68,6 +68,7 @@ struct dccg { + const struct dccg_funcs *funcs; + int pipe_dppclk_khz[MAX_PIPES]; + int ref_dppclk; ++ bool dpp_clock_gated[MAX_PIPES]; + //int dtbclk_khz[MAX_PIPES];/* TODO needs to be removed */ + //int audio_dtbclk_khz;/* TODO needs to be removed */ + //int ref_dtbclk_khz;/* TODO needs to be removed */ +-- +2.40.1 + diff --git a/queue-6.4/drm-amd-display-update-dtbclk-for-dcn32.patch b/queue-6.4/drm-amd-display-update-dtbclk-for-dcn32.patch new file mode 100644 index 00000000000..020ec4928de --- /dev/null +++ b/queue-6.4/drm-amd-display-update-dtbclk-for-dcn32.patch @@ -0,0 +1,76 @@ +From d60be246ebed42933a39a3984519b42eabd54963 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Apr 2022 20:41:10 -0400 +Subject: drm/amd/display: Update DTBCLK for DCN32 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Alvin Lee + +[ Upstream commit 128c1ca0303fe764a4cde5f761e72810d9e40b6e ] + +[Why&How] +- Implement interface to program DTBCLK DTO’s + according to reference DTBCLK returned by PMFW +- This is required because DTO programming + requires exact DTBCLK reference freq or it could + result in underflow + +Acked-by: Aurabindo Pillai +Signed-off-by: Alvin Lee +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../display/dc/clk_mgr/dcn32/dcn32_clk_mgr.c | 27 +++++++++++++++++++ + 1 file changed, 27 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn32/dcn32_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn32/dcn32_clk_mgr.c +index 8d9444db092ab..eea103908b09f 100644 +--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn32/dcn32_clk_mgr.c ++++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn32/dcn32_clk_mgr.c +@@ -233,6 +233,32 @@ void dcn32_init_clocks(struct clk_mgr *clk_mgr_base) + DC_FP_END(); + } + ++static void dcn32_update_clocks_update_dtb_dto(struct clk_mgr_internal *clk_mgr, ++ struct dc_state *context, ++ int ref_dtbclk_khz) ++{ ++ struct dccg *dccg = clk_mgr->dccg; ++ uint32_t tg_mask = 0; ++ int i; ++ ++ for (i = 0; i < clk_mgr->base.ctx->dc->res_pool->pipe_count; i++) { ++ struct pipe_ctx *pipe_ctx = &context->res_ctx.pipe_ctx[i]; ++ struct dtbclk_dto_params dto_params = {0}; ++ ++ /* use mask to program DTO once per tg */ ++ if (pipe_ctx->stream_res.tg && ++ !(tg_mask & (1 << pipe_ctx->stream_res.tg->inst))) { ++ tg_mask |= (1 << pipe_ctx->stream_res.tg->inst); ++ ++ dto_params.otg_inst = pipe_ctx->stream_res.tg->inst; ++ dto_params.ref_dtbclk_khz = ref_dtbclk_khz; ++ ++ dccg->funcs->set_dtbclk_dto(clk_mgr->dccg, &dto_params); ++ //dccg->funcs->set_audio_dtbclk_dto(clk_mgr->dccg, &dto_params); ++ } ++ } ++} ++ + /* Since DPPCLK request to PMFW needs to be exact (due to DPP DTO programming), + * update DPPCLK to be the exact frequency that will be set after the DPPCLK + * divider is updated. This will prevent rounding issues that could cause DPP +@@ -570,6 +596,7 @@ static void dcn32_update_clocks(struct clk_mgr *clk_mgr_base, + /* DCCG requires KHz precision for DTBCLK */ + clk_mgr_base->clks.ref_dtbclk_khz = + dcn32_smu_set_hard_min_by_freq(clk_mgr, PPCLK_DTBCLK, khz_to_mhz_ceil(new_clocks->ref_dtbclk_khz)); ++ dcn32_update_clocks_update_dtb_dto(clk_mgr, context, clk_mgr_base->clks.ref_dtbclk_khz); + } + + if (dc->config.forced_clocks == false || (force_reset && safe_to_lower)) { +-- +2.40.1 + diff --git a/queue-6.4/drm-amdgpu-fix-calltrace-warning-in-amddrm_buddy_fin.patch b/queue-6.4/drm-amdgpu-fix-calltrace-warning-in-amddrm_buddy_fin.patch new file mode 100644 index 00000000000..506e1df38e4 --- /dev/null +++ b/queue-6.4/drm-amdgpu-fix-calltrace-warning-in-amddrm_buddy_fin.patch @@ -0,0 +1,78 @@ +From 98b901cb31b9fd4c8a2be30781f0e76f6c20386c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Apr 2023 13:21:45 +0800 +Subject: drm/amdgpu: fix calltrace warning in amddrm_buddy_fini + +From: Longlong Yao + +[ Upstream commit 01382501509871d0799bab6bd412c228486af5bf ] + +The following call trace is observed when removing the amdgpu driver, which +is caused by that BOs allocated for psp are not freed until removing. + +[61811.450562] RIP: 0010:amddrm_buddy_fini.cold+0x29/0x47 [amddrm_buddy] +[61811.450577] Call Trace: +[61811.450577] +[61811.450579] amdgpu_vram_mgr_fini+0x135/0x1c0 [amdgpu] +[61811.450728] amdgpu_ttm_fini+0x207/0x290 [amdgpu] +[61811.450870] amdgpu_bo_fini+0x27/0xa0 [amdgpu] +[61811.451012] gmc_v9_0_sw_fini+0x4a/0x60 [amdgpu] +[61811.451166] amdgpu_device_fini_sw+0x117/0x520 [amdgpu] +[61811.451306] amdgpu_driver_release_kms+0x16/0x30 [amdgpu] +[61811.451447] devm_drm_dev_init_release+0x4d/0x80 [drm] +[61811.451466] devm_action_release+0x15/0x20 +[61811.451469] release_nodes+0x40/0xb0 +[61811.451471] devres_release_all+0x9b/0xd0 +[61811.451473] __device_release_driver+0x1bb/0x2a0 +[61811.451476] driver_detach+0xf3/0x140 +[61811.451479] bus_remove_driver+0x6c/0xf0 +[61811.451481] driver_unregister+0x31/0x60 +[61811.451483] pci_unregister_driver+0x40/0x90 +[61811.451486] amdgpu_exit+0x15/0x447 [amdgpu] + +For smu v13_0_2, if the GPU supports xgmi, refer to + +commit f5c7e7797060 ("drm/amdgpu: Adjust removal control flow for smu v13_0_2"), + +it will run gpu recover in AMDGPU_RESET_FOR_DEVICE_REMOVE mode when removing, +which makes all devices in hive list have hw reset but no resume except the +basic ip blocks, then other ip blocks will not call .hw_fini according to +ip_block.status.hw. + +Since psp_free_shared_bufs just includes some software operations, so move +it to psp_sw_fini. + +Reviewed-by: Guchun Chen +Reviewed-by: Feifei Xu +Signed-off-by: Longlong Yao +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +index db820331f2c61..39e54685653cc 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +@@ -520,6 +520,8 @@ static int psp_sw_fini(void *handle) + kfree(cmd); + cmd = NULL; + ++ psp_free_shared_bufs(psp); ++ + if (psp->km_ring.ring_mem) + amdgpu_bo_free_kernel(&adev->firmware.rbuf, + &psp->km_ring.ring_mem_mc_addr, +@@ -2657,8 +2659,6 @@ static int psp_hw_fini(void *handle) + + psp_ring_destroy(psp, PSP_RING_TYPE__KM); + +- psp_free_shared_bufs(psp); +- + return 0; + } + +-- +2.40.1 + diff --git a/queue-6.4/drm-amdgpu-fix-integer-overflow-in-amdgpu_cs_pass1.patch b/queue-6.4/drm-amdgpu-fix-integer-overflow-in-amdgpu_cs_pass1.patch new file mode 100644 index 00000000000..34277f2708c --- /dev/null +++ b/queue-6.4/drm-amdgpu-fix-integer-overflow-in-amdgpu_cs_pass1.patch @@ -0,0 +1,40 @@ +From 12080783038f5e24a33070f555f47c65c0df1f17 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Apr 2023 20:22:33 +0800 +Subject: drm/amdgpu: Fix integer overflow in amdgpu_cs_pass1 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: hackyzh002 + +[ Upstream commit 87c2213e85bd81e4a9a4d0880c256568794ae388 ] + +The type of size is unsigned int, if size is 0x40000000, there will +be an integer overflow, size will be zero after size *= sizeof(uint32_t), +will cause uninitialized memory to be referenced later. + +Reviewed-by: Christian König +Signed-off-by: hackyzh002 +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c +index a989ae72a58a9..feb48bb0b4494 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c +@@ -189,7 +189,7 @@ static int amdgpu_cs_pass1(struct amdgpu_cs_parser *p, + uint64_t *chunk_array_user; + uint64_t *chunk_array; + uint32_t uf_offset = 0; +- unsigned int size; ++ size_t size; + int ret; + int i; + +-- +2.40.1 + diff --git a/queue-6.4/drm-amdgpu-fix-memory-leak-in-mes-self-test.patch b/queue-6.4/drm-amdgpu-fix-memory-leak-in-mes-self-test.patch new file mode 100644 index 00000000000..95793cd6f76 --- /dev/null +++ b/queue-6.4/drm-amdgpu-fix-memory-leak-in-mes-self-test.patch @@ -0,0 +1,36 @@ +From 952761b2211a80407f34c198c8a6bd44c78515b3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Apr 2023 14:20:38 +0800 +Subject: drm/amdgpu: fix memory leak in mes self test + +From: Jack Xiao + +[ Upstream commit 31d7c3a4fc3d312a0646990767647925d5bde540 ] + +The fences associated with mes queue have to be freed +up during amdgpu_ring_fini. + +Signed-off-by: Jack Xiao +Reviewed-by: Hawking Zhang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c +index 49de3a3eebc78..de04606c2061e 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c +@@ -361,6 +361,8 @@ void amdgpu_ring_fini(struct amdgpu_ring *ring) + amdgpu_bo_free_kernel(&ring->ring_obj, + &ring->gpu_addr, + (void **)&ring->ring); ++ } else { ++ kfree(ring->fence_drv.fences); + } + + dma_fence_put(ring->vmid_wait); +-- +2.40.1 + diff --git a/queue-6.4/drm-amdgpu-fix-potential-fence-use-after-free-v2.patch b/queue-6.4/drm-amdgpu-fix-potential-fence-use-after-free-v2.patch new file mode 100644 index 00000000000..e82332bbfd7 --- /dev/null +++ b/queue-6.4/drm-amdgpu-fix-potential-fence-use-after-free-v2.patch @@ -0,0 +1,52 @@ +From c40edde3756deade9ab970be698727d90fd79f27 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Jun 2023 18:10:47 -0700 +Subject: drm/amdgpu: Fix potential fence use-after-free v2 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: shanzhulig + +[ Upstream commit 2e54154b9f27262efd0cb4f903cc7d5ad1fe9628 ] + +fence Decrements the reference count before exiting. +Avoid Race Vulnerabilities for fence use-after-free. + +v2 (chk): actually fix the use after free and not just move it. + +Signed-off-by: shanzhulig +Signed-off-by: Christian König +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c +index feb48bb0b4494..0c023269aadaa 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c +@@ -1625,15 +1625,15 @@ static int amdgpu_cs_wait_all_fences(struct amdgpu_device *adev, + continue; + + r = dma_fence_wait_timeout(fence, true, timeout); ++ if (r > 0 && fence->error) ++ r = fence->error; ++ + dma_fence_put(fence); + if (r < 0) + return r; + + if (r == 0) + break; +- +- if (fence->error) +- return fence->error; + } + + memset(wait, 0, sizeof(*wait)); +-- +2.40.1 + diff --git a/queue-6.4/drm-amdgpu-install-stub-fence-into-potential-unused-.patch b/queue-6.4/drm-amdgpu-install-stub-fence-into-potential-unused-.patch new file mode 100644 index 00000000000..4065e1b1952 --- /dev/null +++ b/queue-6.4/drm-amdgpu-install-stub-fence-into-potential-unused-.patch @@ -0,0 +1,59 @@ +From b09cf57499781ce8c1e6970b4e5dea84113d5c07 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 May 2023 20:14:15 +0800 +Subject: drm/amdgpu: install stub fence into potential unused fence pointers +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Lang Yu + +[ Upstream commit 187916e6ed9d0c3b3abc27429f7a5f8c936bd1f0 ] + +When using cpu to update page tables, vm update fences are unused. +Install stub fence into these fence pointers instead of NULL +to avoid NULL dereference when calling dma_fence_wait() on them. + +Suggested-by: Christian König +Signed-off-by: Lang Yu +Reviewed-by: Christian König +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c +index 23f52150ebef4..fd029d91a3402 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c +@@ -1367,6 +1367,7 @@ struct amdgpu_bo_va *amdgpu_vm_bo_add(struct amdgpu_device *adev, + amdgpu_vm_bo_base_init(&bo_va->base, vm, bo); + + bo_va->ref_count = 1; ++ bo_va->last_pt_update = dma_fence_get_stub(); + INIT_LIST_HEAD(&bo_va->valids); + INIT_LIST_HEAD(&bo_va->invalids); + +@@ -2088,7 +2089,8 @@ int amdgpu_vm_init(struct amdgpu_device *adev, struct amdgpu_vm *vm) + vm->update_funcs = &amdgpu_vm_cpu_funcs; + else + vm->update_funcs = &amdgpu_vm_sdma_funcs; +- vm->last_update = NULL; ++ ++ vm->last_update = dma_fence_get_stub(); + vm->last_unlocked = dma_fence_get_stub(); + vm->last_tlb_flush = dma_fence_get_stub(); + +@@ -2213,7 +2215,7 @@ int amdgpu_vm_make_compute(struct amdgpu_device *adev, struct amdgpu_vm *vm) + goto unreserve_bo; + + dma_fence_put(vm->last_update); +- vm->last_update = NULL; ++ vm->last_update = dma_fence_get_stub(); + vm->is_compute_context = true; + + /* Free the shadow bo for compute VM */ +-- +2.40.1 + diff --git a/queue-6.4/drm-amdgpu-unmap-and-remove-csa_va-properly.patch b/queue-6.4/drm-amdgpu-unmap-and-remove-csa_va-properly.patch new file mode 100644 index 00000000000..9cfe746a524 --- /dev/null +++ b/queue-6.4/drm-amdgpu-unmap-and-remove-csa_va-properly.patch @@ -0,0 +1,127 @@ +From 9cb33a59bca3b55e198ef4caa4de23f30a07ed9e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 6 May 2023 12:01:33 +0800 +Subject: drm/amdgpu: unmap and remove csa_va properly +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Lang Yu + +[ Upstream commit 5daff15cd013422bc6d1efcfe82b586800025384 ] + +Root PD BO should be reserved before unmap and remove +a bo_va from VM otherwise lockdep will complain. + +v2: check fpriv->csa_va is not NULL instead of amdgpu_mcbp (christian) + +[14616.936827] WARNING: CPU: 6 PID: 1711 at drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c:1762 amdgpu_vm_bo_del+0x399/0x3f0 [amdgpu] +[14616.937096] Call Trace: +[14616.937097] +[14616.937102] amdgpu_driver_postclose_kms+0x249/0x2f0 [amdgpu] +[14616.937187] drm_file_free+0x1d6/0x300 [drm] +[14616.937207] drm_close_helper.isra.0+0x62/0x70 [drm] +[14616.937220] drm_release+0x5e/0x100 [drm] +[14616.937234] __fput+0x9f/0x280 +[14616.937239] ____fput+0xe/0x20 +[14616.937241] task_work_run+0x61/0x90 +[14616.937246] exit_to_user_mode_prepare+0x215/0x220 +[14616.937251] syscall_exit_to_user_mode+0x2a/0x60 +[14616.937254] do_syscall_64+0x48/0x90 +[14616.937257] entry_SYSCALL_64_after_hwframe+0x63/0xcd + +Signed-off-by: Lang Yu +Acked-by: Christian König +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c | 38 +++++++++++++++++++++++++ + drivers/gpu/drm/amd/amdgpu/amdgpu_csa.h | 3 ++ + drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 10 +++---- + 3 files changed, 46 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c +index c6d4d41c4393e..23d054526e7c7 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c +@@ -106,3 +106,41 @@ int amdgpu_map_static_csa(struct amdgpu_device *adev, struct amdgpu_vm *vm, + ttm_eu_backoff_reservation(&ticket, &list); + return 0; + } ++ ++int amdgpu_unmap_static_csa(struct amdgpu_device *adev, struct amdgpu_vm *vm, ++ struct amdgpu_bo *bo, struct amdgpu_bo_va *bo_va, ++ uint64_t csa_addr) ++{ ++ struct ww_acquire_ctx ticket; ++ struct list_head list; ++ struct amdgpu_bo_list_entry pd; ++ struct ttm_validate_buffer csa_tv; ++ int r; ++ ++ INIT_LIST_HEAD(&list); ++ INIT_LIST_HEAD(&csa_tv.head); ++ csa_tv.bo = &bo->tbo; ++ csa_tv.num_shared = 1; ++ ++ list_add(&csa_tv.head, &list); ++ amdgpu_vm_get_pd_bo(vm, &list, &pd); ++ ++ r = ttm_eu_reserve_buffers(&ticket, &list, true, NULL); ++ if (r) { ++ DRM_ERROR("failed to reserve CSA,PD BOs: err=%d\n", r); ++ return r; ++ } ++ ++ r = amdgpu_vm_bo_unmap(adev, bo_va, csa_addr); ++ if (r) { ++ DRM_ERROR("failed to do bo_unmap on static CSA, err=%d\n", r); ++ ttm_eu_backoff_reservation(&ticket, &list); ++ return r; ++ } ++ ++ amdgpu_vm_bo_del(adev, bo_va); ++ ++ ttm_eu_backoff_reservation(&ticket, &list); ++ ++ return 0; ++} +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_csa.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_csa.h +index 524b4437a0217..7dfc1f2012ebf 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_csa.h ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_csa.h +@@ -34,6 +34,9 @@ int amdgpu_allocate_static_csa(struct amdgpu_device *adev, struct amdgpu_bo **bo + int amdgpu_map_static_csa(struct amdgpu_device *adev, struct amdgpu_vm *vm, + struct amdgpu_bo *bo, struct amdgpu_bo_va **bo_va, + uint64_t csa_addr, uint32_t size); ++int amdgpu_unmap_static_csa(struct amdgpu_device *adev, struct amdgpu_vm *vm, ++ struct amdgpu_bo *bo, struct amdgpu_bo_va *bo_va, ++ uint64_t csa_addr); + void amdgpu_free_static_csa(struct amdgpu_bo **bo); + + #endif +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c +index 0efb38539d70c..724e80c192973 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c +@@ -1284,12 +1284,12 @@ void amdgpu_driver_postclose_kms(struct drm_device *dev, + if (amdgpu_device_ip_get_ip_block(adev, AMD_IP_BLOCK_TYPE_VCE) != NULL) + amdgpu_vce_free_handles(adev, file_priv); + +- if (amdgpu_mcbp) { +- /* TODO: how to handle reserve failure */ +- BUG_ON(amdgpu_bo_reserve(adev->virt.csa_obj, true)); +- amdgpu_vm_bo_del(adev, fpriv->csa_va); ++ if (fpriv->csa_va) { ++ uint64_t csa_addr = amdgpu_csa_vaddr(adev) & AMDGPU_GMC_HOLE_MASK; ++ ++ WARN_ON(amdgpu_unmap_static_csa(adev, &fpriv->vm, adev->virt.csa_obj, ++ fpriv->csa_va, csa_addr)); + fpriv->csa_va = NULL; +- amdgpu_bo_unreserve(adev->virt.csa_obj); + } + + pasid = fpriv->vm.pasid; +-- +2.40.1 + diff --git a/queue-6.4/drm-rcar-du-remove-r-car-h3-es1.-workarounds.patch b/queue-6.4/drm-rcar-du-remove-r-car-h3-es1.-workarounds.patch new file mode 100644 index 00000000000..94495b27a78 --- /dev/null +++ b/queue-6.4/drm-rcar-du-remove-r-car-h3-es1.-workarounds.patch @@ -0,0 +1,202 @@ +From d73d296d920fd936fc9b986b8785ffcc03028385 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 May 2023 09:48:17 +0200 +Subject: drm: rcar-du: remove R-Car H3 ES1.* workarounds + +From: Wolfram Sang + +[ Upstream commit 2da4b728f994a1f9189a8066b0be90b615768764 ] + +R-Car H3 ES1.* was only available to an internal development group and +needed a lot of quirks and workarounds. These become a maintenance +burden now, so our development group decided to remove upstream support +for this SoC and prevent booting it. Public users only have ES2 onwards. + +Signed-off-by: Wolfram Sang +Reviewed-by: Kieran Bingham +Reviewed-by: Laurent Pinchart +Signed-off-by: Laurent Pinchart +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/rcar-du/rcar_du_crtc.c | 37 ++------------------ + drivers/gpu/drm/rcar-du/rcar_du_drv.c | 48 -------------------------- + drivers/gpu/drm/rcar-du/rcar_du_drv.h | 2 -- + drivers/gpu/drm/rcar-du/rcar_du_regs.h | 3 +- + 4 files changed, 4 insertions(+), 86 deletions(-) + +diff --git a/drivers/gpu/drm/rcar-du/rcar_du_crtc.c b/drivers/gpu/drm/rcar-du/rcar_du_crtc.c +index d6d29be6b4f48..7e175dbfd8924 100644 +--- a/drivers/gpu/drm/rcar-du/rcar_du_crtc.c ++++ b/drivers/gpu/drm/rcar-du/rcar_du_crtc.c +@@ -223,20 +223,6 @@ static void rcar_du_crtc_set_display_timing(struct rcar_du_crtc *rcrtc) + * DU channels that have a display PLL can't use the internal + * system clock, and have no internal clock divider. + */ +- +- /* +- * The H3 ES1.x exhibits dot clock duty cycle stability issues. +- * We can work around them by configuring the DPLL to twice the +- * desired frequency, coupled with a /2 post-divider. Restrict +- * the workaround to H3 ES1.x as ES2.0 and all other SoCs have +- * no post-divider when a display PLL is present (as shown by +- * the workaround breaking HDMI output on M3-W during testing). +- */ +- if (rcdu->info->quirks & RCAR_DU_QUIRK_H3_ES1_PCLK_STABILITY) { +- target *= 2; +- div = 1; +- } +- + extclk = clk_get_rate(rcrtc->extclock); + rcar_du_dpll_divider(rcrtc, &dpll, extclk, target); + +@@ -245,30 +231,13 @@ static void rcar_du_crtc_set_display_timing(struct rcar_du_crtc *rcrtc) + | DPLLCR_N(dpll.n) | DPLLCR_M(dpll.m) + | DPLLCR_STBY; + +- if (rcrtc->index == 1) { ++ if (rcrtc->index == 1) + dpllcr |= DPLLCR_PLCS1 + | DPLLCR_INCS_DOTCLKIN1; +- } else { +- dpllcr |= DPLLCR_PLCS0_PLL ++ else ++ dpllcr |= DPLLCR_PLCS0 + | DPLLCR_INCS_DOTCLKIN0; + +- /* +- * On ES2.x we have a single mux controlled via bit 21, +- * which selects between DCLKIN source (bit 21 = 0) and +- * a PLL source (bit 21 = 1), where the PLL is always +- * PLL1. +- * +- * On ES1.x we have an additional mux, controlled +- * via bit 20, for choosing between PLL0 (bit 20 = 0) +- * and PLL1 (bit 20 = 1). We always want to use PLL1, +- * so on ES1.x, in addition to setting bit 21, we need +- * to set the bit 20. +- */ +- +- if (rcdu->info->quirks & RCAR_DU_QUIRK_H3_ES1_PLL) +- dpllcr |= DPLLCR_PLCS0_H3ES1X_PLL1; +- } +- + rcar_du_group_write(rcrtc->group, DPLLCR, dpllcr); + + escr = ESCR_DCLKSEL_DCLKIN | div; +diff --git a/drivers/gpu/drm/rcar-du/rcar_du_drv.c b/drivers/gpu/drm/rcar-du/rcar_du_drv.c +index b9a94c5260e9d..1ffde19cb87fe 100644 +--- a/drivers/gpu/drm/rcar-du/rcar_du_drv.c ++++ b/drivers/gpu/drm/rcar-du/rcar_du_drv.c +@@ -16,7 +16,6 @@ + #include + #include + #include +-#include + #include + + #include +@@ -387,43 +386,6 @@ static const struct rcar_du_device_info rcar_du_r8a7795_info = { + .dpll_mask = BIT(2) | BIT(1), + }; + +-static const struct rcar_du_device_info rcar_du_r8a7795_es1_info = { +- .gen = 3, +- .features = RCAR_DU_FEATURE_CRTC_IRQ +- | RCAR_DU_FEATURE_CRTC_CLOCK +- | RCAR_DU_FEATURE_VSP1_SOURCE +- | RCAR_DU_FEATURE_INTERLACED +- | RCAR_DU_FEATURE_TVM_SYNC, +- .quirks = RCAR_DU_QUIRK_H3_ES1_PCLK_STABILITY +- | RCAR_DU_QUIRK_H3_ES1_PLL, +- .channels_mask = BIT(3) | BIT(2) | BIT(1) | BIT(0), +- .routes = { +- /* +- * R8A7795 has one RGB output, two HDMI outputs and one +- * LVDS output. +- */ +- [RCAR_DU_OUTPUT_DPAD0] = { +- .possible_crtcs = BIT(3), +- .port = 0, +- }, +- [RCAR_DU_OUTPUT_HDMI0] = { +- .possible_crtcs = BIT(1), +- .port = 1, +- }, +- [RCAR_DU_OUTPUT_HDMI1] = { +- .possible_crtcs = BIT(2), +- .port = 2, +- }, +- [RCAR_DU_OUTPUT_LVDS0] = { +- .possible_crtcs = BIT(0), +- .port = 3, +- }, +- }, +- .num_lvds = 1, +- .num_rpf = 5, +- .dpll_mask = BIT(2) | BIT(1), +-}; +- + static const struct rcar_du_device_info rcar_du_r8a7796_info = { + .gen = 3, + .features = RCAR_DU_FEATURE_CRTC_IRQ +@@ -614,11 +576,6 @@ static const struct of_device_id rcar_du_of_table[] = { + + MODULE_DEVICE_TABLE(of, rcar_du_of_table); + +-static const struct soc_device_attribute rcar_du_soc_table[] = { +- { .soc_id = "r8a7795", .revision = "ES1.*", .data = &rcar_du_r8a7795_es1_info }, +- { /* sentinel */ } +-}; +- + const char *rcar_du_output_name(enum rcar_du_output output) + { + static const char * const names[] = { +@@ -707,7 +664,6 @@ static void rcar_du_shutdown(struct platform_device *pdev) + + static int rcar_du_probe(struct platform_device *pdev) + { +- const struct soc_device_attribute *soc_attr; + struct rcar_du_device *rcdu; + unsigned int mask; + int ret; +@@ -725,10 +681,6 @@ static int rcar_du_probe(struct platform_device *pdev) + + rcdu->info = of_device_get_match_data(rcdu->dev); + +- soc_attr = soc_device_match(rcar_du_soc_table); +- if (soc_attr) +- rcdu->info = soc_attr->data; +- + platform_set_drvdata(pdev, rcdu); + + /* I/O resources */ +diff --git a/drivers/gpu/drm/rcar-du/rcar_du_drv.h b/drivers/gpu/drm/rcar-du/rcar_du_drv.h +index acc3673fefe18..5cfa2bb7ad93d 100644 +--- a/drivers/gpu/drm/rcar-du/rcar_du_drv.h ++++ b/drivers/gpu/drm/rcar-du/rcar_du_drv.h +@@ -34,8 +34,6 @@ struct rcar_du_device; + #define RCAR_DU_FEATURE_NO_BLENDING BIT(5) /* PnMR.SPIM does not have ALP nor EOR bits */ + + #define RCAR_DU_QUIRK_ALIGN_128B BIT(0) /* Align pitches to 128 bytes */ +-#define RCAR_DU_QUIRK_H3_ES1_PCLK_STABILITY BIT(1) /* H3 ES1 has pclk stability issue */ +-#define RCAR_DU_QUIRK_H3_ES1_PLL BIT(2) /* H3 ES1 PLL setup differs from non-ES1 */ + + enum rcar_du_output { + RCAR_DU_OUTPUT_DPAD0, +diff --git a/drivers/gpu/drm/rcar-du/rcar_du_regs.h b/drivers/gpu/drm/rcar-du/rcar_du_regs.h +index 6c750fab6ebb7..391de6661d8bc 100644 +--- a/drivers/gpu/drm/rcar-du/rcar_du_regs.h ++++ b/drivers/gpu/drm/rcar-du/rcar_du_regs.h +@@ -283,8 +283,7 @@ + #define DPLLCR 0x20044 + #define DPLLCR_CODE (0x95 << 24) + #define DPLLCR_PLCS1 (1 << 23) +-#define DPLLCR_PLCS0_PLL (1 << 21) +-#define DPLLCR_PLCS0_H3ES1X_PLL1 (1 << 20) ++#define DPLLCR_PLCS0 (1 << 21) + #define DPLLCR_CLKE (1 << 18) + #define DPLLCR_FDPLL(n) ((n) << 12) + #define DPLLCR_N(n) ((n) << 5) +-- +2.40.1 + diff --git a/queue-6.4/drm-scheduler-set-entity-to-null-in-drm_sched_entity.patch b/queue-6.4/drm-scheduler-set-entity-to-null-in-drm_sched_entity.patch new file mode 100644 index 00000000000..f606773dcd0 --- /dev/null +++ b/queue-6.4/drm-scheduler-set-entity-to-null-in-drm_sched_entity.patch @@ -0,0 +1,67 @@ +From 6bd22f112f8bf0974ff616f6f14c13179d9117d7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Apr 2023 12:04:53 +0200 +Subject: drm/scheduler: set entity to NULL in drm_sched_entity_pop_job() + +From: Danilo Krummrich + +[ Upstream commit 96c7c2f4d5bd94b15fe63448c087f01607b56f4a ] + +It already happend a few times that patches slipped through which +implemented access to an entity through a job that was already removed +from the entities queue. Since jobs and entities might have different +lifecycles, this can potentially cause UAF bugs. + +In order to make it obvious that a jobs entity pointer shouldn't be +accessed after drm_sched_entity_pop_job() was called successfully, set +the jobs entity pointer to NULL once the job is removed from the entity +queue. + +Moreover, debugging a potential NULL pointer dereference is way easier +than potentially corrupted memory through a UAF. + +Signed-off-by: Danilo Krummrich +Link: https://lore.kernel.org/r/20230418100453.4433-1-dakr@redhat.com +Reviewed-by: Luben Tuikov +Signed-off-by: Luben Tuikov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/scheduler/sched_entity.c | 6 ++++++ + drivers/gpu/drm/scheduler/sched_main.c | 4 ++++ + 2 files changed, 10 insertions(+) + +diff --git a/drivers/gpu/drm/scheduler/sched_entity.c b/drivers/gpu/drm/scheduler/sched_entity.c +index e0a8890a62e23..3e2a31d8190eb 100644 +--- a/drivers/gpu/drm/scheduler/sched_entity.c ++++ b/drivers/gpu/drm/scheduler/sched_entity.c +@@ -448,6 +448,12 @@ struct drm_sched_job *drm_sched_entity_pop_job(struct drm_sched_entity *entity) + drm_sched_rq_update_fifo(entity, next->submit_ts); + } + ++ /* Jobs and entities might have different lifecycles. Since we're ++ * removing the job from the entities queue, set the jobs entity pointer ++ * to NULL to prevent any future access of the entity through this job. ++ */ ++ sched_job->entity = NULL; ++ + return sched_job; + } + +diff --git a/drivers/gpu/drm/scheduler/sched_main.c b/drivers/gpu/drm/scheduler/sched_main.c +index aea5a90ff98b9..cdd67676c3d1b 100644 +--- a/drivers/gpu/drm/scheduler/sched_main.c ++++ b/drivers/gpu/drm/scheduler/sched_main.c +@@ -42,6 +42,10 @@ + * the hardware. + * + * The jobs in a entity are always scheduled in the order that they were pushed. ++ * ++ * Note that once a job was taken from the entities queue and pushed to the ++ * hardware, i.e. the pending queue, the entity must not be referenced anymore ++ * through the jobs entity pointer. + */ + + #include +-- +2.40.1 + diff --git a/queue-6.4/drm-stm-ltdc-fix-late-dereference-check.patch b/queue-6.4/drm-stm-ltdc-fix-late-dereference-check.patch new file mode 100644 index 00000000000..40dcedf117c --- /dev/null +++ b/queue-6.4/drm-stm-ltdc-fix-late-dereference-check.patch @@ -0,0 +1,53 @@ +From 54a4bda96e94823c86ff9366a41aceb1a2ed9f40 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 May 2023 14:38:18 +0200 +Subject: drm/stm: ltdc: fix late dereference check + +From: Raphael Gallais-Pou + +[ Upstream commit 898a9e3f56db9860ab091d4bf41b6caa99aafc3d ] + +In ltdc_crtc_set_crc_source(), struct drm_crtc was dereferenced in a +container_of() before the pointer check. This could cause a kernel panic. + +Fix this smatch warning: +drivers/gpu/drm/stm/ltdc.c:1124 ltdc_crtc_set_crc_source() warn: variable dereferenced before check 'crtc' (see line 1119) + +Reported-by: kernel test robot +Closes: https://lore.kernel.org/lkml/202212241802.zeLFZCXB-lkp@intel.com/ +Reported-by: Dan Carpenter +Closes: https://lore.kernel.org/lkml/202212241802.zeLFZCXB-lkp@intel.com/ +Signed-off-by: Raphael Gallais-Pou +Acked-by: Philippe Cornu +Signed-off-by: Philippe Cornu +Link: https://patchwork.freedesktop.org/patch/msgid/20230515123818.93971-1-raphael.gallais-pou@foss.st.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/stm/ltdc.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/stm/ltdc.c b/drivers/gpu/drm/stm/ltdc.c +index 03c6becda795c..b8be4c1db4235 100644 +--- a/drivers/gpu/drm/stm/ltdc.c ++++ b/drivers/gpu/drm/stm/ltdc.c +@@ -1145,7 +1145,7 @@ static void ltdc_crtc_disable_vblank(struct drm_crtc *crtc) + + static int ltdc_crtc_set_crc_source(struct drm_crtc *crtc, const char *source) + { +- struct ltdc_device *ldev = crtc_to_ltdc(crtc); ++ struct ltdc_device *ldev; + int ret; + + DRM_DEBUG_DRIVER("\n"); +@@ -1153,6 +1153,8 @@ static int ltdc_crtc_set_crc_source(struct drm_crtc *crtc, const char *source) + if (!crtc) + return -ENODEV; + ++ ldev = crtc_to_ltdc(crtc); ++ + if (source && strcmp(source, "auto") == 0) { + ldev->crc_active = true; + ret = regmap_set_bits(ldev->regmap, LTDC_GCR, GCR_CRCEN); +-- +2.40.1 + diff --git a/queue-6.4/drop-the-netfs_-prefix-from-netfs_extract_iter_to_sg.patch b/queue-6.4/drop-the-netfs_-prefix-from-netfs_extract_iter_to_sg.patch new file mode 100644 index 00000000000..8b33877fdd2 --- /dev/null +++ b/queue-6.4/drop-the-netfs_-prefix-from-netfs_extract_iter_to_sg.patch @@ -0,0 +1,212 @@ +From 5c8403d27896c1124612b4db8fd0438771d5b6c3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Jun 2023 14:08:47 +0100 +Subject: Drop the netfs_ prefix from netfs_extract_iter_to_sg() + +From: David Howells + +[ Upstream commit 0d7aeb68700ff87b4d2acafb789408a065225e1e ] + +Rename netfs_extract_iter_to_sg() and its auxiliary functions to drop the +netfs_ prefix. + +Signed-off-by: David Howells +cc: Jeff Layton +cc: Steve French +cc: Shyam Prasad N +cc: Rohith Surabattula +cc: Jens Axboe +cc: Herbert Xu +cc: "Matthew Wilcox (Oracle)" +cc: "David S. Miller" +cc: Eric Dumazet +cc: Jakub Kicinski +cc: Paolo Abeni +cc: linux-crypto@vger.kernel.org +cc: linux-cachefs@redhat.com +cc: linux-cifs@vger.kernel.org +cc: linux-fsdevel@vger.kernel.org +cc: netdev@vger.kernel.org +Signed-off-by: Paolo Abeni +Stable-dep-of: f443fd5af5db ("crypto, cifs: fix error handling in extract_iter_to_sg()") +Signed-off-by: Sasha Levin +--- + fs/netfs/iterator.c | 66 +++++++++++++++++++-------------------- + fs/smb/client/smb2ops.c | 4 +-- + fs/smb/client/smbdirect.c | 2 +- + include/linux/netfs.h | 6 ++-- + 4 files changed, 39 insertions(+), 39 deletions(-) + +diff --git a/fs/netfs/iterator.c b/fs/netfs/iterator.c +index 8a4c866874297..f8eba3de1a975 100644 +--- a/fs/netfs/iterator.c ++++ b/fs/netfs/iterator.c +@@ -106,11 +106,11 @@ EXPORT_SYMBOL_GPL(netfs_extract_user_iter); + * Extract and pin a list of up to sg_max pages from UBUF- or IOVEC-class + * iterators, and add them to the scatterlist. + */ +-static ssize_t netfs_extract_user_to_sg(struct iov_iter *iter, +- ssize_t maxsize, +- struct sg_table *sgtable, +- unsigned int sg_max, +- iov_iter_extraction_t extraction_flags) ++static ssize_t extract_user_to_sg(struct iov_iter *iter, ++ ssize_t maxsize, ++ struct sg_table *sgtable, ++ unsigned int sg_max, ++ iov_iter_extraction_t extraction_flags) + { + struct scatterlist *sg = sgtable->sgl + sgtable->nents; + struct page **pages; +@@ -159,11 +159,11 @@ static ssize_t netfs_extract_user_to_sg(struct iov_iter *iter, + * Extract up to sg_max pages from a BVEC-type iterator and add them to the + * scatterlist. The pages are not pinned. + */ +-static ssize_t netfs_extract_bvec_to_sg(struct iov_iter *iter, +- ssize_t maxsize, +- struct sg_table *sgtable, +- unsigned int sg_max, +- iov_iter_extraction_t extraction_flags) ++static ssize_t extract_bvec_to_sg(struct iov_iter *iter, ++ ssize_t maxsize, ++ struct sg_table *sgtable, ++ unsigned int sg_max, ++ iov_iter_extraction_t extraction_flags) + { + const struct bio_vec *bv = iter->bvec; + struct scatterlist *sg = sgtable->sgl + sgtable->nents; +@@ -205,11 +205,11 @@ static ssize_t netfs_extract_bvec_to_sg(struct iov_iter *iter, + * scatterlist. This can deal with vmalloc'd buffers as well as kmalloc'd or + * static buffers. The pages are not pinned. + */ +-static ssize_t netfs_extract_kvec_to_sg(struct iov_iter *iter, +- ssize_t maxsize, +- struct sg_table *sgtable, +- unsigned int sg_max, +- iov_iter_extraction_t extraction_flags) ++static ssize_t extract_kvec_to_sg(struct iov_iter *iter, ++ ssize_t maxsize, ++ struct sg_table *sgtable, ++ unsigned int sg_max, ++ iov_iter_extraction_t extraction_flags) + { + const struct kvec *kv = iter->kvec; + struct scatterlist *sg = sgtable->sgl + sgtable->nents; +@@ -266,11 +266,11 @@ static ssize_t netfs_extract_kvec_to_sg(struct iov_iter *iter, + * Extract up to sg_max folios from an XARRAY-type iterator and add them to + * the scatterlist. The pages are not pinned. + */ +-static ssize_t netfs_extract_xarray_to_sg(struct iov_iter *iter, +- ssize_t maxsize, +- struct sg_table *sgtable, +- unsigned int sg_max, +- iov_iter_extraction_t extraction_flags) ++static ssize_t extract_xarray_to_sg(struct iov_iter *iter, ++ ssize_t maxsize, ++ struct sg_table *sgtable, ++ unsigned int sg_max, ++ iov_iter_extraction_t extraction_flags) + { + struct scatterlist *sg = sgtable->sgl + sgtable->nents; + struct xarray *xa = iter->xarray; +@@ -312,7 +312,7 @@ static ssize_t netfs_extract_xarray_to_sg(struct iov_iter *iter, + } + + /** +- * netfs_extract_iter_to_sg - Extract pages from an iterator and add ot an sglist ++ * extract_iter_to_sg - Extract pages from an iterator and add ot an sglist + * @iter: The iterator to extract from + * @maxsize: The amount of iterator to copy + * @sgtable: The scatterlist table to fill in +@@ -339,9 +339,9 @@ static ssize_t netfs_extract_xarray_to_sg(struct iov_iter *iter, + * The iov_iter_extract_mode() function should be used to query how cleanup + * should be performed. + */ +-ssize_t netfs_extract_iter_to_sg(struct iov_iter *iter, size_t maxsize, +- struct sg_table *sgtable, unsigned int sg_max, +- iov_iter_extraction_t extraction_flags) ++ssize_t extract_iter_to_sg(struct iov_iter *iter, size_t maxsize, ++ struct sg_table *sgtable, unsigned int sg_max, ++ iov_iter_extraction_t extraction_flags) + { + if (maxsize == 0) + return 0; +@@ -349,21 +349,21 @@ ssize_t netfs_extract_iter_to_sg(struct iov_iter *iter, size_t maxsize, + switch (iov_iter_type(iter)) { + case ITER_UBUF: + case ITER_IOVEC: +- return netfs_extract_user_to_sg(iter, maxsize, sgtable, sg_max, +- extraction_flags); ++ return extract_user_to_sg(iter, maxsize, sgtable, sg_max, ++ extraction_flags); + case ITER_BVEC: +- return netfs_extract_bvec_to_sg(iter, maxsize, sgtable, sg_max, +- extraction_flags); ++ return extract_bvec_to_sg(iter, maxsize, sgtable, sg_max, ++ extraction_flags); + case ITER_KVEC: +- return netfs_extract_kvec_to_sg(iter, maxsize, sgtable, sg_max, +- extraction_flags); ++ return extract_kvec_to_sg(iter, maxsize, sgtable, sg_max, ++ extraction_flags); + case ITER_XARRAY: +- return netfs_extract_xarray_to_sg(iter, maxsize, sgtable, sg_max, +- extraction_flags); ++ return extract_xarray_to_sg(iter, maxsize, sgtable, sg_max, ++ extraction_flags); + default: + pr_err("%s(%u) unsupported\n", __func__, iov_iter_type(iter)); + WARN_ON_ONCE(1); + return -EIO; + } + } +-EXPORT_SYMBOL_GPL(netfs_extract_iter_to_sg); ++EXPORT_SYMBOL_GPL(extract_iter_to_sg); +diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c +index 3bac586e8a8eb..5dec02361b69d 100644 +--- a/fs/smb/client/smb2ops.c ++++ b/fs/smb/client/smb2ops.c +@@ -4374,8 +4374,8 @@ static void *smb2_get_aead_req(struct crypto_aead *tfm, struct smb_rqst *rqst, + } + sgtable.orig_nents = sgtable.nents; + +- rc = netfs_extract_iter_to_sg(iter, count, &sgtable, +- num_sgs - sgtable.nents, 0); ++ rc = extract_iter_to_sg(iter, count, &sgtable, ++ num_sgs - sgtable.nents, 0); + iov_iter_revert(iter, rc); + sgtable.orig_nents = sgtable.nents; + } +diff --git a/fs/smb/client/smbdirect.c b/fs/smb/client/smbdirect.c +index 0362ebd4fa0fc..223e17c16b602 100644 +--- a/fs/smb/client/smbdirect.c ++++ b/fs/smb/client/smbdirect.c +@@ -2227,7 +2227,7 @@ static int smbd_iter_to_mr(struct smbd_connection *info, + + memset(sgt->sgl, 0, max_sg * sizeof(struct scatterlist)); + +- ret = netfs_extract_iter_to_sg(iter, iov_iter_count(iter), sgt, max_sg, 0); ++ ret = extract_iter_to_sg(iter, iov_iter_count(iter), sgt, max_sg, 0); + WARN_ON(ret < 0); + if (sgt->nents > 0) + sg_mark_end(&sgt->sgl[sgt->nents - 1]); +diff --git a/include/linux/netfs.h b/include/linux/netfs.h +index a1f3522daa698..55e201c3a8416 100644 +--- a/include/linux/netfs.h ++++ b/include/linux/netfs.h +@@ -301,9 +301,9 @@ ssize_t netfs_extract_user_iter(struct iov_iter *orig, size_t orig_len, + struct iov_iter *new, + iov_iter_extraction_t extraction_flags); + struct sg_table; +-ssize_t netfs_extract_iter_to_sg(struct iov_iter *iter, size_t len, +- struct sg_table *sgtable, unsigned int sg_max, +- iov_iter_extraction_t extraction_flags); ++ssize_t extract_iter_to_sg(struct iov_iter *iter, size_t len, ++ struct sg_table *sgtable, unsigned int sg_max, ++ iov_iter_extraction_t extraction_flags); + + /** + * netfs_inode - Get the netfs inode context from the inode +-- +2.40.1 + diff --git a/queue-6.4/dt-bindings-input-goodix-add-goodix-no-reset-during-.patch b/queue-6.4/dt-bindings-input-goodix-add-goodix-no-reset-during-.patch new file mode 100644 index 00000000000..7968dce7761 --- /dev/null +++ b/queue-6.4/dt-bindings-input-goodix-add-goodix-no-reset-during-.patch @@ -0,0 +1,54 @@ +From 41f5760d0ecf573670ba0bbef8d2183835f767d1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 May 2023 11:42:36 +0800 +Subject: dt-bindings: input: goodix: Add "goodix,no-reset-during-suspend" + property + +From: Fei Shao + +[ Upstream commit 359ed24a0dd3802e703ec8071dc3b6ed446de5f0 ] + +We observed that on Chromebook device Steelix, if Goodix GT7375P +touchscreen is powered in suspend (because, for example, it connects to +an always-on regulator) and with the reset GPIO asserted, it will +introduce about 14mW power leakage. + +To address that, we add this property to skip reset during suspend. +If it's set, the driver will stop asserting the reset GPIO during +power-down. Refer to the comments in the driver for details. + +Signed-off-by: Fei Shao +Suggested-by: Jeff LaBundy +Reviewed-by: Douglas Anderson +Reviewed-by: Matthias Brugger +Reviewed-by: Jeff LaBundy +Acked-by: Rob Herring +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + .../devicetree/bindings/input/goodix,gt7375p.yaml | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/Documentation/devicetree/bindings/input/goodix,gt7375p.yaml b/Documentation/devicetree/bindings/input/goodix,gt7375p.yaml +index ce18d7dadae23..1edad1da1196d 100644 +--- a/Documentation/devicetree/bindings/input/goodix,gt7375p.yaml ++++ b/Documentation/devicetree/bindings/input/goodix,gt7375p.yaml +@@ -43,6 +43,15 @@ properties: + itself as long as it allows the main board to make signals compatible + with what the touchscreen is expecting for its IO rails. + ++ goodix,no-reset-during-suspend: ++ description: ++ Set this to true to enforce the driver to not assert the reset GPIO ++ during suspend. ++ Due to potential touchscreen hardware flaw, back-powering could happen in ++ suspend if the power supply is on and with active-low reset GPIO asserted. ++ This property is used to avoid the back-powering issue. ++ type: boolean ++ + required: + - compatible + - reg +-- +2.40.1 + diff --git a/queue-6.4/firewire-net-fix-use-after-free-in-fwnet_finish_inco.patch b/queue-6.4/firewire-net-fix-use-after-free-in-fwnet_finish_inco.patch new file mode 100644 index 00000000000..b684f9936fe --- /dev/null +++ b/queue-6.4/firewire-net-fix-use-after-free-in-fwnet_finish_inco.patch @@ -0,0 +1,53 @@ +From ed566c2be37495268f13acf2e1d1f8e33564fdde Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jun 2023 13:39:35 +0800 +Subject: firewire: net: fix use after free in fwnet_finish_incoming_packet() + +From: Zhang Shurong + +[ Upstream commit 3ff256751a2853e1ffaa36958ff933ccc98c6cb5 ] + +The netif_rx() function frees the skb so we can't dereference it to +save the skb->len. + +Signed-off-by: Zhang Shurong +Link: https://lore.kernel.org/r/tencent_3B3D24B66ED66A6BB73CC0E63C6A14E45109@qq.com +Signed-off-by: Takashi Sakamoto +Signed-off-by: Sasha Levin +--- + drivers/firewire/net.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/firewire/net.c b/drivers/firewire/net.c +index 538bd677c254a..7a4d1a478e33e 100644 +--- a/drivers/firewire/net.c ++++ b/drivers/firewire/net.c +@@ -479,7 +479,7 @@ static int fwnet_finish_incoming_packet(struct net_device *net, + struct sk_buff *skb, u16 source_node_id, + bool is_broadcast, u16 ether_type) + { +- int status; ++ int status, len; + + switch (ether_type) { + case ETH_P_ARP: +@@ -533,13 +533,15 @@ static int fwnet_finish_incoming_packet(struct net_device *net, + } + skb->protocol = protocol; + } ++ ++ len = skb->len; + status = netif_rx(skb); + if (status == NET_RX_DROP) { + net->stats.rx_errors++; + net->stats.rx_dropped++; + } else { + net->stats.rx_packets++; +- net->stats.rx_bytes += skb->len; ++ net->stats.rx_bytes += len; + } + + return 0; +-- +2.40.1 + diff --git a/queue-6.4/fix-a-couple-of-spelling-mistakes.patch b/queue-6.4/fix-a-couple-of-spelling-mistakes.patch new file mode 100644 index 00000000000..21f9135b991 --- /dev/null +++ b/queue-6.4/fix-a-couple-of-spelling-mistakes.patch @@ -0,0 +1,64 @@ +From 36848ca44a59cd8fb1deb8201e01dd7bda4940dc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Jun 2023 14:08:48 +0100 +Subject: Fix a couple of spelling mistakes + +From: David Howells + +[ Upstream commit 3b9e9f72badfbb03415459126498d524bcb25225 ] + +Fix a couple of spelling mistakes in a comment. + +Suggested-by: Simon Horman +Link: https://lore.kernel.org/r/ZHH2mSRqeL4Gs1ft@corigine.com/ +Link: https://lore.kernel.org/r/ZHH1nqZWOGzxlidT@corigine.com/ +Signed-off-by: David Howells +Reviewed-by: Simon Horman +cc: Jeff Layton +cc: Steve French +cc: Shyam Prasad N +cc: Rohith Surabattula +cc: Jens Axboe +cc: Herbert Xu +cc: "David S. Miller" +cc: Eric Dumazet +cc: Jakub Kicinski +cc: Paolo Abeni +cc: Matthew Wilcox +cc: linux-crypto@vger.kernel.org +cc: linux-cachefs@redhat.com +cc: linux-cifs@vger.kernel.org +cc: linux-fsdevel@vger.kernel.org +cc: netdev@vger.kernel.org +Signed-off-by: Paolo Abeni +Stable-dep-of: f443fd5af5db ("crypto, cifs: fix error handling in extract_iter_to_sg()") +Signed-off-by: Sasha Levin +--- + fs/netfs/iterator.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/fs/netfs/iterator.c b/fs/netfs/iterator.c +index f8eba3de1a975..f41a37bca1e8b 100644 +--- a/fs/netfs/iterator.c ++++ b/fs/netfs/iterator.c +@@ -312,7 +312,7 @@ static ssize_t extract_xarray_to_sg(struct iov_iter *iter, + } + + /** +- * extract_iter_to_sg - Extract pages from an iterator and add ot an sglist ++ * extract_iter_to_sg - Extract pages from an iterator and add to an sglist + * @iter: The iterator to extract from + * @maxsize: The amount of iterator to copy + * @sgtable: The scatterlist table to fill in +@@ -332,7 +332,7 @@ static ssize_t extract_xarray_to_sg(struct iov_iter *iter, + * @extraction_flags can have ITER_ALLOW_P2PDMA set to request peer-to-peer DMA + * be allowed on the pages extracted. + * +- * If successul, @sgtable->nents is updated to include the number of elements ++ * If successful, @sgtable->nents is updated to include the number of elements + * added and the number of bytes added is returned. @sgtable->orig_nents is + * left unaltered. + * +-- +2.40.1 + diff --git a/queue-6.4/fs-ntfs3-alternative-boot-if-primary-boot-is-corrupt.patch b/queue-6.4/fs-ntfs3-alternative-boot-if-primary-boot-is-corrupt.patch new file mode 100644 index 00000000000..ae4157af6eb --- /dev/null +++ b/queue-6.4/fs-ntfs3-alternative-boot-if-primary-boot-is-corrupt.patch @@ -0,0 +1,220 @@ +From b8b1660dbdd430c2c614fa548491003193a5bb67 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 May 2023 11:56:13 +0400 +Subject: fs/ntfs3: Alternative boot if primary boot is corrupted + +From: Konstantin Komarov + +[ Upstream commit 6a4cd3ea7d771be17177d95ff67d22cfa2a38b50 ] + +Some code refactoring added also. + +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/super.c | 98 +++++++++++++++++++++++++++++++++++------------- + 1 file changed, 71 insertions(+), 27 deletions(-) + +diff --git a/fs/ntfs3/super.c b/fs/ntfs3/super.c +index 5158dd31fd97f..ecf899d571d83 100644 +--- a/fs/ntfs3/super.c ++++ b/fs/ntfs3/super.c +@@ -724,6 +724,8 @@ static int ntfs_init_from_boot(struct super_block *sb, u32 sector_size, + struct MFT_REC *rec; + u16 fn, ao; + u8 cluster_bits; ++ u32 boot_off = 0; ++ const char *hint = "Primary boot"; + + sbi->volume.blocks = dev_size >> PAGE_SHIFT; + +@@ -731,11 +733,12 @@ static int ntfs_init_from_boot(struct super_block *sb, u32 sector_size, + if (!bh) + return -EIO; + ++check_boot: + err = -EINVAL; +- boot = (struct NTFS_BOOT *)bh->b_data; ++ boot = (struct NTFS_BOOT *)Add2Ptr(bh->b_data, boot_off); + + if (memcmp(boot->system_id, "NTFS ", sizeof("NTFS ") - 1)) { +- ntfs_err(sb, "Boot's signature is not NTFS."); ++ ntfs_err(sb, "%s signature is not NTFS.", hint); + goto out; + } + +@@ -748,14 +751,16 @@ static int ntfs_init_from_boot(struct super_block *sb, u32 sector_size, + boot->bytes_per_sector[0]; + if (boot_sector_size < SECTOR_SIZE || + !is_power_of_2(boot_sector_size)) { +- ntfs_err(sb, "Invalid bytes per sector %u.", boot_sector_size); ++ ntfs_err(sb, "%s: invalid bytes per sector %u.", hint, ++ boot_sector_size); + goto out; + } + + /* cluster size: 512, 1K, 2K, 4K, ... 2M */ + sct_per_clst = true_sectors_per_clst(boot); + if ((int)sct_per_clst < 0 || !is_power_of_2(sct_per_clst)) { +- ntfs_err(sb, "Invalid sectors per cluster %u.", sct_per_clst); ++ ntfs_err(sb, "%s: invalid sectors per cluster %u.", hint, ++ sct_per_clst); + goto out; + } + +@@ -771,8 +776,8 @@ static int ntfs_init_from_boot(struct super_block *sb, u32 sector_size, + if (mlcn * sct_per_clst >= sectors || mlcn2 * sct_per_clst >= sectors) { + ntfs_err( + sb, +- "Start of MFT 0x%llx (0x%llx) is out of volume 0x%llx.", +- mlcn, mlcn2, sectors); ++ "%s: start of MFT 0x%llx (0x%llx) is out of volume 0x%llx.", ++ hint, mlcn, mlcn2, sectors); + goto out; + } + +@@ -784,7 +789,7 @@ static int ntfs_init_from_boot(struct super_block *sb, u32 sector_size, + + /* Check MFT record size. */ + if (record_size < SECTOR_SIZE || !is_power_of_2(record_size)) { +- ntfs_err(sb, "Invalid bytes per MFT record %u (%d).", ++ ntfs_err(sb, "%s: invalid bytes per MFT record %u (%d).", hint, + record_size, boot->record_size); + goto out; + } +@@ -801,13 +806,13 @@ static int ntfs_init_from_boot(struct super_block *sb, u32 sector_size, + + /* Check index record size. */ + if (sbi->index_size < SECTOR_SIZE || !is_power_of_2(sbi->index_size)) { +- ntfs_err(sb, "Invalid bytes per index %u(%d).", sbi->index_size, +- boot->index_size); ++ ntfs_err(sb, "%s: invalid bytes per index %u(%d).", hint, ++ sbi->index_size, boot->index_size); + goto out; + } + + if (sbi->index_size > MAXIMUM_BYTES_PER_INDEX) { +- ntfs_err(sb, "Unsupported bytes per index %u.", ++ ntfs_err(sb, "%s: unsupported bytes per index %u.", hint, + sbi->index_size); + goto out; + } +@@ -834,7 +839,7 @@ static int ntfs_init_from_boot(struct super_block *sb, u32 sector_size, + + /* Compare boot's cluster and sector. */ + if (sbi->cluster_size < boot_sector_size) { +- ntfs_err(sb, "Invalid bytes per cluster (%u).", ++ ntfs_err(sb, "%s: invalid bytes per cluster (%u).", hint, + sbi->cluster_size); + goto out; + } +@@ -930,7 +935,46 @@ static int ntfs_init_from_boot(struct super_block *sb, u32 sector_size, + + err = 0; + ++ if (bh->b_blocknr && !sb_rdonly(sb)) { ++ /* ++ * Alternative boot is ok but primary is not ok. ++ * Update primary boot. ++ */ ++ struct buffer_head *bh0 = sb_getblk(sb, 0); ++ if (bh0) { ++ if (buffer_locked(bh0)) ++ __wait_on_buffer(bh0); ++ ++ lock_buffer(bh0); ++ memcpy(bh0->b_data, boot, sizeof(*boot)); ++ set_buffer_uptodate(bh0); ++ mark_buffer_dirty(bh0); ++ unlock_buffer(bh0); ++ if (!sync_dirty_buffer(bh0)) ++ ntfs_warn(sb, "primary boot is updated"); ++ put_bh(bh0); ++ } ++ } ++ + out: ++ if (err == -EINVAL && !bh->b_blocknr && dev_size > PAGE_SHIFT) { ++ u32 block_size = min_t(u32, sector_size, PAGE_SIZE); ++ u64 lbo = dev_size - sizeof(*boot); ++ ++ /* ++ * Try alternative boot (last sector) ++ */ ++ brelse(bh); ++ ++ sb_set_blocksize(sb, block_size); ++ bh = ntfs_bread(sb, lbo >> blksize_bits(block_size)); ++ if (!bh) ++ return -EINVAL; ++ ++ boot_off = lbo & (block_size - 1); ++ hint = "Alternative boot"; ++ goto check_boot; ++ } + brelse(bh); + + return err; +@@ -955,6 +999,7 @@ static int ntfs_fill_super(struct super_block *sb, struct fs_context *fc) + struct ATTR_DEF_ENTRY *t; + u16 *shared; + struct MFT_REF ref; ++ bool ro = sb_rdonly(sb); + + ref.high = 0; + +@@ -1035,6 +1080,10 @@ static int ntfs_fill_super(struct super_block *sb, struct fs_context *fc) + sbi->volume.minor_ver = info->minor_ver; + sbi->volume.flags = info->flags; + sbi->volume.ni = ni; ++ if (info->flags & VOLUME_FLAG_DIRTY) { ++ sbi->volume.real_dirty = true; ++ ntfs_info(sb, "It is recommened to use chkdsk."); ++ } + + /* Load $MFTMirr to estimate recs_mirr. */ + ref.low = cpu_to_le32(MFT_REC_MIRR); +@@ -1069,21 +1118,16 @@ static int ntfs_fill_super(struct super_block *sb, struct fs_context *fc) + + iput(inode); + +- if (sbi->flags & NTFS_FLAGS_NEED_REPLAY) { +- if (!sb_rdonly(sb)) { +- ntfs_warn(sb, +- "failed to replay log file. Can't mount rw!"); +- err = -EINVAL; +- goto out; +- } +- } else if (sbi->volume.flags & VOLUME_FLAG_DIRTY) { +- if (!sb_rdonly(sb) && !options->force) { +- ntfs_warn( +- sb, +- "volume is dirty and \"force\" flag is not set!"); +- err = -EINVAL; +- goto out; +- } ++ if ((sbi->flags & NTFS_FLAGS_NEED_REPLAY) && !ro) { ++ ntfs_warn(sb, "failed to replay log file. Can't mount rw!"); ++ err = -EINVAL; ++ goto out; ++ } ++ ++ if ((sbi->volume.flags & VOLUME_FLAG_DIRTY) && !ro && !options->force) { ++ ntfs_warn(sb, "volume is dirty and \"force\" flag is not set!"); ++ err = -EINVAL; ++ goto out; + } + + /* Load $MFT. */ +@@ -1173,7 +1217,7 @@ static int ntfs_fill_super(struct super_block *sb, struct fs_context *fc) + + bad_len += len; + bad_frags += 1; +- if (sb_rdonly(sb)) ++ if (ro) + continue; + + if (wnd_set_used_safe(&sbi->used.bitmap, lcn, len, &tt) || tt) { +-- +2.40.1 + diff --git a/queue-6.4/fs-ntfs3-enhance-sanity-check-while-generating-attr_.patch b/queue-6.4/fs-ntfs3-enhance-sanity-check-while-generating-attr_.patch new file mode 100644 index 00000000000..cf4d042dc35 --- /dev/null +++ b/queue-6.4/fs-ntfs3-enhance-sanity-check-while-generating-attr_.patch @@ -0,0 +1,199 @@ +From 35e92aecbed5d1fc40e311a7e9743d9a9ec1876a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Mar 2023 10:56:55 +0800 +Subject: fs/ntfs3: Enhance sanity check while generating attr_list + +From: Edward Lo + +[ Upstream commit fdec309c7672cbee4dc0229ee4cbb33c948a1bdd ] + +ni_create_attr_list uses WARN_ON to catch error cases while generating +attribute list, which only prints out stack trace and may not be enough. +This repalces them with more proper error handling flow. + +[ 59.666332] BUG: kernel NULL pointer dereference, address: 000000000000000e +[ 59.673268] #PF: supervisor read access in kernel mode +[ 59.678354] #PF: error_code(0x0000) - not-present page +[ 59.682831] PGD 8000000005ff1067 P4D 8000000005ff1067 PUD 7dee067 PMD 0 +[ 59.688556] Oops: 0000 [#1] PREEMPT SMP KASAN PTI +[ 59.692642] CPU: 0 PID: 198 Comm: poc Tainted: G B W 6.2.0-rc1+ #4 +[ 59.698868] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 +[ 59.708795] RIP: 0010:ni_create_attr_list+0x505/0x860 +[ 59.713657] Code: 7e 10 e8 5e d0 d0 ff 45 0f b7 76 10 48 8d 7b 16 e8 00 d1 d0 ff 66 44 89 73 16 4d 8d 75 0e 4c 89 f7 e8 3f d0 d0 ff 4c 8d8 +[ 59.731559] RSP: 0018:ffff88800a56f1e0 EFLAGS: 00010282 +[ 59.735691] RAX: 0000000000000001 RBX: ffff88800b7b5088 RCX: ffffffffb83079fe +[ 59.741792] RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffffffffbb7f9fc0 +[ 59.748423] RBP: ffff88800a56f3a8 R08: ffff88800b7b50a0 R09: fffffbfff76ff3f9 +[ 59.754654] R10: ffffffffbb7f9fc7 R11: fffffbfff76ff3f8 R12: ffff88800b756180 +[ 59.761552] R13: 0000000000000000 R14: 000000000000000e R15: 0000000000000050 +[ 59.768323] FS: 00007feaa8c96440(0000) GS:ffff88806d400000(0000) knlGS:0000000000000000 +[ 59.776027] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 59.781395] CR2: 00007f3a2e0b1000 CR3: 000000000a5bc000 CR4: 00000000000006f0 +[ 59.787607] Call Trace: +[ 59.790271] +[ 59.792488] ? __pfx_ni_create_attr_list+0x10/0x10 +[ 59.797235] ? kernel_text_address+0xd3/0xe0 +[ 59.800856] ? unwind_get_return_address+0x3e/0x60 +[ 59.805101] ? __kasan_check_write+0x18/0x20 +[ 59.809296] ? preempt_count_sub+0x1c/0xd0 +[ 59.813421] ni_ins_attr_ext+0x52c/0x5c0 +[ 59.817034] ? __pfx_ni_ins_attr_ext+0x10/0x10 +[ 59.821926] ? __vfs_setxattr+0x121/0x170 +[ 59.825718] ? __vfs_setxattr_noperm+0x97/0x300 +[ 59.829562] ? __vfs_setxattr_locked+0x145/0x170 +[ 59.833987] ? vfs_setxattr+0x137/0x2a0 +[ 59.836732] ? do_setxattr+0xce/0x150 +[ 59.839807] ? setxattr+0x126/0x140 +[ 59.842353] ? path_setxattr+0x164/0x180 +[ 59.845275] ? __x64_sys_setxattr+0x71/0x90 +[ 59.848838] ? do_syscall_64+0x3f/0x90 +[ 59.851898] ? entry_SYSCALL_64_after_hwframe+0x72/0xdc +[ 59.857046] ? stack_depot_save+0x17/0x20 +[ 59.860299] ni_insert_attr+0x1ba/0x420 +[ 59.863104] ? __pfx_ni_insert_attr+0x10/0x10 +[ 59.867069] ? preempt_count_sub+0x1c/0xd0 +[ 59.869897] ? _raw_spin_unlock_irqrestore+0x2b/0x50 +[ 59.874088] ? __create_object+0x3ae/0x5d0 +[ 59.877865] ni_insert_resident+0xc4/0x1c0 +[ 59.881430] ? __pfx_ni_insert_resident+0x10/0x10 +[ 59.886355] ? kasan_save_alloc_info+0x1f/0x30 +[ 59.891117] ? __kasan_kmalloc+0x8b/0xa0 +[ 59.894383] ntfs_set_ea+0x90d/0xbf0 +[ 59.897703] ? __pfx_ntfs_set_ea+0x10/0x10 +[ 59.901011] ? kernel_text_address+0xd3/0xe0 +[ 59.905308] ? __kernel_text_address+0x16/0x50 +[ 59.909811] ? unwind_get_return_address+0x3e/0x60 +[ 59.914898] ? __pfx_stack_trace_consume_entry+0x10/0x10 +[ 59.920250] ? arch_stack_walk+0xa2/0x100 +[ 59.924560] ? filter_irq_stacks+0x27/0x80 +[ 59.928722] ntfs_setxattr+0x405/0x440 +[ 59.932512] ? __pfx_ntfs_setxattr+0x10/0x10 +[ 59.936634] ? kvmalloc_node+0x2d/0x120 +[ 59.940378] ? kasan_save_stack+0x41/0x60 +[ 59.943870] ? kasan_save_stack+0x2a/0x60 +[ 59.947719] ? kasan_set_track+0x29/0x40 +[ 59.951417] ? kasan_save_alloc_info+0x1f/0x30 +[ 59.955733] ? __kasan_kmalloc+0x8b/0xa0 +[ 59.959598] ? __kmalloc_node+0x68/0x150 +[ 59.963163] ? kvmalloc_node+0x2d/0x120 +[ 59.966490] ? vmemdup_user+0x2b/0xa0 +[ 59.969060] __vfs_setxattr+0x121/0x170 +[ 59.972456] ? __pfx___vfs_setxattr+0x10/0x10 +[ 59.976008] __vfs_setxattr_noperm+0x97/0x300 +[ 59.981562] __vfs_setxattr_locked+0x145/0x170 +[ 59.986100] vfs_setxattr+0x137/0x2a0 +[ 59.989964] ? __pfx_vfs_setxattr+0x10/0x10 +[ 59.993616] ? __kasan_check_write+0x18/0x20 +[ 59.997425] do_setxattr+0xce/0x150 +[ 60.000304] setxattr+0x126/0x140 +[ 60.002967] ? __pfx_setxattr+0x10/0x10 +[ 60.006471] ? __virt_addr_valid+0xcb/0x140 +[ 60.010461] ? __call_rcu_common.constprop.0+0x1c7/0x330 +[ 60.016037] ? debug_smp_processor_id+0x1b/0x30 +[ 60.021008] ? kasan_quarantine_put+0x5b/0x190 +[ 60.025545] ? putname+0x84/0xa0 +[ 60.027910] ? __kasan_slab_free+0x11e/0x1b0 +[ 60.031483] ? putname+0x84/0xa0 +[ 60.033986] ? preempt_count_sub+0x1c/0xd0 +[ 60.036876] ? __mnt_want_write+0xae/0x100 +[ 60.040738] ? mnt_want_write+0x8f/0x150 +[ 60.044317] path_setxattr+0x164/0x180 +[ 60.048096] ? __pfx_path_setxattr+0x10/0x10 +[ 60.052096] ? strncpy_from_user+0x175/0x1c0 +[ 60.056482] ? debug_smp_processor_id+0x1b/0x30 +[ 60.059848] ? fpregs_assert_state_consistent+0x6b/0x80 +[ 60.064557] __x64_sys_setxattr+0x71/0x90 +[ 60.068892] do_syscall_64+0x3f/0x90 +[ 60.072868] entry_SYSCALL_64_after_hwframe+0x72/0xdc +[ 60.077523] RIP: 0033:0x7feaa86e4469 +[ 60.080915] Code: 00 f3 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 088 +[ 60.097353] RSP: 002b:00007ffdbd8311e8 EFLAGS: 00000286 ORIG_RAX: 00000000000000bc +[ 60.103386] RAX: ffffffffffffffda RBX: 9461c5e290baac00 RCX: 00007feaa86e4469 +[ 60.110322] RDX: 00007ffdbd831fe0 RSI: 00007ffdbd831305 RDI: 00007ffdbd831263 +[ 60.116808] RBP: 00007ffdbd836180 R08: 0000000000000001 R09: 00007ffdbd836268 +[ 60.123879] R10: 000000000000007d R11: 0000000000000286 R12: 0000000000400500 +[ 60.130540] R13: 00007ffdbd836260 R14: 0000000000000000 R15: 0000000000000000 +[ 60.136553] +[ 60.138818] Modules linked in: +[ 60.141839] CR2: 000000000000000e +[ 60.144831] ---[ end trace 0000000000000000 ]--- +[ 60.149058] RIP: 0010:ni_create_attr_list+0x505/0x860 +[ 60.153975] Code: 7e 10 e8 5e d0 d0 ff 45 0f b7 76 10 48 8d 7b 16 e8 00 d1 d0 ff 66 44 89 73 16 4d 8d 75 0e 4c 89 f7 e8 3f d0 d0 ff 4c 8d8 +[ 60.172443] RSP: 0018:ffff88800a56f1e0 EFLAGS: 00010282 +[ 60.176246] RAX: 0000000000000001 RBX: ffff88800b7b5088 RCX: ffffffffb83079fe +[ 60.182752] RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffffffffbb7f9fc0 +[ 60.189949] RBP: ffff88800a56f3a8 R08: ffff88800b7b50a0 R09: fffffbfff76ff3f9 +[ 60.196950] R10: ffffffffbb7f9fc7 R11: fffffbfff76ff3f8 R12: ffff88800b756180 +[ 60.203671] R13: 0000000000000000 R14: 000000000000000e R15: 0000000000000050 +[ 60.209595] FS: 00007feaa8c96440(0000) GS:ffff88806d400000(0000) knlGS:0000000000000000 +[ 60.216299] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 60.222276] CR2: 00007f3a2e0b1000 CR3: 000000000a5bc000 CR4: 00000000000006f0 + +Signed-off-by: Edward Lo +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/frecord.c | 16 +++++++++++----- + 1 file changed, 11 insertions(+), 5 deletions(-) + +diff --git a/fs/ntfs3/frecord.c b/fs/ntfs3/frecord.c +index 2bfcf1a989c95..50214b77c6a35 100644 +--- a/fs/ntfs3/frecord.c ++++ b/fs/ntfs3/frecord.c +@@ -874,6 +874,7 @@ int ni_create_attr_list(struct ntfs_inode *ni) + if (err) + goto out1; + ++ err = -EINVAL; + /* Call mi_remove_attr() in reverse order to keep pointers 'arr_move' valid. */ + while (to_free > 0) { + struct ATTRIB *b = arr_move[--nb]; +@@ -882,7 +883,8 @@ int ni_create_attr_list(struct ntfs_inode *ni) + + attr = mi_insert_attr(mi, b->type, Add2Ptr(b, name_off), + b->name_len, asize, name_off); +- WARN_ON(!attr); ++ if (!attr) ++ goto out1; + + mi_get_ref(mi, &le_b[nb]->ref); + le_b[nb]->id = attr->id; +@@ -892,17 +894,20 @@ int ni_create_attr_list(struct ntfs_inode *ni) + attr->id = le_b[nb]->id; + + /* Remove from primary record. */ +- WARN_ON(!mi_remove_attr(NULL, &ni->mi, b)); ++ if (!mi_remove_attr(NULL, &ni->mi, b)) ++ goto out1; + + if (to_free <= asize) + break; + to_free -= asize; +- WARN_ON(!nb); ++ if (!nb) ++ goto out1; + } + + attr = mi_insert_attr(&ni->mi, ATTR_LIST, NULL, 0, + lsize + SIZEOF_RESIDENT, SIZEOF_RESIDENT); +- WARN_ON(!attr); ++ if (!attr) ++ goto out1; + + attr->non_res = 0; + attr->flags = 0; +@@ -922,9 +927,10 @@ int ni_create_attr_list(struct ntfs_inode *ni) + kfree(ni->attr_list.le); + ni->attr_list.le = NULL; + ni->attr_list.size = 0; ++ return err; + + out: +- return err; ++ return 0; + } + + /* +-- +2.40.1 + diff --git a/queue-6.4/fs-ntfs3-fix-possible-null-pointer-dereferences-in-m.patch b/queue-6.4/fs-ntfs3-fix-possible-null-pointer-dereferences-in-m.patch new file mode 100644 index 00000000000..75bf35c9a9e --- /dev/null +++ b/queue-6.4/fs-ntfs3-fix-possible-null-pointer-dereferences-in-m.patch @@ -0,0 +1,62 @@ +From d3124c15130ec06d9295613b4933220bc83ffab7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Mar 2023 21:22:11 +0800 +Subject: fs: ntfs3: Fix possible null-pointer dereferences in mi_read() + +From: Jia-Ju Bai + +[ Upstream commit 97498cd610c0d030a7bd49a7efad974790661162 ] + +In a previous commit 2681631c2973 ("fs/ntfs3: Add null pointer check to +attr_load_runs_vcn"), ni can be NULL in attr_load_runs_vcn(), and thus it +should be checked before being used. + +However, in the call stack of this commit, mft_ni in mi_read() is +aliased with ni in attr_load_runs_vcn(), and it is also used in +mi_read() at two places: + +mi_read() + rw_lock = &mft_ni->file.run_lock -> No check + attr_load_runs_vcn(mft_ni, ...) + ni (namely mft_ni) is checked in the previous commit + attr_load_runs_vcn(..., &mft_ni->file.run) -> No check + +Thus, to avoid possible null-pointer dereferences, the related checks +should be added. + +These bugs are reported by a static analysis tool implemented by myself, +and they are found by extending a known bug fixed in the previous commit. +Thus, they could be theoretical bugs. + +Signed-off-by: Jia-Ju Bai +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/record.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/fs/ntfs3/record.c b/fs/ntfs3/record.c +index 2a281cead2bcc..7060f784c2d72 100644 +--- a/fs/ntfs3/record.c ++++ b/fs/ntfs3/record.c +@@ -124,7 +124,7 @@ int mi_read(struct mft_inode *mi, bool is_mft) + struct rw_semaphore *rw_lock = NULL; + + if (is_mounted(sbi)) { +- if (!is_mft) { ++ if (!is_mft && mft_ni) { + rw_lock = &mft_ni->file.run_lock; + down_read(rw_lock); + } +@@ -148,7 +148,7 @@ int mi_read(struct mft_inode *mi, bool is_mft) + ni_lock(mft_ni); + down_write(rw_lock); + } +- err = attr_load_runs_vcn(mft_ni, ATTR_DATA, NULL, 0, &mft_ni->file.run, ++ err = attr_load_runs_vcn(mft_ni, ATTR_DATA, NULL, 0, run, + vbo >> sbi->cluster_bits); + if (rw_lock) { + up_write(rw_lock); +-- +2.40.1 + diff --git a/queue-6.4/fs-ntfs3-mark-ntfs-dirty-when-on-disk-struct-is-corr.patch b/queue-6.4/fs-ntfs3-mark-ntfs-dirty-when-on-disk-struct-is-corr.patch new file mode 100644 index 00000000000..18dc349375b --- /dev/null +++ b/queue-6.4/fs-ntfs3-mark-ntfs-dirty-when-on-disk-struct-is-corr.patch @@ -0,0 +1,81 @@ +From 5cf79e0661746899c2ff4720d1f64ad18af61110 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 May 2023 11:36:28 +0400 +Subject: fs/ntfs3: Mark ntfs dirty when on-disk struct is corrupted + +From: Konstantin Komarov + +[ Upstream commit e0f363a98830e8d7d70fbaf91c07ae0b7c57aafe ] + +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/fsntfs.c | 2 +- + fs/ntfs3/index.c | 6 ++++++ + fs/ntfs3/ntfs_fs.h | 2 ++ + fs/ntfs3/record.c | 6 ++++++ + 4 files changed, 15 insertions(+), 1 deletion(-) + +diff --git a/fs/ntfs3/fsntfs.c b/fs/ntfs3/fsntfs.c +index 28cc421102e59..21567e58265c4 100644 +--- a/fs/ntfs3/fsntfs.c ++++ b/fs/ntfs3/fsntfs.c +@@ -178,7 +178,7 @@ int ntfs_fix_post_read(struct NTFS_RECORD_HEADER *rhdr, size_t bytes, + /* Check errors. */ + if ((fo & 1) || fo + fn * sizeof(short) > SECTOR_SIZE || !fn-- || + fn * SECTOR_SIZE > bytes) { +- return -EINVAL; /* Native chkntfs returns ok! */ ++ return -E_NTFS_CORRUPT; + } + + /* Get fixup pointer. */ +diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c +index 0a48d2d672198..b40da258e6848 100644 +--- a/fs/ntfs3/index.c ++++ b/fs/ntfs3/index.c +@@ -1113,6 +1113,12 @@ int indx_read(struct ntfs_index *indx, struct ntfs_inode *ni, CLST vbn, + *node = in; + + out: ++ if (err == -E_NTFS_CORRUPT) { ++ ntfs_inode_err(&ni->vfs_inode, "directory corrupted"); ++ ntfs_set_state(ni->mi.sbi, NTFS_DIRTY_ERROR); ++ err = -EINVAL; ++ } ++ + if (ib != in->index) + kfree(ib); + +diff --git a/fs/ntfs3/ntfs_fs.h b/fs/ntfs3/ntfs_fs.h +index eb01f7e76479a..2e4be773728df 100644 +--- a/fs/ntfs3/ntfs_fs.h ++++ b/fs/ntfs3/ntfs_fs.h +@@ -53,6 +53,8 @@ enum utf16_endian; + #define E_NTFS_NONRESIDENT 556 + /* NTFS specific error code about punch hole. */ + #define E_NTFS_NOTALIGNED 557 ++/* NTFS specific error code when on-disk struct is corrupted. */ ++#define E_NTFS_CORRUPT 558 + + + /* sbi->flags */ +diff --git a/fs/ntfs3/record.c b/fs/ntfs3/record.c +index 7060f784c2d72..7974ca35a15c6 100644 +--- a/fs/ntfs3/record.c ++++ b/fs/ntfs3/record.c +@@ -180,6 +180,12 @@ int mi_read(struct mft_inode *mi, bool is_mft) + return 0; + + out: ++ if (err == -E_NTFS_CORRUPT) { ++ ntfs_err(sbi->sb, "mft corrupted"); ++ ntfs_set_state(sbi, NTFS_DIRTY_ERROR); ++ err = -EINVAL; ++ } ++ + return err; + } + +-- +2.40.1 + diff --git a/queue-6.4/fs-ntfs3-return-error-for-inconsistent-extended-attr.patch b/queue-6.4/fs-ntfs3-return-error-for-inconsistent-extended-attr.patch new file mode 100644 index 00000000000..d52000661a8 --- /dev/null +++ b/queue-6.4/fs-ntfs3-return-error-for-inconsistent-extended-attr.patch @@ -0,0 +1,107 @@ +From 6b2e0ad191522458d156449c5eefa5b5178b74ec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Mar 2023 18:23:03 +0800 +Subject: fs/ntfs3: Return error for inconsistent extended attributes + +From: Edward Lo + +[ Upstream commit c9db0ff04649aa0b45f497183c957fe260f229f6 ] + +ntfs_read_ea is called when we want to read extended attributes. There +are some sanity checks for the validity of the EAs. However, it fails to +return a proper error code for the inconsistent attributes, which might +lead to unpredicted memory accesses after return. + +[ 138.916927] BUG: KASAN: use-after-free in ntfs_set_ea+0x453/0xbf0 +[ 138.923876] Write of size 4 at addr ffff88800205cfac by task poc/199 +[ 138.931132] +[ 138.933016] CPU: 0 PID: 199 Comm: poc Not tainted 6.2.0-rc1+ #4 +[ 138.938070] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 +[ 138.947327] Call Trace: +[ 138.949557] +[ 138.951539] dump_stack_lvl+0x4d/0x67 +[ 138.956834] print_report+0x16f/0x4a6 +[ 138.960798] ? ntfs_set_ea+0x453/0xbf0 +[ 138.964437] ? kasan_complete_mode_report_info+0x7d/0x200 +[ 138.969793] ? ntfs_set_ea+0x453/0xbf0 +[ 138.973523] kasan_report+0xb8/0x140 +[ 138.976740] ? ntfs_set_ea+0x453/0xbf0 +[ 138.980578] __asan_store4+0x76/0xa0 +[ 138.984669] ntfs_set_ea+0x453/0xbf0 +[ 138.988115] ? __pfx_ntfs_set_ea+0x10/0x10 +[ 138.993390] ? kernel_text_address+0xd3/0xe0 +[ 138.998270] ? __kernel_text_address+0x16/0x50 +[ 139.002121] ? unwind_get_return_address+0x3e/0x60 +[ 139.005659] ? __pfx_stack_trace_consume_entry+0x10/0x10 +[ 139.010177] ? arch_stack_walk+0xa2/0x100 +[ 139.013657] ? filter_irq_stacks+0x27/0x80 +[ 139.017018] ntfs_setxattr+0x405/0x440 +[ 139.022151] ? __pfx_ntfs_setxattr+0x10/0x10 +[ 139.026569] ? kvmalloc_node+0x2d/0x120 +[ 139.030329] ? kasan_save_stack+0x41/0x60 +[ 139.033883] ? kasan_save_stack+0x2a/0x60 +[ 139.037338] ? kasan_set_track+0x29/0x40 +[ 139.040163] ? kasan_save_alloc_info+0x1f/0x30 +[ 139.043588] ? __kasan_kmalloc+0x8b/0xa0 +[ 139.047255] ? __kmalloc_node+0x68/0x150 +[ 139.051264] ? kvmalloc_node+0x2d/0x120 +[ 139.055301] ? vmemdup_user+0x2b/0xa0 +[ 139.058584] __vfs_setxattr+0x121/0x170 +[ 139.062617] ? __pfx___vfs_setxattr+0x10/0x10 +[ 139.066282] __vfs_setxattr_noperm+0x97/0x300 +[ 139.070061] __vfs_setxattr_locked+0x145/0x170 +[ 139.073580] vfs_setxattr+0x137/0x2a0 +[ 139.076641] ? __pfx_vfs_setxattr+0x10/0x10 +[ 139.080223] ? __kasan_check_write+0x18/0x20 +[ 139.084234] do_setxattr+0xce/0x150 +[ 139.087768] setxattr+0x126/0x140 +[ 139.091250] ? __pfx_setxattr+0x10/0x10 +[ 139.094948] ? __virt_addr_valid+0xcb/0x140 +[ 139.097838] ? __call_rcu_common.constprop.0+0x1c7/0x330 +[ 139.102688] ? debug_smp_processor_id+0x1b/0x30 +[ 139.105985] ? kasan_quarantine_put+0x5b/0x190 +[ 139.109980] ? putname+0x84/0xa0 +[ 139.113886] ? __kasan_slab_free+0x11e/0x1b0 +[ 139.117961] ? putname+0x84/0xa0 +[ 139.121316] ? preempt_count_sub+0x1c/0xd0 +[ 139.124427] ? __mnt_want_write+0xae/0x100 +[ 139.127836] ? mnt_want_write+0x8f/0x150 +[ 139.130954] path_setxattr+0x164/0x180 +[ 139.133998] ? __pfx_path_setxattr+0x10/0x10 +[ 139.137853] ? __pfx_ksys_pwrite64+0x10/0x10 +[ 139.141299] ? debug_smp_processor_id+0x1b/0x30 +[ 139.145714] ? fpregs_assert_state_consistent+0x6b/0x80 +[ 139.150796] __x64_sys_setxattr+0x71/0x90 +[ 139.155407] do_syscall_64+0x3f/0x90 +[ 139.159035] entry_SYSCALL_64_after_hwframe+0x72/0xdc +[ 139.163843] RIP: 0033:0x7f108cae4469 +[ 139.166481] Code: 00 f3 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 088 +[ 139.183764] RSP: 002b:00007fff87588388 EFLAGS: 00000286 ORIG_RAX: 00000000000000bc +[ 139.190657] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f108cae4469 +[ 139.196586] RDX: 00007fff875883b0 RSI: 00007fff875883d1 RDI: 00007fff875883b6 +[ 139.201716] RBP: 00007fff8758c530 R08: 0000000000000001 R09: 00007fff8758c618 +[ 139.207940] R10: 0000000000000006 R11: 0000000000000286 R12: 00000000004004c0 +[ 139.214007] R13: 00007fff8758c610 R14: 0000000000000000 R15: 0000000000000000 + +Signed-off-by: Edward Lo +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/xattr.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/ntfs3/xattr.c b/fs/ntfs3/xattr.c +index fd02fcf4d4091..26787c2bbf758 100644 +--- a/fs/ntfs3/xattr.c ++++ b/fs/ntfs3/xattr.c +@@ -141,6 +141,7 @@ static int ntfs_read_ea(struct ntfs_inode *ni, struct EA_FULL **ea, + + memset(Add2Ptr(ea_p, size), 0, add_bytes); + ++ err = -EINVAL; + /* Check all attributes for consistency. */ + for (off = 0; off < size; off += ea_size) { + const struct EA_FULL *ef = Add2Ptr(ea_p, off); +-- +2.40.1 + diff --git a/queue-6.4/gfs2-fix-possible-data-races-in-gfs2_show_options.patch b/queue-6.4/gfs2-fix-possible-data-races-in-gfs2_show_options.patch new file mode 100644 index 00000000000..1ce1091d643 --- /dev/null +++ b/queue-6.4/gfs2-fix-possible-data-races-in-gfs2_show_options.patch @@ -0,0 +1,86 @@ +From e11852e64c887cd15947de90f0b56fe48c5f86ad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Jun 2023 11:06:37 +0800 +Subject: gfs2: Fix possible data races in gfs2_show_options() + +From: Tuo Li + +[ Upstream commit 6fa0a72cbbe45db4ed967a51f9e6f4e3afe61d20 ] + +Some fields such as gt_logd_secs of the struct gfs2_tune are accessed +without holding the lock gt_spin in gfs2_show_options(): + + val = sdp->sd_tune.gt_logd_secs; + if (val != 30) + seq_printf(s, ",commit=%d", val); + +And thus can cause data races when gfs2_show_options() and other functions +such as gfs2_reconfigure() are concurrently executed: + + spin_lock(>->gt_spin); + gt->gt_logd_secs = newargs->ar_commit; + +To fix these possible data races, the lock sdp->sd_tune.gt_spin is +acquired before accessing the fields of gfs2_tune and released after these +accesses. + +Further changes by Andreas: + +- Don't hold the spin lock over the seq_printf operations. + +Reported-by: BassCheck +Signed-off-by: Tuo Li +Signed-off-by: Andreas Gruenbacher +Signed-off-by: Sasha Levin +--- + fs/gfs2/super.c | 26 +++++++++++++++----------- + 1 file changed, 15 insertions(+), 11 deletions(-) + +diff --git a/fs/gfs2/super.c b/fs/gfs2/super.c +index a84bf6444bba9..204ba7f8417e6 100644 +--- a/fs/gfs2/super.c ++++ b/fs/gfs2/super.c +@@ -1004,7 +1004,14 @@ static int gfs2_show_options(struct seq_file *s, struct dentry *root) + { + struct gfs2_sbd *sdp = root->d_sb->s_fs_info; + struct gfs2_args *args = &sdp->sd_args; +- int val; ++ unsigned int logd_secs, statfs_slow, statfs_quantum, quota_quantum; ++ ++ spin_lock(&sdp->sd_tune.gt_spin); ++ logd_secs = sdp->sd_tune.gt_logd_secs; ++ quota_quantum = sdp->sd_tune.gt_quota_quantum; ++ statfs_quantum = sdp->sd_tune.gt_statfs_quantum; ++ statfs_slow = sdp->sd_tune.gt_statfs_slow; ++ spin_unlock(&sdp->sd_tune.gt_spin); + + if (is_ancestor(root, sdp->sd_master_dir)) + seq_puts(s, ",meta"); +@@ -1059,17 +1066,14 @@ static int gfs2_show_options(struct seq_file *s, struct dentry *root) + } + if (args->ar_discard) + seq_puts(s, ",discard"); +- val = sdp->sd_tune.gt_logd_secs; +- if (val != 30) +- seq_printf(s, ",commit=%d", val); +- val = sdp->sd_tune.gt_statfs_quantum; +- if (val != 30) +- seq_printf(s, ",statfs_quantum=%d", val); +- else if (sdp->sd_tune.gt_statfs_slow) ++ if (logd_secs != 30) ++ seq_printf(s, ",commit=%d", logd_secs); ++ if (statfs_quantum != 30) ++ seq_printf(s, ",statfs_quantum=%d", statfs_quantum); ++ else if (statfs_slow) + seq_puts(s, ",statfs_quantum=0"); +- val = sdp->sd_tune.gt_quota_quantum; +- if (val != 60) +- seq_printf(s, ",quota_quantum=%d", val); ++ if (quota_quantum != 60) ++ seq_printf(s, ",quota_quantum=%d", quota_quantum); + if (args->ar_statfs_percent) + seq_printf(s, ",statfs_percent=%d", args->ar_statfs_percent); + if (args->ar_errors != GFS2_ERRORS_DEFAULT) { +-- +2.40.1 + diff --git a/queue-6.4/hid-i2c-hid-goodix-add-support-for-goodix-no-reset-d.patch b/queue-6.4/hid-i2c-hid-goodix-add-support-for-goodix-no-reset-d.patch new file mode 100644 index 00000000000..3e1aeecba64 --- /dev/null +++ b/queue-6.4/hid-i2c-hid-goodix-add-support-for-goodix-no-reset-d.patch @@ -0,0 +1,97 @@ +From c493df85647fd95d2d5d31be82ca778295e42832 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 May 2023 11:42:37 +0800 +Subject: HID: i2c-hid: goodix: Add support for + "goodix,no-reset-during-suspend" property + +From: Fei Shao + +[ Upstream commit 7607f12ba735f04e0ef8718dabadf3a765c9a477 ] + +In the beginning, commit 18eeef46d359 ("HID: i2c-hid: goodix: Tie the +reset line to true state of the regulator") introduced a change to tie +the reset line of the Goodix touchscreen to the state of the regulator +to fix a power leakage issue in suspend. + +After some time, the change was deemed unnecessary and was reverted in +commit 557e05fa9fdd ("HID: i2c-hid: goodix: Stop tying the reset line to +the regulator") due to difficulties in managing regulator notifiers for +designs like Evoker, which provides a second power rail to touchscreen. + +However, the revert caused a power regression on another Chromebook +device Steelix in the field, which has a dedicated always-on regulator +for touchscreen and was covered by the workaround in the first commit. + +To address both cases, this patch adds the support for the new +"goodix,no-reset-during-suspend" property in the driver: +- When set to true, the driver does not assert the reset GPIO during + power-down. + Instead, the GPIO will be asserted during power-up to ensure the + touchscreen always has a clean start and consistent behavior after + resuming. + This is for designs with a dedicated always-on regulator. +- When set to false or unset, the driver uses the original control flow + and asserts GPIO and disables regulators normally. + This is for the two-regulator and shared-regulator designs. + +Signed-off-by: Fei Shao +Suggested-by: Douglas Anderson +Reviewed-by: Douglas Anderson +Reviewed-by: Jeff LaBundy +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/i2c-hid/i2c-hid-of-goodix.c | 16 +++++++++++++++- + 1 file changed, 15 insertions(+), 1 deletion(-) + +diff --git a/drivers/hid/i2c-hid/i2c-hid-of-goodix.c b/drivers/hid/i2c-hid/i2c-hid-of-goodix.c +index 0060e3dcd775d..db4639db98407 100644 +--- a/drivers/hid/i2c-hid/i2c-hid-of-goodix.c ++++ b/drivers/hid/i2c-hid/i2c-hid-of-goodix.c +@@ -28,6 +28,7 @@ struct i2c_hid_of_goodix { + struct regulator *vdd; + struct regulator *vddio; + struct gpio_desc *reset_gpio; ++ bool no_reset_during_suspend; + const struct goodix_i2c_hid_timing_data *timings; + }; + +@@ -37,6 +38,14 @@ static int goodix_i2c_hid_power_up(struct i2chid_ops *ops) + container_of(ops, struct i2c_hid_of_goodix, ops); + int ret; + ++ /* ++ * We assert reset GPIO here (instead of during power-down) to ensure ++ * the device will have a clean state after powering up, just like the ++ * normal scenarios will have. ++ */ ++ if (ihid_goodix->no_reset_during_suspend) ++ gpiod_set_value_cansleep(ihid_goodix->reset_gpio, 1); ++ + ret = regulator_enable(ihid_goodix->vdd); + if (ret) + return ret; +@@ -60,7 +69,9 @@ static void goodix_i2c_hid_power_down(struct i2chid_ops *ops) + struct i2c_hid_of_goodix *ihid_goodix = + container_of(ops, struct i2c_hid_of_goodix, ops); + +- gpiod_set_value_cansleep(ihid_goodix->reset_gpio, 1); ++ if (!ihid_goodix->no_reset_during_suspend) ++ gpiod_set_value_cansleep(ihid_goodix->reset_gpio, 1); ++ + regulator_disable(ihid_goodix->vddio); + regulator_disable(ihid_goodix->vdd); + } +@@ -91,6 +102,9 @@ static int i2c_hid_of_goodix_probe(struct i2c_client *client) + if (IS_ERR(ihid_goodix->vddio)) + return PTR_ERR(ihid_goodix->vddio); + ++ ihid_goodix->no_reset_during_suspend = ++ of_property_read_bool(client->dev.of_node, "goodix,no-reset-during-suspend"); ++ + ihid_goodix->timings = device_get_match_data(&client->dev); + + return i2c_hid_core_probe(client, &ihid_goodix->ops, 0x0001, 0); +-- +2.40.1 + diff --git a/queue-6.4/hid-intel-ish-hid-ipc-add-arrow-lake-pci-device-id.patch b/queue-6.4/hid-intel-ish-hid-ipc-add-arrow-lake-pci-device-id.patch new file mode 100644 index 00000000000..0a713d42a80 --- /dev/null +++ b/queue-6.4/hid-intel-ish-hid-ipc-add-arrow-lake-pci-device-id.patch @@ -0,0 +1,47 @@ +From 697bb700360c41b691082cd5a7048e7c325cb746 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Jun 2023 08:26:41 +0800 +Subject: HID: intel-ish-hid: ipc: Add Arrow Lake PCI device ID + +From: Even Xu + +[ Upstream commit 4982126e3029cd59fbd1da0d9cc0365a0585fe64 ] + +Add device ID of Arrow Lake-H into ishtp support list. + +Signed-off-by: Even Xu +Acked-by: Srinivas Pandruvada +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/intel-ish-hid/ipc/hw-ish.h | 1 + + drivers/hid/intel-ish-hid/ipc/pci-ish.c | 1 + + 2 files changed, 2 insertions(+) + +diff --git a/drivers/hid/intel-ish-hid/ipc/hw-ish.h b/drivers/hid/intel-ish-hid/ipc/hw-ish.h +index fc108f19a64c3..e99f3a3c65e15 100644 +--- a/drivers/hid/intel-ish-hid/ipc/hw-ish.h ++++ b/drivers/hid/intel-ish-hid/ipc/hw-ish.h +@@ -33,6 +33,7 @@ + #define ADL_N_DEVICE_ID 0x54FC + #define RPL_S_DEVICE_ID 0x7A78 + #define MTL_P_DEVICE_ID 0x7E45 ++#define ARL_H_DEVICE_ID 0x7745 + + #define REVISION_ID_CHT_A0 0x6 + #define REVISION_ID_CHT_Ax_SI 0x0 +diff --git a/drivers/hid/intel-ish-hid/ipc/pci-ish.c b/drivers/hid/intel-ish-hid/ipc/pci-ish.c +index 7120b30ac51d0..55cb25038e632 100644 +--- a/drivers/hid/intel-ish-hid/ipc/pci-ish.c ++++ b/drivers/hid/intel-ish-hid/ipc/pci-ish.c +@@ -44,6 +44,7 @@ static const struct pci_device_id ish_pci_tbl[] = { + {PCI_DEVICE(PCI_VENDOR_ID_INTEL, ADL_N_DEVICE_ID)}, + {PCI_DEVICE(PCI_VENDOR_ID_INTEL, RPL_S_DEVICE_ID)}, + {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MTL_P_DEVICE_ID)}, ++ {PCI_DEVICE(PCI_VENDOR_ID_INTEL, ARL_H_DEVICE_ID)}, + {0, } + }; + MODULE_DEVICE_TABLE(pci, ish_pci_tbl); +-- +2.40.1 + diff --git a/queue-6.4/hid-logitech-hidpp-add-usb-and-bluetooth-ids-for-the.patch b/queue-6.4/hid-logitech-hidpp-add-usb-and-bluetooth-ids-for-the.patch new file mode 100644 index 00000000000..d314fe4f6b5 --- /dev/null +++ b/queue-6.4/hid-logitech-hidpp-add-usb-and-bluetooth-ids-for-the.patch @@ -0,0 +1,46 @@ +From daa523917c9a6301641253c38c08c00354276258 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 May 2023 15:44:28 +0100 +Subject: HID: logitech-hidpp: Add USB and Bluetooth IDs for the Logitech G915 + TKL Keyboard + +From: stuarthayhurst + +[ Upstream commit 48aea8b445c422a372cf15915101035a47105421 ] + +Adds the USB and Bluetooth IDs for the Logitech G915 TKL keyboard, for device detection +For this device, this provides battery reporting on top of hid-generic + +Reviewed-by: Bastien Nocera +Signed-off-by: Stuart Hayhurst +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-logitech-hidpp.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c +index f7e06d433a915..dfe8e09a18de0 100644 +--- a/drivers/hid/hid-logitech-hidpp.c ++++ b/drivers/hid/hid-logitech-hidpp.c +@@ -4608,6 +4608,8 @@ static const struct hid_device_id hidpp_devices[] = { + HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC086) }, + { /* Logitech G903 Hero Gaming Mouse over USB */ + HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC091) }, ++ { /* Logitech G915 TKL Keyboard over USB */ ++ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC343) }, + { /* Logitech G920 Wheel over USB */ + HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_G920_WHEEL), + .driver_data = HIDPP_QUIRK_CLASS_G920 | HIDPP_QUIRK_FORCE_OUTPUT_REPORTS}, +@@ -4630,6 +4632,8 @@ static const struct hid_device_id hidpp_devices[] = { + { /* MX5500 keyboard over Bluetooth */ + HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, 0xb30b), + .driver_data = HIDPP_QUIRK_HIDPP_CONSUMER_VENDOR_KEYS }, ++ { /* Logitech G915 TKL keyboard over Bluetooth */ ++ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, 0xb35f) }, + { /* M-RCQ142 V470 Cordless Laser Mouse over Bluetooth */ + HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, 0xb008) }, + { /* MX Master mouse over Bluetooth */ +-- +2.40.1 + diff --git a/queue-6.4/iommu-amd-introduce-disable-irte-caching-support.patch b/queue-6.4/iommu-amd-introduce-disable-irte-caching-support.patch new file mode 100644 index 00000000000..7055c09658e --- /dev/null +++ b/queue-6.4/iommu-amd-introduce-disable-irte-caching-support.patch @@ -0,0 +1,165 @@ +From bba94e8fb748e2333fbf61ebc97a4fc43f319992 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 May 2023 10:11:35 -0400 +Subject: iommu/amd: Introduce Disable IRTE Caching Support + +From: Suravee Suthikulpanit + +[ Upstream commit 66419036f68a838c00cbccacd6cb2e99da6e5710 ] + +An Interrupt Remapping Table (IRT) stores interrupt remapping configuration +for each device. In a normal operation, the AMD IOMMU caches the table +to optimize subsequent data accesses. This requires the IOMMU driver to +invalidate IRT whenever it updates the table. The invalidation process +includes issuing an INVALIDATE_INTERRUPT_TABLE command following by +a COMPLETION_WAIT command. + +However, there are cases in which the IRT is updated at a high rate. +For example, for IOMMU AVIC, the IRTE[IsRun] bit is updated on every +vcpu scheduling (i.e. amd_iommu_update_ga()). On system with large +amount of vcpus and VFIO PCI pass-through devices, the invalidation +process could potentially become a performance bottleneck. + +Introducing a new kernel boot option: + + amd_iommu=irtcachedis + +which disables IRTE caching by setting the IRTCachedis bit in each IOMMU +Control register, and bypass the IRT invalidation process. + +Reviewed-by: Jerry Snitselaar +Co-developed-by: Alejandro Jimenez +Signed-off-by: Alejandro Jimenez +Signed-off-by: Suravee Suthikulpanit +Link: https://lore.kernel.org/r/20230530141137.14376-4-suravee.suthikulpanit@amd.com +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + .../admin-guide/kernel-parameters.txt | 1 + + drivers/iommu/amd/amd_iommu_types.h | 4 +++ + drivers/iommu/amd/init.c | 36 +++++++++++++++++++ + 3 files changed, 41 insertions(+) + +diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt +index a8fc0eb6fb1d6..7323911931828 100644 +--- a/Documentation/admin-guide/kernel-parameters.txt ++++ b/Documentation/admin-guide/kernel-parameters.txt +@@ -323,6 +323,7 @@ + option with care. + pgtbl_v1 - Use v1 page table for DMA-API (Default). + pgtbl_v2 - Use v2 page table for DMA-API. ++ irtcachedis - Disable Interrupt Remapping Table (IRT) caching. + + amd_iommu_dump= [HW,X86-64] + Enable AMD IOMMU driver option to dump the ACPI table +diff --git a/drivers/iommu/amd/amd_iommu_types.h b/drivers/iommu/amd/amd_iommu_types.h +index 2ddbda3a43746..5a224e244be8a 100644 +--- a/drivers/iommu/amd/amd_iommu_types.h ++++ b/drivers/iommu/amd/amd_iommu_types.h +@@ -174,6 +174,7 @@ + #define CONTROL_GAINT_EN 29 + #define CONTROL_XT_EN 50 + #define CONTROL_INTCAPXT_EN 51 ++#define CONTROL_IRTCACHEDIS 59 + #define CONTROL_SNPAVIC_EN 61 + + #define CTRL_INV_TO_MASK (7 << CONTROL_INV_TIMEOUT) +@@ -716,6 +717,9 @@ struct amd_iommu { + /* if one, we need to send a completion wait command */ + bool need_sync; + ++ /* true if disable irte caching */ ++ bool irtcachedis_enabled; ++ + /* Handle for IOMMU core code */ + struct iommu_device iommu; + +diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c +index c2d80a4e5fb06..02846299af0ef 100644 +--- a/drivers/iommu/amd/init.c ++++ b/drivers/iommu/amd/init.c +@@ -162,6 +162,7 @@ static int amd_iommu_xt_mode = IRQ_REMAP_XAPIC_MODE; + static bool amd_iommu_detected; + static bool amd_iommu_disabled __initdata; + static bool amd_iommu_force_enable __initdata; ++static bool amd_iommu_irtcachedis; + static int amd_iommu_target_ivhd_type; + + /* Global EFR and EFR2 registers */ +@@ -484,6 +485,9 @@ static void iommu_disable(struct amd_iommu *iommu) + + /* Disable IOMMU hardware itself */ + iommu_feature_disable(iommu, CONTROL_IOMMU_EN); ++ ++ /* Clear IRTE cache disabling bit */ ++ iommu_feature_disable(iommu, CONTROL_IRTCACHEDIS); + } + + /* +@@ -2710,6 +2714,33 @@ static void iommu_enable_ga(struct amd_iommu *iommu) + #endif + } + ++static void iommu_disable_irtcachedis(struct amd_iommu *iommu) ++{ ++ iommu_feature_disable(iommu, CONTROL_IRTCACHEDIS); ++} ++ ++static void iommu_enable_irtcachedis(struct amd_iommu *iommu) ++{ ++ u64 ctrl; ++ ++ if (!amd_iommu_irtcachedis) ++ return; ++ ++ /* ++ * Note: ++ * The support for IRTCacheDis feature is dertermined by ++ * checking if the bit is writable. ++ */ ++ iommu_feature_enable(iommu, CONTROL_IRTCACHEDIS); ++ ctrl = readq(iommu->mmio_base + MMIO_CONTROL_OFFSET); ++ ctrl &= (1ULL << CONTROL_IRTCACHEDIS); ++ if (ctrl) ++ iommu->irtcachedis_enabled = true; ++ pr_info("iommu%d (%#06x) : IRT cache is %s\n", ++ iommu->index, iommu->devid, ++ iommu->irtcachedis_enabled ? "disabled" : "enabled"); ++} ++ + static void early_enable_iommu(struct amd_iommu *iommu) + { + iommu_disable(iommu); +@@ -2720,6 +2751,7 @@ static void early_enable_iommu(struct amd_iommu *iommu) + iommu_set_exclusion_range(iommu); + iommu_enable_ga(iommu); + iommu_enable_xt(iommu); ++ iommu_enable_irtcachedis(iommu); + iommu_enable(iommu); + iommu_flush_all_caches(iommu); + } +@@ -2770,10 +2802,12 @@ static void early_enable_iommus(void) + for_each_iommu(iommu) { + iommu_disable_command_buffer(iommu); + iommu_disable_event_buffer(iommu); ++ iommu_disable_irtcachedis(iommu); + iommu_enable_command_buffer(iommu); + iommu_enable_event_buffer(iommu); + iommu_enable_ga(iommu); + iommu_enable_xt(iommu); ++ iommu_enable_irtcachedis(iommu); + iommu_set_device_table(iommu); + iommu_flush_all_caches(iommu); + } +@@ -3426,6 +3460,8 @@ static int __init parse_amd_iommu_options(char *str) + amd_iommu_pgtable = AMD_IOMMU_V1; + } else if (strncmp(str, "pgtbl_v2", 8) == 0) { + amd_iommu_pgtable = AMD_IOMMU_V2; ++ } else if (strncmp(str, "irtcachedis", 11) == 0) { ++ amd_iommu_irtcachedis = true; + } else { + pr_notice("Unknown option - '%s'\n", str); + } +-- +2.40.1 + diff --git a/queue-6.4/iopoll-call-cpu_relax-in-busy-loops.patch b/queue-6.4/iopoll-call-cpu_relax-in-busy-loops.patch new file mode 100644 index 00000000000..c5bd2392a83 --- /dev/null +++ b/queue-6.4/iopoll-call-cpu_relax-in-busy-loops.patch @@ -0,0 +1,77 @@ +From 13b1c6f4d115c70fb1aab11c7b7969712c60208a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Jun 2023 10:50:36 +0200 +Subject: iopoll: Call cpu_relax() in busy loops + +From: Geert Uytterhoeven + +[ Upstream commit b407460ee99033503993ac7437d593451fcdfe44 ] + +It is considered good practice to call cpu_relax() in busy loops, see +Documentation/process/volatile-considered-harmful.rst. This can not +only lower CPU power consumption or yield to a hyperthreaded twin +processor, but also allows an architecture to mitigate hardware issues +(e.g. ARM Erratum 754327 for Cortex-A9 prior to r2p0) in the +architecture-specific cpu_relax() implementation. + +In addition, cpu_relax() is also a compiler barrier. It is not +immediately obvious that the @op argument "function" will result in an +actual function call (e.g. in case of inlining). + +Where a function call is a C sequence point, this is lost on inlining. +Therefore, with agressive enough optimization it might be possible for +the compiler to hoist the: + + (val) = op(args); + +"load" out of the loop because it doesn't see the value changing. The +addition of cpu_relax() would inhibit this. + +As the iopoll helpers lack calls to cpu_relax(), people are sometimes +reluctant to use them, and may fall back to open-coded polling loops +(including cpu_relax() calls) instead. + +Fix this by adding calls to cpu_relax() to the iopoll helpers: + - For the non-atomic case, it is sufficient to call cpu_relax() in + case of a zero sleep-between-reads value, as a call to + usleep_range() is a safe barrier otherwise. However, it doesn't + hurt to add the call regardless, for simplicity, and for similarity + with the atomic case below. + - For the atomic case, cpu_relax() must be called regardless of the + sleep-between-reads value, as there is no guarantee all + architecture-specific implementations of udelay() handle this. + +Signed-off-by: Geert Uytterhoeven +Acked-by: Peter Zijlstra (Intel) +Acked-by: Arnd Bergmann +Reviewed-by: Tony Lindgren +Reviewed-by: Ulf Hansson +Link: https://lore.kernel.org/r/45c87bec3397fdd704376807f0eec5cc71be440f.1685692810.git.geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + include/linux/iopoll.h | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/include/linux/iopoll.h b/include/linux/iopoll.h +index 2c8860e406bd8..0417360a6db9b 100644 +--- a/include/linux/iopoll.h ++++ b/include/linux/iopoll.h +@@ -53,6 +53,7 @@ + } \ + if (__sleep_us) \ + usleep_range((__sleep_us >> 2) + 1, __sleep_us); \ ++ cpu_relax(); \ + } \ + (cond) ? 0 : -ETIMEDOUT; \ + }) +@@ -95,6 +96,7 @@ + } \ + if (__delay_us) \ + udelay(__delay_us); \ ++ cpu_relax(); \ + } \ + (cond) ? 0 : -ETIMEDOUT; \ + }) +-- +2.40.1 + diff --git a/queue-6.4/led-qcom-lpg-fix-resource-leaks-in-for_each_availabl.patch b/queue-6.4/led-qcom-lpg-fix-resource-leaks-in-for_each_availabl.patch new file mode 100644 index 00000000000..d62eda5927f --- /dev/null +++ b/queue-6.4/led-qcom-lpg-fix-resource-leaks-in-for_each_availabl.patch @@ -0,0 +1,51 @@ +From a7a91ea8559a73d1d26794baa5fae34eea5a97a9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 May 2023 19:17:03 +0800 +Subject: led: qcom-lpg: Fix resource leaks in + for_each_available_child_of_node() loops + +From: Lu Hongfei + +[ Upstream commit 8f38f8fa7261819eb7d4fb369dc3bfab72259033 ] + +Ensure child node references are decremented properly in the error path. + +Signed-off-by: Lu Hongfei +Link: https://lore.kernel.org/r/20230525111705.3055-1-luhongfei@vivo.com +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/leds/rgb/leds-qcom-lpg.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/leds/rgb/leds-qcom-lpg.c b/drivers/leds/rgb/leds-qcom-lpg.c +index 1c849814a4917..212df2e3d3502 100644 +--- a/drivers/leds/rgb/leds-qcom-lpg.c ++++ b/drivers/leds/rgb/leds-qcom-lpg.c +@@ -1173,8 +1173,10 @@ static int lpg_add_led(struct lpg *lpg, struct device_node *np) + i = 0; + for_each_available_child_of_node(np, child) { + ret = lpg_parse_channel(lpg, child, &led->channels[i]); +- if (ret < 0) ++ if (ret < 0) { ++ of_node_put(child); + return ret; ++ } + + info[i].color_index = led->channels[i]->color; + info[i].intensity = 0; +@@ -1352,8 +1354,10 @@ static int lpg_probe(struct platform_device *pdev) + + for_each_available_child_of_node(pdev->dev.of_node, np) { + ret = lpg_add_led(lpg, np); +- if (ret) ++ if (ret) { ++ of_node_put(np); + return ret; ++ } + } + + for (i = 0; i < lpg->num_channels; i++) +-- +2.40.1 + diff --git a/queue-6.4/media-camss-set-vfe-bpl_alignment-to-16-for-sdm845-a.patch b/queue-6.4/media-camss-set-vfe-bpl_alignment-to-16-for-sdm845-a.patch new file mode 100644 index 00000000000..ae743519982 --- /dev/null +++ b/queue-6.4/media-camss-set-vfe-bpl_alignment-to-16-for-sdm845-a.patch @@ -0,0 +1,48 @@ +From 1309fa0d6619537a8ca48545fdac191efe8515ac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 May 2023 00:52:35 +0300 +Subject: media: camss: set VFE bpl_alignment to 16 for sdm845 and sm8250 + +From: Andrey Konovalov + +[ Upstream commit d5b7eb477c286f6ceccbb38704136eea0e6b09ca ] + +From the experiments with camera sensors using SGRBG10_1X10/3280x2464 and +SRGGB10_1X10/3280x2464 formats, it becomes clear that on sdm845 and sm8250 +VFE outputs the lines padded to a length multiple of 16 bytes. As in the +current driver the value of the bpl_alignment is set to 8 bytes, the frames +captured in formats with the bytes-per-line value being not a multiple of +16 get corrupted. + +Set the bpl_alignment of the camss video output device to 16 for sdm845 and +sm8250 to fix that. + +Signed-off-by: Andrey Konovalov +Tested-by: Bryan O'Donoghue +Acked-by: Bryan O'Donoghue +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/platform/qcom/camss/camss-vfe.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/platform/qcom/camss/camss-vfe.c b/drivers/media/platform/qcom/camss/camss-vfe.c +index e0832f3f4f25c..06c95568e5af4 100644 +--- a/drivers/media/platform/qcom/camss/camss-vfe.c ++++ b/drivers/media/platform/qcom/camss/camss-vfe.c +@@ -1541,7 +1541,11 @@ int msm_vfe_register_entities(struct vfe_device *vfe, + } + + video_out->ops = &vfe->video_ops; +- video_out->bpl_alignment = 8; ++ if (vfe->camss->version == CAMSS_845 || ++ vfe->camss->version == CAMSS_8250) ++ video_out->bpl_alignment = 16; ++ else ++ video_out->bpl_alignment = 8; + video_out->line_based = 0; + if (i == VFE_LINE_PIX) { + video_out->bpl_alignment = 16; +-- +2.40.1 + diff --git a/queue-6.4/media-platform-mediatek-vpu-fix-null-ptr-dereference.patch b/queue-6.4/media-platform-mediatek-vpu-fix-null-ptr-dereference.patch new file mode 100644 index 00000000000..9a1ccf53bea --- /dev/null +++ b/queue-6.4/media-platform-mediatek-vpu-fix-null-ptr-dereference.patch @@ -0,0 +1,50 @@ +From 83b3e1633736a58278a0ae35d984f1df7b44c908 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 May 2023 13:11:47 +0100 +Subject: media: platform: mediatek: vpu: fix NULL ptr dereference + +From: Hans Verkuil + +[ Upstream commit 3df55cd773e8603b623425cc97b05e542854ad27 ] + +If pdev is NULL, then it is still dereferenced. + +This fixes this smatch warning: + +drivers/media/platform/mediatek/vpu/mtk_vpu.c:570 vpu_load_firmware() warn: address of NULL pointer 'pdev' + +Signed-off-by: Hans Verkuil +Cc: Yunfei Dong +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/mediatek/vpu/mtk_vpu.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/platform/mediatek/vpu/mtk_vpu.c b/drivers/media/platform/mediatek/vpu/mtk_vpu.c +index 5e2bc286f168e..1a95958a1f908 100644 +--- a/drivers/media/platform/mediatek/vpu/mtk_vpu.c ++++ b/drivers/media/platform/mediatek/vpu/mtk_vpu.c +@@ -562,15 +562,17 @@ static int load_requested_vpu(struct mtk_vpu *vpu, + int vpu_load_firmware(struct platform_device *pdev) + { + struct mtk_vpu *vpu; +- struct device *dev = &pdev->dev; ++ struct device *dev; + struct vpu_run *run; + int ret; + + if (!pdev) { +- dev_err(dev, "VPU platform device is invalid\n"); ++ pr_err("VPU platform device is invalid\n"); + return -EINVAL; + } + ++ dev = &pdev->dev; ++ + vpu = platform_get_drvdata(pdev); + run = &vpu->run; + +-- +2.40.1 + diff --git a/queue-6.4/media-v4l2-mem2mem-add-lock-to-protect-parameter-num.patch b/queue-6.4/media-v4l2-mem2mem-add-lock-to-protect-parameter-num.patch new file mode 100644 index 00000000000..3e7c044d13a --- /dev/null +++ b/queue-6.4/media-v4l2-mem2mem-add-lock-to-protect-parameter-num.patch @@ -0,0 +1,69 @@ +From 59b5bb08c117810d28ee6acff5f1c0afd9e8cbec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Apr 2023 16:17:40 +0800 +Subject: media: v4l2-mem2mem: add lock to protect parameter num_rdy +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Yunfei Dong + +[ Upstream commit 56b5c3e67b0f9af3f45cf393be048ee8d8a92694 ] + +Getting below error when using KCSAN to check the driver. Adding lock to +protect parameter num_rdy when getting the value with function: +v4l2_m2m_num_src_bufs_ready/v4l2_m2m_num_dst_bufs_ready. + +kworker/u16:3: [name:report&]BUG: KCSAN: data-race in v4l2_m2m_buf_queue +kworker/u16:3: [name:report&] + +kworker/u16:3: [name:report&]read-write to 0xffffff8105f35b94 of 1 bytes by task 20865 on cpu 7: +kworker/u16:3:  v4l2_m2m_buf_queue+0xd8/0x10c + +Signed-off-by: Pina Chen +Signed-off-by: Yunfei Dong +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + include/media/v4l2-mem2mem.h | 18 ++++++++++++++++-- + 1 file changed, 16 insertions(+), 2 deletions(-) + +diff --git a/include/media/v4l2-mem2mem.h b/include/media/v4l2-mem2mem.h +index bb9de6a899e07..d6c8eb2b52019 100644 +--- a/include/media/v4l2-mem2mem.h ++++ b/include/media/v4l2-mem2mem.h +@@ -593,7 +593,14 @@ void v4l2_m2m_buf_queue(struct v4l2_m2m_ctx *m2m_ctx, + static inline + unsigned int v4l2_m2m_num_src_bufs_ready(struct v4l2_m2m_ctx *m2m_ctx) + { +- return m2m_ctx->out_q_ctx.num_rdy; ++ unsigned int num_buf_rdy; ++ unsigned long flags; ++ ++ spin_lock_irqsave(&m2m_ctx->out_q_ctx.rdy_spinlock, flags); ++ num_buf_rdy = m2m_ctx->out_q_ctx.num_rdy; ++ spin_unlock_irqrestore(&m2m_ctx->out_q_ctx.rdy_spinlock, flags); ++ ++ return num_buf_rdy; + } + + /** +@@ -605,7 +612,14 @@ unsigned int v4l2_m2m_num_src_bufs_ready(struct v4l2_m2m_ctx *m2m_ctx) + static inline + unsigned int v4l2_m2m_num_dst_bufs_ready(struct v4l2_m2m_ctx *m2m_ctx) + { +- return m2m_ctx->cap_q_ctx.num_rdy; ++ unsigned int num_buf_rdy; ++ unsigned long flags; ++ ++ spin_lock_irqsave(&m2m_ctx->cap_q_ctx.rdy_spinlock, flags); ++ num_buf_rdy = m2m_ctx->cap_q_ctx.num_rdy; ++ spin_unlock_irqrestore(&m2m_ctx->cap_q_ctx.rdy_spinlock, flags); ++ ++ return num_buf_rdy; + } + + /** +-- +2.40.1 + diff --git a/queue-6.4/move-netfs_extract_iter_to_sg-to-lib-scatterlist.c.patch b/queue-6.4/move-netfs_extract_iter_to_sg-to-lib-scatterlist.c.patch new file mode 100644 index 00000000000..da748078790 --- /dev/null +++ b/queue-6.4/move-netfs_extract_iter_to_sg-to-lib-scatterlist.c.patch @@ -0,0 +1,630 @@ +From 6ed957095c5beea5dcc0534b994220930e55723d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Jun 2023 14:08:50 +0100 +Subject: Move netfs_extract_iter_to_sg() to lib/scatterlist.c + +From: David Howells + +[ Upstream commit f5f82cd18732d828bcd1ec308c4e8c55012e84b0 ] + +Move netfs_extract_iter_to_sg() to lib/scatterlist.c as it's going to be +used by more than just network filesystems (AF_ALG, for example). + +Signed-off-by: David Howells +cc: Jeff Layton +cc: Steve French +cc: Shyam Prasad N +cc: Rohith Surabattula +cc: Jens Axboe +cc: Herbert Xu +cc: "David S. Miller" +cc: Eric Dumazet +cc: Jakub Kicinski +cc: Paolo Abeni +cc: Matthew Wilcox +cc: linux-crypto@vger.kernel.org +cc: linux-cachefs@redhat.com +cc: linux-cifs@vger.kernel.org +cc: linux-fsdevel@vger.kernel.org +cc: netdev@vger.kernel.org +Signed-off-by: Paolo Abeni +Stable-dep-of: f443fd5af5db ("crypto, cifs: fix error handling in extract_iter_to_sg()") +Signed-off-by: Sasha Levin +--- + fs/netfs/iterator.c | 267 ----------------------------------------- + include/linux/netfs.h | 4 - + include/linux/uio.h | 5 + + lib/scatterlist.c | 269 ++++++++++++++++++++++++++++++++++++++++++ + 4 files changed, 274 insertions(+), 271 deletions(-) + +diff --git a/fs/netfs/iterator.c b/fs/netfs/iterator.c +index 9f09dc30ceb65..2ff07ba655a07 100644 +--- a/fs/netfs/iterator.c ++++ b/fs/netfs/iterator.c +@@ -101,270 +101,3 @@ ssize_t netfs_extract_user_iter(struct iov_iter *orig, size_t orig_len, + return npages; + } + EXPORT_SYMBOL_GPL(netfs_extract_user_iter); +- +-/* +- * Extract and pin a list of up to sg_max pages from UBUF- or IOVEC-class +- * iterators, and add them to the scatterlist. +- */ +-static ssize_t extract_user_to_sg(struct iov_iter *iter, +- ssize_t maxsize, +- struct sg_table *sgtable, +- unsigned int sg_max, +- iov_iter_extraction_t extraction_flags) +-{ +- struct scatterlist *sg = sgtable->sgl + sgtable->nents; +- struct page **pages; +- unsigned int npages; +- ssize_t ret = 0, res; +- size_t len, off; +- +- /* We decant the page list into the tail of the scatterlist */ +- pages = (void *)sgtable->sgl + +- array_size(sg_max, sizeof(struct scatterlist)); +- pages -= sg_max; +- +- do { +- res = iov_iter_extract_pages(iter, &pages, maxsize, sg_max, +- extraction_flags, &off); +- if (res < 0) +- goto failed; +- +- len = res; +- maxsize -= len; +- ret += len; +- npages = DIV_ROUND_UP(off + len, PAGE_SIZE); +- sg_max -= npages; +- +- for (; npages > 0; npages--) { +- struct page *page = *pages; +- size_t seg = min_t(size_t, PAGE_SIZE - off, len); +- +- *pages++ = NULL; +- sg_set_page(sg, page, seg, off); +- sgtable->nents++; +- sg++; +- len -= seg; +- off = 0; +- } +- } while (maxsize > 0 && sg_max > 0); +- +- return ret; +- +-failed: +- while (sgtable->nents > sgtable->orig_nents) +- put_page(sg_page(&sgtable->sgl[--sgtable->nents])); +- return res; +-} +- +-/* +- * Extract up to sg_max pages from a BVEC-type iterator and add them to the +- * scatterlist. The pages are not pinned. +- */ +-static ssize_t extract_bvec_to_sg(struct iov_iter *iter, +- ssize_t maxsize, +- struct sg_table *sgtable, +- unsigned int sg_max, +- iov_iter_extraction_t extraction_flags) +-{ +- const struct bio_vec *bv = iter->bvec; +- struct scatterlist *sg = sgtable->sgl + sgtable->nents; +- unsigned long start = iter->iov_offset; +- unsigned int i; +- ssize_t ret = 0; +- +- for (i = 0; i < iter->nr_segs; i++) { +- size_t off, len; +- +- len = bv[i].bv_len; +- if (start >= len) { +- start -= len; +- continue; +- } +- +- len = min_t(size_t, maxsize, len - start); +- off = bv[i].bv_offset + start; +- +- sg_set_page(sg, bv[i].bv_page, len, off); +- sgtable->nents++; +- sg++; +- sg_max--; +- +- ret += len; +- maxsize -= len; +- if (maxsize <= 0 || sg_max == 0) +- break; +- start = 0; +- } +- +- if (ret > 0) +- iov_iter_advance(iter, ret); +- return ret; +-} +- +-/* +- * Extract up to sg_max pages from a KVEC-type iterator and add them to the +- * scatterlist. This can deal with vmalloc'd buffers as well as kmalloc'd or +- * static buffers. The pages are not pinned. +- */ +-static ssize_t extract_kvec_to_sg(struct iov_iter *iter, +- ssize_t maxsize, +- struct sg_table *sgtable, +- unsigned int sg_max, +- iov_iter_extraction_t extraction_flags) +-{ +- const struct kvec *kv = iter->kvec; +- struct scatterlist *sg = sgtable->sgl + sgtable->nents; +- unsigned long start = iter->iov_offset; +- unsigned int i; +- ssize_t ret = 0; +- +- for (i = 0; i < iter->nr_segs; i++) { +- struct page *page; +- unsigned long kaddr; +- size_t off, len, seg; +- +- len = kv[i].iov_len; +- if (start >= len) { +- start -= len; +- continue; +- } +- +- kaddr = (unsigned long)kv[i].iov_base + start; +- off = kaddr & ~PAGE_MASK; +- len = min_t(size_t, maxsize, len - start); +- kaddr &= PAGE_MASK; +- +- maxsize -= len; +- ret += len; +- do { +- seg = min_t(size_t, len, PAGE_SIZE - off); +- if (is_vmalloc_or_module_addr((void *)kaddr)) +- page = vmalloc_to_page((void *)kaddr); +- else +- page = virt_to_page(kaddr); +- +- sg_set_page(sg, page, len, off); +- sgtable->nents++; +- sg++; +- sg_max--; +- +- len -= seg; +- kaddr += PAGE_SIZE; +- off = 0; +- } while (len > 0 && sg_max > 0); +- +- if (maxsize <= 0 || sg_max == 0) +- break; +- start = 0; +- } +- +- if (ret > 0) +- iov_iter_advance(iter, ret); +- return ret; +-} +- +-/* +- * Extract up to sg_max folios from an XARRAY-type iterator and add them to +- * the scatterlist. The pages are not pinned. +- */ +-static ssize_t extract_xarray_to_sg(struct iov_iter *iter, +- ssize_t maxsize, +- struct sg_table *sgtable, +- unsigned int sg_max, +- iov_iter_extraction_t extraction_flags) +-{ +- struct scatterlist *sg = sgtable->sgl + sgtable->nents; +- struct xarray *xa = iter->xarray; +- struct folio *folio; +- loff_t start = iter->xarray_start + iter->iov_offset; +- pgoff_t index = start / PAGE_SIZE; +- ssize_t ret = 0; +- size_t offset, len; +- XA_STATE(xas, xa, index); +- +- rcu_read_lock(); +- +- xas_for_each(&xas, folio, ULONG_MAX) { +- if (xas_retry(&xas, folio)) +- continue; +- if (WARN_ON(xa_is_value(folio))) +- break; +- if (WARN_ON(folio_test_hugetlb(folio))) +- break; +- +- offset = offset_in_folio(folio, start); +- len = min_t(size_t, maxsize, folio_size(folio) - offset); +- +- sg_set_page(sg, folio_page(folio, 0), len, offset); +- sgtable->nents++; +- sg++; +- sg_max--; +- +- maxsize -= len; +- ret += len; +- if (maxsize <= 0 || sg_max == 0) +- break; +- } +- +- rcu_read_unlock(); +- if (ret > 0) +- iov_iter_advance(iter, ret); +- return ret; +-} +- +-/** +- * extract_iter_to_sg - Extract pages from an iterator and add to an sglist +- * @iter: The iterator to extract from +- * @maxsize: The amount of iterator to copy +- * @sgtable: The scatterlist table to fill in +- * @sg_max: Maximum number of elements in @sgtable that may be filled +- * @extraction_flags: Flags to qualify the request +- * +- * Extract the page fragments from the given amount of the source iterator and +- * add them to a scatterlist that refers to all of those bits, to a maximum +- * addition of @sg_max elements. +- * +- * The pages referred to by UBUF- and IOVEC-type iterators are extracted and +- * pinned; BVEC-, KVEC- and XARRAY-type are extracted but aren't pinned; PIPE- +- * and DISCARD-type are not supported. +- * +- * No end mark is placed on the scatterlist; that's left to the caller. +- * +- * @extraction_flags can have ITER_ALLOW_P2PDMA set to request peer-to-peer DMA +- * be allowed on the pages extracted. +- * +- * If successful, @sgtable->nents is updated to include the number of elements +- * added and the number of bytes added is returned. @sgtable->orig_nents is +- * left unaltered. +- * +- * The iov_iter_extract_mode() function should be used to query how cleanup +- * should be performed. +- */ +-ssize_t extract_iter_to_sg(struct iov_iter *iter, size_t maxsize, +- struct sg_table *sgtable, unsigned int sg_max, +- iov_iter_extraction_t extraction_flags) +-{ +- if (maxsize == 0) +- return 0; +- +- switch (iov_iter_type(iter)) { +- case ITER_UBUF: +- case ITER_IOVEC: +- return extract_user_to_sg(iter, maxsize, sgtable, sg_max, +- extraction_flags); +- case ITER_BVEC: +- return extract_bvec_to_sg(iter, maxsize, sgtable, sg_max, +- extraction_flags); +- case ITER_KVEC: +- return extract_kvec_to_sg(iter, maxsize, sgtable, sg_max, +- extraction_flags); +- case ITER_XARRAY: +- return extract_xarray_to_sg(iter, maxsize, sgtable, sg_max, +- extraction_flags); +- default: +- pr_err("%s(%u) unsupported\n", __func__, iov_iter_type(iter)); +- WARN_ON_ONCE(1); +- return -EIO; +- } +-} +-EXPORT_SYMBOL_GPL(extract_iter_to_sg); +diff --git a/include/linux/netfs.h b/include/linux/netfs.h +index 55e201c3a8416..b11a84f6c32b7 100644 +--- a/include/linux/netfs.h ++++ b/include/linux/netfs.h +@@ -300,10 +300,6 @@ void netfs_stats_show(struct seq_file *); + ssize_t netfs_extract_user_iter(struct iov_iter *orig, size_t orig_len, + struct iov_iter *new, + iov_iter_extraction_t extraction_flags); +-struct sg_table; +-ssize_t extract_iter_to_sg(struct iov_iter *iter, size_t len, +- struct sg_table *sgtable, unsigned int sg_max, +- iov_iter_extraction_t extraction_flags); + + /** + * netfs_inode - Get the netfs inode context from the inode +diff --git a/include/linux/uio.h b/include/linux/uio.h +index 044c1d8c230cf..0ccb983cf645a 100644 +--- a/include/linux/uio.h ++++ b/include/linux/uio.h +@@ -433,4 +433,9 @@ static inline bool iov_iter_extract_will_pin(const struct iov_iter *iter) + return user_backed_iter(iter); + } + ++struct sg_table; ++ssize_t extract_iter_to_sg(struct iov_iter *iter, size_t len, ++ struct sg_table *sgtable, unsigned int sg_max, ++ iov_iter_extraction_t extraction_flags); ++ + #endif +diff --git a/lib/scatterlist.c b/lib/scatterlist.c +index 8d7519a8f308d..e97d7060329e8 100644 +--- a/lib/scatterlist.c ++++ b/lib/scatterlist.c +@@ -9,6 +9,8 @@ + #include + #include + #include ++#include ++#include + + /** + * sg_next - return the next scatterlist entry in a list +@@ -1095,3 +1097,270 @@ size_t sg_zero_buffer(struct scatterlist *sgl, unsigned int nents, + return offset; + } + EXPORT_SYMBOL(sg_zero_buffer); ++ ++/* ++ * Extract and pin a list of up to sg_max pages from UBUF- or IOVEC-class ++ * iterators, and add them to the scatterlist. ++ */ ++static ssize_t extract_user_to_sg(struct iov_iter *iter, ++ ssize_t maxsize, ++ struct sg_table *sgtable, ++ unsigned int sg_max, ++ iov_iter_extraction_t extraction_flags) ++{ ++ struct scatterlist *sg = sgtable->sgl + sgtable->nents; ++ struct page **pages; ++ unsigned int npages; ++ ssize_t ret = 0, res; ++ size_t len, off; ++ ++ /* We decant the page list into the tail of the scatterlist */ ++ pages = (void *)sgtable->sgl + ++ array_size(sg_max, sizeof(struct scatterlist)); ++ pages -= sg_max; ++ ++ do { ++ res = iov_iter_extract_pages(iter, &pages, maxsize, sg_max, ++ extraction_flags, &off); ++ if (res < 0) ++ goto failed; ++ ++ len = res; ++ maxsize -= len; ++ ret += len; ++ npages = DIV_ROUND_UP(off + len, PAGE_SIZE); ++ sg_max -= npages; ++ ++ for (; npages > 0; npages--) { ++ struct page *page = *pages; ++ size_t seg = min_t(size_t, PAGE_SIZE - off, len); ++ ++ *pages++ = NULL; ++ sg_set_page(sg, page, seg, off); ++ sgtable->nents++; ++ sg++; ++ len -= seg; ++ off = 0; ++ } ++ } while (maxsize > 0 && sg_max > 0); ++ ++ return ret; ++ ++failed: ++ while (sgtable->nents > sgtable->orig_nents) ++ put_page(sg_page(&sgtable->sgl[--sgtable->nents])); ++ return res; ++} ++ ++/* ++ * Extract up to sg_max pages from a BVEC-type iterator and add them to the ++ * scatterlist. The pages are not pinned. ++ */ ++static ssize_t extract_bvec_to_sg(struct iov_iter *iter, ++ ssize_t maxsize, ++ struct sg_table *sgtable, ++ unsigned int sg_max, ++ iov_iter_extraction_t extraction_flags) ++{ ++ const struct bio_vec *bv = iter->bvec; ++ struct scatterlist *sg = sgtable->sgl + sgtable->nents; ++ unsigned long start = iter->iov_offset; ++ unsigned int i; ++ ssize_t ret = 0; ++ ++ for (i = 0; i < iter->nr_segs; i++) { ++ size_t off, len; ++ ++ len = bv[i].bv_len; ++ if (start >= len) { ++ start -= len; ++ continue; ++ } ++ ++ len = min_t(size_t, maxsize, len - start); ++ off = bv[i].bv_offset + start; ++ ++ sg_set_page(sg, bv[i].bv_page, len, off); ++ sgtable->nents++; ++ sg++; ++ sg_max--; ++ ++ ret += len; ++ maxsize -= len; ++ if (maxsize <= 0 || sg_max == 0) ++ break; ++ start = 0; ++ } ++ ++ if (ret > 0) ++ iov_iter_advance(iter, ret); ++ return ret; ++} ++ ++/* ++ * Extract up to sg_max pages from a KVEC-type iterator and add them to the ++ * scatterlist. This can deal with vmalloc'd buffers as well as kmalloc'd or ++ * static buffers. The pages are not pinned. ++ */ ++static ssize_t extract_kvec_to_sg(struct iov_iter *iter, ++ ssize_t maxsize, ++ struct sg_table *sgtable, ++ unsigned int sg_max, ++ iov_iter_extraction_t extraction_flags) ++{ ++ const struct kvec *kv = iter->kvec; ++ struct scatterlist *sg = sgtable->sgl + sgtable->nents; ++ unsigned long start = iter->iov_offset; ++ unsigned int i; ++ ssize_t ret = 0; ++ ++ for (i = 0; i < iter->nr_segs; i++) { ++ struct page *page; ++ unsigned long kaddr; ++ size_t off, len, seg; ++ ++ len = kv[i].iov_len; ++ if (start >= len) { ++ start -= len; ++ continue; ++ } ++ ++ kaddr = (unsigned long)kv[i].iov_base + start; ++ off = kaddr & ~PAGE_MASK; ++ len = min_t(size_t, maxsize, len - start); ++ kaddr &= PAGE_MASK; ++ ++ maxsize -= len; ++ ret += len; ++ do { ++ seg = min_t(size_t, len, PAGE_SIZE - off); ++ if (is_vmalloc_or_module_addr((void *)kaddr)) ++ page = vmalloc_to_page((void *)kaddr); ++ else ++ page = virt_to_page(kaddr); ++ ++ sg_set_page(sg, page, len, off); ++ sgtable->nents++; ++ sg++; ++ sg_max--; ++ ++ len -= seg; ++ kaddr += PAGE_SIZE; ++ off = 0; ++ } while (len > 0 && sg_max > 0); ++ ++ if (maxsize <= 0 || sg_max == 0) ++ break; ++ start = 0; ++ } ++ ++ if (ret > 0) ++ iov_iter_advance(iter, ret); ++ return ret; ++} ++ ++/* ++ * Extract up to sg_max folios from an XARRAY-type iterator and add them to ++ * the scatterlist. The pages are not pinned. ++ */ ++static ssize_t extract_xarray_to_sg(struct iov_iter *iter, ++ ssize_t maxsize, ++ struct sg_table *sgtable, ++ unsigned int sg_max, ++ iov_iter_extraction_t extraction_flags) ++{ ++ struct scatterlist *sg = sgtable->sgl + sgtable->nents; ++ struct xarray *xa = iter->xarray; ++ struct folio *folio; ++ loff_t start = iter->xarray_start + iter->iov_offset; ++ pgoff_t index = start / PAGE_SIZE; ++ ssize_t ret = 0; ++ size_t offset, len; ++ XA_STATE(xas, xa, index); ++ ++ rcu_read_lock(); ++ ++ xas_for_each(&xas, folio, ULONG_MAX) { ++ if (xas_retry(&xas, folio)) ++ continue; ++ if (WARN_ON(xa_is_value(folio))) ++ break; ++ if (WARN_ON(folio_test_hugetlb(folio))) ++ break; ++ ++ offset = offset_in_folio(folio, start); ++ len = min_t(size_t, maxsize, folio_size(folio) - offset); ++ ++ sg_set_page(sg, folio_page(folio, 0), len, offset); ++ sgtable->nents++; ++ sg++; ++ sg_max--; ++ ++ maxsize -= len; ++ ret += len; ++ if (maxsize <= 0 || sg_max == 0) ++ break; ++ } ++ ++ rcu_read_unlock(); ++ if (ret > 0) ++ iov_iter_advance(iter, ret); ++ return ret; ++} ++ ++/** ++ * extract_iter_to_sg - Extract pages from an iterator and add to an sglist ++ * @iter: The iterator to extract from ++ * @maxsize: The amount of iterator to copy ++ * @sgtable: The scatterlist table to fill in ++ * @sg_max: Maximum number of elements in @sgtable that may be filled ++ * @extraction_flags: Flags to qualify the request ++ * ++ * Extract the page fragments from the given amount of the source iterator and ++ * add them to a scatterlist that refers to all of those bits, to a maximum ++ * addition of @sg_max elements. ++ * ++ * The pages referred to by UBUF- and IOVEC-type iterators are extracted and ++ * pinned; BVEC-, KVEC- and XARRAY-type are extracted but aren't pinned; PIPE- ++ * and DISCARD-type are not supported. ++ * ++ * No end mark is placed on the scatterlist; that's left to the caller. ++ * ++ * @extraction_flags can have ITER_ALLOW_P2PDMA set to request peer-to-peer DMA ++ * be allowed on the pages extracted. ++ * ++ * If successful, @sgtable->nents is updated to include the number of elements ++ * added and the number of bytes added is returned. @sgtable->orig_nents is ++ * left unaltered. ++ * ++ * The iov_iter_extract_mode() function should be used to query how cleanup ++ * should be performed. ++ */ ++ssize_t extract_iter_to_sg(struct iov_iter *iter, size_t maxsize, ++ struct sg_table *sgtable, unsigned int sg_max, ++ iov_iter_extraction_t extraction_flags) ++{ ++ if (maxsize == 0) ++ return 0; ++ ++ switch (iov_iter_type(iter)) { ++ case ITER_UBUF: ++ case ITER_IOVEC: ++ return extract_user_to_sg(iter, maxsize, sgtable, sg_max, ++ extraction_flags); ++ case ITER_BVEC: ++ return extract_bvec_to_sg(iter, maxsize, sgtable, sg_max, ++ extraction_flags); ++ case ITER_KVEC: ++ return extract_kvec_to_sg(iter, maxsize, sgtable, sg_max, ++ extraction_flags); ++ case ITER_XARRAY: ++ return extract_xarray_to_sg(iter, maxsize, sgtable, sg_max, ++ extraction_flags); ++ default: ++ pr_err("%s(%u) unsupported\n", __func__, iov_iter_type(iter)); ++ WARN_ON_ONCE(1); ++ return -EIO; ++ } ++} ++EXPORT_SYMBOL_GPL(extract_iter_to_sg); +-- +2.40.1 + diff --git a/queue-6.4/net-phy-at803x-fix-the-wol-setting-functions.patch b/queue-6.4/net-phy-at803x-fix-the-wol-setting-functions.patch new file mode 100644 index 00000000000..e0eecd702fa --- /dev/null +++ b/queue-6.4/net-phy-at803x-fix-the-wol-setting-functions.patch @@ -0,0 +1,120 @@ +From 150a606d3cbb3da1f2e1a8cd290726fc3250e977 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Aug 2023 14:13:46 -0500 +Subject: net: phy: at803x: fix the wol setting functions + +From: Li Yang + +[ Upstream commit e58f30246c35c126c7571065b33bee4b3b1d2ef8 ] + +In commit 7beecaf7d507 ("net: phy: at803x: improve the WOL feature"), it +seems not correct to use a wol_en bit in a 1588 Control Register which is +only available on AR8031/AR8033(share the same phy_id) to determine if WoL +is enabled. Change it back to use AT803X_INTR_ENABLE_WOL for determining +the WoL status which is applicable on all chips supporting wol. Also update +the at803x_set_wol() function to only update the 1588 register on chips +having it. After this change, disabling wol at probe from commit +d7cd5e06c9dd ("net: phy: at803x: disable WOL at probe") is no longer +needed. Change it to just disable the WoL bit in 1588 register for +AR8031/AR8033 to be aligned with AT803X_INTR_ENABLE_WOL in probe. + +Fixes: 7beecaf7d507 ("net: phy: at803x: improve the WOL feature") +Signed-off-by: Li Yang +Reviewed-by: Viorel Suman +Reviewed-by: Wei Fang +Reviewed-by: Russell King (Oracle) +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/phy/at803x.c | 45 ++++++++++++++++++++++------------------ + 1 file changed, 25 insertions(+), 20 deletions(-) + +diff --git a/drivers/net/phy/at803x.c b/drivers/net/phy/at803x.c +index b2e1c0655f628..8a77ec33b4172 100644 +--- a/drivers/net/phy/at803x.c ++++ b/drivers/net/phy/at803x.c +@@ -459,21 +459,27 @@ static int at803x_set_wol(struct phy_device *phydev, + phy_write_mmd(phydev, MDIO_MMD_PCS, offsets[i], + mac[(i * 2) + 1] | (mac[(i * 2)] << 8)); + +- /* Enable WOL function */ +- ret = phy_modify_mmd(phydev, MDIO_MMD_PCS, AT803X_PHY_MMD3_WOL_CTRL, +- 0, AT803X_WOL_EN); +- if (ret) +- return ret; ++ /* Enable WOL function for 1588 */ ++ if (phydev->drv->phy_id == ATH8031_PHY_ID) { ++ ret = phy_modify_mmd(phydev, MDIO_MMD_PCS, ++ AT803X_PHY_MMD3_WOL_CTRL, ++ 0, AT803X_WOL_EN); ++ if (ret) ++ return ret; ++ } + /* Enable WOL interrupt */ + ret = phy_modify(phydev, AT803X_INTR_ENABLE, 0, AT803X_INTR_ENABLE_WOL); + if (ret) + return ret; + } else { +- /* Disable WoL function */ +- ret = phy_modify_mmd(phydev, MDIO_MMD_PCS, AT803X_PHY_MMD3_WOL_CTRL, +- AT803X_WOL_EN, 0); +- if (ret) +- return ret; ++ /* Disable WoL function for 1588 */ ++ if (phydev->drv->phy_id == ATH8031_PHY_ID) { ++ ret = phy_modify_mmd(phydev, MDIO_MMD_PCS, ++ AT803X_PHY_MMD3_WOL_CTRL, ++ AT803X_WOL_EN, 0); ++ if (ret) ++ return ret; ++ } + /* Disable WOL interrupt */ + ret = phy_modify(phydev, AT803X_INTR_ENABLE, AT803X_INTR_ENABLE_WOL, 0); + if (ret) +@@ -508,11 +514,11 @@ static void at803x_get_wol(struct phy_device *phydev, + wol->supported = WAKE_MAGIC; + wol->wolopts = 0; + +- value = phy_read_mmd(phydev, MDIO_MMD_PCS, AT803X_PHY_MMD3_WOL_CTRL); ++ value = phy_read(phydev, AT803X_INTR_ENABLE); + if (value < 0) + return; + +- if (value & AT803X_WOL_EN) ++ if (value & AT803X_INTR_ENABLE_WOL) + wol->wolopts |= WAKE_MAGIC; + } + +@@ -858,9 +864,6 @@ static int at803x_probe(struct phy_device *phydev) + if (phydev->drv->phy_id == ATH8031_PHY_ID) { + int ccr = phy_read(phydev, AT803X_REG_CHIP_CONFIG); + int mode_cfg; +- struct ethtool_wolinfo wol = { +- .wolopts = 0, +- }; + + if (ccr < 0) + return ccr; +@@ -877,12 +880,14 @@ static int at803x_probe(struct phy_device *phydev) + break; + } + +- /* Disable WOL by default */ +- ret = at803x_set_wol(phydev, &wol); +- if (ret < 0) { +- phydev_err(phydev, "failed to disable WOL on probe: %d\n", ret); ++ /* Disable WoL in 1588 register which is enabled ++ * by default ++ */ ++ ret = phy_modify_mmd(phydev, MDIO_MMD_PCS, ++ AT803X_PHY_MMD3_WOL_CTRL, ++ AT803X_WOL_EN, 0); ++ if (ret) + return ret; +- } + } + + return 0; +-- +2.40.1 + diff --git a/queue-6.4/net-phy-at803x-use-devm_regulator_get_enable_optiona.patch b/queue-6.4/net-phy-at803x-use-devm_regulator_get_enable_optiona.patch new file mode 100644 index 00000000000..5f3d9ba2779 --- /dev/null +++ b/queue-6.4/net-phy-at803x-use-devm_regulator_get_enable_optiona.patch @@ -0,0 +1,161 @@ +From 7b36946a1ac5bed0a0225ca8311b7720a4736479 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 17 Jun 2023 16:24:37 +0200 +Subject: net: phy: at803x: Use devm_regulator_get_enable_optional() + +From: Christophe JAILLET + +[ Upstream commit 988e8d90b3dc482637532e61bc2d58bfc4af5167 ] + +Use devm_regulator_get_enable_optional() instead of hand writing it. It +saves some line of code. + +Signed-off-by: Christophe JAILLET +Reviewed-by: Andrew Lunn +Signed-off-by: David S. Miller +Stable-dep-of: e58f30246c35 ("net: phy: at803x: fix the wol setting functions") +Signed-off-by: Sasha Levin +--- + drivers/net/phy/at803x.c | 44 +++++++--------------------------------- + 1 file changed, 7 insertions(+), 37 deletions(-) + +diff --git a/drivers/net/phy/at803x.c b/drivers/net/phy/at803x.c +index ef6dc008e4c50..b2e1c0655f628 100644 +--- a/drivers/net/phy/at803x.c ++++ b/drivers/net/phy/at803x.c +@@ -304,7 +304,6 @@ struct at803x_priv { + bool is_1000basex; + struct regulator_dev *vddio_rdev; + struct regulator_dev *vddh_rdev; +- struct regulator *vddio; + u64 stats[ARRAY_SIZE(at803x_hw_stats)]; + }; + +@@ -824,11 +823,11 @@ static int at803x_parse_dt(struct phy_device *phydev) + if (ret < 0) + return ret; + +- priv->vddio = devm_regulator_get_optional(&phydev->mdio.dev, +- "vddio"); +- if (IS_ERR(priv->vddio)) { ++ ret = devm_regulator_get_enable_optional(&phydev->mdio.dev, ++ "vddio"); ++ if (ret) { + phydev_err(phydev, "failed to get VDDIO regulator\n"); +- return PTR_ERR(priv->vddio); ++ return ret; + } + + /* Only AR8031/8033 support 1000Base-X for SFP modules */ +@@ -856,12 +855,6 @@ static int at803x_probe(struct phy_device *phydev) + if (ret) + return ret; + +- if (priv->vddio) { +- ret = regulator_enable(priv->vddio); +- if (ret < 0) +- return ret; +- } +- + if (phydev->drv->phy_id == ATH8031_PHY_ID) { + int ccr = phy_read(phydev, AT803X_REG_CHIP_CONFIG); + int mode_cfg; +@@ -869,10 +862,8 @@ static int at803x_probe(struct phy_device *phydev) + .wolopts = 0, + }; + +- if (ccr < 0) { +- ret = ccr; +- goto err; +- } ++ if (ccr < 0) ++ return ccr; + mode_cfg = ccr & AT803X_MODE_CFG_MASK; + + switch (mode_cfg) { +@@ -890,25 +881,11 @@ static int at803x_probe(struct phy_device *phydev) + ret = at803x_set_wol(phydev, &wol); + if (ret < 0) { + phydev_err(phydev, "failed to disable WOL on probe: %d\n", ret); +- goto err; ++ return ret; + } + } + + return 0; +- +-err: +- if (priv->vddio) +- regulator_disable(priv->vddio); +- +- return ret; +-} +- +-static void at803x_remove(struct phy_device *phydev) +-{ +- struct at803x_priv *priv = phydev->priv; +- +- if (priv->vddio) +- regulator_disable(priv->vddio); + } + + static int at803x_get_features(struct phy_device *phydev) +@@ -2021,7 +1998,6 @@ static struct phy_driver at803x_driver[] = { + .name = "Qualcomm Atheros AR8035", + .flags = PHY_POLL_CABLE_TEST, + .probe = at803x_probe, +- .remove = at803x_remove, + .config_aneg = at803x_config_aneg, + .config_init = at803x_config_init, + .soft_reset = genphy_soft_reset, +@@ -2043,7 +2019,6 @@ static struct phy_driver at803x_driver[] = { + .name = "Qualcomm Atheros AR8030", + .phy_id_mask = AT8030_PHY_ID_MASK, + .probe = at803x_probe, +- .remove = at803x_remove, + .config_init = at803x_config_init, + .link_change_notify = at803x_link_change_notify, + .set_wol = at803x_set_wol, +@@ -2059,7 +2034,6 @@ static struct phy_driver at803x_driver[] = { + .name = "Qualcomm Atheros AR8031/AR8033", + .flags = PHY_POLL_CABLE_TEST, + .probe = at803x_probe, +- .remove = at803x_remove, + .config_init = at803x_config_init, + .config_aneg = at803x_config_aneg, + .soft_reset = genphy_soft_reset, +@@ -2082,7 +2056,6 @@ static struct phy_driver at803x_driver[] = { + PHY_ID_MATCH_EXACT(ATH8032_PHY_ID), + .name = "Qualcomm Atheros AR8032", + .probe = at803x_probe, +- .remove = at803x_remove, + .flags = PHY_POLL_CABLE_TEST, + .config_init = at803x_config_init, + .link_change_notify = at803x_link_change_notify, +@@ -2098,7 +2071,6 @@ static struct phy_driver at803x_driver[] = { + PHY_ID_MATCH_EXACT(ATH9331_PHY_ID), + .name = "Qualcomm Atheros AR9331 built-in PHY", + .probe = at803x_probe, +- .remove = at803x_remove, + .suspend = at803x_suspend, + .resume = at803x_resume, + .flags = PHY_POLL_CABLE_TEST, +@@ -2115,7 +2087,6 @@ static struct phy_driver at803x_driver[] = { + PHY_ID_MATCH_EXACT(QCA9561_PHY_ID), + .name = "Qualcomm Atheros QCA9561 built-in PHY", + .probe = at803x_probe, +- .remove = at803x_remove, + .suspend = at803x_suspend, + .resume = at803x_resume, + .flags = PHY_POLL_CABLE_TEST, +@@ -2181,7 +2152,6 @@ static struct phy_driver at803x_driver[] = { + .name = "Qualcomm QCA8081", + .flags = PHY_POLL_CABLE_TEST, + .probe = at803x_probe, +- .remove = at803x_remove, + .config_intr = at803x_config_intr, + .handle_interrupt = at803x_handle_interrupt, + .get_tunable = at803x_get_tunable, +-- +2.40.1 + diff --git a/queue-6.4/nvme-core-don-t-hold-rcu-read-lock-in-nvme_ns_chr_ur.patch b/queue-6.4/nvme-core-don-t-hold-rcu-read-lock-in-nvme_ns_chr_ur.patch new file mode 100644 index 00000000000..e5498864f25 --- /dev/null +++ b/queue-6.4/nvme-core-don-t-hold-rcu-read-lock-in-nvme_ns_chr_ur.patch @@ -0,0 +1,55 @@ +From f577575976f4800ac8750de557748de91d328e78 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Aug 2023 10:04:40 +0800 +Subject: nvme: core: don't hold rcu read lock in nvme_ns_chr_uring_cmd_iopoll + +From: Ming Lei + +[ Upstream commit a7a7dabb5dd72d2875bc3ce56f94ea5ceb259d5b ] + +Now nvme_ns_chr_uring_cmd_iopoll() has switched to request based io +polling, and the associated NS is guaranteed to be live in case of +io polling, so request is guaranteed to be valid because blk-mq uses +pre-allocated request pool. + +Remove the rcu read lock in nvme_ns_chr_uring_cmd_iopoll(), which +isn't needed any more after switching to request based io polling. + +Fix "BUG: sleeping function called from invalid context" because +set_page_dirty_lock() from blk_rq_unmap_user() may sleep. + +Fixes: 585079b6e425 ("nvme: wire up async polling for io passthrough commands") +Reported-by: Guangwu Zhang +Cc: Kanchan Joshi +Cc: Anuj Gupta +Signed-off-by: Ming Lei +Tested-by: Guangwu Zhang +Link: https://lore.kernel.org/r/20230809020440.174682-1-ming.lei@redhat.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/ioctl.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/nvme/host/ioctl.c b/drivers/nvme/host/ioctl.c +index f15e7330b75ac..642f0310da278 100644 +--- a/drivers/nvme/host/ioctl.c ++++ b/drivers/nvme/host/ioctl.c +@@ -787,14 +787,12 @@ int nvme_ns_chr_uring_cmd_iopoll(struct io_uring_cmd *ioucmd, + struct nvme_ns *ns; + struct request_queue *q; + +- rcu_read_lock(); + bio = READ_ONCE(ioucmd->cookie); + ns = container_of(file_inode(ioucmd->file)->i_cdev, + struct nvme_ns, cdev); + q = ns->queue; + if (test_bit(QUEUE_FLAG_POLL, &q->queue_flags) && bio && bio->bi_bdev) + ret = bio_poll(bio, iob, poll_flags); +- rcu_read_unlock(); + return ret; + } + #ifdef CONFIG_NVME_MULTIPATH +-- +2.40.1 + diff --git a/queue-6.4/pci-tegra194-fix-possible-array-out-of-bounds-access.patch b/queue-6.4/pci-tegra194-fix-possible-array-out-of-bounds-access.patch new file mode 100644 index 00000000000..e25f4a312f7 --- /dev/null +++ b/queue-6.4/pci-tegra194-fix-possible-array-out-of-bounds-access.patch @@ -0,0 +1,66 @@ +From 7b98ebe5132eb14a1740ec9e095015c76159f987 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 May 2023 23:02:09 +0530 +Subject: PCI: tegra194: Fix possible array out of bounds access + +From: Sumit Gupta + +[ Upstream commit 205b3d02d57ce6dce96f6d2b9c230f56a9bf9817 ] + +Add check to fix the possible array out of bounds violation by +making speed equal to GEN1_CORE_CLK_FREQ when its value is more +than the size of "pcie_gen_freq" array. This array has size of +four but possible speed (CLS) values are from "0 to 0xF". So, +"speed - 1" values are "-1 to 0xE". + +Suggested-by: Bjorn Helgaas +Signed-off-by: Sumit Gupta +Link: https://lore.kernel.org/lkml/72b9168b-d4d6-4312-32ea-69358df2f2d0@nvidia.com/ +Acked-by: Lorenzo Pieralisi +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/dwc/pcie-tegra194.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +diff --git a/drivers/pci/controller/dwc/pcie-tegra194.c b/drivers/pci/controller/dwc/pcie-tegra194.c +index 09825b4a075e5..e6eec85480ca9 100644 +--- a/drivers/pci/controller/dwc/pcie-tegra194.c ++++ b/drivers/pci/controller/dwc/pcie-tegra194.c +@@ -223,6 +223,7 @@ + #define EP_STATE_ENABLED 1 + + static const unsigned int pcie_gen_freq[] = { ++ GEN1_CORE_CLK_FREQ, /* PCI_EXP_LNKSTA_CLS == 0; undefined */ + GEN1_CORE_CLK_FREQ, + GEN2_CORE_CLK_FREQ, + GEN3_CORE_CLK_FREQ, +@@ -459,7 +460,11 @@ static irqreturn_t tegra_pcie_ep_irq_thread(int irq, void *arg) + + speed = dw_pcie_readw_dbi(pci, pcie->pcie_cap_base + PCI_EXP_LNKSTA) & + PCI_EXP_LNKSTA_CLS; +- clk_set_rate(pcie->core_clk, pcie_gen_freq[speed - 1]); ++ ++ if (speed >= ARRAY_SIZE(pcie_gen_freq)) ++ speed = 0; ++ ++ clk_set_rate(pcie->core_clk, pcie_gen_freq[speed]); + + if (pcie->of_data->has_ltr_req_fix) + return IRQ_HANDLED; +@@ -1020,7 +1025,11 @@ static int tegra_pcie_dw_start_link(struct dw_pcie *pci) + + speed = dw_pcie_readw_dbi(pci, pcie->pcie_cap_base + PCI_EXP_LNKSTA) & + PCI_EXP_LNKSTA_CLS; +- clk_set_rate(pcie->core_clk, pcie_gen_freq[speed - 1]); ++ ++ if (speed >= ARRAY_SIZE(pcie_gen_freq)) ++ speed = 0; ++ ++ clk_set_rate(pcie->core_clk, pcie_gen_freq[speed]); + + tegra_pcie_enable_interrupts(pp); + +-- +2.40.1 + diff --git a/queue-6.4/pcmcia-rsrc_nonstatic-fix-memory-leak-in-nonstatic_r.patch b/queue-6.4/pcmcia-rsrc_nonstatic-fix-memory-leak-in-nonstatic_r.patch new file mode 100644 index 00000000000..f23a7e91d60 --- /dev/null +++ b/queue-6.4/pcmcia-rsrc_nonstatic-fix-memory-leak-in-nonstatic_r.patch @@ -0,0 +1,66 @@ +From cf7283d8179d4fedd4683b12325975ccf00f0422 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 May 2023 20:45:29 +0200 +Subject: pcmcia: rsrc_nonstatic: Fix memory leak in + nonstatic_release_resource_db() + +From: Armin Wolf + +[ Upstream commit c85fd9422fe0f5d667305efb27f56d09eab120b0 ] + +When nonstatic_release_resource_db() frees all resources associated +with an PCMCIA socket, it forgets to free socket_data too, causing +a memory leak observable with kmemleak: + +unreferenced object 0xc28d1000 (size 64): + comm "systemd-udevd", pid 297, jiffies 4294898478 (age 194.484s) + hex dump (first 32 bytes): + 00 00 00 00 00 00 00 00 f0 85 0e c3 00 00 00 00 ................ + 00 00 00 00 0c 10 8d c2 00 00 00 00 00 00 00 00 ................ + backtrace: + [] __kmem_cache_alloc_node+0x2d7/0x4a0 + [<7e51f0c8>] kmalloc_trace+0x31/0xa4 + [] nonstatic_init+0x24/0x1a4 [pcmcia_rsrc] + [] pcmcia_register_socket+0x200/0x35c [pcmcia_core] + [] yenta_probe+0x4d8/0xa70 [yenta_socket] + [] pci_device_probe+0x99/0x194 + [<84b7c690>] really_probe+0x181/0x45c + [<8060fe6e>] __driver_probe_device+0x75/0x1f4 + [] driver_probe_device+0x28/0xac + [<648b766f>] __driver_attach+0xeb/0x1e4 + [<6e9659eb>] bus_for_each_dev+0x61/0xb4 + [<25a669f3>] driver_attach+0x1e/0x28 + [] bus_add_driver+0x102/0x20c + [] driver_register+0x5b/0x120 + [<942cd8a4>] __pci_register_driver+0x44/0x4c + [] __UNIQUE_ID___addressable_cleanup_module188+0x1c/0xfffff000 [iTCO_vendor_support] + +Fix this by freeing socket_data too. + +Tested on a Acer Travelmate 4002WLMi by manually binding/unbinding +the yenta_cardbus driver (yenta_socket). + +Signed-off-by: Armin Wolf +Message-ID: <20230512184529.5094-1-W_Armin@gmx.de> +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/pcmcia/rsrc_nonstatic.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/pcmcia/rsrc_nonstatic.c b/drivers/pcmcia/rsrc_nonstatic.c +index 471e0c5815f39..bf9d070a44966 100644 +--- a/drivers/pcmcia/rsrc_nonstatic.c ++++ b/drivers/pcmcia/rsrc_nonstatic.c +@@ -1053,6 +1053,8 @@ static void nonstatic_release_resource_db(struct pcmcia_socket *s) + q = p->next; + kfree(p); + } ++ ++ kfree(data); + } + + +-- +2.40.1 + diff --git a/queue-6.4/powerpc-kasan-disable-kcov-in-kasan-code.patch b/queue-6.4/powerpc-kasan-disable-kcov-in-kasan-code.patch new file mode 100644 index 00000000000..8fcabaafe84 --- /dev/null +++ b/queue-6.4/powerpc-kasan-disable-kcov-in-kasan-code.patch @@ -0,0 +1,40 @@ +From 02214200a85d6628a8b521d4459e972a96c1c834 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Jul 2023 14:41:43 +1000 +Subject: powerpc/kasan: Disable KCOV in KASAN code + +From: Benjamin Gray + +[ Upstream commit ccb381e1af1ace292153c88eb1fffa5683d16a20 ] + +As per the generic KASAN code in mm/kasan, disable KCOV with +KCOV_INSTRUMENT := n in the makefile. + +This fixes a ppc64 boot hang when KCOV and KASAN are enabled. +kasan_early_init() gets called before a PACA is initialised, but the +KCOV hook expects a valid PACA. + +Suggested-by: Christophe Leroy +Signed-off-by: Benjamin Gray +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20230710044143.146840-1-bgray@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/mm/kasan/Makefile | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/powerpc/mm/kasan/Makefile b/arch/powerpc/mm/kasan/Makefile +index 699eeffd9f551..f9522fd70b2f3 100644 +--- a/arch/powerpc/mm/kasan/Makefile ++++ b/arch/powerpc/mm/kasan/Makefile +@@ -1,6 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + + KASAN_SANITIZE := n ++KCOV_INSTRUMENT := n + + obj-$(CONFIG_PPC32) += init_32.o + obj-$(CONFIG_PPC_8xx) += 8xx.o +-- +2.40.1 + diff --git a/queue-6.4/rdma-bnxt_re-consider-timeout-of-destroy-ah-as-succe.patch b/queue-6.4/rdma-bnxt_re-consider-timeout-of-destroy-ah-as-succe.patch new file mode 100644 index 00000000000..4f4fda84a74 --- /dev/null +++ b/queue-6.4/rdma-bnxt_re-consider-timeout-of-destroy-ah-as-succe.patch @@ -0,0 +1,120 @@ +From 8dacd9698026095743f1bfb89ce7fc2e2748bb99 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Jun 2023 04:01:50 -0700 +Subject: RDMA/bnxt_re: consider timeout of destroy ah as success. + +From: Kashyap Desai + +[ Upstream commit bb8c93618fb0b8567d309f1aebc6df0cd31da1a2 ] + +If destroy_ah is timed out, it is likely to be destroyed by firmware +but it is taking longer time due to temporary slowness +in processing the rcfw command. In worst case, there might be +AH resource leak in firmware. + +Sending timeout return value can dump warning message from ib_core +which can be avoided if we map timeout of destroy_ah as success. + +Signed-off-by: Kashyap Desai +Signed-off-by: Selvin Xavier +Link: https://lore.kernel.org/r/1686308514-11996-14-git-send-email-selvin.xavier@broadcom.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/bnxt_re/bnxt_re.h | 2 ++ + drivers/infiniband/hw/bnxt_re/ib_verbs.c | 16 ++++++++++++---- + drivers/infiniband/hw/bnxt_re/qplib_sp.c | 8 +++++--- + drivers/infiniband/hw/bnxt_re/qplib_sp.h | 4 ++-- + 4 files changed, 21 insertions(+), 9 deletions(-) + +diff --git a/drivers/infiniband/hw/bnxt_re/bnxt_re.h b/drivers/infiniband/hw/bnxt_re/bnxt_re.h +index 2c95e6f3d47ac..eef3ef3fabb42 100644 +--- a/drivers/infiniband/hw/bnxt_re/bnxt_re.h ++++ b/drivers/infiniband/hw/bnxt_re/bnxt_re.h +@@ -179,6 +179,8 @@ struct bnxt_re_dev { + #define BNXT_RE_ROCEV2_IPV4_PACKET 2 + #define BNXT_RE_ROCEV2_IPV6_PACKET 3 + ++#define BNXT_RE_CHECK_RC(x) ((x) && ((x) != -ETIMEDOUT)) ++ + static inline struct device *rdev_to_dev(struct bnxt_re_dev *rdev) + { + if (rdev) +diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c +index ebe6852c40e8c..e7f153ee27541 100644 +--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c ++++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c +@@ -614,12 +614,20 @@ int bnxt_re_destroy_ah(struct ib_ah *ib_ah, u32 flags) + { + struct bnxt_re_ah *ah = container_of(ib_ah, struct bnxt_re_ah, ib_ah); + struct bnxt_re_dev *rdev = ah->rdev; ++ bool block = true; ++ int rc = 0; + +- bnxt_qplib_destroy_ah(&rdev->qplib_res, &ah->qplib_ah, +- !(flags & RDMA_DESTROY_AH_SLEEPABLE)); ++ block = !(flags & RDMA_DESTROY_AH_SLEEPABLE); ++ rc = bnxt_qplib_destroy_ah(&rdev->qplib_res, &ah->qplib_ah, block); ++ if (BNXT_RE_CHECK_RC(rc)) { ++ if (rc == -ETIMEDOUT) ++ rc = 0; ++ else ++ goto fail; ++ } + atomic_dec(&rdev->ah_count); +- +- return 0; ++fail: ++ return rc; + } + + static u8 bnxt_re_stack_to_dev_nw_type(enum rdma_network_type ntype) +diff --git a/drivers/infiniband/hw/bnxt_re/qplib_sp.c b/drivers/infiniband/hw/bnxt_re/qplib_sp.c +index b967a17a44beb..10919532bca29 100644 +--- a/drivers/infiniband/hw/bnxt_re/qplib_sp.c ++++ b/drivers/infiniband/hw/bnxt_re/qplib_sp.c +@@ -468,13 +468,14 @@ int bnxt_qplib_create_ah(struct bnxt_qplib_res *res, struct bnxt_qplib_ah *ah, + return 0; + } + +-void bnxt_qplib_destroy_ah(struct bnxt_qplib_res *res, struct bnxt_qplib_ah *ah, +- bool block) ++int bnxt_qplib_destroy_ah(struct bnxt_qplib_res *res, struct bnxt_qplib_ah *ah, ++ bool block) + { + struct bnxt_qplib_rcfw *rcfw = res->rcfw; + struct creq_destroy_ah_resp resp = {}; + struct bnxt_qplib_cmdqmsg msg = {}; + struct cmdq_destroy_ah req = {}; ++ int rc; + + /* Clean up the AH table in the device */ + bnxt_qplib_rcfw_cmd_prep((struct cmdq_base *)&req, +@@ -485,7 +486,8 @@ void bnxt_qplib_destroy_ah(struct bnxt_qplib_res *res, struct bnxt_qplib_ah *ah, + + bnxt_qplib_fill_cmdqmsg(&msg, &req, &resp, NULL, sizeof(req), + sizeof(resp), block); +- bnxt_qplib_rcfw_send_message(rcfw, &msg); ++ rc = bnxt_qplib_rcfw_send_message(rcfw, &msg); ++ return rc; + } + + /* MRW */ +diff --git a/drivers/infiniband/hw/bnxt_re/qplib_sp.h b/drivers/infiniband/hw/bnxt_re/qplib_sp.h +index 5de874659cdfa..4061616048e85 100644 +--- a/drivers/infiniband/hw/bnxt_re/qplib_sp.h ++++ b/drivers/infiniband/hw/bnxt_re/qplib_sp.h +@@ -327,8 +327,8 @@ int bnxt_qplib_set_func_resources(struct bnxt_qplib_res *res, + struct bnxt_qplib_ctx *ctx); + int bnxt_qplib_create_ah(struct bnxt_qplib_res *res, struct bnxt_qplib_ah *ah, + bool block); +-void bnxt_qplib_destroy_ah(struct bnxt_qplib_res *res, struct bnxt_qplib_ah *ah, +- bool block); ++int bnxt_qplib_destroy_ah(struct bnxt_qplib_res *res, struct bnxt_qplib_ah *ah, ++ bool block); + int bnxt_qplib_alloc_mrw(struct bnxt_qplib_res *res, + struct bnxt_qplib_mrw *mrw); + int bnxt_qplib_dereg_mrw(struct bnxt_qplib_res *res, struct bnxt_qplib_mrw *mrw, +-- +2.40.1 + diff --git a/queue-6.4/rdma-mana_ib-use-v2-version-of-cfg_rx_steer_req-to-e.patch b/queue-6.4/rdma-mana_ib-use-v2-version-of-cfg_rx_steer_req-to-e.patch new file mode 100644 index 00000000000..1eee6a98a3e --- /dev/null +++ b/queue-6.4/rdma-mana_ib-use-v2-version-of-cfg_rx_steer_req-to-e.patch @@ -0,0 +1,112 @@ +From e444d3b6dfa3c502e8693f4a2dcf48d382e0f98d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 13 May 2023 23:18:15 -0700 +Subject: RDMA/mana_ib: Use v2 version of cfg_rx_steer_req to enable RX + coalescing + +From: Long Li + +[ Upstream commit 2145328515c8fa9b8a9f7889250bc6c032f2a0e6 ] + +With RX coalescing, one CQE entry can be used to indicate multiple packets +on the receive queue. This saves processing time and PCI bandwidth over +the CQ. + +The MANA Ethernet driver also uses the v2 version of the protocol. It +doesn't use RX coalescing and its behavior is not changed. + +Link: https://lore.kernel.org/r/1684045095-31228-1-git-send-email-longli@linuxonhyperv.com +Signed-off-by: Long Li +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mana/qp.c | 5 ++++- + drivers/net/ethernet/microsoft/mana/mana_en.c | 5 ++++- + include/net/mana/mana.h | 4 +++- + 3 files changed, 11 insertions(+), 3 deletions(-) + +diff --git a/drivers/infiniband/hw/mana/qp.c b/drivers/infiniband/hw/mana/qp.c +index 54b61930a7fdb..4b3b5b274e849 100644 +--- a/drivers/infiniband/hw/mana/qp.c ++++ b/drivers/infiniband/hw/mana/qp.c +@@ -13,7 +13,7 @@ static int mana_ib_cfg_vport_steering(struct mana_ib_dev *dev, + u8 *rx_hash_key) + { + struct mana_port_context *mpc = netdev_priv(ndev); +- struct mana_cfg_rx_steer_req *req = NULL; ++ struct mana_cfg_rx_steer_req_v2 *req; + struct mana_cfg_rx_steer_resp resp = {}; + mana_handle_t *req_indir_tab; + struct gdma_context *gc; +@@ -33,6 +33,8 @@ static int mana_ib_cfg_vport_steering(struct mana_ib_dev *dev, + mana_gd_init_req_hdr(&req->hdr, MANA_CONFIG_VPORT_RX, req_buf_size, + sizeof(resp)); + ++ req->hdr.req.msg_version = GDMA_MESSAGE_V2; ++ + req->vport = mpc->port_handle; + req->rx_enable = 1; + req->update_default_rxobj = 1; +@@ -46,6 +48,7 @@ static int mana_ib_cfg_vport_steering(struct mana_ib_dev *dev, + req->num_indir_entries = MANA_INDIRECT_TABLE_SIZE; + req->indir_tab_offset = sizeof(*req); + req->update_indir_tab = true; ++ req->cqe_coalescing_enable = 1; + + req_indir_tab = (mana_handle_t *)(req + 1); + /* The ind table passed to the hardware must have +diff --git a/drivers/net/ethernet/microsoft/mana/mana_en.c b/drivers/net/ethernet/microsoft/mana/mana_en.c +index 96c78f7db2543..7441577294bad 100644 +--- a/drivers/net/ethernet/microsoft/mana/mana_en.c ++++ b/drivers/net/ethernet/microsoft/mana/mana_en.c +@@ -973,7 +973,7 @@ static int mana_cfg_vport_steering(struct mana_port_context *apc, + bool update_tab) + { + u16 num_entries = MANA_INDIRECT_TABLE_SIZE; +- struct mana_cfg_rx_steer_req *req = NULL; ++ struct mana_cfg_rx_steer_req_v2 *req; + struct mana_cfg_rx_steer_resp resp = {}; + struct net_device *ndev = apc->ndev; + mana_handle_t *req_indir_tab; +@@ -988,6 +988,8 @@ static int mana_cfg_vport_steering(struct mana_port_context *apc, + mana_gd_init_req_hdr(&req->hdr, MANA_CONFIG_VPORT_RX, req_buf_size, + sizeof(resp)); + ++ req->hdr.req.msg_version = GDMA_MESSAGE_V2; ++ + req->vport = apc->port_handle; + req->num_indir_entries = num_entries; + req->indir_tab_offset = sizeof(*req); +@@ -997,6 +999,7 @@ static int mana_cfg_vport_steering(struct mana_port_context *apc, + req->update_hashkey = update_key; + req->update_indir_tab = update_tab; + req->default_rxobj = apc->default_rxobj; ++ req->cqe_coalescing_enable = 0; + + if (update_key) + memcpy(&req->hashkey, apc->hashkey, MANA_HASH_KEY_SIZE); +diff --git a/include/net/mana/mana.h b/include/net/mana/mana.h +index 9eef199728454..024ad8ddb27e5 100644 +--- a/include/net/mana/mana.h ++++ b/include/net/mana/mana.h +@@ -579,7 +579,7 @@ struct mana_fence_rq_resp { + }; /* HW DATA */ + + /* Configure vPort Rx Steering */ +-struct mana_cfg_rx_steer_req { ++struct mana_cfg_rx_steer_req_v2 { + struct gdma_req_hdr hdr; + mana_handle_t vport; + u16 num_indir_entries; +@@ -592,6 +592,8 @@ struct mana_cfg_rx_steer_req { + u8 reserved; + mana_handle_t default_rxobj; + u8 hashkey[MANA_HASH_KEY_SIZE]; ++ u8 cqe_coalescing_enable; ++ u8 reserved2[7]; + }; /* HW DATA */ + + struct mana_cfg_rx_steer_resp { +-- +2.40.1 + diff --git a/queue-6.4/rdma-mlx5-return-the-firmware-result-upon-destroying.patch b/queue-6.4/rdma-mlx5-return-the-firmware-result-upon-destroying.patch new file mode 100644 index 00000000000..12c147dce77 --- /dev/null +++ b/queue-6.4/rdma-mlx5-return-the-firmware-result-upon-destroying.patch @@ -0,0 +1,112 @@ +From 82d8ea5645c2a454db3f3cf14713e08ab1d14f2e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Jun 2023 13:14:07 +0300 +Subject: RDMA/mlx5: Return the firmware result upon destroying QP/RQ + +From: Patrisious Haddad + +[ Upstream commit 22664c06e997087fe37f9ba208008c948571214a ] + +Previously when destroying a QP/RQ, the result of the firmware +destruction function was ignored and upper layers weren't informed +about the failure. +Which in turn could lead to various problems since when upper layer +isn't aware of the failure it continues its operation thinking that the +related QP/RQ was successfully destroyed while it actually wasn't, +which could lead to the below kernel WARN. + +Currently, we return the correct firmware destruction status to upper +layers which in case of the RQ would be mlx5_ib_destroy_wq() which +was already capable of handling RQ destruction failure or in case of +a QP to destroy_qp_common(), which now would actually warn upon qp +destruction failure. + +WARNING: CPU: 3 PID: 995 at drivers/infiniband/core/rdma_core.c:940 uverbs_destroy_ufile_hw+0xcb/0xe0 [ib_uverbs] +Modules linked in: xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink xt_addrtype iptable_nat nf_nat br_netfilter rpcrdma rdma_ucm ib_iser libiscsi scsi_transport_iscsi rdma_cm ib_umad ib_ipoib iw_cm ib_cm mlx5_ib ib_uverbs ib_core overlay mlx5_core fuse +CPU: 3 PID: 995 Comm: python3 Not tainted 5.16.0-rc5+ #1 +Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 +RIP: 0010:uverbs_destroy_ufile_hw+0xcb/0xe0 [ib_uverbs] +Code: 41 5c 41 5d 41 5e e9 44 34 f0 e0 48 89 df e8 4c 77 ff ff 49 8b 86 10 01 00 00 48 85 c0 74 a1 4c 89 e7 ff d0 eb 9a 0f 0b eb c1 <0f> 0b be 04 00 00 00 48 89 df e8 b6 f6 ff ff e9 75 ff ff ff 90 0f +RSP: 0018:ffff8881533e3e78 EFLAGS: 00010287 +RAX: ffff88811b2cf3e0 RBX: ffff888106209700 RCX: 0000000000000000 +RDX: ffff888106209780 RSI: ffff8881533e3d30 RDI: ffff888109b101a0 +RBP: 0000000000000001 R08: ffff888127cb381c R09: 0de9890000000009 +R10: ffff888127cb3800 R11: 0000000000000000 R12: ffff888106209780 +R13: ffff888106209750 R14: ffff888100f20660 R15: 0000000000000000 +FS: 00007f8be353b740(0000) GS:ffff88852c980000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 00007f8bd5b117c0 CR3: 000000012cd8a004 CR4: 0000000000370ea0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +Call Trace: + + ib_uverbs_close+0x1a/0x90 [ib_uverbs] + __fput+0x82/0x230 + task_work_run+0x59/0x90 + exit_to_user_mode_prepare+0x138/0x140 + syscall_exit_to_user_mode+0x1d/0x50 + ? __x64_sys_close+0xe/0x40 + do_syscall_64+0x4a/0x90 + entry_SYSCALL_64_after_hwframe+0x44/0xae +RIP: 0033:0x7f8be3ae0abb +Code: 03 00 00 00 0f 05 48 3d 00 f0 ff ff 77 41 c3 48 83 ec 18 89 7c 24 0c e8 83 43 f9 ff 8b 7c 24 0c 41 89 c0 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 44 89 c7 89 44 24 0c e8 c1 43 f9 ff 8b 44 +RSP: 002b:00007ffdb51909c0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 +RAX: 0000000000000000 RBX: 0000557bb7f7c020 RCX: 00007f8be3ae0abb +RDX: 0000557bb7c74010 RSI: 0000557bb7f14ca0 RDI: 0000000000000005 +RBP: 0000557bb7fbd598 R08: 0000000000000000 R09: 0000000000000000 +R10: 0000000000000000 R11: 0000000000000293 R12: 0000557bb7fbd5b8 +R13: 0000557bb7fbd5a8 R14: 0000000000001000 R15: 0000557bb7f7c020 + + +Signed-off-by: Patrisious Haddad +Link: https://lore.kernel.org/r/c6df677f931d18090bafbe7f7dbb9524047b7d9b.1685953497.git.leon@kernel.org +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mlx5/qpc.c | 10 ++++------ + 1 file changed, 4 insertions(+), 6 deletions(-) + +diff --git a/drivers/infiniband/hw/mlx5/qpc.c b/drivers/infiniband/hw/mlx5/qpc.c +index bae0334d6e7f1..aec011557b4a7 100644 +--- a/drivers/infiniband/hw/mlx5/qpc.c ++++ b/drivers/infiniband/hw/mlx5/qpc.c +@@ -298,8 +298,7 @@ int mlx5_core_destroy_qp(struct mlx5_ib_dev *dev, struct mlx5_core_qp *qp) + MLX5_SET(destroy_qp_in, in, opcode, MLX5_CMD_OP_DESTROY_QP); + MLX5_SET(destroy_qp_in, in, qpn, qp->qpn); + MLX5_SET(destroy_qp_in, in, uid, qp->uid); +- mlx5_cmd_exec_in(dev->mdev, destroy_qp, in); +- return 0; ++ return mlx5_cmd_exec_in(dev->mdev, destroy_qp, in); + } + + int mlx5_core_set_delay_drop(struct mlx5_ib_dev *dev, +@@ -551,14 +550,14 @@ int mlx5_core_xrcd_dealloc(struct mlx5_ib_dev *dev, u32 xrcdn) + return mlx5_cmd_exec_in(dev->mdev, dealloc_xrcd, in); + } + +-static void destroy_rq_tracked(struct mlx5_ib_dev *dev, u32 rqn, u16 uid) ++static int destroy_rq_tracked(struct mlx5_ib_dev *dev, u32 rqn, u16 uid) + { + u32 in[MLX5_ST_SZ_DW(destroy_rq_in)] = {}; + + MLX5_SET(destroy_rq_in, in, opcode, MLX5_CMD_OP_DESTROY_RQ); + MLX5_SET(destroy_rq_in, in, rqn, rqn); + MLX5_SET(destroy_rq_in, in, uid, uid); +- mlx5_cmd_exec_in(dev->mdev, destroy_rq, in); ++ return mlx5_cmd_exec_in(dev->mdev, destroy_rq, in); + } + + int mlx5_core_create_rq_tracked(struct mlx5_ib_dev *dev, u32 *in, int inlen, +@@ -589,8 +588,7 @@ int mlx5_core_destroy_rq_tracked(struct mlx5_ib_dev *dev, + struct mlx5_core_qp *rq) + { + destroy_resource_common(dev, rq); +- destroy_rq_tracked(dev, rq->qpn, rq->uid); +- return 0; ++ return destroy_rq_tracked(dev, rq->qpn, rq->uid); + } + + static void destroy_sq_tracked(struct mlx5_ib_dev *dev, u32 sqn, u16 uid) +-- +2.40.1 + diff --git a/queue-6.4/revert-drm-amd-display-disable-subvp-drr-to-prevent-.patch b/queue-6.4/revert-drm-amd-display-disable-subvp-drr-to-prevent-.patch new file mode 100644 index 00000000000..12899a9db5f --- /dev/null +++ b/queue-6.4/revert-drm-amd-display-disable-subvp-drr-to-prevent-.patch @@ -0,0 +1,73 @@ +From 50678a628e86023c579ff53c5da3e9fe65d0aea2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Mar 2023 10:25:04 -0400 +Subject: Revert "drm/amd/display: disable SubVP + DRR to prevent underflow" + +From: Aurabindo Pillai + +[ Upstream commit f38129bb081758176dd78304faaee95007fb8838 ] + +This reverts commit 80c6d6804f31451848a3956a70c2bcb1f07cfcb0. +The orignal commit was intended as a workaround to prevent underflow and +flickering when using one normal monitor and the other high refresh rate +monitor (> 120Hz). + +This patch is being reverted in favour of a software solution to enable +SubVP+DRR + +Signed-off-by: Aurabindo Pillai +Reviewed-by: Rodrigo Siqueira +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 5 ----- + drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c | 4 ---- + drivers/gpu/drm/amd/include/amd_shared.h | 1 - + 3 files changed, 10 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index bdce367544368..4dd9a85f5c724 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -1653,11 +1653,6 @@ static int amdgpu_dm_init(struct amdgpu_device *adev) + if (amdgpu_dc_feature_mask & DC_DISABLE_LTTPR_DP2_0) + init_data.flags.allow_lttpr_non_transparent_mode.bits.DP2_0 = true; + +- /* Disable SubVP + DRR config by default */ +- init_data.flags.disable_subvp_drr = true; +- if (amdgpu_dc_feature_mask & DC_ENABLE_SUBVP_DRR) +- init_data.flags.disable_subvp_drr = false; +- + init_data.flags.seamless_boot_edp_requested = false; + + if (check_seamless_boot_capability(adev)) { +diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c b/drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c +index d8b4119820bfc..1bfda6e2b3070 100644 +--- a/drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c ++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c +@@ -880,10 +880,6 @@ static bool subvp_drr_schedulable(struct dc *dc, struct dc_state *context, struc + int16_t stretched_drr_us = 0; + int16_t drr_stretched_vblank_us = 0; + int16_t max_vblank_mallregion = 0; +- const struct dc_config *config = &dc->config; +- +- if (config->disable_subvp_drr) +- return false; + + // Find SubVP pipe + for (i = 0; i < dc->res_pool->pipe_count; i++) { +diff --git a/drivers/gpu/drm/amd/include/amd_shared.h b/drivers/gpu/drm/amd/include/amd_shared.h +index e4a22c68517d1..f175e65b853a0 100644 +--- a/drivers/gpu/drm/amd/include/amd_shared.h ++++ b/drivers/gpu/drm/amd/include/amd_shared.h +@@ -240,7 +240,6 @@ enum DC_FEATURE_MASK { + DC_DISABLE_LTTPR_DP2_0 = (1 << 6), //0x40, disabled by default + DC_PSR_ALLOW_SMU_OPT = (1 << 7), //0x80, disabled by default + DC_PSR_ALLOW_MULTI_DISP_OPT = (1 << 8), //0x100, disabled by default +- DC_ENABLE_SUBVP_DRR = (1 << 9), // 0x200, disabled by default + }; + + enum DC_DEBUG_MASK { +-- +2.40.1 + diff --git a/queue-6.4/revert-patch-uml-export-symbols-added-by-gcc-hardene.patch b/queue-6.4/revert-patch-uml-export-symbols-added-by-gcc-hardene.patch new file mode 100644 index 00000000000..94adab85e8c --- /dev/null +++ b/queue-6.4/revert-patch-uml-export-symbols-added-by-gcc-hardene.patch @@ -0,0 +1,94 @@ +From 7b08a23d1f94e80f90fecea0dd7f1611b17113ca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Jun 2023 18:13:10 +0900 +Subject: Revert "[PATCH] uml: export symbols added by GCC hardened" + +From: Masahiro Yamada + +[ Upstream commit 8635e8df477bc77837886da206f4915576f88fec ] + +This reverts commit cead61a6717a9873426b08d73a34a325e3546f5d. + +It exported __stack_smash_handler and __guard, while they may not be +defined by anyone. + +The code *declares* __stack_smash_handler and __guard. It does not +create weak symbols. If no external library is linked, they are left +undefined, but yet exported. + +If a loadable module tries to access non-existing symbols, bad things +(a page fault, NULL pointer dereference, etc.) will happen. So, the +current code is wrong and dangerous. + +If the code were written as follows, it would *define* them as weak +symbols so modules would be able to get access to them. + + void (*__stack_smash_handler)(void *) __attribute__((weak)); + EXPORT_SYMBOL(__stack_smash_handler); + + long __guard __attribute__((weak)); + EXPORT_SYMBOL(__guard); + +In fact, modpost forbids exporting undefined symbols. It shows an error +message if it detects such a mistake. + + ERROR: modpost: "..." [...] was exported without definition + +Unfortunately, it is checked only when the code is built as modular. +The problem described above has been unnoticed for a long time because +arch/um/os-Linux/user_syms.c is always built-in. + +With a planned change in Kbuild, exporting undefined symbols will always +result in a build error instead of a run-time error. It is a good thing, +but we need to fix the breakage in advance. + +One fix is to define weak symbols as shown above. An alternative is to +export them conditionally as follows: + + #ifdef CONFIG_STACKPROTECTOR + extern void __stack_smash_handler(void *); + EXPORT_SYMBOL(__stack_smash_handler); + + external long __guard; + EXPORT_SYMBOL(__guard); + #endif + +This is what other architectures do; EXPORT_SYMBOL(__stack_chk_guard) +is guarded by #ifdef CONFIG_STACKPROTECTOR. + +However, adding the #ifdef guard is not sensible because UML cannot +enable the stack-protector in the first place! (Please note UML does +not select HAVE_STACKPROTECTOR in Kconfig.) + +So, the code is already broken (and unused) in multiple ways. + +Just remove. + +Signed-off-by: Masahiro Yamada +Reviewed-by: Nick Desaulniers +Signed-off-by: Sasha Levin +--- + arch/um/os-Linux/user_syms.c | 7 ------- + 1 file changed, 7 deletions(-) + +diff --git a/arch/um/os-Linux/user_syms.c b/arch/um/os-Linux/user_syms.c +index 9b62a9d352b3a..a310ae27b479a 100644 +--- a/arch/um/os-Linux/user_syms.c ++++ b/arch/um/os-Linux/user_syms.c +@@ -37,13 +37,6 @@ EXPORT_SYMBOL(vsyscall_ehdr); + EXPORT_SYMBOL(vsyscall_end); + #endif + +-/* Export symbols used by GCC for the stack protector. */ +-extern void __stack_smash_handler(void *) __attribute__((weak)); +-EXPORT_SYMBOL(__stack_smash_handler); +- +-extern long __guard __attribute__((weak)); +-EXPORT_SYMBOL(__guard); +- + #ifdef _FORTIFY_SOURCE + extern int __sprintf_chk(char *str, int flag, size_t len, const char *format); + EXPORT_SYMBOL(__sprintf_chk); +-- +2.40.1 + diff --git a/queue-6.4/ring-buffer-do-not-swap-cpu_buffer-during-resize-pro.patch b/queue-6.4/ring-buffer-do-not-swap-cpu_buffer-during-resize-pro.patch new file mode 100644 index 00000000000..b624fbee36a --- /dev/null +++ b/queue-6.4/ring-buffer-do-not-swap-cpu_buffer-during-resize-pro.patch @@ -0,0 +1,243 @@ +From 25bdf945bbc210945c03cf4b4d950699798ad3fa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Jul 2023 15:58:47 +0800 +Subject: ring-buffer: Do not swap cpu_buffer during resize process + +From: Chen Lin + +[ Upstream commit 8a96c0288d0737ad77882024974c075345c72011 ] + +When ring_buffer_swap_cpu was called during resize process, +the cpu buffer was swapped in the middle, resulting in incorrect state. +Continuing to run in the wrong state will result in oops. + +This issue can be easily reproduced using the following two scripts: +/tmp # cat test1.sh +//#! /bin/sh +for i in `seq 0 100000` +do + echo 2000 > /sys/kernel/debug/tracing/buffer_size_kb + sleep 0.5 + echo 5000 > /sys/kernel/debug/tracing/buffer_size_kb + sleep 0.5 +done +/tmp # cat test2.sh +//#! /bin/sh +for i in `seq 0 100000` +do + echo irqsoff > /sys/kernel/debug/tracing/current_tracer + sleep 1 + echo nop > /sys/kernel/debug/tracing/current_tracer + sleep 1 +done +/tmp # ./test1.sh & +/tmp # ./test2.sh & + +A typical oops log is as follows, sometimes with other different oops logs. + +[ 231.711293] WARNING: CPU: 0 PID: 9 at kernel/trace/ring_buffer.c:2026 rb_update_pages+0x378/0x3f8 +[ 231.713375] Modules linked in: +[ 231.714735] CPU: 0 PID: 9 Comm: kworker/0:1 Tainted: G W 6.5.0-rc1-00276-g20edcec23f92 #15 +[ 231.716750] Hardware name: linux,dummy-virt (DT) +[ 231.718152] Workqueue: events update_pages_handler +[ 231.719714] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) +[ 231.721171] pc : rb_update_pages+0x378/0x3f8 +[ 231.722212] lr : rb_update_pages+0x25c/0x3f8 +[ 231.723248] sp : ffff800082b9bd50 +[ 231.724169] x29: ffff800082b9bd50 x28: ffff8000825f7000 x27: 0000000000000000 +[ 231.726102] x26: 0000000000000001 x25: fffffffffffff010 x24: 0000000000000ff0 +[ 231.728122] x23: ffff0000c3a0b600 x22: ffff0000c3a0b5c0 x21: fffffffffffffe0a +[ 231.730203] x20: ffff0000c3a0b600 x19: ffff0000c0102400 x18: 0000000000000000 +[ 231.732329] x17: 0000000000000000 x16: 0000000000000000 x15: 0000ffffe7aa8510 +[ 231.734212] x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000002 +[ 231.736291] x11: ffff8000826998a8 x10: ffff800082b9baf0 x9 : ffff800081137558 +[ 231.738195] x8 : fffffc00030e82c8 x7 : 0000000000000000 x6 : 0000000000000001 +[ 231.740192] x5 : ffff0000ffbafe00 x4 : 0000000000000000 x3 : 0000000000000000 +[ 231.742118] x2 : 00000000000006aa x1 : 0000000000000001 x0 : ffff0000c0007208 +[ 231.744196] Call trace: +[ 231.744892] rb_update_pages+0x378/0x3f8 +[ 231.745893] update_pages_handler+0x1c/0x38 +[ 231.746893] process_one_work+0x1f0/0x468 +[ 231.747852] worker_thread+0x54/0x410 +[ 231.748737] kthread+0x124/0x138 +[ 231.749549] ret_from_fork+0x10/0x20 +[ 231.750434] ---[ end trace 0000000000000000 ]--- +[ 233.720486] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 +[ 233.721696] Mem abort info: +[ 233.721935] ESR = 0x0000000096000004 +[ 233.722283] EC = 0x25: DABT (current EL), IL = 32 bits +[ 233.722596] SET = 0, FnV = 0 +[ 233.722805] EA = 0, S1PTW = 0 +[ 233.723026] FSC = 0x04: level 0 translation fault +[ 233.723458] Data abort info: +[ 233.723734] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 +[ 233.724176] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 +[ 233.724589] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 +[ 233.725075] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000104943000 +[ 233.725592] [0000000000000000] pgd=0000000000000000, p4d=0000000000000000 +[ 233.726231] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP +[ 233.726720] Modules linked in: +[ 233.727007] CPU: 0 PID: 9 Comm: kworker/0:1 Tainted: G W 6.5.0-rc1-00276-g20edcec23f92 #15 +[ 233.727777] Hardware name: linux,dummy-virt (DT) +[ 233.728225] Workqueue: events update_pages_handler +[ 233.728655] pstate: 200000c5 (nzCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) +[ 233.729054] pc : rb_update_pages+0x1a8/0x3f8 +[ 233.729334] lr : rb_update_pages+0x154/0x3f8 +[ 233.729592] sp : ffff800082b9bd50 +[ 233.729792] x29: ffff800082b9bd50 x28: ffff8000825f7000 x27: 0000000000000000 +[ 233.730220] x26: 0000000000000000 x25: ffff800082a8b840 x24: ffff0000c0102418 +[ 233.730653] x23: 0000000000000000 x22: fffffc000304c880 x21: 0000000000000003 +[ 233.731105] x20: 00000000000001f4 x19: ffff0000c0102400 x18: ffff800082fcbc58 +[ 233.731727] x17: 0000000000000000 x16: 0000000000000001 x15: 0000000000000001 +[ 233.732282] x14: ffff8000825fe0c8 x13: 0000000000000001 x12: 0000000000000000 +[ 233.732709] x11: ffff8000826998a8 x10: 0000000000000ae0 x9 : ffff8000801b760c +[ 233.733148] x8 : fefefefefefefeff x7 : 0000000000000018 x6 : ffff0000c03298c0 +[ 233.733553] x5 : 0000000000000002 x4 : 0000000000000000 x3 : 0000000000000000 +[ 233.733972] x2 : ffff0000c3a0b600 x1 : 0000000000000000 x0 : 0000000000000000 +[ 233.734418] Call trace: +[ 233.734593] rb_update_pages+0x1a8/0x3f8 +[ 233.734853] update_pages_handler+0x1c/0x38 +[ 233.735148] process_one_work+0x1f0/0x468 +[ 233.735525] worker_thread+0x54/0x410 +[ 233.735852] kthread+0x124/0x138 +[ 233.736064] ret_from_fork+0x10/0x20 +[ 233.736387] Code: 92400000 910006b5 aa000021 aa0303f7 (f9400060) +[ 233.736959] ---[ end trace 0000000000000000 ]--- + +After analysis, the seq of the error is as follows [1-5]: + +int ring_buffer_resize(struct trace_buffer *buffer, unsigned long size, + int cpu_id) +{ + for_each_buffer_cpu(buffer, cpu) { + cpu_buffer = buffer->buffers[cpu]; + //1. get cpu_buffer, aka cpu_buffer(A) + ... + ... + schedule_work_on(cpu, + &cpu_buffer->update_pages_work); + //2. 'update_pages_work' is queue on 'cpu', cpu_buffer(A) is passed to + // update_pages_handler, do the update process, set 'update_done' in + // complete(&cpu_buffer->update_done) and to wakeup resize process. + //----> + //3. Just at this moment, ring_buffer_swap_cpu is triggered, + //cpu_buffer(A) be swaped to cpu_buffer(B), the max_buffer. + //ring_buffer_swap_cpu is called as the 'Call trace' below. + + Call trace: + dump_backtrace+0x0/0x2f8 + show_stack+0x18/0x28 + dump_stack+0x12c/0x188 + ring_buffer_swap_cpu+0x2f8/0x328 + update_max_tr_single+0x180/0x210 + check_critical_timing+0x2b4/0x2c8 + tracer_hardirqs_on+0x1c0/0x200 + trace_hardirqs_on+0xec/0x378 + el0_svc_common+0x64/0x260 + do_el0_svc+0x90/0xf8 + el0_svc+0x20/0x30 + el0_sync_handler+0xb0/0xb8 + el0_sync+0x180/0x1c0 + //<---- + + /* wait for all the updates to complete */ + for_each_buffer_cpu(buffer, cpu) { + cpu_buffer = buffer->buffers[cpu]; + //4. get cpu_buffer, cpu_buffer(B) is used in the following process, + //the state of cpu_buffer(A) and cpu_buffer(B) is totally wrong. + //for example, cpu_buffer(A)->update_done will leave be set 1, and will + //not 'wait_for_completion' at the next resize round. + if (!cpu_buffer->nr_pages_to_update) + continue; + + if (cpu_online(cpu)) + wait_for_completion(&cpu_buffer->update_done); + cpu_buffer->nr_pages_to_update = 0; + } + ... +} + //5. the state of cpu_buffer(A) and cpu_buffer(B) is totally wrong, + //Continuing to run in the wrong state, then oops occurs. + +Link: https://lore.kernel.org/linux-trace-kernel/202307191558478409990@zte.com.cn + +Signed-off-by: Chen Lin +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +--- + kernel/trace/ring_buffer.c | 14 +++++++++++++- + kernel/trace/trace.c | 3 ++- + 2 files changed, 15 insertions(+), 2 deletions(-) + +diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c +index 99634b29a8b82..46b4a3c7c3bf5 100644 +--- a/kernel/trace/ring_buffer.c ++++ b/kernel/trace/ring_buffer.c +@@ -538,6 +538,7 @@ struct trace_buffer { + unsigned flags; + int cpus; + atomic_t record_disabled; ++ atomic_t resizing; + cpumask_var_t cpumask; + + struct lock_class_key *reader_lock_key; +@@ -2166,7 +2167,7 @@ int ring_buffer_resize(struct trace_buffer *buffer, unsigned long size, + + /* prevent another thread from changing buffer sizes */ + mutex_lock(&buffer->mutex); +- ++ atomic_inc(&buffer->resizing); + + if (cpu_id == RING_BUFFER_ALL_CPUS) { + /* +@@ -2321,6 +2322,7 @@ int ring_buffer_resize(struct trace_buffer *buffer, unsigned long size, + atomic_dec(&buffer->record_disabled); + } + ++ atomic_dec(&buffer->resizing); + mutex_unlock(&buffer->mutex); + return 0; + +@@ -2341,6 +2343,7 @@ int ring_buffer_resize(struct trace_buffer *buffer, unsigned long size, + } + } + out_err_unlock: ++ atomic_dec(&buffer->resizing); + mutex_unlock(&buffer->mutex); + return err; + } +@@ -5543,6 +5546,15 @@ int ring_buffer_swap_cpu(struct trace_buffer *buffer_a, + if (local_read(&cpu_buffer_b->committing)) + goto out_dec; + ++ /* ++ * When resize is in progress, we cannot swap it because ++ * it will mess the state of the cpu buffer. ++ */ ++ if (atomic_read(&buffer_a->resizing)) ++ goto out_dec; ++ if (atomic_read(&buffer_b->resizing)) ++ goto out_dec; ++ + buffer_a->buffers[cpu] = cpu_buffer_b; + buffer_b->buffers[cpu] = cpu_buffer_a; + +diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c +index c80ff6f5b2cc1..fd051f85efd4b 100644 +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -1928,9 +1928,10 @@ update_max_tr_single(struct trace_array *tr, struct task_struct *tsk, int cpu) + * place on this CPU. We fail to record, but we reset + * the max trace buffer (no one writes directly to it) + * and flag that it failed. ++ * Another reason is resize is in progress. + */ + trace_array_printk_buf(tr->max_buffer.buffer, _THIS_IP_, +- "Failed to swap buffers due to commit in progress\n"); ++ "Failed to swap buffers due to commit or resize in progress\n"); + } + + WARN_ON_ONCE(ret && ret != -EAGAIN && ret != -EBUSY); +-- +2.40.1 + diff --git a/queue-6.4/serial-stm32-ignore-return-value-of-uart_remove_one_.patch b/queue-6.4/serial-stm32-ignore-return-value-of-uart_remove_one_.patch new file mode 100644 index 00000000000..b0b3efbd698 --- /dev/null +++ b/queue-6.4/serial-stm32-ignore-return-value-of-uart_remove_one_.patch @@ -0,0 +1,56 @@ +From 5ecfef76f0ffab029edea0a3fea8ab80c189fc75 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 May 2023 19:38:09 +0200 +Subject: serial: stm32: Ignore return value of uart_remove_one_port() in + .remove() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 6bd6cd29c92401a101993290051fa55078238a52 ] + +Returning early from stm32_usart_serial_remove() results in a resource +leak as several cleanup functions are not called. The driver core ignores +the return value and there is no possibility to clean up later. + +uart_remove_one_port() only returns non-zero if there is some +inconsistency (i.e. stm32_usart_driver.state[port->line].uart_port == NULL). +This should never happen, and even if it does it's a bad idea to exit +early in the remove callback without cleaning up. + +This prepares changing the prototype of struct platform_driver::remove to +return void. See commit 5c5a7680e67b ("platform: Provide a remove callback +that returns no value") for further details about this quest. + +Signed-off-by: Uwe Kleine-König +Link: https://lore.kernel.org/r/20230512173810.131447-2-u.kleine-koenig@pengutronix.de +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/stm32-usart.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c +index 1e38fc9b10c11..e9e11a2596211 100644 +--- a/drivers/tty/serial/stm32-usart.c ++++ b/drivers/tty/serial/stm32-usart.c +@@ -1755,13 +1755,10 @@ static int stm32_usart_serial_remove(struct platform_device *pdev) + struct uart_port *port = platform_get_drvdata(pdev); + struct stm32_port *stm32_port = to_stm32_port(port); + const struct stm32_usart_offsets *ofs = &stm32_port->info->ofs; +- int err; + u32 cr3; + + pm_runtime_get_sync(&pdev->dev); +- err = uart_remove_one_port(&stm32_usart_driver, port); +- if (err) +- return(err); ++ uart_remove_one_port(&stm32_usart_driver, port); + + pm_runtime_disable(&pdev->dev); + pm_runtime_set_suspended(&pdev->dev); +-- +2.40.1 + diff --git a/queue-6.4/series b/queue-6.4/series new file mode 100644 index 00000000000..a3d35ef0846 --- /dev/null +++ b/queue-6.4/series @@ -0,0 +1,92 @@ +drop-the-netfs_-prefix-from-netfs_extract_iter_to_sg.patch +fix-a-couple-of-spelling-mistakes.patch +wrap-lines-at-80.patch +move-netfs_extract_iter_to_sg-to-lib-scatterlist.c.patch +crypto-cifs-fix-error-handling-in-extract_iter_to_sg.patch +nvme-core-don-t-hold-rcu-read-lock-in-nvme_ns_chr_ur.patch +net-phy-at803x-use-devm_regulator_get_enable_optiona.patch +net-phy-at803x-fix-the-wol-setting-functions.patch +drm-amd-display-update-dtbclk-for-dcn32.patch +drm-scheduler-set-entity-to-null-in-drm_sched_entity.patch +drm-amdgpu-fix-calltrace-warning-in-amddrm_buddy_fin.patch +drm-amdgpu-fix-integer-overflow-in-amdgpu_cs_pass1.patch +drm-amdgpu-fix-memory-leak-in-mes-self-test.patch +revert-drm-amd-display-disable-subvp-drr-to-prevent-.patch +asoc-intel-sof_sdw-add-quirk-for-mtl-rvp.patch +asoc-intel-sof_sdw-add-quirk-for-lnl-rvp.patch +pci-tegra194-fix-possible-array-out-of-bounds-access.patch +asoc-cs35l56-move-dsp-part-string-generation-so-that.patch +asoc-sof-amd-add-pci-revision-id-check.patch +drm-stm-ltdc-fix-late-dereference-check.patch +arm64-dts-qcom-ipq5332-add-qfprom-node.patch +drm-rcar-du-remove-r-car-h3-es1.-workarounds.patch +asoc-amd-vangogh-add-check-for-acp-config-flags-in-v.patch +rdma-mana_ib-use-v2-version-of-cfg_rx_steer_req-to-e.patch +arm-dts-imx6dl-prtrvt-prtvt7-prti6q-prtwd2-fix-usb-r.patch +asoc-intel-sof_sdw_rt_sdca_jack_common-test-sof_jack.patch +asoc-intel-sof_sdw-add-quick-for-dell-sku-0bda.patch +asoc-intel-sof_sdw-add-support-for-rex-soundwire.patch +iopoll-call-cpu_relax-in-busy-loops.patch +asoc-sof-intel-fix-soundwire-hdaudio-mutual-exclusio.patch +dma-remap-use-kvmalloc_array-kvfree-for-larger-dma-m.patch +accel-habanalabs-add-pci-health-check-during-heartbe.patch +accel-habanalabs-fix-mem-leak-in-capture-user-mappin.patch +dt-bindings-input-goodix-add-goodix-no-reset-during-.patch +hid-i2c-hid-goodix-add-support-for-goodix-no-reset-d.patch +hid-logitech-hidpp-add-usb-and-bluetooth-ids-for-the.patch +iommu-amd-introduce-disable-irte-caching-support.patch +drm-amdgpu-install-stub-fence-into-potential-unused-.patch +drm-amd-display-remove-v_startup-workaround-for-dcn3.patch +drm-amd-display-apply-60us-prefetch-for-dcfclk-300mh.patch +drm-amdgpu-unmap-and-remove-csa_va-properly.patch +rdma-mlx5-return-the-firmware-result-upon-destroying.patch +rdma-bnxt_re-consider-timeout-of-destroy-ah-as-succe.patch +drm-amd-display-skip-dpp-dto-update-if-root-clock-is.patch +drm-amd-display-enable-dcn314-dpp-rco.patch +asoc-sof-core-free-the-firmware-trace-before-calling.patch +hid-intel-ish-hid-ipc-add-arrow-lake-pci-device-id.patch +revert-patch-uml-export-symbols-added-by-gcc-hardene.patch +smb-client-fix-warning-in-cifs_smb3_do_mount.patch +cifs-fix-session-state-check-in-reconnect-to-avoid-u.patch +serial-stm32-ignore-return-value-of-uart_remove_one_.patch +led-qcom-lpg-fix-resource-leaks-in-for_each_availabl.patch +media-v4l2-mem2mem-add-lock-to-protect-parameter-num.patch +media-camss-set-vfe-bpl_alignment-to-16-for-sdm845-a.patch +usb-gadget-u_serial-avoid-spinlock-recursion-in-__gs.patch +usb-gadget-uvc-queue-empty-isoc-requests-if-no-video.patch +media-platform-mediatek-vpu-fix-null-ptr-dereference.patch +thunderbolt-read-retimer-nvm-authentication-status-p.patch +xhci-get-rid-of-xhci_plat-quirk-that-used-to-prevent.patch +usb-chipidea-imx-don-t-request-qos-for-imx8ulp.patch +usb-chipidea-imx-turn-off-vbus-comparator-when-suspe.patch +usb-chipidea-imx-add-missing-usb-phy-dpdm-wakeup-set.patch +gfs2-fix-possible-data-races-in-gfs2_show_options.patch +pcmcia-rsrc_nonstatic-fix-memory-leak-in-nonstatic_r.patch +thunderbolt-add-intel-barlow-ridge-pci-id.patch +thunderbolt-limit-intel-barlow-ridge-usb3-bandwidth.patch +firewire-net-fix-use-after-free-in-fwnet_finish_inco.patch +watchdog-sp5100_tco-support-hygon-fch-sch-server-con.patch +bluetooth-l2cap-fix-use-after-free.patch +bluetooth-btusb-add-mt7922-bluetooth-id-for-the-asus.patch +ceph-try-to-dump-the-msgs-when-decoding-fails.patch +drm-amdgpu-fix-potential-fence-use-after-free-v2.patch +fs-ntfs3-enhance-sanity-check-while-generating-attr_.patch +fs-ntfs3-return-error-for-inconsistent-extended-attr.patch +fs-ntfs3-fix-possible-null-pointer-dereferences-in-m.patch +fs-ntfs3-mark-ntfs-dirty-when-on-disk-struct-is-corr.patch +fs-ntfs3-alternative-boot-if-primary-boot-is-corrupt.patch +alsa-hda-realtek-add-quirks-for-unis-h3c-desktop-b76.patch +alsa-hda-fix-a-possible-null-pointer-dereference-due.patch +alsa-hda-realtek-add-quirk-for-asus-rog-gx650p.patch +alsa-hda-realtek-add-quirk-for-asus-rog-ga402x.patch +alsa-hda-realtek-amend-g634-quirk-to-enable-rear-spe.patch +alsa-hda-realtek-add-quirk-for-asus-rog-g614jx.patch +apparmor-fix-use-of-strcpy-in-policy_unpack_test.patch +alsa-hda-realtek-add-quirk-for-asus-rog-gz301v.patch +powerpc-kasan-disable-kcov-in-kasan-code.patch +bluetooth-mgmt-use-correct-address-for-memcpy.patch +ring-buffer-do-not-swap-cpu_buffer-during-resize-pro.patch +btrfs-move-out-now-unused-bg-from-the-reclaim-list.patch +btrfs-fix-use-after-free-of-new-block-group-that-bec.patch +can-raw-fix-receiver-memory-leak.patch +can-raw-fix-lockdep-issue-in-raw_release.patch diff --git a/queue-6.4/smb-client-fix-warning-in-cifs_smb3_do_mount.patch b/queue-6.4/smb-client-fix-warning-in-cifs_smb3_do_mount.patch new file mode 100644 index 00000000000..57cb2860125 --- /dev/null +++ b/queue-6.4/smb-client-fix-warning-in-cifs_smb3_do_mount.patch @@ -0,0 +1,88 @@ +From a3a868b8573f4a4bb9b940b8f3dc1fd668e8a38d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Jun 2023 16:24:37 -0300 +Subject: smb: client: fix warning in cifs_smb3_do_mount() + +From: Paulo Alcantara + +[ Upstream commit 12c30f33cc6769bf411088a2872843c4f9ea32f9 ] + +This fixes the following warning reported by kernel test robot + + fs/smb/client/cifsfs.c:982 cifs_smb3_do_mount() warn: possible + memory leak of 'cifs_sb' + +Link: https://lore.kernel.org/all/202306170124.CtQqzf0I-lkp@intel.com/ +Signed-off-by: Paulo Alcantara (SUSE) +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/smb/client/cifsfs.c | 28 ++++++++++------------------ + 1 file changed, 10 insertions(+), 18 deletions(-) + +diff --git a/fs/smb/client/cifsfs.c b/fs/smb/client/cifsfs.c +index 43a4d8603db34..30b03938f6d1d 100644 +--- a/fs/smb/client/cifsfs.c ++++ b/fs/smb/client/cifsfs.c +@@ -884,11 +884,11 @@ struct dentry * + cifs_smb3_do_mount(struct file_system_type *fs_type, + int flags, struct smb3_fs_context *old_ctx) + { +- int rc; +- struct super_block *sb = NULL; +- struct cifs_sb_info *cifs_sb = NULL; + struct cifs_mnt_data mnt_data; ++ struct cifs_sb_info *cifs_sb; ++ struct super_block *sb; + struct dentry *root; ++ int rc; + + if (cifsFYI) { + cifs_dbg(FYI, "%s: devname=%s flags=0x%x\n", __func__, +@@ -897,11 +897,9 @@ cifs_smb3_do_mount(struct file_system_type *fs_type, + cifs_info("Attempting to mount %s\n", old_ctx->source); + } + +- cifs_sb = kzalloc(sizeof(struct cifs_sb_info), GFP_KERNEL); +- if (cifs_sb == NULL) { +- root = ERR_PTR(-ENOMEM); +- goto out; +- } ++ cifs_sb = kzalloc(sizeof(*cifs_sb), GFP_KERNEL); ++ if (!cifs_sb) ++ return ERR_PTR(-ENOMEM); + + cifs_sb->ctx = kzalloc(sizeof(struct smb3_fs_context), GFP_KERNEL); + if (!cifs_sb->ctx) { +@@ -938,10 +936,8 @@ cifs_smb3_do_mount(struct file_system_type *fs_type, + + sb = sget(fs_type, cifs_match_super, cifs_set_super, flags, &mnt_data); + if (IS_ERR(sb)) { +- root = ERR_CAST(sb); + cifs_umount(cifs_sb); +- cifs_sb = NULL; +- goto out; ++ return ERR_CAST(sb); + } + + if (sb->s_root) { +@@ -972,13 +968,9 @@ cifs_smb3_do_mount(struct file_system_type *fs_type, + deactivate_locked_super(sb); + return root; + out: +- if (cifs_sb) { +- if (!sb || IS_ERR(sb)) { /* otherwise kill_sb will handle */ +- kfree(cifs_sb->prepath); +- smb3_cleanup_fs_context(cifs_sb->ctx); +- kfree(cifs_sb); +- } +- } ++ kfree(cifs_sb->prepath); ++ smb3_cleanup_fs_context(cifs_sb->ctx); ++ kfree(cifs_sb); + return root; + } + +-- +2.40.1 + diff --git a/queue-6.4/thunderbolt-add-intel-barlow-ridge-pci-id.patch b/queue-6.4/thunderbolt-add-intel-barlow-ridge-pci-id.patch new file mode 100644 index 00000000000..046cacb7bba --- /dev/null +++ b/queue-6.4/thunderbolt-add-intel-barlow-ridge-pci-id.patch @@ -0,0 +1,53 @@ +From 0d3a81913b107a8c23cd26971ef5d6c9ab0c5c6f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 17 Dec 2022 08:35:04 +0200 +Subject: thunderbolt: Add Intel Barlow Ridge PCI ID + +From: Mika Westerberg + +[ Upstream commit 6f14a210661ce03988ef4ed3c8402037c8e06539 ] + +Intel Barlow Ridge is the first USB4 v2 controller from Intel. The +controller exposes standard USB4 PCI class ID in typical configurations, +however there is a way to configure it so that it uses a special class +ID to allow using s different driver than the Windows inbox one. For +this reason add the Barlow Ridge PCI ID to the Linux driver too so that +the driver can attach regardless of the class ID. + +Tested-by: Pengfei Xu +Signed-off-by: Mika Westerberg +Signed-off-by: Sasha Levin +--- + drivers/thunderbolt/nhi.c | 2 ++ + drivers/thunderbolt/nhi.h | 2 ++ + 2 files changed, 4 insertions(+) + +diff --git a/drivers/thunderbolt/nhi.c b/drivers/thunderbolt/nhi.c +index e58beac442958..1257d1c41f8e5 100644 +--- a/drivers/thunderbolt/nhi.c ++++ b/drivers/thunderbolt/nhi.c +@@ -1480,6 +1480,8 @@ static struct pci_device_id nhi_ids[] = { + .driver_data = (kernel_ulong_t)&icl_nhi_ops }, + { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_MTL_P_NHI1), + .driver_data = (kernel_ulong_t)&icl_nhi_ops }, ++ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HOST_80G_NHI) }, ++ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HOST_40G_NHI) }, + + /* Any USB4 compliant host */ + { PCI_DEVICE_CLASS(PCI_CLASS_SERIAL_USB_USB4, ~0) }, +diff --git a/drivers/thunderbolt/nhi.h b/drivers/thunderbolt/nhi.h +index b0718020c6f59..c15a0c46c9cff 100644 +--- a/drivers/thunderbolt/nhi.h ++++ b/drivers/thunderbolt/nhi.h +@@ -75,6 +75,8 @@ extern const struct tb_nhi_ops icl_nhi_ops; + #define PCI_DEVICE_ID_INTEL_TITAN_RIDGE_DD_BRIDGE 0x15ef + #define PCI_DEVICE_ID_INTEL_ADL_NHI0 0x463e + #define PCI_DEVICE_ID_INTEL_ADL_NHI1 0x466d ++#define PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HOST_80G_NHI 0x5781 ++#define PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HOST_40G_NHI 0x5784 + #define PCI_DEVICE_ID_INTEL_MTL_M_NHI0 0x7eb2 + #define PCI_DEVICE_ID_INTEL_MTL_P_NHI0 0x7ec2 + #define PCI_DEVICE_ID_INTEL_MTL_P_NHI1 0x7ec3 +-- +2.40.1 + diff --git a/queue-6.4/thunderbolt-limit-intel-barlow-ridge-usb3-bandwidth.patch b/queue-6.4/thunderbolt-limit-intel-barlow-ridge-usb3-bandwidth.patch new file mode 100644 index 00000000000..a8279d50590 --- /dev/null +++ b/queue-6.4/thunderbolt-limit-intel-barlow-ridge-usb3-bandwidth.patch @@ -0,0 +1,56 @@ +From 432051c95f8b72aa8d852eb95359949c49c15da0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 May 2023 10:45:53 +0300 +Subject: thunderbolt: Limit Intel Barlow Ridge USB3 bandwidth + +From: Mika Westerberg + +[ Upstream commit f2bfa944080dcbb8eb56259dfd2c07204cbee17e ] + +Intel Barlow Ridge discrete USB4 host router has the same limitation as +the previous generations so make sure the USB3 bandwidth limitation +quirk is applied to Barlow Ridge too. + +Signed-off-by: Gil Fine +Signed-off-by: Mika Westerberg +Signed-off-by: Sasha Levin +--- + drivers/thunderbolt/nhi.h | 2 ++ + drivers/thunderbolt/quirks.c | 8 ++++++++ + 2 files changed, 10 insertions(+) + +diff --git a/drivers/thunderbolt/nhi.h b/drivers/thunderbolt/nhi.h +index c15a0c46c9cff..0f029ce758825 100644 +--- a/drivers/thunderbolt/nhi.h ++++ b/drivers/thunderbolt/nhi.h +@@ -77,6 +77,8 @@ extern const struct tb_nhi_ops icl_nhi_ops; + #define PCI_DEVICE_ID_INTEL_ADL_NHI1 0x466d + #define PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HOST_80G_NHI 0x5781 + #define PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HOST_40G_NHI 0x5784 ++#define PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HUB_80G_BRIDGE 0x5786 ++#define PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HUB_40G_BRIDGE 0x57a4 + #define PCI_DEVICE_ID_INTEL_MTL_M_NHI0 0x7eb2 + #define PCI_DEVICE_ID_INTEL_MTL_P_NHI0 0x7ec2 + #define PCI_DEVICE_ID_INTEL_MTL_P_NHI1 0x7ec3 +diff --git a/drivers/thunderbolt/quirks.c b/drivers/thunderbolt/quirks.c +index 1157b8869bcca..8c2ee431fcde8 100644 +--- a/drivers/thunderbolt/quirks.c ++++ b/drivers/thunderbolt/quirks.c +@@ -74,6 +74,14 @@ static const struct tb_quirk tb_quirks[] = { + quirk_usb3_maximum_bandwidth }, + { 0x8087, PCI_DEVICE_ID_INTEL_MTL_P_NHI1, 0x0000, 0x0000, + quirk_usb3_maximum_bandwidth }, ++ { 0x8087, PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HOST_80G_NHI, 0x0000, 0x0000, ++ quirk_usb3_maximum_bandwidth }, ++ { 0x8087, PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HOST_40G_NHI, 0x0000, 0x0000, ++ quirk_usb3_maximum_bandwidth }, ++ { 0x8087, PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HUB_80G_BRIDGE, 0x0000, 0x0000, ++ quirk_usb3_maximum_bandwidth }, ++ { 0x8087, PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HUB_40G_BRIDGE, 0x0000, 0x0000, ++ quirk_usb3_maximum_bandwidth }, + /* + * CLx is not supported on AMD USB4 Yellow Carp and Pink Sardine platforms. + */ +-- +2.40.1 + diff --git a/queue-6.4/thunderbolt-read-retimer-nvm-authentication-status-p.patch b/queue-6.4/thunderbolt-read-retimer-nvm-authentication-status-p.patch new file mode 100644 index 00000000000..dd9570a5631 --- /dev/null +++ b/queue-6.4/thunderbolt-read-retimer-nvm-authentication-status-p.patch @@ -0,0 +1,73 @@ +From 6cf97c06d9a7463c67e619a044b444e0dde64304 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 May 2023 14:46:44 +0300 +Subject: thunderbolt: Read retimer NVM authentication status prior + tb_retimer_set_inbound_sbtx() + +From: Mika Westerberg + +[ Upstream commit 1402ba08abae5cfa583ff1a40b99c098a0532d41 ] + +According to the USB4 retimer guide the correct order is immediately +after sending ENUMERATE_RETIMERS so update the code to follow this. + +Signed-off-by: Mika Westerberg +Signed-off-by: Sasha Levin +--- + drivers/thunderbolt/retimer.c | 29 +++++++++++++++++++++-------- + 1 file changed, 21 insertions(+), 8 deletions(-) + +diff --git a/drivers/thunderbolt/retimer.c b/drivers/thunderbolt/retimer.c +index 9cc28197dbc45..edbd92435b41a 100644 +--- a/drivers/thunderbolt/retimer.c ++++ b/drivers/thunderbolt/retimer.c +@@ -187,6 +187,21 @@ static ssize_t nvm_authenticate_show(struct device *dev, + return ret; + } + ++static void tb_retimer_nvm_authenticate_status(struct tb_port *port, u32 *status) ++{ ++ int i; ++ ++ tb_port_dbg(port, "reading NVM authentication status of retimers\n"); ++ ++ /* ++ * Before doing anything else, read the authentication status. ++ * If the retimer has it set, store it for the new retimer ++ * device instance. ++ */ ++ for (i = 1; i <= TB_MAX_RETIMER_INDEX; i++) ++ usb4_port_retimer_nvm_authenticate_status(port, i, &status[i]); ++} ++ + static void tb_retimer_set_inbound_sbtx(struct tb_port *port) + { + int i; +@@ -455,18 +470,16 @@ int tb_retimer_scan(struct tb_port *port, bool add) + return ret; + + /* +- * Enable sideband channel for each retimer. We can do this +- * regardless whether there is device connected or not. ++ * Immediately after sending enumerate retimers read the ++ * authentication status of each retimer. + */ +- tb_retimer_set_inbound_sbtx(port); ++ tb_retimer_nvm_authenticate_status(port, status); + + /* +- * Before doing anything else, read the authentication status. +- * If the retimer has it set, store it for the new retimer +- * device instance. ++ * Enable sideband channel for each retimer. We can do this ++ * regardless whether there is device connected or not. + */ +- for (i = 1; i <= TB_MAX_RETIMER_INDEX; i++) +- usb4_port_retimer_nvm_authenticate_status(port, i, &status[i]); ++ tb_retimer_set_inbound_sbtx(port); + + for (i = 1; i <= TB_MAX_RETIMER_INDEX; i++) { + /* +-- +2.40.1 + diff --git a/queue-6.4/usb-chipidea-imx-add-missing-usb-phy-dpdm-wakeup-set.patch b/queue-6.4/usb-chipidea-imx-add-missing-usb-phy-dpdm-wakeup-set.patch new file mode 100644 index 00000000000..fbc9d00c462 --- /dev/null +++ b/queue-6.4/usb-chipidea-imx-add-missing-usb-phy-dpdm-wakeup-set.patch @@ -0,0 +1,41 @@ +From 744908cc6f56b7fbbef6b7f5aa622267175e7f33 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 May 2023 16:19:07 +0800 +Subject: usb: chipidea: imx: add missing USB PHY DPDM wakeup setting + +From: Xu Yang + +[ Upstream commit 53d061c19dc4cb68409df6dc11c40389c8c42a75 ] + +USB PHY DPDM wakeup bit is enabled by default, when USB wakeup +is not required(/sys/.../wakeup is disabled), this bit should be +disabled, otherwise we will have unexpected wakeup if do USB device +connect/disconnect while system sleep. +This bit can be enabled for both host and device mode. + +Signed-off-by: Li Jun +Signed-off-by: Xu Yang +Acked-by: Peter Chen +Message-ID: <20230517081907.3410465-3-xu.yang_2@nxp.com> +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/chipidea/usbmisc_imx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/chipidea/usbmisc_imx.c b/drivers/usb/chipidea/usbmisc_imx.c +index 0938e274ba3a8..681c2ddc83fa5 100644 +--- a/drivers/usb/chipidea/usbmisc_imx.c ++++ b/drivers/usb/chipidea/usbmisc_imx.c +@@ -135,7 +135,7 @@ + #define TXVREFTUNE0_MASK (0xf << 20) + + #define MX6_USB_OTG_WAKEUP_BITS (MX6_BM_WAKEUP_ENABLE | MX6_BM_VBUS_WAKEUP | \ +- MX6_BM_ID_WAKEUP) ++ MX6_BM_ID_WAKEUP | MX6SX_BM_DPDM_WAKEUP_EN) + + struct usbmisc_ops { + /* It's called once when probe a usb device */ +-- +2.40.1 + diff --git a/queue-6.4/usb-chipidea-imx-don-t-request-qos-for-imx8ulp.patch b/queue-6.4/usb-chipidea-imx-don-t-request-qos-for-imx8ulp.patch new file mode 100644 index 00000000000..d0f5be5d9b6 --- /dev/null +++ b/queue-6.4/usb-chipidea-imx-don-t-request-qos-for-imx8ulp.patch @@ -0,0 +1,49 @@ +From 63b0a10e6eeba98e371a4d06681034431751e42c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 May 2023 18:40:07 +0800 +Subject: usb: chipidea: imx: don't request QoS for imx8ulp + +From: Xu Yang + +[ Upstream commit 9a070e8e208995a9d638b538ed7abf28bd6ea6f0 ] + +Use dedicated imx8ulp usb compatible to remove QoS request +since imx8ulp has no such limitation of imx7ulp: DMA will +not work if system enters idle. + +Signed-off-by: Xu Yang +Signed-off-by: Li Jun +Acked-by: Peter Chen +Message-ID: <20230530104007.1294702-2-xu.yang_2@nxp.com> +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/chipidea/ci_hdrc_imx.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/usb/chipidea/ci_hdrc_imx.c b/drivers/usb/chipidea/ci_hdrc_imx.c +index 2855ac3030014..f7577f2bd2c5d 100644 +--- a/drivers/usb/chipidea/ci_hdrc_imx.c ++++ b/drivers/usb/chipidea/ci_hdrc_imx.c +@@ -70,6 +70,10 @@ static const struct ci_hdrc_imx_platform_flag imx7ulp_usb_data = { + CI_HDRC_PMQOS, + }; + ++static const struct ci_hdrc_imx_platform_flag imx8ulp_usb_data = { ++ .flags = CI_HDRC_SUPPORTS_RUNTIME_PM, ++}; ++ + static const struct of_device_id ci_hdrc_imx_dt_ids[] = { + { .compatible = "fsl,imx23-usb", .data = &imx23_usb_data}, + { .compatible = "fsl,imx28-usb", .data = &imx28_usb_data}, +@@ -80,6 +84,7 @@ static const struct of_device_id ci_hdrc_imx_dt_ids[] = { + { .compatible = "fsl,imx6ul-usb", .data = &imx6ul_usb_data}, + { .compatible = "fsl,imx7d-usb", .data = &imx7d_usb_data}, + { .compatible = "fsl,imx7ulp-usb", .data = &imx7ulp_usb_data}, ++ { .compatible = "fsl,imx8ulp-usb", .data = &imx8ulp_usb_data}, + { /* sentinel */ } + }; + MODULE_DEVICE_TABLE(of, ci_hdrc_imx_dt_ids); +-- +2.40.1 + diff --git a/queue-6.4/usb-chipidea-imx-turn-off-vbus-comparator-when-suspe.patch b/queue-6.4/usb-chipidea-imx-turn-off-vbus-comparator-when-suspe.patch new file mode 100644 index 00000000000..dc49c09ef4e --- /dev/null +++ b/queue-6.4/usb-chipidea-imx-turn-off-vbus-comparator-when-suspe.patch @@ -0,0 +1,117 @@ +From 26003f615a5c698cf3398aa5cd82a0fcc648a4ca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 May 2023 16:19:06 +0800 +Subject: usb: chipidea: imx: turn off vbus comparator when suspend + +From: Xu Yang + +[ Upstream commit 0ac37fbdad7087bbcbbe246a602c248ccfd954ea ] + +As we use bvalid for vbus wakeup source, to save power when +suspend, turn off the vbus comparator for imx7d and imx8mm. + +Below is this bit description from RM of iMX8MM +"VBUS Valid Comparator Enable: + +This signal controls the USB OTG PHY VBUS Valid comparator which +indicates whether the voltage on the USB_OTG*_VBUS pin is below +the VBUS Valid threshold. The VBUS Valid threshold is nominally +4.75V on this USB PHY. The VBUS Valid threshold can be adjusted +using the USBNC_OTGn_PHY_CFG1[OTGTUNE0] bit field. Status of the +VBUS Valid comparator, when it is enabled, is reported on the +USBNC_OTGn_PHY_STATUS[VBUS_VLD] bit. +When OTGDISABLE0 (USBNC_USB_OTGx_PHY_CFG2[10])is set to 1'b0 and +DRVVBUS0 is set to 1'b1, the Bandgap circuitry and VBUS Valid +comparator are powered, even in Suspend or Sleep mode. +DRVVBUS0 should be reset to 1'b0 when the internal VBUS Valid comparator +is not required, to reduce quiescent current in Suspend or Sleep mode. + - 0 The VBUS Valid comparator is disabled + - 1 The VBUS Valid comparator is enabled" + +Signed-off-by: Li Jun +Signed-off-by: Xu Yang +Acked-by: Peter Chen +Message-ID: <20230517081907.3410465-2-xu.yang_2@nxp.com> +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/chipidea/usbmisc_imx.c | 35 ++++++++++++++++++++++++++++++ + 1 file changed, 35 insertions(+) + +diff --git a/drivers/usb/chipidea/usbmisc_imx.c b/drivers/usb/chipidea/usbmisc_imx.c +index c57c1a71a5132..0938e274ba3a8 100644 +--- a/drivers/usb/chipidea/usbmisc_imx.c ++++ b/drivers/usb/chipidea/usbmisc_imx.c +@@ -152,6 +152,7 @@ struct usbmisc_ops { + int (*charger_detection)(struct imx_usbmisc_data *data); + /* It's called when system resume from usb power lost */ + int (*power_lost_check)(struct imx_usbmisc_data *data); ++ void (*vbus_comparator_on)(struct imx_usbmisc_data *data, bool on); + }; + + struct imx_usbmisc { +@@ -875,6 +876,33 @@ static int imx7d_charger_detection(struct imx_usbmisc_data *data) + return ret; + } + ++static void usbmisc_imx7d_vbus_comparator_on(struct imx_usbmisc_data *data, ++ bool on) ++{ ++ unsigned long flags; ++ struct imx_usbmisc *usbmisc = dev_get_drvdata(data->dev); ++ u32 val; ++ ++ if (data->hsic) ++ return; ++ ++ spin_lock_irqsave(&usbmisc->lock, flags); ++ /* ++ * Disable VBUS valid comparator when in suspend mode, ++ * when OTG is disabled and DRVVBUS0 is asserted case ++ * the Bandgap circuitry and VBUS Valid comparator are ++ * still powered, even in Suspend or Sleep mode. ++ */ ++ val = readl(usbmisc->base + MX7D_USB_OTG_PHY_CFG2); ++ if (on) ++ val |= MX7D_USB_OTG_PHY_CFG2_DRVVBUS0; ++ else ++ val &= ~MX7D_USB_OTG_PHY_CFG2_DRVVBUS0; ++ ++ writel(val, usbmisc->base + MX7D_USB_OTG_PHY_CFG2); ++ spin_unlock_irqrestore(&usbmisc->lock, flags); ++} ++ + static int usbmisc_imx7ulp_init(struct imx_usbmisc_data *data) + { + struct imx_usbmisc *usbmisc = dev_get_drvdata(data->dev); +@@ -1018,6 +1046,7 @@ static const struct usbmisc_ops imx7d_usbmisc_ops = { + .set_wakeup = usbmisc_imx7d_set_wakeup, + .charger_detection = imx7d_charger_detection, + .power_lost_check = usbmisc_imx7d_power_lost_check, ++ .vbus_comparator_on = usbmisc_imx7d_vbus_comparator_on, + }; + + static const struct usbmisc_ops imx7ulp_usbmisc_ops = { +@@ -1132,6 +1161,9 @@ int imx_usbmisc_suspend(struct imx_usbmisc_data *data, bool wakeup) + + usbmisc = dev_get_drvdata(data->dev); + ++ if (usbmisc->ops->vbus_comparator_on) ++ usbmisc->ops->vbus_comparator_on(data, false); ++ + if (wakeup && usbmisc->ops->set_wakeup) + ret = usbmisc->ops->set_wakeup(data, true); + if (ret) { +@@ -1185,6 +1217,9 @@ int imx_usbmisc_resume(struct imx_usbmisc_data *data, bool wakeup) + goto hsic_set_clk_fail; + } + ++ if (usbmisc->ops->vbus_comparator_on) ++ usbmisc->ops->vbus_comparator_on(data, true); ++ + return 0; + + hsic_set_clk_fail: +-- +2.40.1 + diff --git a/queue-6.4/usb-gadget-u_serial-avoid-spinlock-recursion-in-__gs.patch b/queue-6.4/usb-gadget-u_serial-avoid-spinlock-recursion-in-__gs.patch new file mode 100644 index 00000000000..6b7464bf364 --- /dev/null +++ b/queue-6.4/usb-gadget-u_serial-avoid-spinlock-recursion-in-__gs.patch @@ -0,0 +1,61 @@ +From 7f4b427005396ebc272ac84d68a25e4dc965837b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 May 2023 18:57:52 +0530 +Subject: usb: gadget: u_serial: Avoid spinlock recursion in __gs_console_push + +From: Prashanth K + +[ Upstream commit e5990469943c711cb00bfde6338d2add6c6d0bfe ] + +When serial console over USB is enabled, gs_console_connect +queues gs_console_work, where it acquires the spinlock and +queues the usb request, and this request goes to gadget layer. +Now consider a situation where gadget layer prints something +to dmesg, this will eventually call gs_console_write() which +requires cons->lock. And this causes spinlock recursion. Avoid +this by excluding usb_ep_queue from the spinlock. + + spin_lock_irqsave //needs cons->lock + gs_console_write + . + . + _printk + __warn_printk + dev_warn/pr_err + . + . + [USB Gadget Layer] + . + . + usb_ep_queue + gs_console_work + __gs_console_push // acquires cons->lock + process_one_work + +Signed-off-by: Prashanth K +Link: https://lore.kernel.org/r/1683638872-6885-1-git-send-email-quic_prashk@quicinc.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/function/u_serial.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/usb/gadget/function/u_serial.c b/drivers/usb/gadget/function/u_serial.c +index e5d522d54f6a3..97f07757d19e3 100644 +--- a/drivers/usb/gadget/function/u_serial.c ++++ b/drivers/usb/gadget/function/u_serial.c +@@ -916,8 +916,11 @@ static void __gs_console_push(struct gs_console *cons) + } + + req->length = size; ++ ++ spin_unlock_irq(&cons->lock); + if (usb_ep_queue(ep, req, GFP_ATOMIC)) + req->length = 0; ++ spin_lock_irq(&cons->lock); + } + + static void gs_console_work(struct work_struct *work) +-- +2.40.1 + diff --git a/queue-6.4/usb-gadget-uvc-queue-empty-isoc-requests-if-no-video.patch b/queue-6.4/usb-gadget-uvc-queue-empty-isoc-requests-if-no-video.patch new file mode 100644 index 00000000000..1efed65a199 --- /dev/null +++ b/queue-6.4/usb-gadget-uvc-queue-empty-isoc-requests-if-no-video.patch @@ -0,0 +1,106 @@ +From b621cbe2564146446e358fb0bb15188c01b02b90 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 May 2023 16:11:03 -0700 +Subject: usb: gadget: uvc: queue empty isoc requests if no video buffer is + available + +From: Avichal Rakesh + +[ Upstream commit c3ff12a92bd7072170978b8b41c2fa41b038139a ] + +ISOC transfers expect a certain cadence of requests being queued. Not +keeping up with the expected rate of requests results in missed ISOC +transfers (EXDEV). The application layer may or may not produce video +frames to match this expectation, so uvc gadget driver must handle cases +where the application is not queuing up buffers fast enough to fulfill +ISOC requirements. + +Currently, uvc gadget driver waits for new video buffer to become available +before queuing up usb requests. With this patch the gadget driver queues up +0 length usb requests whenever there are no video buffers available. The +USB controller's complete callback is used as the limiter for how quickly +the 0 length packets will be queued. Video buffers are still queued as +soon as they become available. + +Link: https://lore.kernel.org/CAMHf4WKbi6KBPQztj9FA4kPvESc1fVKrC8G73-cs6tTeQby9=w@mail.gmail.com/ +Signed-off-by: Avichal Rakesh +Link: https://lore.kernel.org/r/20230508231103.1621375-1-arakesh@google.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/function/uvc_video.c | 32 ++++++++++++++++++------- + 1 file changed, 24 insertions(+), 8 deletions(-) + +diff --git a/drivers/usb/gadget/function/uvc_video.c b/drivers/usb/gadget/function/uvc_video.c +index dd1c6b2ca7c6f..e81865978299c 100644 +--- a/drivers/usb/gadget/function/uvc_video.c ++++ b/drivers/usb/gadget/function/uvc_video.c +@@ -386,6 +386,9 @@ static void uvcg_video_pump(struct work_struct *work) + struct uvc_buffer *buf; + unsigned long flags; + int ret; ++ bool buf_int; ++ /* video->max_payload_size is only set when using bulk transfer */ ++ bool is_bulk = video->max_payload_size; + + while (video->ep->enabled) { + /* +@@ -408,20 +411,35 @@ static void uvcg_video_pump(struct work_struct *work) + */ + spin_lock_irqsave(&queue->irqlock, flags); + buf = uvcg_queue_head(queue); +- if (buf == NULL) { ++ ++ if (buf != NULL) { ++ video->encode(req, video, buf); ++ /* Always interrupt for the last request of a video buffer */ ++ buf_int = buf->state == UVC_BUF_STATE_DONE; ++ } else if (!(queue->flags & UVC_QUEUE_DISCONNECTED) && !is_bulk) { ++ /* ++ * No video buffer available; the queue is still connected and ++ * we're traferring over ISOC. Queue a 0 length request to ++ * prevent missed ISOC transfers. ++ */ ++ req->length = 0; ++ buf_int = false; ++ } else { ++ /* ++ * Either queue has been disconnected or no video buffer ++ * available to bulk transfer. Either way, stop processing ++ * further. ++ */ + spin_unlock_irqrestore(&queue->irqlock, flags); + break; + } + +- video->encode(req, video, buf); +- + /* + * With usb3 we have more requests. This will decrease the + * interrupt load to a quarter but also catches the corner + * cases, which needs to be handled. + */ +- if (list_empty(&video->req_free) || +- buf->state == UVC_BUF_STATE_DONE || ++ if (list_empty(&video->req_free) || buf_int || + !(video->req_int_count % + DIV_ROUND_UP(video->uvc_num_requests, 4))) { + video->req_int_count = 0; +@@ -441,8 +459,7 @@ static void uvcg_video_pump(struct work_struct *work) + + /* Endpoint now owns the request */ + req = NULL; +- if (buf->state != UVC_BUF_STATE_DONE) +- video->req_int_count++; ++ video->req_int_count++; + } + + if (!req) +@@ -527,4 +544,3 @@ int uvcg_video_init(struct uvc_video *video, struct uvc_device *uvc) + V4L2_BUF_TYPE_VIDEO_OUTPUT, &video->mutex); + return 0; + } +- +-- +2.40.1 + diff --git a/queue-6.4/watchdog-sp5100_tco-support-hygon-fch-sch-server-con.patch b/queue-6.4/watchdog-sp5100_tco-support-hygon-fch-sch-server-con.patch new file mode 100644 index 00000000000..b2d8a283e42 --- /dev/null +++ b/queue-6.4/watchdog-sp5100_tco-support-hygon-fch-sch-server-con.patch @@ -0,0 +1,46 @@ +From 9ede6a1f64c60f34386e807ae3b3b6118eaf0e3c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Jun 2023 11:19:07 +0800 +Subject: watchdog: sp5100_tco: support Hygon FCH/SCH (Server Controller Hub) + +From: Yuechao Zhao + +[ Upstream commit 009637de1f65cff452ad49554d1e8ef9fda99e43 ] + +Add PCI_VENDOR_ID_HYGON(Hygon vendor id [0x1d94]) in this driver + +Signed-off-by: Yuechao Zhao +Reviewed-by: Guenter Roeck +Link: https://lkml.kernel.org/r/20230612031907.796461-1-a345351830@gmail.com +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/sp5100_tco.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/watchdog/sp5100_tco.c b/drivers/watchdog/sp5100_tco.c +index 14f8d8d90920f..2bd3dc25cb030 100644 +--- a/drivers/watchdog/sp5100_tco.c ++++ b/drivers/watchdog/sp5100_tco.c +@@ -96,7 +96,7 @@ static enum tco_reg_layout tco_reg_layout(struct pci_dev *dev) + sp5100_tco_pci->device == PCI_DEVICE_ID_AMD_KERNCZ_SMBUS && + sp5100_tco_pci->revision >= AMD_ZEN_SMBUS_PCI_REV) { + return efch_mmio; +- } else if (dev->vendor == PCI_VENDOR_ID_AMD && ++ } else if ((dev->vendor == PCI_VENDOR_ID_AMD || dev->vendor == PCI_VENDOR_ID_HYGON) && + ((dev->device == PCI_DEVICE_ID_AMD_HUDSON2_SMBUS && + dev->revision >= 0x41) || + (dev->device == PCI_DEVICE_ID_AMD_KERNCZ_SMBUS && +@@ -579,6 +579,8 @@ static const struct pci_device_id sp5100_tco_pci_tbl[] = { + PCI_ANY_ID, }, + { PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_KERNCZ_SMBUS, PCI_ANY_ID, + PCI_ANY_ID, }, ++ { PCI_VENDOR_ID_HYGON, PCI_DEVICE_ID_AMD_KERNCZ_SMBUS, PCI_ANY_ID, ++ PCI_ANY_ID, }, + { 0, }, /* End of list */ + }; + MODULE_DEVICE_TABLE(pci, sp5100_tco_pci_tbl); +-- +2.40.1 + diff --git a/queue-6.4/wrap-lines-at-80.patch b/queue-6.4/wrap-lines-at-80.patch new file mode 100644 index 00000000000..eacbefc1eda --- /dev/null +++ b/queue-6.4/wrap-lines-at-80.patch @@ -0,0 +1,53 @@ +From 8e2a5d5f7d646129c3182cc7f930a6369a7793e7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Jun 2023 14:08:49 +0100 +Subject: Wrap lines at 80 + +From: David Howells + +[ Upstream commit 936dc763c52e05cb2e7302af30a69c826916d89e ] + +Wrap a line at 80 to stop checkpatch complaining. + +Signed-off-by: David Howells +cc: Jeff Layton +cc: Steve French +cc: Shyam Prasad N +cc: Rohith Surabattula +cc: Jens Axboe +cc: Herbert Xu +cc: "David S. Miller" +cc: Eric Dumazet +cc: Jakub Kicinski +cc: Paolo Abeni +cc: Matthew Wilcox +cc: Simon Horman +cc: linux-crypto@vger.kernel.org +cc: linux-cachefs@redhat.com +cc: linux-cifs@vger.kernel.org +cc: linux-fsdevel@vger.kernel.org +cc: netdev@vger.kernel.org +Signed-off-by: Paolo Abeni +Stable-dep-of: f443fd5af5db ("crypto, cifs: fix error handling in extract_iter_to_sg()") +Signed-off-by: Sasha Levin +--- + fs/netfs/iterator.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/fs/netfs/iterator.c b/fs/netfs/iterator.c +index f41a37bca1e8b..9f09dc30ceb65 100644 +--- a/fs/netfs/iterator.c ++++ b/fs/netfs/iterator.c +@@ -119,7 +119,8 @@ static ssize_t extract_user_to_sg(struct iov_iter *iter, + size_t len, off; + + /* We decant the page list into the tail of the scatterlist */ +- pages = (void *)sgtable->sgl + array_size(sg_max, sizeof(struct scatterlist)); ++ pages = (void *)sgtable->sgl + ++ array_size(sg_max, sizeof(struct scatterlist)); + pages -= sg_max; + + do { +-- +2.40.1 + diff --git a/queue-6.4/xhci-get-rid-of-xhci_plat-quirk-that-used-to-prevent.patch b/queue-6.4/xhci-get-rid-of-xhci_plat-quirk-that-used-to-prevent.patch new file mode 100644 index 00000000000..e4d401b32c6 --- /dev/null +++ b/queue-6.4/xhci-get-rid-of-xhci_plat-quirk-that-used-to-prevent.patch @@ -0,0 +1,150 @@ +From ba4565679887d8004edc62700fd69bda586bb974 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Jun 2023 17:40:02 +0300 +Subject: xhci: get rid of XHCI_PLAT quirk that used to prevent MSI setup + +From: Mathias Nyman + +[ Upstream commit 0a4776205b16d038ec6fedef2094951fcb6f441b ] + +The XHCI_PLAT quirk was only needed to ensure non-PCI xHC host avoided +setting up MSI interrupts in generic xhci codepaths. + +The MSI setup code is now moved to PCI specific xhci-pci.c file so +the quirk is no longer needed. + +Remove setting the XHCI_PLAT quirk for HiSilocon SoC xHC, NVIDIA Tegra xHC, +MediaTek xHC, the generic xhci-plat driver, and the checks for XHCI_PLAT +in xhci-pci.c MSI setup code. + +Signed-off-by: Mathias Nyman +Message-ID: <20230602144009.1225632-5-mathias.nyman@linux.intel.com> +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/host/xhci-histb.c | 12 +----------- + drivers/usb/host/xhci-mtk.c | 6 ------ + drivers/usb/host/xhci-pci.c | 7 ------- + drivers/usb/host/xhci-plat.c | 7 +------ + drivers/usb/host/xhci-tegra.c | 1 - + drivers/usb/host/xhci.h | 2 +- + 6 files changed, 3 insertions(+), 32 deletions(-) + +diff --git a/drivers/usb/host/xhci-histb.c b/drivers/usb/host/xhci-histb.c +index 91ce97821de51..7c20477550830 100644 +--- a/drivers/usb/host/xhci-histb.c ++++ b/drivers/usb/host/xhci-histb.c +@@ -164,16 +164,6 @@ static void xhci_histb_host_disable(struct xhci_hcd_histb *histb) + clk_disable_unprepare(histb->bus_clk); + } + +-static void xhci_histb_quirks(struct device *dev, struct xhci_hcd *xhci) +-{ +- /* +- * As of now platform drivers don't provide MSI support so we ensure +- * here that the generic code does not try to make a pci_dev from our +- * dev struct in order to setup MSI +- */ +- xhci->quirks |= XHCI_PLAT; +-} +- + /* called during probe() after chip reset completes */ + static int xhci_histb_setup(struct usb_hcd *hcd) + { +@@ -186,7 +176,7 @@ static int xhci_histb_setup(struct usb_hcd *hcd) + return ret; + } + +- return xhci_gen_setup(hcd, xhci_histb_quirks); ++ return xhci_gen_setup(hcd, NULL); + } + + static const struct xhci_driver_overrides xhci_histb_overrides __initconst = { +diff --git a/drivers/usb/host/xhci-mtk.c b/drivers/usb/host/xhci-mtk.c +index b60521e1a9a63..9a40da3b0064b 100644 +--- a/drivers/usb/host/xhci-mtk.c ++++ b/drivers/usb/host/xhci-mtk.c +@@ -418,12 +418,6 @@ static void xhci_mtk_quirks(struct device *dev, struct xhci_hcd *xhci) + struct usb_hcd *hcd = xhci_to_hcd(xhci); + struct xhci_hcd_mtk *mtk = hcd_to_mtk(hcd); + +- /* +- * As of now platform drivers don't provide MSI support so we ensure +- * here that the generic code does not try to make a pci_dev from our +- * dev struct in order to setup MSI +- */ +- xhci->quirks |= XHCI_PLAT; + xhci->quirks |= XHCI_MTK_HOST; + /* + * MTK host controller gives a spurious successful event after a +diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c +index db9826c38b20b..9540f0e48c215 100644 +--- a/drivers/usb/host/xhci-pci.c ++++ b/drivers/usb/host/xhci-pci.c +@@ -108,9 +108,6 @@ static void xhci_cleanup_msix(struct xhci_hcd *xhci) + struct usb_hcd *hcd = xhci_to_hcd(xhci); + struct pci_dev *pdev = to_pci_dev(hcd->self.controller); + +- if (xhci->quirks & XHCI_PLAT) +- return; +- + /* return if using legacy interrupt */ + if (hcd->irq > 0) + return; +@@ -208,10 +205,6 @@ static int xhci_try_enable_msi(struct usb_hcd *hcd) + struct pci_dev *pdev; + int ret; + +- /* The xhci platform device has set up IRQs through usb_add_hcd. */ +- if (xhci->quirks & XHCI_PLAT) +- return 0; +- + pdev = to_pci_dev(xhci_to_hcd(xhci)->self.controller); + /* + * Some Fresco Logic host controllers advertise MSI, but fail to +diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c +index f36633fa83624..80da67a6c3bf2 100644 +--- a/drivers/usb/host/xhci-plat.c ++++ b/drivers/usb/host/xhci-plat.c +@@ -78,12 +78,7 @@ static void xhci_plat_quirks(struct device *dev, struct xhci_hcd *xhci) + { + struct xhci_plat_priv *priv = xhci_to_priv(xhci); + +- /* +- * As of now platform drivers don't provide MSI support so we ensure +- * here that the generic code does not try to make a pci_dev from our +- * dev struct in order to setup MSI +- */ +- xhci->quirks |= XHCI_PLAT | priv->quirks; ++ xhci->quirks |= priv->quirks; + } + + /* called during probe() after chip reset completes */ +diff --git a/drivers/usb/host/xhci-tegra.c b/drivers/usb/host/xhci-tegra.c +index d28fa892c2866..07a319db58034 100644 +--- a/drivers/usb/host/xhci-tegra.c ++++ b/drivers/usb/host/xhci-tegra.c +@@ -2662,7 +2662,6 @@ static void tegra_xhci_quirks(struct device *dev, struct xhci_hcd *xhci) + { + struct tegra_xusb *tegra = dev_get_drvdata(dev); + +- xhci->quirks |= XHCI_PLAT; + if (tegra && tegra->soc->lpm_support) + xhci->quirks |= XHCI_LPM_SUPPORT; + } +diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h +index 4474d540f6b49..0b1928851a2a9 100644 +--- a/drivers/usb/host/xhci.h ++++ b/drivers/usb/host/xhci.h +@@ -1874,7 +1874,7 @@ struct xhci_hcd { + #define XHCI_SPURIOUS_REBOOT BIT_ULL(13) + #define XHCI_COMP_MODE_QUIRK BIT_ULL(14) + #define XHCI_AVOID_BEI BIT_ULL(15) +-#define XHCI_PLAT BIT_ULL(16) ++#define XHCI_PLAT BIT_ULL(16) /* Deprecated */ + #define XHCI_SLOW_SUSPEND BIT_ULL(17) + #define XHCI_SPURIOUS_WAKEUP BIT_ULL(18) + /* For controllers with a broken beyond repair streams implementation */ +-- +2.40.1 +