From: Sasha Levin Date: Mon, 12 Jun 2023 03:51:35 +0000 (-0400) Subject: Fixes for 6.3 X-Git-Tag: v4.14.318~38 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=b61fc92da83defb9dc14f1f364d4cdacc24f8428;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 6.3 Signed-off-by: Sasha Levin --- diff --git a/queue-6.3/arm-at91-pm-fix-imbalanced-reference-counter-for-eth.patch b/queue-6.3/arm-at91-pm-fix-imbalanced-reference-counter-for-eth.patch new file mode 100644 index 00000000000..1c7a5b17275 --- /dev/null +++ b/queue-6.3/arm-at91-pm-fix-imbalanced-reference-counter-for-eth.patch @@ -0,0 +1,87 @@ +From aa220a94f94c20c67acda6df88874dda326b0934 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 May 2023 09:25:11 +0300 +Subject: ARM: at91: pm: fix imbalanced reference counter for ethernet devices + +From: Claudiu Beznea + +[ Upstream commit ccd4923d18d5698a5910d516646ce125b9155d47 ] + +The of_find_device_by_node() function is returning a struct platform_device +object with the embedded struct device member's reference counter +incremented. This needs to be dropped when done with the platform device +returned by of_find_device_by_node(). + +at91_pm_eth_quirk_is_valid() calls of_find_device_by_node() on +suspend and resume path. On suspend it calls of_find_device_by_node() and +on resume and failure paths it drops the counter of +struct platform_device::dev. + +In case ethernet device may not wakeup there is a put_device() on +at91_pm_eth_quirk_is_valid() which is wrong as it colides with +put_device() on resume path leading to the reference counter of struct +device embedded in struct platform_device to be messed, stack trace to be +displayed (after 5 consecutive suspend/resume cycles) and execution to +hang. + +Along with this the error path of at91_pm_config_quirks() had been also +adapted to decrement propertly the reference counter of struct device +embedded in struct platform_device. + +Fixes: b7fc72c63399 ("ARM: at91: pm: add quirks for pm") +Signed-off-by: Claudiu Beznea +Acked-by: Nicolas Ferre +Link: https://lore.kernel.org/r/20230518062511.2988500-1-claudiu.beznea@microchip.com +Signed-off-by: Sasha Levin +--- + arch/arm/mach-at91/pm.c | 20 +++++++++----------- + 1 file changed, 9 insertions(+), 11 deletions(-) + +diff --git a/arch/arm/mach-at91/pm.c b/arch/arm/mach-at91/pm.c +index 60dc56d8acfb9..437dd0352fd44 100644 +--- a/arch/arm/mach-at91/pm.c ++++ b/arch/arm/mach-at91/pm.c +@@ -334,16 +334,14 @@ static bool at91_pm_eth_quirk_is_valid(struct at91_pm_quirk_eth *eth) + pdev = of_find_device_by_node(eth->np); + if (!pdev) + return false; ++ /* put_device(eth->dev) is called at the end of suspend. */ + eth->dev = &pdev->dev; + } + + /* No quirks if device isn't a wakeup source. */ +- if (!device_may_wakeup(eth->dev)) { +- put_device(eth->dev); ++ if (!device_may_wakeup(eth->dev)) + return false; +- } + +- /* put_device(eth->dev) is called at the end of suspend. */ + return true; + } + +@@ -439,14 +437,14 @@ static int at91_pm_config_quirks(bool suspend) + pr_err("AT91: PM: failed to enable %s clocks\n", + j == AT91_PM_G_ETH ? "geth" : "eth"); + } +- } else { +- /* +- * Release the reference to eth->dev taken in +- * at91_pm_eth_quirk_is_valid(). +- */ +- put_device(eth->dev); +- eth->dev = NULL; + } ++ ++ /* ++ * Release the reference to eth->dev taken in ++ * at91_pm_eth_quirk_is_valid(). ++ */ ++ put_device(eth->dev); ++ eth->dev = NULL; + } + + return ret; +-- +2.39.2 + diff --git a/queue-6.3/arm-dts-at91-sama7g5ek-fix-debounce-delay-property-f.patch b/queue-6.3/arm-dts-at91-sama7g5ek-fix-debounce-delay-property-f.patch new file mode 100644 index 00000000000..c5053c233ec --- /dev/null +++ b/queue-6.3/arm-dts-at91-sama7g5ek-fix-debounce-delay-property-f.patch @@ -0,0 +1,37 @@ +From 7f83044019eab6e45f332ef3c60692226b5991ac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 May 2023 08:27:50 +0300 +Subject: ARM: dts: at91: sama7g5ek: fix debounce delay property for shdwc + +From: Claudiu Beznea + +[ Upstream commit 6b0db163ff9200a55dc77a652dad1d4b0a853f63 ] + +There is no atmel,shdwc-debouncer property for SHDWC. The right DT property +is debounce-delay-us. Use it. + +Fixes: 16b161bcf5d4 ("ARM: dts: at91: sama7g5: add shdwc node") +Signed-off-by: Claudiu Beznea +Acked-by: Nicolas Ferre +Link: https://lore.kernel.org/r/20230523052750.184223-1-claudiu.beznea@microchip.com +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/at91-sama7g5ek.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/at91-sama7g5ek.dts b/arch/arm/boot/dts/at91-sama7g5ek.dts +index aa5cc0e98bbab..217e9b96c61e5 100644 +--- a/arch/arm/boot/dts/at91-sama7g5ek.dts ++++ b/arch/arm/boot/dts/at91-sama7g5ek.dts +@@ -792,7 +792,7 @@ &sdmmc2 { + }; + + &shdwc { +- atmel,shdwc-debouncer = <976>; ++ debounce-delay-us = <976>; + status = "okay"; + + input@0 { +-- +2.39.2 + diff --git a/queue-6.3/arm64-dts-imx8-ss-dma-assign-default-clock-rate-for-.patch b/queue-6.3/arm64-dts-imx8-ss-dma-assign-default-clock-rate-for-.patch new file mode 100644 index 00000000000..6e3639a72b4 --- /dev/null +++ b/queue-6.3/arm64-dts-imx8-ss-dma-assign-default-clock-rate-for-.patch @@ -0,0 +1,65 @@ +From d2f4758e10e5c06d897cb0334b99ff2dc05db1dc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 May 2023 10:38:54 -0500 +Subject: arm64: dts: imx8-ss-dma: assign default clock rate for lpuarts + +From: Shenwei Wang + +[ Upstream commit ca50d7765587fe0a8351a6e8d9742cfd4811d925 ] + +Add the assigned-clocks and assigned-clock-rates properties for the +LPUARTx nodes. Without these properties, the default clock rate +used would be 0, which can cause the UART ports to fail when open. + +Fixes: 35f4e9d7530f ("arm64: dts: imx8: split adma ss into dma and audio ss") +Signed-off-by: Shenwei Wang +Reviewed-by: Fabio Estevam +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8-ss-dma.dtsi | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/arch/arm64/boot/dts/freescale/imx8-ss-dma.dtsi b/arch/arm64/boot/dts/freescale/imx8-ss-dma.dtsi +index a943a1e2797f4..21345ae14eb25 100644 +--- a/arch/arm64/boot/dts/freescale/imx8-ss-dma.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8-ss-dma.dtsi +@@ -90,6 +90,8 @@ lpuart0: serial@5a060000 { + clocks = <&uart0_lpcg IMX_LPCG_CLK_4>, + <&uart0_lpcg IMX_LPCG_CLK_0>; + clock-names = "ipg", "baud"; ++ assigned-clocks = <&clk IMX_SC_R_UART_0 IMX_SC_PM_CLK_PER>; ++ assigned-clock-rates = <80000000>; + power-domains = <&pd IMX_SC_R_UART_0>; + status = "disabled"; + }; +@@ -100,6 +102,8 @@ lpuart1: serial@5a070000 { + clocks = <&uart1_lpcg IMX_LPCG_CLK_4>, + <&uart1_lpcg IMX_LPCG_CLK_0>; + clock-names = "ipg", "baud"; ++ assigned-clocks = <&clk IMX_SC_R_UART_1 IMX_SC_PM_CLK_PER>; ++ assigned-clock-rates = <80000000>; + power-domains = <&pd IMX_SC_R_UART_1>; + status = "disabled"; + }; +@@ -110,6 +114,8 @@ lpuart2: serial@5a080000 { + clocks = <&uart2_lpcg IMX_LPCG_CLK_4>, + <&uart2_lpcg IMX_LPCG_CLK_0>; + clock-names = "ipg", "baud"; ++ assigned-clocks = <&clk IMX_SC_R_UART_2 IMX_SC_PM_CLK_PER>; ++ assigned-clock-rates = <80000000>; + power-domains = <&pd IMX_SC_R_UART_2>; + status = "disabled"; + }; +@@ -120,6 +126,8 @@ lpuart3: serial@5a090000 { + clocks = <&uart3_lpcg IMX_LPCG_CLK_4>, + <&uart3_lpcg IMX_LPCG_CLK_0>; + clock-names = "ipg", "baud"; ++ assigned-clocks = <&clk IMX_SC_R_UART_3 IMX_SC_PM_CLK_PER>; ++ assigned-clock-rates = <80000000>; + power-domains = <&pd IMX_SC_R_UART_3>; + status = "disabled"; + }; +-- +2.39.2 + diff --git a/queue-6.3/arm64-dts-imx8mn-beacon-fix-spi-cs-pinmux.patch b/queue-6.3/arm64-dts-imx8mn-beacon-fix-spi-cs-pinmux.patch new file mode 100644 index 00000000000..71480b29b18 --- /dev/null +++ b/queue-6.3/arm64-dts-imx8mn-beacon-fix-spi-cs-pinmux.patch @@ -0,0 +1,48 @@ +From 8f74418feeab46ba44568c0a99217a53776e4620 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 28 May 2023 06:22:54 -0500 +Subject: arm64: dts: imx8mn-beacon: Fix SPI CS pinmux + +From: Adam Ford + +[ Upstream commit 9bf2e534313fcf420367668cc1f30e10469901dc ] + +The final production baseboard had a different chip select than +earlier prototype boards. When the newer board was released, +the SPI stopped working because the wrong pin was used in the device +tree and conflicted with the UART RTS. Fix the pinmux for +production boards. + +Fixes: 36ca3c8ccb53 ("arm64: dts: imx: Add Beacon i.MX8M Nano development kit") +Signed-off-by: Adam Ford +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8mn-beacon-baseboard.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mn-beacon-baseboard.dtsi b/arch/arm64/boot/dts/freescale/imx8mn-beacon-baseboard.dtsi +index 9e82069c941fa..5a1f7c30afe57 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mn-beacon-baseboard.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mn-beacon-baseboard.dtsi +@@ -81,7 +81,7 @@ sound { + &ecspi2 { + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_espi2>; +- cs-gpios = <&gpio5 9 GPIO_ACTIVE_LOW>; ++ cs-gpios = <&gpio5 13 GPIO_ACTIVE_LOW>; + status = "okay"; + + eeprom@0 { +@@ -202,7 +202,7 @@ pinctrl_espi2: espi2grp { + MX8MN_IOMUXC_ECSPI2_SCLK_ECSPI2_SCLK 0x82 + MX8MN_IOMUXC_ECSPI2_MOSI_ECSPI2_MOSI 0x82 + MX8MN_IOMUXC_ECSPI2_MISO_ECSPI2_MISO 0x82 +- MX8MN_IOMUXC_ECSPI1_SS0_GPIO5_IO9 0x41 ++ MX8MN_IOMUXC_ECSPI2_SS0_GPIO5_IO13 0x41 + >; + }; + +-- +2.39.2 + diff --git a/queue-6.3/arm64-dts-imx8qm-mek-correct-gpios-for-usdhc2-cd-and.patch b/queue-6.3/arm64-dts-imx8qm-mek-correct-gpios-for-usdhc2-cd-and.patch new file mode 100644 index 00000000000..eb033aad8a1 --- /dev/null +++ b/queue-6.3/arm64-dts-imx8qm-mek-correct-gpios-for-usdhc2-cd-and.patch @@ -0,0 +1,38 @@ +From 721ee0e20832f39b9761cdd9d951dc02fc518e23 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 May 2023 08:54:21 -0500 +Subject: arm64: dts: imx8qm-mek: correct GPIOs for USDHC2 CD and WP signals + +From: Shenwei Wang + +[ Upstream commit 2b28fc688cdff225c41cdd22857500e187453ed7 ] + +The USDHC2 CD and WP sginal should be on LSIO_GPIO5. + +Fixes: 307fd14d4b14 ("arm64: dts: imx: add imx8qm mek support") +Signed-off-by: Shenwei Wang +Reviewed-by: Fabio Estevam +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8qm-mek.dts | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx8qm-mek.dts b/arch/arm64/boot/dts/freescale/imx8qm-mek.dts +index ce9d3f0b98fc0..607cd6b4e9721 100644 +--- a/arch/arm64/boot/dts/freescale/imx8qm-mek.dts ++++ b/arch/arm64/boot/dts/freescale/imx8qm-mek.dts +@@ -82,8 +82,8 @@ &usdhc2 { + pinctrl-0 = <&pinctrl_usdhc2>; + bus-width = <4>; + vmmc-supply = <®_usdhc2_vmmc>; +- cd-gpios = <&lsio_gpio4 22 GPIO_ACTIVE_LOW>; +- wp-gpios = <&lsio_gpio4 21 GPIO_ACTIVE_HIGH>; ++ cd-gpios = <&lsio_gpio5 22 GPIO_ACTIVE_LOW>; ++ wp-gpios = <&lsio_gpio5 21 GPIO_ACTIVE_HIGH>; + status = "okay"; + }; + +-- +2.39.2 + diff --git a/queue-6.3/arm64-dts-qcom-sc7180-lite-fix-sdram-freq-for-miside.patch b/queue-6.3/arm64-dts-qcom-sc7180-lite-fix-sdram-freq-for-miside.patch new file mode 100644 index 00000000000..1a1cb68a351 --- /dev/null +++ b/queue-6.3/arm64-dts-qcom-sc7180-lite-fix-sdram-freq-for-miside.patch @@ -0,0 +1,87 @@ +From d07b66867045109cf958f9b17933afa46a2bcde9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 May 2023 17:19:29 -0700 +Subject: arm64: dts: qcom: sc7180-lite: Fix SDRAM freq for misidentified + sc7180-lite boards + +From: Douglas Anderson + +[ Upstream commit 3a735530c159b75e1402c08abe1ba4eb99a1f7a3 ] + +In general, the three SKUs of sc7180 (lite, normal, and pro) are +handled dynamically. + +The cpufreq table in sc7180.dtsi includes the superset of all CPU +frequencies. The "qcom-cpufreq-hw" driver in Linux shows that we can +dynamically detect which frequencies are actually available on the +currently running CPU and then we can just enable those ones. + +The GPU is similarly dynamic. The nvmem has a fuse in it (see +"gpu_speed_bin" in sc7180.dtsi) that the GPU driver can use to figure +out which frequencies to enable. + +There is one part, however, that is not so dynamic. The way SDRAM +frequency works in sc7180 is that it's tied to cpufreq. At the busiest +cpufreq operating points we'll pick the top supported SDRAM frequency. +They ramp down together. + +For the "pro" SKU of sc7180, we only enable one extra cpufreq step. +That extra cpufreq step runs SDRAM at the same speed as the step +below. Thus, for normal and pro things are OK. There is no sc7180-pro +device tree snippet. + +For the "lite" SKU if sc7180, however, things aren't so easy. The +"lite" SKU drops 3 cpufreq entries but can still run SDRAM at max +frequency. That messed things up with the whole scheme. This is why we +added the "sc7180-lite" fragment in commit 8fd01e01fd6f ("arm64: dts: +qcom: sc7180-lite: Tweak DDR/L3 scaling on SC7180-lite"). + +When the lite scheme came about, it was agreed that the WiFi SKUs of +lazor would _always_ be "lite" and would, in fact, be the only "lite" +devices. Unfortunately, this decision changed and folks didn't realize +that it would be a problem. Specifically, some later lazor WiFi-only +devices were built with "pro" CPUs. + +Building WiFi-only lazor with "pro" CPUs isn't the end of the world. +The SDRAM will ramp up a little sooner than it otherwise would, but +aside from a small power hit things work OK. One problem, though, is +that the SDRAM scaling becomes a bit quirky. Specifically, with the +current tables we'll max out SDRAM frequency at 2.1GHz but then +_lower_ it at 2.2GHz / 2.3GHz only to raise it back to max for 2.4GHz +and 2.55GHz. + +Let's at least fix this so that the SDRAM frequency doesn't go down in +that quirky way. On true "lite" SKUs this change will be a no-op +because the operating points we're touching are disabled. This change +is only useful when a board that thinks it has a "lite" CPU actually +has a "normal" or "pro" one stuffed. + +Fixes: 8fd01e01fd6f ("arm64: dts: qcom: sc7180-lite: Tweak DDR/L3 scaling on SC7180-lite") +Signed-off-by: Douglas Anderson +Reviewed-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230515171929.1.Ic8dee2cb79ce39ffc04eab2a344dde47b2f9459f@changeid +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sc7180-lite.dtsi | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/arch/arm64/boot/dts/qcom/sc7180-lite.dtsi b/arch/arm64/boot/dts/qcom/sc7180-lite.dtsi +index d8ed1d7b4ec76..4b306a59d9bec 100644 +--- a/arch/arm64/boot/dts/qcom/sc7180-lite.dtsi ++++ b/arch/arm64/boot/dts/qcom/sc7180-lite.dtsi +@@ -16,3 +16,11 @@ &cpu6_opp11 { + &cpu6_opp12 { + opp-peak-kBps = <8532000 23347200>; + }; ++ ++&cpu6_opp13 { ++ opp-peak-kBps = <8532000 23347200>; ++}; ++ ++&cpu6_opp14 { ++ opp-peak-kBps = <8532000 23347200>; ++}; +-- +2.39.2 + diff --git a/queue-6.3/arm64-dts-qcom-sc8280xp-flush-rsc-sleep-wake-votes.patch b/queue-6.3/arm64-dts-qcom-sc8280xp-flush-rsc-sleep-wake-votes.patch new file mode 100644 index 00000000000..02cbc24dea2 --- /dev/null +++ b/queue-6.3/arm64-dts-qcom-sc8280xp-flush-rsc-sleep-wake-votes.patch @@ -0,0 +1,41 @@ +From 39d4ab1f38a3cc561d178213fdf313c507749bb5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 May 2023 08:04:25 -0700 +Subject: arm64: dts: qcom: sc8280xp: Flush RSC sleep & wake votes + +From: Bjorn Andersson + +[ Upstream commit ce7c014937c442be677963848c7db62eccd94eac ] + +The rpmh driver will cache sleep and wake votes until the cluster +power-domain is about to enter idle, to avoid unnecessary writes. So +associate the apps_rsc with the cluster pd, so that it can be notified +about this event. + +Without this, only AMC votes are being commited. + +Signed-off-by: Bjorn Andersson +Reviewed-by: Konrad Dybcio +Fixes: 152d1faf1e2f ("arm64: dts: qcom: add SC8280XP platform") +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230512150425.3171122-1-quic_bjorande@quicinc.com +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sc8280xp.dtsi | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi +index 03b679b75201d..f081ca449699a 100644 +--- a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi ++++ b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi +@@ -3957,6 +3957,7 @@ apps_rsc: rsc@18200000 { + qcom,tcs-config = , , + , ; + label = "apps_rsc"; ++ power-domains = <&CLUSTER_PD>; + + apps_bcm_voter: bcm-voter { + compatible = "qcom,bcm-voter"; +-- +2.39.2 + diff --git a/queue-6.3/arm64-dts-qcom-sm6375-pdx225-fix-remoteproc-firmware.patch b/queue-6.3/arm64-dts-qcom-sm6375-pdx225-fix-remoteproc-firmware.patch new file mode 100644 index 00000000000..308d4bfde78 --- /dev/null +++ b/queue-6.3/arm64-dts-qcom-sm6375-pdx225-fix-remoteproc-firmware.patch @@ -0,0 +1,42 @@ +From 1e699268eba1a20081e76c2f12b5740ef2a1a100 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 May 2023 19:06:13 +0200 +Subject: arm64: dts: qcom: sm6375-pdx225: Fix remoteproc firmware paths + +From: Konrad Dybcio + +[ Upstream commit a14da6144d16ef27e3022835fa282a3740b8ad7b ] + +They were previously missing the SoC name. Fix it. + +Fixes: a2ad207c412b ("arm64: dts: qcom: sm6375-pdx225: Enable ADSP & CDSP") +Signed-off-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230517-topic-murray-fwname-v1-1-923e87312249@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sm6375-sony-xperia-murray-pdx225.dts | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sm6375-sony-xperia-murray-pdx225.dts b/arch/arm64/boot/dts/qcom/sm6375-sony-xperia-murray-pdx225.dts +index b691c3834b6b6..71970dd3fc1ad 100644 +--- a/arch/arm64/boot/dts/qcom/sm6375-sony-xperia-murray-pdx225.dts ++++ b/arch/arm64/boot/dts/qcom/sm6375-sony-xperia-murray-pdx225.dts +@@ -151,12 +151,12 @@ &qupv3_id_1 { + }; + + &remoteproc_adsp { +- firmware-name = "qcom/Sony/murray/adsp.mbn"; ++ firmware-name = "qcom/sm6375/Sony/murray/adsp.mbn"; + status = "okay"; + }; + + &remoteproc_cdsp { +- firmware-name = "qcom/Sony/murray/cdsp.mbn"; ++ firmware-name = "qcom/sm6375/Sony/murray/cdsp.mbn"; + status = "okay"; + }; + +-- +2.39.2 + diff --git a/queue-6.3/asoc-amd-ps-fix-for-acp_lock-access-in-pdm-driver.patch b/queue-6.3/asoc-amd-ps-fix-for-acp_lock-access-in-pdm-driver.patch new file mode 100644 index 00000000000..63e339a448e --- /dev/null +++ b/queue-6.3/asoc-amd-ps-fix-for-acp_lock-access-in-pdm-driver.patch @@ -0,0 +1,77 @@ +From f572d3a489adc092b0ad511bf4c0df77a0106ab0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 May 2023 16:59:55 +0530 +Subject: ASoC: amd: ps: fix for acp_lock access in pdm driver + +From: Vijendar Mukunda + +[ Upstream commit b6b5c6426efe27cbd954409a50604d99c79bd42b ] + +Sending the mutex address(acp_lock) as platform +data during ACP PDM platform driver register sequence, +its creating copy of the platform data. +Referencing this platform data in ACP PDM driver results +incorrect reference to the common lock usage. + +Instead of directly passing the lock address as platform +data, retrieve it from parent driver data structure +and use the same lock reference in ACP PDM driver. + +Fixes: 45aa83cb9388 ("ASoC: amd: ps: use acp_lock to protect common registers in pdm driver") + +Signed-off-by: Vijendar Mukunda +Link: https://lore.kernel.org/r/20230525113000.1290758-1-Vijendar.Mukunda@amd.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/amd/ps/pci-ps.c | 3 +-- + sound/soc/amd/ps/ps-pdm-dma.c | 10 +++++----- + 2 files changed, 6 insertions(+), 7 deletions(-) + +diff --git a/sound/soc/amd/ps/pci-ps.c b/sound/soc/amd/ps/pci-ps.c +index afddb9a77ba49..b1337b96ea8d6 100644 +--- a/sound/soc/amd/ps/pci-ps.c ++++ b/sound/soc/amd/ps/pci-ps.c +@@ -211,8 +211,7 @@ static int create_acp63_platform_devs(struct pci_dev *pci, struct acp63_dev_data + case ACP63_PDM_DEV_MASK: + adata->pdm_dev_index = 0; + acp63_fill_platform_dev_info(&pdevinfo[0], parent, NULL, "acp_ps_pdm_dma", +- 0, adata->res, 1, &adata->acp_lock, +- sizeof(adata->acp_lock)); ++ 0, adata->res, 1, NULL, 0); + acp63_fill_platform_dev_info(&pdevinfo[1], parent, NULL, "dmic-codec", + 0, NULL, 0, NULL, 0); + acp63_fill_platform_dev_info(&pdevinfo[2], parent, NULL, "acp_ps_mach", +diff --git a/sound/soc/amd/ps/ps-pdm-dma.c b/sound/soc/amd/ps/ps-pdm-dma.c +index 454dab062e4f5..527594aa9c113 100644 +--- a/sound/soc/amd/ps/ps-pdm-dma.c ++++ b/sound/soc/amd/ps/ps-pdm-dma.c +@@ -361,12 +361,12 @@ static int acp63_pdm_audio_probe(struct platform_device *pdev) + { + struct resource *res; + struct pdm_dev_data *adata; ++ struct acp63_dev_data *acp_data; ++ struct device *parent; + int status; + +- if (!pdev->dev.platform_data) { +- dev_err(&pdev->dev, "platform_data not retrieved\n"); +- return -ENODEV; +- } ++ parent = pdev->dev.parent; ++ acp_data = dev_get_drvdata(parent); + res = platform_get_resource(pdev, IORESOURCE_MEM, 0); + if (!res) { + dev_err(&pdev->dev, "IORESOURCE_MEM FAILED\n"); +@@ -382,7 +382,7 @@ static int acp63_pdm_audio_probe(struct platform_device *pdev) + return -ENOMEM; + + adata->capture_stream = NULL; +- adata->acp_lock = pdev->dev.platform_data; ++ adata->acp_lock = &acp_data->acp_lock; + dev_set_drvdata(&pdev->dev, adata); + status = devm_snd_soc_register_component(&pdev->dev, + &acp63_pdm_component, +-- +2.39.2 + diff --git a/queue-6.3/asoc-codecs-wsa881x-do-not-set-can_multi_write-flag.patch b/queue-6.3/asoc-codecs-wsa881x-do-not-set-can_multi_write-flag.patch new file mode 100644 index 00000000000..4784d3077d4 --- /dev/null +++ b/queue-6.3/asoc-codecs-wsa881x-do-not-set-can_multi_write-flag.patch @@ -0,0 +1,39 @@ +From e53dedeaa37081e26ec322988fd73b166bd9c9a3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 May 2023 16:46:05 +0100 +Subject: ASoC: codecs: wsa881x: do not set can_multi_write flag + +From: Srinivas Kandagatla + +[ Upstream commit 6e7a6d4797ef521c0762914610ed682e102b9d36 ] + +regmap-sdw does not support multi register writes, so there is +no point in setting this flag. This also leads to incorrect +programming of WSA codecs with regmap_multi_reg_write() call. + +This invalid configuration should have been rejected by regmap-sdw. + +Fixes: a0aab9e1404a ("ASoC: codecs: add wsa881x amplifier support") +Signed-off-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20230523154605.4284-2-srinivas.kandagatla@linaro.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wsa881x.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/sound/soc/codecs/wsa881x.c b/sound/soc/codecs/wsa881x.c +index f709231b1277a..97f6873a0a8c7 100644 +--- a/sound/soc/codecs/wsa881x.c ++++ b/sound/soc/codecs/wsa881x.c +@@ -645,7 +645,6 @@ static struct regmap_config wsa881x_regmap_config = { + .readable_reg = wsa881x_readable_register, + .reg_format_endian = REGMAP_ENDIAN_NATIVE, + .val_format_endian = REGMAP_ENDIAN_NATIVE, +- .can_multi_write = true, + }; + + enum { +-- +2.39.2 + diff --git a/queue-6.3/asoc-codecs-wsa883x-do-not-set-can_multi_write-flag.patch b/queue-6.3/asoc-codecs-wsa883x-do-not-set-can_multi_write-flag.patch new file mode 100644 index 00000000000..2149a412efd --- /dev/null +++ b/queue-6.3/asoc-codecs-wsa883x-do-not-set-can_multi_write-flag.patch @@ -0,0 +1,39 @@ +From 5fe94b4d04b5a5f1e2579e20cd0130455d636eca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 May 2023 16:46:04 +0100 +Subject: ASoC: codecs: wsa883x: do not set can_multi_write flag + +From: Srinivas Kandagatla + +[ Upstream commit 40ba0411074485e2cf1bf8ee0f3db27bdff88394 ] + +regmap-sdw does not support multi register writes, so there is +no point in setting this flag. This also leads to incorrect +programming of WSA codecs with regmap_multi_reg_write() call. + +This invalid configuration should have been rejected by regmap-sdw. + +Fixes: 43b8c7dc85a1 ("ASoC: codecs: add wsa883x amplifier support") +Signed-off-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20230523154605.4284-1-srinivas.kandagatla@linaro.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wsa883x.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/sound/soc/codecs/wsa883x.c b/sound/soc/codecs/wsa883x.c +index c609cb63dae6d..e80b531435696 100644 +--- a/sound/soc/codecs/wsa883x.c ++++ b/sound/soc/codecs/wsa883x.c +@@ -946,7 +946,6 @@ static struct regmap_config wsa883x_regmap_config = { + .writeable_reg = wsa883x_writeable_register, + .reg_format_endian = REGMAP_ENDIAN_NATIVE, + .val_format_endian = REGMAP_ENDIAN_NATIVE, +- .can_multi_write = true, + .use_single_read = true, + }; + +-- +2.39.2 + diff --git a/queue-6.3/asoc-mediatek-mt8188-fix-use-after-free-in-driver-re.patch b/queue-6.3/asoc-mediatek-mt8188-fix-use-after-free-in-driver-re.patch new file mode 100644 index 00000000000..b3481fbe496 --- /dev/null +++ b/queue-6.3/asoc-mediatek-mt8188-fix-use-after-free-in-driver-re.patch @@ -0,0 +1,165 @@ +From 3f22c00a770d2fd3f51c528751a730ab82497728 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Jun 2023 11:33:17 +0800 +Subject: ASoC: mediatek: mt8188: fix use-after-free in driver remove path + +From: Trevor Wu + +[ Upstream commit fd67a7a1a22ce47fcbc094c4b6e164c34c652cbe ] + +During mt8188_afe_init_clock(), mt8188_audsys_clk_register() was called +followed by several other devm functions. The caller of +mt8188_afe_init_clock() utilized devm_add_action_or_reset() to call +mt8188_afe_deinit_clock(). However, the order was incorrect, causing a +use-after-free issue during remove time. + +At probe time, the order of calls was: +1. mt8188_audsys_clk_register +2. afe_priv->clk = devm_kcalloc +3. afe_priv->clk[i] = devm_clk_get + +At remove time, the order of calls was: +1. mt8188_audsys_clk_unregister +3. free afe_priv->clk[i] +2. free afe_priv->clk + +To resolve the problem, it's necessary to move devm_add_action_or_reset() +to the appropriate position so that the remove order can be 3->2->1. + +Fixes: f6b026479b13 ("ASoC: mediatek: mt8188: support audio clock control") +Signed-off-by: Trevor Wu +Reviewed-by: Douglas Anderson +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20230601033318.10408-2-trevor.wu@mediatek.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/mediatek/mt8188/mt8188-afe-clk.c | 7 --- + sound/soc/mediatek/mt8188/mt8188-afe-clk.h | 1 - + sound/soc/mediatek/mt8188/mt8188-afe-pcm.c | 4 -- + sound/soc/mediatek/mt8188/mt8188-audsys-clk.c | 47 ++++++++++--------- + sound/soc/mediatek/mt8188/mt8188-audsys-clk.h | 1 - + 5 files changed, 24 insertions(+), 36 deletions(-) + +diff --git a/sound/soc/mediatek/mt8188/mt8188-afe-clk.c b/sound/soc/mediatek/mt8188/mt8188-afe-clk.c +index 743d6a162cb9a..0fb97517f82c6 100644 +--- a/sound/soc/mediatek/mt8188/mt8188-afe-clk.c ++++ b/sound/soc/mediatek/mt8188/mt8188-afe-clk.c +@@ -418,13 +418,6 @@ int mt8188_afe_init_clock(struct mtk_base_afe *afe) + return 0; + } + +-void mt8188_afe_deinit_clock(void *priv) +-{ +- struct mtk_base_afe *afe = priv; +- +- mt8188_audsys_clk_unregister(afe); +-} +- + int mt8188_afe_enable_clk(struct mtk_base_afe *afe, struct clk *clk) + { + int ret; +diff --git a/sound/soc/mediatek/mt8188/mt8188-afe-clk.h b/sound/soc/mediatek/mt8188/mt8188-afe-clk.h +index 084fdfb1d877a..a4203a87a1e35 100644 +--- a/sound/soc/mediatek/mt8188/mt8188-afe-clk.h ++++ b/sound/soc/mediatek/mt8188/mt8188-afe-clk.h +@@ -100,7 +100,6 @@ int mt8188_afe_get_mclk_source_clk_id(int sel); + int mt8188_afe_get_mclk_source_rate(struct mtk_base_afe *afe, int apll); + int mt8188_afe_get_default_mclk_source_by_rate(int rate); + int mt8188_afe_init_clock(struct mtk_base_afe *afe); +-void mt8188_afe_deinit_clock(void *priv); + int mt8188_afe_enable_clk(struct mtk_base_afe *afe, struct clk *clk); + void mt8188_afe_disable_clk(struct mtk_base_afe *afe, struct clk *clk); + int mt8188_afe_set_clk_rate(struct mtk_base_afe *afe, struct clk *clk, +diff --git a/sound/soc/mediatek/mt8188/mt8188-afe-pcm.c b/sound/soc/mediatek/mt8188/mt8188-afe-pcm.c +index e8e84de865422..45ab6e2829b7a 100644 +--- a/sound/soc/mediatek/mt8188/mt8188-afe-pcm.c ++++ b/sound/soc/mediatek/mt8188/mt8188-afe-pcm.c +@@ -3185,10 +3185,6 @@ static int mt8188_afe_pcm_dev_probe(struct platform_device *pdev) + if (ret) + return dev_err_probe(dev, ret, "init clock error"); + +- ret = devm_add_action_or_reset(dev, mt8188_afe_deinit_clock, (void *)afe); +- if (ret) +- return ret; +- + spin_lock_init(&afe_priv->afe_ctrl_lock); + + mutex_init(&afe->irq_alloc_lock); +diff --git a/sound/soc/mediatek/mt8188/mt8188-audsys-clk.c b/sound/soc/mediatek/mt8188/mt8188-audsys-clk.c +index be1c53bf47298..c796ad8b62eea 100644 +--- a/sound/soc/mediatek/mt8188/mt8188-audsys-clk.c ++++ b/sound/soc/mediatek/mt8188/mt8188-audsys-clk.c +@@ -138,6 +138,29 @@ static const struct afe_gate aud_clks[CLK_AUD_NR_CLK] = { + GATE_AUD6(CLK_AUD_GASRC11, "aud_gasrc11", "top_asm_h", 11), + }; + ++static void mt8188_audsys_clk_unregister(void *data) ++{ ++ struct mtk_base_afe *afe = data; ++ struct mt8188_afe_private *afe_priv = afe->platform_priv; ++ struct clk *clk; ++ struct clk_lookup *cl; ++ int i; ++ ++ if (!afe_priv) ++ return; ++ ++ for (i = 0; i < CLK_AUD_NR_CLK; i++) { ++ cl = afe_priv->lookup[i]; ++ if (!cl) ++ continue; ++ ++ clk = cl->clk; ++ clk_unregister_gate(clk); ++ ++ clkdev_drop(cl); ++ } ++} ++ + int mt8188_audsys_clk_register(struct mtk_base_afe *afe) + { + struct mt8188_afe_private *afe_priv = afe->platform_priv; +@@ -179,27 +202,5 @@ int mt8188_audsys_clk_register(struct mtk_base_afe *afe) + afe_priv->lookup[i] = cl; + } + +- return 0; +-} +- +-void mt8188_audsys_clk_unregister(struct mtk_base_afe *afe) +-{ +- struct mt8188_afe_private *afe_priv = afe->platform_priv; +- struct clk *clk; +- struct clk_lookup *cl; +- int i; +- +- if (!afe_priv) +- return; +- +- for (i = 0; i < CLK_AUD_NR_CLK; i++) { +- cl = afe_priv->lookup[i]; +- if (!cl) +- continue; +- +- clk = cl->clk; +- clk_unregister_gate(clk); +- +- clkdev_drop(cl); +- } ++ return devm_add_action_or_reset(afe->dev, mt8188_audsys_clk_unregister, afe); + } +diff --git a/sound/soc/mediatek/mt8188/mt8188-audsys-clk.h b/sound/soc/mediatek/mt8188/mt8188-audsys-clk.h +index 6c5f463ad7e4d..45b0948c4a06e 100644 +--- a/sound/soc/mediatek/mt8188/mt8188-audsys-clk.h ++++ b/sound/soc/mediatek/mt8188/mt8188-audsys-clk.h +@@ -10,6 +10,5 @@ + #define _MT8188_AUDSYS_CLK_H_ + + int mt8188_audsys_clk_register(struct mtk_base_afe *afe); +-void mt8188_audsys_clk_unregister(struct mtk_base_afe *afe); + + #endif +-- +2.39.2 + diff --git a/queue-6.3/asoc-mediatek-mt8195-afe-pcm-convert-to-platform-rem.patch b/queue-6.3/asoc-mediatek-mt8195-afe-pcm-convert-to-platform-rem.patch new file mode 100644 index 00000000000..a6a2c4356af --- /dev/null +++ b/queue-6.3/asoc-mediatek-mt8195-afe-pcm-convert-to-platform-rem.patch @@ -0,0 +1,69 @@ +From 8ca845103e341135df43930354d255e962611718 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Mar 2023 16:06:45 +0100 +Subject: ASoC: mediatek: mt8195-afe-pcm: Convert to platform remove callback + returning void +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 6461fee68064ba970e3ba90241fe5f5e038aa9d4 ] + +The .remove() callback for a platform driver returns an int which makes +many driver authors wrongly assume it's possible to do error handling by +returning an error code. However the value returned is (mostly) ignored +and this typically results in resource leaks. To improve here there is a +quest to make the remove callback return void. In the first step of this +quest all drivers are converted to .remove_new() which already returns +void. + +Trivially convert this driver from always returning zero in the remove +callback to the void returning variant. + +Signed-off-by: Uwe Kleine-König +Reviewed-by: AngeloGioacchino Del Regno +Acked-by: Takashi Iwai +Acked-by: Nicolas Ferre +Link: https://lore.kernel.org/r/20230315150745.67084-114-u.kleine-koenig@pengutronix.de +Signed-off-by: Mark Brown +Stable-dep-of: dc93f0dcb436 ("ASoC: mediatek: mt8195: fix use-after-free in driver remove path") +Signed-off-by: Sasha Levin +--- + sound/soc/mediatek/mt8195/mt8195-afe-pcm.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/sound/soc/mediatek/mt8195/mt8195-afe-pcm.c b/sound/soc/mediatek/mt8195/mt8195-afe-pcm.c +index 72b2c6d629b93..9e45efeada55c 100644 +--- a/sound/soc/mediatek/mt8195/mt8195-afe-pcm.c ++++ b/sound/soc/mediatek/mt8195/mt8195-afe-pcm.c +@@ -3253,7 +3253,7 @@ static int mt8195_afe_pcm_dev_probe(struct platform_device *pdev) + return ret; + } + +-static int mt8195_afe_pcm_dev_remove(struct platform_device *pdev) ++static void mt8195_afe_pcm_dev_remove(struct platform_device *pdev) + { + struct mtk_base_afe *afe = platform_get_drvdata(pdev); + +@@ -3264,7 +3264,6 @@ static int mt8195_afe_pcm_dev_remove(struct platform_device *pdev) + mt8195_afe_runtime_suspend(&pdev->dev); + + mt8195_afe_deinit_clock(afe); +- return 0; + } + + static const struct of_device_id mt8195_afe_pcm_dt_match[] = { +@@ -3285,7 +3284,7 @@ static struct platform_driver mt8195_afe_pcm_driver = { + .pm = &mt8195_afe_pm_ops, + }, + .probe = mt8195_afe_pcm_dev_probe, +- .remove = mt8195_afe_pcm_dev_remove, ++ .remove_new = mt8195_afe_pcm_dev_remove, + }; + + module_platform_driver(mt8195_afe_pcm_driver); +-- +2.39.2 + diff --git a/queue-6.3/asoc-mediatek-mt8195-fix-use-after-free-in-driver-re.patch b/queue-6.3/asoc-mediatek-mt8195-fix-use-after-free-in-driver-re.patch new file mode 100644 index 00000000000..95bc30149ce --- /dev/null +++ b/queue-6.3/asoc-mediatek-mt8195-fix-use-after-free-in-driver-re.patch @@ -0,0 +1,173 @@ +From afe7de1febeb486a9a92c5fe7fcad644f8838fe0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Jun 2023 11:33:18 +0800 +Subject: ASoC: mediatek: mt8195: fix use-after-free in driver remove path + +From: Trevor Wu + +[ Upstream commit dc93f0dcb436dfd24a06c5b3c0f4c5cd9296e8e5 ] + +During mt8195_afe_init_clock(), mt8195_audsys_clk_register() was called +followed by several other devm functions. At mt8195_afe_deinit_clock() +located at mt8195_afe_pcm_dev_remove(), mt8195_audsys_clk_unregister() +was called. + +However, there was an issue with the order in which these functions were +called. Specifically, the remove callback of platform_driver was called +before devres released the resource, resulting in a use-after-free issue +during remove time. + +At probe time, the order of calls was: +1. mt8195_audsys_clk_register +2. afe_priv->clk = devm_kcalloc +3. afe_priv->clk[i] = devm_clk_get + +At remove time, the order of calls was: +1. mt8195_audsys_clk_unregister +3. free afe_priv->clk[i] +2. free afe_priv->clk + +To resolve the problem, we can utilize devm_add_action_or_reset() in +mt8195_audsys_clk_register() so that the remove order can be changed to +3->2->1. + +Fixes: 6746cc858259 ("ASoC: mediatek: mt8195: add platform driver") +Signed-off-by: Trevor Wu +Reviewed-by: Douglas Anderson +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20230601033318.10408-3-trevor.wu@mediatek.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/mediatek/mt8195/mt8195-afe-clk.c | 5 -- + sound/soc/mediatek/mt8195/mt8195-afe-clk.h | 1 - + sound/soc/mediatek/mt8195/mt8195-afe-pcm.c | 4 -- + sound/soc/mediatek/mt8195/mt8195-audsys-clk.c | 47 ++++++++++--------- + sound/soc/mediatek/mt8195/mt8195-audsys-clk.h | 1 - + 5 files changed, 24 insertions(+), 34 deletions(-) + +diff --git a/sound/soc/mediatek/mt8195/mt8195-afe-clk.c b/sound/soc/mediatek/mt8195/mt8195-afe-clk.c +index 9ca2cb8c8a9c2..f35318ae07392 100644 +--- a/sound/soc/mediatek/mt8195/mt8195-afe-clk.c ++++ b/sound/soc/mediatek/mt8195/mt8195-afe-clk.c +@@ -410,11 +410,6 @@ int mt8195_afe_init_clock(struct mtk_base_afe *afe) + return 0; + } + +-void mt8195_afe_deinit_clock(struct mtk_base_afe *afe) +-{ +- mt8195_audsys_clk_unregister(afe); +-} +- + int mt8195_afe_enable_clk(struct mtk_base_afe *afe, struct clk *clk) + { + int ret; +diff --git a/sound/soc/mediatek/mt8195/mt8195-afe-clk.h b/sound/soc/mediatek/mt8195/mt8195-afe-clk.h +index 40663e31becd1..a08c0ee6c8602 100644 +--- a/sound/soc/mediatek/mt8195/mt8195-afe-clk.h ++++ b/sound/soc/mediatek/mt8195/mt8195-afe-clk.h +@@ -101,7 +101,6 @@ int mt8195_afe_get_mclk_source_clk_id(int sel); + int mt8195_afe_get_mclk_source_rate(struct mtk_base_afe *afe, int apll); + int mt8195_afe_get_default_mclk_source_by_rate(int rate); + int mt8195_afe_init_clock(struct mtk_base_afe *afe); +-void mt8195_afe_deinit_clock(struct mtk_base_afe *afe); + int mt8195_afe_enable_clk(struct mtk_base_afe *afe, struct clk *clk); + void mt8195_afe_disable_clk(struct mtk_base_afe *afe, struct clk *clk); + int mt8195_afe_prepare_clk(struct mtk_base_afe *afe, struct clk *clk); +diff --git a/sound/soc/mediatek/mt8195/mt8195-afe-pcm.c b/sound/soc/mediatek/mt8195/mt8195-afe-pcm.c +index 9e45efeada55c..03dabc056b916 100644 +--- a/sound/soc/mediatek/mt8195/mt8195-afe-pcm.c ++++ b/sound/soc/mediatek/mt8195/mt8195-afe-pcm.c +@@ -3255,15 +3255,11 @@ static int mt8195_afe_pcm_dev_probe(struct platform_device *pdev) + + static void mt8195_afe_pcm_dev_remove(struct platform_device *pdev) + { +- struct mtk_base_afe *afe = platform_get_drvdata(pdev); +- + snd_soc_unregister_component(&pdev->dev); + + pm_runtime_disable(&pdev->dev); + if (!pm_runtime_status_suspended(&pdev->dev)) + mt8195_afe_runtime_suspend(&pdev->dev); +- +- mt8195_afe_deinit_clock(afe); + } + + static const struct of_device_id mt8195_afe_pcm_dt_match[] = { +diff --git a/sound/soc/mediatek/mt8195/mt8195-audsys-clk.c b/sound/soc/mediatek/mt8195/mt8195-audsys-clk.c +index e0670e0dbd5b0..38594bc3f2f77 100644 +--- a/sound/soc/mediatek/mt8195/mt8195-audsys-clk.c ++++ b/sound/soc/mediatek/mt8195/mt8195-audsys-clk.c +@@ -148,6 +148,29 @@ static const struct afe_gate aud_clks[CLK_AUD_NR_CLK] = { + GATE_AUD6(CLK_AUD_GASRC19, "aud_gasrc19", "top_asm_h", 19), + }; + ++static void mt8195_audsys_clk_unregister(void *data) ++{ ++ struct mtk_base_afe *afe = data; ++ struct mt8195_afe_private *afe_priv = afe->platform_priv; ++ struct clk *clk; ++ struct clk_lookup *cl; ++ int i; ++ ++ if (!afe_priv) ++ return; ++ ++ for (i = 0; i < CLK_AUD_NR_CLK; i++) { ++ cl = afe_priv->lookup[i]; ++ if (!cl) ++ continue; ++ ++ clk = cl->clk; ++ clk_unregister_gate(clk); ++ ++ clkdev_drop(cl); ++ } ++} ++ + int mt8195_audsys_clk_register(struct mtk_base_afe *afe) + { + struct mt8195_afe_private *afe_priv = afe->platform_priv; +@@ -188,27 +211,5 @@ int mt8195_audsys_clk_register(struct mtk_base_afe *afe) + afe_priv->lookup[i] = cl; + } + +- return 0; +-} +- +-void mt8195_audsys_clk_unregister(struct mtk_base_afe *afe) +-{ +- struct mt8195_afe_private *afe_priv = afe->platform_priv; +- struct clk *clk; +- struct clk_lookup *cl; +- int i; +- +- if (!afe_priv) +- return; +- +- for (i = 0; i < CLK_AUD_NR_CLK; i++) { +- cl = afe_priv->lookup[i]; +- if (!cl) +- continue; +- +- clk = cl->clk; +- clk_unregister_gate(clk); +- +- clkdev_drop(cl); +- } ++ return devm_add_action_or_reset(afe->dev, mt8195_audsys_clk_unregister, afe); + } +diff --git a/sound/soc/mediatek/mt8195/mt8195-audsys-clk.h b/sound/soc/mediatek/mt8195/mt8195-audsys-clk.h +index 239d31016ba76..69db2dd1c9e02 100644 +--- a/sound/soc/mediatek/mt8195/mt8195-audsys-clk.h ++++ b/sound/soc/mediatek/mt8195/mt8195-audsys-clk.h +@@ -10,6 +10,5 @@ + #define _MT8195_AUDSYS_CLK_H_ + + int mt8195_audsys_clk_register(struct mtk_base_afe *afe); +-void mt8195_audsys_clk_unregister(struct mtk_base_afe *afe); + + #endif +-- +2.39.2 + diff --git a/queue-6.3/asoc-simple-card-utils-fix-pcm-constraint-error-chec.patch b/queue-6.3/asoc-simple-card-utils-fix-pcm-constraint-error-chec.patch new file mode 100644 index 00000000000..212aa3f625e --- /dev/null +++ b/queue-6.3/asoc-simple-card-utils-fix-pcm-constraint-error-chec.patch @@ -0,0 +1,47 @@ +From 9bcf748afa9f316ce25d6738d620c08ad675ab29 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Jun 2023 19:19:35 -0600 +Subject: ASoC: simple-card-utils: fix PCM constraint error check + +From: Robert Hancock + +[ Upstream commit 635071f5fee31550e921644b2becc42b3ff1036c ] + +The code in asoc_simple_startup was treating any non-zero return from +snd_pcm_hw_constraint_minmax as an error, when this can return 1 in some +normal cases and only negative values indicate an error. + +When this happened, it caused asoc_simple_startup to disable the clocks +it just enabled and return 1, which was not treated as an error by the +calling code which only checks for negative return values. Then when the +PCM is eventually shut down, it causes the clock framework to complain +about disabling clocks that were not enabled. + +Fix the check for snd_pcm_hw_constraint_minmax return value to only +treat negative values as an error. + +Fixes: 5ca2ab459817 ("ASoC: simple-card-utils: Add new system-clock-fixed flag") +Signed-off-by: Robert Hancock +Link: https://lore.kernel.org/r/20230602011936.231931-1-robert.hancock@calian.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/generic/simple-card-utils.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/generic/simple-card-utils.c b/sound/soc/generic/simple-card-utils.c +index 56552a616f21f..1f24344846ae9 100644 +--- a/sound/soc/generic/simple-card-utils.c ++++ b/sound/soc/generic/simple-card-utils.c +@@ -314,7 +314,7 @@ int asoc_simple_startup(struct snd_pcm_substream *substream) + } + ret = snd_pcm_hw_constraint_minmax(substream->runtime, SNDRV_PCM_HW_PARAM_RATE, + fixed_rate, fixed_rate); +- if (ret) ++ if (ret < 0) + goto codec_err; + } + +-- +2.39.2 + diff --git a/queue-6.3/blk-mq-fix-blk_mq_hw_ctx-active-request-accounting.patch b/queue-6.3/blk-mq-fix-blk_mq_hw_ctx-active-request-accounting.patch new file mode 100644 index 00000000000..948beae67a5 --- /dev/null +++ b/queue-6.3/blk-mq-fix-blk_mq_hw_ctx-active-request-accounting.patch @@ -0,0 +1,85 @@ +From d62c3ed793af09d7f654fb1b81f0b2fd0b960928 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 13 May 2023 18:12:27 -0400 +Subject: blk-mq: fix blk_mq_hw_ctx active request accounting + +From: Tian Lan + +[ Upstream commit ddad59331a4e16088468ca0ad228a9fe32d7955a ] + +The nr_active counter continues to increase over time which causes the +blk_mq_get_tag to hang until the thread is rescheduled to a different +core despite there are still tags available. + +kernel-stack + + INFO: task inboundIOReacto:3014879 blocked for more than 2 seconds + Not tainted 6.1.15-amd64 #1 Debian 6.1.15~debian11 + "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. + task:inboundIOReacto state:D stack:0 pid:3014879 ppid:4557 flags:0x00000000 + Call Trace: + + __schedule+0x351/0xa20 + scheduler+0x5d/0xe0 + io_schedule+0x42/0x70 + blk_mq_get_tag+0x11a/0x2a0 + ? dequeue_task_stop+0x70/0x70 + __blk_mq_alloc_requests+0x191/0x2e0 + +kprobe output showing RQF_MQ_INFLIGHT bit is not cleared before +__blk_mq_free_request being called. + + 320 320 kworker/29:1H __blk_mq_free_request rq_flags 0x220c0 in-flight 1 + b'__blk_mq_free_request+0x1 [kernel]' + b'bt_iter+0x50 [kernel]' + b'blk_mq_queue_tag_busy_iter+0x318 [kernel]' + b'blk_mq_timeout_work+0x7c [kernel]' + b'process_one_work+0x1c4 [kernel]' + b'worker_thread+0x4d [kernel]' + b'kthread+0xe6 [kernel]' + b'ret_from_fork+0x1f [kernel]' + +Signed-off-by: Tian Lan +Fixes: 2e315dc07df0 ("blk-mq: grab rq->refcount before calling ->fn in blk_mq_tagset_busy_iter") +Reviewed-by: Ming Lei +Link: https://lore.kernel.org/r/20230513221227.497327-1-tilan7663@gmail.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-mq.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/block/blk-mq.c b/block/blk-mq.c +index ae08c4936743d..f2e2ffd135baf 100644 +--- a/block/blk-mq.c ++++ b/block/blk-mq.c +@@ -717,6 +717,10 @@ static void __blk_mq_free_request(struct request *rq) + blk_crypto_free_request(rq); + blk_pm_mark_last_busy(rq); + rq->mq_hctx = NULL; ++ ++ if (rq->rq_flags & RQF_MQ_INFLIGHT) ++ __blk_mq_dec_active_requests(hctx); ++ + if (rq->tag != BLK_MQ_NO_TAG) + blk_mq_put_tag(hctx->tags, ctx, rq->tag); + if (sched_tag != BLK_MQ_NO_TAG) +@@ -728,15 +732,11 @@ static void __blk_mq_free_request(struct request *rq) + void blk_mq_free_request(struct request *rq) + { + struct request_queue *q = rq->q; +- struct blk_mq_hw_ctx *hctx = rq->mq_hctx; + + if ((rq->rq_flags & RQF_ELVPRIV) && + q->elevator->type->ops.finish_request) + q->elevator->type->ops.finish_request(rq); + +- if (rq->rq_flags & RQF_MQ_INFLIGHT) +- __blk_mq_dec_active_requests(hctx); +- + if (unlikely(laptop_mode && !blk_rq_is_passthrough(rq))) + laptop_io_completion(q->disk->bdi); + +-- +2.39.2 + diff --git a/queue-6.3/eeprom-at24-also-select-regmap.patch b/queue-6.3/eeprom-at24-also-select-regmap.patch new file mode 100644 index 00000000000..1d8531f3aae --- /dev/null +++ b/queue-6.3/eeprom-at24-also-select-regmap.patch @@ -0,0 +1,49 @@ +From f6f24af6bbcc71e6089c58d9c4ae341fe4c30f6e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Jun 2023 19:54:24 -0700 +Subject: eeprom: at24: also select REGMAP + +From: Randy Dunlap + +[ Upstream commit 7f3c782b3914e510b646a77aedc3adeac2e4a63b ] + +Selecting only REGMAP_I2C can leave REGMAP unset, causing build errors, +so also select REGMAP to prevent the build errors. + +../drivers/misc/eeprom/at24.c:540:42: warning: 'struct regmap_config' declared inside parameter list will not be visible outside of this definition or declaration + 540 | struct regmap_config *regmap_config) +../drivers/misc/eeprom/at24.c: In function 'at24_make_dummy_client': +../drivers/misc/eeprom/at24.c:552:18: error: implicit declaration of function 'devm_regmap_init_i2c' [-Werror=implicit-function-declaration] + 552 | regmap = devm_regmap_init_i2c(dummy_client, regmap_config); +../drivers/misc/eeprom/at24.c:552:16: warning: assignment to 'struct regmap *' from 'int' makes pointer from integer without a cast [-Wint-conversion] + 552 | regmap = devm_regmap_init_i2c(dummy_client, regmap_config); +../drivers/misc/eeprom/at24.c: In function 'at24_probe': +../drivers/misc/eeprom/at24.c:586:16: error: variable 'regmap_config' has initializer but incomplete type + 586 | struct regmap_config regmap_config = { }; +../drivers/misc/eeprom/at24.c:586:30: error: storage size of 'regmap_config' isn't known + 586 | struct regmap_config regmap_config = { }; +../drivers/misc/eeprom/at24.c:586:30: warning: unused variable 'regmap_config' [-Wunused-variable] + +Fixes: 5c015258478e ("eeprom: at24: add basic regmap_i2c support") +Signed-off-by: Randy Dunlap +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/misc/eeprom/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/misc/eeprom/Kconfig b/drivers/misc/eeprom/Kconfig +index f0a7531f354c1..2d240bfa819f8 100644 +--- a/drivers/misc/eeprom/Kconfig ++++ b/drivers/misc/eeprom/Kconfig +@@ -6,6 +6,7 @@ config EEPROM_AT24 + depends on I2C && SYSFS + select NVMEM + select NVMEM_SYSFS ++ select REGMAP + select REGMAP_I2C + help + Enable this driver to get read/write support to most I2C EEPROMs +-- +2.39.2 + diff --git a/queue-6.3/firmware-arm_ffa-set-handle-field-to-zero-in-memory-.patch b/queue-6.3/firmware-arm_ffa-set-handle-field-to-zero-in-memory-.patch new file mode 100644 index 00000000000..4949c366988 --- /dev/null +++ b/queue-6.3/firmware-arm_ffa-set-handle-field-to-zero-in-memory-.patch @@ -0,0 +1,39 @@ +From 1ea6fd9c445933871870f125d26e28a685e68d20 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Jun 2023 16:07:49 +0200 +Subject: firmware: arm_ffa: Set handle field to zero in memory descriptor + +From: Balint Dobszay + +[ Upstream commit 3aa0519a4780f1b8e11966bd879d4a2934ba455f ] + +As described in the commit 111a833dc5cb ("firmware: arm_ffa: Set +reserved/MBZ fields to zero in the memory descriptors") some fields in +the memory descriptor have to be zeroed explicitly. The handle field is +one of these, but it was left out from that change, fix this now. + +Fixes: 111a833dc5cb ("firmware: arm_ffa: Set reserved/MBZ fields to zero in the memory descriptors") +Reported-by: Imre Kis +Signed-off-by: Balint Dobszay +Link: https://lore.kernel.org/r/20230601140749.93812-1-balint.dobszay@arm.com +Signed-off-by: Sudeep Holla +Signed-off-by: Sasha Levin +--- + drivers/firmware/arm_ffa/driver.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/firmware/arm_ffa/driver.c b/drivers/firmware/arm_ffa/driver.c +index e234091386671..2109cd178ff70 100644 +--- a/drivers/firmware/arm_ffa/driver.c ++++ b/drivers/firmware/arm_ffa/driver.c +@@ -424,6 +424,7 @@ ffa_setup_and_transmit(u32 func_id, void *buffer, u32 max_fragsize, + ep_mem_access->flag = 0; + ep_mem_access->reserved = 0; + } ++ mem_region->handle = 0; + mem_region->reserved_0 = 0; + mem_region->reserved_1 = 0; + mem_region->ep_count = args->nattrs; +-- +2.39.2 + diff --git a/queue-6.3/gpio-sim-fix-memory-corruption-when-adding-named-lin.patch b/queue-6.3/gpio-sim-fix-memory-corruption-when-adding-named-lin.patch new file mode 100644 index 00000000000..6b3bf0bdcaa --- /dev/null +++ b/queue-6.3/gpio-sim-fix-memory-corruption-when-adding-named-lin.patch @@ -0,0 +1,45 @@ +From 0bdc39f2ad16b2f61dcc48d64f8cb4f55cefbde3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Jun 2023 20:00:34 +0800 +Subject: gpio: sim: fix memory corruption when adding named lines and unnamed + hogs + +From: Kent Gibson + +[ Upstream commit 95ae9979bfe3174c2ee8d64409c44532f2881907 ] + +When constructing the sim, gpio-sim constructs an array of named lines, +sized based on the largest offset of any named line, and then initializes +that array with the names of all lines, including unnamed hogs with higher +offsets. In doing so it writes NULLs beyond the extent of the array. + +Add a check that only named lines are used to initialize the array. + +Fixes: cb8c474e79be ("gpio: sim: new testing module") +Signed-off-by: Kent Gibson +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-sim.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpio/gpio-sim.c b/drivers/gpio/gpio-sim.c +index e5dfd636c63c1..09aa0b64859b4 100644 +--- a/drivers/gpio/gpio-sim.c ++++ b/drivers/gpio/gpio-sim.c +@@ -721,8 +721,10 @@ static char **gpio_sim_make_line_names(struct gpio_sim_bank *bank, + if (!line_names) + return ERR_PTR(-ENOMEM); + +- list_for_each_entry(line, &bank->line_list, siblings) +- line_names[line->offset] = line->name; ++ list_for_each_entry(line, &bank->line_list, siblings) { ++ if (line->name && (line->offset <= max_offset)) ++ line_names[line->offset] = line->name; ++ } + + return line_names; + } +-- +2.39.2 + diff --git a/queue-6.3/i2c-mv64xxx-fix-reading-invalid-status-value-in-atom.patch b/queue-6.3/i2c-mv64xxx-fix-reading-invalid-status-value-in-atom.patch new file mode 100644 index 00000000000..78f8d3fa9af --- /dev/null +++ b/queue-6.3/i2c-mv64xxx-fix-reading-invalid-status-value-in-atom.patch @@ -0,0 +1,68 @@ +From e109f83f2fa777a5ee21367e88024f6c5b48d096 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 21 May 2023 14:19:40 +0200 +Subject: i2c: mv64xxx: Fix reading invalid status value in atomic mode +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Marek Behún + +[ Upstream commit 5578d0a79b6430fa1543640dd6f2d397d0886ce7 ] + +There seems to be a bug within the mv64xxx I2C controller, wherein the +status register may not necessarily contain valid value immediately +after the IFLG flag is set in the control register. + +My theory is that the controller: +- first sets the IFLG in control register +- then updates the status register +- then raises an interrupt + +This may sometime cause weird bugs when in atomic mode, since in this +mode we do not wait for an interrupt, but instead we poll the control +register for IFLG and read status register immediately after. + +I encountered -ENXIO from mv64xxx_i2c_fsm() due to this issue when using +this driver in atomic mode. + +Note that I've only seen this issue on Armada 385, I don't know whether +other SOCs with this controller are also affected. Also note that this +fix has been in U-Boot for over 4 years [1] without anybody complaining, +so it should not cause regressions. + +[1] https://source.denx.de/u-boot/u-boot/-/commit/d50e29662f78 + +Fixes: 544a8d75f3d6 ("i2c: mv64xxx: Add atomic_xfer method to driver") +Signed-off-by: Marek Behún +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-mv64xxx.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/drivers/i2c/busses/i2c-mv64xxx.c b/drivers/i2c/busses/i2c-mv64xxx.c +index 047dfef7a6577..878c076ebdc6b 100644 +--- a/drivers/i2c/busses/i2c-mv64xxx.c ++++ b/drivers/i2c/busses/i2c-mv64xxx.c +@@ -520,6 +520,17 @@ mv64xxx_i2c_intr(int irq, void *dev_id) + + while (readl(drv_data->reg_base + drv_data->reg_offsets.control) & + MV64XXX_I2C_REG_CONTROL_IFLG) { ++ /* ++ * It seems that sometime the controller updates the status ++ * register only after it asserts IFLG in control register. ++ * This may result in weird bugs when in atomic mode. A delay ++ * of 100 ns before reading the status register solves this ++ * issue. This bug does not seem to appear when using ++ * interrupts. ++ */ ++ if (drv_data->atomic) ++ ndelay(100); ++ + status = readl(drv_data->reg_base + drv_data->reg_offsets.status); + mv64xxx_i2c_fsm(drv_data, status); + mv64xxx_i2c_do_action(drv_data); +-- +2.39.2 + diff --git a/queue-6.3/i2c-sprd-delete-i2c-adapter-in-.remove-s-error-path.patch b/queue-6.3/i2c-sprd-delete-i2c-adapter-in-.remove-s-error-path.patch new file mode 100644 index 00000000000..979fc3aaa37 --- /dev/null +++ b/queue-6.3/i2c-sprd-delete-i2c-adapter-in-.remove-s-error-path.patch @@ -0,0 +1,53 @@ +From 18442eb5a6135d85010cf5c3bc39fac14939e5fe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Mar 2023 10:58:19 +0100 +Subject: i2c: sprd: Delete i2c adapter in .remove's error path +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit ca0aa17f2db3468fd017038d23a78e17388e2f67 ] + +If pm runtime resume fails the .remove callback used to exit early. This +resulted in an error message by the driver core but the device gets +removed anyhow. This lets the registered i2c adapter stay around with an +unbound parent device. + +So only skip clk disabling if resume failed, but do delete the adapter. + +Fixes: 8b9ec0719834 ("i2c: Add Spreadtrum I2C controller driver") +Signed-off-by: Uwe Kleine-König +Reviewed-by: Andi Shyti +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-sprd.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-sprd.c b/drivers/i2c/busses/i2c-sprd.c +index 4fe15cd78907e..ffc54fbf814dd 100644 +--- a/drivers/i2c/busses/i2c-sprd.c ++++ b/drivers/i2c/busses/i2c-sprd.c +@@ -576,12 +576,14 @@ static int sprd_i2c_remove(struct platform_device *pdev) + struct sprd_i2c *i2c_dev = platform_get_drvdata(pdev); + int ret; + +- ret = pm_runtime_resume_and_get(i2c_dev->dev); ++ ret = pm_runtime_get_sync(i2c_dev->dev); + if (ret < 0) +- return ret; ++ dev_err(&pdev->dev, "Failed to resume device (%pe)\n", ERR_PTR(ret)); + + i2c_del_adapter(&i2c_dev->adap); +- clk_disable_unprepare(i2c_dev->clk); ++ ++ if (ret >= 0) ++ clk_disable_unprepare(i2c_dev->clk); + + pm_runtime_put_noidle(i2c_dev->dev); + pm_runtime_disable(i2c_dev->dev); +-- +2.39.2 + diff --git a/queue-6.3/riscv-fix-kprobe-__user-string-arg-print-fault-issue.patch b/queue-6.3/riscv-fix-kprobe-__user-string-arg-print-fault-issue.patch new file mode 100644 index 00000000000..7b26a83ddce --- /dev/null +++ b/queue-6.3/riscv-fix-kprobe-__user-string-arg-print-fault-issue.patch @@ -0,0 +1,68 @@ +From fe1341e6d2e935fd3c42691b4bc8c8dd8f61f666 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 May 2023 15:29:10 +0800 +Subject: riscv: fix kprobe __user string arg print fault issue +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ruan Jinjie + +[ Upstream commit 99a670b2069c725a7b50318aa681d9cae8f89325 ] + +On riscv qemu platform, when add kprobe event on do_sys_open() to show +filename string arg, it just print fault as follow: + +echo 'p:myprobe do_sys_open dfd=$arg1 filename=+0($arg2):string flags=$arg3 +mode=$arg4' > kprobe_events + +bash-166 [000] ...1. 360.195367: myprobe: (do_sys_open+0x0/0x84) +dfd=0xffffffffffffff9c filename=(fault) flags=0x8241 mode=0x1b6 + +bash-166 [000] ...1. 360.219369: myprobe: (do_sys_open+0x0/0x84) +dfd=0xffffffffffffff9c filename=(fault) flags=0x8241 mode=0x1b6 + +bash-191 [000] ...1. 360.378827: myprobe: (do_sys_open+0x0/0x84) +dfd=0xffffffffffffff9c filename=(fault) flags=0x98800 mode=0x0 + +As riscv do not select ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE, +the +0($arg2) addr is processed as a kernel address though it is a +userspace address, cause the above filename=(fault) print. So select +ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE to avoid the issue, after that the +kprobe trace is ok as below: + +bash-166 [000] ...1. 96.767641: myprobe: (do_sys_open+0x0/0x84) +dfd=0xffffffffffffff9c filename="/dev/null" flags=0x8241 mode=0x1b6 + +bash-166 [000] ...1. 96.793751: myprobe: (do_sys_open+0x0/0x84) +dfd=0xffffffffffffff9c filename="/dev/null" flags=0x8241 mode=0x1b6 + +bash-177 [000] ...1. 96.962354: myprobe: (do_sys_open+0x0/0x84) +dfd=0xffffffffffffff9c filename="/sys/kernel/debug/tracing/events/kprobes/" +flags=0x98800 mode=0x0 + +Signed-off-by: Ruan Jinjie +Acked-by: Björn Töpel +Fixes: 0ebeea8ca8a4 ("bpf: Restrict bpf_probe_read{, str}() only to archs where they work") +Link: https://lore.kernel.org/r/20230504072910.3742842-1-ruanjinjie@huawei.com +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + arch/riscv/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/riscv/Kconfig b/arch/riscv/Kconfig +index eb7f29a412f87..b462ed7d41fe1 100644 +--- a/arch/riscv/Kconfig ++++ b/arch/riscv/Kconfig +@@ -25,6 +25,7 @@ config RISCV + select ARCH_HAS_GIGANTIC_PAGE + select ARCH_HAS_KCOV + select ARCH_HAS_MMIOWB ++ select ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE + select ARCH_HAS_PMEM_API + select ARCH_HAS_PTE_SPECIAL + select ARCH_HAS_SET_DIRECT_MAP if MMU +-- +2.39.2 + diff --git a/queue-6.3/riscv-mm-ensure-prot-of-vm_write-and-vm_exec-must-be.patch b/queue-6.3/riscv-mm-ensure-prot-of-vm_write-and-vm_exec-must-be.patch new file mode 100644 index 00000000000..0572ee2b8d8 --- /dev/null +++ b/queue-6.3/riscv-mm-ensure-prot-of-vm_write-and-vm_exec-must-be.patch @@ -0,0 +1,59 @@ +From 39e88c7b8e3250bd4d518e50dd0f988db42b6b32 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Apr 2023 18:28:28 +0800 +Subject: riscv: mm: Ensure prot of VM_WRITE and VM_EXEC must be readable + +From: Hsieh-Tseng Shen + +[ Upstream commit 6569fc12e442ea973d96db39e542aa19a7bc3a79 ] + +Commit 8aeb7b17f04e ("RISC-V: Make mmap() with PROT_WRITE imply PROT_READ") +allows riscv to use mmap with PROT_WRITE only, and meanwhile mmap with w+x +is also permitted. However, when userspace tries to access this page with +PROT_WRITE|PROT_EXEC, which causes infinite loop at load page fault as +well as it triggers soft lockup. According to riscv privileged spec, +"Writable pages must also be marked readable". The fix to drop the +`PAGE_COPY_READ_EXEC` and then `PAGE_COPY_EXEC` would be just used instead. +This aligns the other arches (i.e arm64) for protection_map. + +Fixes: 8aeb7b17f04e ("RISC-V: Make mmap() with PROT_WRITE imply PROT_READ") +Signed-off-by: Hsieh-Tseng Shen +Reviewed-by: Alexandre Ghiti +Link: https://lore.kernel.org/r/20230425102828.1616812-1-woodrow.shen@sifive.com +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + arch/riscv/include/asm/pgtable.h | 3 +-- + arch/riscv/mm/init.c | 2 +- + 2 files changed, 2 insertions(+), 3 deletions(-) + +diff --git a/arch/riscv/include/asm/pgtable.h b/arch/riscv/include/asm/pgtable.h +index f641837ccf31d..05eda3281ba90 100644 +--- a/arch/riscv/include/asm/pgtable.h ++++ b/arch/riscv/include/asm/pgtable.h +@@ -165,8 +165,7 @@ extern struct pt_alloc_ops pt_ops __initdata; + _PAGE_EXEC | _PAGE_WRITE) + + #define PAGE_COPY PAGE_READ +-#define PAGE_COPY_EXEC PAGE_EXEC +-#define PAGE_COPY_READ_EXEC PAGE_READ_EXEC ++#define PAGE_COPY_EXEC PAGE_READ_EXEC + #define PAGE_SHARED PAGE_WRITE + #define PAGE_SHARED_EXEC PAGE_WRITE_EXEC + +diff --git a/arch/riscv/mm/init.c b/arch/riscv/mm/init.c +index dc1793bf01796..309d685d70267 100644 +--- a/arch/riscv/mm/init.c ++++ b/arch/riscv/mm/init.c +@@ -286,7 +286,7 @@ static const pgprot_t protection_map[16] = { + [VM_EXEC] = PAGE_EXEC, + [VM_EXEC | VM_READ] = PAGE_READ_EXEC, + [VM_EXEC | VM_WRITE] = PAGE_COPY_EXEC, +- [VM_EXEC | VM_WRITE | VM_READ] = PAGE_COPY_READ_EXEC, ++ [VM_EXEC | VM_WRITE | VM_READ] = PAGE_COPY_EXEC, + [VM_SHARED] = PAGE_NONE, + [VM_SHARED | VM_READ] = PAGE_READ, + [VM_SHARED | VM_WRITE] = PAGE_SHARED, +-- +2.39.2 + diff --git a/queue-6.3/series b/queue-6.3/series index e43394580e0..91142120da3 100644 --- a/queue-6.3/series +++ b/queue-6.3/series @@ -115,3 +115,34 @@ usb-usbfs-enforce-page-requirements-for-mmap.patch usb-usbfs-use-consistent-mmap-functions.patch mm-page_table_check-make-it-dependent-on-exclusive_system_ram.patch mm-page_table_check-ensure-user-pages-are-not-slab-pages.patch +soc-qcom-rpmh-rsc-drop-redundant-unsigned-0-comparis.patch +arm64-dts-qcom-sc8280xp-flush-rsc-sleep-wake-votes.patch +arm64-dts-qcom-sm6375-pdx225-fix-remoteproc-firmware.patch +arm-at91-pm-fix-imbalanced-reference-counter-for-eth.patch +arm-dts-at91-sama7g5ek-fix-debounce-delay-property-f.patch +asoc-codecs-wsa883x-do-not-set-can_multi_write-flag.patch +asoc-codecs-wsa881x-do-not-set-can_multi_write-flag.patch +soc-qcom-ramp_controller-fix-an-error-handling-path-.patch +soc-qcom-rmtfs-fix-error-code-in-probe.patch +arm64-dts-qcom-sc7180-lite-fix-sdram-freq-for-miside.patch +arm64-dts-imx8qm-mek-correct-gpios-for-usdhc2-cd-and.patch +arm64-dts-imx8-ss-dma-assign-default-clock-rate-for-.patch +asoc-amd-ps-fix-for-acp_lock-access-in-pdm-driver.patch +asoc-mediatek-mt8188-fix-use-after-free-in-driver-re.patch +asoc-mediatek-mt8195-afe-pcm-convert-to-platform-rem.patch +asoc-mediatek-mt8195-fix-use-after-free-in-driver-re.patch +asoc-simple-card-utils-fix-pcm-constraint-error-chec.patch +blk-mq-fix-blk_mq_hw_ctx-active-request-accounting.patch +arm64-dts-imx8mn-beacon-fix-spi-cs-pinmux.patch +i2c-mv64xxx-fix-reading-invalid-status-value-in-atom.patch +firmware-arm_ffa-set-handle-field-to-zero-in-memory-.patch +gpio-sim-fix-memory-corruption-when-adding-named-lin.patch +i2c-sprd-delete-i2c-adapter-in-.remove-s-error-path.patch +riscv-mm-ensure-prot-of-vm_write-and-vm_exec-must-be.patch +eeprom-at24-also-select-regmap.patch +soundwire-stream-add-missing-clear-of-alloc_slave_rt.patch +riscv-fix-kprobe-__user-string-arg-print-fault-issue.patch +vduse-avoid-empty-string-for-dev-name.patch +vdpa-mlx5-fix-hang-when-cvq-commands-are-triggered-d.patch +vhost-support-packed-when-setting-getting-vring_base.patch +vhost_vdpa-support-packed-when-setting-getting-vring.patch diff --git a/queue-6.3/soc-qcom-ramp_controller-fix-an-error-handling-path-.patch b/queue-6.3/soc-qcom-ramp_controller-fix-an-error-handling-path-.patch new file mode 100644 index 00000000000..7fd28661c07 --- /dev/null +++ b/queue-6.3/soc-qcom-ramp_controller-fix-an-error-handling-path-.patch @@ -0,0 +1,39 @@ +From 11942cb868dac91ee2fe2e48b677ef62701ace7a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Apr 2023 00:29:35 +0200 +Subject: soc: qcom: ramp_controller: Fix an error handling path in + qcom_ramp_controller_probe() + +From: Christophe JAILLET + +[ Upstream commit b3d0dcc8e359cf5d57fb6308bc9750af5da574b3 ] + +'qrc' is known to be non-NULL at this point. +Checking for 'qrc->desc' was expected instead, so use it. + +Fixes: a723c95fa137 ("soc: qcom: Add Qualcomm Ramp Controller driver") +Signed-off-by: Christophe JAILLET +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/84727a79d0261b4112411aec23b553504015c02c.1681684138.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Sasha Levin +--- + drivers/soc/qcom/ramp_controller.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/soc/qcom/ramp_controller.c b/drivers/soc/qcom/ramp_controller.c +index dc74d2a19de2b..5e3ba0be09035 100644 +--- a/drivers/soc/qcom/ramp_controller.c ++++ b/drivers/soc/qcom/ramp_controller.c +@@ -296,7 +296,7 @@ static int qcom_ramp_controller_probe(struct platform_device *pdev) + return -ENOMEM; + + qrc->desc = device_get_match_data(&pdev->dev); +- if (!qrc) ++ if (!qrc->desc) + return -EINVAL; + + qrc->regmap = devm_regmap_init_mmio(&pdev->dev, base, &qrc_regmap_config); +-- +2.39.2 + diff --git a/queue-6.3/soc-qcom-rmtfs-fix-error-code-in-probe.patch b/queue-6.3/soc-qcom-rmtfs-fix-error-code-in-probe.patch new file mode 100644 index 00000000000..b59d3d1d47e --- /dev/null +++ b/queue-6.3/soc-qcom-rmtfs-fix-error-code-in-probe.patch @@ -0,0 +1,37 @@ +From 5d8d99d239292800c0f2fbd12c09bfaa71271ee1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Apr 2023 13:44:21 +0300 +Subject: soc: qcom: rmtfs: Fix error code in probe() + +From: Dan Carpenter + +[ Upstream commit 7b374a2fc8665bfb8a0d93b617463cc0732f533a ] + +Return an error code if of_property_count_u32_elems() fails. Don't +return success. + +Fixes: e656cd0bcf3d ("soc: qcom: rmtfs: Optionally map RMTFS to more VMs") +Signed-off-by: Dan Carpenter +Reviewed-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/76b21a14-70ff-4ca9-927d-587543c6699c@kili.mountain +Signed-off-by: Sasha Levin +--- + drivers/soc/qcom/rmtfs_mem.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/soc/qcom/rmtfs_mem.c b/drivers/soc/qcom/rmtfs_mem.c +index 0d31377f178d5..d4bda086c141a 100644 +--- a/drivers/soc/qcom/rmtfs_mem.c ++++ b/drivers/soc/qcom/rmtfs_mem.c +@@ -234,6 +234,7 @@ static int qcom_rmtfs_mem_probe(struct platform_device *pdev) + num_vmids = 0; + } else if (num_vmids < 0) { + dev_err(&pdev->dev, "failed to count qcom,vmid elements: %d\n", num_vmids); ++ ret = num_vmids; + goto remove_cdev; + } else if (num_vmids > NUM_MAX_VMIDS) { + dev_warn(&pdev->dev, +-- +2.39.2 + diff --git a/queue-6.3/soc-qcom-rpmh-rsc-drop-redundant-unsigned-0-comparis.patch b/queue-6.3/soc-qcom-rpmh-rsc-drop-redundant-unsigned-0-comparis.patch new file mode 100644 index 00000000000..1108bb99f93 --- /dev/null +++ b/queue-6.3/soc-qcom-rpmh-rsc-drop-redundant-unsigned-0-comparis.patch @@ -0,0 +1,38 @@ +From a7ac150caf539969db0b92ede906decf09c02cef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 13 May 2023 13:29:13 +0200 +Subject: soc: qcom: rpmh-rsc: drop redundant unsigned >=0 comparision + +From: Krzysztof Kozlowski + +[ Upstream commit 3395d36e6805786c26d13188735bc796b9d7a7c9 ] + +Unsigned int "minor" is always >= 0 as reported by Smatch: + + drivers/soc/qcom/rpmh-rsc.c:1076 rpmh_rsc_probe() warn: always true condition '(drv->ver.minor >= 0) => (0-u32max >= 0)' + +Fixes: 88704a0cd719 ("soc: qcom: rpmh-rsc: Support RSC v3 minor versions") +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230513112913.176009-1-krzysztof.kozlowski@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/soc/qcom/rpmh-rsc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/soc/qcom/rpmh-rsc.c b/drivers/soc/qcom/rpmh-rsc.c +index f93544f6d7961..0dd4363ebac8f 100644 +--- a/drivers/soc/qcom/rpmh-rsc.c ++++ b/drivers/soc/qcom/rpmh-rsc.c +@@ -1073,7 +1073,7 @@ static int rpmh_rsc_probe(struct platform_device *pdev) + drv->ver.minor = rsc_id & (MINOR_VER_MASK << MINOR_VER_SHIFT); + drv->ver.minor >>= MINOR_VER_SHIFT; + +- if (drv->ver.major == 3 && drv->ver.minor >= 0) ++ if (drv->ver.major == 3) + drv->regs = rpmh_rsc_reg_offset_ver_3_0; + else + drv->regs = rpmh_rsc_reg_offset_ver_2_7; +-- +2.39.2 + diff --git a/queue-6.3/soundwire-stream-add-missing-clear-of-alloc_slave_rt.patch b/queue-6.3/soundwire-stream-add-missing-clear-of-alloc_slave_rt.patch new file mode 100644 index 00000000000..4373c739bde --- /dev/null +++ b/queue-6.3/soundwire-stream-add-missing-clear-of-alloc_slave_rt.patch @@ -0,0 +1,42 @@ +From 222d9b5b220a573cb884f53893977876461c19fe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Jun 2023 11:11:36 +0100 +Subject: soundwire: stream: Add missing clear of alloc_slave_rt + +From: Charles Keepax + +[ Upstream commit 58d95889f3c2064c6139ee94bb0e4d86e1ad4eab ] + +The current path that skips allocating the slave runtime does not clear +the alloc_slave_rt flag, this is clearly incorrect. Add the missing +clear, so the runtime won't be erroneously cleaned up. + +Fixes: f3016b891c8c ("soundwire: stream: sdw_stream_add_ functions can be called multiple times") +Reviewed-by: Pierre-Louis Bossart +Signed-off-by: Charles Keepax +Link: https://lore.kernel.org/r/20230602101140.2040141-1-ckeepax@opensource.cirrus.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/soundwire/stream.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/soundwire/stream.c b/drivers/soundwire/stream.c +index 8c6da1739e3d1..3c909853aaf89 100644 +--- a/drivers/soundwire/stream.c ++++ b/drivers/soundwire/stream.c +@@ -2019,8 +2019,10 @@ int sdw_stream_add_slave(struct sdw_slave *slave, + + skip_alloc_master_rt: + s_rt = sdw_slave_rt_find(slave, stream); +- if (s_rt) ++ if (s_rt) { ++ alloc_slave_rt = false; + goto skip_alloc_slave_rt; ++ } + + s_rt = sdw_slave_rt_alloc(slave, m_rt); + if (!s_rt) { +-- +2.39.2 + diff --git a/queue-6.3/vdpa-mlx5-fix-hang-when-cvq-commands-are-triggered-d.patch b/queue-6.3/vdpa-mlx5-fix-hang-when-cvq-commands-are-triggered-d.patch new file mode 100644 index 00000000000..95ccef9744e --- /dev/null +++ b/queue-6.3/vdpa-mlx5-fix-hang-when-cvq-commands-are-triggered-d.patch @@ -0,0 +1,126 @@ +From c0c5a4493604c3929db950e46f9acebf598b7413 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 May 2023 12:58:01 +0300 +Subject: vdpa/mlx5: Fix hang when cvq commands are triggered during device + unregister + +From: Dragos Tatulea + +[ Upstream commit 73790bdfba076c0886f0f14fd46ff2c70ee31ce9 ] + +Currently the vdpa device is unregistered after the workqueue that +processes vq commands is disabled. However, the device unregister +process can still send commands to the cvq (a vlan delete for example) +which leads to a hang because the handing workqueue has been disabled +and the command never finishes: + + [ 2263.095764] rcu: INFO: rcu_sched self-detected stall on CPU + [ 2263.096307] rcu: 9-....: (5250 ticks this GP) idle=dac4/1/0x4000000000000000 softirq=111009/111009 fqs=2544 + [ 2263.097154] rcu: (t=5251 jiffies g=393549 q=347 ncpus=10) + [ 2263.097648] CPU: 9 PID: 94300 Comm: kworker/u20:2 Not tainted 6.3.0-rc6_for_upstream_min_debug_2023_04_14_00_02 #1 + [ 2263.098535] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 + [ 2263.099481] Workqueue: mlx5_events mlx5_vhca_state_work_handler [mlx5_core] + [ 2263.100143] RIP: 0010:virtnet_send_command+0x109/0x170 + [ 2263.100621] Code: 1d df f5 ff 85 c0 78 5c 48 8b 7b 08 e8 d0 c5 f5 ff 84 c0 75 11 eb 22 48 8b 7b 08 e8 01 b7 f5 ff 84 c0 75 15 f3 90 48 8b 7b 08 <48> 8d 74 24 04 e8 8d c5 f5 ff 48 85 c0 74 de 48 8b 83 f8 00 00 00 + [ 2263.102148] RSP: 0018:ffff888139cf36e8 EFLAGS: 00000246 + [ 2263.102624] RAX: 0000000000000000 RBX: ffff888166bea940 RCX: 0000000000000001 + [ 2263.103244] RDX: 0000000000000000 RSI: ffff888139cf36ec RDI: ffff888146763800 + [ 2263.103864] RBP: ffff888139cf3710 R08: ffff88810d201000 R09: 0000000000000000 + [ 2263.104473] R10: 0000000000000002 R11: 0000000000000003 R12: 0000000000000002 + [ 2263.105082] R13: 0000000000000002 R14: ffff888114528400 R15: ffff888166bea000 + [ 2263.105689] FS: 0000000000000000(0000) GS:ffff88852cc80000(0000) knlGS:0000000000000000 + [ 2263.106404] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + [ 2263.106925] CR2: 00007f31f394b000 CR3: 000000010615b006 CR4: 0000000000370ea0 + [ 2263.107542] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 + [ 2263.108163] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 + [ 2263.108769] Call Trace: + [ 2263.109059] + [ 2263.109320] ? check_preempt_wakeup+0x11f/0x230 + [ 2263.109750] virtnet_vlan_rx_kill_vid+0x5a/0xa0 + [ 2263.110180] vlan_vid_del+0x9c/0x170 + [ 2263.110546] vlan_device_event+0x351/0x760 [8021q] + [ 2263.111004] raw_notifier_call_chain+0x41/0x60 + [ 2263.111426] dev_close_many+0xcb/0x120 + [ 2263.111808] unregister_netdevice_many_notify+0x130/0x770 + [ 2263.112297] ? wq_worker_running+0xa/0x30 + [ 2263.112688] unregister_netdevice_queue+0x89/0xc0 + [ 2263.113128] unregister_netdev+0x18/0x20 + [ 2263.113512] virtnet_remove+0x4f/0x230 + [ 2263.113885] virtio_dev_remove+0x31/0x70 + [ 2263.114273] device_release_driver_internal+0x18f/0x1f0 + [ 2263.114746] bus_remove_device+0xc6/0x130 + [ 2263.115146] device_del+0x173/0x3c0 + [ 2263.115502] ? kernfs_find_ns+0x35/0xd0 + [ 2263.115895] device_unregister+0x1a/0x60 + [ 2263.116279] unregister_virtio_device+0x11/0x20 + [ 2263.116706] device_release_driver_internal+0x18f/0x1f0 + [ 2263.117182] bus_remove_device+0xc6/0x130 + [ 2263.117576] device_del+0x173/0x3c0 + [ 2263.117929] ? vdpa_dev_remove+0x20/0x20 [vdpa] + [ 2263.118364] device_unregister+0x1a/0x60 + [ 2263.118752] mlx5_vdpa_dev_del+0x4c/0x80 [mlx5_vdpa] + [ 2263.119232] vdpa_match_remove+0x21/0x30 [vdpa] + [ 2263.119663] bus_for_each_dev+0x71/0xc0 + [ 2263.120054] vdpa_mgmtdev_unregister+0x57/0x70 [vdpa] + [ 2263.120520] mlx5v_remove+0x12/0x20 [mlx5_vdpa] + [ 2263.120953] auxiliary_bus_remove+0x18/0x30 + [ 2263.121356] device_release_driver_internal+0x18f/0x1f0 + [ 2263.121830] bus_remove_device+0xc6/0x130 + [ 2263.122223] device_del+0x173/0x3c0 + [ 2263.122581] ? devl_param_driverinit_value_get+0x29/0x90 + [ 2263.123070] mlx5_rescan_drivers_locked+0xc4/0x2d0 [mlx5_core] + [ 2263.123633] mlx5_unregister_device+0x54/0x80 [mlx5_core] + [ 2263.124169] mlx5_uninit_one+0x54/0x150 [mlx5_core] + [ 2263.124656] mlx5_sf_dev_remove+0x45/0x90 [mlx5_core] + [ 2263.125153] auxiliary_bus_remove+0x18/0x30 + [ 2263.125560] device_release_driver_internal+0x18f/0x1f0 + [ 2263.126052] bus_remove_device+0xc6/0x130 + [ 2263.126451] device_del+0x173/0x3c0 + [ 2263.126815] mlx5_sf_dev_remove+0x39/0xf0 [mlx5_core] + [ 2263.127318] mlx5_sf_dev_state_change_handler+0x178/0x270 [mlx5_core] + [ 2263.127920] blocking_notifier_call_chain+0x5a/0x80 + [ 2263.128379] mlx5_vhca_state_work_handler+0x151/0x200 [mlx5_core] + [ 2263.128951] process_one_work+0x1bb/0x3c0 + [ 2263.129355] ? process_one_work+0x3c0/0x3c0 + [ 2263.129766] worker_thread+0x4d/0x3c0 + [ 2263.130140] ? process_one_work+0x3c0/0x3c0 + [ 2263.130548] kthread+0xb9/0xe0 + [ 2263.130895] ? kthread_complete_and_exit+0x20/0x20 + [ 2263.131349] ret_from_fork+0x1f/0x30 + [ 2263.131717] + +The fix is to disable and destroy the workqueue after the device +unregister. It is expected that vhost will not trigger kicks after +the unregister. But even if it would, the wq is disabled already by +setting the pointer to NULL (done so in the referenced commit). + +Fixes: ad6dc1daaf29 ("vdpa/mlx5: Avoid processing works if workqueue was destroyed") +Signed-off-by: Dragos Tatulea +Message-Id: <20230516095800.3549932-1-dtatulea@nvidia.com> +Signed-off-by: Michael S. Tsirkin +Reviewed-by: Tariq Toukan +Acked-by: Jason Wang +Signed-off-by: Sasha Levin +--- + drivers/vdpa/mlx5/net/mlx5_vnet.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/vdpa/mlx5/net/mlx5_vnet.c b/drivers/vdpa/mlx5/net/mlx5_vnet.c +index 97a16f7eb8941..0b228fbb2a68b 100644 +--- a/drivers/vdpa/mlx5/net/mlx5_vnet.c ++++ b/drivers/vdpa/mlx5/net/mlx5_vnet.c +@@ -3323,10 +3323,10 @@ static void mlx5_vdpa_dev_del(struct vdpa_mgmt_dev *v_mdev, struct vdpa_device * + mlx5_vdpa_remove_debugfs(ndev->debugfs); + ndev->debugfs = NULL; + unregister_link_notifier(ndev); ++ _vdpa_unregister_device(dev); + wq = mvdev->wq; + mvdev->wq = NULL; + destroy_workqueue(wq); +- _vdpa_unregister_device(dev); + mgtdev->ndev = NULL; + } + +-- +2.39.2 + diff --git a/queue-6.3/vduse-avoid-empty-string-for-dev-name.patch b/queue-6.3/vduse-avoid-empty-string-for-dev-name.patch new file mode 100644 index 00000000000..316eeed9001 --- /dev/null +++ b/queue-6.3/vduse-avoid-empty-string-for-dev-name.patch @@ -0,0 +1,64 @@ +From de71f4532ada2ebd862a83d142dbd9ca4ba04a89 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 May 2023 11:36:26 +0800 +Subject: vduse: avoid empty string for dev name + +From: Sheng Zhao + +[ Upstream commit a90e8608eb0ed93d31ac0feb055f77ce59512542 ] + +Syzkaller hits a kernel WARN when the first character of the dev name +provided is NULL. Solution is to add a NULL check before calling +cdev_device_add() in vduse_create_dev(). + +kobject: (0000000072042169): attempted to be registered with empty name! +WARNING: CPU: 0 PID: 112695 at lib/kobject.c:236 +Call Trace: + kobject_add_varg linux/src/lib/kobject.c:390 [inline] + kobject_add+0xf6/0x150 linux/src/lib/kobject.c:442 + device_add+0x28f/0xc20 linux/src/drivers/base/core.c:2167 + cdev_device_add+0x83/0xc0 linux/src/fs/char_dev.c:546 + vduse_create_dev linux/src/drivers/vdpa/vdpa_user/vduse_dev.c:2254 [inline] + vduse_ioctl+0x7b5/0xf30 linux/src/drivers/vdpa/vdpa_user/vduse_dev.c:2316 + vfs_ioctl linux/src/fs/ioctl.c:47 [inline] + file_ioctl linux/src/fs/ioctl.c:510 [inline] + do_vfs_ioctl+0x14b/0xa80 linux/src/fs/ioctl.c:697 + ksys_ioctl+0x7c/0xa0 linux/src/fs/ioctl.c:714 + __do_sys_ioctl linux/src/fs/ioctl.c:721 [inline] + __se_sys_ioctl linux/src/fs/ioctl.c:719 [inline] + __x64_sys_ioctl+0x42/0x50 linux/src/fs/ioctl.c:719 + do_syscall_64+0x94/0x330 linux/src/arch/x86/entry/common.c:291 + entry_SYSCALL_64_after_hwframe+0x44/0xa9 + +Fixes: c8a6153b6c59 ("vduse: Introduce VDUSE - vDPA Device in Userspace") +Cc: "Xie Yongji" +Reported-by: Xianjun Zeng +Signed-off-by: Sheng Zhao +Message-Id: <20230530033626.1266794-1-sheng.zhao@bytedance.com> +Signed-off-by: Michael S. Tsirkin +Acked-by: Jason Wang +Reviewed-by: Xie Yongji +Cc: "Michael S. Tsirkin", "Jason Wang", +Reviewed-by: Xie Yongji +Signed-off-by: Sasha Levin +--- + drivers/vdpa/vdpa_user/vduse_dev.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/vdpa/vdpa_user/vduse_dev.c b/drivers/vdpa/vdpa_user/vduse_dev.c +index 0c3b48616a9f3..695b20b17e010 100644 +--- a/drivers/vdpa/vdpa_user/vduse_dev.c ++++ b/drivers/vdpa/vdpa_user/vduse_dev.c +@@ -1443,6 +1443,9 @@ static bool vduse_validate_config(struct vduse_dev_config *config) + if (config->vq_num > 0xffff) + return false; + ++ if (!config->name[0]) ++ return false; ++ + if (!device_is_allowed(config->device_id)) + return false; + +-- +2.39.2 + diff --git a/queue-6.3/vhost-support-packed-when-setting-getting-vring_base.patch b/queue-6.3/vhost-support-packed-when-setting-getting-vring_base.patch new file mode 100644 index 00000000000..9354a4bf828 --- /dev/null +++ b/queue-6.3/vhost-support-packed-when-setting-getting-vring_base.patch @@ -0,0 +1,85 @@ +From 694541002d112e667299e0f9dc6ddb9707478c98 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Apr 2023 15:50:30 -0700 +Subject: vhost: support PACKED when setting-getting vring_base + +From: Shannon Nelson + +[ Upstream commit 55d8122f5cd62d5aaa225d7167dcd14a44c850b9 ] + +Use the right structs for PACKED or split vqs when setting and +getting the vring base. + +Fixes: 4c8cf31885f6 ("vhost: introduce vDPA-based backend") +Signed-off-by: Shannon Nelson +Message-Id: <20230424225031.18947-3-shannon.nelson@amd.com> +Signed-off-by: Michael S. Tsirkin +Acked-by: Jason Wang +Signed-off-by: Sasha Levin +--- + drivers/vhost/vhost.c | 18 +++++++++++++----- + drivers/vhost/vhost.h | 8 ++++++-- + 2 files changed, 19 insertions(+), 7 deletions(-) + +diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c +index f11bdbe4c2c5f..f64efda48f21c 100644 +--- a/drivers/vhost/vhost.c ++++ b/drivers/vhost/vhost.c +@@ -1633,17 +1633,25 @@ long vhost_vring_ioctl(struct vhost_dev *d, unsigned int ioctl, void __user *arg + r = -EFAULT; + break; + } +- if (s.num > 0xffff) { +- r = -EINVAL; +- break; ++ if (vhost_has_feature(vq, VIRTIO_F_RING_PACKED)) { ++ vq->last_avail_idx = s.num & 0xffff; ++ vq->last_used_idx = (s.num >> 16) & 0xffff; ++ } else { ++ if (s.num > 0xffff) { ++ r = -EINVAL; ++ break; ++ } ++ vq->last_avail_idx = s.num; + } +- vq->last_avail_idx = s.num; + /* Forget the cached index value. */ + vq->avail_idx = vq->last_avail_idx; + break; + case VHOST_GET_VRING_BASE: + s.index = idx; +- s.num = vq->last_avail_idx; ++ if (vhost_has_feature(vq, VIRTIO_F_RING_PACKED)) ++ s.num = (u32)vq->last_avail_idx | ((u32)vq->last_used_idx << 16); ++ else ++ s.num = vq->last_avail_idx; + if (copy_to_user(argp, &s, sizeof s)) + r = -EFAULT; + break; +diff --git a/drivers/vhost/vhost.h b/drivers/vhost/vhost.h +index 1647b750169c7..6f73f29d59791 100644 +--- a/drivers/vhost/vhost.h ++++ b/drivers/vhost/vhost.h +@@ -85,13 +85,17 @@ struct vhost_virtqueue { + /* The routine to call when the Guest pings us, or timeout. */ + vhost_work_fn_t handle_kick; + +- /* Last available index we saw. */ ++ /* Last available index we saw. ++ * Values are limited to 0x7fff, and the high bit is used as ++ * a wrap counter when using VIRTIO_F_RING_PACKED. */ + u16 last_avail_idx; + + /* Caches available index value from user. */ + u16 avail_idx; + +- /* Last index we used. */ ++ /* Last index we used. ++ * Values are limited to 0x7fff, and the high bit is used as ++ * a wrap counter when using VIRTIO_F_RING_PACKED. */ + u16 last_used_idx; + + /* Used flags */ +-- +2.39.2 + diff --git a/queue-6.3/vhost_vdpa-support-packed-when-setting-getting-vring.patch b/queue-6.3/vhost_vdpa-support-packed-when-setting-getting-vring.patch new file mode 100644 index 00000000000..1b939122e79 --- /dev/null +++ b/queue-6.3/vhost_vdpa-support-packed-when-setting-getting-vring.patch @@ -0,0 +1,64 @@ +From d3a9322fc545819a800c802db0e227b2658df84f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Apr 2023 15:50:31 -0700 +Subject: vhost_vdpa: support PACKED when setting-getting vring_base + +From: Shannon Nelson + +[ Upstream commit beee7fdb5b56a46415a4992d28dd4c2d06eb52df ] + +Use the right structs for PACKED or split vqs when setting and +getting the vring base. + +Fixes: 4c8cf31885f6 ("vhost: introduce vDPA-based backend") +Signed-off-by: Shannon Nelson +Message-Id: <20230424225031.18947-4-shannon.nelson@amd.com> +Signed-off-by: Michael S. Tsirkin +Acked-by: Jason Wang +Signed-off-by: Sasha Levin +--- + drivers/vhost/vdpa.c | 21 +++++++++++++++++---- + 1 file changed, 17 insertions(+), 4 deletions(-) + +diff --git a/drivers/vhost/vdpa.c b/drivers/vhost/vdpa.c +index 74c7d1f978b75..779fc44677162 100644 +--- a/drivers/vhost/vdpa.c ++++ b/drivers/vhost/vdpa.c +@@ -572,7 +572,14 @@ static long vhost_vdpa_vring_ioctl(struct vhost_vdpa *v, unsigned int cmd, + if (r) + return r; + +- vq->last_avail_idx = vq_state.split.avail_index; ++ if (vhost_has_feature(vq, VIRTIO_F_RING_PACKED)) { ++ vq->last_avail_idx = vq_state.packed.last_avail_idx | ++ (vq_state.packed.last_avail_counter << 15); ++ vq->last_used_idx = vq_state.packed.last_used_idx | ++ (vq_state.packed.last_used_counter << 15); ++ } else { ++ vq->last_avail_idx = vq_state.split.avail_index; ++ } + break; + } + +@@ -590,9 +597,15 @@ static long vhost_vdpa_vring_ioctl(struct vhost_vdpa *v, unsigned int cmd, + break; + + case VHOST_SET_VRING_BASE: +- vq_state.split.avail_index = vq->last_avail_idx; +- if (ops->set_vq_state(vdpa, idx, &vq_state)) +- r = -EINVAL; ++ if (vhost_has_feature(vq, VIRTIO_F_RING_PACKED)) { ++ vq_state.packed.last_avail_idx = vq->last_avail_idx & 0x7fff; ++ vq_state.packed.last_avail_counter = !!(vq->last_avail_idx & 0x8000); ++ vq_state.packed.last_used_idx = vq->last_used_idx & 0x7fff; ++ vq_state.packed.last_used_counter = !!(vq->last_used_idx & 0x8000); ++ } else { ++ vq_state.split.avail_index = vq->last_avail_idx; ++ } ++ r = ops->set_vq_state(vdpa, idx, &vq_state); + break; + + case VHOST_SET_VRING_CALL: +-- +2.39.2 +