From: Sasha Levin Date: Sun, 5 Mar 2023 01:57:01 +0000 (-0500) Subject: Fixes for 5.15 X-Git-Tag: v6.2.3~126 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=c5780a18e56c325669b119fe0ba5302defc7de0e;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.15 Signed-off-by: Sasha Levin --- diff --git a/queue-5.15/acpi-battery-fix-missing-nul-termination-with-large-.patch b/queue-5.15/acpi-battery-fix-missing-nul-termination-with-large-.patch new file mode 100644 index 00000000000..a0e156f10b9 --- /dev/null +++ b/queue-5.15/acpi-battery-fix-missing-nul-termination-with-large-.patch @@ -0,0 +1,44 @@ +From 0a690f0b5c2026ce0079ea2b3203e1d9062cbdc3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 14 Jan 2023 09:50:50 +0100 +Subject: ACPI: battery: Fix missing NUL-termination with large strings + +From: Armin Wolf + +[ Upstream commit f2ac14b5f197e4a2dec51e5ceaa56682ff1592bc ] + +When encountering a string bigger than the destination buffer (32 bytes), +the string is not properly NUL-terminated, causing buffer overreads later. + +This for example happens on the Inspiron 3505, where the battery +model name is larger than 32 bytes, which leads to sysfs showing +the model name together with the serial number string (which is +NUL-terminated and thus prevents worse). + +Fix this by using strscpy() which ensures that the result is +always NUL-terminated. + +Fixes: 106449e870b3 ("ACPI: Battery: Allow extract string from integer") +Signed-off-by: Armin Wolf +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/battery.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c +index 56db7b4da5140..c7569151fd02a 100644 +--- a/drivers/acpi/battery.c ++++ b/drivers/acpi/battery.c +@@ -449,7 +449,7 @@ static int extract_package(struct acpi_battery *battery, + + if (element->type == ACPI_TYPE_STRING || + element->type == ACPI_TYPE_BUFFER) +- strncpy(ptr, element->string.pointer, 32); ++ strscpy(ptr, element->string.pointer, 32); + else if (element->type == ACPI_TYPE_INTEGER) { + strncpy(ptr, (u8 *)&element->integer.value, + sizeof(u64)); +-- +2.39.2 + diff --git a/queue-5.15/acpi-don-t-build-acpica-with-os.patch b/queue-5.15/acpi-don-t-build-acpica-with-os.patch new file mode 100644 index 00000000000..334083126b3 --- /dev/null +++ b/queue-5.15/acpi-don-t-build-acpica-with-os.patch @@ -0,0 +1,111 @@ +From 4bfbdf807a5d02c3e9370d2419eebbc44bd44070 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 23 Jan 2023 13:45:58 +0000 +Subject: ACPI: Don't build ACPICA with '-Os' + +From: Mark Rutland + +[ Upstream commit 8f9e0a52810dd83406c768972d022c37e7a18f1f ] + +The ACPICA code has been built with '-Os' since the beginning of git +history, though there's no explanatory comment as to why. + +This is unfortunate as GCC drops the alignment specificed by +'-falign-functions=N' when '-Os' is used, as reported in GCC bug 88345: + + https://gcc.gnu.org/bugzilla/show_bug.cgi?id=88345 + +This prevents CONFIG_FUNCTION_ALIGNMENT and +CONFIG_DEBUG_FORCE_FUNCTION_ALIGN_64B from having their expected effect +on the ACPICA code. This is doubly unfortunate as in subsequent patches +arm64 will depend upon CONFIG_FUNCTION_ALIGNMENT for its ftrace +implementation. + +Drop the '-Os' flag when building the ACPICA code. With this removed, +the code builds cleanly and works correctly in testing so far. + +I've tested this by selecting CONFIG_DEBUG_FORCE_FUNCTION_ALIGN_64B=y, +building and booting a kernel using ACPI, and looking for misaligned +text symbols: + +* arm64: + + Before, v6.2-rc3: + # uname -rm + 6.2.0-rc3 aarch64 + # grep ' [Tt] ' /proc/kallsyms | grep -iv '[048c]0 [Tt] ' | wc -l + 5009 + + Before, v6.2-rc3 + fixed __cold: + # uname -rm + 6.2.0-rc3-00001-g2a2bedf8bfa9 aarch64 + # grep ' [Tt] ' /proc/kallsyms | grep -iv '[048c]0 [Tt] ' | wc -l + 919 + + After: + # uname -rm + 6.2.0-rc3-00002-g267bddc38572 aarch64 + # grep ' [Tt] ' /proc/kallsyms | grep -iv '[048c]0 [Tt] ' | wc -l + 323 + # grep ' [Tt] ' /proc/kallsyms | grep -iv '[048c]0 [Tt] ' | grep acpi | wc -l + 0 + +* x86_64: + + Before, v6.2-rc3: + # uname -rm + 6.2.0-rc3 x86_64 + # grep ' [Tt] ' /proc/kallsyms | grep -iv '[048c]0 [Tt] ' | wc -l + 11537 + + Before, v6.2-rc3 + fixed __cold: + # uname -rm + 6.2.0-rc3-00001-g2a2bedf8bfa9 x86_64 + # grep ' [Tt] ' /proc/kallsyms | grep -iv '[048c]0 [Tt] ' | wc -l + 2805 + + After: + # uname -rm + 6.2.0-rc3-00002-g267bddc38572 x86_64 + # grep ' [Tt] ' /proc/kallsyms | grep -iv '[048c]0 [Tt] ' | wc -l + 1357 + # grep ' [Tt] ' /proc/kallsyms | grep -iv '[048c]0 [Tt] ' | grep acpi | wc -l + 0 + +With the patch applied, the remaining unaligned text labels are a +combination of static call trampolines and labels in assembly, which can +be dealt with in subsequent patches. + +Signed-off-by: Mark Rutland +Acked-by: Rafael J. Wysocki +Cc: Florent Revest +Cc: Len Brown +Cc: Masami Hiramatsu +Cc: Peter Zijlstra +Cc: Robert Moore +Cc: Steven Rostedt +Cc: Will Deacon +Cc: linux-acpi@vger.kernel.org +Link: https://lore.kernel.org/r/20230123134603.1064407-4-mark.rutland@arm.com +Signed-off-by: Catalin Marinas +Signed-off-by: Sasha Levin +--- + drivers/acpi/acpica/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/acpi/acpica/Makefile b/drivers/acpi/acpica/Makefile +index 59700433a96e5..f919811156b1f 100644 +--- a/drivers/acpi/acpica/Makefile ++++ b/drivers/acpi/acpica/Makefile +@@ -3,7 +3,7 @@ + # Makefile for ACPICA Core interpreter + # + +-ccflags-y := -Os -D_LINUX -DBUILDING_ACPICA ++ccflags-y := -D_LINUX -DBUILDING_ACPICA + ccflags-$(CONFIG_ACPI_DEBUG) += -DACPI_DEBUG_OUTPUT + + # use acpi.o to put all files here into acpi.o modparam namespace +-- +2.39.2 + diff --git a/queue-5.15/acpi-resource-add-helper-function-acpi_dev_get_memor.patch b/queue-5.15/acpi-resource-add-helper-function-acpi_dev_get_memor.patch new file mode 100644 index 00000000000..35532e97487 --- /dev/null +++ b/queue-5.15/acpi-resource-add-helper-function-acpi_dev_get_memor.patch @@ -0,0 +1,65 @@ +From 16d041ceb3b9f0867eac8a60d6ca213884d800a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Aug 2022 13:16:26 +0300 +Subject: ACPI: resource: Add helper function acpi_dev_get_memory_resources() + +From: Heikki Krogerus + +[ Upstream commit 6bb057bfd9d509755349cd2a6ca5e5e6e6071304 ] + +Wrapper function that finds all memory type resources by +using acpi_dev_get_resources(). It removes the need for the +drivers to check the resource data type separately. + +Signed-off-by: Heikki Krogerus +Signed-off-by: Rafael J. Wysocki +Stable-dep-of: c3194949ae8f ("usb: typec: intel_pmc_mux: Don't leak the ACPI device reference count") +Signed-off-by: Sasha Levin +--- + drivers/acpi/resource.c | 17 +++++++++++++++++ + include/linux/acpi.h | 1 + + 2 files changed, 18 insertions(+) + +diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c +index f6317bc417ab1..3b9f894873365 100644 +--- a/drivers/acpi/resource.c ++++ b/drivers/acpi/resource.c +@@ -788,6 +788,23 @@ int acpi_dev_get_dma_resources(struct acpi_device *adev, struct list_head *list) + } + EXPORT_SYMBOL_GPL(acpi_dev_get_dma_resources); + ++/** ++ * acpi_dev_get_memory_resources - Get current memory resources of a device. ++ * @adev: ACPI device node to get the resources for. ++ * @list: Head of the resultant list of resources (must be empty). ++ * ++ * This is a helper function that locates all memory type resources of @adev ++ * with acpi_dev_get_resources(). ++ * ++ * The number of resources in the output list is returned on success, an error ++ * code reflecting the error condition is returned otherwise. ++ */ ++int acpi_dev_get_memory_resources(struct acpi_device *adev, struct list_head *list) ++{ ++ return acpi_dev_get_resources(adev, list, is_memory, NULL); ++} ++EXPORT_SYMBOL_GPL(acpi_dev_get_memory_resources); ++ + /** + * acpi_dev_filter_resource_type - Filter ACPI resource according to resource + * types +diff --git a/include/linux/acpi.h b/include/linux/acpi.h +index 2d7df5cea2494..a23a5aea9c817 100644 +--- a/include/linux/acpi.h ++++ b/include/linux/acpi.h +@@ -484,6 +484,7 @@ int acpi_dev_get_resources(struct acpi_device *adev, struct list_head *list, + void *preproc_data); + int acpi_dev_get_dma_resources(struct acpi_device *adev, + struct list_head *list); ++int acpi_dev_get_memory_resources(struct acpi_device *adev, struct list_head *list); + int acpi_dev_filter_resource_type(struct acpi_resource *ares, + unsigned long types); + +-- +2.39.2 + diff --git a/queue-5.15/acpi-resource-add-irq-overrides-for-maingear-vector-.patch b/queue-5.15/acpi-resource-add-irq-overrides-for-maingear-vector-.patch new file mode 100644 index 00000000000..13c1d5653f0 --- /dev/null +++ b/queue-5.15/acpi-resource-add-irq-overrides-for-maingear-vector-.patch @@ -0,0 +1,67 @@ +From 5179926d1ea8753bb55fbb00b8db53728d83f76d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 11 Feb 2023 15:13:33 -0500 +Subject: ACPI: resource: Add IRQ overrides for MAINGEAR Vector Pro 2 models + +From: Adam Niederer + +[ Upstream commit cb18703c179713056bd7e3bdfc2260ab4e8658f0 ] + +Fix a regression introduced by commit 9946e39fe8d0 ("ACPI: resource: skip +IRQ override on AMD Zen platforms") on MAINGEAR Vector Pro 2 systems, which +causes the built-in keyboard to not work. This restores the functionality +by adding an IRQ override. + +No other IRQs were being overridden before, so this should be all that is +needed for these systems. I have personally tested this on the 15" model +(MG-VCP2-15A3070T), and I have confirmation that the issue is present on +the 17" model (MG-VCP2-17A3070T). + +Fixes: 9946e39fe8d0 ("ACPI: resource: skip IRQ override on AMD Zen platforms") +Signed-off-by: Adam Niederer +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/resource.c | 19 +++++++++++++++++++ + 1 file changed, 19 insertions(+) + +diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c +index 33921949bd8fd..b153e434a796d 100644 +--- a/drivers/acpi/resource.c ++++ b/drivers/acpi/resource.c +@@ -446,6 +446,24 @@ static const struct dmi_system_id schenker_gm_rg[] = { + { } + }; + ++static const struct dmi_system_id maingear_laptop[] = { ++ { ++ .ident = "MAINGEAR Vector Pro 2 15", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Micro Electronics Inc"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "MG-VCP2-15A3070T"), ++ } ++ }, ++ { ++ .ident = "MAINGEAR Vector Pro 2 17", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Micro Electronics Inc"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "MG-VCP2-17A3070T"), ++ }, ++ }, ++ { } ++}; ++ + struct irq_override_cmp { + const struct dmi_system_id *system; + unsigned char irq; +@@ -461,6 +479,7 @@ static const struct irq_override_cmp override_table[] = { + { lenovo_laptop, 6, ACPI_LEVEL_SENSITIVE, ACPI_ACTIVE_LOW, 0, true }, + { lenovo_laptop, 10, ACPI_LEVEL_SENSITIVE, ACPI_ACTIVE_LOW, 0, true }, + { schenker_gm_rg, 1, ACPI_EDGE_SENSITIVE, ACPI_ACTIVE_LOW, 1, true }, ++ { maingear_laptop, 1, ACPI_EDGE_SENSITIVE, ACPI_ACTIVE_LOW, 1, true }, + }; + + static bool acpi_dev_irq_override(u32 gsi, u8 triggering, u8 polarity, +-- +2.39.2 + diff --git a/queue-5.15/acpi-resource-do-irq-override-on-all-tongfang-gmxrgx.patch b/queue-5.15/acpi-resource-do-irq-override-on-all-tongfang-gmxrgx.patch new file mode 100644 index 00000000000..a981409d4c6 --- /dev/null +++ b/queue-5.15/acpi-resource-do-irq-override-on-all-tongfang-gmxrgx.patch @@ -0,0 +1,50 @@ +From 3b0d1283115442c8724e96baa557733d2d4288be Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Feb 2023 19:16:53 +0100 +Subject: ACPI: resource: Do IRQ override on all TongFang GMxRGxx + +From: Werner Sembach + +[ Upstream commit 17bb7046e7ce038a73ee97eaa804e0300c5199e2 ] + +Apply commit 7592b79ba4a9 ("ACPI: resource: do IRQ override on XMG Core 15") +override for all vendors using this mainboard. + +Signed-off-by: Werner Sembach +Fixes: 9946e39fe8d0 ("ACPI: resource: skip IRQ override on AMD Zen platforms") +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/resource.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c +index b153e434a796d..f6317bc417ab1 100644 +--- a/drivers/acpi/resource.c ++++ b/drivers/acpi/resource.c +@@ -435,11 +435,10 @@ static const struct dmi_system_id lenovo_laptop[] = { + { } + }; + +-static const struct dmi_system_id schenker_gm_rg[] = { ++static const struct dmi_system_id tongfang_gm_rg[] = { + { +- .ident = "XMG CORE 15 (M22)", ++ .ident = "TongFang GMxRGxx/XMG CORE 15 (M22)/TUXEDO Stellaris 15 Gen4 AMD", + .matches = { +- DMI_MATCH(DMI_SYS_VENDOR, "SchenkerTechnologiesGmbH"), + DMI_MATCH(DMI_BOARD_NAME, "GMxRGxx"), + }, + }, +@@ -478,7 +477,7 @@ static const struct irq_override_cmp override_table[] = { + { asus_laptop, 1, ACPI_LEVEL_SENSITIVE, ACPI_ACTIVE_LOW, 0, false }, + { lenovo_laptop, 6, ACPI_LEVEL_SENSITIVE, ACPI_ACTIVE_LOW, 0, true }, + { lenovo_laptop, 10, ACPI_LEVEL_SENSITIVE, ACPI_ACTIVE_LOW, 0, true }, +- { schenker_gm_rg, 1, ACPI_EDGE_SENSITIVE, ACPI_ACTIVE_LOW, 1, true }, ++ { tongfang_gm_rg, 1, ACPI_EDGE_SENSITIVE, ACPI_ACTIVE_LOW, 1, true }, + { maingear_laptop, 1, ACPI_EDGE_SENSITIVE, ACPI_ACTIVE_LOW, 1, true }, + }; + +-- +2.39.2 + diff --git a/queue-5.15/acpi-video-fix-lenovo-ideapad-z570-dmi-match.patch b/queue-5.15/acpi-video-fix-lenovo-ideapad-z570-dmi-match.patch new file mode 100644 index 00000000000..038d863eb4e --- /dev/null +++ b/queue-5.15/acpi-video-fix-lenovo-ideapad-z570-dmi-match.patch @@ -0,0 +1,42 @@ +From fc6b3e242a452b92f63e78a3fcedf9c265768674 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Feb 2023 13:44:49 +0100 +Subject: ACPI: video: Fix Lenovo Ideapad Z570 DMI match + +From: Hans de Goede + +[ Upstream commit 2d11eae42d52a131f06061015e49dc0f085c5bfc ] + +Multiple Ideapad Z570 variants need acpi_backlight=native to force native +use on these pre Windows 8 machines since acpi_video backlight control +does not work here. + +The original DMI quirk matches on a product_name of "102434U" but other +variants may have different product_name-s such as e.g. "1024D9U". + +Move to checking product_version instead as is more or less standard for +Lenovo DMI quirks for similar reasons. + +Signed-off-by: Hans de Goede +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/video_detect.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/acpi/video_detect.c b/drivers/acpi/video_detect.c +index b13713199ad94..038542b3a80a7 100644 +--- a/drivers/acpi/video_detect.c ++++ b/drivers/acpi/video_detect.c +@@ -313,7 +313,7 @@ static const struct dmi_system_id video_detect_dmi_table[] = { + .ident = "Lenovo Ideapad Z570", + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), +- DMI_MATCH(DMI_PRODUCT_NAME, "102434U"), ++ DMI_MATCH(DMI_PRODUCT_VERSION, "Ideapad Z570"), + }, + }, + { +-- +2.39.2 + diff --git a/queue-5.15/acpica-drop-port-i-o-validation-for-some-regions.patch b/queue-5.15/acpica-drop-port-i-o-validation-for-some-regions.patch new file mode 100644 index 00000000000..92130a3f580 --- /dev/null +++ b/queue-5.15/acpica-drop-port-i-o-validation-for-some-regions.patch @@ -0,0 +1,75 @@ +From d0bb06697adf1d585a538e6a97fd3165ddd3edb0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Dec 2022 09:51:20 -0600 +Subject: ACPICA: Drop port I/O validation for some regions + +From: Mario Limonciello + +[ Upstream commit e1d9148582ab2c3dada5c5cf8ca7531ca269fee5 ] + +Microsoft introduced support in Windows XP for blocking port I/O +to various regions. For Windows compatibility ACPICA has adopted +the same protections and will disallow writes to those +(presumably) the same regions. + +On some systems the AML included with the firmware will issue 4 byte +long writes to 0x80. These writes aren't making it over because of this +blockage. The first 4 byte write attempt is rejected, and then +subsequently 1 byte at a time each offset is tried. The first at 0x80 +works, but then the next 3 bytes are rejected. + +This manifests in bizarre failures for devices that expected the AML to +write all 4 bytes. Trying the same AML on Windows 10 or 11 doesn't hit +this failure and all 4 bytes are written. + +Either some of these regions were wrong or some point after Windows XP +some of these regions blocks have been lifted. + +In the last 15 years there doesn't seem to be any reports popping up of +this error in the Windows event viewer anymore. There is no documentation +at Microsoft's developer site indicating that Windows ACPI interpreter +blocks these regions. Between the lack of documentation and the fact that +the writes actually do work in Windows 10 and 11, it's quite likely +Windows doesn't actually enforce this anymore. + +So to help the issue, only enforce Windows XP specific entries if the +latest _OSI supported is Windows XP. Continue to enforce the +ALWAYS_ILLEGAL entries. + +Link: https://github.com/acpica/acpica/pull/817 +Fixes: 7f0719039085 ("ACPICA: New: I/O port protection") +Signed-off-by: Mario Limonciello +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/acpica/hwvalid.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/acpi/acpica/hwvalid.c b/drivers/acpi/acpica/hwvalid.c +index e15badf4077aa..c6716f90e013a 100644 +--- a/drivers/acpi/acpica/hwvalid.c ++++ b/drivers/acpi/acpica/hwvalid.c +@@ -23,8 +23,8 @@ acpi_hw_validate_io_request(acpi_io_address address, u32 bit_width); + * + * The table is used to implement the Microsoft port access rules that + * first appeared in Windows XP. Some ports are always illegal, and some +- * ports are only illegal if the BIOS calls _OSI with a win_XP string or +- * later (meaning that the BIOS itelf is post-XP.) ++ * ports are only illegal if the BIOS calls _OSI with nothing newer than ++ * the specific _OSI strings. + * + * This provides ACPICA with the desired port protections and + * Microsoft compatibility. +@@ -145,7 +145,8 @@ acpi_hw_validate_io_request(acpi_io_address address, u32 bit_width) + + /* Port illegality may depend on the _OSI calls made by the BIOS */ + +- if (acpi_gbl_osi_data >= port_info->osi_dependency) { ++ if (port_info->osi_dependency == ACPI_ALWAYS_ILLEGAL || ++ acpi_gbl_osi_data == port_info->osi_dependency) { + ACPI_DEBUG_PRINT((ACPI_DB_VALUES, + "Denied AML access to port 0x%8.8X%8.8X/%X (%s 0x%.4X-0x%.4X)\n", + ACPI_FORMAT_UINT64(address), +-- +2.39.2 + diff --git a/queue-5.15/acpica-nsrepair-handle-cases-without-a-return-value-.patch b/queue-5.15/acpica-nsrepair-handle-cases-without-a-return-value-.patch new file mode 100644 index 00000000000..74a90b4b28b --- /dev/null +++ b/queue-5.15/acpica-nsrepair-handle-cases-without-a-return-value-.patch @@ -0,0 +1,65 @@ +From ad0922bd1d9cab742b9e3ec3e51823fd9d4e3c3f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 7 Jan 2023 02:53:08 +0300 +Subject: ACPICA: nsrepair: handle cases without a return value correctly + +From: Daniil Tatianin + +[ Upstream commit ca843a4c79486e99a19b859ef0b9887854afe146 ] + +Previously acpi_ns_simple_repair() would crash if expected_btypes +contained any combination of ACPI_RTYPE_NONE with a different type, +e.g | ACPI_RTYPE_INTEGER because of slightly incorrect logic in the +!return_object branch, which wouldn't return AE_AML_NO_RETURN_VALUE +for such cases. + +Found by Linux Verification Center (linuxtesting.org) with the SVACE +static analysis tool. + +Link: https://github.com/acpica/acpica/pull/811 +Fixes: 61db45ca2163 ("ACPICA: Restore code that repairs NULL package elements in return values.") +Signed-off-by: Daniil Tatianin +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/acpica/nsrepair.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +diff --git a/drivers/acpi/acpica/nsrepair.c b/drivers/acpi/acpica/nsrepair.c +index 499067daa22c6..1b8677f2ced37 100644 +--- a/drivers/acpi/acpica/nsrepair.c ++++ b/drivers/acpi/acpica/nsrepair.c +@@ -181,8 +181,9 @@ acpi_ns_simple_repair(struct acpi_evaluate_info *info, + * Try to fix if there was no return object. Warning if failed to fix. + */ + if (!return_object) { +- if (expected_btypes && (!(expected_btypes & ACPI_RTYPE_NONE))) { +- if (package_index != ACPI_NOT_PACKAGE_ELEMENT) { ++ if (expected_btypes) { ++ if (!(expected_btypes & ACPI_RTYPE_NONE) && ++ package_index != ACPI_NOT_PACKAGE_ELEMENT) { + ACPI_WARN_PREDEFINED((AE_INFO, + info->full_pathname, + ACPI_WARN_ALWAYS, +@@ -196,14 +197,15 @@ acpi_ns_simple_repair(struct acpi_evaluate_info *info, + if (ACPI_SUCCESS(status)) { + return (AE_OK); /* Repair was successful */ + } +- } else { ++ } ++ ++ if (expected_btypes != ACPI_RTYPE_NONE) { + ACPI_WARN_PREDEFINED((AE_INFO, + info->full_pathname, + ACPI_WARN_ALWAYS, + "Missing expected return value")); ++ return (AE_AML_NO_RETURN_VALUE); + } +- +- return (AE_AML_NO_RETURN_VALUE); + } + } + +-- +2.39.2 + diff --git a/queue-5.15/alpha-boot-tools-objstrip-fix-the-check-for-elf-head.patch b/queue-5.15/alpha-boot-tools-objstrip-fix-the-check-for-elf-head.patch new file mode 100644 index 00000000000..f8c71d16ba1 --- /dev/null +++ b/queue-5.15/alpha-boot-tools-objstrip-fix-the-check-for-elf-head.patch @@ -0,0 +1,36 @@ +From 33e027ae6a424141d487b334d72ce3bdcbf7a656 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Jan 2023 00:14:02 -0500 +Subject: alpha/boot/tools/objstrip: fix the check for ELF header + +From: Al Viro + +[ Upstream commit 1878787797cbb019eeefe6f905514dcd557302b6 ] + +Just memcmp() with ELFMAG - that's the normal way to do it in userland +code, which that thing is. Besides, that has the benefit of actually +building - str_has_prefix() is *NOT* present in . + +Fixes: 5f14596e55de "alpha: Replace strncmp with str_has_prefix" +Signed-off-by: Al Viro +Signed-off-by: Sasha Levin +--- + arch/alpha/boot/tools/objstrip.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/alpha/boot/tools/objstrip.c b/arch/alpha/boot/tools/objstrip.c +index 08b430d25a315..7cf92d172dce9 100644 +--- a/arch/alpha/boot/tools/objstrip.c ++++ b/arch/alpha/boot/tools/objstrip.c +@@ -148,7 +148,7 @@ main (int argc, char *argv[]) + #ifdef __ELF__ + elf = (struct elfhdr *) buf; + +- if (elf->e_ident[0] == 0x7f && str_has_prefix((char *)elf->e_ident + 1, "ELF")) { ++ if (memcmp(&elf->e_ident[EI_MAG0], ELFMAG, SELFMAG) == 0) { + if (elf->e_type != ET_EXEC) { + fprintf(stderr, "%s: %s is not an ELF executable\n", + prog_name, inname); +-- +2.39.2 + diff --git a/queue-5.15/alsa-hda-ca0132-minor-fix-for-allocation-size.patch b/queue-5.15/alsa-hda-ca0132-minor-fix-for-allocation-size.patch new file mode 100644 index 00000000000..e764b53d448 --- /dev/null +++ b/queue-5.15/alsa-hda-ca0132-minor-fix-for-allocation-size.patch @@ -0,0 +1,40 @@ +From 10f75aecbc02bdd469f474e7fe9b17dd008a77ac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Jan 2023 14:15:23 +0300 +Subject: ALSA: hda/ca0132: minor fix for allocation size + +From: Alexey V. Vissarionov + +[ Upstream commit 3ee0fe7fa39b14d1cea455b7041f2df933bd97d2 ] + +Although the "dma_chan" pointer occupies more or equal space compared +to "*dma_chan", the allocation size should use the size of variable +itself. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 01ef7dbffb41 ("ALSA: hda - Update CA0132 codec to load DSP firmware binary") +Signed-off-by: Alexey V. Vissarionov +Link: https://lore.kernel.org/r/20230117111522.GA15213@altlinux.org +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/patch_ca0132.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/pci/hda/patch_ca0132.c b/sound/pci/hda/patch_ca0132.c +index 801dd8d44953b..c0cb6e49a9b65 100644 +--- a/sound/pci/hda/patch_ca0132.c ++++ b/sound/pci/hda/patch_ca0132.c +@@ -2455,7 +2455,7 @@ static int dspio_set_uint_param(struct hda_codec *codec, int mod_id, + static int dspio_alloc_dma_chan(struct hda_codec *codec, unsigned int *dma_chan) + { + int status = 0; +- unsigned int size = sizeof(dma_chan); ++ unsigned int size = sizeof(*dma_chan); + + codec_dbg(codec, " dspio_alloc_dma_chan() -- begin\n"); + status = dspio_scp(codec, MASTERCONTROL, 0x20, +-- +2.39.2 + diff --git a/queue-5.15/applicom-fix-pci-device-refcount-leak-in-applicom_in.patch b/queue-5.15/applicom-fix-pci-device-refcount-leak-in-applicom_in.patch new file mode 100644 index 00000000000..797c1078e15 --- /dev/null +++ b/queue-5.15/applicom-fix-pci-device-refcount-leak-in-applicom_in.patch @@ -0,0 +1,53 @@ +From 22ea544a137ec91d596fc951768d643c669ad6d9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Nov 2022 19:40:35 +0800 +Subject: applicom: Fix PCI device refcount leak in applicom_init() + +From: Xiongfeng Wang + +[ Upstream commit ce4273d89c52167d6fe20572136c58117eae0657 ] + +As comment of pci_get_class() says, it returns a pci_device with its +refcount increased and decreased the refcount for the input parameter +@from if it is not NULL. + +If we break the loop in applicom_init() with 'dev' not NULL, we need to +call pci_dev_put() to decrease the refcount. Add the missing +pci_dev_put() to avoid refcount leak. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Xiongfeng Wang +Link: https://lore.kernel.org/r/20221122114035.24194-1-wangxiongfeng2@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/char/applicom.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/char/applicom.c b/drivers/char/applicom.c +index deb85a334c937..260573c283209 100644 +--- a/drivers/char/applicom.c ++++ b/drivers/char/applicom.c +@@ -197,8 +197,10 @@ static int __init applicom_init(void) + if (!pci_match_id(applicom_pci_tbl, dev)) + continue; + +- if (pci_enable_device(dev)) ++ if (pci_enable_device(dev)) { ++ pci_dev_put(dev); + return -EIO; ++ } + + RamIO = ioremap(pci_resource_start(dev, 0), LEN_RAM_IO); + +@@ -207,6 +209,7 @@ static int __init applicom_init(void) + "space at 0x%llx\n", + (unsigned long long)pci_resource_start(dev, 0)); + pci_disable_device(dev); ++ pci_dev_put(dev); + return -EIO; + } + +-- +2.39.2 + diff --git a/queue-5.15/arm-bcm2835_defconfig-enable-the-framebuffer.patch b/queue-5.15/arm-bcm2835_defconfig-enable-the-framebuffer.patch new file mode 100644 index 00000000000..4b52e060a8d --- /dev/null +++ b/queue-5.15/arm-bcm2835_defconfig-enable-the-framebuffer.patch @@ -0,0 +1,39 @@ +From edd16da2f18d03d177861bb5fc91f03ff96827b0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Jan 2023 21:58:41 +0100 +Subject: ARM: bcm2835_defconfig: Enable the framebuffer + +From: Stefan Wahren + +[ Upstream commit afc8dd99840b7fb7190e769a893cda673bc3a907 ] + +Booting Linux on a Raspberry Pi based on bcm2835_defconfig there is +no display activity. + +Enable CONFIG_FB which is nowadays required for CONFIG_FB_SIMPLE +and CONFIG_FRAMEBUFFER_CONSOLE. + +Fixes: f611b1e7624c ("drm: Avoid circular dependencies for CONFIG_FB") +Signed-off-by: Stefan Wahren +Link: https://lore.kernel.org/r/20230113205842.17051-1-stefan.wahren@i2se.com +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +--- + arch/arm/configs/bcm2835_defconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm/configs/bcm2835_defconfig b/arch/arm/configs/bcm2835_defconfig +index 383c632eba7bd..1e244a9287902 100644 +--- a/arch/arm/configs/bcm2835_defconfig ++++ b/arch/arm/configs/bcm2835_defconfig +@@ -108,6 +108,7 @@ CONFIG_MEDIA_SUPPORT=y + CONFIG_MEDIA_CAMERA_SUPPORT=y + CONFIG_DRM=y + CONFIG_DRM_VC4=y ++CONFIG_FB=y + CONFIG_FB_SIMPLE=y + CONFIG_FRAMEBUFFER_CONSOLE=y + CONFIG_SOUND=y +-- +2.39.2 + diff --git a/queue-5.15/arm-dts-exynos-correct-wr-active-property-in-exynos3.patch b/queue-5.15/arm-dts-exynos-correct-wr-active-property-in-exynos3.patch new file mode 100644 index 00000000000..41bf292309f --- /dev/null +++ b/queue-5.15/arm-dts-exynos-correct-wr-active-property-in-exynos3.patch @@ -0,0 +1,37 @@ +From c227f09fdac71ba5950e0ad28b483ce45c66dc1a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Jan 2023 16:53:54 +0100 +Subject: ARM: dts: exynos: correct wr-active property in Exynos3250 Rinato + +From: Krzysztof Kozlowski + +[ Upstream commit d15d2a617499882971ddb773a583015bf36fa492 ] + +The property is wr-active: + + exynos3250-rinato.dtb: fimd@11c00000: i80-if-timings: 'wr-act' does not match any of the regexes: 'pinctrl-[0-9]+' + +Fixes: b59b3afb94d4 ("ARM: dts: add fimd device support for exynos3250-rinato") +Link: https://lore.kernel.org/r/20230120155404.323386-2-krzysztof.kozlowski@linaro.org +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/exynos3250-rinato.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/exynos3250-rinato.dts b/arch/arm/boot/dts/exynos3250-rinato.dts +index f6ba5e4260404..7562497c45dd8 100644 +--- a/arch/arm/boot/dts/exynos3250-rinato.dts ++++ b/arch/arm/boot/dts/exynos3250-rinato.dts +@@ -249,7 +249,7 @@ &fimd { + i80-if-timings { + cs-setup = <0>; + wr-setup = <0>; +- wr-act = <1>; ++ wr-active = <1>; + wr-hold = <0>; + }; + }; +-- +2.39.2 + diff --git a/queue-5.15/arm-dts-exynos-use-exynos5420-compatible-for-the-mip.patch b/queue-5.15/arm-dts-exynos-use-exynos5420-compatible-for-the-mip.patch new file mode 100644 index 00000000000..13a8e49d634 --- /dev/null +++ b/queue-5.15/arm-dts-exynos-use-exynos5420-compatible-for-the-mip.patch @@ -0,0 +1,37 @@ +From bee5017ea7066c1aba236e73fbde3b5eb6359b4d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 21 Jan 2023 22:18:42 +0200 +Subject: ARM: dts: exynos: Use Exynos5420 compatible for the MIPI video phy + +From: Markuss Broks + +[ Upstream commit 5d5aa219a790d61cad2c38e1aa32058f16ad2f0b ] + +For some reason, the driver adding support for Exynos5420 MIPI phy +back in 2016 wasn't used on Exynos5420, which caused a kernel panic. +Add the proper compatible for it. + +Signed-off-by: Markuss Broks +Link: https://lore.kernel.org/r/20230121201844.46872-2-markuss.broks@gmail.com +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/exynos5420.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/exynos5420.dtsi b/arch/arm/boot/dts/exynos5420.dtsi +index e23e8ffb093fa..4fb4804830afe 100644 +--- a/arch/arm/boot/dts/exynos5420.dtsi ++++ b/arch/arm/boot/dts/exynos5420.dtsi +@@ -602,7 +602,7 @@ dp_phy: dp-video-phy { + }; + + mipi_phy: mipi-video-phy { +- compatible = "samsung,s5pv210-mipi-video-phy"; ++ compatible = "samsung,exynos5420-mipi-video-phy"; + syscon = <&pmu_system_controller>; + #phy-cells = <1>; + }; +-- +2.39.2 + diff --git a/queue-5.15/arm-dts-imx7s-correct-iomuxc-gpr-mux-controller-cell.patch b/queue-5.15/arm-dts-imx7s-correct-iomuxc-gpr-mux-controller-cell.patch new file mode 100644 index 00000000000..8d5f3f66422 --- /dev/null +++ b/queue-5.15/arm-dts-imx7s-correct-iomuxc-gpr-mux-controller-cell.patch @@ -0,0 +1,36 @@ +From 34647c94292853f2b22d3c45c7539ebc5cc10017 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Dec 2022 11:04:33 +0800 +Subject: ARM: dts: imx7s: correct iomuxc gpr mux controller cells + +From: Peng Fan + +[ Upstream commit 0e3e1946606a2919b1dda9967ab2e1c5af2fedd6 ] + +Per binding doc reg-mux.yaml, the #mux-control-cells should be 1 + +Signed-off-by: Peng Fan +Reviewed-by: Marco Felsch +Fixes: 94a905a79f2c ("ARM: dts: imx7s: add multiplexer controls") +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/imx7s.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/imx7s.dtsi b/arch/arm/boot/dts/imx7s.dtsi +index 95f22513a7c02..f4d2009d998b7 100644 +--- a/arch/arm/boot/dts/imx7s.dtsi ++++ b/arch/arm/boot/dts/imx7s.dtsi +@@ -497,7 +497,7 @@ gpr: iomuxc-gpr@30340000 { + + mux: mux-controller { + compatible = "mmio-mux"; +- #mux-control-cells = <0>; ++ #mux-control-cells = <1>; + mux-reg-masks = <0x14 0x00000010>; + }; + +-- +2.39.2 + diff --git a/queue-5.15/arm-dts-sun8i-nanopi-duo2-fix-regulator-gpio-referen.patch b/queue-5.15/arm-dts-sun8i-nanopi-duo2-fix-regulator-gpio-referen.patch new file mode 100644 index 00000000000..a9c723ad1bb --- /dev/null +++ b/queue-5.15/arm-dts-sun8i-nanopi-duo2-fix-regulator-gpio-referen.patch @@ -0,0 +1,40 @@ +From c8e20e7bd808037f550eb78d804d4d7f079f9998 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 31 Dec 2022 16:58:54 -0600 +Subject: ARM: dts: sun8i: nanopi-duo2: Fix regulator GPIO reference + +From: Samuel Holland + +[ Upstream commit 2177d4ae971f79b4a9a3c411f2fb8ae6113d1430 ] + +The property named in the schema is 'enable-gpios', not 'enable-gpio'. +This makes no difference at runtime, because the regulator is marked as +always-on, but it breaks validation. + +Fixes: 4701fc6e5dd9 ("ARM: dts: sun8i: add FriendlyARM NanoPi Duo2") +Reviewed-by: Andre Przywara +Acked-by: Jernej Skrabec +Signed-off-by: Samuel Holland +Link: https://lore.kernel.org/r/20221231225854.16320-2-samuel@sholland.org +Signed-off-by: Jernej Skrabec +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/sun8i-h3-nanopi-duo2.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/sun8i-h3-nanopi-duo2.dts b/arch/arm/boot/dts/sun8i-h3-nanopi-duo2.dts +index 8e7dfcffe1fbe..355f7844fd55e 100644 +--- a/arch/arm/boot/dts/sun8i-h3-nanopi-duo2.dts ++++ b/arch/arm/boot/dts/sun8i-h3-nanopi-duo2.dts +@@ -57,7 +57,7 @@ reg_vdd_cpux: vdd-cpux-regulator { + regulator-ramp-delay = <50>; /* 4ms */ + + enable-active-high; +- enable-gpio = <&r_pio 0 8 GPIO_ACTIVE_HIGH>; /* PL8 */ ++ enable-gpios = <&r_pio 0 8 GPIO_ACTIVE_HIGH>; /* PL8 */ + gpios = <&r_pio 0 6 GPIO_ACTIVE_HIGH>; /* PL6 */ + gpios-states = <0x1>; + states = <1100000 0>, <1300000 1>; +-- +2.39.2 + diff --git a/queue-5.15/arm-imx-call-ida_simple_remove-for-ida_simple_get.patch b/queue-5.15/arm-imx-call-ida_simple_remove-for-ida_simple_get.patch new file mode 100644 index 00000000000..2e499474896 --- /dev/null +++ b/queue-5.15/arm-imx-call-ida_simple_remove-for-ida_simple_get.patch @@ -0,0 +1,102 @@ +From 971426e5b4ba2f327eda50ee3fc7ca5e14b40dfb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Jan 2023 14:11:23 +0800 +Subject: ARM: imx: Call ida_simple_remove() for ida_simple_get + +From: Angus Chen + +[ Upstream commit ebeb49f43c8952f12aa20f03f00d7009edc2d1c5 ] + +The function call ida_simple_get maybe fail,we should deal with it. +And if ida_simple_get success ,it need to call ida_simple_remove also. +BTW,devm_kasprintf can handle id is zero for consistency. + +Fixes: e76bdfd7403a ("ARM: imx: Added perf functionality to mmdc driver") +Signed-off-by: Angus Chen +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/mach-imx/mmdc.c | 24 ++++++++++++------------ + 1 file changed, 12 insertions(+), 12 deletions(-) + +diff --git a/arch/arm/mach-imx/mmdc.c b/arch/arm/mach-imx/mmdc.c +index af12668d0bf51..b9efe9da06e0b 100644 +--- a/arch/arm/mach-imx/mmdc.c ++++ b/arch/arm/mach-imx/mmdc.c +@@ -99,6 +99,7 @@ struct mmdc_pmu { + cpumask_t cpu; + struct hrtimer hrtimer; + unsigned int active_events; ++ int id; + struct device *dev; + struct perf_event *mmdc_events[MMDC_NUM_COUNTERS]; + struct hlist_node node; +@@ -433,8 +434,6 @@ static enum hrtimer_restart mmdc_pmu_timer_handler(struct hrtimer *hrtimer) + static int mmdc_pmu_init(struct mmdc_pmu *pmu_mmdc, + void __iomem *mmdc_base, struct device *dev) + { +- int mmdc_num; +- + *pmu_mmdc = (struct mmdc_pmu) { + .pmu = (struct pmu) { + .task_ctx_nr = perf_invalid_context, +@@ -452,15 +451,16 @@ static int mmdc_pmu_init(struct mmdc_pmu *pmu_mmdc, + .active_events = 0, + }; + +- mmdc_num = ida_simple_get(&mmdc_ida, 0, 0, GFP_KERNEL); ++ pmu_mmdc->id = ida_simple_get(&mmdc_ida, 0, 0, GFP_KERNEL); + +- return mmdc_num; ++ return pmu_mmdc->id; + } + + static int imx_mmdc_remove(struct platform_device *pdev) + { + struct mmdc_pmu *pmu_mmdc = platform_get_drvdata(pdev); + ++ ida_simple_remove(&mmdc_ida, pmu_mmdc->id); + cpuhp_state_remove_instance_nocalls(cpuhp_mmdc_state, &pmu_mmdc->node); + perf_pmu_unregister(&pmu_mmdc->pmu); + iounmap(pmu_mmdc->mmdc_base); +@@ -474,7 +474,6 @@ static int imx_mmdc_perf_init(struct platform_device *pdev, void __iomem *mmdc_b + { + struct mmdc_pmu *pmu_mmdc; + char *name; +- int mmdc_num; + int ret; + const struct of_device_id *of_id = + of_match_device(imx_mmdc_dt_ids, &pdev->dev); +@@ -497,14 +496,14 @@ static int imx_mmdc_perf_init(struct platform_device *pdev, void __iomem *mmdc_b + cpuhp_mmdc_state = ret; + } + +- mmdc_num = mmdc_pmu_init(pmu_mmdc, mmdc_base, &pdev->dev); +- pmu_mmdc->mmdc_ipg_clk = mmdc_ipg_clk; +- if (mmdc_num == 0) +- name = "mmdc"; +- else +- name = devm_kasprintf(&pdev->dev, +- GFP_KERNEL, "mmdc%d", mmdc_num); ++ ret = mmdc_pmu_init(pmu_mmdc, mmdc_base, &pdev->dev); ++ if (ret < 0) ++ goto pmu_free; + ++ name = devm_kasprintf(&pdev->dev, ++ GFP_KERNEL, "mmdc%d", ret); ++ ++ pmu_mmdc->mmdc_ipg_clk = mmdc_ipg_clk; + pmu_mmdc->devtype_data = (struct fsl_mmdc_devtype_data *)of_id->data; + + hrtimer_init(&pmu_mmdc->hrtimer, CLOCK_MONOTONIC, +@@ -525,6 +524,7 @@ static int imx_mmdc_perf_init(struct platform_device *pdev, void __iomem *mmdc_b + + pmu_register_err: + pr_warn("MMDC Perf PMU failed (%d), disabled\n", ret); ++ ida_simple_remove(&mmdc_ida, pmu_mmdc->id); + cpuhp_state_remove_instance_nocalls(cpuhp_mmdc_state, &pmu_mmdc->node); + hrtimer_cancel(&pmu_mmdc->hrtimer); + pmu_free: +-- +2.39.2 + diff --git a/queue-5.15/arm-omap1-call-platform_device_put-in-error-case-in-.patch b/queue-5.15/arm-omap1-call-platform_device_put-in-error-case-in-.patch new file mode 100644 index 00000000000..0d8d8a07e9a --- /dev/null +++ b/queue-5.15/arm-omap1-call-platform_device_put-in-error-case-in-.patch @@ -0,0 +1,39 @@ +From aef73d6bb1b7b26b7b9cb95b394abae53fb54e05 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Jan 2023 11:57:54 +0200 +Subject: ARM: OMAP1: call platform_device_put() in error case in + omap1_dm_timer_init() + +From: Yang Yingliang + +[ Upstream commit 0414a100d6ab32721efa70ab55524540fdfe0ede ] + +If platform_device_add() is not called or failed, it should call +platform_device_put() in error case. + +Fixes: 97933d6ced60 ("ARM: OMAP1: dmtimer: conversion to platform devices") +Reported-by: Hulk Robot +Signed-off-by: Yang Yingliang +Message-Id: <20220701094602.2365099-1-yangyingliang@huawei.com> +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/mach-omap1/timer.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/mach-omap1/timer.c b/arch/arm/mach-omap1/timer.c +index 0411d5508d637..7046d7fa7a0aa 100644 +--- a/arch/arm/mach-omap1/timer.c ++++ b/arch/arm/mach-omap1/timer.c +@@ -165,7 +165,7 @@ static int __init omap1_dm_timer_init(void) + kfree(pdata); + + err_free_pdev: +- platform_device_unregister(pdev); ++ platform_device_put(pdev); + + return ret; + } +-- +2.39.2 + diff --git a/queue-5.15/arm-omap2-fix-memory-leak-in-realtime_counter_init.patch b/queue-5.15/arm-omap2-fix-memory-leak-in-realtime_counter_init.patch new file mode 100644 index 00000000000..10a948ddd3e --- /dev/null +++ b/queue-5.15/arm-omap2-fix-memory-leak-in-realtime_counter_init.patch @@ -0,0 +1,36 @@ +From 5084a827dbe8f6a4efe374faeec85f4fae74bcaa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Nov 2022 22:19:17 +0800 +Subject: ARM: OMAP2+: Fix memory leak in realtime_counter_init() + +From: Chen Hui + +[ Upstream commit ed8167cbf65c2b6ff6faeb0f96ded4d6d581e1ac ] + +The "sys_clk" resource is malloced by clk_get(), +it is not released when the function return. + +Fixes: fa6d79d27614 ("ARM: OMAP: Add initialisation for the real-time counter.") +Signed-off-by: Chen Hui +Message-Id: <20221108141917.46796-1-judy.chenhui@huawei.com> +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/mach-omap2/timer.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm/mach-omap2/timer.c b/arch/arm/mach-omap2/timer.c +index 620ba69c8f114..5677c4a08f376 100644 +--- a/arch/arm/mach-omap2/timer.c ++++ b/arch/arm/mach-omap2/timer.c +@@ -76,6 +76,7 @@ static void __init realtime_counter_init(void) + } + + rate = clk_get_rate(sys_clk); ++ clk_put(sys_clk); + + if (soc_is_dra7xx()) { + /* +-- +2.39.2 + diff --git a/queue-5.15/arm-s3c-fix-s3c64xx_set_timer_source-prototype.patch b/queue-5.15/arm-s3c-fix-s3c64xx_set_timer_source-prototype.patch new file mode 100644 index 00000000000..d23e6a1be72 --- /dev/null +++ b/queue-5.15/arm-s3c-fix-s3c64xx_set_timer_source-prototype.patch @@ -0,0 +1,46 @@ +From 2ca93a7ccc52b81c54b220ed731c0ef2c1c09f63 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Jan 2023 10:02:12 +0100 +Subject: ARM: s3c: fix s3c64xx_set_timer_source prototype + +From: Arnd Bergmann + +[ Upstream commit 5bf52f5e4d12b8109f348cab60cb7d51092c4270 ] + +The prototype does not match the definition, as gcc-13 points +out: + +arch/arm/mach-s3c/s3c64xx.c:169:13: error: conflicting types for 's3c64xx_set_timer_source' due to enum/integer mismatch; have 'void(unsigned int, unsigned int)' [-Werror=enum-int-mismatch] + 169 | void __init s3c64xx_set_timer_source(unsigned int event, unsigned int source) + | ^~~~~~~~~~~~~~~~~~~~~~~~ +In file included from arch/arm/mach-s3c/s3c64xx.c:50: +arch/arm/mach-s3c/s3c64xx.h:62:20: note: previous declaration of 's3c64xx_set_timer_source' with type 'void(enum s3c64xx_timer_mode, enum s3c64xx_timer_mode)' + 62 | extern void __init s3c64xx_set_timer_source(enum s3c64xx_timer_mode event, + | ^~~~~~~~~~~~~~~~~~~~~~~~ + +Fixes: 4280506ac9bb ("ARM: SAMSUNG: Move all platforms to new clocksource driver") +Signed-off-by: Arnd Bergmann +Link: https://lore.kernel.org/r/20230118090224.2162863-1-arnd@kernel.org +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Sasha Levin +--- + arch/arm/mach-s3c/s3c64xx.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/arch/arm/mach-s3c/s3c64xx.c b/arch/arm/mach-s3c/s3c64xx.c +index 4dfb648142f2a..17f0065031490 100644 +--- a/arch/arm/mach-s3c/s3c64xx.c ++++ b/arch/arm/mach-s3c/s3c64xx.c +@@ -173,7 +173,8 @@ static struct samsung_pwm_variant s3c64xx_pwm_variant = { + .tclk_mask = (1 << 7) | (1 << 6) | (1 << 5), + }; + +-void __init s3c64xx_set_timer_source(unsigned int event, unsigned int source) ++void __init s3c64xx_set_timer_source(enum s3c64xx_timer_mode event, ++ enum s3c64xx_timer_mode source) + { + s3c64xx_pwm_variant.output_mask = BIT(SAMSUNG_PWM_NUM) - 1; + s3c64xx_pwm_variant.output_mask &= ~(BIT(event) | BIT(source)); +-- +2.39.2 + diff --git a/queue-5.15/arm-zynq-fix-refcount-leak-in-zynq_early_slcr_init.patch b/queue-5.15/arm-zynq-fix-refcount-leak-in-zynq_early_slcr_init.patch new file mode 100644 index 00000000000..e4f83ee591f --- /dev/null +++ b/queue-5.15/arm-zynq-fix-refcount-leak-in-zynq_early_slcr_init.patch @@ -0,0 +1,37 @@ +From 771a76d8cb1d70597a26768f034c73d26595c333 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Nov 2022 22:05:44 +0800 +Subject: ARM: zynq: Fix refcount leak in zynq_early_slcr_init + +From: Qiheng Lin + +[ Upstream commit 9eedb910a3be0005b88c696a8552c0d4c9937cd4 ] + +of_find_compatible_node() returns a node pointer with refcount incremented, +we should use of_node_put() on error path. +Add missing of_node_put() to avoid refcount leak. + +Fixes: 3329659df030 ("ARM: zynq: Simplify SLCR initialization") +Signed-off-by: Qiheng Lin +Link: https://lore.kernel.org/r/20221129140544.41293-1-linqiheng@huawei.com +Signed-off-by: Michal Simek +Signed-off-by: Sasha Levin +--- + arch/arm/mach-zynq/slcr.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm/mach-zynq/slcr.c b/arch/arm/mach-zynq/slcr.c +index 37707614885a5..9765b3f4c2fc5 100644 +--- a/arch/arm/mach-zynq/slcr.c ++++ b/arch/arm/mach-zynq/slcr.c +@@ -213,6 +213,7 @@ int __init zynq_early_slcr_init(void) + zynq_slcr_regmap = syscon_regmap_lookup_by_compatible("xlnx,zynq-slcr"); + if (IS_ERR(zynq_slcr_regmap)) { + pr_err("%s: failed to find zynq-slcr\n", __func__); ++ of_node_put(np); + return -ENODEV; + } + +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-amlogic-meson-axg-fix-scpi-clock-dvfs-node.patch b/queue-5.15/arm64-dts-amlogic-meson-axg-fix-scpi-clock-dvfs-node.patch new file mode 100644 index 00000000000..20e9736dd88 --- /dev/null +++ b/queue-5.15/arm64-dts-amlogic-meson-axg-fix-scpi-clock-dvfs-node.patch @@ -0,0 +1,35 @@ +From e3dae282a29816619a33e4b3062b5fd7b06a6aa7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Jan 2023 11:34:23 +0100 +Subject: arm64: dts: amlogic: meson-axg: fix SCPI clock dvfs node name + +From: Neil Armstrong + +[ Upstream commit 5b7069d72f03c92a0ab919725017394ebce03a81 ] + +Fixes: +scpi: clocks: 'clock-controller' does not match any of the regexes: '^clocks-[0-9a-f]+$', 'pinctrl-[0-9]+' + +Link: https://lore.kernel.org/r/20230124-b4-amlogic-bindings-fixups-v1-2-44351528957e@linaro.org +Signed-off-by: Neil Armstrong +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/amlogic/meson-axg.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/amlogic/meson-axg.dtsi b/arch/arm64/boot/dts/amlogic/meson-axg.dtsi +index e2ab338adb3c1..03e2c5d0bb9c1 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-axg.dtsi ++++ b/arch/arm64/boot/dts/amlogic/meson-axg.dtsi +@@ -152,7 +152,7 @@ scpi { + scpi_clocks: clocks { + compatible = "arm,scpi-clocks"; + +- scpi_dvfs: clock-controller { ++ scpi_dvfs: clocks-0 { + compatible = "arm,scpi-dvfs-clocks"; + #clock-cells = <1>; + clock-indices = <0>; +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-amlogic-meson-gx-add-missing-scpi-sensors-.patch b/queue-5.15/arm64-dts-amlogic-meson-gx-add-missing-scpi-sensors-.patch new file mode 100644 index 00000000000..126666098dd --- /dev/null +++ b/queue-5.15/arm64-dts-amlogic-meson-gx-add-missing-scpi-sensors-.patch @@ -0,0 +1,37 @@ +From a30391b3acfe2f635cf9eae2fd61df1cd443e544 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Jan 2023 11:34:24 +0100 +Subject: arm64: dts: amlogic: meson-gx: add missing SCPI sensors compatible + +From: Neil Armstrong + +[ Upstream commit 2ff650051493d5bdb6dd09d4c2850bb37db6be31 ] + +Fixes: +scpi: sensors:compatible: 'oneOf' conditional failed, one must be fixed: + ['amlogic,meson-gxbb-scpi-sensors'] is too short + 'arm,scpi-sensors' was expected + +Link: https://lore.kernel.org/r/20230124-b4-amlogic-bindings-fixups-v1-3-44351528957e@linaro.org +Signed-off-by: Neil Armstrong +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/amlogic/meson-axg.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/amlogic/meson-axg.dtsi b/arch/arm64/boot/dts/amlogic/meson-axg.dtsi +index 03e2c5d0bb9c1..db5a1f4653135 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-axg.dtsi ++++ b/arch/arm64/boot/dts/amlogic/meson-axg.dtsi +@@ -161,7 +161,7 @@ scpi_dvfs: clocks-0 { + }; + + scpi_sensors: sensors { +- compatible = "amlogic,meson-gxbb-scpi-sensors"; ++ compatible = "amlogic,meson-gxbb-scpi-sensors", "arm,scpi-sensors"; + #thermal-sensor-cells = <1>; + }; + }; +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-amlogic-meson-gx-add-missing-unit-address-.patch b/queue-5.15/arm64-dts-amlogic-meson-gx-add-missing-unit-address-.patch new file mode 100644 index 00000000000..7d3af468833 --- /dev/null +++ b/queue-5.15/arm64-dts-amlogic-meson-gx-add-missing-unit-address-.patch @@ -0,0 +1,36 @@ +From df5a09525a0667993d8820a8052d429d8bc0194a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Jan 2023 11:34:27 +0100 +Subject: arm64: dts: amlogic: meson-gx: add missing unit address to rng node + name + +From: Neil Armstrong + +[ Upstream commit 61ff70708b98a85516eccb3755084ac97b42cf48 ] + +Fixes: +bus@c8834000: rng: {...} should not be valid under {'type': 'object'} + +Link: https://lore.kernel.org/r/20230124-b4-amlogic-bindings-fixups-v1-6-44351528957e@linaro.org +Signed-off-by: Neil Armstrong +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/amlogic/meson-gx.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/amlogic/meson-gx.dtsi b/arch/arm64/boot/dts/amlogic/meson-gx.dtsi +index 31bbfe4868d8e..32cc9fab4490f 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-gx.dtsi ++++ b/arch/arm64/boot/dts/amlogic/meson-gx.dtsi +@@ -531,7 +531,7 @@ periphs: bus@c8834000 { + #size-cells = <2>; + ranges = <0x0 0x0 0x0 0xc8834000 0x0 0x2000>; + +- hwrng: rng { ++ hwrng: rng@0 { + compatible = "amlogic,meson-rng"; + reg = <0x0 0x0 0x0 0x4>; + }; +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-amlogic-meson-gx-fix-scpi-clock-dvfs-node-.patch b/queue-5.15/arm64-dts-amlogic-meson-gx-fix-scpi-clock-dvfs-node-.patch new file mode 100644 index 00000000000..e69f7208cfd --- /dev/null +++ b/queue-5.15/arm64-dts-amlogic-meson-gx-fix-scpi-clock-dvfs-node-.patch @@ -0,0 +1,35 @@ +From 7915684198e0465831130d0383cda0323f372b80 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Jan 2023 11:34:22 +0100 +Subject: arm64: dts: amlogic: meson-gx: fix SCPI clock dvfs node name + +From: Neil Armstrong + +[ Upstream commit 127f79212b07c5d9a6657a87e3eafdd889335814 ] + +Fixes: +scpi: clocks: 'clock-controller' does not match any of the regexes: '^clocks-[0-9a-f]+$', 'pinctrl-[0-9]+' + +Link: https://lore.kernel.org/r/20230124-b4-amlogic-bindings-fixups-v1-1-44351528957e@linaro.org +Signed-off-by: Neil Armstrong +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/amlogic/meson-gx.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/amlogic/meson-gx.dtsi b/arch/arm64/boot/dts/amlogic/meson-gx.dtsi +index 304f6b467de8b..31bbfe4868d8e 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-gx.dtsi ++++ b/arch/arm64/boot/dts/amlogic/meson-gx.dtsi +@@ -249,7 +249,7 @@ scpi { + scpi_clocks: clocks { + compatible = "arm,scpi-clocks"; + +- scpi_dvfs: clock-controller { ++ scpi_dvfs: clocks-0 { + compatible = "arm,scpi-dvfs-clocks"; + #clock-cells = <1>; + clock-indices = <0>; +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-amlogic-meson-gx-libretech-pc-fix-update-b.patch b/queue-5.15/arm64-dts-amlogic-meson-gx-libretech-pc-fix-update-b.patch new file mode 100644 index 00000000000..2ba2066b123 --- /dev/null +++ b/queue-5.15/arm64-dts-amlogic-meson-gx-libretech-pc-fix-update-b.patch @@ -0,0 +1,35 @@ +From 54cc0e740c62afd1b1fe3d9132e7a558e091fbc8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Jan 2023 11:34:31 +0100 +Subject: arm64: dts: amlogic: meson-gx-libretech-pc: fix update button name + +From: Neil Armstrong + +[ Upstream commit 6bb506ed36968207a8832f0143ebc127f0770eef ] + +Fixes: + adc-keys: 'update-button' does not match any of the regexes: '^button-', 'pinctrl-[0-9]+' + +Link: https://lore.kernel.org/r/20230124-b4-amlogic-bindings-fixups-v1-10-44351528957e@linaro.org +Signed-off-by: Neil Armstrong +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/amlogic/meson-gx-libretech-pc.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/amlogic/meson-gx-libretech-pc.dtsi b/arch/arm64/boot/dts/amlogic/meson-gx-libretech-pc.dtsi +index 2d7032f41e4b5..772c220c8f496 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-gx-libretech-pc.dtsi ++++ b/arch/arm64/boot/dts/amlogic/meson-gx-libretech-pc.dtsi +@@ -17,7 +17,7 @@ adc-keys { + io-channel-names = "buttons"; + keyup-threshold-microvolt = <1800000>; + +- update-button { ++ button-update { + label = "update"; + linux,code = ; + press-threshold-microvolt = <1300000>; +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-amlogic-meson-gxbb-kii-pro-fix-led-node-na.patch b/queue-5.15/arm64-dts-amlogic-meson-gxbb-kii-pro-fix-led-node-na.patch new file mode 100644 index 00000000000..efbe06eb6f9 --- /dev/null +++ b/queue-5.15/arm64-dts-amlogic-meson-gxbb-kii-pro-fix-led-node-na.patch @@ -0,0 +1,35 @@ +From f515e223702b7ae06501442eb964d075cf57b38f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Jan 2023 11:34:34 +0100 +Subject: arm64: dts: amlogic: meson-gxbb-kii-pro: fix led node name + +From: Neil Armstrong + +[ Upstream commit afdef3b188c934f79ad4b0a7bd8c692742f9b5af ] + +Fixes: +leds: status: {...} is not of type 'array' + +Link: https://lore.kernel.org/r/20230124-b4-amlogic-bindings-fixups-v1-13-44351528957e@linaro.org +Signed-off-by: Neil Armstrong +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/amlogic/meson-gxbb-kii-pro.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-kii-pro.dts b/arch/arm64/boot/dts/amlogic/meson-gxbb-kii-pro.dts +index e8394a8269ee1..802faf7e4e3cb 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-gxbb-kii-pro.dts ++++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-kii-pro.dts +@@ -16,7 +16,7 @@ / { + + leds { + compatible = "gpio-leds"; +- status { ++ led { + gpios = <&gpio_ao GPIOAO_13 GPIO_ACTIVE_LOW>; + default-state = "off"; + color = ; +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-amlogic-meson-gxl-add-missing-unit-address.patch b/queue-5.15/arm64-dts-amlogic-meson-gxl-add-missing-unit-address.patch new file mode 100644 index 00000000000..e419f10045b --- /dev/null +++ b/queue-5.15/arm64-dts-amlogic-meson-gxl-add-missing-unit-address.patch @@ -0,0 +1,36 @@ +From 7e0f6e845c9a7d673885f59bff453b8045cd0ebb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Jan 2023 11:34:30 +0100 +Subject: arm64: dts: amlogic: meson-gxl: add missing unit address to + eth-phy-mux node name + +From: Neil Armstrong + +[ Upstream commit d19189f70ba596798ea49166d2d1ef36a8df5289 ] + +Fixes: +bus@c8834000: eth-phy-mux: {...} should not be valid under {'type': 'object'} + +Link: https://lore.kernel.org/r/20230124-b4-amlogic-bindings-fixups-v1-9-44351528957e@linaro.org +Signed-off-by: Neil Armstrong +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/amlogic/meson-gxl.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi +index c3ac531c4f84a..3500229350522 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi ++++ b/arch/arm64/boot/dts/amlogic/meson-gxl.dtsi +@@ -759,7 +759,7 @@ mux { + }; + }; + +- eth-phy-mux { ++ eth-phy-mux@55c { + compatible = "mdio-mux-mmioreg", "mdio-mux"; + #address-cells = <1>; + #size-cells = <0>; +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-amlogic-meson-gxl-s905d-phicomm-n1-fix-led.patch b/queue-5.15/arm64-dts-amlogic-meson-gxl-s905d-phicomm-n1-fix-led.patch new file mode 100644 index 00000000000..dbc304c54b2 --- /dev/null +++ b/queue-5.15/arm64-dts-amlogic-meson-gxl-s905d-phicomm-n1-fix-led.patch @@ -0,0 +1,35 @@ +From 74cb30274b555816498526a6b764c60a5f518f0b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Jan 2023 11:34:33 +0100 +Subject: arm64: dts: amlogic: meson-gxl-s905d-phicomm-n1: fix led node name + +From: Neil Armstrong + +[ Upstream commit eee64d8fbbdaab72bbab3e462f3a7b742d20c8c2 ] + +Fixes: +leds: status: {...} is not of type 'array' + +Link: https://lore.kernel.org/r/20230124-b4-amlogic-bindings-fixups-v1-12-44351528957e@linaro.org +Signed-off-by: Neil Armstrong +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/amlogic/meson-gxl-s905d-phicomm-n1.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905d-phicomm-n1.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905d-phicomm-n1.dts +index 9ef210f17b4aa..393d3cb33b9ee 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905d-phicomm-n1.dts ++++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905d-phicomm-n1.dts +@@ -18,7 +18,7 @@ cvbs-connector { + leds { + compatible = "gpio-leds"; + +- status { ++ led { + label = "n1:white:status"; + gpios = <&gpio_ao GPIOAO_9 GPIO_ACTIVE_HIGH>; + default-state = "on"; +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-amlogic-meson-gxl-s905d-sml5442tw-drop-inv.patch b/queue-5.15/arm64-dts-amlogic-meson-gxl-s905d-sml5442tw-drop-inv.patch new file mode 100644 index 00000000000..9985a50414f --- /dev/null +++ b/queue-5.15/arm64-dts-amlogic-meson-gxl-s905d-sml5442tw-drop-inv.patch @@ -0,0 +1,34 @@ +From 3315be78f755d0e3a4ab993ddd6c2d48b7bf297b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Jan 2023 11:34:26 +0100 +Subject: arm64: dts: amlogic: meson-gxl-s905d-sml5442tw: drop invalid + clock-names property + +From: Neil Armstrong + +[ Upstream commit e3bd275ccbacf5eb18eaa311cea39f8bf8655feb ] + +Fixes: +bluetooth: 'clock-names' does not match any of the regexes: 'pinctrl-[0-9]+' + +Link: https://lore.kernel.org/r/20230124-b4-amlogic-bindings-fixups-v1-5-44351528957e@linaro.org +Signed-off-by: Neil Armstrong +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/amlogic/meson-gxl-s905d-sml5442tw.dts | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905d-sml5442tw.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905d-sml5442tw.dts +index b331a013572f3..c490dbbf063bf 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905d-sml5442tw.dts ++++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905d-sml5442tw.dts +@@ -79,6 +79,5 @@ bluetooth { + enable-gpios = <&gpio GPIOX_17 GPIO_ACTIVE_HIGH>; + max-speed = <2000000>; + clocks = <&wifi32k>; +- clock-names = "lpo"; + }; + }; +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-amlogic-meson-sm1-bananapi-m5-fix-adc-keys.patch b/queue-5.15/arm64-dts-amlogic-meson-sm1-bananapi-m5-fix-adc-keys.patch new file mode 100644 index 00000000000..aa4385afd0f --- /dev/null +++ b/queue-5.15/arm64-dts-amlogic-meson-sm1-bananapi-m5-fix-adc-keys.patch @@ -0,0 +1,44 @@ +From d9b183fea082bbbc5a1e992fb6802d4f38918076 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Jan 2023 11:34:32 +0100 +Subject: arm64: dts: amlogic: meson-sm1-bananapi-m5: fix adc keys node names + +From: Neil Armstrong + +[ Upstream commit d519a73332b6c3d14e15f8fd20d7c6f29ed13d41 ] + +Fixes: +adc_keys: 'key' does not match any of the regexes: '^button-', 'pinctrl-[0-9]+' + +Also fix the invalid "adc_keys" node name. + +Link: https://lore.kernel.org/r/20230124-b4-amlogic-bindings-fixups-v1-11-44351528957e@linaro.org +Signed-off-by: Neil Armstrong +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/amlogic/meson-sm1-bananapi-m5.dts | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/amlogic/meson-sm1-bananapi-m5.dts b/arch/arm64/boot/dts/amlogic/meson-sm1-bananapi-m5.dts +index cadba194b149b..6d0db667581fa 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-sm1-bananapi-m5.dts ++++ b/arch/arm64/boot/dts/amlogic/meson-sm1-bananapi-m5.dts +@@ -17,13 +17,13 @@ / { + compatible = "bananapi,bpi-m5", "amlogic,sm1"; + model = "Banana Pi BPI-M5"; + +- adc_keys { ++ adc-keys { + compatible = "adc-keys"; + io-channels = <&saradc 2>; + io-channel-names = "buttons"; + keyup-threshold-microvolt = <1800000>; + +- key { ++ button-sw3 { + label = "SW3"; + linux,code = ; + press-threshold-microvolt = <1700000>; +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-amlogic-meson-sm1-odroid-hc4-fix-active-fa.patch b/queue-5.15/arm64-dts-amlogic-meson-sm1-odroid-hc4-fix-active-fa.patch new file mode 100644 index 00000000000..e120a1db58b --- /dev/null +++ b/queue-5.15/arm64-dts-amlogic-meson-sm1-odroid-hc4-fix-active-fa.patch @@ -0,0 +1,50 @@ +From b78518fd81785e89082252b713855b876f3532a8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Jan 2023 12:39:08 +0100 +Subject: arm64: dts: amlogic: meson-sm1-odroid-hc4: fix active fan thermal + trip + +From: Neil Armstrong + +[ Upstream commit 1d2f14117aa7773efff50f832b85fc7779e586e0 ] + +Add an active trip tied to the on-board fan cooling device, which is better +than describing it along the passive cooling maps. + +Fixes: 33b14f663df8 ("arm64: dts: meson: add initial device-tree for ODROID-HC4") +Reported-by: Ricardo Pardini +Link: https://lore.kernel.org/r/20230124-topic-odroid-hc4-upstream-fix-fan-trip-v1-1-b0c6aa355d93@linaro.org +Tested-by: Ricardo Pardini +[narmstrong: added Ricardo's tested-by from off-list chat] +Signed-off-by: Neil Armstrong +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/amlogic/meson-sm1-odroid-hc4.dts | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/amlogic/meson-sm1-odroid-hc4.dts b/arch/arm64/boot/dts/amlogic/meson-sm1-odroid-hc4.dts +index f3f953225bf5b..15fece2e63205 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-sm1-odroid-hc4.dts ++++ b/arch/arm64/boot/dts/amlogic/meson-sm1-odroid-hc4.dts +@@ -76,9 +76,17 @@ sound { + }; + + &cpu_thermal { ++ trips { ++ cpu_active: cpu-active { ++ temperature = <60000>; /* millicelsius */ ++ hysteresis = <2000>; /* millicelsius */ ++ type = "active"; ++ }; ++ }; ++ + cooling-maps { + map { +- trip = <&cpu_passive>; ++ trip = <&cpu_active>; + cooling-device = <&fan0 THERMAL_NO_LIMIT THERMAL_NO_LIMIT>; + }; + }; +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-imx8m-align-soc-unique-id-node-unit-addres.patch b/queue-5.15/arm64-dts-imx8m-align-soc-unique-id-node-unit-addres.patch new file mode 100644 index 00000000000..6a4d00b9371 --- /dev/null +++ b/queue-5.15/arm64-dts-imx8m-align-soc-unique-id-node-unit-addres.patch @@ -0,0 +1,78 @@ +From f5232040ce7de1b51bfed05aeb12d79b21a15b64 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Dec 2022 17:23:50 +0100 +Subject: arm64: dts: imx8m: Align SoC unique ID node unit address + +From: Marek Vasut + +[ Upstream commit ee0d68f219be8618f53d3f8808952e20525e3f30 ] + +Align the SoC unique ID DT node unit address with its reg property. + +Reviewed-by: Peng Fan +Fixes: cbff23797fa1 ("arm64: dts: imx8m: add NVMEM provider and consumer to read soc unique ID") +Signed-off-by: Marek Vasut +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8mm.dtsi | 2 +- + arch/arm64/boot/dts/freescale/imx8mn.dtsi | 2 +- + arch/arm64/boot/dts/freescale/imx8mp.dtsi | 2 +- + arch/arm64/boot/dts/freescale/imx8mq.dtsi | 2 +- + 4 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mm.dtsi b/arch/arm64/boot/dts/freescale/imx8mm.dtsi +index 67e91fdfaf526..2a67122c5624c 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mm.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mm.dtsi +@@ -530,7 +530,7 @@ ocotp: efuse@30350000 { + #address-cells = <1>; + #size-cells = <1>; + +- imx8mm_uid: unique-id@410 { ++ imx8mm_uid: unique-id@4 { + reg = <0x4 0x8>; + }; + +diff --git a/arch/arm64/boot/dts/freescale/imx8mn.dtsi b/arch/arm64/boot/dts/freescale/imx8mn.dtsi +index 6dcead5bae620..0c47ff2426410 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mn.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mn.dtsi +@@ -533,7 +533,7 @@ ocotp: efuse@30350000 { + #address-cells = <1>; + #size-cells = <1>; + +- imx8mn_uid: unique-id@410 { ++ imx8mn_uid: unique-id@4 { + reg = <0x4 0x8>; + }; + +diff --git a/arch/arm64/boot/dts/freescale/imx8mp.dtsi b/arch/arm64/boot/dts/freescale/imx8mp.dtsi +index 664177ed38d3e..ab670b5d641b1 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mp.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mp.dtsi +@@ -358,7 +358,7 @@ ocotp: efuse@30350000 { + #address-cells = <1>; + #size-cells = <1>; + +- imx8mp_uid: unique-id@420 { ++ imx8mp_uid: unique-id@8 { + reg = <0x8 0x8>; + }; + +diff --git a/arch/arm64/boot/dts/freescale/imx8mq.dtsi b/arch/arm64/boot/dts/freescale/imx8mq.dtsi +index fd38092bb247e..2a698c5b87bcd 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mq.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mq.dtsi +@@ -557,7 +557,7 @@ ocotp: efuse@30350000 { + #address-cells = <1>; + #size-cells = <1>; + +- imx8mq_uid: soc-uid@410 { ++ imx8mq_uid: soc-uid@4 { + reg = <0x4 0x8>; + }; + +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-mediatek-mt7622-add-missing-pwm-cells-to-p.patch b/queue-5.15/arm64-dts-mediatek-mt7622-add-missing-pwm-cells-to-p.patch new file mode 100644 index 00000000000..8dcfc128711 --- /dev/null +++ b/queue-5.15/arm64-dts-mediatek-mt7622-add-missing-pwm-cells-to-p.patch @@ -0,0 +1,35 @@ +From b6e5936e16c4c5103c51a4342f73187e0b867c95 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Nov 2022 12:20:27 +0100 +Subject: arm64: dts: mediatek: mt7622: Add missing pwm-cells to pwm node + +From: AngeloGioacchino Del Regno + +[ Upstream commit 22925af785fa3470efdf566339616d801119d348 ] + +Specify #pwm-cells on pwm@11006000 to make it actually usable. + +Fixes: ae457b7679c4 ("arm64: dts: mt7622: add SoC and peripheral related device nodes") +Signed-off-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20221128112028.58021-2-angelogioacchino.delregno@collabora.com +Signed-off-by: Matthias Brugger +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt7622.dtsi | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/boot/dts/mediatek/mt7622.dtsi b/arch/arm64/boot/dts/mediatek/mt7622.dtsi +index 890a942ec6082..a4c48b2abd209 100644 +--- a/arch/arm64/boot/dts/mediatek/mt7622.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt7622.dtsi +@@ -428,6 +428,7 @@ uart3: serial@11005000 { + pwm: pwm@11006000 { + compatible = "mediatek,mt7622-pwm"; + reg = <0 0x11006000 0 0x1000>; ++ #pwm-cells = <2>; + interrupts = ; + clocks = <&topckgen CLK_TOP_PWM_SEL>, + <&pericfg CLK_PERI_PWM_PD>, +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-mediatek-mt8183-fix-systimer-13-mhz-clock-.patch b/queue-5.15/arm64-dts-mediatek-mt8183-fix-systimer-13-mhz-clock-.patch new file mode 100644 index 00000000000..31c8a0f996e --- /dev/null +++ b/queue-5.15/arm64-dts-mediatek-mt8183-fix-systimer-13-mhz-clock-.patch @@ -0,0 +1,65 @@ +From b98056095452128d92dee8c46be5495a220a6ef4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Dec 2022 16:42:26 +0800 +Subject: arm64: dts: mediatek: mt8183: Fix systimer 13 MHz clock description + +From: Chen-Yu Tsai + +[ Upstream commit ce8a06b5bac75ccce99c0cf91b96b767d64f28a7 ] + +The systimer block derives its 13 MHz clock by dividing the main 26 MHz +oscillator clock by 2 internally, not through the TOPCKGEN clock +controller. + +On the MT8183 this divider is set either by power-on-reset or by the +bootloader. The bootloader may then make the divider unconfigurable to, +but can be read out by, the operating system. + +Making the systimer block take the 26 MHz clock directly requires +changing the implementations. As an ABI compatible fix, change the +input clock of the systimer block a fixed factor divide-by-2 clock +that takes the 26 MHz oscillator as its input. + +Fixes: 5bc8e2875ffb ("arm64: dts: mt8183: add systimer0 device node") +Signed-off-by: Chen-Yu Tsai +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20221201084229.3464449-2-wenst@chromium.org +Signed-off-by: Matthias Brugger +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8183.dtsi | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8183.dtsi b/arch/arm64/boot/dts/mediatek/mt8183.dtsi +index f4e0bea8ddcb6..81fde34ffd52a 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8183.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8183.dtsi +@@ -299,6 +299,15 @@ psci { + method = "smc"; + }; + ++ clk13m: fixed-factor-clock-13m { ++ compatible = "fixed-factor-clock"; ++ #clock-cells = <0>; ++ clocks = <&clk26m>; ++ clock-div = <2>; ++ clock-mult = <1>; ++ clock-output-names = "clk13m"; ++ }; ++ + clk26m: oscillator { + compatible = "fixed-clock"; + #clock-cells = <0>; +@@ -610,8 +619,7 @@ systimer: timer@10017000 { + "mediatek,mt6765-timer"; + reg = <0 0x10017000 0 0x1000>; + interrupts = ; +- clocks = <&topckgen CLK_TOP_CLK13M>; +- clock-names = "clk13m"; ++ clocks = <&clk13m>; + }; + + iommu: iommu@10205000 { +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-meson-bananapi-m5-switch-vddio_c-pin-to-op.patch b/queue-5.15/arm64-dts-meson-bananapi-m5-switch-vddio_c-pin-to-op.patch new file mode 100644 index 00000000000..78ffedfb071 --- /dev/null +++ b/queue-5.15/arm64-dts-meson-bananapi-m5-switch-vddio_c-pin-to-op.patch @@ -0,0 +1,45 @@ +From db92b2bd290de193dd0a1aab0518cc1983fd1f5a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Jan 2023 14:22:17 +0000 +Subject: arm64: dts: meson: bananapi-m5: switch VDDIO_C pin to OPEN_DRAIN + +From: Christian Hewitt + +[ Upstream commit 856968e066bd77b113965f1a355ec7401edff65f ] + +For proper warm (re)boot from SD card the BPI-M5 board requires TFLASH_VDD_EN +and VDDIO_C pins to be switched to high impedance mode. This can be achieved +using OPEN_DRAIN instead of ACTIVE_HIGH to leave the GPIO pins in input mode +and retain high state (pin has the pull-up). + +This change is inspired by meson-sm1-odroid.dtsi where OPEN_DRAIN has been +used to resolve similar problems with the Odroid C4 board (TF_IO in the C4 +dts is the equivalent regulator). + +Fixes: 976e920183e4 ("arm64: dts: meson-sm1: add Banana PI BPI-M5 board dts") +Suggested-by: Neil Armstrong +Signed-off-by: Christian Hewitt +Reviewed-by: Neil Armstrong +Link: https://lore.kernel.org/r/20230127142221.3718184-2-christianshewitt@gmail.com +Signed-off-by: Neil Armstrong +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/amlogic/meson-sm1-bananapi-m5.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/amlogic/meson-sm1-bananapi-m5.dts b/arch/arm64/boot/dts/amlogic/meson-sm1-bananapi-m5.dts +index 6d0db667581fa..38ebe98ba9c6b 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-sm1-bananapi-m5.dts ++++ b/arch/arm64/boot/dts/amlogic/meson-sm1-bananapi-m5.dts +@@ -123,7 +123,7 @@ vddio_c: regulator-vddio_c { + regulator-min-microvolt = <1800000>; + regulator-max-microvolt = <3300000>; + +- enable-gpio = <&gpio_ao GPIOE_2 GPIO_ACTIVE_HIGH>; ++ enable-gpio = <&gpio_ao GPIOE_2 GPIO_OPEN_DRAIN>; + enable-active-high; + regulator-always-on; + +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-meson-g12a-fix-internal-ethernet-phy-unit-.patch b/queue-5.15/arm64-dts-meson-g12a-fix-internal-ethernet-phy-unit-.patch new file mode 100644 index 00000000000..8a08d3dee10 --- /dev/null +++ b/queue-5.15/arm64-dts-meson-g12a-fix-internal-ethernet-phy-unit-.patch @@ -0,0 +1,41 @@ +From 7ef52ad6fa285e9b3adb656bc687b207b67b5985 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Jan 2023 22:13:49 +0100 +Subject: arm64: dts: meson-g12a: Fix internal Ethernet PHY unit name + +From: Martin Blumenstingl + +[ Upstream commit e7303651bbc76c848007f1cfac1fbeaa65f600d1 ] + +Documentation/devicetree/bindings/net/ethernet-phy.yaml defines that the +node name for Ethernet PHYs should match the following pattern: + ^ethernet-phy(@[a-f0-9]+)?$ + +Replace the underscore with a hyphen to adhere to this binding. + +Fixes: 280c17df8fbf ("arm64: dts: meson: g12a: add mdio multiplexer") +Signed-off-by: Martin Blumenstingl +Reviewed-by: Neil Armstrong +Link: https://lore.kernel.org/r/20230111211350.1461860-6-martin.blumenstingl@googlemail.com +Signed-off-by: Neil Armstrong +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi b/arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi +index 2526d6e3a3dcb..899cfe416aef4 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi ++++ b/arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi +@@ -1733,7 +1733,7 @@ int_mdio: mdio@1 { + #address-cells = <1>; + #size-cells = <0>; + +- internal_ephy: ethernet_phy@8 { ++ internal_ephy: ethernet-phy@8 { + compatible = "ethernet-phy-id0180.3301", + "ethernet-phy-ieee802.3-c22"; + interrupts = ; +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-meson-gx-fix-ethernet-mac-address-unit-nam.patch b/queue-5.15/arm64-dts-meson-gx-fix-ethernet-mac-address-unit-nam.patch new file mode 100644 index 00000000000..50b0950630d --- /dev/null +++ b/queue-5.15/arm64-dts-meson-gx-fix-ethernet-mac-address-unit-nam.patch @@ -0,0 +1,39 @@ +From 5c3cccf228185fead58b6090a891a15aeb724077 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Jan 2023 22:13:48 +0100 +Subject: arm64: dts: meson-gx: Fix Ethernet MAC address unit name + +From: Martin Blumenstingl + +[ Upstream commit 8ed5310356bfa47cc6bb4221ae6b21258c52e3d1 ] + +Unit names should use hyphens instead of underscores to not cause +warnings. + +Fixes: bfe59f92d306 ("ARM64: dts: amlogic: gxbb: Enable NVMEM") +Suggested-by: Vyacheslav Bocharov +Signed-off-by: Martin Blumenstingl +Reviewed-by: Neil Armstrong +Link: https://lore.kernel.org/r/20230111211350.1461860-5-martin.blumenstingl@googlemail.com +Signed-off-by: Neil Armstrong +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/amlogic/meson-gx.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/amlogic/meson-gx.dtsi b/arch/arm64/boot/dts/amlogic/meson-gx.dtsi +index ee623ead972e5..f8d46588e582f 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-gx.dtsi ++++ b/arch/arm64/boot/dts/amlogic/meson-gx.dtsi +@@ -232,7 +232,7 @@ sn: sn@14 { + reg = <0x14 0x10>; + }; + +- eth_mac: eth_mac@34 { ++ eth_mac: eth-mac@34 { + reg = <0x34 0x10>; + }; + +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-meson-gx-fix-the-scpi-dvfs-node-name-and-u.patch b/queue-5.15/arm64-dts-meson-gx-fix-the-scpi-dvfs-node-name-and-u.patch new file mode 100644 index 00000000000..ba2bb0b1415 --- /dev/null +++ b/queue-5.15/arm64-dts-meson-gx-fix-the-scpi-dvfs-node-name-and-u.patch @@ -0,0 +1,40 @@ +From 0e7faaed43af30f022569a84fb9981ce6bbadaec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Jan 2023 22:13:50 +0100 +Subject: arm64: dts: meson-gx: Fix the SCPI DVFS node name and unit address + +From: Martin Blumenstingl + +[ Upstream commit f189c869ad92787ddd753558bcbae89d75825bb6 ] + +Node names should be generic and use hyphens instead of underscores to +not cause warnings. Also nodes without a reg property should not have a +unit-address. Change the scpi_dvfs node to use clock-controller as node +name without a unit address (since it does not have a reg property). + +Fixes: 70db166a2baa ("ARM64: dts: meson-gxbb: Add SCPI with cpufreq & sensors Nodes") +Signed-off-by: Martin Blumenstingl +Reviewed-by: Neil Armstrong +Link: https://lore.kernel.org/r/20230111211350.1461860-7-martin.blumenstingl@googlemail.com +Signed-off-by: Neil Armstrong +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/amlogic/meson-gx.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/amlogic/meson-gx.dtsi b/arch/arm64/boot/dts/amlogic/meson-gx.dtsi +index f8d46588e582f..304f6b467de8b 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-gx.dtsi ++++ b/arch/arm64/boot/dts/amlogic/meson-gx.dtsi +@@ -249,7 +249,7 @@ scpi { + scpi_clocks: clocks { + compatible = "arm,scpi-clocks"; + +- scpi_dvfs: scpi_clocks@0 { ++ scpi_dvfs: clock-controller { + compatible = "arm,scpi-dvfs-clocks"; + #clock-cells = <1>; + clock-indices = <0>; +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-meson-remove-cpu-opps-below-1ghz-for-g12a-.patch b/queue-5.15/arm64-dts-meson-remove-cpu-opps-below-1ghz-for-g12a-.patch new file mode 100644 index 00000000000..86ca4d80e79 --- /dev/null +++ b/queue-5.15/arm64-dts-meson-remove-cpu-opps-below-1ghz-for-g12a-.patch @@ -0,0 +1,59 @@ +From a0b33c23e271eeb9bf55957f8fa7ef481d25a71d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Jan 2023 05:30:31 +0000 +Subject: arm64: dts: meson: remove CPU opps below 1GHz for G12A boards + +From: Christian Hewitt + +[ Upstream commit 3cbd431c2b34d84605d358c8c57654193fd661fb ] + +Amlogic G12A devices experience CPU stalls and random board wedges when +the system idles and CPU cores clock down to lower opp points. Recent +vendor kernels include a change to remove 100-250MHz and other distro +sources also remove the 500/667MHz points. Unless all 100-667Mhz opps +are removed or the CPU governor forced to performance stalls are still +observed, so let's remove them to improve stability and uptime. + +Fixes: b190056fa9ee ("arm64: dts: meson-g12a: add cpus OPP table") +Signed-off-by: Christian Hewitt +Link: https://lore.kernel.org/r/20230119053031.21400-1-christianshewitt@gmail.com +Signed-off-by: Neil Armstrong +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/amlogic/meson-g12a.dtsi | 20 -------------------- + 1 file changed, 20 deletions(-) + +diff --git a/arch/arm64/boot/dts/amlogic/meson-g12a.dtsi b/arch/arm64/boot/dts/amlogic/meson-g12a.dtsi +index fb0ab27d1f642..6eaceb717d617 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-g12a.dtsi ++++ b/arch/arm64/boot/dts/amlogic/meson-g12a.dtsi +@@ -57,26 +57,6 @@ cpu_opp_table: opp-table { + compatible = "operating-points-v2"; + opp-shared; + +- opp-100000000 { +- opp-hz = /bits/ 64 <100000000>; +- opp-microvolt = <731000>; +- }; +- +- opp-250000000 { +- opp-hz = /bits/ 64 <250000000>; +- opp-microvolt = <731000>; +- }; +- +- opp-500000000 { +- opp-hz = /bits/ 64 <500000000>; +- opp-microvolt = <731000>; +- }; +- +- opp-667000000 { +- opp-hz = /bits/ 64 <666666666>; +- opp-microvolt = <731000>; +- }; +- + opp-1000000000 { + opp-hz = /bits/ 64 <1000000000>; + opp-microvolt = <731000>; +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-msm8992-bullhead-add-memory-hole-region.patch b/queue-5.15/arm64-dts-msm8992-bullhead-add-memory-hole-region.patch new file mode 100644 index 00000000000..bff72765296 --- /dev/null +++ b/queue-5.15/arm64-dts-msm8992-bullhead-add-memory-hole-region.patch @@ -0,0 +1,52 @@ +From 5329da7a2132fd3b3f9490d3ca282f3045dcedd8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 11 Dec 2022 11:05:01 +0100 +Subject: arm64: dts: msm8992-bullhead: add memory hole region + +From: Dominik Kobinski + +[ Upstream commit 22c7e1a0fa45cd7d028d6b4117161fd0e3427fe0 ] + +Add region for memory hole present on bullhead in order to +fix a reboot issue on recent kernels + +Reported-by: Petr Vorel +Signed-off-by: Dominik Kobinski +Reviewed-by: Konrad Dybcio +Tested-by: Petr Vorel +Reviewed-by: Petr Vorel +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20221211100501.82323-1-dominikkobinski314@gmail.com +Stable-dep-of: 26a91359aea4 ("arm64: dts: qcom: msm8992-bullhead: Fix cont_splash_mem size") +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/msm8992-bullhead-rev-101.dts | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/arch/arm64/boot/dts/qcom/msm8992-bullhead-rev-101.dts b/arch/arm64/boot/dts/qcom/msm8992-bullhead-rev-101.dts +index c7d191dc6d4ba..d7d06553bf9ec 100644 +--- a/arch/arm64/boot/dts/qcom/msm8992-bullhead-rev-101.dts ++++ b/arch/arm64/boot/dts/qcom/msm8992-bullhead-rev-101.dts +@@ -2,6 +2,7 @@ + /* Copyright (c) 2015, LGE Inc. All rights reserved. + * Copyright (c) 2016, The Linux Foundation. All rights reserved. + * Copyright (c) 2021, Petr Vorel ++ * Copyright (c) 2022, Dominik Kobinski + */ + + /dts-v1/; +@@ -50,6 +51,11 @@ cont_splash_mem: memory@3400000 { + reg = <0 0x03400000 0 0x1200000>; + no-map; + }; ++ ++ removed_region: reserved@5000000 { ++ reg = <0 0x05000000 0 0x2200000>; ++ no-map; ++ }; + }; + }; + +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-mt8192-fix-cpu-map-for-single-cluster-soc.patch b/queue-5.15/arm64-dts-mt8192-fix-cpu-map-for-single-cluster-soc.patch new file mode 100644 index 00000000000..a22a3ca6a34 --- /dev/null +++ b/queue-5.15/arm64-dts-mt8192-fix-cpu-map-for-single-cluster-soc.patch @@ -0,0 +1,53 @@ +From 50581aede9c29e8c1c99b31a7c684849f4bf1496 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Jan 2023 11:35:22 +0100 +Subject: arm64: dts: mt8192: Fix CPU map for single-cluster SoC + +From: AngeloGioacchino Del Regno + +[ Upstream commit 160ce54d635455ffb5e9b42c5ba9cb9aaa98cdb2 ] + +MT8192 features the ARM DynamIQ technology and combines both four +Cortex-A76 (big) and four Cortex-A55 (LITTLE) CPUs in one cluster: +fix the CPU map to reflect that. + +Signed-off-by: AngeloGioacchino Del Regno +Fixes: 48489980e27e ("arm64: dts: Add Mediatek SoC MT8192 and evaluation board dts and Makefile") +Link: https://lore.kernel.org/r/20230126103526.417039-3-angelogioacchino.delregno@collabora.com +Signed-off-by: Matthias Brugger +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8192.dtsi | 11 ++++------- + 1 file changed, 4 insertions(+), 7 deletions(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8192.dtsi b/arch/arm64/boot/dts/mediatek/mt8192.dtsi +index d1e63527b3875..9ed1a72295747 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8192.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8192.dtsi +@@ -135,19 +135,16 @@ core2 { + core3 { + cpu = <&cpu3>; + }; +- }; +- +- cluster1 { +- core0 { ++ core4 { + cpu = <&cpu4>; + }; +- core1 { ++ core5 { + cpu = <&cpu5>; + }; +- core2 { ++ core6 { + cpu = <&cpu6>; + }; +- core3 { ++ core7 { + cpu = <&cpu7>; + }; + }; +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-qcom-fix-ipq8074-pcie-phy-nodes.patch b/queue-5.15/arm64-dts-qcom-fix-ipq8074-pcie-phy-nodes.patch new file mode 100644 index 00000000000..55fd5ba925c --- /dev/null +++ b/queue-5.15/arm64-dts-qcom-fix-ipq8074-pcie-phy-nodes.patch @@ -0,0 +1,105 @@ +From 7a617c6cb8009a07e87747a7f9d34608012aec79 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Sep 2021 11:42:51 +0800 +Subject: arm64: dts: qcom: Fix IPQ8074 PCIe PHY nodes + +From: Shawn Guo + +[ Upstream commit 942bcd33ed455ad40b71a59901bd926bbf4a500e ] + +IPQ8074 PCIe PHY nodes are broken in the many ways: + +- '#address-cells', '#size-cells' and 'ranges' are missing. +- Child phy/lane node is missing, and the child properties like + '#phy-cells' and 'clocks' are mistakenly put into parent node. +- The clocks properties for parent node are missing. + +Fix them to get the nodes comply with the bindings schema. + +Signed-off-by: Shawn Guo +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20210929034253.24570-9-shawn.guo@linaro.org +Stable-dep-of: 7ba33591b45f ("arm64: dts: qcom: ipq8074: fix Gen3 PCIe QMP PHY") +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/ipq8074.dtsi | 46 +++++++++++++++++++++------ + 1 file changed, 36 insertions(+), 10 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/ipq8074.dtsi b/arch/arm64/boot/dts/qcom/ipq8074.dtsi +index 183b144a23fb5..ae32e2380dd5a 100644 +--- a/arch/arm64/boot/dts/qcom/ipq8074.dtsi ++++ b/arch/arm64/boot/dts/qcom/ipq8074.dtsi +@@ -174,34 +174,60 @@ qusb_phy_0: phy@79000 { + status = "disabled"; + }; + +- pcie_phy0: phy@86000 { ++ pcie_qmp0: phy@86000 { + compatible = "qcom,ipq8074-qmp-pcie-phy"; + reg = <0x00086000 0x1000>; +- #phy-cells = <0>; +- clocks = <&gcc GCC_PCIE0_PIPE_CLK>; +- clock-names = "pipe_clk"; +- clock-output-names = "pcie20_phy0_pipe_clk"; ++ #address-cells = <1>; ++ #size-cells = <1>; ++ ranges; + ++ clocks = <&gcc GCC_PCIE0_AUX_CLK>, ++ <&gcc GCC_PCIE0_AHB_CLK>; ++ clock-names = "aux", "cfg_ahb"; + resets = <&gcc GCC_PCIE0_PHY_BCR>, + <&gcc GCC_PCIE0PHY_PHY_BCR>; + reset-names = "phy", + "common"; + status = "disabled"; ++ ++ pcie_phy0: phy@86200 { ++ reg = <0x86200 0x16c>, ++ <0x86400 0x200>, ++ <0x86800 0x4f4>; ++ #phy-cells = <0>; ++ #clock-cells = <0>; ++ clocks = <&gcc GCC_PCIE0_PIPE_CLK>; ++ clock-names = "pipe0"; ++ clock-output-names = "pcie_0_pipe_clk"; ++ }; + }; + +- pcie_phy1: phy@8e000 { ++ pcie_qmp1: phy@8e000 { + compatible = "qcom,ipq8074-qmp-pcie-phy"; + reg = <0x0008e000 0x1000>; +- #phy-cells = <0>; +- clocks = <&gcc GCC_PCIE1_PIPE_CLK>; +- clock-names = "pipe_clk"; +- clock-output-names = "pcie20_phy1_pipe_clk"; ++ #address-cells = <1>; ++ #size-cells = <1>; ++ ranges; + ++ clocks = <&gcc GCC_PCIE1_AUX_CLK>, ++ <&gcc GCC_PCIE1_AHB_CLK>; ++ clock-names = "aux", "cfg_ahb"; + resets = <&gcc GCC_PCIE1_PHY_BCR>, + <&gcc GCC_PCIE1PHY_PHY_BCR>; + reset-names = "phy", + "common"; + status = "disabled"; ++ ++ pcie_phy1: phy@8e200 { ++ reg = <0x8e200 0x16c>, ++ <0x8e400 0x200>, ++ <0x8e800 0x4f4>; ++ #phy-cells = <0>; ++ #clock-cells = <0>; ++ clocks = <&gcc GCC_PCIE1_PIPE_CLK>; ++ clock-names = "pipe0"; ++ clock-output-names = "pcie_1_pipe_clk"; ++ }; + }; + + prng: rng@e3000 { +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-qcom-ipq8074-correct-gen2-pcie-ranges.patch b/queue-5.15/arm64-dts-qcom-ipq8074-correct-gen2-pcie-ranges.patch new file mode 100644 index 00000000000..d27b88c648e --- /dev/null +++ b/queue-5.15/arm64-dts-qcom-ipq8074-correct-gen2-pcie-ranges.patch @@ -0,0 +1,41 @@ +From d83f731afafa94ea070e74632dff0623652fa866 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Jan 2023 17:44:43 +0100 +Subject: arm64: dts: qcom: ipq8074: correct Gen2 PCIe ranges + +From: Robert Marko + +[ Upstream commit 2055cb7dccea16bafa3adf9c5e3216949512c34a ] + +Current ranges property set in Gen2 PCIe node is incorrect, replace it +with the downstream 5.4 QCA kernel value. + +Fixes: 33057e1672fe ("ARM: dts: ipq8074: Add pcie nodes") +Signed-off-by: Robert Marko +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230113164449.906002-3-robimarko@gmail.com +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/ipq8074.dtsi | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/ipq8074.dtsi b/arch/arm64/boot/dts/qcom/ipq8074.dtsi +index 6a095087bc64e..fe0a4cdfe4e56 100644 +--- a/arch/arm64/boot/dts/qcom/ipq8074.dtsi ++++ b/arch/arm64/boot/dts/qcom/ipq8074.dtsi +@@ -662,9 +662,9 @@ pcie1: pci@10000000 { + phy-names = "pciephy"; + + ranges = <0x81000000 0 0x10200000 0x10200000 +- 0 0x100000 /* downstream I/O */ +- 0x82000000 0 0x10300000 0x10300000 +- 0 0xd00000>; /* non-prefetchable memory */ ++ 0 0x10000>, /* downstream I/O */ ++ <0x82000000 0 0x10220000 0x10220000 ++ 0 0xfde0000>; /* non-prefetchable memory */ + + interrupts = ; + interrupt-names = "msi"; +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-qcom-ipq8074-correct-pcie-qmp-phy-output-c.patch b/queue-5.15/arm64-dts-qcom-ipq8074-correct-pcie-qmp-phy-output-c.patch new file mode 100644 index 00000000000..2b97bdf79a2 --- /dev/null +++ b/queue-5.15/arm64-dts-qcom-ipq8074-correct-pcie-qmp-phy-output-c.patch @@ -0,0 +1,51 @@ +From e65df72c0b7f8625c9add97d3fa2544f6440409c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Jan 2023 17:44:49 +0100 +Subject: arm64: dts: qcom: ipq8074: correct PCIe QMP PHY output clock names + +From: Robert Marko + +[ Upstream commit 0e8b90c0256cf9c9589e2cee517dedc987a34355 ] + +Current PCIe QMP PHY output name were changed in ("arm64: dts: qcom: Fix +IPQ8074 PCIe PHY nodes") however it did not account for the fact that GCC +driver is relying on the old names to match them as they are being used as +the parent for the gcc_pcie0_pipe_clk and gcc_pcie1_pipe_clk. + +This broke parenting as GCC could not find the parent clock, so fix it by +changing to the names that driver is expecting. + +Fixes: 942bcd33ed45 ("arm64: dts: qcom: Fix IPQ8074 PCIe PHY nodes") +Signed-off-by: Robert Marko +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230113164449.906002-9-robimarko@gmail.com +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/ipq8074.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/ipq8074.dtsi b/arch/arm64/boot/dts/qcom/ipq8074.dtsi +index e1c1f132209d9..a893a221e5633 100644 +--- a/arch/arm64/boot/dts/qcom/ipq8074.dtsi ++++ b/arch/arm64/boot/dts/qcom/ipq8074.dtsi +@@ -199,7 +199,7 @@ pcie_phy0: phy@84200 { + #clock-cells = <0>; + clocks = <&gcc GCC_PCIE0_PIPE_CLK>; + clock-names = "pipe0"; +- clock-output-names = "pcie_0_pipe_clk"; ++ clock-output-names = "pcie20_phy0_pipe_clk"; + }; + }; + +@@ -227,7 +227,7 @@ pcie_phy1: phy@8e200 { + #clock-cells = <0>; + clocks = <&gcc GCC_PCIE1_PIPE_CLK>; + clock-names = "pipe0"; +- clock-output-names = "pcie_1_pipe_clk"; ++ clock-output-names = "pcie20_phy1_pipe_clk"; + }; + }; + +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-qcom-ipq8074-correct-usb3-qmp-phy-s-clock-.patch b/queue-5.15/arm64-dts-qcom-ipq8074-correct-usb3-qmp-phy-s-clock-.patch new file mode 100644 index 00000000000..ccaeab02f4a --- /dev/null +++ b/queue-5.15/arm64-dts-qcom-ipq8074-correct-usb3-qmp-phy-s-clock-.patch @@ -0,0 +1,64 @@ +From c55f66c8720390a84718a6dea884230cb104fd76 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 8 Jan 2023 14:04:40 +0100 +Subject: arm64: dts: qcom: ipq8074: correct USB3 QMP PHY-s clock output names + +From: Robert Marko + +[ Upstream commit 877cff3568c0f54511d77918ae16b2d6e9a0dfce ] + +It seems that clock-output-names for the USB3 QMP PHY-s where set without +actually checking what is the GCC clock driver expecting, so clock core +could never actually find the parents for usb0_pipe_clk_src and +usb1_pipe_clk_src clocks in the GCC driver. + +So, correct the names to be what the driver expects so that parenting +works. + +Before: +gcc_usb0_pipe_clk_src 0 0 0 125000000 0 0 50000 Y +gcc_usb1_pipe_clk_src 0 0 0 125000000 0 0 50000 Y + +After: + usb3phy_0_cc_pipe_clk 1 1 0 125000000 0 0 50000 Y + usb0_pipe_clk_src 1 1 0 125000000 0 0 50000 Y + gcc_usb0_pipe_clk 1 1 0 125000000 0 0 50000 Y + usb3phy_1_cc_pipe_clk 1 1 0 125000000 0 0 50000 Y + usb1_pipe_clk_src 1 1 0 125000000 0 0 50000 Y + gcc_usb1_pipe_clk 1 1 0 125000000 0 0 50000 Y + +Fixes: 5e09bc51d07b ("arm64: dts: ipq8074: enable USB support") +Signed-off-by: Robert Marko +Reviewed-by: Dmitry Baryshkov +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230108130440.670181-2-robimarko@gmail.com +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/ipq8074.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/ipq8074.dtsi b/arch/arm64/boot/dts/qcom/ipq8074.dtsi +index 9d4019e0949a9..183b144a23fb5 100644 +--- a/arch/arm64/boot/dts/qcom/ipq8074.dtsi ++++ b/arch/arm64/boot/dts/qcom/ipq8074.dtsi +@@ -114,7 +114,7 @@ usb1_ssphy: phy@58200 { + #phy-cells = <0>; + clocks = <&gcc GCC_USB1_PIPE_CLK>; + clock-names = "pipe0"; +- clock-output-names = "gcc_usb1_pipe_clk_src"; ++ clock-output-names = "usb3phy_1_cc_pipe_clk"; + }; + }; + +@@ -157,7 +157,7 @@ usb0_ssphy: phy@78200 { + #phy-cells = <0>; + clocks = <&gcc GCC_USB0_PIPE_CLK>; + clock-names = "pipe0"; +- clock-output-names = "gcc_usb0_pipe_clk_src"; ++ clock-output-names = "usb3phy_0_cc_pipe_clk"; + }; + }; + +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-qcom-ipq8074-fix-gen3-pcie-node.patch b/queue-5.15/arm64-dts-qcom-ipq8074-fix-gen3-pcie-node.patch new file mode 100644 index 00000000000..c198f663c6c --- /dev/null +++ b/queue-5.15/arm64-dts-qcom-ipq8074-fix-gen3-pcie-node.patch @@ -0,0 +1,109 @@ +From a176d88ad1c9c17abf0f47018b2b7452a349b014 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Jan 2023 17:44:48 +0100 +Subject: arm64: dts: qcom: ipq8074: fix Gen3 PCIe node + +From: Robert Marko + +[ Upstream commit 3e83a9c41ab0244a45a4a2800b9adb8de0d15f82 ] + +IPQ8074 comes in 2 silicon versions: +* v1 with 2x Gen2 PCIe ports and QMP PHY-s +* v2 with 1x Gen3 and 1x Gen2 PCIe ports and QMP PHY-s + +v2 is the final and production version that is actually supported by the +kernel, however it looks like PCIe related nodes were added for the v1 SoC. + +Finish the PCIe fixup by using the correct compatible, adding missing ATU +register space, declaring max-link-speed, use correct ranges, add missing +clocks and resets. + +Fixes: 33057e1672fe ("ARM: dts: ipq8074: Add pcie nodes") +Signed-off-by: Robert Marko +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230113164449.906002-8-robimarko@gmail.com +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/ipq8074.dtsi | 30 +++++++++++++++------------ + 1 file changed, 17 insertions(+), 13 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/ipq8074.dtsi b/arch/arm64/boot/dts/qcom/ipq8074.dtsi +index fe0a4cdfe4e56..e1c1f132209d9 100644 +--- a/arch/arm64/boot/dts/qcom/ipq8074.dtsi ++++ b/arch/arm64/boot/dts/qcom/ipq8074.dtsi +@@ -707,16 +707,18 @@ IRQ_TYPE_LEVEL_HIGH>, /* int_c */ + }; + + pcie0: pci@20000000 { +- compatible = "qcom,pcie-ipq8074"; ++ compatible = "qcom,pcie-ipq8074-gen3"; + reg = <0x20000000 0xf1d>, + <0x20000f20 0xa8>, +- <0x00080000 0x2000>, ++ <0x20001000 0x1000>, ++ <0x00080000 0x4000>, + <0x20100000 0x1000>; +- reg-names = "dbi", "elbi", "parf", "config"; ++ reg-names = "dbi", "elbi", "atu", "parf", "config"; + device_type = "pci"; + linux,pci-domain = <0>; + bus-range = <0x00 0xff>; + num-lanes = <1>; ++ max-link-speed = <3>; + #address-cells = <3>; + #size-cells = <2>; + +@@ -724,9 +726,9 @@ pcie0: pci@20000000 { + phy-names = "pciephy"; + + ranges = <0x81000000 0 0x20200000 0x20200000 +- 0 0x100000 /* downstream I/O */ +- 0x82000000 0 0x20300000 0x20300000 +- 0 0xd00000>; /* non-prefetchable memory */ ++ 0 0x10000>, /* downstream I/O */ ++ <0x82000000 0 0x20220000 0x20220000 ++ 0 0xfde0000>; /* non-prefetchable memory */ + + interrupts = ; + interrupt-names = "msi"; +@@ -744,28 +746,30 @@ IRQ_TYPE_LEVEL_HIGH>, /* int_c */ + clocks = <&gcc GCC_SYS_NOC_PCIE0_AXI_CLK>, + <&gcc GCC_PCIE0_AXI_M_CLK>, + <&gcc GCC_PCIE0_AXI_S_CLK>, +- <&gcc GCC_PCIE0_AHB_CLK>, +- <&gcc GCC_PCIE0_AUX_CLK>; +- ++ <&gcc GCC_PCIE0_AXI_S_BRIDGE_CLK>, ++ <&gcc GCC_PCIE0_RCHNG_CLK>; + clock-names = "iface", + "axi_m", + "axi_s", +- "ahb", +- "aux"; ++ "axi_bridge", ++ "rchng"; ++ + resets = <&gcc GCC_PCIE0_PIPE_ARES>, + <&gcc GCC_PCIE0_SLEEP_ARES>, + <&gcc GCC_PCIE0_CORE_STICKY_ARES>, + <&gcc GCC_PCIE0_AXI_MASTER_ARES>, + <&gcc GCC_PCIE0_AXI_SLAVE_ARES>, + <&gcc GCC_PCIE0_AHB_ARES>, +- <&gcc GCC_PCIE0_AXI_MASTER_STICKY_ARES>; ++ <&gcc GCC_PCIE0_AXI_MASTER_STICKY_ARES>, ++ <&gcc GCC_PCIE0_AXI_SLAVE_STICKY_ARES>; + reset-names = "pipe", + "sleep", + "sticky", + "axi_m", + "axi_s", + "ahb", +- "axi_m_sticky"; ++ "axi_m_sticky", ++ "axi_s_sticky"; + status = "disabled"; + }; + }; +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-qcom-ipq8074-fix-gen3-pcie-qmp-phy.patch b/queue-5.15/arm64-dts-qcom-ipq8074-fix-gen3-pcie-qmp-phy.patch new file mode 100644 index 00000000000..83a82c7952c --- /dev/null +++ b/queue-5.15/arm64-dts-qcom-ipq8074-fix-gen3-pcie-qmp-phy.patch @@ -0,0 +1,67 @@ +From 562069538811743dd9187ad6c0ff69a3d7d088c3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Jan 2023 17:44:42 +0100 +Subject: arm64: dts: qcom: ipq8074: fix Gen3 PCIe QMP PHY + +From: Robert Marko + +[ Upstream commit 7ba33591b45f9d547a317e42f1c2acd19c925eb6 ] + +IPQ8074 comes in 2 silicon versions: +* v1 with 2x Gen2 PCIe ports and QMP PHY-s +* v2 with 1x Gen3 and 1x Gen2 PCIe ports and QMP PHY-s + +v2 is the final and production version that is actually supported by the +kernel, however it looks like PCIe related nodes were added for the v1 SoC. + +Now that we have Gen3 QMP PHY support, we can start fixing the PCIe support +by fixing the Gen3 QMP PHY node first. + +Change the compatible to the Gen3 QMP PHY, correct the register space start +and size, add the missing misc PCS register space. + +Fixes: 33057e1672fe ("ARM: dts: ipq8074: Add pcie nodes") +Signed-off-by: Robert Marko +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230113164449.906002-2-robimarko@gmail.com +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/ipq8074.dtsi | 15 ++++++++------- + 1 file changed, 8 insertions(+), 7 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/ipq8074.dtsi b/arch/arm64/boot/dts/qcom/ipq8074.dtsi +index a7ce999182e9e..6a095087bc64e 100644 +--- a/arch/arm64/boot/dts/qcom/ipq8074.dtsi ++++ b/arch/arm64/boot/dts/qcom/ipq8074.dtsi +@@ -174,9 +174,9 @@ qusb_phy_0: phy@79000 { + status = "disabled"; + }; + +- pcie_qmp0: phy@86000 { +- compatible = "qcom,ipq8074-qmp-pcie-phy"; +- reg = <0x00086000 0x1c4>; ++ pcie_qmp0: phy@84000 { ++ compatible = "qcom,ipq8074-qmp-gen3-pcie-phy"; ++ reg = <0x00084000 0x1bc>; + #address-cells = <1>; + #size-cells = <1>; + ranges; +@@ -190,10 +190,11 @@ pcie_qmp0: phy@86000 { + "common"; + status = "disabled"; + +- pcie_phy0: phy@86200 { +- reg = <0x86200 0x16c>, +- <0x86400 0x200>, +- <0x86800 0x4f4>; ++ pcie_phy0: phy@84200 { ++ reg = <0x84200 0x16c>, ++ <0x84400 0x200>, ++ <0x84800 0x1f0>, ++ <0x84c00 0xf4>; + #phy-cells = <0>; + #clock-cells = <0>; + clocks = <&gcc GCC_PCIE0_PIPE_CLK>; +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-qcom-ipq8074-fix-pcie-phy-serdes-size.patch b/queue-5.15/arm64-dts-qcom-ipq8074-fix-pcie-phy-serdes-size.patch new file mode 100644 index 00000000000..ddd28eb90bd --- /dev/null +++ b/queue-5.15/arm64-dts-qcom-ipq8074-fix-pcie-phy-serdes-size.patch @@ -0,0 +1,48 @@ +From a8613f32921c51ae2ab7cc247568287c35577a2b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Sep 2022 16:34:30 +0200 +Subject: arm64: dts: qcom: ipq8074: fix PCIe PHY serdes size + +From: Johan Hovold + +[ Upstream commit ed22cc93abae68f9d3fc4957c20a1d902cf28882 ] + +The size of the PCIe PHY serdes register region is 0x1c4 and the +corresponding 'reg' property should specifically not include the +adjacent regions that are defined in the child node (e.g. tx and rx). + +Fixes: 33057e1672fe ("ARM: dts: ipq8074: Add pcie nodes") +Signed-off-by: Johan Hovold +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20220915143431.19842-1-johan+linaro@kernel.org +Stable-dep-of: 7ba33591b45f ("arm64: dts: qcom: ipq8074: fix Gen3 PCIe QMP PHY") +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/ipq8074.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/ipq8074.dtsi b/arch/arm64/boot/dts/qcom/ipq8074.dtsi +index ae32e2380dd5a..a7ce999182e9e 100644 +--- a/arch/arm64/boot/dts/qcom/ipq8074.dtsi ++++ b/arch/arm64/boot/dts/qcom/ipq8074.dtsi +@@ -176,7 +176,7 @@ qusb_phy_0: phy@79000 { + + pcie_qmp0: phy@86000 { + compatible = "qcom,ipq8074-qmp-pcie-phy"; +- reg = <0x00086000 0x1000>; ++ reg = <0x00086000 0x1c4>; + #address-cells = <1>; + #size-cells = <1>; + ranges; +@@ -204,7 +204,7 @@ pcie_phy0: phy@86200 { + + pcie_qmp1: phy@8e000 { + compatible = "qcom,ipq8074-qmp-pcie-phy"; +- reg = <0x0008e000 0x1000>; ++ reg = <0x0008e000 0x1c4>; + #address-cells = <1>; + #size-cells = <1>; + ranges; +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-qcom-msm8992-bullhead-disable-dfps_data_me.patch b/queue-5.15/arm64-dts-qcom-msm8992-bullhead-disable-dfps_data_me.patch new file mode 100644 index 00000000000..55c3a12c414 --- /dev/null +++ b/queue-5.15/arm64-dts-qcom-msm8992-bullhead-disable-dfps_data_me.patch @@ -0,0 +1,46 @@ +From 80f97d9b09c9cf87e58d167397c46756925566b7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Dec 2022 19:54:39 +0100 +Subject: arm64: dts: qcom: msm8992-bullhead: Disable dfps_data_mem + +From: Petr Vorel + +[ Upstream commit 4dee5aa44b924036511a744ceb3abb1ceeb96bb6 ] + +It's disabled on downstream [1] thus not shown on downstream dmesg. + +Removing it fixes warnings on v6.1: + +[ 0.000000] OF: reserved mem: OVERLAP DETECTED! +[ 0.000000] dfps_data_mem@3400000 (0x0000000003400000--0x0000000003401000) overlaps with memory@3400000 (0x0000000003400000--0x0000000004600000) + +[1] https://android.googlesource.com/kernel/msm.git/+/android-7.0.0_r0.17/arch/arm64/boot/dts/lge/msm8992-bullhead.dtsi#137 + +Fixes: 976d321f32dc ("arm64: dts: qcom: msm8992: Make the DT an overlay on top of 8994") + +Signed-off-by: Petr Vorel +Reviewed-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20221226185440.440968-3-pevik@seznam.cz +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/msm8992-bullhead-rev-101.dts | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/arch/arm64/boot/dts/qcom/msm8992-bullhead-rev-101.dts b/arch/arm64/boot/dts/qcom/msm8992-bullhead-rev-101.dts +index 8e20bb13bd65e..84ba740cb957b 100644 +--- a/arch/arm64/boot/dts/qcom/msm8992-bullhead-rev-101.dts ++++ b/arch/arm64/boot/dts/qcom/msm8992-bullhead-rev-101.dts +@@ -14,6 +14,9 @@ + /* cont_splash_mem has different memory mapping */ + /delete-node/ &cont_splash_mem; + ++/* disabled on downstream, conflicts with cont_splash_mem */ ++/delete-node/ &dfps_data_mem; ++ + / { + model = "LG Nexus 5X"; + compatible = "lg,bullhead", "qcom,msm8992"; +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-qcom-msm8992-bullhead-fix-cont_splash_mem-.patch b/queue-5.15/arm64-dts-qcom-msm8992-bullhead-fix-cont_splash_mem-.patch new file mode 100644 index 00000000000..2ef9616c4e5 --- /dev/null +++ b/queue-5.15/arm64-dts-qcom-msm8992-bullhead-fix-cont_splash_mem-.patch @@ -0,0 +1,58 @@ +From 48e5b68529ed490c0cd4e71aa11d06c755bc648c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Dec 2022 19:54:38 +0100 +Subject: arm64: dts: qcom: msm8992-bullhead: Fix cont_splash_mem size + +From: Petr Vorel + +[ Upstream commit 26a91359aea4d89e7d3646d806eed0f3755b74bd ] + +Original google firmware reports 12 MiB: +[ 0.000000] cma: Found cont_splash_mem@0, memory base 0x0000000003400000, size 12 MiB, limit 0xffffffffffffffff + +which is actually 12*1024*1024 = 0xc00000. + +This matches the aosp source [1]: +&cont_splash_mem { + reg = <0 0x03400000 0 0xc00000>; +}; + +Fixes: 3cb6a271f4b0 ("arm64: dts: qcom: msm8992-bullhead: Fix cont_splash_mem mapping") +Fixes: 976d321f32dc ("arm64: dts: qcom: msm8992: Make the DT an overlay on top of 8994") + +[1] https://android.googlesource.com/kernel/msm.git/+/android-7.0.0_r0.17/arch/arm64/boot/dts/lge/msm8992-bullhead.dtsi#141 + +Signed-off-by: Petr Vorel +Reviewed-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20221226185440.440968-2-pevik@seznam.cz +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/msm8992-bullhead-rev-101.dts | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/msm8992-bullhead-rev-101.dts b/arch/arm64/boot/dts/qcom/msm8992-bullhead-rev-101.dts +index d7d06553bf9ec..8e20bb13bd65e 100644 +--- a/arch/arm64/boot/dts/qcom/msm8992-bullhead-rev-101.dts ++++ b/arch/arm64/boot/dts/qcom/msm8992-bullhead-rev-101.dts +@@ -1,7 +1,7 @@ + // SPDX-License-Identifier: GPL-2.0-only + /* Copyright (c) 2015, LGE Inc. All rights reserved. + * Copyright (c) 2016, The Linux Foundation. All rights reserved. +- * Copyright (c) 2021, Petr Vorel ++ * Copyright (c) 2021-2022, Petr Vorel + * Copyright (c) 2022, Dominik Kobinski + */ + +@@ -48,7 +48,7 @@ ramoops@1ff00000 { + }; + + cont_splash_mem: memory@3400000 { +- reg = <0 0x03400000 0 0x1200000>; ++ reg = <0 0x03400000 0 0xc00000>; + no-map; + }; + +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-qcom-msm8992-lg-bullhead-correct-memory-ov.patch b/queue-5.15/arm64-dts-qcom-msm8992-lg-bullhead-correct-memory-ov.patch new file mode 100644 index 00000000000..e83ef71c727 --- /dev/null +++ b/queue-5.15/arm64-dts-qcom-msm8992-lg-bullhead-correct-memory-ov.patch @@ -0,0 +1,62 @@ +From 840075c5ff6dd221aa98980560cc051279047bc5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Feb 2023 16:48:19 +1100 +Subject: arm64: dts: qcom: msm8992-lg-bullhead: Correct memory overlaps with + the SMEM and MPSS memory regions + +From: Jamie Douglass + +[ Upstream commit d44106883d74992343710f18c4aaae937c7cefab ] + +The memory region reserved by a previous commit (see fixes tag below) +overlaps with the SMEM and MPSS memory regions, causing error messages in +dmesg: + OF: reserved mem: OVERLAP DETECTED! + reserved@5000000 (0x0000000005000000--0x0000000007200000) + overlaps with smem_region@6a00000 + (0x0000000006a00000--0x0000000006c00000) + + OF: reserved mem: OVERLAP DETECTED! + reserved@6c00000 (0x0000000006c00000--0x0000000007200000) + overlaps with memory@7000000 + (0x0000000007000000--0x000000000ca00000) + +This patch resolves both of these by splitting the previously reserved +memory region into two sections either side of the SMEM region and by +cutting off the second memory region to 0x7000000. + +Fixes: 22c7e1a0fa45 ("arm64: dts: msm8992-bullhead: add memory hole region") +Signed-off-by: Jamie Douglass +Reviewed-by: Petr Vorel +Tested-by: Petr Vorel +Reviewed-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230202054819.16079-1-jamiemdouglass@gmail.com +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/msm8992-bullhead-rev-101.dts | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/msm8992-bullhead-rev-101.dts b/arch/arm64/boot/dts/qcom/msm8992-bullhead-rev-101.dts +index 84ba740cb957b..60fcb024c8879 100644 +--- a/arch/arm64/boot/dts/qcom/msm8992-bullhead-rev-101.dts ++++ b/arch/arm64/boot/dts/qcom/msm8992-bullhead-rev-101.dts +@@ -55,8 +55,13 @@ cont_splash_mem: memory@3400000 { + no-map; + }; + +- removed_region: reserved@5000000 { +- reg = <0 0x05000000 0 0x2200000>; ++ reserved@5000000 { ++ reg = <0x0 0x05000000 0x0 0x1a00000>; ++ no-map; ++ }; ++ ++ reserved@6c00000 { ++ reg = <0x0 0x06c00000 0x0 0x400000>; + no-map; + }; + }; +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-qcom-msm8996-tone-fix-usb-taking-6-minutes.patch b/queue-5.15/arm64-dts-qcom-msm8996-tone-fix-usb-taking-6-minutes.patch new file mode 100644 index 00000000000..99f5d78444e --- /dev/null +++ b/queue-5.15/arm64-dts-qcom-msm8996-tone-fix-usb-taking-6-minutes.patch @@ -0,0 +1,51 @@ +From 16fda82327cfb74987bdee9626960b83999787a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Nov 2022 23:01:47 +0100 +Subject: arm64: dts: qcom: msm8996-tone: Fix USB taking 6 minutes to wake up + +From: Konrad Dybcio + +[ Upstream commit 43069b9cd358aebc692e654de91ee06ff66e26af ] + +The hardware turns out to be pretty sluggish at assuming it can only +do USB2 with just a USB2 phy assigned to it - before it needed about +6 minutes to acknowledge that. + +Limit it to USB-HS explicitly to make USB come up about 720x faster. + +Fixes: 9da65e441d4d ("arm64: dts: qcom: Add support for SONY Xperia X Performance / XZ / XZs (msm8996, Tone platform)") +Signed-off-by: Konrad Dybcio +Reviewed-by: Neil Armstrong +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20221124220147.102611-1-konrad.dybcio@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/msm8996-sony-xperia-tone.dtsi | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/msm8996-sony-xperia-tone.dtsi b/arch/arm64/boot/dts/qcom/msm8996-sony-xperia-tone.dtsi +index 507396c4d23b6..7802abac39fa5 100644 +--- a/arch/arm64/boot/dts/qcom/msm8996-sony-xperia-tone.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8996-sony-xperia-tone.dtsi +@@ -938,10 +938,6 @@ touch_int_sleep: touch-int-sleep { + }; + }; + +-/* +- * For reasons that are currently unknown (but probably related to fusb301), USB takes about +- * 6 minutes to wake up (nothing interesting in kernel logs), but then it works as it should. +- */ + &usb3 { + status = "okay"; + qcom,select-utmi-as-pipe-clk; +@@ -950,6 +946,7 @@ &usb3 { + &usb3_dwc3 { + extcon = <&usb3_id>; + dr_mode = "peripheral"; ++ maximum-speed = "high-speed"; + phys = <&hsusb_phy1>; + phy-names = "usb2-phy"; + snps,hird-threshold = /bits/ 8 <0>; +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-qcom-pmk8350-specify-pbs-register-for-pon.patch b/queue-5.15/arm64-dts-qcom-pmk8350-specify-pbs-register-for-pon.patch new file mode 100644 index 00000000000..52c91c6a528 --- /dev/null +++ b/queue-5.15/arm64-dts-qcom-pmk8350-specify-pbs-register-for-pon.patch @@ -0,0 +1,40 @@ +From de4fa0bd040fc881a430307bda1fa904fefe1e51 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Nov 2022 14:26:26 +0100 +Subject: arm64: dts: qcom: pmk8350: Specify PBS register for PON + +From: Konrad Dybcio + +[ Upstream commit f46ef374e0dcb8fd2f272a376cf0dcdab7e52fc2 ] + +PMK8350 is the first PMIC to require both HLOS and PBS registers for +PON to function properly (at least in theory, sm8350 sees no change). +The support for it on the driver side has been added long ago, +but it has never been wired up. Do so. + +Signed-off-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20221115132626.7465-1-konrad.dybcio@linaro.org +Stable-dep-of: c0ee8e0ba5cc ("arm64: dts: qcom: pmk8350: Use the correct PON compatible") +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/pmk8350.dtsi | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/pmk8350.dtsi b/arch/arm64/boot/dts/qcom/pmk8350.dtsi +index 04fc2632a0b20..530adc87a4096 100644 +--- a/arch/arm64/boot/dts/qcom/pmk8350.dtsi ++++ b/arch/arm64/boot/dts/qcom/pmk8350.dtsi +@@ -17,7 +17,8 @@ pmk8350: pmic@0 { + + pmk8350_pon: pon@1300 { + compatible = "qcom,pm8998-pon"; +- reg = <0x1300>; ++ reg = <0x1300>, <0x800>; ++ reg-names = "hlos", "pbs"; + + pwrkey { + compatible = "qcom,pmk8350-pwrkey"; +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-qcom-pmk8350-use-the-correct-pon-compatibl.patch b/queue-5.15/arm64-dts-qcom-pmk8350-use-the-correct-pon-compatibl.patch new file mode 100644 index 00000000000..0796dd04c18 --- /dev/null +++ b/queue-5.15/arm64-dts-qcom-pmk8350-use-the-correct-pon-compatibl.patch @@ -0,0 +1,37 @@ +From d3de037aee52874be3719b92a640c996a01aba26 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Feb 2023 22:29:30 +0100 +Subject: arm64: dts: qcom: pmk8350: Use the correct PON compatible + +From: Konrad Dybcio + +[ Upstream commit c0ee8e0ba5cc17623e63349a168b41e407b1eef0 ] + +A special compatible was introduced for PMK8350 both in the driver and +the bindings to facilitate for 2 base registers (PBS & HLOS). Use it. + +Fixes: b2de43136058 ("arm64: dts: qcom: pmk8350: Add peripherals for pmk8350") +Signed-off-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230213212930.2115182-1-konrad.dybcio@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/pmk8350.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/pmk8350.dtsi b/arch/arm64/boot/dts/qcom/pmk8350.dtsi +index 530adc87a4096..fc38f77d12a36 100644 +--- a/arch/arm64/boot/dts/qcom/pmk8350.dtsi ++++ b/arch/arm64/boot/dts/qcom/pmk8350.dtsi +@@ -16,7 +16,7 @@ pmk8350: pmic@0 { + #size-cells = <0>; + + pmk8350_pon: pon@1300 { +- compatible = "qcom,pm8998-pon"; ++ compatible = "qcom,pmk8350-pon"; + reg = <0x1300>, <0x800>; + reg-names = "hlos", "pbs"; + +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-qcom-qcs404-use-symbol-names-for-pcie-rese.patch b/queue-5.15/arm64-dts-qcom-qcs404-use-symbol-names-for-pcie-rese.patch new file mode 100644 index 00000000000..85d674ac144 --- /dev/null +++ b/queue-5.15/arm64-dts-qcom-qcs404-use-symbol-names-for-pcie-rese.patch @@ -0,0 +1,58 @@ +From 490dd02a6a2e499ac083f7f0f7322f34c91b3301 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Dec 2022 06:21:51 +0200 +Subject: arm64: dts: qcom: qcs404: use symbol names for PCIe resets + +From: Dmitry Baryshkov + +[ Upstream commit 41a37d157a613444c97e8f71a5fb2a21116b70d7 ] + +The commit e5bbbff5b7d7 ("clk: gcc-qcs404: Add PCIe resets") added names +for PCIe resets, but it did not change the existing qcs404.dtsi to use +these names. Do it now and use symbol names to make it easier to check +and modify the dtsi in future. + +Fixes: e5bbbff5b7d7 ("clk: gcc-qcs404: Add PCIe resets") +Reviewed-by: Konrad Dybcio +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20221226042154.2666748-14-dmitry.baryshkov@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/qcs404.dtsi | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/qcs404.dtsi b/arch/arm64/boot/dts/qcom/qcs404.dtsi +index 18cc8e3bc93ac..fd0d634a373fc 100644 +--- a/arch/arm64/boot/dts/qcom/qcs404.dtsi ++++ b/arch/arm64/boot/dts/qcom/qcs404.dtsi +@@ -775,7 +775,7 @@ pcie_phy: phy@7786000 { + + clocks = <&gcc GCC_PCIE_0_PIPE_CLK>; + resets = <&gcc GCC_PCIEPHY_0_PHY_BCR>, +- <&gcc 21>; ++ <&gcc GCC_PCIE_0_PIPE_ARES>; + reset-names = "phy", "pipe"; + + clock-output-names = "pcie_0_pipe_clk"; +@@ -1305,12 +1305,12 @@ pcie: pci@10000000 { + <&gcc GCC_PCIE_0_SLV_AXI_CLK>; + clock-names = "iface", "aux", "master_bus", "slave_bus"; + +- resets = <&gcc 18>, +- <&gcc 17>, +- <&gcc 15>, +- <&gcc 19>, ++ resets = <&gcc GCC_PCIE_0_AXI_MASTER_ARES>, ++ <&gcc GCC_PCIE_0_AXI_SLAVE_ARES>, ++ <&gcc GCC_PCIE_0_AXI_MASTER_STICKY_ARES>, ++ <&gcc GCC_PCIE_0_CORE_STICKY_ARES>, + <&gcc GCC_PCIE_0_BCR>, +- <&gcc 16>; ++ <&gcc GCC_PCIE_0_AHB_ARES>; + reset-names = "axi_m", + "axi_s", + "axi_m_sticky", +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-qcom-sc7180-correct-spmi-bus-address-cells.patch b/queue-5.15/arm64-dts-qcom-sc7180-correct-spmi-bus-address-cells.patch new file mode 100644 index 00000000000..913462864a2 --- /dev/null +++ b/queue-5.15/arm64-dts-qcom-sc7180-correct-spmi-bus-address-cells.patch @@ -0,0 +1,43 @@ +From b346e8405d5bc1b2c7662197d3175cb65b0959be Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Dec 2022 11:19:17 +0100 +Subject: arm64: dts: qcom: sc7180: correct SPMI bus address cells + +From: Krzysztof Kozlowski + +[ Upstream commit 1f75745537222172f84783d369bbd1fb2d4b6414 ] + +The SPMI bus uses two address cells and zero size cells (second reg +entry - SPMI_USID - is not the size): + + spmi@c440000: #address-cells:0:0: 2 was expected + +Fixes: 0f9dc5f09fbd ("arm64: dts: qcom: sc7180: Add SPMI PMIC arbiter device") +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Konrad Dybcio +Reviewed-by: Stephen Boyd +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20221213101921.47924-1-krzysztof.kozlowski@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sc7180.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sc7180.dtsi b/arch/arm64/boot/dts/qcom/sc7180.dtsi +index de86ae3a7fd27..12816d60e2494 100644 +--- a/arch/arm64/boot/dts/qcom/sc7180.dtsi ++++ b/arch/arm64/boot/dts/qcom/sc7180.dtsi +@@ -3241,8 +3241,8 @@ spmi_bus: spmi@c440000 { + interrupts-extended = <&pdc 1 IRQ_TYPE_LEVEL_HIGH>; + qcom,ee = <0>; + qcom,channel = <0>; +- #address-cells = <1>; +- #size-cells = <1>; ++ #address-cells = <2>; ++ #size-cells = <0>; + interrupt-controller; + #interrupt-cells = <4>; + cell-index = <0>; +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-qcom-sc7280-correct-spmi-bus-address-cells.patch b/queue-5.15/arm64-dts-qcom-sc7280-correct-spmi-bus-address-cells.patch new file mode 100644 index 00000000000..edc6ee09bfa --- /dev/null +++ b/queue-5.15/arm64-dts-qcom-sc7280-correct-spmi-bus-address-cells.patch @@ -0,0 +1,43 @@ +From 0029bbff132e6a30a1a31a631ff699fc4fe041d5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Dec 2022 11:19:18 +0100 +Subject: arm64: dts: qcom: sc7280: correct SPMI bus address cells + +From: Krzysztof Kozlowski + +[ Upstream commit 8da3786a91e56fe0c4aeb2c2209744474af6e517 ] + +The SPMI bus uses two address cells and zero size cells (second reg +entry - SPMI_USID - is not the size): + + spmi@c440000: #address-cells:0:0: 2 was expected + +Fixes: 14abf8dfe364 ("arm64: dts: qcom: sc7280: Add SPMI PMIC arbiter device for SC7280") +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Konrad Dybcio +Reviewed-by: Stephen Boyd +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20221213101921.47924-2-krzysztof.kozlowski@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sc7280.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sc7280.dtsi b/arch/arm64/boot/dts/qcom/sc7280.dtsi +index b795a9993cc1b..fb6473a0aa4b3 100644 +--- a/arch/arm64/boot/dts/qcom/sc7280.dtsi ++++ b/arch/arm64/boot/dts/qcom/sc7280.dtsi +@@ -1494,8 +1494,8 @@ spmi_bus: spmi@c440000 { + interrupts-extended = <&pdc 1 IRQ_TYPE_LEVEL_HIGH>; + qcom,ee = <0>; + qcom,channel = <0>; +- #address-cells = <1>; +- #size-cells = <1>; ++ #address-cells = <2>; ++ #size-cells = <0>; + interrupt-controller; + #interrupt-cells = <4>; + }; +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-qcom-sdm845-db845c-fix-audio-codec-interru.patch b/queue-5.15/arm64-dts-qcom-sdm845-db845c-fix-audio-codec-interru.patch new file mode 100644 index 00000000000..d921f1b984e --- /dev/null +++ b/queue-5.15/arm64-dts-qcom-sdm845-db845c-fix-audio-codec-interru.patch @@ -0,0 +1,40 @@ +From 9e73caf34fdfe76ee59addcfedf83e317f9ca927 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Dec 2022 16:13:16 +0100 +Subject: arm64: dts: qcom: sdm845-db845c: fix audio codec interrupt pin name + +From: Krzysztof Kozlowski + +[ Upstream commit 740862bb5f59b93efb390a417995f88a64bdc323 ] + +The pin config entry should have a string, not number, for the GPIO used +as WCD9340 audio codec interrupt. + +Fixes: 89a32a4e769c ("arm64: dts: qcom: db845c: add analog audio support") +Reported-by: Doug Anderson +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Douglas Anderson +Reviewed-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20221222151319.122398-1-krzysztof.kozlowski@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sdm845-db845c.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/sdm845-db845c.dts b/arch/arm64/boot/dts/qcom/sdm845-db845c.dts +index 146d3cd3f1b31..5ce270f0b2ec1 100644 +--- a/arch/arm64/boot/dts/qcom/sdm845-db845c.dts ++++ b/arch/arm64/boot/dts/qcom/sdm845-db845c.dts +@@ -896,7 +896,7 @@ sdc2_card_det_n: sd-card-det-n { + }; + + wcd_intr_default: wcd_intr_default { +- pins = <54>; ++ pins = "gpio54"; + function = "gpio"; + + input-enable; +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-qcom-sm6125-reorder-hsusb-phy-clocks-to-ma.patch b/queue-5.15/arm64-dts-qcom-sm6125-reorder-hsusb-phy-clocks-to-ma.patch new file mode 100644 index 00000000000..d653ce9553f --- /dev/null +++ b/queue-5.15/arm64-dts-qcom-sm6125-reorder-hsusb-phy-clocks-to-ma.patch @@ -0,0 +1,48 @@ +From 8578ec4bf9fe3621bfcb35bfd0b36da1ca59cfc3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Dec 2022 22:33:43 +0100 +Subject: arm64: dts: qcom: sm6125: Reorder HSUSB PHY clocks to match bindings + +From: Marijn Suijten + +[ Upstream commit 8416262b0ea46d84767141b074748f4d4f37736a ] + +Reorder the clocks and corresponding names to match the QUSB2 phy +schema, fixing the following CHECK_DTBS errors: + + arch/arm64/boot/dts/qcom/sm6125-sony-xperia-seine-pdx201.dtb: phy@1613000: clock-names:0: 'cfg_ahb' was expected + From schema: /newdata/aosp-r/kernel/mainline/kernel/Documentation/devicetree/bindings/phy/qcom,qusb2-phy.yaml + arch/arm64/boot/dts/qcom/sm6125-sony-xperia-seine-pdx201.dtb: phy@1613000: clock-names:1: 'ref' was expected + From schema: /newdata/aosp-r/kernel/mainline/kernel/Documentation/devicetree/bindings/phy/qcom,qusb2-phy.yaml + +Fixes: cff4bbaf2a2d ("arm64: dts: qcom: Add support for SM6125") +Signed-off-by: Marijn Suijten +Reviewed-by: Martin Botka +Reviewed-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20221216213343.1140143-1-marijn.suijten@somainline.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sm6125.dtsi | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sm6125.dtsi b/arch/arm64/boot/dts/qcom/sm6125.dtsi +index dc3bddc54eb62..2e4fe2bc1e0a8 100644 +--- a/arch/arm64/boot/dts/qcom/sm6125.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm6125.dtsi +@@ -392,9 +392,9 @@ hsusb_phy1: phy@1613000 { + reg = <0x01613000 0x180>; + #phy-cells = <0>; + +- clocks = <&rpmcc RPM_SMD_XO_CLK_SRC>, +- <&gcc GCC_AHB2PHY_USB_CLK>; +- clock-names = "ref", "cfg_ahb"; ++ clocks = <&gcc GCC_AHB2PHY_USB_CLK>, ++ <&rpmcc RPM_SMD_XO_CLK_SRC>; ++ clock-names = "cfg_ahb", "ref"; + + resets = <&gcc GCC_QUSB2PHY_PRIM_BCR>; + status = "disabled"; +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-qcom-sm8150-kumano-panel-framebuffer-is-2..patch b/queue-5.15/arm64-dts-qcom-sm8150-kumano-panel-framebuffer-is-2..patch new file mode 100644 index 00000000000..47c3450e7f4 --- /dev/null +++ b/queue-5.15/arm64-dts-qcom-sm8150-kumano-panel-framebuffer-is-2..patch @@ -0,0 +1,48 @@ +From 4de918d92b16f0732c47cc3ddd6aa32a14df4037 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Dec 2022 20:17:33 +0100 +Subject: arm64: dts: qcom: sm8150-kumano: Panel framebuffer is 2.5k instead of + 4k + +From: Marijn Suijten + +[ Upstream commit be8de06dc397c45cb0f3fe04084089c3f06c419f ] + +The framebuffer configuration for kumano griffin, written in kumano dtsi +(which is overwritten in bahamut dts for its smaller panel) has to use a +1096x2560 configuration as this is what the panel (and framebuffer area) +has been initialized to. Downstream userspace also has access to (and +uses) this 2.5k mode by default, and only switches the panel to 4k when +requested. + +Fixes: d0a6ce59ea4e ("arm64: dts: qcom: sm8150: Add support for SONY Xperia 1 / 5 (Kumano platform)") +Signed-off-by: Marijn Suijten +Reviewed-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20221209191733.1458031-1-marijn.suijten@somainline.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sm8150-sony-xperia-kumano.dtsi | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sm8150-sony-xperia-kumano.dtsi b/arch/arm64/boot/dts/qcom/sm8150-sony-xperia-kumano.dtsi +index fb6e5a140c9f6..04c71f74ab72d 100644 +--- a/arch/arm64/boot/dts/qcom/sm8150-sony-xperia-kumano.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm8150-sony-xperia-kumano.dtsi +@@ -33,9 +33,10 @@ chosen { + framebuffer: framebuffer@9c000000 { + compatible = "simple-framebuffer"; + reg = <0 0x9c000000 0 0x2300000>; +- width = <1644>; +- height = <3840>; +- stride = <(1644 * 4)>; ++ /* Griffin BL initializes in 2.5k mode, not 4k */ ++ width = <1096>; ++ height = <2560>; ++ stride = <(1096 * 4)>; + format = "a8r8g8b8"; + /* + * That's (going to be) a lot of clocks, but it's necessary due +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-renesas-beacon-renesom-fix-gpio-expander-r.patch b/queue-5.15/arm64-dts-renesas-beacon-renesom-fix-gpio-expander-r.patch new file mode 100644 index 00000000000..4a278440888 --- /dev/null +++ b/queue-5.15/arm64-dts-renesas-beacon-renesom-fix-gpio-expander-r.patch @@ -0,0 +1,76 @@ +From f779bb439686625a0dc8d7853e06a61ea745bc80 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 14 Jan 2023 16:56:45 -0600 +Subject: arm64: dts: renesas: beacon-renesom: Fix gpio expander reference + +From: Adam Ford + +[ Upstream commit d7f9492dfc03153ac56ab59066a196558748f575 ] + +The board used to originally introduce the Beacon Embedded RZ/G2[M/N/H] +boards had a GPIO expander with address 20, but this was changed when +the final board went to production. + +The production boards changed both the part itself and the address. +With the incorrect address, the LCD cannot come up. If the LCD fails, +the rcar-du driver fails to come up, and that also breaks HDMI. + +Pre-release board were not shipped to the general public, so it should +be safe to push this as a fix. Anyone with a production board would +have video fail due to this GPIO expander change. + +Fixes: a1d8a344f1ca ("arm64: dts: renesas: Introduce r8a774a1-beacon-rzg2m-kit") +Signed-off-by: Adam Ford +Reviewed-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/20230114225647.227972-1-aford173@gmail.com +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + .../dts/renesas/beacon-renesom-baseboard.dtsi | 24 ++++++++----------- + 1 file changed, 10 insertions(+), 14 deletions(-) + +diff --git a/arch/arm64/boot/dts/renesas/beacon-renesom-baseboard.dtsi b/arch/arm64/boot/dts/renesas/beacon-renesom-baseboard.dtsi +index 48e0c0494f6a0..f1ab4943c295c 100644 +--- a/arch/arm64/boot/dts/renesas/beacon-renesom-baseboard.dtsi ++++ b/arch/arm64/boot/dts/renesas/beacon-renesom-baseboard.dtsi +@@ -432,20 +432,6 @@ wm8962_endpoint: endpoint { + }; + }; + +- /* 0 - lcd_reset */ +- /* 1 - lcd_pwr */ +- /* 2 - lcd_select */ +- /* 3 - backlight-enable */ +- /* 4 - Touch_shdwn */ +- /* 5 - LCD_H_pol */ +- /* 6 - lcd_V_pol */ +- gpio_exp1: gpio@20 { +- compatible = "onnn,pca9654"; +- reg = <0x20>; +- gpio-controller; +- #gpio-cells = <2>; +- }; +- + touchscreen@26 { + compatible = "ilitek,ili2117"; + reg = <0x26>; +@@ -477,6 +463,16 @@ hd3ss3220_out_ep: endpoint { + }; + }; + }; ++ ++ gpio_exp1: gpio@70 { ++ compatible = "nxp,pca9538"; ++ reg = <0x70>; ++ gpio-controller; ++ #gpio-cells = <2>; ++ gpio-line-names = "lcd_reset", "lcd_pwr", "lcd_select", ++ "backlight-enable", "Touch_shdwn", ++ "LCD_H_pol", "lcd_V_pol"; ++ }; + }; + + &lvds0 { +-- +2.39.2 + diff --git a/queue-5.15/arm64-dts-ti-k3-j7200-fix-wakeup-pinmux-range.patch b/queue-5.15/arm64-dts-ti-k3-j7200-fix-wakeup-pinmux-range.patch new file mode 100644 index 00000000000..abbf743b274 --- /dev/null +++ b/queue-5.15/arm64-dts-ti-k3-j7200-fix-wakeup-pinmux-range.patch @@ -0,0 +1,90 @@ +From 9416cd7d435bb1fc70b5a792eab54ae0f91de65c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Jan 2023 09:56:22 +0530 +Subject: arm64: dts: ti: k3-j7200: Fix wakeup pinmux range + +From: Vaishnav Achath + +[ Upstream commit 9ae21ac445e911e3541985c20052fc05d60f6879 ] + +The WKUP_PADCONFIG register region in J7200 has multiple non-addressable +regions, split the existing wkup_pmx region as follows to avoid the +non-addressable regions and include all valid WKUP_PADCONFIG registers. +Also update references to old nodes with new ones. + +wkup_pmx0 -> 13 pins (WKUP_PADCONFIG 0 - 12) +wkup_pmx1 -> 2 pins (WKUP_PADCONFIG 14 - 15) +wkup_pmx2 -> 59 pins (WKUP_PADCONFIG 26 - 84) +wkup_pmx3 -> 8 pins (WKUP_PADCONFIG 93 - 100) + +J7200 Datasheet (Table 6-106, Section 6.4 Pin Multiplexing) : + https://www.ti.com/lit/ds/symlink/dra821u.pdf + +Fixes: d361ed88455f ("arm64: dts: ti: Add support for J7200 SoC") + +Signed-off-by: Vaishnav Achath +Reviewed-by: Jayesh Choudhary +Signed-off-by: Vignesh Raghavendra +Link: https://lore.kernel.org/r/20230119042622.22310-1-vaishnav.a@ti.com +Signed-off-by: Sasha Levin +--- + .../dts/ti/k3-j7200-common-proc-board.dts | 2 +- + .../boot/dts/ti/k3-j7200-mcu-wakeup.dtsi | 29 ++++++++++++++++++- + 2 files changed, 29 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/ti/k3-j7200-common-proc-board.dts b/arch/arm64/boot/dts/ti/k3-j7200-common-proc-board.dts +index c3406e7f10a97..4417fe81afd7f 100644 +--- a/arch/arm64/boot/dts/ti/k3-j7200-common-proc-board.dts ++++ b/arch/arm64/boot/dts/ti/k3-j7200-common-proc-board.dts +@@ -77,7 +77,7 @@ vdd_sd_dv: gpio-regulator-TLV71033 { + }; + }; + +-&wkup_pmx0 { ++&wkup_pmx2 { + mcu_cpsw_pins_default: mcu-cpsw-pins-default { + pinctrl-single,pins = < + J721E_WKUP_IOPAD(0x0068, PIN_OUTPUT, 0) /* MCU_RGMII1_TX_CTL */ +diff --git a/arch/arm64/boot/dts/ti/k3-j7200-mcu-wakeup.dtsi b/arch/arm64/boot/dts/ti/k3-j7200-mcu-wakeup.dtsi +index 1044ec6c4b0d4..8185c1627c6f1 100644 +--- a/arch/arm64/boot/dts/ti/k3-j7200-mcu-wakeup.dtsi ++++ b/arch/arm64/boot/dts/ti/k3-j7200-mcu-wakeup.dtsi +@@ -56,7 +56,34 @@ chipid@43000014 { + wkup_pmx0: pinctrl@4301c000 { + compatible = "pinctrl-single"; + /* Proxy 0 addressing */ +- reg = <0x00 0x4301c000 0x00 0x178>; ++ reg = <0x00 0x4301c000 0x00 0x34>; ++ #pinctrl-cells = <1>; ++ pinctrl-single,register-width = <32>; ++ pinctrl-single,function-mask = <0xffffffff>; ++ }; ++ ++ wkup_pmx1: pinctrl@0x4301c038 { ++ compatible = "pinctrl-single"; ++ /* Proxy 0 addressing */ ++ reg = <0x00 0x4301c038 0x00 0x8>; ++ #pinctrl-cells = <1>; ++ pinctrl-single,register-width = <32>; ++ pinctrl-single,function-mask = <0xffffffff>; ++ }; ++ ++ wkup_pmx2: pinctrl@0x4301c068 { ++ compatible = "pinctrl-single"; ++ /* Proxy 0 addressing */ ++ reg = <0x00 0x4301c068 0x00 0xec>; ++ #pinctrl-cells = <1>; ++ pinctrl-single,register-width = <32>; ++ pinctrl-single,function-mask = <0xffffffff>; ++ }; ++ ++ wkup_pmx3: pinctrl@0x4301c174 { ++ compatible = "pinctrl-single"; ++ /* Proxy 0 addressing */ ++ reg = <0x00 0x4301c174 0x00 0x20>; + #pinctrl-cells = <1>; + pinctrl-single,register-width = <32>; + pinctrl-single,function-mask = <0xffffffff>; +-- +2.39.2 + diff --git a/queue-5.15/asoc-codecs-change-bulk-clock-voting-to-optional-vot.patch b/queue-5.15/asoc-codecs-change-bulk-clock-voting-to-optional-vot.patch new file mode 100644 index 00000000000..00379ea86a0 --- /dev/null +++ b/queue-5.15/asoc-codecs-change-bulk-clock-voting-to-optional-vot.patch @@ -0,0 +1,70 @@ +From aec7889fb827b79f2369a01de6127018413bcfba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Oct 2021 13:13:08 +0530 +Subject: ASoC: codecs: Change bulk clock voting to optional voting in digital + codecs + +From: Srinivasa Rao Mandadapu + +[ Upstream commit 9f589cf0f91485c8591775acad056c80378a2d34 ] + +Change bulk clock frequency voting to optional bulk voting in va, rx and tx macros +to accommodate both ADSP and ADSP bypass based lpass architectures. + +Signed-off-by: Srinivasa Rao Mandadapu +Co-developed-by: Venkata Prasad Potturu +Signed-off-by: Venkata Prasad Potturu +Reviewed-by: Srinivas Kandagatla +Tested-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/1635234188-7746-6-git-send-email-srivasam@codeaurora.org +Signed-off-by: Mark Brown +Stable-dep-of: e7621434378c ("ASoC: codecs: lpass: fix incorrect mclk rate") +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/lpass-rx-macro.c | 2 +- + sound/soc/codecs/lpass-tx-macro.c | 2 +- + sound/soc/codecs/lpass-va-macro.c | 2 +- + 3 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/sound/soc/codecs/lpass-rx-macro.c b/sound/soc/codecs/lpass-rx-macro.c +index 23452900b9ae1..3c4f1fb219a44 100644 +--- a/sound/soc/codecs/lpass-rx-macro.c ++++ b/sound/soc/codecs/lpass-rx-macro.c +@@ -3535,7 +3535,7 @@ static int rx_macro_probe(struct platform_device *pdev) + rx->clks[3].id = "npl"; + rx->clks[4].id = "fsgen"; + +- ret = devm_clk_bulk_get(dev, RX_NUM_CLKS_MAX, rx->clks); ++ ret = devm_clk_bulk_get_optional(dev, RX_NUM_CLKS_MAX, rx->clks); + if (ret) { + dev_err(dev, "Error getting RX Clocks (%d)\n", ret); + return ret; +diff --git a/sound/soc/codecs/lpass-tx-macro.c b/sound/soc/codecs/lpass-tx-macro.c +index feafb8a90ffe9..8d1126802ddfa 100644 +--- a/sound/soc/codecs/lpass-tx-macro.c ++++ b/sound/soc/codecs/lpass-tx-macro.c +@@ -1801,7 +1801,7 @@ static int tx_macro_probe(struct platform_device *pdev) + tx->clks[3].id = "npl"; + tx->clks[4].id = "fsgen"; + +- ret = devm_clk_bulk_get(dev, TX_NUM_CLKS_MAX, tx->clks); ++ ret = devm_clk_bulk_get_optional(dev, TX_NUM_CLKS_MAX, tx->clks); + if (ret) { + dev_err(dev, "Error getting RX Clocks (%d)\n", ret); + return ret; +diff --git a/sound/soc/codecs/lpass-va-macro.c b/sound/soc/codecs/lpass-va-macro.c +index 08702a21212c1..9b9bae9b92be1 100644 +--- a/sound/soc/codecs/lpass-va-macro.c ++++ b/sound/soc/codecs/lpass-va-macro.c +@@ -1408,7 +1408,7 @@ static int va_macro_probe(struct platform_device *pdev) + va->clks[1].id = "dcodec"; + va->clks[2].id = "mclk"; + +- ret = devm_clk_bulk_get(dev, VA_NUM_CLKS_MAX, va->clks); ++ ret = devm_clk_bulk_get_optional(dev, VA_NUM_CLKS_MAX, va->clks); + if (ret) { + dev_err(dev, "Error getting VA Clocks (%d)\n", ret); + return ret; +-- +2.39.2 + diff --git a/queue-5.15/asoc-codecs-lpass-fix-incorrect-mclk-rate.patch b/queue-5.15/asoc-codecs-lpass-fix-incorrect-mclk-rate.patch new file mode 100644 index 00000000000..7cb9be0e1c5 --- /dev/null +++ b/queue-5.15/asoc-codecs-lpass-fix-incorrect-mclk-rate.patch @@ -0,0 +1,73 @@ +From 8fab3e762673940385e7eb41dd46d3be1e72d0b2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Feb 2023 12:28:04 +0000 +Subject: ASoC: codecs: lpass: fix incorrect mclk rate + +From: Srinivas Kandagatla + +[ Upstream commit e7621434378c40b62ef858c14ae6415fb6469a8e ] + +For some reason we ended up with incorrect mclk rate which should be +1920000 instead of 96000, So far we were getting lucky as the same clk +is set to 192000 by wsa and va macro. This issue is discovered when there +is no wsa macro active and only rx or tx path is tested. +Fix this by setting correct rate. + +Fixes: c39667ddcfc5 ("ASoC: codecs: lpass-tx-macro: add support for lpass tx macro") +Fixes: af3d54b99764 ("ASoC: codecs: lpass-rx-macro: add support for lpass rx macro") +Signed-off-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20230209122806.18923-7-srinivas.kandagatla@linaro.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/lpass-rx-macro.c | 4 ++-- + sound/soc/codecs/lpass-tx-macro.c | 4 ++-- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/sound/soc/codecs/lpass-rx-macro.c b/sound/soc/codecs/lpass-rx-macro.c +index 213ededb6f9ee..72a0db09c7131 100644 +--- a/sound/soc/codecs/lpass-rx-macro.c ++++ b/sound/soc/codecs/lpass-rx-macro.c +@@ -363,7 +363,7 @@ + #define CDC_RX_DSD1_CFG2 (0x0F8C) + #define RX_MAX_OFFSET (0x0F8C) + +-#define MCLK_FREQ 9600000 ++#define MCLK_FREQ 19200000 + + #define RX_MACRO_RATES (SNDRV_PCM_RATE_8000 | SNDRV_PCM_RATE_16000 |\ + SNDRV_PCM_RATE_32000 | SNDRV_PCM_RATE_48000 |\ +@@ -3565,7 +3565,7 @@ static int rx_macro_probe(struct platform_device *pdev) + + /* set MCLK and NPL rates */ + clk_set_rate(rx->mclk, MCLK_FREQ); +- clk_set_rate(rx->npl, 2 * MCLK_FREQ); ++ clk_set_rate(rx->npl, MCLK_FREQ); + + ret = clk_prepare_enable(rx->macro); + if (ret) +diff --git a/sound/soc/codecs/lpass-tx-macro.c b/sound/soc/codecs/lpass-tx-macro.c +index d604e2b0109b0..2b7ba78551fab 100644 +--- a/sound/soc/codecs/lpass-tx-macro.c ++++ b/sound/soc/codecs/lpass-tx-macro.c +@@ -200,7 +200,7 @@ + #define TX_MACRO_AMIC_UNMUTE_DELAY_MS 100 + #define TX_MACRO_DMIC_HPF_DELAY_MS 300 + #define TX_MACRO_AMIC_HPF_DELAY_MS 300 +-#define MCLK_FREQ 9600000 ++#define MCLK_FREQ 19200000 + + enum { + TX_MACRO_AIF_INVALID = 0, +@@ -1832,7 +1832,7 @@ static int tx_macro_probe(struct platform_device *pdev) + + /* set MCLK and NPL rates */ + clk_set_rate(tx->mclk, MCLK_FREQ); +- clk_set_rate(tx->npl, 2 * MCLK_FREQ); ++ clk_set_rate(tx->npl, MCLK_FREQ); + + ret = clk_prepare_enable(tx->macro); + if (ret) +-- +2.39.2 + diff --git a/queue-5.15/asoc-codecs-rx-macro-move-clk-provider-to-managed-va.patch b/queue-5.15/asoc-codecs-rx-macro-move-clk-provider-to-managed-va.patch new file mode 100644 index 00000000000..bc54f45dbbb --- /dev/null +++ b/queue-5.15/asoc-codecs-rx-macro-move-clk-provider-to-managed-va.patch @@ -0,0 +1,87 @@ +From 7d170d846a93838f602df05ae0cfad252e9b6320 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Feb 2022 11:17:04 +0000 +Subject: ASoC: codecs: rx-macro: move clk provider to managed variants + +From: Srinivas Kandagatla + +[ Upstream commit 70a5e96bad592145ba25365689a2d7d8dedb3bd9 ] + +move clk provider registration to managed api variants, this should help +with some code tidyup. + +Signed-off-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20220224111718.6264-3-srinivas.kandagatla@linaro.org +Signed-off-by: Mark Brown +Stable-dep-of: e7621434378c ("ASoC: codecs: lpass: fix incorrect mclk rate") +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/lpass-rx-macro.c | 21 +++++++++++---------- + 1 file changed, 11 insertions(+), 10 deletions(-) + +diff --git a/sound/soc/codecs/lpass-rx-macro.c b/sound/soc/codecs/lpass-rx-macro.c +index 3c4f1fb219a44..f3e5755a49a1d 100644 +--- a/sound/soc/codecs/lpass-rx-macro.c ++++ b/sound/soc/codecs/lpass-rx-macro.c +@@ -3479,10 +3479,9 @@ static const struct clk_ops swclk_gate_ops = { + + }; + +-static struct clk *rx_macro_register_mclk_output(struct rx_macro *rx) ++static int rx_macro_register_mclk_output(struct rx_macro *rx) + { + struct device *dev = rx->dev; +- struct device_node *np = dev->of_node; + const char *parent_clk_name = NULL; + const char *clk_name = "lpass-rx-mclk"; + struct clk_hw *hw; +@@ -3498,13 +3497,11 @@ static struct clk *rx_macro_register_mclk_output(struct rx_macro *rx) + init.num_parents = 1; + rx->hw.init = &init; + hw = &rx->hw; +- ret = clk_hw_register(rx->dev, hw); ++ ret = devm_clk_hw_register(rx->dev, hw); + if (ret) +- return ERR_PTR(ret); +- +- of_clk_add_provider(np, of_clk_src_simple_get, hw->clk); ++ return ret; + +- return NULL; ++ return devm_of_clk_add_hw_provider(dev, of_clk_hw_simple_get, hw); + } + + static const struct snd_soc_component_driver rx_macro_component_drv = { +@@ -3562,22 +3559,26 @@ static int rx_macro_probe(struct platform_device *pdev) + if (ret) + return ret; + +- rx_macro_register_mclk_output(rx); ++ ret = rx_macro_register_mclk_output(rx); ++ if (ret) ++ goto err; + + ret = devm_snd_soc_register_component(dev, &rx_macro_component_drv, + rx_macro_dai, + ARRAY_SIZE(rx_macro_dai)); + if (ret) +- clk_bulk_disable_unprepare(RX_NUM_CLKS_MAX, rx->clks); ++ goto err; + + return ret; ++err: ++ clk_bulk_disable_unprepare(RX_NUM_CLKS_MAX, rx->clks); ++ return ret; + } + + static int rx_macro_remove(struct platform_device *pdev) + { + struct rx_macro *rx = dev_get_drvdata(&pdev->dev); + +- of_clk_del_provider(pdev->dev.of_node); + clk_bulk_disable_unprepare(RX_NUM_CLKS_MAX, rx->clks); + return 0; + } +-- +2.39.2 + diff --git a/queue-5.15/asoc-codecs-rx-macro-move-to-individual-clks-from-bu.patch b/queue-5.15/asoc-codecs-rx-macro-move-to-individual-clks-from-bu.patch new file mode 100644 index 00000000000..1ddc8c88e2e --- /dev/null +++ b/queue-5.15/asoc-codecs-rx-macro-move-to-individual-clks-from-bu.patch @@ -0,0 +1,163 @@ +From 84fab852d818e37e3d73fec7f28290a0ccb010f3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Feb 2022 11:17:06 +0000 +Subject: ASoC: codecs: rx-macro: move to individual clks from bulk + +From: Srinivas Kandagatla + +[ Upstream commit 43b647d9940454263421f9a1c756680bdf1d443c ] + +Using bulk clocks and referencing them individually using array index is +not great for readers. +So move them to individual clocks handling and also remove some unnecessary +error handling in the code. + +Signed-off-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20220224111718.6264-5-srinivas.kandagatla@linaro.org +Signed-off-by: Mark Brown +Stable-dep-of: e7621434378c ("ASoC: codecs: lpass: fix incorrect mclk rate") +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/lpass-rx-macro.c | 85 +++++++++++++++++++++++-------- + 1 file changed, 64 insertions(+), 21 deletions(-) + +diff --git a/sound/soc/codecs/lpass-rx-macro.c b/sound/soc/codecs/lpass-rx-macro.c +index f3e5755a49a1d..213ededb6f9ee 100644 +--- a/sound/soc/codecs/lpass-rx-macro.c ++++ b/sound/soc/codecs/lpass-rx-macro.c +@@ -608,7 +608,11 @@ struct rx_macro { + int softclip_clk_users; + + struct regmap *regmap; +- struct clk_bulk_data clks[RX_NUM_CLKS_MAX]; ++ struct clk *mclk; ++ struct clk *npl; ++ struct clk *macro; ++ struct clk *dcodec; ++ struct clk *fsgen; + struct clk_hw hw; + }; + #define to_rx_macro(_hw) container_of(_hw, struct rx_macro, hw) +@@ -3488,7 +3492,7 @@ static int rx_macro_register_mclk_output(struct rx_macro *rx) + struct clk_init_data init; + int ret; + +- parent_clk_name = __clk_get_name(rx->clks[2].clk); ++ parent_clk_name = __clk_get_name(rx->mclk); + + init.name = clk_name; + init.ops = &swclk_gate_ops; +@@ -3526,17 +3530,25 @@ static int rx_macro_probe(struct platform_device *pdev) + if (!rx) + return -ENOMEM; + +- rx->clks[0].id = "macro"; +- rx->clks[1].id = "dcodec"; +- rx->clks[2].id = "mclk"; +- rx->clks[3].id = "npl"; +- rx->clks[4].id = "fsgen"; ++ rx->macro = devm_clk_get_optional(dev, "macro"); ++ if (IS_ERR(rx->macro)) ++ return PTR_ERR(rx->macro); + +- ret = devm_clk_bulk_get_optional(dev, RX_NUM_CLKS_MAX, rx->clks); +- if (ret) { +- dev_err(dev, "Error getting RX Clocks (%d)\n", ret); +- return ret; +- } ++ rx->dcodec = devm_clk_get_optional(dev, "dcodec"); ++ if (IS_ERR(rx->dcodec)) ++ return PTR_ERR(rx->dcodec); ++ ++ rx->mclk = devm_clk_get(dev, "mclk"); ++ if (IS_ERR(rx->mclk)) ++ return PTR_ERR(rx->mclk); ++ ++ rx->npl = devm_clk_get(dev, "npl"); ++ if (IS_ERR(rx->npl)) ++ return PTR_ERR(rx->npl); ++ ++ rx->fsgen = devm_clk_get(dev, "fsgen"); ++ if (IS_ERR(rx->fsgen)) ++ return PTR_ERR(rx->fsgen); + + base = devm_platform_ioremap_resource(pdev, 0); + if (IS_ERR(base)) +@@ -3552,26 +3564,52 @@ static int rx_macro_probe(struct platform_device *pdev) + rx->dev = dev; + + /* set MCLK and NPL rates */ +- clk_set_rate(rx->clks[2].clk, MCLK_FREQ); +- clk_set_rate(rx->clks[3].clk, 2 * MCLK_FREQ); ++ clk_set_rate(rx->mclk, MCLK_FREQ); ++ clk_set_rate(rx->npl, 2 * MCLK_FREQ); + +- ret = clk_bulk_prepare_enable(RX_NUM_CLKS_MAX, rx->clks); ++ ret = clk_prepare_enable(rx->macro); + if (ret) +- return ret; ++ goto err; ++ ++ ret = clk_prepare_enable(rx->dcodec); ++ if (ret) ++ goto err_dcodec; ++ ++ ret = clk_prepare_enable(rx->mclk); ++ if (ret) ++ goto err_mclk; ++ ++ ret = clk_prepare_enable(rx->npl); ++ if (ret) ++ goto err_npl; ++ ++ ret = clk_prepare_enable(rx->fsgen); ++ if (ret) ++ goto err_fsgen; + + ret = rx_macro_register_mclk_output(rx); + if (ret) +- goto err; ++ goto err_clkout; + + ret = devm_snd_soc_register_component(dev, &rx_macro_component_drv, + rx_macro_dai, + ARRAY_SIZE(rx_macro_dai)); + if (ret) +- goto err; ++ goto err_clkout; + +- return ret; ++ return 0; ++ ++err_clkout: ++ clk_disable_unprepare(rx->fsgen); ++err_fsgen: ++ clk_disable_unprepare(rx->npl); ++err_npl: ++ clk_disable_unprepare(rx->mclk); ++err_mclk: ++ clk_disable_unprepare(rx->dcodec); ++err_dcodec: ++ clk_disable_unprepare(rx->macro); + err: +- clk_bulk_disable_unprepare(RX_NUM_CLKS_MAX, rx->clks); + return ret; + } + +@@ -3579,7 +3617,12 @@ static int rx_macro_remove(struct platform_device *pdev) + { + struct rx_macro *rx = dev_get_drvdata(&pdev->dev); + +- clk_bulk_disable_unprepare(RX_NUM_CLKS_MAX, rx->clks); ++ clk_disable_unprepare(rx->mclk); ++ clk_disable_unprepare(rx->npl); ++ clk_disable_unprepare(rx->fsgen); ++ clk_disable_unprepare(rx->macro); ++ clk_disable_unprepare(rx->dcodec); ++ + return 0; + } + +-- +2.39.2 + diff --git a/queue-5.15/asoc-codecs-tx-macro-move-clk-provider-to-managed-va.patch b/queue-5.15/asoc-codecs-tx-macro-move-clk-provider-to-managed-va.patch new file mode 100644 index 00000000000..bbbb1dc012e --- /dev/null +++ b/queue-5.15/asoc-codecs-tx-macro-move-clk-provider-to-managed-va.patch @@ -0,0 +1,77 @@ +From 9cccf7a793ec5694709cc0efb59495b7e646249b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Feb 2022 11:17:05 +0000 +Subject: ASoC: codecs: tx-macro: move clk provider to managed variants + +From: Srinivas Kandagatla + +[ Upstream commit db8665a3e904f579840417f9414415c4dd54ac84 ] + +move clk provider registration to managed api variants, this should help +with some code tidyup. + +Signed-off-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20220224111718.6264-4-srinivas.kandagatla@linaro.org +Signed-off-by: Mark Brown +Stable-dep-of: e7621434378c ("ASoC: codecs: lpass: fix incorrect mclk rate") +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/lpass-tx-macro.c | 17 +++++++---------- + 1 file changed, 7 insertions(+), 10 deletions(-) + +diff --git a/sound/soc/codecs/lpass-tx-macro.c b/sound/soc/codecs/lpass-tx-macro.c +index 8d1126802ddfa..4192f91612e16 100644 +--- a/sound/soc/codecs/lpass-tx-macro.c ++++ b/sound/soc/codecs/lpass-tx-macro.c +@@ -1745,10 +1745,9 @@ static const struct clk_ops swclk_gate_ops = { + + }; + +-static struct clk *tx_macro_register_mclk_output(struct tx_macro *tx) ++static int tx_macro_register_mclk_output(struct tx_macro *tx) + { + struct device *dev = tx->dev; +- struct device_node *np = dev->of_node; + const char *parent_clk_name = NULL; + const char *clk_name = "lpass-tx-mclk"; + struct clk_hw *hw; +@@ -1764,13 +1763,11 @@ static struct clk *tx_macro_register_mclk_output(struct tx_macro *tx) + init.num_parents = 1; + tx->hw.init = &init; + hw = &tx->hw; +- ret = clk_hw_register(tx->dev, hw); ++ ret = devm_clk_hw_register(dev, hw); + if (ret) +- return ERR_PTR(ret); +- +- of_clk_add_provider(np, of_clk_src_simple_get, hw->clk); ++ return ret; + +- return NULL; ++ return devm_of_clk_add_hw_provider(dev, of_clk_hw_simple_get, hw); + } + + static const struct snd_soc_component_driver tx_macro_component_drv = { +@@ -1828,7 +1825,9 @@ static int tx_macro_probe(struct platform_device *pdev) + if (ret) + return ret; + +- tx_macro_register_mclk_output(tx); ++ ret = tx_macro_register_mclk_output(tx); ++ if (ret) ++ goto err; + + ret = devm_snd_soc_register_component(dev, &tx_macro_component_drv, + tx_macro_dai, +@@ -1846,8 +1845,6 @@ static int tx_macro_remove(struct platform_device *pdev) + { + struct tx_macro *tx = dev_get_drvdata(&pdev->dev); + +- of_clk_del_provider(pdev->dev.of_node); +- + clk_bulk_disable_unprepare(TX_NUM_CLKS_MAX, tx->clks); + + return 0; +-- +2.39.2 + diff --git a/queue-5.15/asoc-codecs-tx-macro-move-to-individual-clks-from-bu.patch b/queue-5.15/asoc-codecs-tx-macro-move-to-individual-clks-from-bu.patch new file mode 100644 index 00000000000..1043f2cc3ce --- /dev/null +++ b/queue-5.15/asoc-codecs-tx-macro-move-to-individual-clks-from-bu.patch @@ -0,0 +1,171 @@ +From d910f65d400b22c8f8f2ac3f8bac20227bf5f724 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Feb 2022 11:17:07 +0000 +Subject: ASoC: codecs: tx-macro: move to individual clks from bulk + +From: Srinivas Kandagatla + +[ Upstream commit 512864c4ffa70522b9c44d5b40c15273330ae9c7 ] + +Using bulk clocks and referencing them individually using array index is +not great for readers. +So move them to individual clocks handling and also remove some unnecessary +error handling in the code. + +Signed-off-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20220224111718.6264-6-srinivas.kandagatla@linaro.org +Signed-off-by: Mark Brown +Stable-dep-of: e7621434378c ("ASoC: codecs: lpass: fix incorrect mclk rate") +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/lpass-tx-macro.c | 87 +++++++++++++++++++++++-------- + 1 file changed, 65 insertions(+), 22 deletions(-) + +diff --git a/sound/soc/codecs/lpass-tx-macro.c b/sound/soc/codecs/lpass-tx-macro.c +index 4192f91612e16..d604e2b0109b0 100644 +--- a/sound/soc/codecs/lpass-tx-macro.c ++++ b/sound/soc/codecs/lpass-tx-macro.c +@@ -6,6 +6,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -258,7 +259,11 @@ struct tx_macro { + unsigned long active_ch_cnt[TX_MACRO_MAX_DAIS]; + unsigned long active_decimator[TX_MACRO_MAX_DAIS]; + struct regmap *regmap; +- struct clk_bulk_data clks[TX_NUM_CLKS_MAX]; ++ struct clk *mclk; ++ struct clk *npl; ++ struct clk *macro; ++ struct clk *dcodec; ++ struct clk *fsgen; + struct clk_hw hw; + bool dec_active[NUM_DECIMATORS]; + bool reset_swr; +@@ -1754,7 +1759,7 @@ static int tx_macro_register_mclk_output(struct tx_macro *tx) + struct clk_init_data init; + int ret; + +- parent_clk_name = __clk_get_name(tx->clks[2].clk); ++ parent_clk_name = __clk_get_name(tx->mclk); + + init.name = clk_name; + init.ops = &swclk_gate_ops; +@@ -1792,17 +1797,25 @@ static int tx_macro_probe(struct platform_device *pdev) + if (!tx) + return -ENOMEM; + +- tx->clks[0].id = "macro"; +- tx->clks[1].id = "dcodec"; +- tx->clks[2].id = "mclk"; +- tx->clks[3].id = "npl"; +- tx->clks[4].id = "fsgen"; ++ tx->macro = devm_clk_get_optional(dev, "macro"); ++ if (IS_ERR(tx->macro)) ++ return PTR_ERR(tx->macro); + +- ret = devm_clk_bulk_get_optional(dev, TX_NUM_CLKS_MAX, tx->clks); +- if (ret) { +- dev_err(dev, "Error getting RX Clocks (%d)\n", ret); +- return ret; +- } ++ tx->dcodec = devm_clk_get_optional(dev, "dcodec"); ++ if (IS_ERR(tx->dcodec)) ++ return PTR_ERR(tx->dcodec); ++ ++ tx->mclk = devm_clk_get(dev, "mclk"); ++ if (IS_ERR(tx->mclk)) ++ return PTR_ERR(tx->mclk); ++ ++ tx->npl = devm_clk_get(dev, "npl"); ++ if (IS_ERR(tx->npl)) ++ return PTR_ERR(tx->npl); ++ ++ tx->fsgen = devm_clk_get(dev, "fsgen"); ++ if (IS_ERR(tx->fsgen)) ++ return PTR_ERR(tx->fsgen); + + base = devm_platform_ioremap_resource(pdev, 0); + if (IS_ERR(base)) +@@ -1818,26 +1831,52 @@ static int tx_macro_probe(struct platform_device *pdev) + tx->dev = dev; + + /* set MCLK and NPL rates */ +- clk_set_rate(tx->clks[2].clk, MCLK_FREQ); +- clk_set_rate(tx->clks[3].clk, 2 * MCLK_FREQ); ++ clk_set_rate(tx->mclk, MCLK_FREQ); ++ clk_set_rate(tx->npl, 2 * MCLK_FREQ); + +- ret = clk_bulk_prepare_enable(TX_NUM_CLKS_MAX, tx->clks); ++ ret = clk_prepare_enable(tx->macro); + if (ret) +- return ret; ++ goto err; ++ ++ ret = clk_prepare_enable(tx->dcodec); ++ if (ret) ++ goto err_dcodec; ++ ++ ret = clk_prepare_enable(tx->mclk); ++ if (ret) ++ goto err_mclk; ++ ++ ret = clk_prepare_enable(tx->npl); ++ if (ret) ++ goto err_npl; ++ ++ ret = clk_prepare_enable(tx->fsgen); ++ if (ret) ++ goto err_fsgen; + + ret = tx_macro_register_mclk_output(tx); + if (ret) +- goto err; ++ goto err_clkout; + + ret = devm_snd_soc_register_component(dev, &tx_macro_component_drv, + tx_macro_dai, + ARRAY_SIZE(tx_macro_dai)); + if (ret) +- goto err; +- return ret; +-err: +- clk_bulk_disable_unprepare(TX_NUM_CLKS_MAX, tx->clks); ++ goto err_clkout; + ++ return 0; ++ ++err_clkout: ++ clk_disable_unprepare(tx->fsgen); ++err_fsgen: ++ clk_disable_unprepare(tx->npl); ++err_npl: ++ clk_disable_unprepare(tx->mclk); ++err_mclk: ++ clk_disable_unprepare(tx->dcodec); ++err_dcodec: ++ clk_disable_unprepare(tx->macro); ++err: + return ret; + } + +@@ -1845,7 +1884,11 @@ static int tx_macro_remove(struct platform_device *pdev) + { + struct tx_macro *tx = dev_get_drvdata(&pdev->dev); + +- clk_bulk_disable_unprepare(TX_NUM_CLKS_MAX, tx->clks); ++ clk_disable_unprepare(tx->macro); ++ clk_disable_unprepare(tx->dcodec); ++ clk_disable_unprepare(tx->mclk); ++ clk_disable_unprepare(tx->npl); ++ clk_disable_unprepare(tx->fsgen); + + return 0; + } +-- +2.39.2 + diff --git a/queue-5.15/asoc-dt-bindings-meson-fix-gx-card-codec-node-regex.patch b/queue-5.15/asoc-dt-bindings-meson-fix-gx-card-codec-node-regex.patch new file mode 100644 index 00000000000..9e0bed306fd --- /dev/null +++ b/queue-5.15/asoc-dt-bindings-meson-fix-gx-card-codec-node-regex.patch @@ -0,0 +1,38 @@ +From 9cb4ac0cde2ccc61c7f3aea0896cff37a225220c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Feb 2023 19:36:46 +0100 +Subject: ASoC: dt-bindings: meson: fix gx-card codec node regex + +From: Jerome Brunet + +[ Upstream commit 480b26226873c88e482575ceb0d0a38d76e1be57 ] + +'codec' is a valid node name when there is a single codec +in the link. Fix the node regular expression to apply this. + +Fixes: fd00366b8e41 ("ASoC: meson: gx: add sound card dt-binding documentation") +Signed-off-by: Jerome Brunet +Reviewed-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20230202183653.486216-3-jbrunet@baylibre.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + .../devicetree/bindings/sound/amlogic,gx-sound-card.yaml | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/Documentation/devicetree/bindings/sound/amlogic,gx-sound-card.yaml b/Documentation/devicetree/bindings/sound/amlogic,gx-sound-card.yaml +index 2e35aeaa8781d..89e3819c6127a 100644 +--- a/Documentation/devicetree/bindings/sound/amlogic,gx-sound-card.yaml ++++ b/Documentation/devicetree/bindings/sound/amlogic,gx-sound-card.yaml +@@ -61,7 +61,7 @@ patternProperties: + description: phandle of the CPU DAI + + patternProperties: +- "^codec-[0-9]+$": ++ "^codec(-[0-9]+)?$": + type: object + description: |- + Codecs: +-- +2.39.2 + diff --git a/queue-5.15/asoc-fsl_sai-initialize-is_dsp_mode-flag.patch b/queue-5.15/asoc-fsl_sai-initialize-is_dsp_mode-flag.patch new file mode 100644 index 00000000000..80c16c0c774 --- /dev/null +++ b/queue-5.15/asoc-fsl_sai-initialize-is_dsp_mode-flag.patch @@ -0,0 +1,42 @@ +From 7d336e0e7b0d3123eab6175af621c54c2bbab854 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Jan 2023 15:07:54 +0800 +Subject: ASoC: fsl_sai: initialize is_dsp_mode flag + +From: Shengjiu Wang + +[ Upstream commit a23924b7dd7b748fff8e305e1daf590fed2af21b ] + +Initialize is_dsp_mode flag in the beginning of function +fsl_sai_set_dai_fmt_tr(). + +When the DAIFMT is DAIFMT_DSP_B the first time, is_dsp_mode is +true, then the second time DAIFMT is DAIFMT_I2S, is_dsp_mode +still true, which is a wrong state. So need to initialize +is_dsp_mode flag every time. + +Fixes: a3f7dcc9cc03 ("ASoC: fsl-sai: Add SND_SOC_DAIFMT_DSP_A/B support.") +Signed-off-by: Shengjiu Wang +Reviewed-by: Iuliana Prodan +Link: https://lore.kernel.org/r/1673852874-32200-1-git-send-email-shengjiu.wang@nxp.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/fsl/fsl_sai.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/soc/fsl/fsl_sai.c b/sound/soc/fsl/fsl_sai.c +index 5ec504ff060a5..6a12cbd43084b 100644 +--- a/sound/soc/fsl/fsl_sai.c ++++ b/sound/soc/fsl/fsl_sai.c +@@ -231,6 +231,7 @@ static int fsl_sai_set_dai_fmt_tr(struct snd_soc_dai *cpu_dai, + if (!sai->is_lsb_first) + val_cr4 |= FSL_SAI_CR4_MF; + ++ sai->is_dsp_mode = false; + /* DAI mode */ + switch (fmt & SND_SOC_DAIFMT_FORMAT_MASK) { + case SND_SOC_DAIFMT_I2S: +-- +2.39.2 + diff --git a/queue-5.15/asoc-fsl_sai-update-to-modern-clocking-terminology.patch b/queue-5.15/asoc-fsl_sai-update-to-modern-clocking-terminology.patch new file mode 100644 index 00000000000..5b261c2a638 --- /dev/null +++ b/queue-5.15/asoc-fsl_sai-update-to-modern-clocking-terminology.patch @@ -0,0 +1,130 @@ +From c7771c61ac6bc6a229c1855926d413113dd04a9e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Sep 2021 22:35:32 +0100 +Subject: ASoC: fsl_sai: Update to modern clocking terminology + +From: Mark Brown + +[ Upstream commit 361284a4eb598eaf28e8458c542f214d3689b134 ] + +As part of moving to remove the old style defines for the bus clocks update +the fsl_sai driver to use more modern terminology for clocking. + +Signed-off-by: Mark Brown +Reviewed-by: Fabio Estevam +Link: https://lore.kernel.org/r/20210921213542.31688-6-broonie@kernel.org +Signed-off-by: Mark Brown +Stable-dep-of: a23924b7dd7b ("ASoC: fsl_sai: initialize is_dsp_mode flag") +Signed-off-by: Sasha Levin +--- + sound/soc/fsl/fsl_sai.c | 34 +++++++++++++++++----------------- + sound/soc/fsl/fsl_sai.h | 2 +- + 2 files changed, 18 insertions(+), 18 deletions(-) + +diff --git a/sound/soc/fsl/fsl_sai.c b/sound/soc/fsl/fsl_sai.c +index 5ba06df2ace51..5ec504ff060a5 100644 +--- a/sound/soc/fsl/fsl_sai.c ++++ b/sound/soc/fsl/fsl_sai.c +@@ -297,23 +297,23 @@ static int fsl_sai_set_dai_fmt_tr(struct snd_soc_dai *cpu_dai, + return -EINVAL; + } + +- /* DAI clock master masks */ +- switch (fmt & SND_SOC_DAIFMT_MASTER_MASK) { +- case SND_SOC_DAIFMT_CBS_CFS: ++ /* DAI clock provider masks */ ++ switch (fmt & SND_SOC_DAIFMT_CLOCK_PROVIDER_MASK) { ++ case SND_SOC_DAIFMT_CBC_CFC: + val_cr2 |= FSL_SAI_CR2_BCD_MSTR; + val_cr4 |= FSL_SAI_CR4_FSD_MSTR; +- sai->is_slave_mode = false; ++ sai->is_consumer_mode = false; + break; +- case SND_SOC_DAIFMT_CBM_CFM: +- sai->is_slave_mode = true; ++ case SND_SOC_DAIFMT_CBP_CFP: ++ sai->is_consumer_mode = true; + break; +- case SND_SOC_DAIFMT_CBS_CFM: ++ case SND_SOC_DAIFMT_CBC_CFP: + val_cr2 |= FSL_SAI_CR2_BCD_MSTR; +- sai->is_slave_mode = false; ++ sai->is_consumer_mode = false; + break; +- case SND_SOC_DAIFMT_CBM_CFS: ++ case SND_SOC_DAIFMT_CBP_CFC: + val_cr4 |= FSL_SAI_CR4_FSD_MSTR; +- sai->is_slave_mode = true; ++ sai->is_consumer_mode = true; + break; + default: + return -EINVAL; +@@ -356,8 +356,8 @@ static int fsl_sai_set_bclk(struct snd_soc_dai *dai, bool tx, u32 freq) + u32 id; + int ret = 0; + +- /* Don't apply to slave mode */ +- if (sai->is_slave_mode) ++ /* Don't apply to consumer mode */ ++ if (sai->is_consumer_mode) + return 0; + + /* +@@ -462,7 +462,7 @@ static int fsl_sai_hw_params(struct snd_pcm_substream *substream, + + pins = DIV_ROUND_UP(channels, slots); + +- if (!sai->is_slave_mode) { ++ if (!sai->is_consumer_mode) { + if (sai->bclk_ratio) + ret = fsl_sai_set_bclk(cpu_dai, tx, + sai->bclk_ratio * +@@ -502,12 +502,12 @@ static int fsl_sai_hw_params(struct snd_pcm_substream *substream, + val_cr4 |= FSL_SAI_CR4_CHMOD; + + /* +- * For SAI master mode, when Tx(Rx) sync with Rx(Tx) clock, Rx(Tx) will ++ * For SAI provider mode, when Tx(Rx) sync with Rx(Tx) clock, Rx(Tx) will + * generate bclk and frame clock for Tx(Rx), we should set RCR4(TCR4), + * RCR5(TCR5) for playback(capture), or there will be sync error. + */ + +- if (!sai->is_slave_mode && fsl_sai_dir_is_synced(sai, adir)) { ++ if (!sai->is_consumer_mode && fsl_sai_dir_is_synced(sai, adir)) { + regmap_update_bits(sai->regmap, FSL_SAI_xCR4(!tx, ofs), + FSL_SAI_CR4_SYWD_MASK | FSL_SAI_CR4_FRSZ_MASK | + FSL_SAI_CR4_CHMOD_MASK, +@@ -543,7 +543,7 @@ static int fsl_sai_hw_free(struct snd_pcm_substream *substream, + regmap_update_bits(sai->regmap, FSL_SAI_xCR3(tx, ofs), + FSL_SAI_CR3_TRCE_MASK, 0); + +- if (!sai->is_slave_mode && ++ if (!sai->is_consumer_mode && + sai->mclk_streams & BIT(substream->stream)) { + clk_disable_unprepare(sai->mclk_clk[sai->mclk_id[tx]]); + sai->mclk_streams &= ~BIT(substream->stream); +@@ -577,7 +577,7 @@ static void fsl_sai_config_disable(struct fsl_sai *sai, int dir) + * This is a hardware bug, and will be fix in the + * next sai version. + */ +- if (!sai->is_slave_mode) { ++ if (!sai->is_consumer_mode) { + /* Software Reset */ + regmap_write(sai->regmap, FSL_SAI_xCSR(tx, ofs), FSL_SAI_CSR_SR); + /* Clear SR bit to finish the reset */ +diff --git a/sound/soc/fsl/fsl_sai.h b/sound/soc/fsl/fsl_sai.h +index f471467dfb3e4..93da86009c750 100644 +--- a/sound/soc/fsl/fsl_sai.h ++++ b/sound/soc/fsl/fsl_sai.h +@@ -259,7 +259,7 @@ struct fsl_sai { + struct clk *bus_clk; + struct clk *mclk_clk[FSL_SAI_MCLK_MAX]; + +- bool is_slave_mode; ++ bool is_consumer_mode; + bool is_lsb_first; + bool is_dsp_mode; + bool synchronous[2]; +-- +2.39.2 + diff --git a/queue-5.15/asoc-kirkwood-iterate-over-array-indexes-instead-of-.patch b/queue-5.15/asoc-kirkwood-iterate-over-array-indexes-instead-of-.patch new file mode 100644 index 00000000000..8d7809ba0e6 --- /dev/null +++ b/queue-5.15/asoc-kirkwood-iterate-over-array-indexes-instead-of-.patch @@ -0,0 +1,50 @@ +From d3ea735cfd9f313c856d2910abdbf9cb2a29b87b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Jan 2023 14:41:29 -0800 +Subject: ASoC: kirkwood: Iterate over array indexes instead of using pointer + math + +From: Kees Cook + +[ Upstream commit b3bcedc0402fcdc5c8624c433562d9d1882749d8 ] + +Walking the dram->cs array was seen as accesses beyond the first array +item by the compiler. Instead, use the array index directly. This allows +for run-time bounds checking under CONFIG_UBSAN_BOUNDS as well. Seen +with GCC 13 with -fstrict-flex-arrays: + +../sound/soc/kirkwood/kirkwood-dma.c: In function +'kirkwood_dma_conf_mbus_windows.constprop': +../sound/soc/kirkwood/kirkwood-dma.c:90:24: warning: array subscript 0 is outside array bounds of 'const struct mbus_dram_window[0]' [-Warray-bounds=] + 90 | if ((cs->base & 0xffff0000) < (dma & 0xffff0000)) { + | ~~^~~~~~ + +Cc: Liam Girdwood +Cc: Mark Brown +Cc: Jaroslav Kysela +Cc: Takashi Iwai +Cc: alsa-devel@alsa-project.org +Signed-off-by: Kees Cook +Link: https://lore.kernel.org/r/20230127224128.never.410-kees@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/kirkwood/kirkwood-dma.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/kirkwood/kirkwood-dma.c b/sound/soc/kirkwood/kirkwood-dma.c +index 700a18561a940..640cebd2983e2 100644 +--- a/sound/soc/kirkwood/kirkwood-dma.c ++++ b/sound/soc/kirkwood/kirkwood-dma.c +@@ -86,7 +86,7 @@ kirkwood_dma_conf_mbus_windows(void __iomem *base, int win, + + /* try to find matching cs for current dma address */ + for (i = 0; i < dram->num_cs; i++) { +- const struct mbus_dram_window *cs = dram->cs + i; ++ const struct mbus_dram_window *cs = &dram->cs[i]; + if ((cs->base & 0xffff0000) < (dma & 0xffff0000)) { + writel(cs->base & 0xffff0000, + base + KIRKWOOD_AUDIO_WIN_BASE_REG(win)); +-- +2.39.2 + diff --git a/queue-5.15/asoc-mchp-spdifrx-disable-all-interrupts-in-mchp_spd.patch b/queue-5.15/asoc-mchp-spdifrx-disable-all-interrupts-in-mchp_spd.patch new file mode 100644 index 00000000000..56d40edf93b --- /dev/null +++ b/queue-5.15/asoc-mchp-spdifrx-disable-all-interrupts-in-mchp_spd.patch @@ -0,0 +1,39 @@ +From 1f5711c1a76acf4c685287017531dd397bd30386 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Jan 2023 14:06:43 +0200 +Subject: ASoC: mchp-spdifrx: disable all interrupts in + mchp_spdifrx_dai_remove() + +From: Claudiu Beznea + +[ Upstream commit aaecdc32b7e35b4f9b457fb3509414aa9a932589 ] + +CSC interrupts which might be used in controls are on bits 8 and 9 of +SPDIFRX_IDR register. Thus disable all the interrupts that are exported +by driver. + +Fixes: ef265c55c1ac ("ASoC: mchp-spdifrx: add driver for SPDIF RX") +Signed-off-by: Claudiu Beznea +Link: https://lore.kernel.org/r/20230130120647.638049-5-claudiu.beznea@microchip.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/atmel/mchp-spdifrx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/atmel/mchp-spdifrx.c b/sound/soc/atmel/mchp-spdifrx.c +index eb1b8724e11f4..03b7037239b85 100644 +--- a/sound/soc/atmel/mchp-spdifrx.c ++++ b/sound/soc/atmel/mchp-spdifrx.c +@@ -921,7 +921,7 @@ static int mchp_spdifrx_dai_remove(struct snd_soc_dai *dai) + struct mchp_spdifrx_dev *dev = snd_soc_dai_get_drvdata(dai); + + /* Disable interrupts */ +- regmap_write(dev->regmap, SPDIFRX_IDR, 0xFF); ++ regmap_write(dev->regmap, SPDIFRX_IDR, GENMASK(14, 0)); + + clk_disable_unprepare(dev->pclk); + +-- +2.39.2 + diff --git a/queue-5.15/asoc-mchp-spdifrx-fix-controls-that-works-with-compl.patch b/queue-5.15/asoc-mchp-spdifrx-fix-controls-that-works-with-compl.patch new file mode 100644 index 00000000000..bb346fbd600 --- /dev/null +++ b/queue-5.15/asoc-mchp-spdifrx-fix-controls-that-works-with-compl.patch @@ -0,0 +1,282 @@ +From ce8ac438385ceeceae077a2f85e240f584fdbd14 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Jan 2023 14:06:42 +0200 +Subject: ASoC: mchp-spdifrx: fix controls that works with completion mechanism + +From: Claudiu Beznea + +[ Upstream commit d3681df44e856aab523a6eb7ba15b5e41efcbb1c ] + +Channel status get and channel subcode get controls relies on data +returned by controls when certain IRQs are raised. To achieve that +completions are used b/w controls and interrupt service routine. The +concurrent accesses to these controls are protected by +struct snd_card::controls_rwsem. + +Issues identified: +- reinit_completion() may be called while waiting for completion + which should be avoided +- in case of multiple threads waiting, the complete() call in interrupt + will signal only one waiting thread per interrupt which may lead to + timeout for the others +- in case of channel status get as the CSC interrupt is not refcounted + ISR may disable interrupt for threads that were just enabled it. + +To solve these the access to controls were protected by a mutex. Along +with this there is no need for spinlock to protect the software cache +reads/updates b/w controls and ISR as the update is happening only when +requested from control, and only one reader can reach the control. + +Fixes: ef265c55c1ac ("ASoC: mchp-spdifrx: add driver for SPDIF RX") +Signed-off-by: Claudiu Beznea +Link: https://lore.kernel.org/r/20230130120647.638049-4-claudiu.beznea@microchip.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/atmel/mchp-spdifrx.c | 143 ++++++++++++++++++--------------- + 1 file changed, 77 insertions(+), 66 deletions(-) + +diff --git a/sound/soc/atmel/mchp-spdifrx.c b/sound/soc/atmel/mchp-spdifrx.c +index 076a78fd0b125..eb1b8724e11f4 100644 +--- a/sound/soc/atmel/mchp-spdifrx.c ++++ b/sound/soc/atmel/mchp-spdifrx.c +@@ -217,7 +217,6 @@ struct mchp_spdifrx_ch_stat { + struct mchp_spdifrx_user_data { + unsigned char data[SPDIFRX_UD_BITS / 8]; + struct completion done; +- spinlock_t lock; /* protect access to user data */ + }; + + struct mchp_spdifrx_mixer_control { +@@ -231,8 +230,6 @@ struct mchp_spdifrx_mixer_control { + struct mchp_spdifrx_dev { + struct snd_dmaengine_dai_dma_data capture; + struct mchp_spdifrx_mixer_control control; +- spinlock_t blockend_lock; /* protect access to blockend_refcount */ +- int blockend_refcount; + struct mutex mlock; + struct device *dev; + struct regmap *regmap; +@@ -277,37 +274,11 @@ static void mchp_spdifrx_channel_user_data_read(struct mchp_spdifrx_dev *dev, + } + } + +-/* called from non-atomic context only */ +-static void mchp_spdifrx_isr_blockend_en(struct mchp_spdifrx_dev *dev) +-{ +- unsigned long flags; +- +- spin_lock_irqsave(&dev->blockend_lock, flags); +- dev->blockend_refcount++; +- /* don't enable BLOCKEND interrupt if it's already enabled */ +- if (dev->blockend_refcount == 1) +- regmap_write(dev->regmap, SPDIFRX_IER, SPDIFRX_IR_BLOCKEND); +- spin_unlock_irqrestore(&dev->blockend_lock, flags); +-} +- +-/* called from atomic/non-atomic context */ +-static void mchp_spdifrx_isr_blockend_dis(struct mchp_spdifrx_dev *dev) +-{ +- unsigned long flags; +- +- spin_lock_irqsave(&dev->blockend_lock, flags); +- dev->blockend_refcount--; +- /* don't enable BLOCKEND interrupt if it's already enabled */ +- if (dev->blockend_refcount == 0) +- regmap_write(dev->regmap, SPDIFRX_IDR, SPDIFRX_IR_BLOCKEND); +- spin_unlock_irqrestore(&dev->blockend_lock, flags); +-} +- + static irqreturn_t mchp_spdif_interrupt(int irq, void *dev_id) + { + struct mchp_spdifrx_dev *dev = dev_id; + struct mchp_spdifrx_mixer_control *ctrl = &dev->control; +- u32 sr, imr, pending, idr = 0; ++ u32 sr, imr, pending; + irqreturn_t ret = IRQ_NONE; + int ch; + +@@ -322,13 +293,10 @@ static irqreturn_t mchp_spdif_interrupt(int irq, void *dev_id) + + if (pending & SPDIFRX_IR_BLOCKEND) { + for (ch = 0; ch < SPDIFRX_CHANNELS; ch++) { +- spin_lock(&ctrl->user_data[ch].lock); + mchp_spdifrx_channel_user_data_read(dev, ch); +- spin_unlock(&ctrl->user_data[ch].lock); +- + complete(&ctrl->user_data[ch].done); + } +- mchp_spdifrx_isr_blockend_dis(dev); ++ regmap_write(dev->regmap, SPDIFRX_IDR, SPDIFRX_IR_BLOCKEND); + ret = IRQ_HANDLED; + } + +@@ -336,7 +304,7 @@ static irqreturn_t mchp_spdif_interrupt(int irq, void *dev_id) + if (pending & SPDIFRX_IR_CSC(ch)) { + mchp_spdifrx_channel_status_read(dev, ch); + complete(&ctrl->ch_stat[ch].done); +- idr |= SPDIFRX_IR_CSC(ch); ++ regmap_write(dev->regmap, SPDIFRX_IDR, SPDIFRX_IR_CSC(ch)); + ret = IRQ_HANDLED; + } + } +@@ -346,8 +314,6 @@ static irqreturn_t mchp_spdif_interrupt(int irq, void *dev_id) + ret = IRQ_HANDLED; + } + +- regmap_write(dev->regmap, SPDIFRX_IDR, idr); +- + return ret; + } + +@@ -517,23 +483,51 @@ static int mchp_spdifrx_cs_get(struct mchp_spdifrx_dev *dev, + { + struct mchp_spdifrx_mixer_control *ctrl = &dev->control; + struct mchp_spdifrx_ch_stat *ch_stat = &ctrl->ch_stat[channel]; +- int ret; ++ int ret = 0; ++ ++ mutex_lock(&dev->mlock); + +- regmap_write(dev->regmap, SPDIFRX_IER, SPDIFRX_IR_CSC(channel)); +- /* check for new data available */ +- ret = wait_for_completion_interruptible_timeout(&ch_stat->done, +- msecs_to_jiffies(100)); +- /* IP might not be started or valid stream might not be present */ +- if (ret <= 0) { +- dev_dbg(dev->dev, "channel status for channel %d timeout\n", +- channel); +- return ret ? : -ETIMEDOUT; ++ /* ++ * We may reach this point with both clocks enabled but the receiver ++ * still disabled. To void waiting for completion and return with ++ * timeout check the dev->trigger_enabled. ++ * ++ * To retrieve data: ++ * - if the receiver is enabled CSC IRQ will update the data in software ++ * caches (ch_stat->data) ++ * - otherwise we just update it here the software caches with latest ++ * available information and return it; in this case we don't need ++ * spin locking as the IRQ is disabled and will not be raised from ++ * anywhere else. ++ */ ++ ++ if (dev->trigger_enabled) { ++ reinit_completion(&ch_stat->done); ++ regmap_write(dev->regmap, SPDIFRX_IER, SPDIFRX_IR_CSC(channel)); ++ /* Check for new data available */ ++ ret = wait_for_completion_interruptible_timeout(&ch_stat->done, ++ msecs_to_jiffies(100)); ++ /* Valid stream might not be present */ ++ if (ret <= 0) { ++ dev_dbg(dev->dev, "channel status for channel %d timeout\n", ++ channel); ++ regmap_write(dev->regmap, SPDIFRX_IDR, SPDIFRX_IR_CSC(channel)); ++ ret = ret ? : -ETIMEDOUT; ++ goto unlock; ++ } else { ++ ret = 0; ++ } ++ } else { ++ /* Update software cache with latest channel status. */ ++ mchp_spdifrx_channel_status_read(dev, channel); + } + + memcpy(uvalue->value.iec958.status, ch_stat->data, + sizeof(ch_stat->data)); + +- return 0; ++unlock: ++ mutex_unlock(&dev->mlock); ++ return ret; + } + + static int mchp_spdifrx_cs1_get(struct snd_kcontrol *kcontrol, +@@ -567,29 +561,49 @@ static int mchp_spdifrx_subcode_ch_get(struct mchp_spdifrx_dev *dev, + int channel, + struct snd_ctl_elem_value *uvalue) + { +- unsigned long flags; + struct mchp_spdifrx_mixer_control *ctrl = &dev->control; + struct mchp_spdifrx_user_data *user_data = &ctrl->user_data[channel]; +- int ret; ++ int ret = 0; ++ ++ mutex_lock(&dev->mlock); ++ ++ /* ++ * We may reach this point with both clocks enabled but the receiver ++ * still disabled. To void waiting for completion to just timeout we ++ * check here the dev->trigger_enabled flag. ++ * ++ * To retrieve data: ++ * - if the receiver is enabled we need to wait for blockend IRQ to read ++ * data to and update it for us in software caches ++ * - otherwise reading the SPDIFRX_CHUD() registers is enough. ++ */ + +- reinit_completion(&user_data->done); +- mchp_spdifrx_isr_blockend_en(dev); +- ret = wait_for_completion_interruptible_timeout(&user_data->done, +- msecs_to_jiffies(100)); +- /* IP might not be started or valid stream might not be present */ +- if (ret <= 0) { +- dev_dbg(dev->dev, "user data for channel %d timeout\n", +- channel); +- mchp_spdifrx_isr_blockend_dis(dev); +- return ret ? : -ETIMEDOUT; ++ if (dev->trigger_enabled) { ++ reinit_completion(&user_data->done); ++ regmap_write(dev->regmap, SPDIFRX_IER, SPDIFRX_IR_BLOCKEND); ++ ret = wait_for_completion_interruptible_timeout(&user_data->done, ++ msecs_to_jiffies(100)); ++ /* Valid stream might not be present. */ ++ if (ret <= 0) { ++ dev_dbg(dev->dev, "user data for channel %d timeout\n", ++ channel); ++ regmap_write(dev->regmap, SPDIFRX_IDR, SPDIFRX_IR_BLOCKEND); ++ ret = ret ? : -ETIMEDOUT; ++ goto unlock; ++ } else { ++ ret = 0; ++ } ++ } else { ++ /* Update software cache with last available data. */ ++ mchp_spdifrx_channel_user_data_read(dev, channel); + } + +- spin_lock_irqsave(&user_data->lock, flags); + memcpy(uvalue->value.iec958.subcode, user_data->data, + sizeof(user_data->data)); +- spin_unlock_irqrestore(&user_data->lock, flags); + +- return 0; ++unlock: ++ mutex_unlock(&dev->mlock); ++ return ret; + } + + static int mchp_spdifrx_subcode_ch1_get(struct snd_kcontrol *kcontrol, +@@ -890,11 +904,9 @@ static int mchp_spdifrx_dai_probe(struct snd_soc_dai *dai) + SPDIFRX_MR_AUTORST_NOACTION | + SPDIFRX_MR_PACK_DISABLED); + +- dev->blockend_refcount = 0; + for (ch = 0; ch < SPDIFRX_CHANNELS; ch++) { + init_completion(&ctrl->ch_stat[ch].done); + init_completion(&ctrl->user_data[ch].done); +- spin_lock_init(&ctrl->user_data[ch].lock); + } + + /* Add controls */ +@@ -1004,7 +1016,6 @@ static int mchp_spdifrx_probe(struct platform_device *pdev) + */ + clk_set_min_rate(dev->gclk, 48000 * SPDIFRX_GCLK_RATIO_MIN + 1); + +- spin_lock_init(&dev->blockend_lock); + mutex_init(&dev->mlock); + + dev->dev = &pdev->dev; +-- +2.39.2 + diff --git a/queue-5.15/asoc-mchp-spdifrx-fix-controls-which-rely-on-rsr-reg.patch b/queue-5.15/asoc-mchp-spdifrx-fix-controls-which-rely-on-rsr-reg.patch new file mode 100644 index 00000000000..cf3f0e7906a --- /dev/null +++ b/queue-5.15/asoc-mchp-spdifrx-fix-controls-which-rely-on-rsr-reg.patch @@ -0,0 +1,365 @@ +From 627c8c4adb8b2f8453a136fd0a557813aebc0552 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Jan 2023 14:06:40 +0200 +Subject: ASoC: mchp-spdifrx: fix controls which rely on rsr register + +From: Claudiu Beznea + +[ Upstream commit fa09fa60385abbf99342494b280da8b4aebbc0e9 ] + +The SPDIFRX block is clocked by 2 clocks: peripheral and generic clocks. +Peripheral clock feeds user interface (registers) and generic clock feeds +the receiver. + +To enable the receiver the generic clock needs to be enabled and also the +ENABLE bit of MCHP_SPDIFRX_MR register need to be set. + +The signal control exported by mchp-spdifrx driver reports wrong status +when the receiver is disabled. This can happen when requesting the signal +and the capture was not previously started. To solve this the receiver +needs to be enabled (by enabling generic clock and setting ENABLE bit of +MR register) before reading the signal status. + +As with this fix there are 2 paths now that need to control the generic +clock and ENABLE bit of SPDIFRX_MR register (one path though controls, one +path though configuration) a mutex has been introduced. We can't rely on +subsystem locking as the controls are protected by +struct snd_card::controls_rwsem semaphore and configuration is protected +by a different lock (embedded in snd_pcm_stream_lock_irq()). + +The introduction of mutex is also extended to other controls which rely on +SPDIFRX_RSR.ULOCK bit as it has been discovered experimentally that having +both clocks enabled but not the receiver (through ENABLE bit of SPDIFRX.MR) +leads to inconsistent values of SPDIFRX_RSR.ULOCK. Thus on some controls we +rely on software state (dev->trigger_enabled protected by mutex) to +retrieve proper values. + +Fixes: ef265c55c1ac ("ASoC: mchp-spdifrx: add driver for SPDIF RX") +Signed-off-by: Claudiu Beznea +Link: https://lore.kernel.org/r/20230130120647.638049-2-claudiu.beznea@microchip.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/atmel/mchp-spdifrx.c | 192 ++++++++++++++++++++++++--------- + 1 file changed, 142 insertions(+), 50 deletions(-) + +diff --git a/sound/soc/atmel/mchp-spdifrx.c b/sound/soc/atmel/mchp-spdifrx.c +index 2a62d9a2fa0d0..3962ce00ad34a 100644 +--- a/sound/soc/atmel/mchp-spdifrx.c ++++ b/sound/soc/atmel/mchp-spdifrx.c +@@ -233,11 +233,13 @@ struct mchp_spdifrx_dev { + struct mchp_spdifrx_mixer_control control; + spinlock_t blockend_lock; /* protect access to blockend_refcount */ + int blockend_refcount; ++ struct mutex mlock; + struct device *dev; + struct regmap *regmap; + struct clk *pclk; + struct clk *gclk; + unsigned int fmt; ++ unsigned int trigger_enabled; + unsigned int gclk_enabled:1; + }; + +@@ -353,47 +355,40 @@ static int mchp_spdifrx_trigger(struct snd_pcm_substream *substream, int cmd, + struct snd_soc_dai *dai) + { + struct mchp_spdifrx_dev *dev = snd_soc_dai_get_drvdata(dai); +- u32 mr; +- int running; +- int ret; +- +- regmap_read(dev->regmap, SPDIFRX_MR, &mr); +- running = !!(mr & SPDIFRX_MR_RXEN_ENABLE); ++ int ret = 0; + + switch (cmd) { + case SNDRV_PCM_TRIGGER_START: + case SNDRV_PCM_TRIGGER_RESUME: + case SNDRV_PCM_TRIGGER_PAUSE_RELEASE: +- if (!running) { +- mr &= ~SPDIFRX_MR_RXEN_MASK; +- mr |= SPDIFRX_MR_RXEN_ENABLE; +- /* enable overrun interrupts */ +- regmap_write(dev->regmap, SPDIFRX_IER, +- SPDIFRX_IR_OVERRUN); +- } ++ mutex_lock(&dev->mlock); ++ /* Enable overrun interrupts */ ++ regmap_write(dev->regmap, SPDIFRX_IER, SPDIFRX_IR_OVERRUN); ++ ++ /* Enable receiver. */ ++ regmap_update_bits(dev->regmap, SPDIFRX_MR, SPDIFRX_MR_RXEN_MASK, ++ SPDIFRX_MR_RXEN_ENABLE); ++ dev->trigger_enabled = true; ++ mutex_unlock(&dev->mlock); + break; + case SNDRV_PCM_TRIGGER_STOP: + case SNDRV_PCM_TRIGGER_SUSPEND: + case SNDRV_PCM_TRIGGER_PAUSE_PUSH: +- if (running) { +- mr &= ~SPDIFRX_MR_RXEN_MASK; +- mr |= SPDIFRX_MR_RXEN_DISABLE; +- /* disable overrun interrupts */ +- regmap_write(dev->regmap, SPDIFRX_IDR, +- SPDIFRX_IR_OVERRUN); +- } ++ mutex_lock(&dev->mlock); ++ /* Disable overrun interrupts */ ++ regmap_write(dev->regmap, SPDIFRX_IDR, SPDIFRX_IR_OVERRUN); ++ ++ /* Disable receiver. */ ++ regmap_update_bits(dev->regmap, SPDIFRX_MR, SPDIFRX_MR_RXEN_MASK, ++ SPDIFRX_MR_RXEN_DISABLE); ++ dev->trigger_enabled = false; ++ mutex_unlock(&dev->mlock); + break; + default: +- return -EINVAL; ++ ret = -EINVAL; + } + +- ret = regmap_write(dev->regmap, SPDIFRX_MR, mr); +- if (ret) { +- dev_err(dev->dev, "unable to enable/disable RX: %d\n", ret); +- return ret; +- } +- +- return 0; ++ return ret; + } + + static int mchp_spdifrx_hw_params(struct snd_pcm_substream *substream, +@@ -413,13 +408,6 @@ static int mchp_spdifrx_hw_params(struct snd_pcm_substream *substream, + return -EINVAL; + } + +- regmap_read(dev->regmap, SPDIFRX_MR, &mr); +- +- if (mr & SPDIFRX_MR_RXEN_ENABLE) { +- dev_err(dev->dev, "PCM already running\n"); +- return -EBUSY; +- } +- + if (params_channels(params) != SPDIFRX_CHANNELS) { + dev_err(dev->dev, "unsupported number of channels: %d\n", + params_channels(params)); +@@ -445,6 +433,13 @@ static int mchp_spdifrx_hw_params(struct snd_pcm_substream *substream, + return -EINVAL; + } + ++ mutex_lock(&dev->mlock); ++ if (dev->trigger_enabled) { ++ dev_err(dev->dev, "PCM already running\n"); ++ ret = -EBUSY; ++ goto unlock; ++ } ++ + if (dev->gclk_enabled) { + clk_disable_unprepare(dev->gclk); + dev->gclk_enabled = 0; +@@ -455,19 +450,24 @@ static int mchp_spdifrx_hw_params(struct snd_pcm_substream *substream, + dev_err(dev->dev, + "unable to set gclk min rate: rate %u * ratio %u + 1\n", + params_rate(params), SPDIFRX_GCLK_RATIO_MIN); +- return ret; ++ goto unlock; + } + ret = clk_prepare_enable(dev->gclk); + if (ret) { + dev_err(dev->dev, "unable to enable gclk: %d\n", ret); +- return ret; ++ goto unlock; + } + dev->gclk_enabled = 1; + + dev_dbg(dev->dev, "GCLK range min set to %d\n", + params_rate(params) * SPDIFRX_GCLK_RATIO_MIN + 1); + +- return regmap_write(dev->regmap, SPDIFRX_MR, mr); ++ ret = regmap_write(dev->regmap, SPDIFRX_MR, mr); ++ ++unlock: ++ mutex_unlock(&dev->mlock); ++ ++ return ret; + } + + static int mchp_spdifrx_hw_free(struct snd_pcm_substream *substream, +@@ -475,10 +475,12 @@ static int mchp_spdifrx_hw_free(struct snd_pcm_substream *substream, + { + struct mchp_spdifrx_dev *dev = snd_soc_dai_get_drvdata(dai); + ++ mutex_lock(&dev->mlock); + if (dev->gclk_enabled) { + clk_disable_unprepare(dev->gclk); + dev->gclk_enabled = 0; + } ++ mutex_unlock(&dev->mlock); + return 0; + } + +@@ -627,10 +629,24 @@ static int mchp_spdifrx_ulock_get(struct snd_kcontrol *kcontrol, + u32 val; + bool ulock_old = ctrl->ulock; + +- regmap_read(dev->regmap, SPDIFRX_RSR, &val); +- ctrl->ulock = !(val & SPDIFRX_RSR_ULOCK); ++ mutex_lock(&dev->mlock); ++ ++ /* ++ * The RSR.ULOCK has wrong value if both pclk and gclk are enabled ++ * and the receiver is disabled. Thus we take into account the ++ * dev->trigger_enabled here to return a real status. ++ */ ++ if (dev->trigger_enabled) { ++ regmap_read(dev->regmap, SPDIFRX_RSR, &val); ++ ctrl->ulock = !(val & SPDIFRX_RSR_ULOCK); ++ } else { ++ ctrl->ulock = 0; ++ } ++ + uvalue->value.integer.value[0] = ctrl->ulock; + ++ mutex_unlock(&dev->mlock); ++ + return ulock_old != ctrl->ulock; + } + +@@ -643,8 +659,22 @@ static int mchp_spdifrx_badf_get(struct snd_kcontrol *kcontrol, + u32 val; + bool badf_old = ctrl->badf; + +- regmap_read(dev->regmap, SPDIFRX_RSR, &val); +- ctrl->badf = !!(val & SPDIFRX_RSR_BADF); ++ mutex_lock(&dev->mlock); ++ ++ /* ++ * The RSR.ULOCK has wrong value if both pclk and gclk are enabled ++ * and the receiver is disabled. Thus we take into account the ++ * dev->trigger_enabled here to return a real status. ++ */ ++ if (dev->trigger_enabled) { ++ regmap_read(dev->regmap, SPDIFRX_RSR, &val); ++ ctrl->badf = !!(val & SPDIFRX_RSR_BADF); ++ } else { ++ ctrl->badf = 0; ++ } ++ ++ mutex_unlock(&dev->mlock); ++ + uvalue->value.integer.value[0] = ctrl->badf; + + return badf_old != ctrl->badf; +@@ -656,11 +686,48 @@ static int mchp_spdifrx_signal_get(struct snd_kcontrol *kcontrol, + struct snd_soc_dai *dai = snd_kcontrol_chip(kcontrol); + struct mchp_spdifrx_dev *dev = snd_soc_dai_get_drvdata(dai); + struct mchp_spdifrx_mixer_control *ctrl = &dev->control; +- u32 val; ++ u32 val = ~0U, loops = 10; ++ int ret; + bool signal_old = ctrl->signal; + +- regmap_read(dev->regmap, SPDIFRX_RSR, &val); +- ctrl->signal = !(val & SPDIFRX_RSR_NOSIGNAL); ++ mutex_lock(&dev->mlock); ++ ++ /* ++ * To get the signal we need to have receiver enabled. This ++ * could be enabled also from trigger() function thus we need to ++ * take care of not disabling the receiver when it runs. ++ */ ++ if (!dev->trigger_enabled) { ++ ret = clk_prepare_enable(dev->gclk); ++ if (ret) ++ goto unlock; ++ ++ regmap_update_bits(dev->regmap, SPDIFRX_MR, SPDIFRX_MR_RXEN_MASK, ++ SPDIFRX_MR_RXEN_ENABLE); ++ ++ /* Wait for RSR.ULOCK bit. */ ++ while (--loops) { ++ regmap_read(dev->regmap, SPDIFRX_RSR, &val); ++ if (!(val & SPDIFRX_RSR_ULOCK)) ++ break; ++ usleep_range(100, 150); ++ } ++ ++ regmap_update_bits(dev->regmap, SPDIFRX_MR, SPDIFRX_MR_RXEN_MASK, ++ SPDIFRX_MR_RXEN_DISABLE); ++ ++ clk_disable_unprepare(dev->gclk); ++ } else { ++ regmap_read(dev->regmap, SPDIFRX_RSR, &val); ++ } ++ ++unlock: ++ mutex_unlock(&dev->mlock); ++ ++ if (!(val & SPDIFRX_RSR_ULOCK)) ++ ctrl->signal = !(val & SPDIFRX_RSR_NOSIGNAL); ++ else ++ ctrl->signal = 0; + uvalue->value.integer.value[0] = ctrl->signal; + + return signal_old != ctrl->signal; +@@ -685,18 +752,32 @@ static int mchp_spdifrx_rate_get(struct snd_kcontrol *kcontrol, + u32 val; + int rate; + +- regmap_read(dev->regmap, SPDIFRX_RSR, &val); +- +- /* if the receiver is not locked, ISF data is invalid */ +- if (val & SPDIFRX_RSR_ULOCK || !(val & SPDIFRX_RSR_IFS_MASK)) { ++ mutex_lock(&dev->mlock); ++ ++ /* ++ * The RSR.ULOCK has wrong value if both pclk and gclk are enabled ++ * and the receiver is disabled. Thus we take into account the ++ * dev->trigger_enabled here to return a real status. ++ */ ++ if (dev->trigger_enabled) { ++ regmap_read(dev->regmap, SPDIFRX_RSR, &val); ++ /* If the receiver is not locked, ISF data is invalid. */ ++ if (val & SPDIFRX_RSR_ULOCK || !(val & SPDIFRX_RSR_IFS_MASK)) { ++ ucontrol->value.integer.value[0] = 0; ++ goto unlock; ++ } ++ } else { ++ /* Reveicer is not locked, IFS data is invalid. */ + ucontrol->value.integer.value[0] = 0; +- return 0; ++ goto unlock; + } + + rate = clk_get_rate(dev->gclk); + + ucontrol->value.integer.value[0] = rate / (32 * SPDIFRX_RSR_IFS(val)); + ++unlock: ++ mutex_unlock(&dev->mlock); + return 0; + } + +@@ -912,7 +993,18 @@ static int mchp_spdifrx_probe(struct platform_device *pdev) + "failed to get the PMC generated clock: %d\n", err); + return err; + } ++ ++ /* ++ * Signal control need a valid rate on gclk. hw_params() configures ++ * it propertly but requesting signal before any hw_params() has been ++ * called lead to invalid value returned for signal. Thus, configure ++ * gclk at a valid rate, here, in initialization, to simplify the ++ * control path. ++ */ ++ clk_set_min_rate(dev->gclk, 48000 * SPDIFRX_GCLK_RATIO_MIN + 1); ++ + spin_lock_init(&dev->blockend_lock); ++ mutex_init(&dev->mlock); + + dev->dev = &pdev->dev; + dev->regmap = regmap; +-- +2.39.2 + diff --git a/queue-5.15/asoc-mchp-spdifrx-fix-return-value-in-case-completio.patch b/queue-5.15/asoc-mchp-spdifrx-fix-return-value-in-case-completio.patch new file mode 100644 index 00000000000..77f7187dd6e --- /dev/null +++ b/queue-5.15/asoc-mchp-spdifrx-fix-return-value-in-case-completio.patch @@ -0,0 +1,49 @@ +From 2eba8589efba518d21afea05bfdfa7e0adfca8f7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Jan 2023 14:06:41 +0200 +Subject: ASoC: mchp-spdifrx: fix return value in case completion times out + +From: Claudiu Beznea + +[ Upstream commit a4c4161d6eae3ef5f486d1638ef452d9bc1376b0 ] + +wait_for_completion_interruptible_timeout() returns 0 in case of +timeout. Check this into account when returning from function. + +Fixes: ef265c55c1ac ("ASoC: mchp-spdifrx: add driver for SPDIF RX") +Signed-off-by: Claudiu Beznea +Link: https://lore.kernel.org/r/20230130120647.638049-3-claudiu.beznea@microchip.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/atmel/mchp-spdifrx.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/atmel/mchp-spdifrx.c b/sound/soc/atmel/mchp-spdifrx.c +index 3962ce00ad34a..076a78fd0b125 100644 +--- a/sound/soc/atmel/mchp-spdifrx.c ++++ b/sound/soc/atmel/mchp-spdifrx.c +@@ -524,9 +524,10 @@ static int mchp_spdifrx_cs_get(struct mchp_spdifrx_dev *dev, + ret = wait_for_completion_interruptible_timeout(&ch_stat->done, + msecs_to_jiffies(100)); + /* IP might not be started or valid stream might not be present */ +- if (ret < 0) { ++ if (ret <= 0) { + dev_dbg(dev->dev, "channel status for channel %d timeout\n", + channel); ++ return ret ? : -ETIMEDOUT; + } + + memcpy(uvalue->value.iec958.status, ch_stat->data, +@@ -580,7 +581,7 @@ static int mchp_spdifrx_subcode_ch_get(struct mchp_spdifrx_dev *dev, + dev_dbg(dev->dev, "user data for channel %d timeout\n", + channel); + mchp_spdifrx_isr_blockend_dis(dev); +- return ret; ++ return ret ? : -ETIMEDOUT; + } + + spin_lock_irqsave(&user_data->lock, flags); +-- +2.39.2 + diff --git a/queue-5.15/asoc-mchp-spdifrx-fix-uninitialized-use-of-mr-in-mch.patch b/queue-5.15/asoc-mchp-spdifrx-fix-uninitialized-use-of-mr-in-mch.patch new file mode 100644 index 00000000000..b2da25c1843 --- /dev/null +++ b/queue-5.15/asoc-mchp-spdifrx-fix-uninitialized-use-of-mr-in-mch.patch @@ -0,0 +1,51 @@ +From d3e33f27cb61fb92634a0011ceaa7f4ee41e3f57 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Feb 2023 09:34:19 -0700 +Subject: ASoC: mchp-spdifrx: Fix uninitialized use of mr in + mchp_spdifrx_hw_params() + +From: Nathan Chancellor + +[ Upstream commit 218674a45930c700486d27b765bf2f1b43f8cbf7 ] + +Clang warns: + + ../sound/soc/atmel/mchp-spdifrx.c:455:3: error: variable 'mr' is uninitialized when used here [-Werror,-Wuninitialized] + mr |= SPDIFRX_MR_ENDIAN_BIG; + ^~ + ../sound/soc/atmel/mchp-spdifrx.c:432:8: note: initialize the variable 'mr' to silence this warning + u32 mr; + ^ + = 0 + 1 error generated. + +Zero initialize mr so that these bitwise OR and assignment operation +works unconditionally. + +Fixes: fa09fa60385a ("ASoC: mchp-spdifrx: fix controls which rely on rsr register") +Link: https://github.com/ClangBuiltLinux/linux/issues/1797 +Signed-off-by: Nathan Chancellor +Reviewed-by: Claudiu Beznea +Link: https://lore.kernel.org/r/20230202-mchp-spdifrx-fix-uninit-mr-v1-1-629a045d7a2f@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/atmel/mchp-spdifrx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/atmel/mchp-spdifrx.c b/sound/soc/atmel/mchp-spdifrx.c +index 03b7037239b85..39a3c2a33bdbb 100644 +--- a/sound/soc/atmel/mchp-spdifrx.c ++++ b/sound/soc/atmel/mchp-spdifrx.c +@@ -362,7 +362,7 @@ static int mchp_spdifrx_hw_params(struct snd_pcm_substream *substream, + struct snd_soc_dai *dai) + { + struct mchp_spdifrx_dev *dev = snd_soc_dai_get_drvdata(dai); +- u32 mr; ++ u32 mr = 0; + int ret; + + dev_dbg(dev->dev, "%s() rate=%u format=%#x width=%u channels=%u\n", +-- +2.39.2 + diff --git a/queue-5.15/asoc-rsnd-fixup-endif-position.patch b/queue-5.15/asoc-rsnd-fixup-endif-position.patch new file mode 100644 index 00000000000..b79d27beffb --- /dev/null +++ b/queue-5.15/asoc-rsnd-fixup-endif-position.patch @@ -0,0 +1,44 @@ +From 2e5151ae67f4c141611f5a9be724a6711ddba654 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Feb 2023 01:59:52 +0000 +Subject: ASoC: rsnd: fixup #endif position + +From: Kuninori Morimoto + +[ Upstream commit 49123b51cd896e00b256a27c2ce9e6bfe1bbc22f ] + +commit 1f9c82b5ab83ff2 ("ASoC: rsnd: add debugfs support") added +CONFIG_DEBUG_FS related definitions on rsnd.h, but it should be +added inside of RSND_H. This patch fixup it. + +Fixes: 1f9c82b5ab83 ("ASoC: rsnd: add debugfs support") +Signed-off-by: Kuninori Morimoto +Link: https://lore.kernel.org/r/877cx26t7r.wl-kuninori.morimoto.gx@renesas.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sh/rcar/rsnd.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/sh/rcar/rsnd.h b/sound/soc/sh/rcar/rsnd.h +index d9cd190d7e198..f8ef6836ef84e 100644 +--- a/sound/soc/sh/rcar/rsnd.h ++++ b/sound/soc/sh/rcar/rsnd.h +@@ -901,8 +901,6 @@ void rsnd_mod_make_sure(struct rsnd_mod *mod, enum rsnd_mod_type type); + if (!IS_BUILTIN(RSND_DEBUG_NO_DAI_CALL)) \ + dev_dbg(dev, param) + +-#endif +- + #ifdef CONFIG_DEBUG_FS + int rsnd_debugfs_probe(struct snd_soc_component *component); + void rsnd_debugfs_reg_show(struct seq_file *m, phys_addr_t _addr, +@@ -913,3 +911,5 @@ void rsnd_debugfs_mod_reg_show(struct seq_file *m, struct rsnd_mod *mod, + #else + #define rsnd_debugfs_probe NULL + #endif ++ ++#endif /* RSND_H */ +-- +2.39.2 + diff --git a/queue-5.15/asoc-soc-compress-reposition-and-add-pcm_mutex.patch b/queue-5.15/asoc-soc-compress-reposition-and-add-pcm_mutex.patch new file mode 100644 index 00000000000..8162d69555a --- /dev/null +++ b/queue-5.15/asoc-soc-compress-reposition-and-add-pcm_mutex.patch @@ -0,0 +1,136 @@ +From 6eaae6683133c5cd1cdc498d015b8eadc8c70c3e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Dec 2022 14:18:18 +0900 +Subject: ASoC: soc-compress: Reposition and add pcm_mutex +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: 강신형 + +[ Upstream commit aa9ff6a4955fdba02b54fbc4386db876603703b7 ] + +If panic_on_warn is set and compress stream(DPCM) is started, +then kernel panic occurred because card->pcm_mutex isn't held appropriately. +In the following functions, warning were issued at this line +"snd_soc_dpcm_mutex_assert_held". + +static int dpcm_be_connect(struct snd_soc_pcm_runtime *fe, + struct snd_soc_pcm_runtime *be, int stream) +{ + ... + snd_soc_dpcm_mutex_assert_held(fe); + ... +} + +void dpcm_be_disconnect(struct snd_soc_pcm_runtime *fe, int stream) +{ + ... + snd_soc_dpcm_mutex_assert_held(fe); + ... +} + +void snd_soc_runtime_action(struct snd_soc_pcm_runtime *rtd, + int stream, int action) +{ + ... + snd_soc_dpcm_mutex_assert_held(rtd); + ... +} + +int dpcm_dapm_stream_event(struct snd_soc_pcm_runtime *fe, int dir, + int event) +{ + ... + snd_soc_dpcm_mutex_assert_held(fe); + ... +} + +These functions are called by soc_compr_set_params_fe, soc_compr_open_fe +and soc_compr_free_fe +without pcm_mutex locking. And this is call stack. + +[ 414.527841][ T2179] pc : dpcm_process_paths+0x5a4/0x750 +[ 414.527848][ T2179] lr : dpcm_process_paths+0x37c/0x750 +[ 414.527945][ T2179] Call trace: +[ 414.527949][ T2179] dpcm_process_paths+0x5a4/0x750 +[ 414.527955][ T2179] soc_compr_open_fe+0xb0/0x2cc +[ 414.527972][ T2179] snd_compr_open+0x180/0x248 +[ 414.527981][ T2179] snd_open+0x15c/0x194 +[ 414.528003][ T2179] chrdev_open+0x1b0/0x220 +[ 414.528023][ T2179] do_dentry_open+0x30c/0x594 +[ 414.528045][ T2179] vfs_open+0x34/0x44 +[ 414.528053][ T2179] path_openat+0x914/0xb08 +[ 414.528062][ T2179] do_filp_open+0xc0/0x170 +[ 414.528068][ T2179] do_sys_openat2+0x94/0x18c +[ 414.528076][ T2179] __arm64_sys_openat+0x78/0xa4 +[ 414.528084][ T2179] invoke_syscall+0x48/0x10c +[ 414.528094][ T2179] el0_svc_common+0xbc/0x104 +[ 414.528099][ T2179] do_el0_svc+0x34/0xd8 +[ 414.528103][ T2179] el0_svc+0x34/0xc4 +[ 414.528125][ T2179] el0t_64_sync_handler+0x8c/0xfc +[ 414.528133][ T2179] el0t_64_sync+0x1a0/0x1a4 +[ 414.528142][ T2179] Kernel panic - not syncing: panic_on_warn set ... + +So, I reposition and add pcm_mutex to resolve lockdep error. + +Signed-off-by: Shinhyung Kang +Link: https://lore.kernel.org/r/016401d90ac4$7b6848c0$7238da40$@samsung.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/soc-compress.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/sound/soc/soc-compress.c b/sound/soc/soc-compress.c +index e352b06a7b7a3..c2703a7598dd5 100644 +--- a/sound/soc/soc-compress.c ++++ b/sound/soc/soc-compress.c +@@ -116,6 +116,8 @@ static int soc_compr_open_fe(struct snd_compr_stream *cstream) + if (ret < 0) + goto be_err; + ++ mutex_lock_nested(&fe->card->pcm_mutex, fe->card->pcm_subclass); ++ + /* calculate valid and active FE <-> BE dpcms */ + dpcm_process_paths(fe, stream, &list, 1); + fe->dpcm[stream].runtime = fe_substream->runtime; +@@ -151,7 +153,6 @@ static int soc_compr_open_fe(struct snd_compr_stream *cstream) + fe->dpcm[stream].state = SND_SOC_DPCM_STATE_OPEN; + fe->dpcm[stream].runtime_update = SND_SOC_DPCM_UPDATE_NO; + +- mutex_lock_nested(&fe->card->pcm_mutex, fe->card->pcm_subclass); + snd_soc_runtime_activate(fe, stream); + mutex_unlock(&fe->card->pcm_mutex); + +@@ -182,7 +183,6 @@ static int soc_compr_free_fe(struct snd_compr_stream *cstream) + + mutex_lock_nested(&fe->card->pcm_mutex, fe->card->pcm_subclass); + snd_soc_runtime_deactivate(fe, stream); +- mutex_unlock(&fe->card->pcm_mutex); + + fe->dpcm[stream].runtime_update = SND_SOC_DPCM_UPDATE_FE; + +@@ -201,6 +201,8 @@ static int soc_compr_free_fe(struct snd_compr_stream *cstream) + + dpcm_be_disconnect(fe, stream); + ++ mutex_unlock(&fe->card->pcm_mutex); ++ + fe->dpcm[stream].runtime = NULL; + + snd_soc_link_compr_shutdown(cstream, 0); +@@ -376,8 +378,9 @@ static int soc_compr_set_params_fe(struct snd_compr_stream *cstream, + ret = snd_soc_link_compr_set_params(cstream); + if (ret < 0) + goto out; +- ++ mutex_lock_nested(&fe->card->pcm_mutex, fe->card->pcm_subclass); + dpcm_dapm_stream_event(fe, stream, SND_SOC_DAPM_STREAM_START); ++ mutex_unlock(&fe->card->pcm_mutex); + fe->dpcm[stream].state = SND_SOC_DPCM_STATE_PREPARE; + + out: +-- +2.39.2 + diff --git a/queue-5.15/asoc-soc-compress.c-fixup-private_data-on-snd_soc_ne.patch b/queue-5.15/asoc-soc-compress.c-fixup-private_data-on-snd_soc_ne.patch new file mode 100644 index 00000000000..3d2d6957ebe --- /dev/null +++ b/queue-5.15/asoc-soc-compress.c-fixup-private_data-on-snd_soc_ne.patch @@ -0,0 +1,41 @@ +From 22ab97d6a926d5ea225d3008c6d7732727e2751c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 23 Jan 2023 23:17:20 +0000 +Subject: ASoC: soc-compress.c: fixup private_data on snd_soc_new_compress() + +From: Kuninori Morimoto + +[ Upstream commit ffe4c0f0bfaa571a676a0e946d4a6a0607f94294 ] + +commit d3268a40d4b19f ("ASoC: soc-compress.c: fix NULL dereference") +enables DPCM capture, but it should independent from playback. +This patch fixup it. + +Fixes: d3268a40d4b1 ("ASoC: soc-compress.c: fix NULL dereference") +Link: https://lore.kernel.org/r/87tu0i6j7j.wl-kuninori.morimoto.gx@renesas.com +Acked-by: Charles Keepax +Acked-by: Pierre-Louis Bossart +Signed-off-by: Kuninori Morimoto +Link: https://lore.kernel.org/r/871qnkvo1s.wl-kuninori.morimoto.gx@renesas.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/soc-compress.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/soc-compress.c b/sound/soc/soc-compress.c +index 2050728063a15..e352b06a7b7a3 100644 +--- a/sound/soc/soc-compress.c ++++ b/sound/soc/soc-compress.c +@@ -590,7 +590,7 @@ int snd_soc_new_compress(struct snd_soc_pcm_runtime *rtd, int num) + rtd->fe_compr = 1; + if (rtd->dai_link->dpcm_playback) + be_pcm->streams[SNDRV_PCM_STREAM_PLAYBACK].substream->private_data = rtd; +- else if (rtd->dai_link->dpcm_capture) ++ if (rtd->dai_link->dpcm_capture) + be_pcm->streams[SNDRV_PCM_STREAM_CAPTURE].substream->private_data = rtd; + memcpy(compr->ops, &soc_compr_dyn_ops, sizeof(soc_compr_dyn_ops)); + } else { +-- +2.39.2 + diff --git a/queue-5.15/asoc-soc-dapm.h-fixup-warning-struct-snd_pcm_substre.patch b/queue-5.15/asoc-soc-dapm.h-fixup-warning-struct-snd_pcm_substre.patch new file mode 100644 index 00000000000..af2b62ed0ba --- /dev/null +++ b/queue-5.15/asoc-soc-dapm.h-fixup-warning-struct-snd_pcm_substre.patch @@ -0,0 +1,37 @@ +From 70e44a3ebb96dc95c0e31e68f8153c9d2298dd28 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Feb 2023 13:28:51 +0000 +Subject: ASoC: soc-dapm.h: fixup warning struct snd_pcm_substream not declared + +From: Lucas Tanure + +[ Upstream commit fdff966bfde7cf0c85562d2bfb1ff1ba83da5f7b ] + +Add struct snd_pcm_substream forward declaration + +Fixes: 078a85f2806f ("ASoC: dapm: Only power up active channels from a DAI") +Signed-off-by: Lucas Tanure +Reviewed-by: Charles Keepax +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20230215132851.1626881-1-lucas.tanure@collabora.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + include/sound/soc-dapm.h | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/include/sound/soc-dapm.h b/include/sound/soc-dapm.h +index c3039e97929a5..32e93d55acf73 100644 +--- a/include/sound/soc-dapm.h ++++ b/include/sound/soc-dapm.h +@@ -16,6 +16,7 @@ + #include + + struct device; ++struct snd_pcm_substream; + struct snd_soc_pcm_runtime; + struct soc_enum; + +-- +2.39.2 + diff --git a/queue-5.15/asoc-tlv320adcx140-fix-ti-gpio-config-dt-property-in.patch b/queue-5.15/asoc-tlv320adcx140-fix-ti-gpio-config-dt-property-in.patch new file mode 100644 index 00000000000..f09f8af93f2 --- /dev/null +++ b/queue-5.15/asoc-tlv320adcx140-fix-ti-gpio-config-dt-property-in.patch @@ -0,0 +1,50 @@ +From d7c84c6c960d5a24253d47dfdf7f52fefbf71c3c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Feb 2023 09:38:05 +0200 +Subject: ASoC: tlv320adcx140: fix 'ti,gpio-config' DT property init + +From: Steffen Aschbacher + +[ Upstream commit 771725efe5e2e5396dd9d1220437e5f9d6b9ca9d ] + +When the 'ti,gpio-config' property is not defined, the +device_property_count_u32() will return an error, rather than zero. + +The current check, only handles a return value of zero, which assumes that +the property is defined and has nothing defined. + +This change extends the check to also check for an error case (most likely +to be hit by the case that the 'ti,gpio-config' is not defined). + +In case that the 'ti,gpio-config' and the returned 'gpio_count' is not +correct, there is a 'if (gpio_count != ADCX140_NUM_GPIO_CFGS)' check, a few +lines lower that will return -EINVAL. +This means that someone tried to define 'ti,gpio-config', but with the +wrong number of GPIOs. + +Fixes: d5214321498a ("ASoC: tlv320adcx140: Add support for configuring GPIO pin") +Signed-off-by: Steffen Aschbacher +Signed-off-by: Alexandru Ardelean +Link: https://lore.kernel.org/r/20230213073805.14640-1-alex@shruggie.ro +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/tlv320adcx140.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/tlv320adcx140.c b/sound/soc/codecs/tlv320adcx140.c +index 32b120d624b25..06d2502b13478 100644 +--- a/sound/soc/codecs/tlv320adcx140.c ++++ b/sound/soc/codecs/tlv320adcx140.c +@@ -870,7 +870,7 @@ static int adcx140_configure_gpio(struct adcx140_priv *adcx140) + + gpio_count = device_property_count_u32(adcx140->dev, + "ti,gpio-config"); +- if (gpio_count == 0) ++ if (gpio_count <= 0) + return 0; + + if (gpio_count != ADCX140_NUM_GPIO_CFGS) +-- +2.39.2 + diff --git a/queue-5.15/ath9k-hif_usb-simplify-if-if-to-if-else.patch b/queue-5.15/ath9k-hif_usb-simplify-if-if-to-if-else.patch new file mode 100644 index 00000000000..fdb057f9227 --- /dev/null +++ b/queue-5.15/ath9k-hif_usb-simplify-if-if-to-if-else.patch @@ -0,0 +1,44 @@ +From 26ddd278ccadc154eb373b49977cd395303d72c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Apr 2022 10:37:32 +0300 +Subject: ath9k: hif_usb: simplify if-if to if-else +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Wan Jiabing + +[ Upstream commit 2950833f10cfa601813262e1d9c8473f9415681b ] + +Use if and else instead of if(A) and if (!A). + +Signed-off-by: Wan Jiabing +Acked-by: Toke Høiland-Jørgensen +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20220424094441.104937-1-wanjiabing@vivo.com +Stable-dep-of: 0af54343a762 ("wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails") +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath9k/hif_usb.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c +index f938ac1a4abd4..f54380fb6c9e5 100644 +--- a/drivers/net/wireless/ath/ath9k/hif_usb.c ++++ b/drivers/net/wireless/ath/ath9k/hif_usb.c +@@ -368,10 +368,9 @@ static int __hif_usb_tx(struct hif_device_usb *hif_dev) + __skb_queue_head_init(&tx_buf->skb_queue); + list_move_tail(&tx_buf->list, &hif_dev->tx.tx_buf); + hif_dev->tx.tx_buf_cnt++; +- } +- +- if (!ret) ++ } else { + TX_STAT_INC(buf_queued); ++ } + + return ret; + } +-- +2.39.2 + diff --git a/queue-5.15/ath9k-htc-clean-up-statistics-macros.patch b/queue-5.15/ath9k-htc-clean-up-statistics-macros.patch new file mode 100644 index 00000000000..01c95842e27 --- /dev/null +++ b/queue-5.15/ath9k-htc-clean-up-statistics-macros.patch @@ -0,0 +1,232 @@ +From 865028f94f7735fe83583ab2aaefeb36b8c614da Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Jun 2022 21:44:07 +0300 +Subject: ath9k: htc: clean up statistics macros +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pavel Skripkin + +[ Upstream commit d7fc76039b74ad37b7056d5607b05d7cb31a5404 ] + +I've changed *STAT_* macros a bit in previous patch and I seems like +they become really unreadable. Align these macros definitions to make +code cleaner and fix folllowing checkpatch warning + +ERROR: Macros with complex values should be enclosed in parentheses + +Also, statistics macros now accept an hif_dev as argument, since +macros that depend on having a local variable with a magic name +don't abide by the coding style. + +No functional change + +Suggested-by: Jeff Johnson +Signed-off-by: Pavel Skripkin +Acked-by: Toke Høiland-Jørgensen +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/ebb2306d06a496cd1b032155ae52fdc5fa8cc2c5.1655145743.git.paskripkin@gmail.com +Stable-dep-of: 0af54343a762 ("wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails") +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath9k/hif_usb.c | 26 +++++++-------- + drivers/net/wireless/ath/ath9k/htc.h | 32 +++++++++++-------- + drivers/net/wireless/ath/ath9k/htc_drv_txrx.c | 10 +++--- + 3 files changed, 36 insertions(+), 32 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c +index f54380fb6c9e5..1a2e0c7eeb023 100644 +--- a/drivers/net/wireless/ath/ath9k/hif_usb.c ++++ b/drivers/net/wireless/ath/ath9k/hif_usb.c +@@ -244,11 +244,11 @@ static inline void ath9k_skb_queue_complete(struct hif_device_usb *hif_dev, + ath9k_htc_txcompletion_cb(hif_dev->htc_handle, + skb, txok); + if (txok) { +- TX_STAT_INC(skb_success); +- TX_STAT_ADD(skb_success_bytes, ln); ++ TX_STAT_INC(hif_dev, skb_success); ++ TX_STAT_ADD(hif_dev, skb_success_bytes, ln); + } + else +- TX_STAT_INC(skb_failed); ++ TX_STAT_INC(hif_dev, skb_failed); + } + } + +@@ -302,7 +302,7 @@ static void hif_usb_tx_cb(struct urb *urb) + hif_dev->tx.tx_buf_cnt++; + if (!(hif_dev->tx.flags & HIF_USB_TX_STOP)) + __hif_usb_tx(hif_dev); /* Check for pending SKBs */ +- TX_STAT_INC(buf_completed); ++ TX_STAT_INC(hif_dev, buf_completed); + spin_unlock(&hif_dev->tx.tx_lock); + } + +@@ -353,7 +353,7 @@ static int __hif_usb_tx(struct hif_device_usb *hif_dev) + tx_buf->len += tx_buf->offset; + + __skb_queue_tail(&tx_buf->skb_queue, nskb); +- TX_STAT_INC(skb_queued); ++ TX_STAT_INC(hif_dev, skb_queued); + } + + usb_fill_bulk_urb(tx_buf->urb, hif_dev->udev, +@@ -369,7 +369,7 @@ static int __hif_usb_tx(struct hif_device_usb *hif_dev) + list_move_tail(&tx_buf->list, &hif_dev->tx.tx_buf); + hif_dev->tx.tx_buf_cnt++; + } else { +- TX_STAT_INC(buf_queued); ++ TX_STAT_INC(hif_dev, buf_queued); + } + + return ret; +@@ -514,7 +514,7 @@ static void hif_usb_sta_drain(void *hif_handle, u8 idx) + ath9k_htc_txcompletion_cb(hif_dev->htc_handle, + skb, false); + hif_dev->tx.tx_skb_cnt--; +- TX_STAT_INC(skb_failed); ++ TX_STAT_INC(hif_dev, skb_failed); + } + } + +@@ -585,14 +585,14 @@ static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev, + pkt_tag = get_unaligned_le16(ptr + index + 2); + + if (pkt_tag != ATH_USB_RX_STREAM_MODE_TAG) { +- RX_STAT_INC(skb_dropped); ++ RX_STAT_INC(hif_dev, skb_dropped); + return; + } + + if (pkt_len > 2 * MAX_RX_BUF_SIZE) { + dev_err(&hif_dev->udev->dev, + "ath9k_htc: invalid pkt_len (%x)\n", pkt_len); +- RX_STAT_INC(skb_dropped); ++ RX_STAT_INC(hif_dev, skb_dropped); + return; + } + +@@ -618,7 +618,7 @@ static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev, + goto err; + } + skb_reserve(nskb, 32); +- RX_STAT_INC(skb_allocated); ++ RX_STAT_INC(hif_dev, skb_allocated); + + memcpy(nskb->data, &(skb->data[chk_idx+4]), + hif_dev->rx_transfer_len); +@@ -639,7 +639,7 @@ static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev, + goto err; + } + skb_reserve(nskb, 32); +- RX_STAT_INC(skb_allocated); ++ RX_STAT_INC(hif_dev, skb_allocated); + + memcpy(nskb->data, &(skb->data[chk_idx+4]), pkt_len); + skb_put(nskb, pkt_len); +@@ -649,10 +649,10 @@ static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev, + + err: + for (i = 0; i < pool_index; i++) { +- RX_STAT_ADD(skb_completed_bytes, skb_pool[i]->len); ++ RX_STAT_ADD(hif_dev, skb_completed_bytes, skb_pool[i]->len); + ath9k_htc_rx_msg(hif_dev->htc_handle, skb_pool[i], + skb_pool[i]->len, USB_WLAN_RX_PIPE); +- RX_STAT_INC(skb_completed); ++ RX_STAT_INC(hif_dev, skb_completed); + } + } + +diff --git a/drivers/net/wireless/ath/ath9k/htc.h b/drivers/net/wireless/ath/ath9k/htc.h +index e3d546ef71ddc..30f0765fb9fd8 100644 +--- a/drivers/net/wireless/ath/ath9k/htc.h ++++ b/drivers/net/wireless/ath/ath9k/htc.h +@@ -327,14 +327,18 @@ static inline struct ath9k_htc_tx_ctl *HTC_SKB_CB(struct sk_buff *skb) + } + + #ifdef CONFIG_ATH9K_HTC_DEBUGFS +-#define __STAT_SAFE(expr) (hif_dev->htc_handle->drv_priv ? (expr) : 0) +-#define TX_STAT_INC(c) __STAT_SAFE(hif_dev->htc_handle->drv_priv->debug.tx_stats.c++) +-#define TX_STAT_ADD(c, a) __STAT_SAFE(hif_dev->htc_handle->drv_priv->debug.tx_stats.c += a) +-#define RX_STAT_INC(c) __STAT_SAFE(hif_dev->htc_handle->drv_priv->debug.skbrx_stats.c++) +-#define RX_STAT_ADD(c, a) __STAT_SAFE(hif_dev->htc_handle->drv_priv->debug.skbrx_stats.c += a) +-#define CAB_STAT_INC priv->debug.tx_stats.cab_queued++ +- +-#define TX_QSTAT_INC(q) (priv->debug.tx_stats.queue_stats[q]++) ++#define __STAT_SAFE(hif_dev, expr) ((hif_dev)->htc_handle->drv_priv ? (expr) : 0) ++#define CAB_STAT_INC(priv) ((priv)->debug.tx_stats.cab_queued++) ++#define TX_QSTAT_INC(priv, q) ((priv)->debug.tx_stats.queue_stats[q]++) ++ ++#define TX_STAT_INC(hif_dev, c) \ ++ __STAT_SAFE((hif_dev), (hif_dev)->htc_handle->drv_priv->debug.tx_stats.c++) ++#define TX_STAT_ADD(hif_dev, c, a) \ ++ __STAT_SAFE((hif_dev), (hif_dev)->htc_handle->drv_priv->debug.tx_stats.c += a) ++#define RX_STAT_INC(hif_dev, c) \ ++ __STAT_SAFE((hif_dev), (hif_dev)->htc_handle->drv_priv->debug.skbrx_stats.c++) ++#define RX_STAT_ADD(hif_dev, c, a) \ ++ __STAT_SAFE((hif_dev), (hif_dev)->htc_handle->drv_priv->debug.skbrx_stats.c += a) + + void ath9k_htc_err_stat_rx(struct ath9k_htc_priv *priv, + struct ath_rx_status *rs); +@@ -374,13 +378,13 @@ void ath9k_htc_get_et_stats(struct ieee80211_hw *hw, + struct ethtool_stats *stats, u64 *data); + #else + +-#define TX_STAT_INC(c) do { } while (0) +-#define TX_STAT_ADD(c, a) do { } while (0) +-#define RX_STAT_INC(c) do { } while (0) +-#define RX_STAT_ADD(c, a) do { } while (0) +-#define CAB_STAT_INC do { } while (0) ++#define TX_STAT_INC(hif_dev, c) ++#define TX_STAT_ADD(hif_dev, c, a) ++#define RX_STAT_INC(hif_dev, c) ++#define RX_STAT_ADD(hif_dev, c, a) + +-#define TX_QSTAT_INC(c) do { } while (0) ++#define CAB_STAT_INC(priv) ++#define TX_QSTAT_INC(priv, c) + + static inline void ath9k_htc_err_stat_rx(struct ath9k_htc_priv *priv, + struct ath_rx_status *rs) +diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c +index a23eaca0326d1..672789e3c55d0 100644 +--- a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c ++++ b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c +@@ -106,20 +106,20 @@ static inline enum htc_endpoint_id get_htc_epid(struct ath9k_htc_priv *priv, + + switch (qnum) { + case 0: +- TX_QSTAT_INC(IEEE80211_AC_VO); ++ TX_QSTAT_INC(priv, IEEE80211_AC_VO); + epid = priv->data_vo_ep; + break; + case 1: +- TX_QSTAT_INC(IEEE80211_AC_VI); ++ TX_QSTAT_INC(priv, IEEE80211_AC_VI); + epid = priv->data_vi_ep; + break; + case 2: +- TX_QSTAT_INC(IEEE80211_AC_BE); ++ TX_QSTAT_INC(priv, IEEE80211_AC_BE); + epid = priv->data_be_ep; + break; + case 3: + default: +- TX_QSTAT_INC(IEEE80211_AC_BK); ++ TX_QSTAT_INC(priv, IEEE80211_AC_BK); + epid = priv->data_bk_ep; + break; + } +@@ -328,7 +328,7 @@ static void ath9k_htc_tx_data(struct ath9k_htc_priv *priv, + memcpy(tx_fhdr, (u8 *) &tx_hdr, sizeof(tx_hdr)); + + if (is_cab) { +- CAB_STAT_INC; ++ CAB_STAT_INC(priv); + tx_ctl->epid = priv->cab_ep; + return; + } +-- +2.39.2 + diff --git a/queue-5.15/blk-iocost-fix-divide-by-0-error-in-calc_lcoefs.patch b/queue-5.15/blk-iocost-fix-divide-by-0-error-in-calc_lcoefs.patch new file mode 100644 index 00000000000..50714d96b34 --- /dev/null +++ b/queue-5.15/blk-iocost-fix-divide-by-0-error-in-calc_lcoefs.patch @@ -0,0 +1,70 @@ +From 2e61871b4dca7575d795078fa68a0eb0d3095dec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Jan 2023 15:08:05 +0800 +Subject: blk-iocost: fix divide by 0 error in calc_lcoefs() + +From: Li Nan + +[ Upstream commit 984af1e66b4126cf145153661cc24c213e2ec231 ] + +echo max of u64 to cost.model can cause divide by 0 error. + + # echo 8:0 rbps=18446744073709551615 > /sys/fs/cgroup/io.cost.model + + divide error: 0000 [#1] PREEMPT SMP + RIP: 0010:calc_lcoefs+0x4c/0xc0 + Call Trace: + + ioc_refresh_params+0x2b3/0x4f0 + ioc_cost_model_write+0x3cb/0x4c0 + ? _copy_from_iter+0x6d/0x6c0 + ? kernfs_fop_write_iter+0xfc/0x270 + cgroup_file_write+0xa0/0x200 + kernfs_fop_write_iter+0x17d/0x270 + vfs_write+0x414/0x620 + ksys_write+0x73/0x160 + __x64_sys_write+0x1e/0x30 + do_syscall_64+0x35/0x80 + entry_SYSCALL_64_after_hwframe+0x63/0xcd + +calc_lcoefs() uses the input value of cost.model in DIV_ROUND_UP_ULL, +overflow would happen if bps plus IOC_PAGE_SIZE is greater than +ULLONG_MAX, it can cause divide by 0 error. + +Fix the problem by setting basecost + +Signed-off-by: Li Nan +Signed-off-by: Yu Kuai +Acked-by: Tejun Heo +Link: https://lore.kernel.org/r/20230117070806.3857142-5-yukuai1@huaweicloud.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-iocost.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/block/blk-iocost.c b/block/blk-iocost.c +index 069193dee95b0..bd7e9ffa5d401 100644 +--- a/block/blk-iocost.c ++++ b/block/blk-iocost.c +@@ -870,9 +870,14 @@ static void calc_lcoefs(u64 bps, u64 seqiops, u64 randiops, + + *page = *seqio = *randio = 0; + +- if (bps) +- *page = DIV64_U64_ROUND_UP(VTIME_PER_SEC, +- DIV_ROUND_UP_ULL(bps, IOC_PAGE_SIZE)); ++ if (bps) { ++ u64 bps_pages = DIV_ROUND_UP_ULL(bps, IOC_PAGE_SIZE); ++ ++ if (bps_pages) ++ *page = DIV64_U64_ROUND_UP(VTIME_PER_SEC, bps_pages); ++ else ++ *page = 1; ++ } + + if (seqiops) { + v = DIV64_U64_ROUND_UP(VTIME_PER_SEC, seqiops); +-- +2.39.2 + diff --git a/queue-5.15/blk-mq-avoid-sleep-in-blk_mq_alloc_request_hctx.patch b/queue-5.15/blk-mq-avoid-sleep-in-blk_mq_alloc_request_hctx.patch new file mode 100644 index 00000000000..fb50f17f3ec --- /dev/null +++ b/queue-5.15/blk-mq-avoid-sleep-in-blk_mq_alloc_request_hctx.patch @@ -0,0 +1,53 @@ +From 5d18e205f9bb3e0cc2432fefa279c42b9a976c67 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Jan 2023 17:37:13 +0800 +Subject: blk-mq: avoid sleep in blk_mq_alloc_request_hctx + +From: Kemeng Shi + +[ Upstream commit 6ee858a3d3270a68902d66bb47c151a83622535c ] + +Commit 1f5bd336b9150 ("blk-mq: add blk_mq_alloc_request_hctx") add +blk_mq_alloc_request_hctx to send commands to a specific queue. If +BLK_MQ_REQ_NOWAIT is not set in tag allocation, we may change to different +hctx after sleep and get tag from unexpected hctx. So BLK_MQ_REQ_NOWAIT +must be set in flags for blk_mq_alloc_request_hctx. +After commit 600c3b0cea784 ("blk-mq: open code __blk_mq_alloc_request in +blk_mq_alloc_request_hctx"), blk_mq_alloc_request_hctx return -EINVAL +if both BLK_MQ_REQ_NOWAIT and BLK_MQ_REQ_RESERVED are not set instead of +if BLK_MQ_REQ_NOWAIT is not set. So if BLK_MQ_REQ_NOWAIT is not set and +BLK_MQ_REQ_RESERVED is set, blk_mq_alloc_request_hctx could alloc tag +from unexpected hctx. I guess what we need here is that return -EINVAL +if either BLK_MQ_REQ_NOWAIT or BLK_MQ_REQ_RESERVED is not set. + +Currently both BLK_MQ_REQ_NOWAIT and BLK_MQ_REQ_RESERVED will be set if +specific hctx is needed in nvme_auth_submit, nvmf_connect_io_queue +and nvmf_connect_admin_queue. Fix the potential BLK_MQ_REQ_NOWAIT missed +case in future. + +Fixes: 600c3b0cea78 ("blk-mq: open code __blk_mq_alloc_request in blk_mq_alloc_request_hctx") +Reviewed-by: Christoph Hellwig +Signed-off-by: Kemeng Shi +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-mq.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/block/blk-mq.c b/block/blk-mq.c +index 9f53b4caf9772..01e281801453d 100644 +--- a/block/blk-mq.c ++++ b/block/blk-mq.c +@@ -457,7 +457,8 @@ struct request *blk_mq_alloc_request_hctx(struct request_queue *q, + * allocator for this for the rare use case of a command tied to + * a specific queue. + */ +- if (WARN_ON_ONCE(!(flags & (BLK_MQ_REQ_NOWAIT | BLK_MQ_REQ_RESERVED)))) ++ if (WARN_ON_ONCE(!(flags & BLK_MQ_REQ_NOWAIT)) || ++ WARN_ON_ONCE(!(flags & BLK_MQ_REQ_RESERVED))) + return ERR_PTR(-EINVAL); + + if (hctx_idx >= q->nr_hw_queues) +-- +2.39.2 + diff --git a/queue-5.15/blk-mq-correct-stale-comment-of-.get_budget.patch b/queue-5.15/blk-mq-correct-stale-comment-of-.get_budget.patch new file mode 100644 index 00000000000..03fcd44d836 --- /dev/null +++ b/queue-5.15/blk-mq-correct-stale-comment-of-.get_budget.patch @@ -0,0 +1,49 @@ +From 2cd6ad5a6fbcedb653be2658d8d4f93df44a29f6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Jan 2023 17:37:26 +0800 +Subject: blk-mq: correct stale comment of .get_budget + +From: Kemeng Shi + +[ Upstream commit 01542f651a9f58a9b176c3d3dc3eefbacee53b78 ] + +Commit 88022d7201e96 ("blk-mq: don't handle failure in .get_budget") +remove BLK_STS_RESOURCE return value and we only check if we can get +the budget from .get_budget() now. +Correct stale comment that ".get_budget() returns BLK_STS_NO_RESOURCE" +to ".get_budget() fails to get the budget". + +Fixes: 88022d7201e9 ("blk-mq: don't handle failure in .get_budget") +Signed-off-by: Kemeng Shi +Reviewed-by: Christoph Hellwig +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-mq-sched.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/block/blk-mq-sched.c b/block/blk-mq-sched.c +index de45a28925d83..ff1021dbb0d22 100644 +--- a/block/blk-mq-sched.c ++++ b/block/blk-mq-sched.c +@@ -109,7 +109,7 @@ static bool blk_mq_dispatch_hctx_list(struct list_head *rq_list) + /* + * Only SCSI implements .get_budget and .put_budget, and SCSI restarts + * its queue by itself in its completion handler, so we don't need to +- * restart queue if .get_budget() returns BLK_STS_NO_RESOURCE. ++ * restart queue if .get_budget() fails to get the budget. + * + * Returns -EAGAIN if hctx->dispatch was found non-empty and run_work has to + * be run again. This is necessary to avoid starving flushes. +@@ -237,7 +237,7 @@ static struct blk_mq_ctx *blk_mq_next_ctx(struct blk_mq_hw_ctx *hctx, + /* + * Only SCSI implements .get_budget and .put_budget, and SCSI restarts + * its queue by itself in its completion handler, so we don't need to +- * restart queue if .get_budget() returns BLK_STS_NO_RESOURCE. ++ * restart queue if .get_budget() fails to get the budget. + * + * Returns -EAGAIN if hctx->dispatch was found non-empty and run_work has to + * be run again. This is necessary to avoid starving flushes. +-- +2.39.2 + diff --git a/queue-5.15/blk-mq-remove-stale-comment-for-blk_mq_sched_mark_re.patch b/queue-5.15/blk-mq-remove-stale-comment-for-blk_mq_sched_mark_re.patch new file mode 100644 index 00000000000..55dd06f7add --- /dev/null +++ b/queue-5.15/blk-mq-remove-stale-comment-for-blk_mq_sched_mark_re.patch @@ -0,0 +1,41 @@ +From 12cbf944e8b2947dc67424069c22b7db5e7536d0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Jan 2023 17:37:14 +0800 +Subject: blk-mq: remove stale comment for blk_mq_sched_mark_restart_hctx + +From: Kemeng Shi + +[ Upstream commit c31e76bcc379182fe67a82c618493b7b8868c672 ] + +Commit 97889f9ac24f8 ("blk-mq: remove synchronize_rcu() from +blk_mq_del_queue_tag_set()") remove handle of TAG_SHARED in restart, +then shared_hctx_restart counted for how many hardware queues are marked +for restart is removed too. +Remove the stale comment that we still count hardware queues need restart. + +Fixes: 97889f9ac24f ("blk-mq: remove synchronize_rcu() from blk_mq_del_queue_tag_set()") +Reviewed-by: Christoph Hellwig +Signed-off-by: Kemeng Shi +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-mq-sched.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/block/blk-mq-sched.c b/block/blk-mq-sched.c +index 35770e33c817a..de45a28925d83 100644 +--- a/block/blk-mq-sched.c ++++ b/block/blk-mq-sched.c +@@ -45,8 +45,7 @@ void blk_mq_sched_assign_ioc(struct request *rq) + } + + /* +- * Mark a hardware queue as needing a restart. For shared queues, maintain +- * a count of how many hardware queues are marked for restart. ++ * Mark a hardware queue as needing a restart. + */ + void blk_mq_sched_mark_restart_hctx(struct blk_mq_hw_ctx *hctx) + { +-- +2.39.2 + diff --git a/queue-5.15/block-bio-integrity-copy-flags-when-bio_integrity_pa.patch b/queue-5.15/block-bio-integrity-copy-flags-when-bio_integrity_pa.patch new file mode 100644 index 00000000000..4f79a898925 --- /dev/null +++ b/queue-5.15/block-bio-integrity-copy-flags-when-bio_integrity_pa.patch @@ -0,0 +1,44 @@ +From 1b192c2082a19de3b763e81ae91ac1cda6968173 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Feb 2023 12:18:01 -0500 +Subject: block: bio-integrity: Copy flags when bio_integrity_payload is cloned + +From: Martin K. Petersen + +[ Upstream commit b6a4bdcda430e3ca43bbb9cb1d4d4d34ebe15c40 ] + +Make sure to copy the flags when a bio_integrity_payload is cloned. +Otherwise per-I/O properties such as IP checksum flag will not be +passed down to the HBA driver. Since the integrity buffer is owned by +the original bio, the BIP_BLOCK_INTEGRITY flag needs to be masked off +to avoid a double free in the completion path. + +Fixes: aae7df50190a ("block: Integrity checksum flag") +Fixes: b1f01388574c ("block: Relocate bio integrity flags") +Reported-by: Saurav Kashyap +Tested-by: Saurav Kashyap +Signed-off-by: Martin K. Petersen +Reviewed-by: Christoph Hellwig +Reviewed-by: Chaitanya Kulkarni +Link: https://lore.kernel.org/r/20230215171801.21062-1-martin.petersen@oracle.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/bio-integrity.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/block/bio-integrity.c b/block/bio-integrity.c +index 4a7c33ed9a661..4f34ac27c47dd 100644 +--- a/block/bio-integrity.c ++++ b/block/bio-integrity.c +@@ -417,6 +417,7 @@ int bio_integrity_clone(struct bio *bio, struct bio *bio_src, + + bip->bip_vcnt = bip_src->bip_vcnt; + bip->bip_iter = bip_src->bip_iter; ++ bip->bip_flags = bip_src->bip_flags & ~BIP_BLOCK_INTEGRITY; + + return 0; + } +-- +2.39.2 + diff --git a/queue-5.15/bluetooth-btusb-add-vid-pid-13d3-3529-for-realtek-rt.patch b/queue-5.15/bluetooth-btusb-add-vid-pid-13d3-3529-for-realtek-rt.patch new file mode 100644 index 00000000000..2af7f0e362a --- /dev/null +++ b/queue-5.15/bluetooth-btusb-add-vid-pid-13d3-3529-for-realtek-rt.patch @@ -0,0 +1,70 @@ +From d726fcded1ff364dca5f6e8d967e874d45615d3a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Dec 2022 14:07:13 -0500 +Subject: Bluetooth: btusb: Add VID:PID 13d3:3529 for Realtek RTL8821CE + +From: Moises Cardona + +[ Upstream commit 1eec3b95b5ce7fb2cdd273ac4f8b24b1ed6776a1 ] + +This patch adds VID:PID 13d3:3529 to the btusb.c file. + +This VID:PID is found in the Realtek RTL8821CE module +(M.2 module AW-CB304NF on an ASUS E210MA laptop) + +Output of /sys/kernel/debug/usb/devices: + +T: Bus=01 Lev=01 Prnt=01 Port=07 Cnt=02 Dev#= 3 Spd=12 MxCh= 0 +D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=13d3 ProdID=3529 Rev= 1.10 +S: Manufacturer=Realtek +S: Product=Bluetooth Radio +C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=500mA +I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms +E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms +I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms +I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms +I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms +I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms +I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms + +Signed-off-by: Moises Cardona +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/btusb.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index 9c32263f872b9..9eb2267bd3a02 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -400,6 +400,10 @@ static const struct usb_device_id blacklist_table[] = { + { USB_VENDOR_AND_INTERFACE_INFO(0x8087, 0xe0, 0x01, 0x01), + .driver_info = BTUSB_IGNORE }, + ++ /* Realtek 8821CE Bluetooth devices */ ++ { USB_DEVICE(0x13d3, 0x3529), .driver_info = BTUSB_REALTEK | ++ BTUSB_WIDEBAND_SPEECH }, ++ + /* Realtek 8822CE Bluetooth devices */ + { USB_DEVICE(0x0bda, 0xb00c), .driver_info = BTUSB_REALTEK | + BTUSB_WIDEBAND_SPEECH }, +-- +2.39.2 + diff --git a/queue-5.15/bluetooth-hci_qca-get-wakeup-status-from-serdev-devi.patch b/queue-5.15/bluetooth-hci_qca-get-wakeup-status-from-serdev-devi.patch new file mode 100644 index 00000000000..bfb2d1985d9 --- /dev/null +++ b/queue-5.15/bluetooth-hci_qca-get-wakeup-status-from-serdev-devi.patch @@ -0,0 +1,43 @@ +From 6898740e06ec65505eabfff5637bf2d4cb629202 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Feb 2023 09:47:01 -0800 +Subject: Bluetooth: hci_qca: get wakeup status from serdev device handle + +From: Zhengping Jiang + +[ Upstream commit 03b0093f7b310493bc944a20f725228cfe0d3fea ] + +Bluetooth controller attached via the UART is handled by the serdev driver. +Get the wakeup status from the device handle through serdev, instead of the +parent path. + +Fixes: c1a74160eaf1 ("Bluetooth: hci_qca: Add device_may_wakeup support") +Signed-off-by: Zhengping Jiang +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/hci_qca.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/bluetooth/hci_qca.c b/drivers/bluetooth/hci_qca.c +index e45777b3f5dac..8041155f30214 100644 +--- a/drivers/bluetooth/hci_qca.c ++++ b/drivers/bluetooth/hci_qca.c +@@ -1582,10 +1582,11 @@ static bool qca_prevent_wake(struct hci_dev *hdev) + struct hci_uart *hu = hci_get_drvdata(hdev); + bool wakeup; + +- /* UART driver handles the interrupt from BT SoC.So we need to use +- * device handle of UART driver to get the status of device may wakeup. ++ /* BT SoC attached through the serial bus is handled by the serdev driver. ++ * So we need to use the device handle of the serdev driver to get the ++ * status of device may wakeup. + */ +- wakeup = device_may_wakeup(hu->serdev->ctrl->dev.parent); ++ wakeup = device_may_wakeup(&hu->serdev->ctrl->dev); + bt_dev_dbg(hu->hdev, "wakeup status : %d", wakeup); + + return !wakeup; +-- +2.39.2 + diff --git a/queue-5.15/bluetooth-l2cap-fix-potential-user-after-free.patch b/queue-5.15/bluetooth-l2cap-fix-potential-user-after-free.patch new file mode 100644 index 00000000000..035086f8c24 --- /dev/null +++ b/queue-5.15/bluetooth-l2cap-fix-potential-user-after-free.patch @@ -0,0 +1,93 @@ +From 7d83ac71502327136b6adfaf5c36fc8a65062131 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Feb 2023 14:01:11 -0800 +Subject: Bluetooth: L2CAP: Fix potential user-after-free + +From: Luiz Augusto von Dentz + +[ Upstream commit df5703348813235874d851934e957c3723d71644 ] + +This fixes all instances of which requires to allocate a buffer calling +alloc_skb which may release the chan lock and reacquire later which +makes it possible that the chan is disconnected in the meantime. + +Fixes: a6a5568c03c4 ("Bluetooth: Lock the L2CAP channel when sending") +Reported-by: Alexander Coffin +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + net/bluetooth/l2cap_core.c | 24 ------------------------ + net/bluetooth/l2cap_sock.c | 8 ++++++++ + 2 files changed, 8 insertions(+), 24 deletions(-) + +diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c +index e15fcf72a3428..a21e086d69d0e 100644 +--- a/net/bluetooth/l2cap_core.c ++++ b/net/bluetooth/l2cap_core.c +@@ -2683,14 +2683,6 @@ int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len) + if (IS_ERR(skb)) + return PTR_ERR(skb); + +- /* Channel lock is released before requesting new skb and then +- * reacquired thus we need to recheck channel state. +- */ +- if (chan->state != BT_CONNECTED) { +- kfree_skb(skb); +- return -ENOTCONN; +- } +- + l2cap_do_send(chan, skb); + return len; + } +@@ -2735,14 +2727,6 @@ int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len) + if (IS_ERR(skb)) + return PTR_ERR(skb); + +- /* Channel lock is released before requesting new skb and then +- * reacquired thus we need to recheck channel state. +- */ +- if (chan->state != BT_CONNECTED) { +- kfree_skb(skb); +- return -ENOTCONN; +- } +- + l2cap_do_send(chan, skb); + err = len; + break; +@@ -2763,14 +2747,6 @@ int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len) + */ + err = l2cap_segment_sdu(chan, &seg_queue, msg, len); + +- /* The channel could have been closed while segmenting, +- * check that it is still connected. +- */ +- if (chan->state != BT_CONNECTED) { +- __skb_queue_purge(&seg_queue); +- err = -ENOTCONN; +- } +- + if (err) + break; + +diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c +index d2c6785205992..a267c9b6bcef4 100644 +--- a/net/bluetooth/l2cap_sock.c ++++ b/net/bluetooth/l2cap_sock.c +@@ -1623,6 +1623,14 @@ static struct sk_buff *l2cap_sock_alloc_skb_cb(struct l2cap_chan *chan, + if (!skb) + return ERR_PTR(err); + ++ /* Channel lock is released before requesting new skb and then ++ * reacquired thus we need to recheck channel state. ++ */ ++ if (chan->state != BT_CONNECTED) { ++ kfree_skb(skb); ++ return ERR_PTR(-ENOTCONN); ++ } ++ + skb->priority = sk->sk_priority; + + bt_cb(skb)->l2cap.chan = chan; +-- +2.39.2 + diff --git a/queue-5.15/bpf-fix-global-subprog-context-argument-resolution-l.patch b/queue-5.15/bpf-fix-global-subprog-context-argument-resolution-l.patch new file mode 100644 index 00000000000..f43dae2b20a --- /dev/null +++ b/queue-5.15/bpf-fix-global-subprog-context-argument-resolution-l.patch @@ -0,0 +1,70 @@ +From f73fbd1bb63b940e50efd10a484916c4766c1d4a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Feb 2023 20:59:52 -0800 +Subject: bpf: Fix global subprog context argument resolution logic + +From: Andrii Nakryiko + +[ Upstream commit d384dce281ed1b504fae2e279507827638d56fa3 ] + +KPROBE program's user-facing context type is defined as typedef +bpf_user_pt_regs_t. This leads to a problem when trying to passing +kprobe/uprobe/usdt context argument into global subprog, as kernel +always strip away mods and typedefs of user-supplied type, but takes +expected type from bpf_ctx_convert as is, which causes mismatch. + +Current way to work around this is to define a fake struct with the same +name as expected typedef: + + struct bpf_user_pt_regs_t {}; + + __noinline my_global_subprog(struct bpf_user_pt_regs_t *ctx) { ... } + +This patch fixes the issue by resolving expected type, if it's not +a struct. It still leaves the above work-around working for backwards +compatibility. + +Fixes: 91cc1a99740e ("bpf: Annotate context types") +Signed-off-by: Andrii Nakryiko +Signed-off-by: Daniel Borkmann +Acked-by: Stanislav Fomichev +Link: https://lore.kernel.org/bpf/20230216045954.3002473-2-andrii@kernel.org +Signed-off-by: Sasha Levin +--- + kernel/bpf/btf.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c +index 0c2fa93bd8d27..1f9369b677fe2 100644 +--- a/kernel/bpf/btf.c ++++ b/kernel/bpf/btf.c +@@ -4468,6 +4468,7 @@ btf_get_prog_ctx_type(struct bpf_verifier_log *log, const struct btf *btf, + if (!ctx_struct) + /* should not happen */ + return NULL; ++again: + ctx_tname = btf_name_by_offset(btf_vmlinux, ctx_struct->name_off); + if (!ctx_tname) { + /* should not happen */ +@@ -4481,8 +4482,16 @@ btf_get_prog_ctx_type(struct bpf_verifier_log *log, const struct btf *btf, + * int socket_filter_bpf_prog(struct __sk_buff *skb) + * { // no fields of skb are ever used } + */ +- if (strcmp(ctx_tname, tname)) +- return NULL; ++ if (strcmp(ctx_tname, tname)) { ++ /* bpf_user_pt_regs_t is a typedef, so resolve it to ++ * underlying struct and check name again ++ */ ++ if (!btf_type_is_modifier(ctx_struct)) ++ return NULL; ++ while (btf_type_is_modifier(ctx_struct)) ++ ctx_struct = btf_type_by_id(btf_vmlinux, ctx_struct->type); ++ goto again; ++ } + return ctx_type; + } + +-- +2.39.2 + diff --git a/queue-5.15/bpftool-profile-online-cpus-instead-of-possible.patch b/queue-5.15/bpftool-profile-online-cpus-instead-of-possible.patch new file mode 100644 index 00000000000..4a0a7fa7a40 --- /dev/null +++ b/queue-5.15/bpftool-profile-online-cpus-instead-of-possible.patch @@ -0,0 +1,116 @@ +From d64f377a43b9e0f402a2007d1ac2da313e268d52 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Feb 2023 21:17:01 +0800 +Subject: bpftool: profile online CPUs instead of possible + +From: Tonghao Zhang + +[ Upstream commit 377c16fa3f3c60d21e4b05314c8be034ce37f2eb ] + +The number of online cpu may be not equal to possible cpu. +"bpftool prog profile" can not create pmu event on possible +but on online cpu. + +$ dmidecode -s system-product-name +PowerEdge R620 +$ cat /sys/devices/system/cpu/possible +0-47 +$ cat /sys/devices/system/cpu/online +0-31 + +Disable cpu dynamically: +$ echo 0 > /sys/devices/system/cpu/cpuX/online + +If one cpu is offline, perf_event_open will return ENODEV. +To fix this issue: +* check value returned and skip offline cpu. +* close pmu_fd immediately on error path, avoid fd leaking. + +Fixes: 47c09d6a9f67 ("bpftool: Introduce "prog profile" command") +Signed-off-by: Tonghao Zhang +Cc: Quentin Monnet +Cc: Alexei Starovoitov +Cc: Daniel Borkmann +Cc: Andrii Nakryiko +Cc: Martin KaFai Lau +Cc: Song Liu +Cc: Yonghong Song +Cc: John Fastabend +Cc: KP Singh +Cc: Stanislav Fomichev +Cc: Hao Luo +Cc: Jiri Olsa +Acked-by: John Fastabend +Link: https://lore.kernel.org/r/20230202131701.29519-1-tong@infragraf.org +Signed-off-by: Martin KaFai Lau +Signed-off-by: Sasha Levin +--- + tools/bpf/bpftool/prog.c | 38 ++++++++++++++++++++++++++++++-------- + 1 file changed, 30 insertions(+), 8 deletions(-) + +diff --git a/tools/bpf/bpftool/prog.c b/tools/bpf/bpftool/prog.c +index f8755beb3d9eb..bdd4d3b12f6c0 100644 +--- a/tools/bpf/bpftool/prog.c ++++ b/tools/bpf/bpftool/prog.c +@@ -2064,10 +2064,38 @@ static void profile_close_perf_events(struct profiler_bpf *obj) + profile_perf_event_cnt = 0; + } + ++static int profile_open_perf_event(int mid, int cpu, int map_fd) ++{ ++ int pmu_fd; ++ ++ pmu_fd = syscall(__NR_perf_event_open, &metrics[mid].attr, ++ -1 /*pid*/, cpu, -1 /*group_fd*/, 0); ++ if (pmu_fd < 0) { ++ if (errno == ENODEV) { ++ p_info("cpu %d may be offline, skip %s profiling.", ++ cpu, metrics[mid].name); ++ profile_perf_event_cnt++; ++ return 0; ++ } ++ return -1; ++ } ++ ++ if (bpf_map_update_elem(map_fd, ++ &profile_perf_event_cnt, ++ &pmu_fd, BPF_ANY) || ++ ioctl(pmu_fd, PERF_EVENT_IOC_ENABLE, 0)) { ++ close(pmu_fd); ++ return -1; ++ } ++ ++ profile_perf_events[profile_perf_event_cnt++] = pmu_fd; ++ return 0; ++} ++ + static int profile_open_perf_events(struct profiler_bpf *obj) + { + unsigned int cpu, m; +- int map_fd, pmu_fd; ++ int map_fd; + + profile_perf_events = calloc( + sizeof(int), obj->rodata->num_cpu * obj->rodata->num_metric); +@@ -2086,17 +2114,11 @@ static int profile_open_perf_events(struct profiler_bpf *obj) + if (!metrics[m].selected) + continue; + for (cpu = 0; cpu < obj->rodata->num_cpu; cpu++) { +- pmu_fd = syscall(__NR_perf_event_open, &metrics[m].attr, +- -1/*pid*/, cpu, -1/*group_fd*/, 0); +- if (pmu_fd < 0 || +- bpf_map_update_elem(map_fd, &profile_perf_event_cnt, +- &pmu_fd, BPF_ANY) || +- ioctl(pmu_fd, PERF_EVENT_IOC_ENABLE, 0)) { ++ if (profile_open_perf_event(m, cpu, map_fd)) { + p_err("failed to create event %s on cpu %d", + metrics[m].name, cpu); + return -1; + } +- profile_perf_events[profile_perf_event_cnt++] = pmu_fd; + } + } + return 0; +-- +2.39.2 + diff --git a/queue-5.15/builddeb-clean-generated-package-content.patch b/queue-5.15/builddeb-clean-generated-package-content.patch new file mode 100644 index 00000000000..961fd418810 --- /dev/null +++ b/queue-5.15/builddeb-clean-generated-package-content.patch @@ -0,0 +1,37 @@ +From a2dfa72859941bd3608e6307b924dbd04aae3af9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 May 2021 01:01:37 +0200 +Subject: builddeb: clean generated package content + +From: Bastian Germann + +[ Upstream commit c9f9cf2560e40b62015c6c4a04be60f55ce5240e ] + +For each binary Debian package, a directory with the package name is +created in the debian directory. Correct the generated file matches in the +package's clean target, which were renamed without adjusting the target. + +Fixes: 1694e94e4f46 ("builddeb: match temporary directory name to the package name") +Signed-off-by: Bastian Germann +Signed-off-by: Masahiro Yamada +Signed-off-by: Sasha Levin +--- + scripts/package/mkdebian | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/scripts/package/mkdebian b/scripts/package/mkdebian +index 60a2a63a5e900..32d528a367868 100755 +--- a/scripts/package/mkdebian ++++ b/scripts/package/mkdebian +@@ -236,7 +236,7 @@ binary-arch: build-arch + KBUILD_BUILD_VERSION=${revision} -f \$(srctree)/Makefile intdeb-pkg + + clean: +- rm -rf debian/*tmp debian/files ++ rm -rf debian/files debian/linux-* + \$(MAKE) clean + + binary: binary-arch +-- +2.39.2 + diff --git a/queue-5.15/can-esd_usb-move-mislocated-storage-of-sja1000_ecc_s.patch b/queue-5.15/can-esd_usb-move-mislocated-storage-of-sja1000_ecc_s.patch new file mode 100644 index 00000000000..89d179b45f5 --- /dev/null +++ b/queue-5.15/can-esd_usb-move-mislocated-storage-of-sja1000_ecc_s.patch @@ -0,0 +1,49 @@ +From dde6f33c5c175c71121a080f4430a81d305631c4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Feb 2023 20:04:48 +0100 +Subject: can: esd_usb: Move mislocated storage of SJA1000_ECC_SEG bits in case + of a bus error + +From: Frank Jungclaus + +[ Upstream commit 118469f88180438ef43dee93d71f77c00e7b425d ] + +Move the supply for cf->data[3] (bit stream position of CAN error), in +case of a bus- or protocol-error, outside of the "switch (ecc & +SJA1000_ECC_MASK){}"-statement, because this bit stream position is +independent of the error type. + +Fixes: 96d8e90382dc ("can: Add driver for esd CAN-USB/2 device") +Signed-off-by: Frank Jungclaus +Link: https://lore.kernel.org/all/20230216190450.3901254-2-frank.jungclaus@esd.eu +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/usb/esd_usb2.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/can/usb/esd_usb2.c b/drivers/net/can/usb/esd_usb2.c +index 9ed048cb07e6d..1abdf88597de0 100644 +--- a/drivers/net/can/usb/esd_usb2.c ++++ b/drivers/net/can/usb/esd_usb2.c +@@ -278,7 +278,6 @@ static void esd_usb2_rx_event(struct esd_usb2_net_priv *priv, + cf->data[2] |= CAN_ERR_PROT_STUFF; + break; + default: +- cf->data[3] = ecc & SJA1000_ECC_SEG; + break; + } + +@@ -286,6 +285,9 @@ static void esd_usb2_rx_event(struct esd_usb2_net_priv *priv, + if (!(ecc & SJA1000_ECC_DIR)) + cf->data[2] |= CAN_ERR_PROT_TX; + ++ /* Bit stream position in CAN frame as the error was detected */ ++ cf->data[3] = ecc & SJA1000_ECC_SEG; ++ + if (priv->can.state == CAN_STATE_ERROR_WARNING || + priv->can.state == CAN_STATE_ERROR_PASSIVE) { + cf->data[1] = (txerr > rxerr) ? +-- +2.39.2 + diff --git a/queue-5.15/cifs-fix-lost-destroy-smbd-connection-when-mr-alloca.patch b/queue-5.15/cifs-fix-lost-destroy-smbd-connection-when-mr-alloca.patch new file mode 100644 index 00000000000..2a3896faef7 --- /dev/null +++ b/queue-5.15/cifs-fix-lost-destroy-smbd-connection-when-mr-alloca.patch @@ -0,0 +1,42 @@ +From c485c6acbdb9bfc21a55f0e5c86680f011a3a509 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Nov 2022 16:42:07 +0800 +Subject: cifs: Fix lost destroy smbd connection when MR allocate failed + +From: Zhang Xiaoxu + +[ Upstream commit e9d3401d95d62a9531082cd2453ed42f2740e3fd ] + +If the MR allocate failed, the smb direct connection info is NULL, +then smbd_destroy() will directly return, then the connection info +will be leaked. + +Let's set the smb direct connection info to the server before call +smbd_destroy(). + +Fixes: c7398583340a ("CIFS: SMBD: Implement RDMA memory registration") +Signed-off-by: Zhang Xiaoxu +Acked-by: Paulo Alcantara (SUSE) +Reviewed-by: David Howells +Reviewed-by: Tom Talpey +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/cifs/smbdirect.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/cifs/smbdirect.c b/fs/cifs/smbdirect.c +index cb93cccbf0c41..58f086aabc888 100644 +--- a/fs/cifs/smbdirect.c ++++ b/fs/cifs/smbdirect.c +@@ -1702,6 +1702,7 @@ static struct smbd_connection *_smbd_get_connection( + + allocate_mr_failed: + /* At this point, need to a full transport shutdown */ ++ server->smbd_conn = info; + smbd_destroy(server); + return NULL; + +-- +2.39.2 + diff --git a/queue-5.15/cifs-fix-warning-and-uaf-when-destroy-the-mr-list.patch b/queue-5.15/cifs-fix-warning-and-uaf-when-destroy-the-mr-list.patch new file mode 100644 index 00000000000..3dfc45e19a2 --- /dev/null +++ b/queue-5.15/cifs-fix-warning-and-uaf-when-destroy-the-mr-list.patch @@ -0,0 +1,133 @@ +From a4e48bddb86f5e065bb988f378e801612ff0876f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Nov 2022 16:42:08 +0800 +Subject: cifs: Fix warning and UAF when destroy the MR list + +From: Zhang Xiaoxu + +[ Upstream commit 3e161c2791f8e661eed24a2c624087084d910215 ] + +If the MR allocate failed, the MR recovery work not initialized +and list not cleared. Then will be warning and UAF when release +the MR: + + WARNING: CPU: 4 PID: 824 at kernel/workqueue.c:3066 __flush_work.isra.0+0xf7/0x110 + CPU: 4 PID: 824 Comm: mount.cifs Not tainted 6.1.0-rc5+ #82 + RIP: 0010:__flush_work.isra.0+0xf7/0x110 + Call Trace: + + __cancel_work_timer+0x2ba/0x2e0 + smbd_destroy+0x4e1/0x990 + _smbd_get_connection+0x1cbd/0x2110 + smbd_get_connection+0x21/0x40 + cifs_get_tcp_session+0x8ef/0xda0 + mount_get_conns+0x60/0x750 + cifs_mount+0x103/0xd00 + cifs_smb3_do_mount+0x1dd/0xcb0 + smb3_get_tree+0x1d5/0x300 + vfs_get_tree+0x41/0xf0 + path_mount+0x9b3/0xdd0 + __x64_sys_mount+0x190/0x1d0 + do_syscall_64+0x35/0x80 + entry_SYSCALL_64_after_hwframe+0x46/0xb0 + + BUG: KASAN: use-after-free in smbd_destroy+0x4fc/0x990 + Read of size 8 at addr ffff88810b156a08 by task mount.cifs/824 + CPU: 4 PID: 824 Comm: mount.cifs Tainted: G W 6.1.0-rc5+ #82 + Call Trace: + dump_stack_lvl+0x34/0x44 + print_report+0x171/0x472 + kasan_report+0xad/0x130 + smbd_destroy+0x4fc/0x990 + _smbd_get_connection+0x1cbd/0x2110 + smbd_get_connection+0x21/0x40 + cifs_get_tcp_session+0x8ef/0xda0 + mount_get_conns+0x60/0x750 + cifs_mount+0x103/0xd00 + cifs_smb3_do_mount+0x1dd/0xcb0 + smb3_get_tree+0x1d5/0x300 + vfs_get_tree+0x41/0xf0 + path_mount+0x9b3/0xdd0 + __x64_sys_mount+0x190/0x1d0 + do_syscall_64+0x35/0x80 + entry_SYSCALL_64_after_hwframe+0x46/0xb0 + + Allocated by task 824: + kasan_save_stack+0x1e/0x40 + kasan_set_track+0x21/0x30 + __kasan_kmalloc+0x7a/0x90 + _smbd_get_connection+0x1b6f/0x2110 + smbd_get_connection+0x21/0x40 + cifs_get_tcp_session+0x8ef/0xda0 + mount_get_conns+0x60/0x750 + cifs_mount+0x103/0xd00 + cifs_smb3_do_mount+0x1dd/0xcb0 + smb3_get_tree+0x1d5/0x300 + vfs_get_tree+0x41/0xf0 + path_mount+0x9b3/0xdd0 + __x64_sys_mount+0x190/0x1d0 + do_syscall_64+0x35/0x80 + entry_SYSCALL_64_after_hwframe+0x46/0xb0 + + Freed by task 824: + kasan_save_stack+0x1e/0x40 + kasan_set_track+0x21/0x30 + kasan_save_free_info+0x2a/0x40 + ____kasan_slab_free+0x143/0x1b0 + __kmem_cache_free+0xc8/0x330 + _smbd_get_connection+0x1c6a/0x2110 + smbd_get_connection+0x21/0x40 + cifs_get_tcp_session+0x8ef/0xda0 + mount_get_conns+0x60/0x750 + cifs_mount+0x103/0xd00 + cifs_smb3_do_mount+0x1dd/0xcb0 + smb3_get_tree+0x1d5/0x300 + vfs_get_tree+0x41/0xf0 + path_mount+0x9b3/0xdd0 + __x64_sys_mount+0x190/0x1d0 + do_syscall_64+0x35/0x80 + entry_SYSCALL_64_after_hwframe+0x46/0xb0 + +Let's initialize the MR recovery work before MR allocate to prevent +the warning, remove the MRs from the list to prevent the UAF. + +Fixes: c7398583340a ("CIFS: SMBD: Implement RDMA memory registration") +Acked-by: Paulo Alcantara (SUSE) +Reviewed-by: Tom Talpey +Signed-off-by: Zhang Xiaoxu +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/cifs/smbdirect.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/fs/cifs/smbdirect.c b/fs/cifs/smbdirect.c +index 58f086aabc888..a9a5d27b8d38b 100644 +--- a/fs/cifs/smbdirect.c ++++ b/fs/cifs/smbdirect.c +@@ -2251,6 +2251,7 @@ static int allocate_mr_list(struct smbd_connection *info) + atomic_set(&info->mr_ready_count, 0); + atomic_set(&info->mr_used_count, 0); + init_waitqueue_head(&info->wait_for_mr_cleanup); ++ INIT_WORK(&info->mr_recovery_work, smbd_mr_recovery_work); + /* Allocate more MRs (2x) than hardware responder_resources */ + for (i = 0; i < info->responder_resources * 2; i++) { + smbdirect_mr = kzalloc(sizeof(*smbdirect_mr), GFP_KERNEL); +@@ -2278,13 +2279,13 @@ static int allocate_mr_list(struct smbd_connection *info) + list_add_tail(&smbdirect_mr->list, &info->mr_list); + atomic_inc(&info->mr_ready_count); + } +- INIT_WORK(&info->mr_recovery_work, smbd_mr_recovery_work); + return 0; + + out: + kfree(smbdirect_mr); + + list_for_each_entry_safe(smbdirect_mr, tmp, &info->mr_list, list) { ++ list_del(&smbdirect_mr->list); + ib_dereg_mr(smbdirect_mr->mr); + kfree(smbdirect_mr->sgl); + kfree(smbdirect_mr); +-- +2.39.2 + diff --git a/queue-5.15/clocksource-suspend-the-watchdog-temporarily-when-hi.patch b/queue-5.15/clocksource-suspend-the-watchdog-temporarily-when-hi.patch new file mode 100644 index 00000000000..afec33e0eb4 --- /dev/null +++ b/queue-5.15/clocksource-suspend-the-watchdog-temporarily-when-hi.patch @@ -0,0 +1,146 @@ +From c67d3fefefa4d9b3e63f218e21e3f47ef00d9e60 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Dec 2022 16:25:12 +0800 +Subject: clocksource: Suspend the watchdog temporarily when high read latency + detected + +From: Feng Tang + +[ Upstream commit b7082cdfc464bf9231300605d03eebf943dda307 ] + +Bugs have been reported on 8 sockets x86 machines in which the TSC was +wrongly disabled when the system is under heavy workload. + + [ 818.380354] clocksource: timekeeping watchdog on CPU336: hpet wd-wd read-back delay of 1203520ns + [ 818.436160] clocksource: wd-tsc-wd read-back delay of 181880ns, clock-skew test skipped! + [ 819.402962] clocksource: timekeeping watchdog on CPU338: hpet wd-wd read-back delay of 324000ns + [ 819.448036] clocksource: wd-tsc-wd read-back delay of 337240ns, clock-skew test skipped! + [ 819.880863] clocksource: timekeeping watchdog on CPU339: hpet read-back delay of 150280ns, attempt 3, marking unstable + [ 819.936243] tsc: Marking TSC unstable due to clocksource watchdog + [ 820.068173] TSC found unstable after boot, most likely due to broken BIOS. Use 'tsc=unstable'. + [ 820.092382] sched_clock: Marking unstable (818769414384, 1195404998) + [ 820.643627] clocksource: Checking clocksource tsc synchronization from CPU 267 to CPUs 0,4,25,70,126,430,557,564. + [ 821.067990] clocksource: Switched to clocksource hpet + +This can be reproduced by running memory intensive 'stream' tests, +or some of the stress-ng subcases such as 'ioport'. + +The reason for these issues is the when system is under heavy load, the +read latency of the clocksources can be very high. Even lightweight TSC +reads can show high latencies, and latencies are much worse for external +clocksources such as HPET or the APIC PM timer. These latencies can +result in false-positive clocksource-unstable determinations. + +These issues were initially reported by a customer running on a production +system, and this problem was reproduced on several generations of Xeon +servers, especially when running the stress-ng test. These Xeon servers +were not production systems, but they did have the latest steppings +and firmware. + +Given that the clocksource watchdog is a continual diagnostic check with +frequency of twice a second, there is no need to rush it when the system +is under heavy load. Therefore, when high clocksource read latencies +are detected, suspend the watchdog timer for 5 minutes. + +Signed-off-by: Feng Tang +Acked-by: Waiman Long +Cc: John Stultz +Cc: Thomas Gleixner +Cc: Stephen Boyd +Cc: Feng Tang +Signed-off-by: Paul E. McKenney +Signed-off-by: Sasha Levin +--- + kernel/time/clocksource.c | 45 ++++++++++++++++++++++++++++----------- + 1 file changed, 32 insertions(+), 13 deletions(-) + +diff --git a/kernel/time/clocksource.c b/kernel/time/clocksource.c +index bcad1a1e5dcf1..97ec98041f926 100644 +--- a/kernel/time/clocksource.c ++++ b/kernel/time/clocksource.c +@@ -378,6 +378,15 @@ void clocksource_verify_percpu(struct clocksource *cs) + } + EXPORT_SYMBOL_GPL(clocksource_verify_percpu); + ++static inline void clocksource_reset_watchdog(void) ++{ ++ struct clocksource *cs; ++ ++ list_for_each_entry(cs, &watchdog_list, wd_list) ++ cs->flags &= ~CLOCK_SOURCE_WATCHDOG; ++} ++ ++ + static void clocksource_watchdog(struct timer_list *unused) + { + u64 csnow, wdnow, cslast, wdlast, delta; +@@ -385,6 +394,7 @@ static void clocksource_watchdog(struct timer_list *unused) + int64_t wd_nsec, cs_nsec; + struct clocksource *cs; + enum wd_read_status read_ret; ++ unsigned long extra_wait = 0; + u32 md; + + spin_lock(&watchdog_lock); +@@ -404,13 +414,30 @@ static void clocksource_watchdog(struct timer_list *unused) + + read_ret = cs_watchdog_read(cs, &csnow, &wdnow); + +- if (read_ret != WD_READ_SUCCESS) { +- if (read_ret == WD_READ_UNSTABLE) +- /* Clock readout unreliable, so give it up. */ +- __clocksource_unstable(cs); ++ if (read_ret == WD_READ_UNSTABLE) { ++ /* Clock readout unreliable, so give it up. */ ++ __clocksource_unstable(cs); + continue; + } + ++ /* ++ * When WD_READ_SKIP is returned, it means the system is likely ++ * under very heavy load, where the latency of reading ++ * watchdog/clocksource is very big, and affect the accuracy of ++ * watchdog check. So give system some space and suspend the ++ * watchdog check for 5 minutes. ++ */ ++ if (read_ret == WD_READ_SKIP) { ++ /* ++ * As the watchdog timer will be suspended, and ++ * cs->last could keep unchanged for 5 minutes, reset ++ * the counters. ++ */ ++ clocksource_reset_watchdog(); ++ extra_wait = HZ * 300; ++ break; ++ } ++ + /* Clocksource initialized ? */ + if (!(cs->flags & CLOCK_SOURCE_WATCHDOG) || + atomic_read(&watchdog_reset_pending)) { +@@ -506,7 +533,7 @@ static void clocksource_watchdog(struct timer_list *unused) + * pair clocksource_stop_watchdog() clocksource_start_watchdog(). + */ + if (!timer_pending(&watchdog_timer)) { +- watchdog_timer.expires += WATCHDOG_INTERVAL; ++ watchdog_timer.expires += WATCHDOG_INTERVAL + extra_wait; + add_timer_on(&watchdog_timer, next_cpu); + } + out: +@@ -531,14 +558,6 @@ static inline void clocksource_stop_watchdog(void) + watchdog_running = 0; + } + +-static inline void clocksource_reset_watchdog(void) +-{ +- struct clocksource *cs; +- +- list_for_each_entry(cs, &watchdog_list, wd_list) +- cs->flags &= ~CLOCK_SOURCE_WATCHDOG; +-} +- + static void clocksource_resume_watchdog(void) + { + atomic_inc(&watchdog_reset_pending); +-- +2.39.2 + diff --git a/queue-5.15/coda-avoid-partial-allocation-of-sig_inputargs.patch b/queue-5.15/coda-avoid-partial-allocation-of-sig_inputargs.patch new file mode 100644 index 00000000000..dd9d20d0da8 --- /dev/null +++ b/queue-5.15/coda-avoid-partial-allocation-of-sig_inputargs.patch @@ -0,0 +1,46 @@ +From db14e43cdae0c75dba6b230dd92f78f5c7e8cdf2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Jan 2023 14:39:21 -0800 +Subject: coda: Avoid partial allocation of sig_inputArgs + +From: Kees Cook + +[ Upstream commit 48df133578c70185a95a49390d42df1996ddba2a ] + +GCC does not like having a partially allocated object, since it cannot +reason about it for bounds checking when it is passed to other code. +Instead, fully allocate sig_inputArgs. (Alternatively, sig_inputArgs +should be defined as a struct coda_in_hdr, if it is actually not using +any other part of the union.) Seen under GCC 13: + +../fs/coda/upcall.c: In function 'coda_upcall': +../fs/coda/upcall.c:801:22: warning: array subscript 'union inputArgs[0]' is partly outside array bounds of 'unsigned char[20]' [-Warray-bounds=] + 801 | sig_inputArgs->ih.opcode = CODA_SIGNAL; + | ^~ + +Cc: Jan Harkes +Cc: coda@cs.cmu.edu +Cc: codalist@coda.cs.cmu.edu +Signed-off-by: Kees Cook +Link: https://lore.kernel.org/r/20230127223921.never.882-kees@kernel.org +Signed-off-by: Sasha Levin +--- + fs/coda/upcall.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/coda/upcall.c b/fs/coda/upcall.c +index eb3b1898da462..610484c90260b 100644 +--- a/fs/coda/upcall.c ++++ b/fs/coda/upcall.c +@@ -790,7 +790,7 @@ static int coda_upcall(struct venus_comm *vcp, + sig_req = kmalloc(sizeof(struct upc_req), GFP_KERNEL); + if (!sig_req) goto exit; + +- sig_inputArgs = kvzalloc(sizeof(struct coda_in_hdr), GFP_KERNEL); ++ sig_inputArgs = kvzalloc(sizeof(*sig_inputArgs), GFP_KERNEL); + if (!sig_inputArgs) { + kfree(sig_req); + goto exit; +-- +2.39.2 + diff --git a/queue-5.15/coresight-cti-add-pm-runtime-call-in-enable_store.patch b/queue-5.15/coresight-cti-add-pm-runtime-call-in-enable_store.patch new file mode 100644 index 00000000000..22ccb493ab3 --- /dev/null +++ b/queue-5.15/coresight-cti-add-pm-runtime-call-in-enable_store.patch @@ -0,0 +1,56 @@ +From fc01e33265cd56ea4083221c5d2e4f928f8c4eb2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Jan 2023 11:07:35 +0000 +Subject: coresight: cti: Add PM runtime call in enable_store + +From: Mao Jinlong + +[ Upstream commit eff674a9b86a6ffdd10c3af3863545acf7f1ce4f ] + +In commit 6746eae4bbad ("coresight: cti: Fix hang in cti_disable_hw()") +PM runtime calls are removed from cti_enable_hw/cti_disable_hw. When +enabling CTI by writing enable sysfs node, clock for accessing CTI +register won't be enabled. Device will crash due to register access +issue. Add PM runtime call in enable_store to fix this issue. + +Fixes: 6746eae4bbad ("coresight: cti: Fix hang in cti_disable_hw()") +Signed-off-by: Mao Jinlong +[Change to only call pm_runtime_put if a disable happened] +Tested-by: Jinlong Mao +Signed-off-by: James Clark +Signed-off-by: Suzuki K Poulose +Link: https://lore.kernel.org/r/20230110110736.2709917-3-james.clark@arm.com +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/coresight/coresight-cti-sysfs.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +diff --git a/drivers/hwtracing/coresight/coresight-cti-sysfs.c b/drivers/hwtracing/coresight/coresight-cti-sysfs.c +index 7ff7e7780bbfb..92fc3000872a1 100644 +--- a/drivers/hwtracing/coresight/coresight-cti-sysfs.c ++++ b/drivers/hwtracing/coresight/coresight-cti-sysfs.c +@@ -108,10 +108,19 @@ static ssize_t enable_store(struct device *dev, + if (ret) + return ret; + +- if (val) ++ if (val) { ++ ret = pm_runtime_resume_and_get(dev->parent); ++ if (ret) ++ return ret; + ret = cti_enable(drvdata->csdev); +- else ++ if (ret) ++ pm_runtime_put(dev->parent); ++ } else { + ret = cti_disable(drvdata->csdev); ++ if (!ret) ++ pm_runtime_put(dev->parent); ++ } ++ + if (ret) + return ret; + return size; +-- +2.39.2 + diff --git a/queue-5.15/coresight-cti-prevent-negative-values-of-enable-coun.patch b/queue-5.15/coresight-cti-prevent-negative-values-of-enable-coun.patch new file mode 100644 index 00000000000..8d6b09f2d6d --- /dev/null +++ b/queue-5.15/coresight-cti-prevent-negative-values-of-enable-coun.patch @@ -0,0 +1,66 @@ +From daf18b01f55e098628ccdcf405dc013068d8f65b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Jan 2023 11:07:34 +0000 +Subject: coresight: cti: Prevent negative values of enable count + +From: James Clark + +[ Upstream commit 3244fb6dbbf1ffc114cdf382cc167bdd8c18088a ] + +Writing 0 to the enable control repeatedly results in a negative value +for enable_req_count. After this, writing 1 to the enable control +appears to not work until the count returns to positive. + +Change it so that it's impossible for enable_req_count to be < 0. +Return an error to indicate that the disable request was invalid. + +Fixes: 835d722ba10a ("coresight: cti: Initial CoreSight CTI Driver") +Tested-by: Jinlong Mao +Signed-off-by: James Clark +Reviewed-by: Mike Leach +Signed-off-by: Suzuki K Poulose +Link: https://lore.kernel.org/r/20230110110736.2709917-2-james.clark@arm.com +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/coresight/coresight-cti-core.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/drivers/hwtracing/coresight/coresight-cti-core.c b/drivers/hwtracing/coresight/coresight-cti-core.c +index dcd607a0c41a1..932e17f00c0ba 100644 +--- a/drivers/hwtracing/coresight/coresight-cti-core.c ++++ b/drivers/hwtracing/coresight/coresight-cti-core.c +@@ -151,9 +151,16 @@ static int cti_disable_hw(struct cti_drvdata *drvdata) + { + struct cti_config *config = &drvdata->config; + struct coresight_device *csdev = drvdata->csdev; ++ int ret = 0; + + spin_lock(&drvdata->spinlock); + ++ /* don't allow negative refcounts, return an error */ ++ if (!atomic_read(&drvdata->config.enable_req_count)) { ++ ret = -EINVAL; ++ goto cti_not_disabled; ++ } ++ + /* check refcount - disable on 0 */ + if (atomic_dec_return(&drvdata->config.enable_req_count) > 0) + goto cti_not_disabled; +@@ -171,12 +178,12 @@ static int cti_disable_hw(struct cti_drvdata *drvdata) + coresight_disclaim_device_unlocked(csdev); + CS_LOCK(drvdata->base); + spin_unlock(&drvdata->spinlock); +- return 0; ++ return ret; + + /* not disabled this call */ + cti_not_disabled: + spin_unlock(&drvdata->spinlock); +- return 0; ++ return ret; + } + + void cti_write_single_reg(struct cti_drvdata *drvdata, int offset, u32 value) +-- +2.39.2 + diff --git a/queue-5.15/coresight-etm4x-fix-accesses-to-trcseqrstevr-and-trc.patch b/queue-5.15/coresight-etm4x-fix-accesses-to-trcseqrstevr-and-trc.patch new file mode 100644 index 00000000000..6e4580aec1f --- /dev/null +++ b/queue-5.15/coresight-etm4x-fix-accesses-to-trcseqrstevr-and-trc.patch @@ -0,0 +1,69 @@ +From cc3989e1f9a1d59697ac09bfd3f9e39a675a689f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 14 Jan 2023 17:16:32 +0800 +Subject: coresight: etm4x: Fix accesses to TRCSEQRSTEVR and TRCSEQSTR + +From: Junhao He + +[ Upstream commit 589d928248b72f8377d45904a14bcf686aa8bbeb ] + +The TRCSEQRSTEVR and TRCSEQSTR registers are not implemented if the +TRCIDR5.NUMSEQSTATE == 0. Skip accessing the registers in such cases. + +Fixes: 2e1cdfe184b5 ("coresight-etm4x: Adding CoreSight ETM4x driver") +Signed-off-by: Junhao He +Reviewed-by: Mike Leach +Reviewed-by: Anshuman Khandual +Signed-off-by: Suzuki K Poulose +Link: https://lore.kernel.org/r/20230114091632.60095-1-hejunhao3@huawei.com +Signed-off-by: Sasha Levin +--- + .../hwtracing/coresight/coresight-etm4x-core.c | 18 ++++++++++++------ + 1 file changed, 12 insertions(+), 6 deletions(-) + +diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c +index e24252eaf8e40..aa64efa0e05f2 100644 +--- a/drivers/hwtracing/coresight/coresight-etm4x-core.c ++++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c +@@ -384,8 +384,10 @@ static int etm4_enable_hw(struct etmv4_drvdata *drvdata) + etm4x_relaxed_write32(csa, config->vipcssctlr, TRCVIPCSSCTLR); + for (i = 0; i < drvdata->nrseqstate - 1; i++) + etm4x_relaxed_write32(csa, config->seq_ctrl[i], TRCSEQEVRn(i)); +- etm4x_relaxed_write32(csa, config->seq_rst, TRCSEQRSTEVR); +- etm4x_relaxed_write32(csa, config->seq_state, TRCSEQSTR); ++ if (drvdata->nrseqstate) { ++ etm4x_relaxed_write32(csa, config->seq_rst, TRCSEQRSTEVR); ++ etm4x_relaxed_write32(csa, config->seq_state, TRCSEQSTR); ++ } + etm4x_relaxed_write32(csa, config->ext_inp, TRCEXTINSELR); + for (i = 0; i < drvdata->nr_cntr; i++) { + etm4x_relaxed_write32(csa, config->cntrldvr[i], TRCCNTRLDVRn(i)); +@@ -1618,8 +1620,10 @@ static int etm4_cpu_save(struct etmv4_drvdata *drvdata) + for (i = 0; i < drvdata->nrseqstate - 1; i++) + state->trcseqevr[i] = etm4x_read32(csa, TRCSEQEVRn(i)); + +- state->trcseqrstevr = etm4x_read32(csa, TRCSEQRSTEVR); +- state->trcseqstr = etm4x_read32(csa, TRCSEQSTR); ++ if (drvdata->nrseqstate) { ++ state->trcseqrstevr = etm4x_read32(csa, TRCSEQRSTEVR); ++ state->trcseqstr = etm4x_read32(csa, TRCSEQSTR); ++ } + state->trcextinselr = etm4x_read32(csa, TRCEXTINSELR); + + for (i = 0; i < drvdata->nr_cntr; i++) { +@@ -1731,8 +1735,10 @@ static void etm4_cpu_restore(struct etmv4_drvdata *drvdata) + for (i = 0; i < drvdata->nrseqstate - 1; i++) + etm4x_relaxed_write32(csa, state->trcseqevr[i], TRCSEQEVRn(i)); + +- etm4x_relaxed_write32(csa, state->trcseqrstevr, TRCSEQRSTEVR); +- etm4x_relaxed_write32(csa, state->trcseqstr, TRCSEQSTR); ++ if (drvdata->nrseqstate) { ++ etm4x_relaxed_write32(csa, state->trcseqrstevr, TRCSEQRSTEVR); ++ etm4x_relaxed_write32(csa, state->trcseqstr, TRCSEQSTR); ++ } + etm4x_relaxed_write32(csa, state->trcextinselr, TRCEXTINSELR); + + for (i = 0; i < drvdata->nr_cntr; i++) { +-- +2.39.2 + diff --git a/queue-5.15/crypto-ccp-avoid-page-allocation-failure-warning-for.patch b/queue-5.15/crypto-ccp-avoid-page-allocation-failure-warning-for.patch new file mode 100644 index 00000000000..6376320400e --- /dev/null +++ b/queue-5.15/crypto-ccp-avoid-page-allocation-failure-warning-for.patch @@ -0,0 +1,52 @@ +From 89e8a209659bc97606334beaa3a372dd1687c1e4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Dec 2022 14:18:46 -0800 +Subject: crypto: ccp - Avoid page allocation failure warning for SEV_GET_ID2 + +From: David Rientjes + +[ Upstream commit 91dfd98216d817ec5f1c55890bacb7b4fe9b068a ] + +For SEV_GET_ID2, the user provided length does not have a specified +limitation because the length of the ID may change in the future. The +kernel memory allocation, however, is implicitly limited to 4MB on x86 by +the page allocator, otherwise the kzalloc() will fail. + +When this happens, it is best not to spam the kernel log with the warning. +Simply fail the allocation and return ENOMEM to the user. + +Fixes: d6112ea0cb34 ("crypto: ccp - introduce SEV_GET_ID2 command") +Reported-by: Andy Nguyen +Reported-by: Peter Gonda +Suggested-by: Herbert Xu +Signed-off-by: David Rientjes +Acked-by: Tom Lendacky +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/ccp/sev-dev.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/drivers/crypto/ccp/sev-dev.c b/drivers/crypto/ccp/sev-dev.c +index 900727b5edda5..15ef60cd4b149 100644 +--- a/drivers/crypto/ccp/sev-dev.c ++++ b/drivers/crypto/ccp/sev-dev.c +@@ -667,7 +667,14 @@ static int sev_ioctl_do_get_id2(struct sev_issue_cmd *argp) + input_address = (void __user *)input.address; + + if (input.address && input.length) { +- id_blob = kzalloc(input.length, GFP_KERNEL); ++ /* ++ * The length of the ID shouldn't be assumed by software since ++ * it may change in the future. The allocation size is limited ++ * to 1 << (PAGE_SHIFT + MAX_ORDER - 1) by the page allocator. ++ * If the allocation fails, simply return ENOMEM rather than ++ * warning in the kernel log. ++ */ ++ id_blob = kzalloc(input.length, GFP_KERNEL | __GFP_NOWARN); + if (!id_blob) + return -ENOMEM; + +-- +2.39.2 + diff --git a/queue-5.15/crypto-ccp-failure-on-re-initialization-due-to-dupli.patch b/queue-5.15/crypto-ccp-failure-on-re-initialization-due-to-dupli.patch new file mode 100644 index 00000000000..339bb0f9244 --- /dev/null +++ b/queue-5.15/crypto-ccp-failure-on-re-initialization-due-to-dupli.patch @@ -0,0 +1,115 @@ +From 84f5f599d7bb50ddaba668c2ae424d562fb042af Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Jan 2023 10:15:02 +0800 +Subject: crypto: ccp - Failure on re-initialization due to duplicate sysfs + filename + +From: Koba Ko + +[ Upstream commit 299bf602b3f92f1456aef59c6413591fb02e762a ] + +The following warning appears during the CCP module re-initialization: + +[ 140.965403] sysfs: cannot create duplicate filename +'/devices/pci0000:00/0000:00:07.1/0000:03:00.2/dma/dma0chan0' +[ 140.975736] CPU: 0 PID: 388 Comm: kworker/0:2 Kdump: loaded Not +tainted 6.2.0-0.rc2.18.eln124.x86_64 #1 +[ 140.985185] Hardware name: HPE ProLiant DL325 Gen10/ProLiant DL325 +Gen10, BIOS A41 07/17/2020 +[ 140.993761] Workqueue: events work_for_cpu_fn +[ 140.998151] Call Trace: +[ 141.000613] +[ 141.002726] dump_stack_lvl+0x33/0x46 +[ 141.006415] sysfs_warn_dup.cold+0x17/0x23 +[ 141.010542] sysfs_create_dir_ns+0xba/0xd0 +[ 141.014670] kobject_add_internal+0xba/0x260 +[ 141.018970] kobject_add+0x81/0xb0 +[ 141.022395] device_add+0xdc/0x7e0 +[ 141.025822] ? complete_all+0x20/0x90 +[ 141.029510] __dma_async_device_channel_register+0xc9/0x130 +[ 141.035119] dma_async_device_register+0x19e/0x3b0 +[ 141.039943] ccp_dmaengine_register+0x334/0x3f0 [ccp] +[ 141.045042] ccp5_init+0x662/0x6a0 [ccp] +[ 141.049000] ? devm_kmalloc+0x40/0xd0 +[ 141.052688] ccp_dev_init+0xbb/0xf0 [ccp] +[ 141.056732] ? __pci_set_master+0x56/0xd0 +[ 141.060768] sp_init+0x70/0x90 [ccp] +[ 141.064377] sp_pci_probe+0x186/0x1b0 [ccp] +[ 141.068596] local_pci_probe+0x41/0x80 +[ 141.072374] work_for_cpu_fn+0x16/0x20 +[ 141.076145] process_one_work+0x1c8/0x380 +[ 141.080181] worker_thread+0x1ab/0x380 +[ 141.083953] ? __pfx_worker_thread+0x10/0x10 +[ 141.088250] kthread+0xda/0x100 +[ 141.091413] ? __pfx_kthread+0x10/0x10 +[ 141.095185] ret_from_fork+0x2c/0x50 +[ 141.098788] +[ 141.100996] kobject_add_internal failed for dma0chan0 with -EEXIST, +don't try to register things with the same name in the same directory. +[ 141.113703] ccp 0000:03:00.2: ccp initialization failed + +The /dma/dma0chan0 sysfs file is not removed since dma_chan object +has been released in ccp_dma_release() before releasing dma device. +A correct procedure would be: release dma channels first => unregister +dma device => release ccp dma object. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=216888 +Fixes: 68dbe80f5b51 ("crypto: ccp - Release dma channels before dmaengine unrgister") +Tested-by: Vladis Dronov +Signed-off-by: Koba Ko +Reviewed-by: Vladis Dronov +Acked-by: Tom Lendacky +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/ccp/ccp-dmaengine.c | 21 +++++++++++++++++---- + 1 file changed, 17 insertions(+), 4 deletions(-) + +diff --git a/drivers/crypto/ccp/ccp-dmaengine.c b/drivers/crypto/ccp/ccp-dmaengine.c +index 9f753cb4f5f18..b386a7063818b 100644 +--- a/drivers/crypto/ccp/ccp-dmaengine.c ++++ b/drivers/crypto/ccp/ccp-dmaengine.c +@@ -642,14 +642,26 @@ static void ccp_dma_release(struct ccp_device *ccp) + chan = ccp->ccp_dma_chan + i; + dma_chan = &chan->dma_chan; + +- if (dma_chan->client_count) +- dma_release_channel(dma_chan); +- + tasklet_kill(&chan->cleanup_tasklet); + list_del_rcu(&dma_chan->device_node); + } + } + ++static void ccp_dma_release_channels(struct ccp_device *ccp) ++{ ++ struct ccp_dma_chan *chan; ++ struct dma_chan *dma_chan; ++ unsigned int i; ++ ++ for (i = 0; i < ccp->cmd_q_count; i++) { ++ chan = ccp->ccp_dma_chan + i; ++ dma_chan = &chan->dma_chan; ++ ++ if (dma_chan->client_count) ++ dma_release_channel(dma_chan); ++ } ++} ++ + int ccp_dmaengine_register(struct ccp_device *ccp) + { + struct ccp_dma_chan *chan; +@@ -770,8 +782,9 @@ void ccp_dmaengine_unregister(struct ccp_device *ccp) + if (!dmaengine) + return; + +- ccp_dma_release(ccp); ++ ccp_dma_release_channels(ccp); + dma_async_device_unregister(dma_dev); ++ ccp_dma_release(ccp); + + kmem_cache_destroy(ccp->dma_desc_cache); + kmem_cache_destroy(ccp->dma_cmd_cache); +-- +2.39.2 + diff --git a/queue-5.15/crypto-ccp-flush-the-sev-es-tmr-memory-before-giving.patch b/queue-5.15/crypto-ccp-flush-the-sev-es-tmr-memory-before-giving.patch new file mode 100644 index 00000000000..3a4a19e147d --- /dev/null +++ b/queue-5.15/crypto-ccp-flush-the-sev-es-tmr-memory-before-giving.patch @@ -0,0 +1,49 @@ +From aff4f54cdc09ff2c24aeb921825828d945ba7026 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 23 Jan 2023 16:53:08 -0600 +Subject: crypto: ccp - Flush the SEV-ES TMR memory before giving it to + firmware + +From: Tom Lendacky + +[ Upstream commit 46a334a98f585ef78d51d8f5736596887bdd7f54 ] + +Perform a cache flush on the SEV-ES TMR memory after allocation to prevent +any possibility of the firmware encountering an error should dirty cache +lines be present. Use clflush_cache_range() to flush the SEV-ES TMR memory. + +Fixes: 97f9ac3db661 ("crypto: ccp - Add support for SEV-ES to the PSP driver") +Signed-off-by: Tom Lendacky +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/ccp/sev-dev.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/crypto/ccp/sev-dev.c b/drivers/crypto/ccp/sev-dev.c +index 7c9149492970d..70174a9118b19 100644 +--- a/drivers/crypto/ccp/sev-dev.c ++++ b/drivers/crypto/ccp/sev-dev.c +@@ -24,6 +24,7 @@ + #include + + #include ++#include + + #include "psp-dev.h" + #include "sev-dev.h" +@@ -1114,7 +1115,10 @@ void sev_pci_init(void) + + /* Obtain the TMR memory area for SEV-ES use */ + sev_es_tmr = sev_fw_alloc(SEV_ES_TMR_SIZE); +- if (!sev_es_tmr) ++ if (sev_es_tmr) ++ /* Must flush the cache before giving it to the firmware */ ++ clflush_cache_range(sev_es_tmr, SEV_ES_TMR_SIZE); ++ else + dev_warn(sev->dev, + "SEV: TMR allocation failed, SEV-ES support unavailable\n"); + +-- +2.39.2 + diff --git a/queue-5.15/crypto-ccp-refactor-out-sev_fw_alloc.patch b/queue-5.15/crypto-ccp-refactor-out-sev_fw_alloc.patch new file mode 100644 index 00000000000..ed8f0efa803 --- /dev/null +++ b/queue-5.15/crypto-ccp-refactor-out-sev_fw_alloc.patch @@ -0,0 +1,86 @@ +From ef1c7e216703aca6dac97d06871b3d91d8b8a88f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Dec 2021 15:33:04 -0800 +Subject: crypto: ccp - Refactor out sev_fw_alloc() + +From: Peter Gonda + +[ Upstream commit cc17982d58d1e67eab831e7023ede999dda56173 ] + +Create a helper function sev_fw_alloc() which can be used to allocate +aligned memory regions for use by the PSP firmware. Currently only used +for the SEV-ES TMR region but will be used for the SEV_INIT_EX NV memory +region. + +Signed-off-by: Peter Gonda +Reviewed-by: Marc Orr +Acked-by: David Rientjes +Acked-by: Brijesh Singh +Cc: Tom Lendacky +Cc: Brijesh Singh +Cc: Marc Orr +Cc: Joerg Roedel +Cc: Herbert Xu +Cc: David Rientjes +Cc: John Allen +Cc: "David S. Miller" +Cc: Paolo Bonzini +Cc: linux-crypto@vger.kernel.org +Cc: linux-kernel@vger.kernel.org +Signed-off-by: Herbert Xu +Stable-dep-of: 46a334a98f58 ("crypto: ccp - Flush the SEV-ES TMR memory before giving it to firmware") +Signed-off-by: Sasha Levin +--- + drivers/crypto/ccp/sev-dev.c | 20 +++++++++++++------- + 1 file changed, 13 insertions(+), 7 deletions(-) + +diff --git a/drivers/crypto/ccp/sev-dev.c b/drivers/crypto/ccp/sev-dev.c +index 15ef60cd4b149..7c9149492970d 100644 +--- a/drivers/crypto/ccp/sev-dev.c ++++ b/drivers/crypto/ccp/sev-dev.c +@@ -141,6 +141,17 @@ static int sev_cmd_buffer_len(int cmd) + return 0; + } + ++static void *sev_fw_alloc(unsigned long len) ++{ ++ struct page *page; ++ ++ page = alloc_pages(GFP_KERNEL, get_order(len)); ++ if (!page) ++ return NULL; ++ ++ return page_address(page); ++} ++ + static int __sev_do_cmd_locked(int cmd, void *data, int *psp_ret) + { + struct psp_device *psp = psp_master; +@@ -1087,7 +1098,6 @@ EXPORT_SYMBOL_GPL(sev_issue_cmd_external_user); + void sev_pci_init(void) + { + struct sev_device *sev = psp_master->sev_data; +- struct page *tmr_page; + int error, rc; + + if (!sev) +@@ -1103,14 +1113,10 @@ void sev_pci_init(void) + sev_get_api_version(); + + /* Obtain the TMR memory area for SEV-ES use */ +- tmr_page = alloc_pages(GFP_KERNEL, get_order(SEV_ES_TMR_SIZE)); +- if (tmr_page) { +- sev_es_tmr = page_address(tmr_page); +- } else { +- sev_es_tmr = NULL; ++ sev_es_tmr = sev_fw_alloc(SEV_ES_TMR_SIZE); ++ if (!sev_es_tmr) + dev_warn(sev->dev, + "SEV: TMR allocation failed, SEV-ES support unavailable\n"); +- } + + /* Initialize the platform */ + rc = sev_platform_init(&error); +-- +2.39.2 + diff --git a/queue-5.15/crypto-crypto4xx-call-dma_unmap_page-when-done.patch b/queue-5.15/crypto-crypto4xx-call-dma_unmap_page-when-done.patch new file mode 100644 index 00000000000..19bf13d8d02 --- /dev/null +++ b/queue-5.15/crypto-crypto4xx-call-dma_unmap_page-when-done.patch @@ -0,0 +1,64 @@ +From ae4a479de6d7eea17f87bcb03903b7e896e13478 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Feb 2023 14:01:53 +0800 +Subject: crypto: crypto4xx - Call dma_unmap_page when done + +From: Herbert Xu + +[ Upstream commit bcdda4301bdc4955d45f7e1ffefb6207967b067e ] + +In crypto4xx_cipher_done, we should be unmapping the dst page, not +mapping it. + +This was flagged by a sparse warning about the unused addr variable. +While we're at it, also fix a sparse warning regarding the unused +ctx variable in crypto4xx_ahash_done (by actually using it). + +Fixes: 049359d65527 ("crypto: amcc - Add crypt4xx driver") +Signed-off-by: Herbert Xu +Tested-by: Christian Lamparter +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/amcc/crypto4xx_core.c | 10 ++++------ + 1 file changed, 4 insertions(+), 6 deletions(-) + +diff --git a/drivers/crypto/amcc/crypto4xx_core.c b/drivers/crypto/amcc/crypto4xx_core.c +index 8278d98074e9a..e1556a3582a30 100644 +--- a/drivers/crypto/amcc/crypto4xx_core.c ++++ b/drivers/crypto/amcc/crypto4xx_core.c +@@ -522,7 +522,6 @@ static void crypto4xx_cipher_done(struct crypto4xx_device *dev, + { + struct skcipher_request *req; + struct scatterlist *dst; +- dma_addr_t addr; + + req = skcipher_request_cast(pd_uinfo->async_req); + +@@ -531,8 +530,8 @@ static void crypto4xx_cipher_done(struct crypto4xx_device *dev, + req->cryptlen, req->dst); + } else { + dst = pd_uinfo->dest_va; +- addr = dma_map_page(dev->core_dev->device, sg_page(dst), +- dst->offset, dst->length, DMA_FROM_DEVICE); ++ dma_unmap_page(dev->core_dev->device, pd->dest, dst->length, ++ DMA_FROM_DEVICE); + } + + if (pd_uinfo->sa_va->sa_command_0.bf.save_iv == SA_SAVE_IV) { +@@ -557,10 +556,9 @@ static void crypto4xx_ahash_done(struct crypto4xx_device *dev, + struct ahash_request *ahash_req; + + ahash_req = ahash_request_cast(pd_uinfo->async_req); +- ctx = crypto_tfm_ctx(ahash_req->base.tfm); ++ ctx = crypto_ahash_ctx(crypto_ahash_reqtfm(ahash_req)); + +- crypto4xx_copy_digest_to_dst(ahash_req->result, pd_uinfo, +- crypto_tfm_ctx(ahash_req->base.tfm)); ++ crypto4xx_copy_digest_to_dst(ahash_req->result, pd_uinfo, ctx); + crypto4xx_ret_sg_desc(dev, pd_uinfo); + + if (pd_uinfo->state & PD_ENTRY_BUSY) +-- +2.39.2 + diff --git a/queue-5.15/crypto-essiv-handle-ebusy-correctly.patch b/queue-5.15/crypto-essiv-handle-ebusy-correctly.patch new file mode 100644 index 00000000000..8e466568e23 --- /dev/null +++ b/queue-5.15/crypto-essiv-handle-ebusy-correctly.patch @@ -0,0 +1,55 @@ +From b6a72c2362ce5650b811b628ec4dc49732f07d8c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Jan 2023 18:24:09 +0800 +Subject: crypto: essiv - Handle EBUSY correctly + +From: Herbert Xu + +[ Upstream commit b5a772adf45a32c68bef28e60621f12617161556 ] + +As it is essiv only handles the special return value of EINPROGERSS, +which means that in all other cases it will free data related to the +request. + +However, as the caller of essiv may specify MAY_BACKLOG, we also need +to expect EBUSY and treat it in the same way. Otherwise backlogged +requests will trigger a use-after-free. + +Fixes: be1eb7f78aa8 ("crypto: essiv - create wrapper template...") +Signed-off-by: Herbert Xu +Acked-by: Ard Biesheuvel +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + crypto/essiv.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/crypto/essiv.c b/crypto/essiv.c +index 8bcc5bdcb2a95..3505b071e6471 100644 +--- a/crypto/essiv.c ++++ b/crypto/essiv.c +@@ -171,7 +171,12 @@ static void essiv_aead_done(struct crypto_async_request *areq, int err) + struct aead_request *req = areq->data; + struct essiv_aead_request_ctx *rctx = aead_request_ctx(req); + ++ if (err == -EINPROGRESS) ++ goto out; ++ + kfree(rctx->assoc); ++ ++out: + aead_request_complete(req, err); + } + +@@ -247,7 +252,7 @@ static int essiv_aead_crypt(struct aead_request *req, bool enc) + err = enc ? crypto_aead_encrypt(subreq) : + crypto_aead_decrypt(subreq); + +- if (rctx->assoc && err != -EINPROGRESS) ++ if (rctx->assoc && err != -EINPROGRESS && err != -EBUSY) + kfree(rctx->assoc); + return err; + } +-- +2.39.2 + diff --git a/queue-5.15/crypto-hisilicon-wipe-entire-pool-on-error.patch b/queue-5.15/crypto-hisilicon-wipe-entire-pool-on-error.patch new file mode 100644 index 00000000000..e3bd11a4067 --- /dev/null +++ b/queue-5.15/crypto-hisilicon-wipe-entire-pool-on-error.patch @@ -0,0 +1,47 @@ +From c52ee589460ec68e321a0098502485cfdaeba9ca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Jan 2023 20:19:48 -0800 +Subject: crypto: hisilicon: Wipe entire pool on error + +From: Kees Cook + +[ Upstream commit aa85923a954e7704bc9d3847dabeb8540aa98d13 ] + +To work around a Clang __builtin_object_size bug that shows up under +CONFIG_FORTIFY_SOURCE and UBSAN_BOUNDS, move the per-loop-iteration +mem_block wipe into a single wipe of the entire pool structure after +the loop. + +Reported-by: Nathan Chancellor +Link: https://github.com/ClangBuiltLinux/linux/issues/1780 +Cc: Weili Qian +Cc: Zhou Wang +Cc: Herbert Xu +Cc: "David S. Miller" +Cc: linux-crypto@vger.kernel.org +Signed-off-by: Kees Cook +Tested-by: Nathan Chancellor # build +Link: https://lore.kernel.org/r/20230106041945.never.831-kees@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/crypto/hisilicon/sgl.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/crypto/hisilicon/sgl.c b/drivers/crypto/hisilicon/sgl.c +index 057273769f264..3dbe5405d17bc 100644 +--- a/drivers/crypto/hisilicon/sgl.c ++++ b/drivers/crypto/hisilicon/sgl.c +@@ -122,9 +122,8 @@ struct hisi_acc_sgl_pool *hisi_acc_create_sgl_pool(struct device *dev, + for (j = 0; j < i; j++) { + dma_free_coherent(dev, block_size, block[j].sgl, + block[j].sgl_dma); +- memset(block + j, 0, sizeof(*block)); + } +- kfree(pool); ++ kfree_sensitive(pool); + return ERR_PTR(-ENOMEM); + } + EXPORT_SYMBOL_GPL(hisi_acc_create_sgl_pool); +-- +2.39.2 + diff --git a/queue-5.15/crypto-rsa-pkcs1pad-use-akcipher_request_complete.patch b/queue-5.15/crypto-rsa-pkcs1pad-use-akcipher_request_complete.patch new file mode 100644 index 00000000000..f5f29e95142 --- /dev/null +++ b/queue-5.15/crypto-rsa-pkcs1pad-use-akcipher_request_complete.patch @@ -0,0 +1,91 @@ +From 8c0fd4039b2b3a32ad7265c9bdbcc253f9db1125 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 Jan 2023 16:02:04 +0800 +Subject: crypto: rsa-pkcs1pad - Use akcipher_request_complete + +From: Herbert Xu + +[ Upstream commit 564cabc0ca0bdfa8f0fc1ae74b24d0a7554522c5 ] + +Use the akcipher_request_complete helper instead of calling the +completion function directly. In fact the previous code was buggy +in that EINPROGRESS was never passed back to the original caller. + +Fixes: 3d5b1ecdea6f ("crypto: rsa - RSA padding algorithm") +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + crypto/rsa-pkcs1pad.c | 34 +++++++++++++++------------------- + 1 file changed, 15 insertions(+), 19 deletions(-) + +diff --git a/crypto/rsa-pkcs1pad.c b/crypto/rsa-pkcs1pad.c +index 9d804831c8b3f..a4ebbb889274e 100644 +--- a/crypto/rsa-pkcs1pad.c ++++ b/crypto/rsa-pkcs1pad.c +@@ -214,16 +214,14 @@ static void pkcs1pad_encrypt_sign_complete_cb( + struct crypto_async_request *child_async_req, int err) + { + struct akcipher_request *req = child_async_req->data; +- struct crypto_async_request async_req; + + if (err == -EINPROGRESS) +- return; ++ goto out; ++ ++ err = pkcs1pad_encrypt_sign_complete(req, err); + +- async_req.data = req->base.data; +- async_req.tfm = crypto_akcipher_tfm(crypto_akcipher_reqtfm(req)); +- async_req.flags = child_async_req->flags; +- req->base.complete(&async_req, +- pkcs1pad_encrypt_sign_complete(req, err)); ++out: ++ akcipher_request_complete(req, err); + } + + static int pkcs1pad_encrypt(struct akcipher_request *req) +@@ -332,15 +330,14 @@ static void pkcs1pad_decrypt_complete_cb( + struct crypto_async_request *child_async_req, int err) + { + struct akcipher_request *req = child_async_req->data; +- struct crypto_async_request async_req; + + if (err == -EINPROGRESS) +- return; ++ goto out; ++ ++ err = pkcs1pad_decrypt_complete(req, err); + +- async_req.data = req->base.data; +- async_req.tfm = crypto_akcipher_tfm(crypto_akcipher_reqtfm(req)); +- async_req.flags = child_async_req->flags; +- req->base.complete(&async_req, pkcs1pad_decrypt_complete(req, err)); ++out: ++ akcipher_request_complete(req, err); + } + + static int pkcs1pad_decrypt(struct akcipher_request *req) +@@ -512,15 +509,14 @@ static void pkcs1pad_verify_complete_cb( + struct crypto_async_request *child_async_req, int err) + { + struct akcipher_request *req = child_async_req->data; +- struct crypto_async_request async_req; + + if (err == -EINPROGRESS) +- return; ++ goto out; + +- async_req.data = req->base.data; +- async_req.tfm = crypto_akcipher_tfm(crypto_akcipher_reqtfm(req)); +- async_req.flags = child_async_req->flags; +- req->base.complete(&async_req, pkcs1pad_verify_complete(req, err)); ++ err = pkcs1pad_verify_complete(req, err); ++ ++out: ++ akcipher_request_complete(req, err); + } + + /* +-- +2.39.2 + diff --git a/queue-5.15/crypto-seqiv-handle-ebusy-correctly.patch b/queue-5.15/crypto-seqiv-handle-ebusy-correctly.patch new file mode 100644 index 00000000000..f2db08429ad --- /dev/null +++ b/queue-5.15/crypto-seqiv-handle-ebusy-correctly.patch @@ -0,0 +1,40 @@ +From 647ba2803109d04a883ff853023e45134d4992c2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Jan 2023 18:27:51 +0800 +Subject: crypto: seqiv - Handle EBUSY correctly + +From: Herbert Xu + +[ Upstream commit 32e62025e5e52fbe4812ef044759de7010b15dbc ] + +As it is seqiv only handles the special return value of EINPROGERSS, +which means that in all other cases it will free data related to the +request. + +However, as the caller of seqiv may specify MAY_BACKLOG, we also need +to expect EBUSY and treat it in the same way. Otherwise backlogged +requests will trigger a use-after-free. + +Fixes: 0a270321dbf9 ("[CRYPTO] seqiv: Add Sequence Number IV Generator") +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + crypto/seqiv.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/crypto/seqiv.c b/crypto/seqiv.c +index 0899d527c2845..b1bcfe537daf1 100644 +--- a/crypto/seqiv.c ++++ b/crypto/seqiv.c +@@ -23,7 +23,7 @@ static void seqiv_aead_encrypt_complete2(struct aead_request *req, int err) + struct aead_request *subreq = aead_request_ctx(req); + struct crypto_aead *geniv; + +- if (err == -EINPROGRESS) ++ if (err == -EINPROGRESS || err == -EBUSY) + return; + + if (err) +-- +2.39.2 + diff --git a/queue-5.15/crypto-x86-ghash-fix-unaligned-access-in-ghash_setke.patch b/queue-5.15/crypto-x86-ghash-fix-unaligned-access-in-ghash_setke.patch new file mode 100644 index 00000000000..a3aa1892aa1 --- /dev/null +++ b/queue-5.15/crypto-x86-ghash-fix-unaligned-access-in-ghash_setke.patch @@ -0,0 +1,52 @@ +From 2784e1ab51b8bdb7abc957c2a2006690f2e0e47b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Dec 2022 21:40:40 -0800 +Subject: crypto: x86/ghash - fix unaligned access in ghash_setkey() + +From: Eric Biggers + +[ Upstream commit 116db2704c193fff6d73ea6c2219625f0c9bdfc8 ] + +The key can be unaligned, so use the unaligned memory access helpers. + +Fixes: 8ceee72808d1 ("crypto: ghash-clmulni-intel - use C implementation for setkey()") +Signed-off-by: Eric Biggers +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + arch/x86/crypto/ghash-clmulni-intel_glue.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/x86/crypto/ghash-clmulni-intel_glue.c b/arch/x86/crypto/ghash-clmulni-intel_glue.c +index 1f1a95f3dd0ca..c0ab0ff4af655 100644 +--- a/arch/x86/crypto/ghash-clmulni-intel_glue.c ++++ b/arch/x86/crypto/ghash-clmulni-intel_glue.c +@@ -19,6 +19,7 @@ + #include + #include + #include ++#include + + #define GHASH_BLOCK_SIZE 16 + #define GHASH_DIGEST_SIZE 16 +@@ -54,15 +55,14 @@ static int ghash_setkey(struct crypto_shash *tfm, + const u8 *key, unsigned int keylen) + { + struct ghash_ctx *ctx = crypto_shash_ctx(tfm); +- be128 *x = (be128 *)key; + u64 a, b; + + if (keylen != GHASH_BLOCK_SIZE) + return -EINVAL; + + /* perform multiplication by 'x' in GF(2^128) */ +- a = be64_to_cpu(x->a); +- b = be64_to_cpu(x->b); ++ a = get_unaligned_be64(key); ++ b = get_unaligned_be64(key + 8); + + ctx->shash.a = (b << 1) | (a >> 63); + ctx->shash.b = (a << 1) | (b >> 63); +-- +2.39.2 + diff --git a/queue-5.15/crypto-xts-handle-ebusy-correctly.patch b/queue-5.15/crypto-xts-handle-ebusy-correctly.patch new file mode 100644 index 00000000000..eb6d2ea54e6 --- /dev/null +++ b/queue-5.15/crypto-xts-handle-ebusy-correctly.patch @@ -0,0 +1,63 @@ +From 4dd59ec8d76da57a695bdec7205e98eb7bb67e4e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 22 Jan 2023 16:07:37 +0800 +Subject: crypto: xts - Handle EBUSY correctly + +From: Herbert Xu + +[ Upstream commit 51c082514c2dedf2711c99d93c196cc4eedceb40 ] + +As it is xts only handles the special return value of EINPROGRESS, +which means that in all other cases it will free data related to the +request. + +However, as the caller of xts may specify MAY_BACKLOG, we also need +to expect EBUSY and treat it in the same way. Otherwise backlogged +requests will trigger a use-after-free. + +Fixes: 8083b1bf8163 ("crypto: xts - add support for ciphertext stealing") +Signed-off-by: Herbert Xu +Acked-by: Ard Biesheuvel +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + crypto/xts.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/crypto/xts.c b/crypto/xts.c +index 63c85b9e64e08..de6cbcf69bbd6 100644 +--- a/crypto/xts.c ++++ b/crypto/xts.c +@@ -203,12 +203,12 @@ static void xts_encrypt_done(struct crypto_async_request *areq, int err) + if (!err) { + struct xts_request_ctx *rctx = skcipher_request_ctx(req); + +- rctx->subreq.base.flags &= ~CRYPTO_TFM_REQ_MAY_SLEEP; ++ rctx->subreq.base.flags &= CRYPTO_TFM_REQ_MAY_BACKLOG; + err = xts_xor_tweak_post(req, true); + + if (!err && unlikely(req->cryptlen % XTS_BLOCK_SIZE)) { + err = xts_cts_final(req, crypto_skcipher_encrypt); +- if (err == -EINPROGRESS) ++ if (err == -EINPROGRESS || err == -EBUSY) + return; + } + } +@@ -223,12 +223,12 @@ static void xts_decrypt_done(struct crypto_async_request *areq, int err) + if (!err) { + struct xts_request_ctx *rctx = skcipher_request_ctx(req); + +- rctx->subreq.base.flags &= ~CRYPTO_TFM_REQ_MAY_SLEEP; ++ rctx->subreq.base.flags &= CRYPTO_TFM_REQ_MAY_BACKLOG; + err = xts_xor_tweak_post(req, false); + + if (!err && unlikely(req->cryptlen % XTS_BLOCK_SIZE)) { + err = xts_cts_final(req, crypto_skcipher_decrypt); +- if (err == -EINPROGRESS) ++ if (err == -EINPROGRESS || err == -EBUSY) + return; + } + } +-- +2.39.2 + diff --git a/queue-5.15/dm-cache-add-cond_resched-to-various-workqueue-loops.patch b/queue-5.15/dm-cache-add-cond_resched-to-various-workqueue-loops.patch new file mode 100644 index 00000000000..6c48d0fa1ee --- /dev/null +++ b/queue-5.15/dm-cache-add-cond_resched-to-various-workqueue-loops.patch @@ -0,0 +1,50 @@ +From 0b71e066e848f069a2cca9e1e69ef61fb08a58b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Feb 2023 15:31:08 -0500 +Subject: dm cache: add cond_resched() to various workqueue loops + +From: Mike Snitzer + +[ Upstream commit 76227f6dc805e9e960128bcc6276647361e0827c ] + +Otherwise on resource constrained systems these workqueues may be too +greedy. + +Signed-off-by: Mike Snitzer +Signed-off-by: Sasha Levin +--- + drivers/md/dm-cache-target.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/md/dm-cache-target.c b/drivers/md/dm-cache-target.c +index abfe7e37b76f4..24cd28ea2c595 100644 +--- a/drivers/md/dm-cache-target.c ++++ b/drivers/md/dm-cache-target.c +@@ -1813,6 +1813,7 @@ static void process_deferred_bios(struct work_struct *ws) + + else + commit_needed = process_bio(cache, bio) || commit_needed; ++ cond_resched(); + } + + if (commit_needed) +@@ -1835,6 +1836,7 @@ static void requeue_deferred_bios(struct cache *cache) + while ((bio = bio_list_pop(&bios))) { + bio->bi_status = BLK_STS_DM_REQUEUE; + bio_endio(bio); ++ cond_resched(); + } + } + +@@ -1875,6 +1877,8 @@ static void check_migrations(struct work_struct *ws) + r = mg_start(cache, op, NULL); + if (r) + break; ++ ++ cond_resched(); + } + } + +-- +2.39.2 + diff --git a/queue-5.15/dm-remove-flush_scheduled_work-during-local_exit.patch b/queue-5.15/dm-remove-flush_scheduled_work-during-local_exit.patch new file mode 100644 index 00000000000..0b6eecdc3c7 --- /dev/null +++ b/queue-5.15/dm-remove-flush_scheduled_work-during-local_exit.patch @@ -0,0 +1,43 @@ +From c89c016ba2e7331daf45000f3794a3f1035d5037 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Feb 2023 13:06:05 -0500 +Subject: dm: remove flush_scheduled_work() during local_exit() + +From: Mike Snitzer + +[ Upstream commit 0b22ff5360f5c4e11050b89206370fdf7dc0a226 ] + +Commit acfe0ad74d2e1 ("dm: allocate a special workqueue for deferred +device removal") switched from using system workqueue to a single +workqueue local to DM. But it didn't eliminate the call to +flush_scheduled_work() that was introduced purely for the benefit of +deferred device removal with commit 2c140a246dc ("dm: allow remove to +be deferred"). + +Since DM core uses its own workqueue (and queue_work) there is no need +to call flush_scheduled_work() from local_exit(). local_exit()'s +destroy_workqueue(deferred_remove_workqueue) handles flushing work +started with queue_work(). + +Fixes: acfe0ad74d2e1 ("dm: allocate a special workqueue for deferred device removal") +Signed-off-by: Mike Snitzer +Signed-off-by: Sasha Levin +--- + drivers/md/dm.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/md/dm.c b/drivers/md/dm.c +index 9dd2c2da075d9..82c561e3fc145 100644 +--- a/drivers/md/dm.c ++++ b/drivers/md/dm.c +@@ -226,7 +226,6 @@ static int __init local_init(void) + + static void local_exit(void) + { +- flush_scheduled_work(); + destroy_workqueue(deferred_remove_workqueue); + + unregister_blkdev(_major, _name); +-- +2.39.2 + diff --git a/queue-5.15/dm-thin-add-cond_resched-to-various-workqueue-loops.patch b/queue-5.15/dm-thin-add-cond_resched-to-various-workqueue-loops.patch new file mode 100644 index 00000000000..73f87873560 --- /dev/null +++ b/queue-5.15/dm-thin-add-cond_resched-to-various-workqueue-loops.patch @@ -0,0 +1,41 @@ +From 5cb5f42cb59391be22d466548a3ca678096faacc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Feb 2023 15:29:44 -0500 +Subject: dm thin: add cond_resched() to various workqueue loops + +From: Mike Snitzer + +[ Upstream commit e4f80303c2353952e6e980b23914e4214487f2a6 ] + +Otherwise on resource constrained systems these workqueues may be too +greedy. + +Signed-off-by: Mike Snitzer +Signed-off-by: Sasha Levin +--- + drivers/md/dm-thin.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c +index cce26f46ded52..f7124f257703c 100644 +--- a/drivers/md/dm-thin.c ++++ b/drivers/md/dm-thin.c +@@ -2217,6 +2217,7 @@ static void process_thin_deferred_bios(struct thin_c *tc) + throttle_work_update(&pool->throttle); + dm_pool_issue_prefetches(pool->pmd); + } ++ cond_resched(); + } + blk_finish_plug(&plug); + } +@@ -2299,6 +2300,7 @@ static void process_thin_deferred_cells(struct thin_c *tc) + else + pool->process_cell(tc, cell); + } ++ cond_resched(); + } while (!list_empty(&cells)); + } + +-- +2.39.2 + diff --git a/queue-5.15/dmaengine-dw-axi-dmac-do-not-dereference-null-struct.patch b/queue-5.15/dmaengine-dw-axi-dmac-do-not-dereference-null-struct.patch new file mode 100644 index 00000000000..ccdf5a63fe9 --- /dev/null +++ b/queue-5.15/dmaengine-dw-axi-dmac-do-not-dereference-null-struct.patch @@ -0,0 +1,47 @@ +From cff39d63789830d033af1569f4d987b3a738c293 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Jan 2023 14:36:27 -0800 +Subject: dmaengine: dw-axi-dmac: Do not dereference NULL structure + +From: Kees Cook + +[ Upstream commit be4d46edeee4b2459d2f53f37ada88bbfb634b6c ] + +If "vdesc" is NULL, it cannot be used with vd_to_axi_desc(). Leave +"bytes" unchanged at 0. Seen under GCC 13 with -Warray-bounds: + +../drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c: In function 'dma_chan_tx_status': +../drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c:329:46: warning: array subscript 0 is outside array bounds of 'struct +virt_dma_desc[46116860184273879]' [-Warray-bounds=] + 329 | bytes = vd_to_axi_desc(vdesc)->length; + | ^~ + +Fixes: 8e55444da65c ("dmaengine: dw-axi-dmac: Support burst residue granularity") +Cc: Eugeniy Paltsev +Cc: Vinod Koul +Cc: dmaengine@vger.kernel.org +Signed-off-by: Kees Cook +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20230127223623.never.507-kees@kernel.org +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c b/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c +index 41654b2f6c600..cfc47efcb5d93 100644 +--- a/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c ++++ b/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c +@@ -288,8 +288,6 @@ dma_chan_tx_status(struct dma_chan *dchan, dma_cookie_t cookie, + len = vd_to_axi_desc(vdesc)->hw_desc[0].len; + completed_length = completed_blocks * len; + bytes = length - completed_length; +- } else { +- bytes = vd_to_axi_desc(vdesc)->length; + } + + spin_unlock_irqrestore(&chan->vc.lock, flags); +-- +2.39.2 + diff --git a/queue-5.15/dmaengine-dw-edma-fix-missing-src-dst-address-of-int.patch b/queue-5.15/dmaengine-dw-edma-fix-missing-src-dst-address-of-int.patch new file mode 100644 index 00000000000..98ac94a530a --- /dev/null +++ b/queue-5.15/dmaengine-dw-edma-fix-missing-src-dst-address-of-int.patch @@ -0,0 +1,56 @@ +From 6878a9c96fbc19c4bd053b04bdacd97b759195cf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Jan 2023 20:13:46 +0300 +Subject: dmaengine: dw-edma: Fix missing src/dst address of interleaved xfers + +From: Serge Semin + +[ Upstream commit 13b6299cf66165a442089fa895a7f70250703584 ] + +Interleaved DMA transfer support was added by 85e7518f42c8 ("dmaengine: +dw-edma: Add device_prep_interleave_dma() support"), but depending on the +selected channel, either source or destination address are left +uninitialized which was obviously wrong. + +Initialize the destination address of the eDMA burst descriptors for +DEV_TO_MEM interleaved operations and the source address for MEM_TO_DEV +operations. + +Link: https://lore.kernel.org/r/20230113171409.30470-5-Sergey.Semin@baikalelectronics.ru +Fixes: 85e7518f42c8 ("dmaengine: dw-edma: Add device_prep_interleave_dma() support") +Tested-by: Manivannan Sadhasivam +Signed-off-by: Serge Semin +Signed-off-by: Lorenzo Pieralisi +Signed-off-by: Bjorn Helgaas +Reviewed-by: Manivannan Sadhasivam +Acked-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/dw-edma/dw-edma-core.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/dma/dw-edma/dw-edma-core.c b/drivers/dma/dw-edma/dw-edma-core.c +index 36b3fe1b6b0f9..97f5e4e93cfc6 100644 +--- a/drivers/dma/dw-edma/dw-edma-core.c ++++ b/drivers/dma/dw-edma/dw-edma-core.c +@@ -438,6 +438,8 @@ dw_edma_device_transfer(struct dw_edma_transfer *xfer) + * and destination addresses are increased + * by the same portion (data length) + */ ++ } else if (xfer->type == EDMA_XFER_INTERLEAVED) { ++ burst->dar = dst_addr; + } + } else { + burst->dar = dst_addr; +@@ -453,6 +455,8 @@ dw_edma_device_transfer(struct dw_edma_transfer *xfer) + * and destination addresses are increased + * by the same portion (data length) + */ ++ } else if (xfer->type == EDMA_XFER_INTERLEAVED) { ++ burst->sar = src_addr; + } + } + +-- +2.39.2 + diff --git a/queue-5.15/dmaengine-dw-edma-fix-readq_ch-return-value-truncati.patch b/queue-5.15/dmaengine-dw-edma-fix-readq_ch-return-value-truncati.patch new file mode 100644 index 00000000000..668ea5ddf69 --- /dev/null +++ b/queue-5.15/dmaengine-dw-edma-fix-readq_ch-return-value-truncati.patch @@ -0,0 +1,40 @@ +From 168f939131d47ccc1876c01c719a2deb9405f87c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 Jan 2023 18:19:00 +0300 +Subject: dmaengine: dw-edma: Fix readq_ch() return value truncation + +From: Serge Semin + +[ Upstream commit 5fdca4a995bcd4cf61bda40af154a730589dc524 ] + +Previously, readq_ch() did a 64-bit readq(), but truncated the result by +storing it in the u32 "value". Change "value" to u64 to avoid the +truncation. + +Note: the method is currently unused, so the bug hasn't caused any problem +so far. + +Fixes: 04e0a39fc10f ("dmaengine: dw-edma: Add writeq() and readq() for 64 bits architectures") +Signed-off-by: Serge Semin +Signed-off-by: Bjorn Helgaas +Signed-off-by: Sasha Levin +--- + drivers/dma/dw-edma/dw-edma-v0-core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/dma/dw-edma/dw-edma-v0-core.c b/drivers/dma/dw-edma/dw-edma-v0-core.c +index b5b8f8181e776..043a4f3115fa3 100644 +--- a/drivers/dma/dw-edma/dw-edma-v0-core.c ++++ b/drivers/dma/dw-edma/dw-edma-v0-core.c +@@ -192,7 +192,7 @@ static inline void writeq_ch(struct dw_edma *dw, enum dw_edma_dir dir, u16 ch, + static inline u64 readq_ch(struct dw_edma *dw, enum dw_edma_dir dir, u16 ch, + const void __iomem *addr) + { +- u32 value; ++ u64 value; + + if (dw->mf == EDMA_MF_EDMA_LEGACY) { + u32 viewport_sel; +-- +2.39.2 + diff --git a/queue-5.15/dmaengine-hisi_dma-should-depend-on-arch_hisi.patch b/queue-5.15/dmaengine-hisi_dma-should-depend-on-arch_hisi.patch new file mode 100644 index 00000000000..1da233f7387 --- /dev/null +++ b/queue-5.15/dmaengine-hisi_dma-should-depend-on-arch_hisi.patch @@ -0,0 +1,38 @@ +From 5f31c80b25b47cd81e400f8d8510dff2ef856e1d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Nov 2022 16:23:53 +0100 +Subject: dmaengine: HISI_DMA should depend on ARCH_HISI + +From: Geert Uytterhoeven + +[ Upstream commit dcca9d045c0852584ad092123c7f6e6526a633b1 ] + +The HiSilicon DMA Engine is only present on HiSilicon SoCs. Hence add a +dependency on ARCH_HISI, to prevent asking the user about this driver +when configuring a kernel without HiSilicon SoC support. + +Fixes: e9f08b65250d73ab ("dmaengine: hisilicon: Add Kunpeng DMA engine support") +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/363a1816d36cd3cf604d88ec90f97c75f604de64.1669044190.git.geert+renesas@glider.be +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/dma/Kconfig b/drivers/dma/Kconfig +index 80c2c03cb0141..95344ae49e532 100644 +--- a/drivers/dma/Kconfig ++++ b/drivers/dma/Kconfig +@@ -236,7 +236,7 @@ config FSL_RAID + + config HISI_DMA + tristate "HiSilicon DMA Engine support" +- depends on ARM64 || COMPILE_TEST ++ depends on ARCH_HISI || COMPILE_TEST + depends on PCI_MSI + select DMA_ENGINE + select DMA_VIRTUAL_CHANNELS +-- +2.39.2 + diff --git a/queue-5.15/dmaengine-idxd-set-traffic-class-values-in-grpcfg-on.patch b/queue-5.15/dmaengine-idxd-set-traffic-class-values-in-grpcfg-on.patch new file mode 100644 index 00000000000..56fa678bff8 --- /dev/null +++ b/queue-5.15/dmaengine-idxd-set-traffic-class-values-in-grpcfg-on.patch @@ -0,0 +1,79 @@ +From 5e9da65680aa9ee5e0075a59a7b58b28f2e72dcf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Dec 2022 09:21:41 -0800 +Subject: dmaengine: idxd: Set traffic class values in GRPCFG on DSA 2.0 + +From: Fenghua Yu + +[ Upstream commit 9735bde36487da43d3c3fc910df49639f72decbf ] + +On DSA/IAX 1.0, TC-A and TC-B in GRPCFG are set as 1 to have best +performance and cannot be changed through sysfs knobs unless override +option is given. + +The same values should be set on DSA 2.0 as well. + +Fixes: ea7c8f598c32 ("dmaengine: idxd: restore traffic class defaults after wq reset") +Fixes: ade8a86b512c ("dmaengine: idxd: Set defaults for GRPCFG traffic class") +Signed-off-by: Fenghua Yu +Reviewed-by: Dave Jiang +Link: https://lore.kernel.org/r/20221209172141.562648-1-fenghua.yu@intel.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/idxd/device.c | 2 +- + drivers/dma/idxd/init.c | 2 +- + drivers/dma/idxd/sysfs.c | 4 ++-- + 3 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/dma/idxd/device.c b/drivers/dma/idxd/device.c +index 37b07c679c0ee..535f021911c55 100644 +--- a/drivers/dma/idxd/device.c ++++ b/drivers/dma/idxd/device.c +@@ -702,7 +702,7 @@ static void idxd_groups_clear_state(struct idxd_device *idxd) + group->use_rdbuf_limit = false; + group->rdbufs_allowed = 0; + group->rdbufs_reserved = 0; +- if (idxd->hw.version < DEVICE_VERSION_2 && !tc_override) { ++ if (idxd->hw.version <= DEVICE_VERSION_2 && !tc_override) { + group->tc_a = 1; + group->tc_b = 1; + } else { +diff --git a/drivers/dma/idxd/init.c b/drivers/dma/idxd/init.c +index 6263d9825250b..e0e0c7f286b67 100644 +--- a/drivers/dma/idxd/init.c ++++ b/drivers/dma/idxd/init.c +@@ -340,7 +340,7 @@ static int idxd_setup_groups(struct idxd_device *idxd) + } + + idxd->groups[i] = group; +- if (idxd->hw.version < DEVICE_VERSION_2 && !tc_override) { ++ if (idxd->hw.version <= DEVICE_VERSION_2 && !tc_override) { + group->tc_a = 1; + group->tc_b = 1; + } else { +diff --git a/drivers/dma/idxd/sysfs.c b/drivers/dma/idxd/sysfs.c +index 33d94c67fedb9..489a9d8850764 100644 +--- a/drivers/dma/idxd/sysfs.c ++++ b/drivers/dma/idxd/sysfs.c +@@ -327,7 +327,7 @@ static ssize_t group_traffic_class_a_store(struct device *dev, + if (idxd->state == IDXD_DEV_ENABLED) + return -EPERM; + +- if (idxd->hw.version < DEVICE_VERSION_2 && !tc_override) ++ if (idxd->hw.version <= DEVICE_VERSION_2 && !tc_override) + return -EPERM; + + if (val < 0 || val > 7) +@@ -369,7 +369,7 @@ static ssize_t group_traffic_class_b_store(struct device *dev, + if (idxd->state == IDXD_DEV_ENABLED) + return -EPERM; + +- if (idxd->hw.version < DEVICE_VERSION_2 && !tc_override) ++ if (idxd->hw.version <= DEVICE_VERSION_2 && !tc_override) + return -EPERM; + + if (val < 0 || val > 7) +-- +2.39.2 + diff --git a/queue-5.15/dmaengine-sf-pdma-pdma_desc-memory-leak-fix.patch b/queue-5.15/dmaengine-sf-pdma-pdma_desc-memory-leak-fix.patch new file mode 100644 index 00000000000..7c0f543f7f5 --- /dev/null +++ b/queue-5.15/dmaengine-sf-pdma-pdma_desc-memory-leak-fix.patch @@ -0,0 +1,82 @@ +From 57240e3214fd02fc6c105428b97ff309823d525f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Jan 2023 15:36:23 +0530 +Subject: dmaengine: sf-pdma: pdma_desc memory leak fix + +From: Shravan Chippa + +[ Upstream commit b02e07015a5ac7bbc029da931ae17914b8ae0339 ] + +Commit b2cc5c465c2c ("dmaengine: sf-pdma: Add multithread support for a +DMA channel") changed sf_pdma_prep_dma_memcpy() to unconditionally +allocate a new sf_pdma_desc each time it is called. + +The driver previously recycled descs, by checking the in_use flag, only +allocating additional descs if the existing one was in use. This logic +was removed in commit b2cc5c465c2c ("dmaengine: sf-pdma: Add multithread +support for a DMA channel"), but sf_pdma_free_desc() was not changed to +handle the new behaviour. + +As a result, each time sf_pdma_prep_dma_memcpy() is called, the previous +descriptor is leaked, over time leading to memory starvation: + + unreferenced object 0xffffffe008447300 (size 192): + comm "irq/39-mchp_dsc", pid 343, jiffies 4294906910 (age 981.200s) + hex dump (first 32 bytes): + 00 00 00 ff 00 00 00 00 b8 c1 00 00 00 00 00 00 ................ + 00 00 70 08 10 00 00 00 00 00 00 c0 00 00 00 00 ..p............. + backtrace: + [<00000000064a04f4>] kmemleak_alloc+0x1e/0x28 + [<00000000018927a7>] kmem_cache_alloc+0x11e/0x178 + [<000000002aea8d16>] sf_pdma_prep_dma_memcpy+0x40/0x112 + +Add the missing kfree() to sf_pdma_free_desc(), and remove the redundant +in_use flag. + +Fixes: b2cc5c465c2c ("dmaengine: sf-pdma: Add multithread support for a DMA channel") +Signed-off-by: Shravan Chippa +Reviewed-by: Conor Dooley +Link: https://lore.kernel.org/r/20230120100623.3530634-1-shravan.chippa@microchip.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/sf-pdma/sf-pdma.c | 3 +-- + drivers/dma/sf-pdma/sf-pdma.h | 1 - + 2 files changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/dma/sf-pdma/sf-pdma.c b/drivers/dma/sf-pdma/sf-pdma.c +index ab0ad7a2f2015..dcf2b7a4183c1 100644 +--- a/drivers/dma/sf-pdma/sf-pdma.c ++++ b/drivers/dma/sf-pdma/sf-pdma.c +@@ -96,7 +96,6 @@ sf_pdma_prep_dma_memcpy(struct dma_chan *dchan, dma_addr_t dest, dma_addr_t src, + if (!desc) + return NULL; + +- desc->in_use = true; + desc->dirn = DMA_MEM_TO_MEM; + desc->async_tx = vchan_tx_prep(&chan->vchan, &desc->vdesc, flags); + +@@ -290,7 +289,7 @@ static void sf_pdma_free_desc(struct virt_dma_desc *vdesc) + struct sf_pdma_desc *desc; + + desc = to_sf_pdma_desc(vdesc); +- desc->in_use = false; ++ kfree(desc); + } + + static void sf_pdma_donebh_tasklet(struct tasklet_struct *t) +diff --git a/drivers/dma/sf-pdma/sf-pdma.h b/drivers/dma/sf-pdma/sf-pdma.h +index 0c20167b097d0..02a229a3ae225 100644 +--- a/drivers/dma/sf-pdma/sf-pdma.h ++++ b/drivers/dma/sf-pdma/sf-pdma.h +@@ -82,7 +82,6 @@ struct sf_pdma_desc { + u64 src_addr; + struct virt_dma_desc vdesc; + struct sf_pdma_chan *chan; +- bool in_use; + enum dma_transfer_direction dirn; + struct dma_async_tx_descriptor *async_tx; + }; +-- +2.39.2 + diff --git a/queue-5.15/docs-scripts-gdb-add-necessary-make-scripts_gdb-step.patch b/queue-5.15/docs-scripts-gdb-add-necessary-make-scripts_gdb-step.patch new file mode 100644 index 00000000000..4165d6b2752 --- /dev/null +++ b/queue-5.15/docs-scripts-gdb-add-necessary-make-scripts_gdb-step.patch @@ -0,0 +1,46 @@ +From 35e8f9af48d2b240a7bda436cd611fcc83d2193f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Jan 2023 00:23:20 +0100 +Subject: docs/scripts/gdb: add necessary make scripts_gdb step + +From: Jakob Koschel + +[ Upstream commit 6b219431037bf98c9efd49716aea9b68440477a3 ] + +In order to debug the kernel successfully with gdb you need to run +'make scripts_gdb' nowadays. + +This was changed with the following commit: + +Commit 67274c083438340ad16c ("scripts/gdb: delay generation of gdb +constants.py") + +In order to have a complete guide for beginners this remark +should be added to the offial documentation. + +Signed-off-by: Jakob Koschel +Link: https://lore.kernel.org/r/20230112-documentation-gdb-v2-1-292785c43dc9@gmail.com +Signed-off-by: Jonathan Corbet +Signed-off-by: Sasha Levin +--- + Documentation/dev-tools/gdb-kernel-debugging.rst | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/Documentation/dev-tools/gdb-kernel-debugging.rst b/Documentation/dev-tools/gdb-kernel-debugging.rst +index 8e0f1fe8d17ad..895285c037c72 100644 +--- a/Documentation/dev-tools/gdb-kernel-debugging.rst ++++ b/Documentation/dev-tools/gdb-kernel-debugging.rst +@@ -39,6 +39,10 @@ Setup + this mode. In this case, you should build the kernel with + CONFIG_RANDOMIZE_BASE disabled if the architecture supports KASLR. + ++- Build the gdb scripts (required on kernels v5.1 and above):: ++ ++ make scripts_gdb ++ + - Enable the gdb stub of QEMU/KVM, either + + - at VM startup time by appending "-s" to the QEMU command line +-- +2.39.2 + diff --git a/queue-5.15/driver-core-fix-potential-null-ptr-deref-in-device_a.patch b/queue-5.15/driver-core-fix-potential-null-ptr-deref-in-device_a.patch new file mode 100644 index 00000000000..685f5544c92 --- /dev/null +++ b/queue-5.15/driver-core-fix-potential-null-ptr-deref-in-device_a.patch @@ -0,0 +1,72 @@ +From 7fe40155306b592c9ea90d283a9ca9c5b8e69801 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Dec 2022 11:49:04 +0800 +Subject: driver core: fix potential null-ptr-deref in device_add() + +From: Yang Yingliang + +[ Upstream commit f6837f34a34973ef6600c08195ed300e24e97317 ] + +I got the following null-ptr-deref report while doing fault injection test: + +BUG: kernel NULL pointer dereference, address: 0000000000000058 +CPU: 2 PID: 278 Comm: 37-i2c-ds2482 Tainted: G B W N 6.1.0-rc3+ +RIP: 0010:klist_put+0x2d/0xd0 +Call Trace: + + klist_remove+0xf1/0x1c0 + device_release_driver_internal+0x196/0x210 + bus_remove_device+0x1bd/0x240 + device_add+0xd3d/0x1100 + w1_add_master_device+0x476/0x490 [wire] + ds2482_probe+0x303/0x3e0 [ds2482] + +This is how it happened: + +w1_alloc_dev() + // The dev->driver is set to w1_master_driver. + memcpy(&dev->dev, device, sizeof(struct device)); + device_add() + bus_add_device() + dpm_sysfs_add() // It fails, calls bus_remove_device. + + // error path + bus_remove_device() + // The dev->driver is not null, but driver is not bound. + __device_release_driver() + klist_remove(&dev->p->knode_driver) <-- It causes null-ptr-deref. + + // normal path + bus_probe_device() // It's not called yet. + device_bind_driver() + +If dev->driver is set, in the error path after calling bus_add_device() +in device_add(), bus_remove_device() is called, then the device will be +detached from driver. But device_bind_driver() is not called yet, so it +causes null-ptr-deref while access the 'knode_driver'. To fix this, set +dev->driver to null in the error path before calling bus_remove_device(). + +Fixes: 57eee3d23e88 ("Driver core: Call device_pm_add() after bus_add_device() in device_add()") +Signed-off-by: Yang Yingliang +Link: https://lore.kernel.org/r/20221205034904.2077765-1-yangyingliang@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/base/core.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/base/core.c b/drivers/base/core.c +index 10e027e926926..e6a7b93760e45 100644 +--- a/drivers/base/core.c ++++ b/drivers/base/core.c +@@ -3428,6 +3428,7 @@ int device_add(struct device *dev) + device_pm_remove(dev); + dpm_sysfs_remove(dev); + DPMError: ++ dev->driver = NULL; + bus_remove_device(dev); + BusError: + device_remove_attrs(dev); +-- +2.39.2 + diff --git a/queue-5.15/driver-core-fix-resource-leak-in-device_add.patch b/queue-5.15/driver-core-fix-resource-leak-in-device_add.patch new file mode 100644 index 00000000000..720f5fa33f7 --- /dev/null +++ b/queue-5.15/driver-core-fix-resource-leak-in-device_add.patch @@ -0,0 +1,79 @@ +From d879c298886d41c43e30d78f29b20e9ba815ff53 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Nov 2022 09:20:42 +0800 +Subject: driver core: fix resource leak in device_add() + +From: Zhengchao Shao + +[ Upstream commit 6977b1a5d67097eaa4d02b0c126c04cc6e8917c0 ] + +When calling kobject_add() failed in device_add(), it will call +cleanup_glue_dir() to free resource. But in kobject_add(), +dev->kobj.parent has been set to NULL. This will cause resource leak. + +The process is as follows: +device_add() + get_device_parent() + class_dir_create_and_add() + kobject_add() //kobject_get() + ... + dev->kobj.parent = kobj; + ... + kobject_add() //failed, but set dev->kobj.parent = NULL + ... + glue_dir = get_glue_dir(dev) //glue_dir = NULL, and goto + //"Error" label + ... + cleanup_glue_dir() //becaues glue_dir is NULL, not call + //kobject_put() + +The preceding problem may cause insmod mac80211_hwsim.ko to failed. +sysfs: cannot create duplicate filename '/devices/virtual/mac80211_hwsim' +Call Trace: + +dump_stack_lvl+0x8e/0xd1 +sysfs_warn_dup.cold+0x1c/0x29 +sysfs_create_dir_ns+0x224/0x280 +kobject_add_internal+0x2aa/0x880 +kobject_add+0x135/0x1a0 +get_device_parent+0x3d7/0x590 +device_add+0x2aa/0x1cb0 +device_create_groups_vargs+0x1eb/0x260 +device_create+0xdc/0x110 +mac80211_hwsim_new_radio+0x31e/0x4790 [mac80211_hwsim] +init_mac80211_hwsim+0x48d/0x1000 [mac80211_hwsim] +do_one_initcall+0x10f/0x630 +do_init_module+0x19f/0x5e0 +load_module+0x64b7/0x6eb0 +__do_sys_finit_module+0x140/0x200 +do_syscall_64+0x35/0x80 +entry_SYSCALL_64_after_hwframe+0x46/0xb0 + +kobject_add_internal failed for mac80211_hwsim with -EEXIST, don't try to +register things with the same name in the same directory. + +Fixes: cebf8fd16900 ("driver core: fix race between creating/querying glue dir and its cleanup") +Signed-off-by: Zhengchao Shao +Link: https://lore.kernel.org/r/20221123012042.335252-1-shaozhengchao@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/base/core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/base/core.c b/drivers/base/core.c +index e6a7b93760e45..adf003a7e8d6a 100644 +--- a/drivers/base/core.c ++++ b/drivers/base/core.c +@@ -3328,7 +3328,7 @@ int device_add(struct device *dev) + /* we require the name to be set before, and pass NULL */ + error = kobject_add(&dev->kobj, dev->kobj.parent, NULL); + if (error) { +- glue_dir = get_glue_dir(dev); ++ glue_dir = kobj; + goto Error; + } + +-- +2.39.2 + diff --git a/queue-5.15/driver-core-fw_devlink-add-dl_flag_cycle-support-to-.patch b/queue-5.15/driver-core-fw_devlink-add-dl_flag_cycle-support-to-.patch new file mode 100644 index 00000000000..0f983b9176f --- /dev/null +++ b/queue-5.15/driver-core-fw_devlink-add-dl_flag_cycle-support-to-.patch @@ -0,0 +1,162 @@ +From c07f2b6c826e072c9ca1feb28b12070becdf2690 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Feb 2023 17:41:57 -0800 +Subject: driver core: fw_devlink: Add DL_FLAG_CYCLE support to device links + +From: Saravana Kannan + +[ Upstream commit 67cad5c67019c38126b749621665b6723d3ae7e6 ] + +fw_devlink uses DL_FLAG_SYNC_STATE_ONLY device link flag for two +purposes: + +1. To allow a parent device to proxy its child device's dependency on a + supplier so that the supplier doesn't get its sync_state() callback + before the child device/consumer can be added and probed. In this + usage scenario, we need to ignore cycles for ensure correctness of + sync_state() callbacks. + +2. When there are dependency cycles in firmware, we don't know which of + those dependencies are valid. So, we have to ignore them all wrt + probe ordering while still making sure the sync_state() callbacks + come correctly. + +However, when detecting dependency cycles, there can be multiple +dependency cycles between two devices that we need to detect. For +example: + +A -> B -> A and A -> C -> B -> A. + +To detect multiple cycles correct, we need to be able to differentiate +DL_FLAG_SYNC_STATE_ONLY device links used for (1) vs (2) above. + +To allow this differentiation, add a DL_FLAG_CYCLE that can be use to +mark use case (2). We can then use the DL_FLAG_CYCLE to decide which +DL_FLAG_SYNC_STATE_ONLY device links to follow when looking for +dependency cycles. + +Fixes: 2de9d8e0d2fe ("driver core: fw_devlink: Improve handling of cyclic dependencies") +Signed-off-by: Saravana Kannan +Tested-by: Colin Foster +Tested-by: Sudeep Holla +Tested-by: Douglas Anderson +Tested-by: Geert Uytterhoeven +Tested-by: Luca Weiss # qcom/sm7225-fairphone-fp4 +Link: https://lore.kernel.org/r/20230207014207.1678715-6-saravanak@google.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/base/core.c | 28 ++++++++++++++++++---------- + include/linux/device.h | 1 + + 2 files changed, 19 insertions(+), 10 deletions(-) + +diff --git a/drivers/base/core.c b/drivers/base/core.c +index adf003a7e8d6a..178a21e985197 100644 +--- a/drivers/base/core.c ++++ b/drivers/base/core.c +@@ -269,6 +269,12 @@ static bool device_is_ancestor(struct device *dev, struct device *target) + return false; + } + ++static inline bool device_link_flag_is_sync_state_only(u32 flags) ++{ ++ return (flags & ~(DL_FLAG_INFERRED | DL_FLAG_CYCLE)) == ++ (DL_FLAG_SYNC_STATE_ONLY | DL_FLAG_MANAGED); ++} ++ + /** + * device_is_dependent - Check if one device depends on another one + * @dev: Device to check dependencies for. +@@ -295,8 +301,7 @@ int device_is_dependent(struct device *dev, void *target) + return ret; + + list_for_each_entry(link, &dev->links.consumers, s_node) { +- if ((link->flags & ~DL_FLAG_INFERRED) == +- (DL_FLAG_SYNC_STATE_ONLY | DL_FLAG_MANAGED)) ++ if (device_link_flag_is_sync_state_only(link->flags)) + continue; + + if (link->consumer == target) +@@ -369,8 +374,7 @@ static int device_reorder_to_tail(struct device *dev, void *not_used) + + device_for_each_child(dev, NULL, device_reorder_to_tail); + list_for_each_entry(link, &dev->links.consumers, s_node) { +- if ((link->flags & ~DL_FLAG_INFERRED) == +- (DL_FLAG_SYNC_STATE_ONLY | DL_FLAG_MANAGED)) ++ if (device_link_flag_is_sync_state_only(link->flags)) + continue; + device_reorder_to_tail(link->consumer, NULL); + } +@@ -621,7 +625,8 @@ postcore_initcall(devlink_class_init); + DL_FLAG_AUTOREMOVE_SUPPLIER | \ + DL_FLAG_AUTOPROBE_CONSUMER | \ + DL_FLAG_SYNC_STATE_ONLY | \ +- DL_FLAG_INFERRED) ++ DL_FLAG_INFERRED | \ ++ DL_FLAG_CYCLE) + + #define DL_ADD_VALID_FLAGS (DL_MANAGED_LINK_FLAGS | DL_FLAG_STATELESS | \ + DL_FLAG_PM_RUNTIME | DL_FLAG_RPM_ACTIVE) +@@ -690,8 +695,6 @@ struct device_link *device_link_add(struct device *consumer, + if (!consumer || !supplier || consumer == supplier || + flags & ~DL_ADD_VALID_FLAGS || + (flags & DL_FLAG_STATELESS && flags & DL_MANAGED_LINK_FLAGS) || +- (flags & DL_FLAG_SYNC_STATE_ONLY && +- (flags & ~DL_FLAG_INFERRED) != DL_FLAG_SYNC_STATE_ONLY) || + (flags & DL_FLAG_AUTOPROBE_CONSUMER && + flags & (DL_FLAG_AUTOREMOVE_CONSUMER | + DL_FLAG_AUTOREMOVE_SUPPLIER))) +@@ -707,6 +710,10 @@ struct device_link *device_link_add(struct device *consumer, + if (!(flags & DL_FLAG_STATELESS)) + flags |= DL_FLAG_MANAGED; + ++ if (flags & DL_FLAG_SYNC_STATE_ONLY && ++ !device_link_flag_is_sync_state_only(flags)) ++ return NULL; ++ + device_links_write_lock(); + device_pm_lock(); + +@@ -1627,7 +1634,7 @@ static void fw_devlink_relax_link(struct device_link *link) + if (!(link->flags & DL_FLAG_INFERRED)) + return; + +- if (link->flags == (DL_FLAG_MANAGED | FW_DEVLINK_FLAGS_PERMISSIVE)) ++ if (device_link_flag_is_sync_state_only(link->flags)) + return; + + pm_runtime_drop_link(link); +@@ -1695,8 +1702,8 @@ static int fw_devlink_relax_cycle(struct device *con, void *sup) + return ret; + + list_for_each_entry(link, &con->links.consumers, s_node) { +- if ((link->flags & ~DL_FLAG_INFERRED) == +- (DL_FLAG_SYNC_STATE_ONLY | DL_FLAG_MANAGED)) ++ if (!(link->flags & DL_FLAG_CYCLE) && ++ device_link_flag_is_sync_state_only(link->flags)) + continue; + + if (!fw_devlink_relax_cycle(link->consumer, sup)) +@@ -1705,6 +1712,7 @@ static int fw_devlink_relax_cycle(struct device *con, void *sup) + ret = 1; + + fw_devlink_relax_link(link); ++ link->flags |= DL_FLAG_CYCLE; + } + return ret; + } +diff --git a/include/linux/device.h b/include/linux/device.h +index e270cb740b9e7..636ef7caa021d 100644 +--- a/include/linux/device.h ++++ b/include/linux/device.h +@@ -326,6 +326,7 @@ enum device_link_state { + #define DL_FLAG_MANAGED BIT(6) + #define DL_FLAG_SYNC_STATE_ONLY BIT(7) + #define DL_FLAG_INFERRED BIT(8) ++#define DL_FLAG_CYCLE BIT(9) + + /** + * enum dl_dev_state - Device driver presence tracking information. +-- +2.39.2 + diff --git a/queue-5.15/drivers-base-transport_class-fix-possible-memory-lea.patch b/queue-5.15/drivers-base-transport_class-fix-possible-memory-lea.patch new file mode 100644 index 00000000000..51c4834a617 --- /dev/null +++ b/queue-5.15/drivers-base-transport_class-fix-possible-memory-lea.patch @@ -0,0 +1,48 @@ +From 5a9519759e0c9c13e40019c5be64b6ef505c8591 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Nov 2022 18:23:07 +0800 +Subject: drivers: base: transport_class: fix possible memory leak + +From: Yang Yingliang + +[ Upstream commit a86367803838b369fe5486ac18771d14723c258c ] + +Current some drivers(like iscsi) call transport_register_device() +failed, they don't call transport_destroy_device() to release the +memory allocated in transport_setup_device(), because they don't +know what was done, it should be internal thing to release the +resource in register function. So fix this leak by calling destroy +function inside register function. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Yang Yingliang +Link: https://lore.kernel.org/r/20221110102307.3492557-1-yangyingliang@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + include/linux/transport_class.h | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/include/linux/transport_class.h b/include/linux/transport_class.h +index 63076fb835e34..2efc271a96fa6 100644 +--- a/include/linux/transport_class.h ++++ b/include/linux/transport_class.h +@@ -70,8 +70,14 @@ void transport_destroy_device(struct device *); + static inline int + transport_register_device(struct device *dev) + { ++ int ret; ++ + transport_setup_device(dev); +- return transport_add_device(dev); ++ ret = transport_add_device(dev); ++ if (ret) ++ transport_destroy_device(dev); ++ ++ return ret; + } + + static inline void +-- +2.39.2 + diff --git a/queue-5.15/drivers-base-transport_class-fix-resource-leak-when-.patch b/queue-5.15/drivers-base-transport_class-fix-resource-leak-when-.patch new file mode 100644 index 00000000000..5a33dc1e044 --- /dev/null +++ b/queue-5.15/drivers-base-transport_class-fix-resource-leak-when-.patch @@ -0,0 +1,73 @@ +From d795cc4308a2e9d5b4041733685953d8b4b2468a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Nov 2022 11:16:38 +0800 +Subject: drivers: base: transport_class: fix resource leak when + transport_add_device() fails + +From: Yang Yingliang + +[ Upstream commit e5da06b27ff5a148e42265c8e306670a9d913969 ] + +The normal call sequence of using transport class is: + +Add path: +transport_setup_device() + transport_setup_classdev() // call sas_host_setup() here +transport_add_device() // if fails, need call transport_destroy_device() +transport_configure_device() + +Remove path: +transport_remove_device() + transport_remove_classdev // call sas_host_remove() here +transport_destroy_device() + +If transport_add_device() fails, need call transport_destroy_device() +to free memory, but in this case, ->remove() is not called, and the +resources allocated in ->setup() are leaked. So fix these leaks by +calling ->remove() in transport_add_class_device() if it returns error. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Yang Yingliang +Link: https://lore.kernel.org/r/20221115031638.3816551-1-yangyingliang@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/base/transport_class.c | 17 ++++++++++++++++- + 1 file changed, 16 insertions(+), 1 deletion(-) + +diff --git a/drivers/base/transport_class.c b/drivers/base/transport_class.c +index ccc86206e5087..09ee2a1e35bbd 100644 +--- a/drivers/base/transport_class.c ++++ b/drivers/base/transport_class.c +@@ -155,12 +155,27 @@ static int transport_add_class_device(struct attribute_container *cont, + struct device *dev, + struct device *classdev) + { ++ struct transport_class *tclass = class_to_transport_class(cont->class); + int error = attribute_container_add_class_device(classdev); + struct transport_container *tcont = + attribute_container_to_transport_container(cont); + +- if (!error && tcont->statistics) ++ if (error) ++ goto err_remove; ++ ++ if (tcont->statistics) { + error = sysfs_create_group(&classdev->kobj, tcont->statistics); ++ if (error) ++ goto err_del; ++ } ++ ++ return 0; ++ ++err_del: ++ attribute_container_class_device_del(classdev); ++err_remove: ++ if (tclass->remove) ++ tclass->remove(tcont, dev, classdev); + + return error; + } +-- +2.39.2 + diff --git a/queue-5.15/drm-amd-display-fix-memory-leakage.patch b/queue-5.15/drm-amd-display-fix-memory-leakage.patch new file mode 100644 index 00000000000..f2b3d552066 --- /dev/null +++ b/queue-5.15/drm-amd-display-fix-memory-leakage.patch @@ -0,0 +1,33 @@ +From 3c2dcdca7952525fdc8d4065db0f43e97f38bf6f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Nov 2022 10:50:46 +0800 +Subject: drm: amd: display: Fix memory leakage + +From: Konstantin Meskhidze + +[ Upstream commit 6b8701be1f66064ca72733c5f6e13748cdbf8397 ] + +This commit fixes memory leakage in dc_construct_ctx() function. + +Signed-off-by: Konstantin Meskhidze +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/core/dc.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c +index 6c9378208127d..eca882438f6ef 100644 +--- a/drivers/gpu/drm/amd/display/dc/core/dc.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc.c +@@ -771,6 +771,7 @@ static bool dc_construct_ctx(struct dc *dc, + + dc_ctx->perf_trace = dc_perf_trace_create(); + if (!dc_ctx->perf_trace) { ++ kfree(dc_ctx); + ASSERT_CRITICAL(false); + return false; + } +-- +2.39.2 + diff --git a/queue-5.15/drm-amd-display-fix-potential-null-deref-in-dm_resum.patch b/queue-5.15/drm-amd-display-fix-potential-null-deref-in-dm_resum.patch new file mode 100644 index 00000000000..b96134aa301 --- /dev/null +++ b/queue-5.15/drm-amd-display-fix-potential-null-deref-in-dm_resum.patch @@ -0,0 +1,53 @@ +From 8261664168ecc34ad874553abf96df343e9f1494 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Dec 2022 09:06:42 -0500 +Subject: drm/amd/display: Fix potential null-deref in dm_resume + +From: Roman Li + +[ Upstream commit 7a7175a2cd84b7874bebbf8e59f134557a34161b ] + +[Why] +Fixing smatch error: +dm_resume() error: we previously assumed 'aconnector->dc_link' could be null + +[How] +Check if dc_link null at the beginning of the loop, +so further checks can be dropped. + +Reported-by: kernel test robot +Reported-by: Dan Carpenter + +Reviewed-by: Wayne Lin +Acked-by: Jasdeep Dhillon +Signed-off-by: Roman Li +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index b4293b5a82526..68c98e30fee71 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -2687,12 +2687,14 @@ static int dm_resume(void *handle) + drm_for_each_connector_iter(connector, &iter) { + aconnector = to_amdgpu_dm_connector(connector); + ++ if (!aconnector->dc_link) ++ continue; ++ + /* + * this is the case when traversing through already created + * MST connectors, should be skipped + */ +- if (aconnector->dc_link && +- aconnector->dc_link->type == dc_connection_mst_branch) ++ if (aconnector->dc_link->type == dc_connection_mst_branch) + continue; + + mutex_lock(&aconnector->hpd_lock); +-- +2.39.2 + diff --git a/queue-5.15/drm-amd-display-revert-reduce-delay-when-sink-device.patch b/queue-5.15/drm-amd-display-revert-reduce-delay-when-sink-device.patch new file mode 100644 index 00000000000..ddf33364557 --- /dev/null +++ b/queue-5.15/drm-amd-display-revert-reduce-delay-when-sink-device.patch @@ -0,0 +1,82 @@ +From 2c8be7fec3f412ccf272a78935fdff5f36ba654f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Nov 2022 16:17:34 +0800 +Subject: drm/amd/display: Revert Reduce delay when sink device not able to ACK + 00340h write + +From: Ian Chen + +[ Upstream commit 639f6ad6df7f47db48b59956b469a6917a136afb ] + +[WHY] +It causes regression AMD source will not write DPCD 340. + +Reviewed-by: Wayne Lin +Acked-by: Jasdeep Dhillon +Signed-off-by: Ian Chen +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/core/dc_link.c | 6 ------ + drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c | 14 +++----------- + drivers/gpu/drm/amd/display/dc/dc_dp_types.h | 1 - + 3 files changed, 3 insertions(+), 18 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link.c b/drivers/gpu/drm/amd/display/dc/core/dc_link.c +index 3c4205248efc2..b727bd7e039d7 100644 +--- a/drivers/gpu/drm/amd/display/dc/core/dc_link.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link.c +@@ -1665,12 +1665,6 @@ struct dc_link *link_create(const struct link_init_data *init_params) + if (false == dc_link_construct(link, init_params)) + goto construct_fail; + +- /* +- * Must use preferred_link_setting, not reported_link_cap or verified_link_cap, +- * since struct preferred_link_setting won't be reset after S3. +- */ +- link->preferred_link_setting.dpcd_source_device_specific_field_support = true; +- + return link; + + construct_fail: +diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c +index a6ff1b17fd22a..6777adb66f9d7 100644 +--- a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c +@@ -4841,18 +4841,10 @@ void dpcd_set_source_specific_data(struct dc_link *link) + + uint8_t hblank_size = (uint8_t)link->dc->caps.min_horizontal_blanking_period; + +- if (link->preferred_link_setting.dpcd_source_device_specific_field_support) { +- result_write_min_hblank = core_link_write_dpcd(link, +- DP_SOURCE_MINIMUM_HBLANK_SUPPORTED, (uint8_t *)(&hblank_size), +- sizeof(hblank_size)); +- +- if (result_write_min_hblank == DC_ERROR_UNEXPECTED) +- link->preferred_link_setting.dpcd_source_device_specific_field_support = false; +- } else { +- DC_LOG_DC("Sink device does not support 00340h DPCD write. Skipping on purpose.\n"); +- } ++ result_write_min_hblank = core_link_write_dpcd(link, ++ DP_SOURCE_MINIMUM_HBLANK_SUPPORTED, (uint8_t *)(&hblank_size), ++ sizeof(hblank_size)); + } +- + DC_TRACE_LEVEL_MESSAGE(DAL_TRACE_LEVEL_INFORMATION, + WPP_BIT_FLAG_DC_DETECTION_DP_CAPS, + "result=%u link_index=%u enum dce_version=%d DPCD=0x%04X min_hblank=%u branch_dev_id=0x%x branch_dev_name='%c%c%c%c%c%c'", +diff --git a/drivers/gpu/drm/amd/display/dc/dc_dp_types.h b/drivers/gpu/drm/amd/display/dc/dc_dp_types.h +index 4f54bde1bb1c7..1948cd9427d7e 100644 +--- a/drivers/gpu/drm/amd/display/dc/dc_dp_types.h ++++ b/drivers/gpu/drm/amd/display/dc/dc_dp_types.h +@@ -109,7 +109,6 @@ struct dc_link_settings { + enum dc_link_spread link_spread; + bool use_link_rate_set; + uint8_t link_rate_set; +- bool dpcd_source_device_specific_field_support; + }; + + struct dc_lane_settings { +-- +2.39.2 + diff --git a/queue-5.15/drm-amdgpu-fix-enum-odm_combine_mode-mismatch.patch b/queue-5.15/drm-amdgpu-fix-enum-odm_combine_mode-mismatch.patch new file mode 100644 index 00000000000..73a0bbee45e --- /dev/null +++ b/queue-5.15/drm-amdgpu-fix-enum-odm_combine_mode-mismatch.patch @@ -0,0 +1,144 @@ +From f25a13733f74f8c4102c84a46009417af2b501d5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Feb 2023 20:36:02 +0100 +Subject: drm/amdgpu: fix enum odm_combine_mode mismatch + +From: Arnd Bergmann + +[ Upstream commit 087bad7eb1f6945f8232f132953ecc2bda8bd38d ] + +A conversion from 'bool' to 'enum odm_combine_mode' was incomplete, +and gcc warns about this with many instances of + +display/dc/dml/dcn20/display_mode_vba_20.c:3899:44: warning: implicit conversion from 'enum ' to 'enum +odm_combine_mode' [-Wenum-conversion] + 3899 | locals->ODMCombineEnablePerState[i][k] = false; + +Change the ones that we get a warning for, using the same numerical +values to leave the behavior unchanged. + +Fixes: 5fc11598166d ("drm/amd/display: expand dml structs") +Link: https://lore.kernel.org/all/20201026210039.3884312-3-arnd@kernel.org/ +Link: https://lore.kernel.org/all/20210927100659.1431744-1-arnd@kernel.org/ +Signed-off-by: Arnd Bergmann +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../amd/display/dc/dml/dcn20/display_mode_vba_20.c | 8 ++++---- + .../amd/display/dc/dml/dcn20/display_mode_vba_20v2.c | 10 +++++----- + .../amd/display/dc/dml/dcn21/display_mode_vba_21.c | 12 ++++++------ + 3 files changed, 15 insertions(+), 15 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_mode_vba_20.c b/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_mode_vba_20.c +index d3b5b6fedf042..6266b0788387e 100644 +--- a/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_mode_vba_20.c ++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_mode_vba_20.c +@@ -3897,14 +3897,14 @@ void dml20_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode_l + mode_lib->vba.PlaneRequiredDISPCLKWithODMCombine = mode_lib->vba.PixelClock[k] / 2 + * (1 + mode_lib->vba.DISPCLKDPPCLKDSCCLKDownSpreading / 100.0); + +- locals->ODMCombineEnablePerState[i][k] = false; ++ locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_disabled; + mode_lib->vba.PlaneRequiredDISPCLK = mode_lib->vba.PlaneRequiredDISPCLKWithoutODMCombine; + if (mode_lib->vba.ODMCapability) { + if (locals->PlaneRequiredDISPCLKWithoutODMCombine > mode_lib->vba.MaxDispclkRoundedDownToDFSGranularity) { +- locals->ODMCombineEnablePerState[i][k] = true; ++ locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_2to1; + mode_lib->vba.PlaneRequiredDISPCLK = mode_lib->vba.PlaneRequiredDISPCLKWithODMCombine; + } else if (locals->HActive[k] > DCN20_MAX_420_IMAGE_WIDTH && locals->OutputFormat[k] == dm_420) { +- locals->ODMCombineEnablePerState[i][k] = true; ++ locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_2to1; + mode_lib->vba.PlaneRequiredDISPCLK = mode_lib->vba.PlaneRequiredDISPCLKWithODMCombine; + } + } +@@ -3957,7 +3957,7 @@ void dml20_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode_l + locals->RequiredDISPCLK[i][j] = 0.0; + locals->DISPCLK_DPPCLK_Support[i][j] = true; + for (k = 0; k <= mode_lib->vba.NumberOfActivePlanes - 1; k++) { +- locals->ODMCombineEnablePerState[i][k] = false; ++ locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_disabled; + if (locals->SwathWidthYSingleDPP[k] <= locals->MaximumSwathWidth[k]) { + locals->NoOfDPP[i][j][k] = 1; + locals->RequiredDPPCLK[i][j][k] = locals->MinDPPCLKUsingSingleDPP[k] +diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_mode_vba_20v2.c b/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_mode_vba_20v2.c +index 63bbdf8b8678b..0053a6d5178c9 100644 +--- a/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_mode_vba_20v2.c ++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_mode_vba_20v2.c +@@ -4008,17 +4008,17 @@ void dml20v2_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode + mode_lib->vba.PlaneRequiredDISPCLKWithODMCombine = mode_lib->vba.PixelClock[k] / 2 + * (1 + mode_lib->vba.DISPCLKDPPCLKDSCCLKDownSpreading / 100.0); + +- locals->ODMCombineEnablePerState[i][k] = false; ++ locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_disabled; + mode_lib->vba.PlaneRequiredDISPCLK = mode_lib->vba.PlaneRequiredDISPCLKWithoutODMCombine; + if (mode_lib->vba.ODMCapability) { + if (locals->PlaneRequiredDISPCLKWithoutODMCombine > MaxMaxDispclkRoundedDown) { +- locals->ODMCombineEnablePerState[i][k] = true; ++ locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_2to1; + mode_lib->vba.PlaneRequiredDISPCLK = mode_lib->vba.PlaneRequiredDISPCLKWithODMCombine; + } else if (locals->DSCEnabled[k] && (locals->HActive[k] > DCN20_MAX_DSC_IMAGE_WIDTH)) { +- locals->ODMCombineEnablePerState[i][k] = true; ++ locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_2to1; + mode_lib->vba.PlaneRequiredDISPCLK = mode_lib->vba.PlaneRequiredDISPCLKWithODMCombine; + } else if (locals->HActive[k] > DCN20_MAX_420_IMAGE_WIDTH && locals->OutputFormat[k] == dm_420) { +- locals->ODMCombineEnablePerState[i][k] = true; ++ locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_2to1; + mode_lib->vba.PlaneRequiredDISPCLK = mode_lib->vba.PlaneRequiredDISPCLKWithODMCombine; + } + } +@@ -4071,7 +4071,7 @@ void dml20v2_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode + locals->RequiredDISPCLK[i][j] = 0.0; + locals->DISPCLK_DPPCLK_Support[i][j] = true; + for (k = 0; k <= mode_lib->vba.NumberOfActivePlanes - 1; k++) { +- locals->ODMCombineEnablePerState[i][k] = false; ++ locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_disabled; + if (locals->SwathWidthYSingleDPP[k] <= locals->MaximumSwathWidth[k]) { + locals->NoOfDPP[i][j][k] = 1; + locals->RequiredDPPCLK[i][j][k] = locals->MinDPPCLKUsingSingleDPP[k] +diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn21/display_mode_vba_21.c b/drivers/gpu/drm/amd/display/dc/dml/dcn21/display_mode_vba_21.c +index 4136eb8256cb5..26f839ce710f5 100644 +--- a/drivers/gpu/drm/amd/display/dc/dml/dcn21/display_mode_vba_21.c ++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn21/display_mode_vba_21.c +@@ -3979,17 +3979,17 @@ void dml21_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode_l + mode_lib->vba.PlaneRequiredDISPCLKWithODMCombine = mode_lib->vba.PixelClock[k] / 2 + * (1 + mode_lib->vba.DISPCLKDPPCLKDSCCLKDownSpreading / 100.0); + +- locals->ODMCombineEnablePerState[i][k] = false; ++ locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_disabled; + mode_lib->vba.PlaneRequiredDISPCLK = mode_lib->vba.PlaneRequiredDISPCLKWithoutODMCombine; + if (mode_lib->vba.ODMCapability) { + if (locals->PlaneRequiredDISPCLKWithoutODMCombine > MaxMaxDispclkRoundedDown) { +- locals->ODMCombineEnablePerState[i][k] = true; ++ locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_2to1; + mode_lib->vba.PlaneRequiredDISPCLK = mode_lib->vba.PlaneRequiredDISPCLKWithODMCombine; + } else if (locals->DSCEnabled[k] && (locals->HActive[k] > DCN21_MAX_DSC_IMAGE_WIDTH)) { +- locals->ODMCombineEnablePerState[i][k] = true; ++ locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_2to1; + mode_lib->vba.PlaneRequiredDISPCLK = mode_lib->vba.PlaneRequiredDISPCLKWithODMCombine; + } else if (locals->HActive[k] > DCN21_MAX_420_IMAGE_WIDTH && locals->OutputFormat[k] == dm_420) { +- locals->ODMCombineEnablePerState[i][k] = true; ++ locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_2to1; + mode_lib->vba.PlaneRequiredDISPCLK = mode_lib->vba.PlaneRequiredDISPCLKWithODMCombine; + } + } +@@ -4042,7 +4042,7 @@ void dml21_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode_l + locals->RequiredDISPCLK[i][j] = 0.0; + locals->DISPCLK_DPPCLK_Support[i][j] = true; + for (k = 0; k <= mode_lib->vba.NumberOfActivePlanes - 1; k++) { +- locals->ODMCombineEnablePerState[i][k] = false; ++ locals->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_disabled; + if (locals->SwathWidthYSingleDPP[k] <= locals->MaximumSwathWidth[k]) { + locals->NoOfDPP[i][j][k] = 1; + locals->RequiredDPPCLK[i][j][k] = locals->MinDPPCLKUsingSingleDPP[k] +@@ -5218,7 +5218,7 @@ void dml21_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode_l + mode_lib->vba.ODMCombineEnabled[k] = + locals->ODMCombineEnablePerState[mode_lib->vba.VoltageLevel][k]; + } else { +- mode_lib->vba.ODMCombineEnabled[k] = false; ++ mode_lib->vba.ODMCombineEnabled[k] = dm_odm_combine_mode_disabled; + } + mode_lib->vba.DSCEnabled[k] = + locals->RequiresDSC[mode_lib->vba.VoltageLevel][k]; +-- +2.39.2 + diff --git a/queue-5.15/drm-bridge-lt9611-fix-clock-calculation.patch b/queue-5.15/drm-bridge-lt9611-fix-clock-calculation.patch new file mode 100644 index 00000000000..b7d50a49701 --- /dev/null +++ b/queue-5.15/drm-bridge-lt9611-fix-clock-calculation.patch @@ -0,0 +1,106 @@ +From ae9702aa9f3bab1805cf0c5b956eeecff3ed697c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Jan 2023 10:16:50 +0200 +Subject: drm/bridge: lt9611: fix clock calculation + +From: Dmitry Baryshkov + +[ Upstream commit 2576eb26494eb0509dd9ceb0cd27771a7a5e3674 ] + +Instead of having several fixed values for the pcr register, calculate +it before programming. This allows the bridge to support most of the +display modes. + +Fixes: 23278bf54afe ("drm/bridge: Introduce LT9611 DSI to HDMI bridge") +Reviewed-by: Neil Armstrong +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/20230118081658.2198520-6-dmitry.baryshkov@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/lontium-lt9611.c | 32 +++++++++++-------------- + 1 file changed, 14 insertions(+), 18 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/lontium-lt9611.c b/drivers/gpu/drm/bridge/lontium-lt9611.c +index 4925566dfc54f..bb13511dd4263 100644 +--- a/drivers/gpu/drm/bridge/lontium-lt9611.c ++++ b/drivers/gpu/drm/bridge/lontium-lt9611.c +@@ -190,8 +190,9 @@ static void lt9611_mipi_video_setup(struct lt9611 *lt9611, + regmap_write(lt9611->regmap, 0x831b, (u8)(hsync_porch % 256)); + } + +-static void lt9611_pcr_setup(struct lt9611 *lt9611, const struct drm_display_mode *mode) ++static void lt9611_pcr_setup(struct lt9611 *lt9611, const struct drm_display_mode *mode, unsigned int postdiv) + { ++ unsigned int pcr_m = mode->clock * 5 * postdiv / 27000; + const struct reg_sequence reg_cfg[] = { + { 0x830b, 0x01 }, + { 0x830c, 0x10 }, +@@ -234,24 +235,14 @@ static void lt9611_pcr_setup(struct lt9611 *lt9611, const struct drm_display_mod + else + regmap_multi_reg_write(lt9611->regmap, reg_cfg, ARRAY_SIZE(reg_cfg)); + +- switch (mode->hdisplay) { +- case 640: +- regmap_write(lt9611->regmap, 0x8326, 0x14); +- break; +- case 1920: +- regmap_write(lt9611->regmap, 0x8326, 0x37); +- break; +- case 3840: +- regmap_write(lt9611->regmap, 0x8326, 0x37); +- break; +- } ++ regmap_write(lt9611->regmap, 0x8326, pcr_m); + + /* pcr rst */ + regmap_write(lt9611->regmap, 0x8011, 0x5a); + regmap_write(lt9611->regmap, 0x8011, 0xfa); + } + +-static int lt9611_pll_setup(struct lt9611 *lt9611, const struct drm_display_mode *mode) ++static int lt9611_pll_setup(struct lt9611 *lt9611, const struct drm_display_mode *mode, unsigned int *postdiv) + { + unsigned int pclk = mode->clock; + const struct reg_sequence reg_cfg[] = { +@@ -269,12 +260,16 @@ static int lt9611_pll_setup(struct lt9611 *lt9611, const struct drm_display_mode + + regmap_multi_reg_write(lt9611->regmap, reg_cfg, ARRAY_SIZE(reg_cfg)); + +- if (pclk > 150000) ++ if (pclk > 150000) { + regmap_write(lt9611->regmap, 0x812d, 0x88); +- else if (pclk > 70000) ++ *postdiv = 1; ++ } else if (pclk > 70000) { + regmap_write(lt9611->regmap, 0x812d, 0x99); +- else ++ *postdiv = 2; ++ } else { + regmap_write(lt9611->regmap, 0x812d, 0xaa); ++ *postdiv = 4; ++ } + + /* + * first divide pclk by 2 first +@@ -917,14 +912,15 @@ static void lt9611_bridge_mode_set(struct drm_bridge *bridge, + { + struct lt9611 *lt9611 = bridge_to_lt9611(bridge); + struct hdmi_avi_infoframe avi_frame; ++ unsigned int postdiv; + int ret; + + lt9611_bridge_pre_enable(bridge); + + lt9611_mipi_input_digital(lt9611, mode); +- lt9611_pll_setup(lt9611, mode); ++ lt9611_pll_setup(lt9611, mode, &postdiv); + lt9611_mipi_video_setup(lt9611, mode); +- lt9611_pcr_setup(lt9611, mode); ++ lt9611_pcr_setup(lt9611, mode, postdiv); + + ret = drm_hdmi_avi_infoframe_from_display_mode(&avi_frame, + <9611->connector, +-- +2.39.2 + diff --git a/queue-5.15/drm-bridge-lt9611-fix-hpd-reenablement.patch b/queue-5.15/drm-bridge-lt9611-fix-hpd-reenablement.patch new file mode 100644 index 00000000000..c5601e6930c --- /dev/null +++ b/queue-5.15/drm-bridge-lt9611-fix-hpd-reenablement.patch @@ -0,0 +1,52 @@ +From d38e0e29e694a72107877576e7b3dead4a010c1e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Jan 2023 10:16:47 +0200 +Subject: drm/bridge: lt9611: fix HPD reenablement + +From: Dmitry Baryshkov + +[ Upstream commit a7790f6bd38f3642b60ae3504a2c749135b89451 ] + +The driver will reset the bridge in the atomic_pre_enable(). However +this will also drop the HPD interrupt state. Instead of resetting the +bridge, properly wake it up. This fixes the HPD interrupt delivery after +the disable/enable cycle. + +Fixes: 23278bf54afe ("drm/bridge: Introduce LT9611 DSI to HDMI bridge") +Reviewed-by: Neil Armstrong +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/20230118081658.2198520-3-dmitry.baryshkov@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/lontium-lt9611.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/lontium-lt9611.c b/drivers/gpu/drm/bridge/lontium-lt9611.c +index 5e5641ac5ea3d..fe660d667daf6 100644 +--- a/drivers/gpu/drm/bridge/lontium-lt9611.c ++++ b/drivers/gpu/drm/bridge/lontium-lt9611.c +@@ -880,12 +880,18 @@ static enum drm_mode_status lt9611_bridge_mode_valid(struct drm_bridge *bridge, + static void lt9611_bridge_pre_enable(struct drm_bridge *bridge) + { + struct lt9611 *lt9611 = bridge_to_lt9611(bridge); ++ static const struct reg_sequence reg_cfg[] = { ++ { 0x8102, 0x12 }, ++ { 0x8123, 0x40 }, ++ { 0x8130, 0xea }, ++ { 0x8011, 0xfa }, ++ }; + + if (!lt9611->sleep) + return; + +- lt9611_reset(lt9611); +- regmap_write(lt9611->regmap, 0x80ee, 0x01); ++ regmap_multi_reg_write(lt9611->regmap, ++ reg_cfg, ARRAY_SIZE(reg_cfg)); + + lt9611->sleep = false; + } +-- +2.39.2 + diff --git a/queue-5.15/drm-bridge-lt9611-fix-polarity-programming.patch b/queue-5.15/drm-bridge-lt9611-fix-polarity-programming.patch new file mode 100644 index 00000000000..be8355bccb9 --- /dev/null +++ b/queue-5.15/drm-bridge-lt9611-fix-polarity-programming.patch @@ -0,0 +1,68 @@ +From 6769197b159b205f3fcef71b718865b35bcec2aa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Jan 2023 10:16:48 +0200 +Subject: drm/bridge: lt9611: fix polarity programming + +From: Dmitry Baryshkov + +[ Upstream commit 0b157efa384ea417304b1da284ee2f603c607fc3 ] + +Fix programming of hsync and vsync polarities + +Fixes: 23278bf54afe ("drm/bridge: Introduce LT9611 DSI to HDMI bridge") +Reviewed-by: Neil Armstrong +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/20230118081658.2198520-4-dmitry.baryshkov@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/lontium-lt9611.c | 17 ++++++++++++----- + 1 file changed, 12 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/lontium-lt9611.c b/drivers/gpu/drm/bridge/lontium-lt9611.c +index fe660d667daf6..4c56407c4cf04 100644 +--- a/drivers/gpu/drm/bridge/lontium-lt9611.c ++++ b/drivers/gpu/drm/bridge/lontium-lt9611.c +@@ -205,7 +205,6 @@ static void lt9611_pcr_setup(struct lt9611 *lt9611, const struct drm_display_mod + + /* stage 2 */ + { 0x834a, 0x40 }, +- { 0x831d, 0x10 }, + + /* MK limit */ + { 0x832d, 0x38 }, +@@ -220,11 +219,19 @@ static void lt9611_pcr_setup(struct lt9611 *lt9611, const struct drm_display_mod + { 0x8325, 0x00 }, + { 0x832a, 0x01 }, + { 0x834a, 0x10 }, +- { 0x831d, 0x10 }, +- { 0x8326, 0x37 }, + }; ++ u8 pol = 0x10; + +- regmap_multi_reg_write(lt9611->regmap, reg_cfg, ARRAY_SIZE(reg_cfg)); ++ if (mode->flags & DRM_MODE_FLAG_NHSYNC) ++ pol |= 0x2; ++ if (mode->flags & DRM_MODE_FLAG_NVSYNC) ++ pol |= 0x1; ++ regmap_write(lt9611->regmap, 0x831d, pol); ++ ++ if (mode->hdisplay == 3840) ++ regmap_multi_reg_write(lt9611->regmap, reg_cfg2, ARRAY_SIZE(reg_cfg2)); ++ else ++ regmap_multi_reg_write(lt9611->regmap, reg_cfg, ARRAY_SIZE(reg_cfg)); + + switch (mode->hdisplay) { + case 640: +@@ -234,7 +241,7 @@ static void lt9611_pcr_setup(struct lt9611 *lt9611, const struct drm_display_mod + regmap_write(lt9611->regmap, 0x8326, 0x37); + break; + case 3840: +- regmap_multi_reg_write(lt9611->regmap, reg_cfg2, ARRAY_SIZE(reg_cfg2)); ++ regmap_write(lt9611->regmap, 0x8326, 0x37); + break; + } + +-- +2.39.2 + diff --git a/queue-5.15/drm-bridge-lt9611-fix-programming-of-video-modes.patch b/queue-5.15/drm-bridge-lt9611-fix-programming-of-video-modes.patch new file mode 100644 index 00000000000..a4e8660df6a --- /dev/null +++ b/queue-5.15/drm-bridge-lt9611-fix-programming-of-video-modes.patch @@ -0,0 +1,38 @@ +From ac5fa5d335aef36b943a278e9aa0e1f373cd692b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Jan 2023 10:16:49 +0200 +Subject: drm/bridge: lt9611: fix programming of video modes + +From: Dmitry Baryshkov + +[ Upstream commit ad188aa47edaa033a270e1a3efae43836ff47569 ] + +Program the upper part of the hfront_porch into the proper register. + +Fixes: 23278bf54afe ("drm/bridge: Introduce LT9611 DSI to HDMI bridge") +Reviewed-by: Neil Armstrong +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/20230118081658.2198520-5-dmitry.baryshkov@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/lontium-lt9611.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/bridge/lontium-lt9611.c b/drivers/gpu/drm/bridge/lontium-lt9611.c +index 4c56407c4cf04..4925566dfc54f 100644 +--- a/drivers/gpu/drm/bridge/lontium-lt9611.c ++++ b/drivers/gpu/drm/bridge/lontium-lt9611.c +@@ -185,7 +185,8 @@ static void lt9611_mipi_video_setup(struct lt9611 *lt9611, + + regmap_write(lt9611->regmap, 0x8319, (u8)(hfront_porch % 256)); + +- regmap_write(lt9611->regmap, 0x831a, (u8)(hsync_porch / 256)); ++ regmap_write(lt9611->regmap, 0x831a, (u8)(hsync_porch / 256) | ++ ((hfront_porch / 256) << 4)); + regmap_write(lt9611->regmap, 0x831b, (u8)(hsync_porch % 256)); + } + +-- +2.39.2 + diff --git a/queue-5.15/drm-bridge-lt9611-fix-sleep-mode-setup.patch b/queue-5.15/drm-bridge-lt9611-fix-sleep-mode-setup.patch new file mode 100644 index 00000000000..1018c973687 --- /dev/null +++ b/queue-5.15/drm-bridge-lt9611-fix-sleep-mode-setup.patch @@ -0,0 +1,46 @@ +From fbbce77689393670c504cc5388b228935ee5e518 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Jan 2023 10:16:46 +0200 +Subject: drm/bridge: lt9611: fix sleep mode setup + +From: Dmitry Baryshkov + +[ Upstream commit ae2d329f104b75a0a78dcaded29fe6283289cdf9 ] + +On atomic_post_disable the bridge goes to the low power state. However +the code disables too much of the chip, so the HPD event is not being +detected and delivered to the host. Reduce the power saving in order to +get the HPD event. + +Fixes: 23278bf54afe ("drm/bridge: Introduce LT9611 DSI to HDMI bridge") +Reviewed-by: Neil Armstrong +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/20230118081658.2198520-2-dmitry.baryshkov@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/lontium-lt9611.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/lontium-lt9611.c b/drivers/gpu/drm/bridge/lontium-lt9611.c +index 1dcc28a4d8537..5e5641ac5ea3d 100644 +--- a/drivers/gpu/drm/bridge/lontium-lt9611.c ++++ b/drivers/gpu/drm/bridge/lontium-lt9611.c +@@ -446,12 +446,11 @@ static void lt9611_sleep_setup(struct lt9611 *lt9611) + { 0x8023, 0x01 }, + { 0x8157, 0x03 }, /* set addr pin as output */ + { 0x8149, 0x0b }, +- { 0x8151, 0x30 }, /* disable IRQ */ ++ + { 0x8102, 0x48 }, /* MIPI Rx power down */ + { 0x8123, 0x80 }, + { 0x8130, 0x00 }, +- { 0x8100, 0x01 }, /* bandgap power down */ +- { 0x8101, 0x00 }, /* system clk power down */ ++ { 0x8011, 0x0a }, + }; + + regmap_multi_reg_write(lt9611->regmap, +-- +2.39.2 + diff --git a/queue-5.15/drm-bridge-lt9611-pass-a-pointer-to-the-of-node.patch b/queue-5.15/drm-bridge-lt9611-pass-a-pointer-to-the-of-node.patch new file mode 100644 index 00000000000..a58f7111bb3 --- /dev/null +++ b/queue-5.15/drm-bridge-lt9611-pass-a-pointer-to-the-of-node.patch @@ -0,0 +1,37 @@ +From 66398ba37ea44c6d10df8d95213413a81b1b34b3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Jan 2023 10:16:51 +0200 +Subject: drm/bridge: lt9611: pass a pointer to the of node + +From: Dmitry Baryshkov + +[ Upstream commit b0a7f8736789935f62d6df32d441cdf05a5c05d2 ] + +Pass a pointer to the OF node while registering lt9611 MIPI device. + +Fixes: 23278bf54afe ("drm/bridge: Introduce LT9611 DSI to HDMI bridge") +Reviewed-by: Neil Armstrong +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/20230118081658.2198520-7-dmitry.baryshkov@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/lontium-lt9611.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/bridge/lontium-lt9611.c b/drivers/gpu/drm/bridge/lontium-lt9611.c +index bb13511dd4263..0c6dea9ccb728 100644 +--- a/drivers/gpu/drm/bridge/lontium-lt9611.c ++++ b/drivers/gpu/drm/bridge/lontium-lt9611.c +@@ -759,7 +759,7 @@ static const struct drm_connector_funcs lt9611_bridge_connector_funcs = { + static struct mipi_dsi_device *lt9611_attach_dsi(struct lt9611 *lt9611, + struct device_node *dsi_node) + { +- const struct mipi_dsi_device_info info = { "lt9611", 0, NULL }; ++ const struct mipi_dsi_device_info info = { "lt9611", 0, lt9611->dev->of_node}; + struct mipi_dsi_device *dsi; + struct mipi_dsi_host *host; + int ret; +-- +2.39.2 + diff --git a/queue-5.15/drm-bridge-megachips-fix-error-handling-in-i2c_regis.patch b/queue-5.15/drm-bridge-megachips-fix-error-handling-in-i2c_regis.patch new file mode 100644 index 00000000000..87921289eea --- /dev/null +++ b/queue-5.15/drm-bridge-megachips-fix-error-handling-in-i2c_regis.patch @@ -0,0 +1,65 @@ +From 44be130ba94034ac7067b7e2918744c462daca66 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Nov 2022 09:12:26 +0000 +Subject: drm/bridge: megachips: Fix error handling in i2c_register_driver() + +From: Yuan Can + +[ Upstream commit 4ecff954c370b82bce45bdca2846c5c5563e8a8a ] + +A problem about insmod megachips-stdpxxxx-ge-b850v3-fw.ko failed is +triggered with the following log given: + +[ 4497.981497] Error: Driver 'stdp4028-ge-b850v3-fw' is already registered, aborting... +insmod: ERROR: could not insert module megachips-stdpxxxx-ge-b850v3-fw.ko: Device or resource busy + +The reason is that stdpxxxx_ge_b850v3_init() returns i2c_add_driver() +directly without checking its return value, if i2c_add_driver() failed, +it returns without calling i2c_del_driver() on the previous i2c driver, +resulting the megachips-stdpxxxx-ge-b850v3-fw can never be installed +later. +A simple call graph is shown as below: + + stdpxxxx_ge_b850v3_init() + i2c_add_driver(&stdp4028_ge_b850v3_fw_driver) + i2c_add_driver(&stdp2690_ge_b850v3_fw_driver) + i2c_register_driver() + driver_register() + bus_add_driver() + priv = kzalloc(...) # OOM happened + # return without delete stdp4028_ge_b850v3_fw_driver + +Fix by calling i2c_del_driver() on stdp4028_ge_b850v3_fw_driver when +i2c_add_driver() returns error. + +Fixes: fcfa0ddc18ed ("drm/bridge: Drivers for megachips-stdpxxxx-ge-b850v3-fw (LVDS-DP++)") +Signed-off-by: Yuan Can +Reviewed-by: Andrzej Hajda +Tested-by: Ian Ray +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20221108091226.114524-1-yuancan@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c b/drivers/gpu/drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c +index 72248a565579e..e41afcc5326b1 100644 +--- a/drivers/gpu/drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c ++++ b/drivers/gpu/drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c +@@ -444,7 +444,11 @@ static int __init stdpxxxx_ge_b850v3_init(void) + if (ret) + return ret; + +- return i2c_add_driver(&stdp2690_ge_b850v3_fw_driver); ++ ret = i2c_add_driver(&stdp2690_ge_b850v3_fw_driver); ++ if (ret) ++ i2c_del_driver(&stdp4028_ge_b850v3_fw_driver); ++ ++ return ret; + } + module_init(stdpxxxx_ge_b850v3_init); + +-- +2.39.2 + diff --git a/queue-5.15/drm-bridge-ti-sn65dsi83-fix-delay-after-reset-deasse.patch b/queue-5.15/drm-bridge-ti-sn65dsi83-fix-delay-after-reset-deasse.patch new file mode 100644 index 00000000000..839cc9683ce --- /dev/null +++ b/queue-5.15/drm-bridge-ti-sn65dsi83-fix-delay-after-reset-deasse.patch @@ -0,0 +1,40 @@ +From df9ec6b53d1afb83f796bf8811af3e65dc158464 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Nov 2022 09:12:18 +0100 +Subject: drm/bridge: ti-sn65dsi83: Fix delay after reset deassert to match + spec + +From: Frieder Schrempf + +[ Upstream commit 4b03d5e0d3e86ee492d54254927d020dc0fe8acf ] + +The datasheet specifies a delay of 10 milliseconds, but the current +driver only waits for 1 ms. Fix this to make sure the initialization +sequence meets the spec. + +Fixes: ceb515ba29ba ("drm/bridge: ti-sn65dsi83: Add TI SN65DSI83 and SN65DSI84 driver") +Signed-off-by: Frieder Schrempf +Reviewed-by: Alexander Stein +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20221122081219.20143-1-frieder@fris.de +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/ti-sn65dsi83.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/bridge/ti-sn65dsi83.c b/drivers/gpu/drm/bridge/ti-sn65dsi83.c +index c901c0e1a3b04..b3cb910b30852 100644 +--- a/drivers/gpu/drm/bridge/ti-sn65dsi83.c ++++ b/drivers/gpu/drm/bridge/ti-sn65dsi83.c +@@ -381,6 +381,8 @@ static void sn65dsi83_atomic_enable(struct drm_bridge *bridge, + u16 val; + int ret; + ++ usleep_range(10000, 11000); ++ + /* Get the LVDS format from the bridge state. */ + bridge_state = drm_atomic_get_new_bridge_state(state, bridge); + +-- +2.39.2 + diff --git a/queue-5.15/drm-exynos-dsi-fix-mipi_dsi-_no_-mode-flags.patch b/queue-5.15/drm-exynos-dsi-fix-mipi_dsi-_no_-mode-flags.patch new file mode 100644 index 00000000000..d1625321d36 --- /dev/null +++ b/queue-5.15/drm-exynos-dsi-fix-mipi_dsi-_no_-mode-flags.patch @@ -0,0 +1,106 @@ +From 309928fe57e000c0d1124435123ed1a3ac01fd5a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Dec 2022 20:27:44 +0530 +Subject: drm: exynos: dsi: Fix MIPI_DSI*_NO_* mode flags +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jagan Teki + +[ Upstream commit 996e1defca34485dd2bd70b173f069aab5f21a65 ] + +HFP/HBP/HSA/EOT_PACKET modes in Exynos DSI host specifies +0 = Enable and 1 = Disable. + +The logic for checking these mode flags was correct before +the MIPI_DSI*_NO_* mode flag conversion. + +This patch is trying to fix this MIPI_DSI*_NO_* mode flags handling +Exynos DSI host and update the mode_flags in relevant panel drivers. + +Fixes: 0f3b68b66a6d ("drm/dsi: Add _NO_ to MIPI_DSI_* flags disabling features") +Reviewed-by: Marek Vasut +Reviewed-by: Nicolas Boichat +Reported-by: Sébastien Szymanski +Signed-off-by: Jagan Teki +Reviewed-by: Frieder Schrempf +Signed-off-by: Marek Vasut +Link: https://patchwork.freedesktop.org/patch/msgid/20221212145745.15387-1-jagan@amarulasolutions.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/exynos/exynos_drm_dsi.c | 8 ++++---- + drivers/gpu/drm/panel/panel-samsung-s6e3ha2.c | 4 +++- + drivers/gpu/drm/panel/panel-samsung-s6e63j0x03.c | 3 ++- + drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c | 2 -- + 4 files changed, 9 insertions(+), 8 deletions(-) + +diff --git a/drivers/gpu/drm/exynos/exynos_drm_dsi.c b/drivers/gpu/drm/exynos/exynos_drm_dsi.c +index 8d137857818ca..e0465b604f210 100644 +--- a/drivers/gpu/drm/exynos/exynos_drm_dsi.c ++++ b/drivers/gpu/drm/exynos/exynos_drm_dsi.c +@@ -809,15 +809,15 @@ static int exynos_dsi_init_link(struct exynos_dsi *dsi) + reg |= DSIM_AUTO_MODE; + if (dsi->mode_flags & MIPI_DSI_MODE_VIDEO_HSE) + reg |= DSIM_HSE_MODE; +- if (!(dsi->mode_flags & MIPI_DSI_MODE_VIDEO_NO_HFP)) ++ if (dsi->mode_flags & MIPI_DSI_MODE_VIDEO_NO_HFP) + reg |= DSIM_HFP_MODE; +- if (!(dsi->mode_flags & MIPI_DSI_MODE_VIDEO_NO_HBP)) ++ if (dsi->mode_flags & MIPI_DSI_MODE_VIDEO_NO_HBP) + reg |= DSIM_HBP_MODE; +- if (!(dsi->mode_flags & MIPI_DSI_MODE_VIDEO_NO_HSA)) ++ if (dsi->mode_flags & MIPI_DSI_MODE_VIDEO_NO_HSA) + reg |= DSIM_HSA_MODE; + } + +- if (!(dsi->mode_flags & MIPI_DSI_MODE_NO_EOT_PACKET)) ++ if (dsi->mode_flags & MIPI_DSI_MODE_NO_EOT_PACKET) + reg |= DSIM_EOT_DISABLE; + + switch (dsi->format) { +diff --git a/drivers/gpu/drm/panel/panel-samsung-s6e3ha2.c b/drivers/gpu/drm/panel/panel-samsung-s6e3ha2.c +index 0ab1b7ec84cda..166d7d41cd9b5 100644 +--- a/drivers/gpu/drm/panel/panel-samsung-s6e3ha2.c ++++ b/drivers/gpu/drm/panel/panel-samsung-s6e3ha2.c +@@ -692,7 +692,9 @@ static int s6e3ha2_probe(struct mipi_dsi_device *dsi) + + dsi->lanes = 4; + dsi->format = MIPI_DSI_FMT_RGB888; +- dsi->mode_flags = MIPI_DSI_CLOCK_NON_CONTINUOUS; ++ dsi->mode_flags = MIPI_DSI_CLOCK_NON_CONTINUOUS | ++ MIPI_DSI_MODE_VIDEO_NO_HFP | MIPI_DSI_MODE_VIDEO_NO_HBP | ++ MIPI_DSI_MODE_VIDEO_NO_HSA | MIPI_DSI_MODE_NO_EOT_PACKET; + + ctx->supplies[0].supply = "vdd3"; + ctx->supplies[1].supply = "vci"; +diff --git a/drivers/gpu/drm/panel/panel-samsung-s6e63j0x03.c b/drivers/gpu/drm/panel/panel-samsung-s6e63j0x03.c +index ccc8ed6fe3aed..2fc46fdd0e7a0 100644 +--- a/drivers/gpu/drm/panel/panel-samsung-s6e63j0x03.c ++++ b/drivers/gpu/drm/panel/panel-samsung-s6e63j0x03.c +@@ -446,7 +446,8 @@ static int s6e63j0x03_probe(struct mipi_dsi_device *dsi) + + dsi->lanes = 1; + dsi->format = MIPI_DSI_FMT_RGB888; +- dsi->mode_flags = MIPI_DSI_MODE_NO_EOT_PACKET; ++ dsi->mode_flags = MIPI_DSI_MODE_VIDEO_NO_HFP | ++ MIPI_DSI_MODE_VIDEO_NO_HBP | MIPI_DSI_MODE_VIDEO_NO_HSA; + + ctx->supplies[0].supply = "vdd3"; + ctx->supplies[1].supply = "vci"; +diff --git a/drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c b/drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c +index 9b3599d6d2dea..737b8ca22b374 100644 +--- a/drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c ++++ b/drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c +@@ -990,8 +990,6 @@ static int s6e8aa0_probe(struct mipi_dsi_device *dsi) + dsi->lanes = 4; + dsi->format = MIPI_DSI_FMT_RGB888; + dsi->mode_flags = MIPI_DSI_MODE_VIDEO | MIPI_DSI_MODE_VIDEO_BURST +- | MIPI_DSI_MODE_VIDEO_NO_HFP | MIPI_DSI_MODE_VIDEO_NO_HBP +- | MIPI_DSI_MODE_VIDEO_NO_HSA | MIPI_DSI_MODE_NO_EOT_PACKET + | MIPI_DSI_MODE_VSYNC_FLUSH | MIPI_DSI_MODE_VIDEO_AUTO_VERT; + + ret = s6e8aa0_parse_dt(ctx); +-- +2.39.2 + diff --git a/queue-5.15/drm-fix-potential-null-ptr-deref-due-to-drmm_mode_co.patch b/queue-5.15/drm-fix-potential-null-ptr-deref-due-to-drmm_mode_co.patch new file mode 100644 index 00000000000..f5403720c85 --- /dev/null +++ b/queue-5.15/drm-fix-potential-null-ptr-deref-due-to-drmm_mode_co.patch @@ -0,0 +1,80 @@ +From 04f3f481b5c7b3235bbe57dcdb35595979d2957d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Nov 2022 10:16:51 +0800 +Subject: drm: Fix potential null-ptr-deref due to drmm_mode_config_init() + +From: Shang XiaoJing + +[ Upstream commit 834c23e4f798dcdc8af251b3c428ceef94741991 ] + +drmm_mode_config_init() will call drm_mode_create_standard_properties() +and won't check the ret value. When drm_mode_create_standard_properties() +failed due to alloc, property will be a NULL pointer and may causes the +null-ptr-deref. Fix the null-ptr-deref by adding the ret value check. + +Found null-ptr-deref while testing insert module bochs: +general protection fault, probably for non-canonical address + 0xdffffc000000000c: 0000 [#1] SMP KASAN PTI +KASAN: null-ptr-deref in range [0x0000000000000060-0x0000000000000067] +CPU: 3 PID: 249 Comm: modprobe Not tainted 6.1.0-rc1+ #364 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS +rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014 +RIP: 0010:drm_object_attach_property+0x73/0x3c0 [drm] +Call Trace: + + __drm_connector_init+0xb6c/0x1100 [drm] + bochs_pci_probe.cold.11+0x4cb/0x7fe [bochs] + pci_device_probe+0x17d/0x340 + really_probe+0x1db/0x5d0 + __driver_probe_device+0x1e7/0x250 + driver_probe_device+0x4a/0x120 + __driver_attach+0xcd/0x2c0 + bus_for_each_dev+0x11a/0x1b0 + bus_add_driver+0x3d7/0x500 + driver_register+0x18e/0x320 + do_one_initcall+0xc4/0x3e0 + do_init_module+0x1b4/0x630 + load_module+0x5dca/0x7230 + __do_sys_finit_module+0x100/0x170 + do_syscall_64+0x3f/0x90 + entry_SYSCALL_64_after_hwframe+0x63/0xcd +RIP: 0033:0x7ff65af9f839 + +Fixes: 6b4959f43a04 ("drm/atomic: atomic plane properties") +Signed-off-by: Shang XiaoJing +Signed-off-by: Thomas Zimmermann +Link: https://patchwork.freedesktop.org/patch/msgid/20221118021651.2460-1-shangxiaojing@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_mode_config.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/drm_mode_config.c b/drivers/gpu/drm/drm_mode_config.c +index 37b4b9f0e468a..1bd4f0b2cc4d3 100644 +--- a/drivers/gpu/drm/drm_mode_config.c ++++ b/drivers/gpu/drm/drm_mode_config.c +@@ -398,6 +398,8 @@ static void drm_mode_config_init_release(struct drm_device *dev, void *ptr) + */ + int drmm_mode_config_init(struct drm_device *dev) + { ++ int ret; ++ + mutex_init(&dev->mode_config.mutex); + drm_modeset_lock_init(&dev->mode_config.connection_mutex); + mutex_init(&dev->mode_config.idr_mutex); +@@ -419,7 +421,11 @@ int drmm_mode_config_init(struct drm_device *dev) + init_llist_head(&dev->mode_config.connector_free_list); + INIT_WORK(&dev->mode_config.connector_free_work, drm_connector_free_work_fn); + +- drm_mode_create_standard_properties(dev); ++ ret = drm_mode_create_standard_properties(dev); ++ if (ret) { ++ drm_mode_config_cleanup(dev); ++ return ret; ++ } + + /* Just to be sure */ + dev->mode_config.num_fb = 0; +-- +2.39.2 + diff --git a/queue-5.15/drm-fourcc-add-missing-big-endian-xrgb1555-and-rgb56.patch b/queue-5.15/drm-fourcc-add-missing-big-endian-xrgb1555-and-rgb56.patch new file mode 100644 index 00000000000..ff00b3d978b --- /dev/null +++ b/queue-5.15/drm-fourcc-add-missing-big-endian-xrgb1555-and-rgb56.patch @@ -0,0 +1,50 @@ +From 1fc4394f335bd6482868d6ee1f1ae1ac8f6e880d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Nov 2022 17:43:10 +0100 +Subject: drm/fourcc: Add missing big-endian XRGB1555 and RGB565 formats + +From: Geert Uytterhoeven + +[ Upstream commit 6fb6c979ca628583d4d0c59a0f8ff977e581ecc0 ] + +As of commit eae06120f1974e1a ("drm: refuse ADDFB2 ioctl for broken +bigendian drivers"), drivers must set the +quirk_addfb_prefer_host_byte_order quirk to make the drm_mode_addfb() +compat code work correctly on big-endian machines. + +While that works fine for big-endian XRGB8888 and ARGB8888, which are +mapped to the existing little-endian BGRX8888 and BGRA8888 formats, it +does not work for big-endian XRGB1555 and RGB565, as the latter are not +listed in the format database. + +Fix this by adding the missing formats. Limit this to big-endian +platforms, as there is currently no need to support these formats on +little-endian platforms. + +Fixes: 6960e6da9cec3f66 ("drm: fix drm_mode_addfb() on big endian machines.") +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Daniel Vetter +Link: https://patchwork.freedesktop.org/patch/msgid/3ee1f8144feb96c28742b22384189f1f83bcfc1a.1669221671.git.geert@linux-m68k.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_fourcc.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/gpu/drm/drm_fourcc.c b/drivers/gpu/drm/drm_fourcc.c +index 32ee023aed266..7940d948ffdcb 100644 +--- a/drivers/gpu/drm/drm_fourcc.c ++++ b/drivers/gpu/drm/drm_fourcc.c +@@ -153,6 +153,10 @@ const struct drm_format_info *__drm_format_info(u32 format) + { .format = DRM_FORMAT_BGRA5551, .depth = 15, .num_planes = 1, .cpp = { 2, 0, 0 }, .hsub = 1, .vsub = 1, .has_alpha = true }, + { .format = DRM_FORMAT_RGB565, .depth = 16, .num_planes = 1, .cpp = { 2, 0, 0 }, .hsub = 1, .vsub = 1 }, + { .format = DRM_FORMAT_BGR565, .depth = 16, .num_planes = 1, .cpp = { 2, 0, 0 }, .hsub = 1, .vsub = 1 }, ++#ifdef __BIG_ENDIAN ++ { .format = DRM_FORMAT_XRGB1555 | DRM_FORMAT_BIG_ENDIAN, .depth = 15, .num_planes = 1, .cpp = { 2, 0, 0 }, .hsub = 1, .vsub = 1 }, ++ { .format = DRM_FORMAT_RGB565 | DRM_FORMAT_BIG_ENDIAN, .depth = 16, .num_planes = 1, .cpp = { 2, 0, 0 }, .hsub = 1, .vsub = 1 }, ++#endif + { .format = DRM_FORMAT_RGB888, .depth = 24, .num_planes = 1, .cpp = { 3, 0, 0 }, .hsub = 1, .vsub = 1 }, + { .format = DRM_FORMAT_BGR888, .depth = 24, .num_planes = 1, .cpp = { 3, 0, 0 }, .hsub = 1, .vsub = 1 }, + { .format = DRM_FORMAT_XRGB8888, .depth = 24, .num_planes = 1, .cpp = { 4, 0, 0 }, .hsub = 1, .vsub = 1 }, +-- +2.39.2 + diff --git a/queue-5.15/drm-mediatek-clean-dangling-pointer-on-bind-error-pa.patch b/queue-5.15/drm-mediatek-clean-dangling-pointer-on-bind-error-pa.patch new file mode 100644 index 00000000000..27b01df2e49 --- /dev/null +++ b/queue-5.15/drm-mediatek-clean-dangling-pointer-on-bind-error-pa.patch @@ -0,0 +1,44 @@ +From 1bcd81d3455729f57d14b5af9afb85e441f64ec5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Nov 2022 09:39:49 -0500 +Subject: drm/mediatek: Clean dangling pointer on bind error path +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Nícolas F. R. A. Prado + +[ Upstream commit 36aa8c61af55675ed967900fbe5deb32d776f051 ] + +mtk_drm_bind() can fail, in which case drm_dev_put() is called, +destroying the drm_device object. However a pointer to it was still +being held in the private object, and that pointer would be passed along +to DRM in mtk_drm_sys_prepare() if a suspend were triggered at that +point, resulting in a panic. Clean the pointer when destroying the +object in the error path to prevent this from happening. + +Fixes: 119f5173628a ("drm/mediatek: Add DRM Driver for Mediatek SoC MT8173.") +Signed-off-by: Nícolas F. R. A. Prado +Reviewed-by: AngeloGioacchino Del Regno +Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20221122143949.3493104-1-nfraprado@collabora.com/ +Signed-off-by: Chun-Kuang Hu +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mediatek/mtk_drm_drv.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c b/drivers/gpu/drm/mediatek/mtk_drm_drv.c +index aec39724ebeb6..8b3928c2c7d78 100644 +--- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c ++++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c +@@ -376,6 +376,7 @@ static int mtk_drm_bind(struct device *dev) + err_deinit: + mtk_drm_kms_deinit(drm); + err_free: ++ private->drm = NULL; + drm_dev_put(drm); + return ret; + } +-- +2.39.2 + diff --git a/queue-5.15/drm-mediatek-drop-unbalanced-obj-unref.patch b/queue-5.15/drm-mediatek-drop-unbalanced-obj-unref.patch new file mode 100644 index 00000000000..8a2b50ce46a --- /dev/null +++ b/queue-5.15/drm-mediatek-drop-unbalanced-obj-unref.patch @@ -0,0 +1,37 @@ +From 5ce851c9fa6646410e25dddde8231e19b19d55bf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Jan 2023 15:12:55 -0800 +Subject: drm/mediatek: Drop unbalanced obj unref + +From: Rob Clark + +[ Upstream commit 4deef811828e87e26a978d5d6433b261d4713849 ] + +In the error path, mtk_drm_gem_object_mmap() is dropping an obj +reference that it doesn't own. + +Fixes: 119f5173628a ("drm/mediatek: Add DRM Driver for Mediatek SoC MT8173.") +Signed-off-by: Rob Clark +Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20230119231255.2883365-1-robdclark@gmail.com/ +Signed-off-by: Chun-Kuang Hu +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mediatek/mtk_drm_gem.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/gpu/drm/mediatek/mtk_drm_gem.c b/drivers/gpu/drm/mediatek/mtk_drm_gem.c +index fd85e6bfb9545..726a34c4725c4 100644 +--- a/drivers/gpu/drm/mediatek/mtk_drm_gem.c ++++ b/drivers/gpu/drm/mediatek/mtk_drm_gem.c +@@ -164,8 +164,6 @@ static int mtk_drm_gem_object_mmap(struct drm_gem_object *obj, + + ret = dma_mmap_attrs(priv->dma_dev, vma, mtk_gem->cookie, + mtk_gem->dma_addr, obj->size, mtk_gem->dma_attrs); +- if (ret) +- drm_gem_vm_close(vma); + + return ret; + } +-- +2.39.2 + diff --git a/queue-5.15/drm-mediatek-dsi-reduce-the-time-of-dsi-from-lp11-to.patch b/queue-5.15/drm-mediatek-dsi-reduce-the-time-of-dsi-from-lp11-to.patch new file mode 100644 index 00000000000..154912e2e91 --- /dev/null +++ b/queue-5.15/drm-mediatek-dsi-reduce-the-time-of-dsi-from-lp11-to.patch @@ -0,0 +1,51 @@ +From 653906ce310b056f3b8d0de8acffc3f0aad78639 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Jan 2023 13:54:51 +0800 +Subject: drm/mediatek: dsi: Reduce the time of dsi from LP11 to sending cmd + +From: Xinlei Lee + +[ Upstream commit 91aeaed2c1147e3b1157dc084d23f190856a6c23 ] + +According to Figure 16 Turnaround Procedure on page 36 in [1], you +can see the status of LP-00 -> LP10 -> LP11. This state can correspond +to the state of DSI from LP00 -> LP11 in mtk_dsi_lane_ready function +in mtk_dsi.c. + +LP-00 -> LP10 -> LP11 takes about 2*TLPX time (refer to [1] page 51 +to see that TLPX is 50ns) + +The delay at the end of the mtk_dsi_lane_ready function should be +greater than the 2*TLPX specified by the DSI spec, and less than +the time specified by the DSI_RX (generally 6ms to 40ms), to avoid +problems caused by the RX specification + +[1]:mipi_D-PHY_specification_v1-1 + +Fixes: 39e8d062b03c ("drm/mediatek: Keep dsi as LP00 before dcs cmds transfer") +Signed-off-by: Xinlei Lee +Acked-by: Sam Ravnborg +Reviewed-by: AngeloGioacchino Del Regno +Link: https://patchwork.kernel.org/project/linux-mediatek/patch/1673330093-6771-2-git-send-email-xinlei.lee@mediatek.com/ +Signed-off-by: Chun-Kuang Hu +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mediatek/mtk_dsi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/mediatek/mtk_dsi.c b/drivers/gpu/drm/mediatek/mtk_dsi.c +index a6d28533f1b12..98b1204c92906 100644 +--- a/drivers/gpu/drm/mediatek/mtk_dsi.c ++++ b/drivers/gpu/drm/mediatek/mtk_dsi.c +@@ -709,7 +709,7 @@ static void mtk_dsi_lane_ready(struct mtk_dsi *dsi) + mtk_dsi_clk_ulp_mode_leave(dsi); + mtk_dsi_lane0_ulp_mode_leave(dsi); + mtk_dsi_clk_hs_mode(dsi, 0); +- msleep(20); ++ usleep_range(1000, 3000); + /* The reaction time after pulling up the mipi signal for dsi_rx */ + } + } +-- +2.39.2 + diff --git a/queue-5.15/drm-mediatek-mtk_drm_crtc-add-checks-for-devm_kcallo.patch b/queue-5.15/drm-mediatek-mtk_drm_crtc-add-checks-for-devm_kcallo.patch new file mode 100644 index 00000000000..faa01c50d0b --- /dev/null +++ b/queue-5.15/drm-mediatek-mtk_drm_crtc-add-checks-for-devm_kcallo.patch @@ -0,0 +1,38 @@ +From 632e1c54ecbca6dbbc911317295394f04715fd09 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Dec 2022 17:51:15 +0800 +Subject: drm/mediatek: mtk_drm_crtc: Add checks for devm_kcalloc + +From: ruanjinjie + +[ Upstream commit 5bf1e3bd7da625ccf9a22c8cb7d65271e6e47f4c ] + +As the devm_kcalloc may return NULL, the return value needs to be checked +to avoid NULL poineter dereference. + +Fixes: 31c5558dae05 ("drm/mediatek: Refactor plane init") +Signed-off-by: ruanjinjie +Reviewed-by: AngeloGioacchino Del Regno +Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20221205095115.2905090-1-ruanjinjie@huawei.com/ +Signed-off-by: Chun-Kuang Hu +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mediatek/mtk_drm_crtc.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c +index 34bb6c713a908..6497c9fcd2af7 100644 +--- a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c ++++ b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c +@@ -889,6 +889,8 @@ int mtk_drm_crtc_create(struct drm_device *drm_dev, + + mtk_crtc->planes = devm_kcalloc(dev, num_comp_planes, + sizeof(struct drm_plane), GFP_KERNEL); ++ if (!mtk_crtc->planes) ++ return -ENOMEM; + + for (i = 0; i < mtk_crtc->ddp_comp_nr; i++) { + ret = mtk_drm_crtc_init_comp_planes(drm_dev, mtk_crtc, i, +-- +2.39.2 + diff --git a/queue-5.15/drm-mediatek-use-null-instead-of-0-for-null-pointer.patch b/queue-5.15/drm-mediatek-use-null-instead-of-0-for-null-pointer.patch new file mode 100644 index 00000000000..0effc0b03ab --- /dev/null +++ b/queue-5.15/drm-mediatek-use-null-instead-of-0-for-null-pointer.patch @@ -0,0 +1,37 @@ +From 84773f4cf0b04d379b868d32b50cfd2406dec02e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Jan 2023 10:44:41 +0800 +Subject: drm/mediatek: Use NULL instead of 0 for NULL pointer + +From: Miles Chen + +[ Upstream commit 4744cde06f57dd6fbaac468663b1fe2f653eaa16 ] + +Use NULL for NULL pointer to fix the following sparse warning: +drivers/gpu/drm/mediatek/mtk_drm_gem.c:265:27: sparse: warning: Using plain integer as NULL pointer + +Fixes: 3df64d7b0a4f ("drm/mediatek: Implement gem prime vmap/vunmap function") +Signed-off-by: Miles Chen +Reviewed-by: AngeloGioacchino Del Regno +Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20230111024443.24559-1-miles.chen@mediatek.com/ +Signed-off-by: Chun-Kuang Hu +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mediatek/mtk_drm_gem.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/mediatek/mtk_drm_gem.c b/drivers/gpu/drm/mediatek/mtk_drm_gem.c +index d0544962cfc1a..fd85e6bfb9545 100644 +--- a/drivers/gpu/drm/mediatek/mtk_drm_gem.c ++++ b/drivers/gpu/drm/mediatek/mtk_drm_gem.c +@@ -261,6 +261,6 @@ void mtk_drm_gem_prime_vunmap(struct drm_gem_object *obj, struct dma_buf_map *ma + return; + + vunmap(vaddr); +- mtk_gem->kvaddr = 0; ++ mtk_gem->kvaddr = NULL; + kfree(mtk_gem->pages); + } +-- +2.39.2 + diff --git a/queue-5.15/drm-mipi-dsi-fix-byte-order-of-16-bit-dcs-set-get-br.patch b/queue-5.15/drm-mipi-dsi-fix-byte-order-of-16-bit-dcs-set-get-br.patch new file mode 100644 index 00000000000..58624571e86 --- /dev/null +++ b/queue-5.15/drm-mipi-dsi-fix-byte-order-of-16-bit-dcs-set-get-br.patch @@ -0,0 +1,117 @@ +From 265314f17b1e210788a8891b39fea5b24027b6c7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Jan 2023 17:49:07 -0500 +Subject: drm/mipi-dsi: Fix byte order of 16-bit DCS set/get brightness + +From: Daniel Mentz + +[ Upstream commit c9d27c6be518b4ef2966d9564654ef99292ea1b3 ] + +The MIPI DCS specification demands that brightness values are sent in +big endian byte order. It also states that one parameter (i.e. one byte) +shall be sent/received for 8 bit wide values, and two parameters shall +be used for values that are between 9 and 16 bits wide. + +Add new functions to properly handle 16-bit brightness in big endian, +since the two 8- and 16-bit cases are distinct from each other. + +[richard: use separate functions instead of switch/case] +[richard: split into 16-bit component] + +Fixes: 1a9d759331b8 ("drm/dsi: Implement DCS set/get display brightness") +Signed-off-by: Daniel Mentz +Link: https://android.googlesource.com/kernel/msm/+/754affd62d0ee268c686c53169b1dbb7deac8550 +[richard: fix 16-bit brightness_get] +Signed-off-by: Richard Acayan +Tested-by: Caleb Connolly +Reviewed-by: Neil Armstrong +Reviewed-by: Sam Ravnborg +Signed-off-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/20230116224909.23884-2-mailingradian@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_mipi_dsi.c | 52 ++++++++++++++++++++++++++++++++++ + include/drm/drm_mipi_dsi.h | 4 +++ + 2 files changed, 56 insertions(+) + +diff --git a/drivers/gpu/drm/drm_mipi_dsi.c b/drivers/gpu/drm/drm_mipi_dsi.c +index 2c43d54766f34..19fb1d93a4f07 100644 +--- a/drivers/gpu/drm/drm_mipi_dsi.c ++++ b/drivers/gpu/drm/drm_mipi_dsi.c +@@ -1143,6 +1143,58 @@ int mipi_dsi_dcs_get_display_brightness(struct mipi_dsi_device *dsi, + } + EXPORT_SYMBOL(mipi_dsi_dcs_get_display_brightness); + ++/** ++ * mipi_dsi_dcs_set_display_brightness_large() - sets the 16-bit brightness value ++ * of the display ++ * @dsi: DSI peripheral device ++ * @brightness: brightness value ++ * ++ * Return: 0 on success or a negative error code on failure. ++ */ ++int mipi_dsi_dcs_set_display_brightness_large(struct mipi_dsi_device *dsi, ++ u16 brightness) ++{ ++ u8 payload[2] = { brightness >> 8, brightness & 0xff }; ++ ssize_t err; ++ ++ err = mipi_dsi_dcs_write(dsi, MIPI_DCS_SET_DISPLAY_BRIGHTNESS, ++ payload, sizeof(payload)); ++ if (err < 0) ++ return err; ++ ++ return 0; ++} ++EXPORT_SYMBOL(mipi_dsi_dcs_set_display_brightness_large); ++ ++/** ++ * mipi_dsi_dcs_get_display_brightness_large() - gets the current 16-bit ++ * brightness value of the display ++ * @dsi: DSI peripheral device ++ * @brightness: brightness value ++ * ++ * Return: 0 on success or a negative error code on failure. ++ */ ++int mipi_dsi_dcs_get_display_brightness_large(struct mipi_dsi_device *dsi, ++ u16 *brightness) ++{ ++ u8 brightness_be[2]; ++ ssize_t err; ++ ++ err = mipi_dsi_dcs_read(dsi, MIPI_DCS_GET_DISPLAY_BRIGHTNESS, ++ brightness_be, sizeof(brightness_be)); ++ if (err <= 0) { ++ if (err == 0) ++ err = -ENODATA; ++ ++ return err; ++ } ++ ++ *brightness = (brightness_be[0] << 8) | brightness_be[1]; ++ ++ return 0; ++} ++EXPORT_SYMBOL(mipi_dsi_dcs_get_display_brightness_large); ++ + static int mipi_dsi_drv_probe(struct device *dev) + { + struct mipi_dsi_driver *drv = to_mipi_dsi_driver(dev->driver); +diff --git a/include/drm/drm_mipi_dsi.h b/include/drm/drm_mipi_dsi.h +index af7ba8071eb08..1d263eb0b2e12 100644 +--- a/include/drm/drm_mipi_dsi.h ++++ b/include/drm/drm_mipi_dsi.h +@@ -288,6 +288,10 @@ int mipi_dsi_dcs_set_display_brightness(struct mipi_dsi_device *dsi, + u16 brightness); + int mipi_dsi_dcs_get_display_brightness(struct mipi_dsi_device *dsi, + u16 *brightness); ++int mipi_dsi_dcs_set_display_brightness_large(struct mipi_dsi_device *dsi, ++ u16 brightness); ++int mipi_dsi_dcs_get_display_brightness_large(struct mipi_dsi_device *dsi, ++ u16 *brightness); + + /** + * struct mipi_dsi_driver - DSI driver +-- +2.39.2 + diff --git a/queue-5.15/drm-msm-adreno-fix-null-ptr-access-in-adreno_gpu_cle.patch b/queue-5.15/drm-msm-adreno-fix-null-ptr-access-in-adreno_gpu_cle.patch new file mode 100644 index 00000000000..02f57b8277f --- /dev/null +++ b/queue-5.15/drm-msm-adreno-fix-null-ptr-access-in-adreno_gpu_cle.patch @@ -0,0 +1,86 @@ +From cddbb62e454ac56cc0c502eea252d0343c7cb4bc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Dec 2022 20:39:56 +0530 +Subject: drm/msm/adreno: Fix null ptr access in adreno_gpu_cleanup() + +From: Akhil P Oommen + +[ Upstream commit dbeedbcb268d055d8895aceca427f897e12c2b50 ] + +Fix the below kernel panic due to null pointer access: +[ 18.504431] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000048 +[ 18.513464] Mem abort info: +[ 18.516346] ESR = 0x0000000096000005 +[ 18.520204] EC = 0x25: DABT (current EL), IL = 32 bits +[ 18.525706] SET = 0, FnV = 0 +[ 18.528878] EA = 0, S1PTW = 0 +[ 18.532117] FSC = 0x05: level 1 translation fault +[ 18.537138] Data abort info: +[ 18.540110] ISV = 0, ISS = 0x00000005 +[ 18.544060] CM = 0, WnR = 0 +[ 18.547109] user pgtable: 4k pages, 39-bit VAs, pgdp=0000000112826000 +[ 18.553738] [0000000000000048] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000 +[ 18.562690] Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP +**Snip** +[ 18.696758] Call trace: +[ 18.699278] adreno_gpu_cleanup+0x30/0x88 +[ 18.703396] a6xx_destroy+0xc0/0x130 +[ 18.707066] a6xx_gpu_init+0x308/0x424 +[ 18.710921] adreno_bind+0x178/0x288 +[ 18.714590] component_bind_all+0xe0/0x214 +[ 18.718797] msm_drm_bind+0x1d4/0x614 +[ 18.722566] try_to_bring_up_aggregate_device+0x16c/0x1b8 +[ 18.728105] __component_add+0xa0/0x158 +[ 18.732048] component_add+0x20/0x2c +[ 18.735719] adreno_probe+0x40/0xc0 +[ 18.739300] platform_probe+0xb4/0xd4 +[ 18.743068] really_probe+0xfc/0x284 +[ 18.746738] __driver_probe_device+0xc0/0xec +[ 18.751129] driver_probe_device+0x48/0x110 +[ 18.755421] __device_attach_driver+0xa8/0xd0 +[ 18.759900] bus_for_each_drv+0x90/0xdc +[ 18.763843] __device_attach+0xfc/0x174 +[ 18.767786] device_initial_probe+0x20/0x2c +[ 18.772090] bus_probe_device+0x40/0xa0 +[ 18.776032] deferred_probe_work_func+0x94/0xd0 +[ 18.780686] process_one_work+0x190/0x3d0 +[ 18.784805] worker_thread+0x280/0x3d4 +[ 18.788659] kthread+0x104/0x1c0 +[ 18.791981] ret_from_fork+0x10/0x20 +[ 18.795654] Code: f9400408 aa0003f3 aa1f03f4 91142015 (f9402516) +[ 18.801913] ---[ end trace 0000000000000000 ]--- +[ 18.809039] Kernel panic - not syncing: Oops: Fatal exception + +Fixes: 17e822f7591f ("drm/msm: fix unbalanced pm_runtime_enable in adreno_gpu_{init, cleanup}") +Signed-off-by: Akhil P Oommen +Patchwork: https://patchwork.freedesktop.org/patch/515605/ +Link: https://lore.kernel.org/r/20221221203925.v2.1.Ib978de92c4bd000b515486aad72e96c2481f84d0@changeid +Signed-off-by: Rob Clark +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/adreno/adreno_gpu.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/msm/adreno/adreno_gpu.c b/drivers/gpu/drm/msm/adreno/adreno_gpu.c +index bba68776cb25d..3fa01938f4b29 100644 +--- a/drivers/gpu/drm/msm/adreno/adreno_gpu.c ++++ b/drivers/gpu/drm/msm/adreno/adreno_gpu.c +@@ -952,13 +952,13 @@ int adreno_gpu_init(struct drm_device *drm, struct platform_device *pdev, + void adreno_gpu_cleanup(struct adreno_gpu *adreno_gpu) + { + struct msm_gpu *gpu = &adreno_gpu->base; +- struct msm_drm_private *priv = gpu->dev->dev_private; ++ struct msm_drm_private *priv = gpu->dev ? gpu->dev->dev_private : NULL; + unsigned int i; + + for (i = 0; i < ARRAY_SIZE(adreno_gpu->info->fw); i++) + release_firmware(adreno_gpu->fw[i]); + +- if (pm_runtime_enabled(&priv->gpu_pdev->dev)) ++ if (priv && pm_runtime_enabled(&priv->gpu_pdev->dev)) + pm_runtime_disable(&priv->gpu_pdev->dev); + + msm_gpu_cleanup(&adreno_gpu->base); +-- +2.39.2 + diff --git a/queue-5.15/drm-msm-clean-event_thread-worker-in-case-of-an-erro.patch b/queue-5.15/drm-msm-clean-event_thread-worker-in-case-of-an-erro.patch new file mode 100644 index 00000000000..bd54dc0a8cf --- /dev/null +++ b/queue-5.15/drm-msm-clean-event_thread-worker-in-case-of-an-erro.patch @@ -0,0 +1,40 @@ +From c0cc8b639a62272b871adcaeae8dfecf9a71ec71 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 18 Jun 2022 02:33:25 +0300 +Subject: drm/msm: clean event_thread->worker in case of an error + +From: Dmitry Baryshkov + +[ Upstream commit c79bb6b92defdcb834ceeeed9c1cf591beb1b71a ] + +If worker creation fails, nullify the event_thread->worker, so that +msm_drm_uninit() doesn't try accessing invalid memory location. While we +are at it, remove duplicate assignment to the ret variable. + +Fixes: 1041dee2178f ("drm/msm: use kthread_create_worker instead of kthread_run") +Signed-off-by: Dmitry Baryshkov +Reviewed-by: Abhinav Kumar +Patchwork: https://patchwork.freedesktop.org/patch/490106/ +Link: https://lore.kernel.org/r/20220617233328.1143665-2-dmitry.baryshkov@linaro.org +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/msm_drv.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c +index 916361c30d774..6c4d519450b9c 100644 +--- a/drivers/gpu/drm/msm/msm_drv.c ++++ b/drivers/gpu/drm/msm/msm_drv.c +@@ -609,7 +609,7 @@ static int msm_drm_init(struct device *dev, const struct drm_driver *drv) + if (IS_ERR(priv->event_thread[i].worker)) { + ret = PTR_ERR(priv->event_thread[i].worker); + DRM_DEV_ERROR(dev, "failed to create crtc_event kthread\n"); +- ret = PTR_ERR(priv->event_thread[i].worker); ++ priv->event_thread[i].worker = NULL; + goto err_msm_uninit; + } + +-- +2.39.2 + diff --git a/queue-5.15/drm-msm-dpu-add-check-for-cstate.patch b/queue-5.15/drm-msm-dpu-add-check-for-cstate.patch new file mode 100644 index 00000000000..9027eed91b9 --- /dev/null +++ b/queue-5.15/drm-msm-dpu-add-check-for-cstate.patch @@ -0,0 +1,45 @@ +From 756a4c8320b2a957af32247396fadc1b2ca23ba4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Dec 2022 16:05:17 +0800 +Subject: drm/msm/dpu: Add check for cstate + +From: Jiasheng Jiang + +[ Upstream commit c96988b7d99327bb08bd9efd29a203b22cd88ace ] + +As kzalloc may fail and return NULL pointer, +it should be better to check cstate +in order to avoid the NULL pointer dereference +in __drm_atomic_helper_crtc_reset. + +Fixes: 1cff7440a86e ("drm/msm: Convert to using __drm_atomic_helper_crtc_reset() for reset.") +Signed-off-by: Jiasheng Jiang +Reviewed-by: Abhinav Kumar +Reviewed-by: Dmitry Baryshkov +Patchwork: https://patchwork.freedesktop.org/patch/514163/ +Link: https://lore.kernel.org/r/20221206080517.43786-1-jiasheng@iscas.ac.cn +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c +index 2186fc947e5b5..c76305beff6e5 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c +@@ -770,7 +770,10 @@ static void dpu_crtc_reset(struct drm_crtc *crtc) + if (crtc->state) + dpu_crtc_destroy_state(crtc, crtc->state); + +- __drm_atomic_helper_crtc_reset(crtc, &cstate->base); ++ if (cstate) ++ __drm_atomic_helper_crtc_reset(crtc, &cstate->base); ++ else ++ __drm_atomic_helper_crtc_reset(crtc, NULL); + } + + /** +-- +2.39.2 + diff --git a/queue-5.15/drm-msm-dpu-add-check-for-pstates.patch b/queue-5.15/drm-msm-dpu-add-check-for-pstates.patch new file mode 100644 index 00000000000..2238f0932be --- /dev/null +++ b/queue-5.15/drm-msm-dpu-add-check-for-pstates.patch @@ -0,0 +1,40 @@ +From aec85beb7b2c9a87b129713d5c942297dcc18b8c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Dec 2022 16:02:36 +0800 +Subject: drm/msm/dpu: Add check for pstates + +From: Jiasheng Jiang + +[ Upstream commit 93340e10b9c5fc86730d149636e0aa8b47bb5a34 ] + +As kzalloc may fail and return NULL pointer, +it should be better to check pstates +in order to avoid the NULL pointer dereference. + +Fixes: 25fdd5933e4c ("drm/msm: Add SDM845 DPU support") +Signed-off-by: Jiasheng Jiang +Reviewed-by: Abhinav Kumar +Patchwork: https://patchwork.freedesktop.org/patch/514160/ +Link: https://lore.kernel.org/r/20221206080236.43687-1-jiasheng@iscas.ac.cn +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c +index c76305beff6e5..4194689b6b35d 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c +@@ -941,6 +941,8 @@ static int dpu_crtc_atomic_check(struct drm_crtc *crtc, + bool needs_dirtyfb = dpu_crtc_needs_dirtyfb(crtc_state); + + pstates = kzalloc(sizeof(*pstates) * DPU_STAGE_MAX * 4, GFP_KERNEL); ++ if (!pstates) ++ return -ENOMEM; + + if (!crtc_state->enable || !crtc_state->active) { + DRM_DEBUG_ATOMIC("crtc%d -> enable %d, active %d, skip atomic_check\n", +-- +2.39.2 + diff --git a/queue-5.15/drm-msm-dpu-disallow-unallocated-resources-to-be-ret.patch b/queue-5.15/drm-msm-dpu-disallow-unallocated-resources-to-be-ret.patch new file mode 100644 index 00000000000..63d120d6016 --- /dev/null +++ b/queue-5.15/drm-msm-dpu-disallow-unallocated-resources-to-be-ret.patch @@ -0,0 +1,57 @@ +From 54182be79b9d6cb75c7378356d93f23b83893cda Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Jan 2023 00:15:55 +0100 +Subject: drm/msm/dpu: Disallow unallocated resources to be returned + +From: Marijn Suijten + +[ Upstream commit abc40122d9a69f56c04efb5a7485795f5ac799d1 ] + +In the event that the topology requests resources that have not been +created by the system (because they are typically not represented in +dpu_mdss_cfg ^1), the resource(s) in global_state (in this case DSC +blocks, until their allocation/assignment is being sanity-checked in +"drm/msm/dpu: Reject topologies for which no DSC blocks are available") +remain NULL but will still be returned out of +dpu_rm_get_assigned_resources, where the caller expects to get an array +containing num_blks valid pointers (but instead gets these NULLs). + +To prevent this from happening, where null-pointer dereferences +typically result in a hard-to-debug platform lockup, num_blks shouldn't +increase past NULL blocks and will print an error and break instead. +After all, max_blks represents the static size of the maximum number of +blocks whereas the actual amount varies per platform. + +^1: which can happen after a git rebase ended up moving additions to +_dpu_cfg to a different struct which has the same patch context. + +Fixes: bb00a452d6f7 ("drm/msm/dpu: Refactor resource manager") +Signed-off-by: Marijn Suijten +Reviewed-by: Dmitry Baryshkov +Patchwork: https://patchwork.freedesktop.org/patch/517636/ +Link: https://lore.kernel.org/r/20230109231556.344977-1-marijn.suijten@somainline.org +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/disp/dpu1/dpu_rm.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_rm.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_rm.c +index 24fbaf562d418..932275b2dfe74 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_rm.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_rm.c +@@ -663,6 +663,11 @@ int dpu_rm_get_assigned_resources(struct dpu_rm *rm, + blks_size, enc_id); + break; + } ++ if (!hw_blks[i]) { ++ DPU_ERROR("Allocated resource %d unavailable to assign to enc %d\n", ++ type, enc_id); ++ break; ++ } + blks[num_blks++] = hw_blks[i]; + } + +-- +2.39.2 + diff --git a/queue-5.15/drm-msm-dpu-set-pdpu-is_rt_pipe-early-in-dpu_plane_s.patch b/queue-5.15/drm-msm-dpu-set-pdpu-is_rt_pipe-early-in-dpu_plane_s.patch new file mode 100644 index 00000000000..1451cb3a5cf --- /dev/null +++ b/queue-5.15/drm-msm-dpu-set-pdpu-is_rt_pipe-early-in-dpu_plane_s.patch @@ -0,0 +1,71 @@ +From 3147f592d3aa76d022e6ae697d3f7ef9ccdcb6b5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Dec 2022 21:18:30 +0200 +Subject: drm/msm/dpu: set pdpu->is_rt_pipe early in + dpu_plane_sspp_atomic_update() + +From: Dmitry Baryshkov + +[ Upstream commit 1d233b1cb149ec78c20fac58331b27bb460f9558 ] + +The function dpu_plane_sspp_atomic_update() updates pdpu->is_rt_pipe +flag, but after the commit 854f6f1c653b ("drm/msm/dpu: update the qos +remap only if the client type changes") it sets the flag late, after all +the qos functions have updated QoS programming. Move the flag update +back to the place where it happened before the mentioned commit to let +the pipe be programmed according to its current RT/non-RT state. + +Fixes: 854f6f1c653b ("drm/msm/dpu: update the qos remap only if the client type changes") +Signed-off-by: Dmitry Baryshkov +Reviewed-by: Abhinav Kumar +Patchwork: https://patchwork.freedesktop.org/patch/516239/ +Link: https://lore.kernel.org/r/20221229191856.3508092-2-dmitry.baryshkov@linaro.org +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c | 15 ++++++--------- + 1 file changed, 6 insertions(+), 9 deletions(-) + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c +index e32fe89c203cd..59390dc3d1b8c 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c +@@ -1089,7 +1089,7 @@ static void dpu_plane_sspp_atomic_update(struct drm_plane *plane) + struct dpu_plane_state *pstate = to_dpu_plane_state(state); + struct drm_crtc *crtc = state->crtc; + struct drm_framebuffer *fb = state->fb; +- bool is_rt_pipe, update_qos_remap; ++ bool is_rt_pipe; + const struct dpu_format *fmt = + to_dpu_format(msm_framebuffer_format(fb)); + +@@ -1100,6 +1100,9 @@ static void dpu_plane_sspp_atomic_update(struct drm_plane *plane) + pstate->pending = true; + + is_rt_pipe = (dpu_crtc_get_client_type(crtc) != NRT_CLIENT); ++ pstate->needs_qos_remap |= (is_rt_pipe != pdpu->is_rt_pipe); ++ pdpu->is_rt_pipe = is_rt_pipe; ++ + _dpu_plane_set_qos_ctrl(plane, false, DPU_PLANE_QOS_PANIC_CTRL); + + DPU_DEBUG_PLANE(pdpu, "FB[%u] " DRM_RECT_FP_FMT "->crtc%u " DRM_RECT_FMT +@@ -1205,14 +1208,8 @@ static void dpu_plane_sspp_atomic_update(struct drm_plane *plane) + _dpu_plane_set_ot_limit(plane, crtc); + } + +- update_qos_remap = (is_rt_pipe != pdpu->is_rt_pipe) || +- pstate->needs_qos_remap; +- +- if (update_qos_remap) { +- if (is_rt_pipe != pdpu->is_rt_pipe) +- pdpu->is_rt_pipe = is_rt_pipe; +- else if (pstate->needs_qos_remap) +- pstate->needs_qos_remap = false; ++ if (pstate->needs_qos_remap) { ++ pstate->needs_qos_remap = false; + _dpu_plane_set_qos_remap(plane); + } + +-- +2.39.2 + diff --git a/queue-5.15/drm-msm-dsi-add-missing-check-for-alloc_ordered_work.patch b/queue-5.15/drm-msm-dsi-add-missing-check-for-alloc_ordered_work.patch new file mode 100644 index 00000000000..9cc7a77745e --- /dev/null +++ b/queue-5.15/drm-msm-dsi-add-missing-check-for-alloc_ordered_work.patch @@ -0,0 +1,39 @@ +From 75837a8045b75102b2a32c0136d31a1376b3487f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Jan 2023 10:16:51 +0800 +Subject: drm/msm/dsi: Add missing check for alloc_ordered_workqueue + +From: Jiasheng Jiang + +[ Upstream commit 115906ca7b535afb1fe7b5406c566ccd3873f82b ] + +Add check for the return value of alloc_ordered_workqueue as it may return +NULL pointer and cause NULL pointer dereference. + +Signed-off-by: Jiasheng Jiang +Reviewed-by: Abhinav Kumar +Patchwork: https://patchwork.freedesktop.org/patch/517646/ +Link: https://lore.kernel.org/r/20230110021651.12770-1-jiasheng@iscas.ac.cn +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/dsi/dsi_host.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/gpu/drm/msm/dsi/dsi_host.c b/drivers/gpu/drm/msm/dsi/dsi_host.c +index eb60ce125a1fc..d3ec4d67a9a35 100644 +--- a/drivers/gpu/drm/msm/dsi/dsi_host.c ++++ b/drivers/gpu/drm/msm/dsi/dsi_host.c +@@ -1929,6 +1929,9 @@ int msm_dsi_host_init(struct msm_dsi *msm_dsi) + + /* setup workqueue */ + msm_host->workqueue = alloc_ordered_workqueue("dsi_drm_work", 0); ++ if (!msm_host->workqueue) ++ return -ENOMEM; ++ + INIT_WORK(&msm_host->err_work, dsi_err_worker); + INIT_WORK(&msm_host->hpd_work, dsi_hpd_worker); + +-- +2.39.2 + diff --git a/queue-5.15/drm-msm-dsi-allow-2-ctrls-on-v2.5.0.patch b/queue-5.15/drm-msm-dsi-allow-2-ctrls-on-v2.5.0.patch new file mode 100644 index 00000000000..c3fda52b098 --- /dev/null +++ b/queue-5.15/drm-msm-dsi-allow-2-ctrls-on-v2.5.0.patch @@ -0,0 +1,45 @@ +From 8745d42f71f6c75cee6d4c43c66a26e2c076f702 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Jan 2023 22:00:53 +0100 +Subject: drm/msm/dsi: Allow 2 CTRLs on v2.5.0 + +From: Konrad Dybcio + +[ Upstream commit 1ae654ded7c5a19dc13f57a4fe4434fef879b6f9 ] + +v2.5.0 support was originally added for SC7280, but this hw is also +present on SM8350, which has one more DSI host. Bump up the dsi count +and fill in the register of the secondary host to allow it to probe. + +This should not have any adverse effects on SC7280, as the secondary +CTRL will only be touched if it's defined, anyway. + +Fixes: 65c391b31994 ("drm/msm/dsi: Add DSI support for SC7280") +Signed-off-by: Konrad Dybcio +Reviewed-by: Dmitry Baryshkov +Patchwork: https://patchwork.freedesktop.org/patch/519513/ +Link: https://lore.kernel.org/r/20230120210101.2146852-1-konrad.dybcio@linaro.org +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/dsi/dsi_cfg.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/msm/dsi/dsi_cfg.c b/drivers/gpu/drm/msm/dsi/dsi_cfg.c +index ce3901439c69c..68a3f8fea9fe6 100644 +--- a/drivers/gpu/drm/msm/dsi/dsi_cfg.c ++++ b/drivers/gpu/drm/msm/dsi/dsi_cfg.c +@@ -209,8 +209,8 @@ static const struct msm_dsi_config sc7280_dsi_cfg = { + }, + .bus_clk_names = dsi_sc7280_bus_clk_names, + .num_bus_clks = ARRAY_SIZE(dsi_sc7280_bus_clk_names), +- .io_start = { 0xae94000 }, +- .num_dsi = 1, ++ .io_start = { 0xae94000, 0xae96000 }, ++ .num_dsi = 2, + }; + + static const struct msm_dsi_host_cfg_ops msm_dsi_v2_host_ops = { +-- +2.39.2 + diff --git a/queue-5.15/drm-msm-gem-add-check-for-kmalloc.patch b/queue-5.15/drm-msm-gem-add-check-for-kmalloc.patch new file mode 100644 index 00000000000..35e5ae79fdd --- /dev/null +++ b/queue-5.15/drm-msm-gem-add-check-for-kmalloc.patch @@ -0,0 +1,41 @@ +From cda169ace5fa843ccc4515cc7140a353ca86eaca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Dec 2022 17:11:17 +0800 +Subject: drm/msm/gem: Add check for kmalloc + +From: Jiasheng Jiang + +[ Upstream commit d839f0811a31322c087a859c2b181e2383daa7be ] + +Add the check for the return value of kmalloc in order to avoid +NULL pointer dereference in copy_from_user. + +Fixes: 20224d715a88 ("drm/msm/submit: Move copy_from_user ahead of locking bos") +Signed-off-by: Jiasheng Jiang +Reviewed-by: Dmitry Baryshkov +Patchwork: https://patchwork.freedesktop.org/patch/514678/ +Link: https://lore.kernel.org/r/20221212091117.43511-1-jiasheng@iscas.ac.cn +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/msm_gem_submit.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/gpu/drm/msm/msm_gem_submit.c b/drivers/gpu/drm/msm/msm_gem_submit.c +index 1f74bab9e231a..83e6ccad77286 100644 +--- a/drivers/gpu/drm/msm/msm_gem_submit.c ++++ b/drivers/gpu/drm/msm/msm_gem_submit.c +@@ -220,6 +220,10 @@ static int submit_lookup_cmds(struct msm_gem_submit *submit, + goto out; + } + submit->cmd[i].relocs = kmalloc(sz, GFP_KERNEL); ++ if (!submit->cmd[i].relocs) { ++ ret = -ENOMEM; ++ goto out; ++ } + ret = copy_from_user(submit->cmd[i].relocs, userptr, sz); + if (ret) { + ret = -EFAULT; +-- +2.39.2 + diff --git a/queue-5.15/drm-msm-hdmi-add-missing-check-for-alloc_ordered_wor.patch b/queue-5.15/drm-msm-hdmi-add-missing-check-for-alloc_ordered_wor.patch new file mode 100644 index 00000000000..db6dd0a97c8 --- /dev/null +++ b/queue-5.15/drm-msm-hdmi-add-missing-check-for-alloc_ordered_wor.patch @@ -0,0 +1,42 @@ +From 7e733b39677f563c61a435f8d8fe6e6062cc478c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Jan 2023 10:30:11 +0800 +Subject: drm/msm/hdmi: Add missing check for alloc_ordered_workqueue + +From: Jiasheng Jiang + +[ Upstream commit afe4cb96153a0d8003e4e4ebd91b5c543e10df84 ] + +Add check for the return value of alloc_ordered_workqueue as it may return +NULL pointer and cause NULL pointer dereference in `hdmi_hdcp.c` and +`hdmi_hpd.c`. + +Fixes: c6a57a50ad56 ("drm/msm/hdmi: add hdmi hdcp support (V3)") +Signed-off-by: Jiasheng Jiang +Reviewed-by: Dmitry Baryshkov +Patchwork: https://patchwork.freedesktop.org/patch/517211/ +Link: https://lore.kernel.org/r/20230106023011.3985-1-jiasheng@iscas.ac.cn +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/hdmi/hdmi.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/gpu/drm/msm/hdmi/hdmi.c b/drivers/gpu/drm/msm/hdmi/hdmi.c +index e1a9b52d0a292..2c944419e1758 100644 +--- a/drivers/gpu/drm/msm/hdmi/hdmi.c ++++ b/drivers/gpu/drm/msm/hdmi/hdmi.c +@@ -264,6 +264,10 @@ static struct hdmi *msm_hdmi_init(struct platform_device *pdev) + devm_pm_runtime_enable(&pdev->dev); + + hdmi->workq = alloc_ordered_workqueue("msm_hdmi", 0); ++ if (!hdmi->workq) { ++ ret = -ENOMEM; ++ goto fail; ++ } + + hdmi->i2c = msm_hdmi_i2c_init(hdmi); + if (IS_ERR(hdmi->i2c)) { +-- +2.39.2 + diff --git a/queue-5.15/drm-msm-mdp5-add-check-for-kzalloc.patch b/queue-5.15/drm-msm-mdp5-add-check-for-kzalloc.patch new file mode 100644 index 00000000000..54381ba274f --- /dev/null +++ b/queue-5.15/drm-msm-mdp5-add-check-for-kzalloc.patch @@ -0,0 +1,43 @@ +From 67b5d0e9fed7c083ff633f3d4bb998396c21ed20 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Dec 2022 15:48:19 +0800 +Subject: drm/msm/mdp5: Add check for kzalloc + +From: Jiasheng Jiang + +[ Upstream commit 13fcfcb2a9a4787fe4e49841d728f6f2e9fa6911 ] + +As kzalloc may fail and return NULL pointer, +it should be better to check the return value +in order to avoid the NULL pointer dereference. + +Fixes: 1cff7440a86e ("drm/msm: Convert to using __drm_atomic_helper_crtc_reset() for reset.") +Signed-off-by: Jiasheng Jiang +Reviewed-by: Dmitry Baryshkov +Patchwork: https://patchwork.freedesktop.org/patch/514154/ +Link: https://lore.kernel.org/r/20221206074819.18134-1-jiasheng@iscas.ac.cn +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c b/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c +index 31447da0af25c..2b15f10eeae02 100644 +--- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c ++++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c +@@ -1138,7 +1138,10 @@ static void mdp5_crtc_reset(struct drm_crtc *crtc) + if (crtc->state) + mdp5_crtc_destroy_state(crtc, crtc->state); + +- __drm_atomic_helper_crtc_reset(crtc, &mdp5_cstate->base); ++ if (mdp5_cstate) ++ __drm_atomic_helper_crtc_reset(crtc, &mdp5_cstate->base); ++ else ++ __drm_atomic_helper_crtc_reset(crtc, NULL); + } + + static const struct drm_crtc_funcs mdp5_crtc_no_lm_cursor_funcs = { +-- +2.39.2 + diff --git a/queue-5.15/drm-msm-use-strscpy-instead-of-strncpy.patch b/queue-5.15/drm-msm-use-strscpy-instead-of-strncpy.patch new file mode 100644 index 00000000000..455b3288c17 --- /dev/null +++ b/queue-5.15/drm-msm-use-strscpy-instead-of-strncpy.patch @@ -0,0 +1,47 @@ +From a400a0fbd3e4246d846c4360a2eb2401f0e9c88d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Jan 2023 04:01:52 +0200 +Subject: drm/msm: use strscpy instead of strncpy +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Dmitry Baryshkov + +[ Upstream commit d7fd8634f48d76aa799ed57beb7d87dab91bde80 ] + +Using strncpy can result in non-NULL-terminated destination string. Use +strscpy instead. This fixes following warning: + +drivers/gpu/drm/msm/msm_fence.c: In function ‘msm_fence_context_alloc’: +drivers/gpu/drm/msm/msm_fence.c:25:9: warning: ‘strncpy’ specified bound 32 equals destination size [-Wstringop-truncation] + 25 | strncpy(fctx->name, name, sizeof(fctx->name)); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +Fixes: f97decac5f4c ("drm/msm: Support multiple ringbuffers") +Signed-off-by: Dmitry Baryshkov +Reviewed-by: Abhinav Kumar +Patchwork: https://patchwork.freedesktop.org/patch/518787/ +Link: https://lore.kernel.org/r/20230118020152.1689213-1-dmitry.baryshkov@linaro.org +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/msm_fence.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/msm_fence.c b/drivers/gpu/drm/msm/msm_fence.c +index f2cece542c3f7..76439678919c2 100644 +--- a/drivers/gpu/drm/msm/msm_fence.c ++++ b/drivers/gpu/drm/msm/msm_fence.c +@@ -21,7 +21,7 @@ msm_fence_context_alloc(struct drm_device *dev, volatile uint32_t *fenceptr, + return ERR_PTR(-ENOMEM); + + fctx->dev = dev; +- strncpy(fctx->name, name, sizeof(fctx->name)); ++ strscpy(fctx->name, name, sizeof(fctx->name)); + fctx->context = dma_fence_context_alloc(1); + fctx->fenceptr = fenceptr; + spin_lock_init(&fctx->spinlock); +-- +2.39.2 + diff --git a/queue-5.15/drm-mxsfb-drm_mxsfb-should-depend-on-arch_mxs-arch_m.patch b/queue-5.15/drm-mxsfb-drm_mxsfb-should-depend-on-arch_mxs-arch_m.patch new file mode 100644 index 00000000000..a134edb3bfe --- /dev/null +++ b/queue-5.15/drm-mxsfb-drm_mxsfb-should-depend-on-arch_mxs-arch_m.patch @@ -0,0 +1,39 @@ +From 74a4cb11e420c69b87301dbc6cc394b7e9777c51 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Nov 2022 16:59:55 +0100 +Subject: drm: mxsfb: DRM_MXSFB should depend on ARCH_MXS || ARCH_MXC + +From: Geert Uytterhoeven + +[ Upstream commit 7783cc67862f9166c901bfa0f80b717aa8d354dd ] + +Freescale/NXP i.MX LCDIF and eLCDIF LCD controllers are only present on +Freescale/NXP i.MX SoCs. Hence add a dependency on ARCH_MXS || +ARCH_MXC, to prevent asking the user about this driver when configuring +a kernel without Freescale/NXP i.MX support. + +Fixes: 45d59d704080cc0c ("drm: Add new driver for MXSFB controller") +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Marek Vasut +Signed-off-by: Marek Vasut +Link: https://patchwork.freedesktop.org/patch/msgid/98e74779ca2bc575d91afff03369e86b080c01ac.1669046358.git.geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mxsfb/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/mxsfb/Kconfig b/drivers/gpu/drm/mxsfb/Kconfig +index ee22cd25d3e3d..e7201e16119a4 100644 +--- a/drivers/gpu/drm/mxsfb/Kconfig ++++ b/drivers/gpu/drm/mxsfb/Kconfig +@@ -8,6 +8,7 @@ config DRM_MXSFB + tristate "i.MX (e)LCDIF LCD controller" + depends on DRM && OF + depends on COMMON_CLK ++ depends on ARCH_MXS || ARCH_MXC || COMPILE_TEST + select DRM_MXS + select DRM_KMS_HELPER + select DRM_KMS_CMA_HELPER +-- +2.39.2 + diff --git a/queue-5.15/drm-omap-dsi-fix-excessive-stack-usage.patch b/queue-5.15/drm-omap-dsi-fix-excessive-stack-usage.patch new file mode 100644 index 00000000000..4b1a5f2c833 --- /dev/null +++ b/queue-5.15/drm-omap-dsi-fix-excessive-stack-usage.patch @@ -0,0 +1,100 @@ +From 9c753bad69ce2edd5ba3994feafe3abab90eb68b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Sep 2022 11:22:05 +0300 +Subject: drm/omap: dsi: Fix excessive stack usage + +From: Tomi Valkeinen + +[ Upstream commit cfca78971b9233aef0891507a98fba62046d4542 ] + +dsi_dump_dsi_irqs(), a function used for debugfs prints, has a large +struct in its frame, which can result in: + +drivers/gpu/drm/omapdrm/dss/dsi.c:1126:1: warning: the frame size of 1060 bytes is larger than 1024 bytes [-Wframe-larger-than=] + +As the performance of the function is of no concern, let's allocate the +struct with kmalloc instead. + +Compile-tested only. + +Signed-off-by: Tomi Valkeinen +Reported-by: kernel test robot +Reviewed-by: Arnd Bergmann +Link: https://patchwork.freedesktop.org/patch/msgid/20220916082206.167427-1-tomi.valkeinen@ideasonboard.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/omapdrm/dss/dsi.c | 26 ++++++++++++++++---------- + 1 file changed, 16 insertions(+), 10 deletions(-) + +diff --git a/drivers/gpu/drm/omapdrm/dss/dsi.c b/drivers/gpu/drm/omapdrm/dss/dsi.c +index 5f1722b040f46..41da86cd8b64c 100644 +--- a/drivers/gpu/drm/omapdrm/dss/dsi.c ++++ b/drivers/gpu/drm/omapdrm/dss/dsi.c +@@ -1039,22 +1039,26 @@ static int dsi_dump_dsi_irqs(struct seq_file *s, void *p) + { + struct dsi_data *dsi = s->private; + unsigned long flags; +- struct dsi_irq_stats stats; ++ struct dsi_irq_stats *stats; ++ ++ stats = kmalloc(sizeof(*stats), GFP_KERNEL); ++ if (!stats) ++ return -ENOMEM; + + spin_lock_irqsave(&dsi->irq_stats_lock, flags); + +- stats = dsi->irq_stats; ++ *stats = dsi->irq_stats; + memset(&dsi->irq_stats, 0, sizeof(dsi->irq_stats)); + dsi->irq_stats.last_reset = jiffies; + + spin_unlock_irqrestore(&dsi->irq_stats_lock, flags); + + seq_printf(s, "period %u ms\n", +- jiffies_to_msecs(jiffies - stats.last_reset)); ++ jiffies_to_msecs(jiffies - stats->last_reset)); + +- seq_printf(s, "irqs %d\n", stats.irq_count); ++ seq_printf(s, "irqs %d\n", stats->irq_count); + #define PIS(x) \ +- seq_printf(s, "%-20s %10d\n", #x, stats.dsi_irqs[ffs(DSI_IRQ_##x)-1]); ++ seq_printf(s, "%-20s %10d\n", #x, stats->dsi_irqs[ffs(DSI_IRQ_##x)-1]); + + seq_printf(s, "-- DSI%d interrupts --\n", dsi->module_id + 1); + PIS(VC0); +@@ -1078,10 +1082,10 @@ static int dsi_dump_dsi_irqs(struct seq_file *s, void *p) + + #define PIS(x) \ + seq_printf(s, "%-20s %10d %10d %10d %10d\n", #x, \ +- stats.vc_irqs[0][ffs(DSI_VC_IRQ_##x)-1], \ +- stats.vc_irqs[1][ffs(DSI_VC_IRQ_##x)-1], \ +- stats.vc_irqs[2][ffs(DSI_VC_IRQ_##x)-1], \ +- stats.vc_irqs[3][ffs(DSI_VC_IRQ_##x)-1]); ++ stats->vc_irqs[0][ffs(DSI_VC_IRQ_##x)-1], \ ++ stats->vc_irqs[1][ffs(DSI_VC_IRQ_##x)-1], \ ++ stats->vc_irqs[2][ffs(DSI_VC_IRQ_##x)-1], \ ++ stats->vc_irqs[3][ffs(DSI_VC_IRQ_##x)-1]); + + seq_printf(s, "-- VC interrupts --\n"); + PIS(CS); +@@ -1097,7 +1101,7 @@ static int dsi_dump_dsi_irqs(struct seq_file *s, void *p) + + #define PIS(x) \ + seq_printf(s, "%-20s %10d\n", #x, \ +- stats.cio_irqs[ffs(DSI_CIO_IRQ_##x)-1]); ++ stats->cio_irqs[ffs(DSI_CIO_IRQ_##x)-1]); + + seq_printf(s, "-- CIO interrupts --\n"); + PIS(ERRSYNCESC1); +@@ -1122,6 +1126,8 @@ static int dsi_dump_dsi_irqs(struct seq_file *s, void *p) + PIS(ULPSACTIVENOT_ALL1); + #undef PIS + ++ kfree(stats); ++ + return 0; + } + #endif +-- +2.39.2 + diff --git a/queue-5.15/drm-panel-orientation-quirks-add-quirk-for-lenovo-id.patch b/queue-5.15/drm-panel-orientation-quirks-add-quirk-for-lenovo-id.patch new file mode 100644 index 00000000000..1a287afbdfe --- /dev/null +++ b/queue-5.15/drm-panel-orientation-quirks-add-quirk-for-lenovo-id.patch @@ -0,0 +1,42 @@ +From b3ead28f2cda05857c4a66f71b2b53462d21e878 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Feb 2023 16:46:59 +0000 +Subject: drm: panel-orientation-quirks: Add quirk for Lenovo IdeaPad Duet 3 + 10IGL5 + +From: Darrell Kavanagh + +[ Upstream commit 38b2d8efd03d2e56431b611e3523f0158306451d ] + +Another Lenovo convertable where the panel is installed landscape but is +reported to the kernel as portrait. + +Signed-off-by: Darrell Kavanagh +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Link: https://patchwork.freedesktop.org/patch/msgid/20230214164659.3583-1-darrell.kavanagh@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_panel_orientation_quirks.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c +index ce739ba45c551..8768073794fbf 100644 +--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c ++++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c +@@ -278,6 +278,12 @@ static const struct dmi_system_id orientation_data[] = { + DMI_EXACT_MATCH(DMI_PRODUCT_VERSION, "Lenovo ideapad D330-10IGL"), + }, + .driver_data = (void *)&lcd800x1280_rightside_up, ++ }, { /* Lenovo IdeaPad Duet 3 10IGL5 */ ++ .matches = { ++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_VERSION, "IdeaPad Duet 3 10IGL5"), ++ }, ++ .driver_data = (void *)&lcd1200x1920_rightside_up, + }, { /* Lenovo Yoga Book X90F / X91F / X91L */ + .matches = { + /* Non exact match to match all versions */ +-- +2.39.2 + diff --git a/queue-5.15/drm-radeon-free-iio-for-atombios-when-driver-shutdow.patch b/queue-5.15/drm-radeon-free-iio-for-atombios-when-driver-shutdow.patch new file mode 100644 index 00000000000..879d815c8a5 --- /dev/null +++ b/queue-5.15/drm-radeon-free-iio-for-atombios-when-driver-shutdow.patch @@ -0,0 +1,60 @@ +From 51f0c97a405f677187afc7ed1a27409e9824c5d3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Jan 2023 17:47:29 +0800 +Subject: drm/radeon: free iio for atombios when driver shutdown + +From: Liwei Song + +[ Upstream commit 4773fadedca918faec443daaca5e4ea1c0ced144 ] + +Fix below kmemleak when unload radeon driver: + +unreferenced object 0xffff9f8608ede200 (size 512): + comm "systemd-udevd", pid 326, jiffies 4294682822 (age 716.338s) + hex dump (first 32 bytes): + 00 00 00 00 c4 aa ec aa 14 ab 00 00 00 00 00 00 ................ + 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + backtrace: + [<0000000062fadebe>] kmem_cache_alloc_trace+0x2f1/0x500 + [<00000000b6883cea>] atom_parse+0x117/0x230 [radeon] + [<00000000158c23fd>] radeon_atombios_init+0xab/0x170 [radeon] + [<00000000683f672e>] si_init+0x57/0x750 [radeon] + [<00000000566cc31f>] radeon_device_init+0x559/0x9c0 [radeon] + [<0000000046efabb3>] radeon_driver_load_kms+0xc1/0x1a0 [radeon] + [<00000000b5155064>] drm_dev_register+0xdd/0x1d0 + [<0000000045fec835>] radeon_pci_probe+0xbd/0x100 [radeon] + [<00000000e69ecca3>] pci_device_probe+0xe1/0x160 + [<0000000019484b76>] really_probe.part.0+0xc1/0x2c0 + [<000000003f2649da>] __driver_probe_device+0x96/0x130 + [<00000000231c5bb1>] driver_probe_device+0x24/0xf0 + [<0000000000a42377>] __driver_attach+0x77/0x190 + [<00000000d7574da6>] bus_for_each_dev+0x7f/0xd0 + [<00000000633166d2>] driver_attach+0x1e/0x30 + [<00000000313b05b8>] bus_add_driver+0x12c/0x1e0 + +iio was allocated in atom_index_iio() called by atom_parse(), +but it doesn't got released when the dirver is shutdown. +Fix this kmemleak by free it in radeon_atombios_fini(). + +Signed-off-by: Liwei Song +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/radeon/radeon_device.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c +index 92905ebb7b459..1c005e0ddd388 100644 +--- a/drivers/gpu/drm/radeon/radeon_device.c ++++ b/drivers/gpu/drm/radeon/radeon_device.c +@@ -1022,6 +1022,7 @@ void radeon_atombios_fini(struct radeon_device *rdev) + { + if (rdev->mode_info.atom_context) { + kfree(rdev->mode_info.atom_context->scratch); ++ kfree(rdev->mode_info.atom_context->iio); + } + kfree(rdev->mode_info.atom_context); + rdev->mode_info.atom_context = NULL; +-- +2.39.2 + diff --git a/queue-5.15/drm-shmem-helper-fix-locking-for-drm_gem_shmem_get_p.patch b/queue-5.15/drm-shmem-helper-fix-locking-for-drm_gem_shmem_get_p.patch new file mode 100644 index 00000000000..d4a7cb0e884 --- /dev/null +++ b/queue-5.15/drm-shmem-helper-fix-locking-for-drm_gem_shmem_get_p.patch @@ -0,0 +1,112 @@ +From a70f445f5b0553537226e42f8aa97bed394bd684 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 5 Feb 2023 21:51:24 +0900 +Subject: drm/shmem-helper: Fix locking for drm_gem_shmem_get_pages_sgt() + +From: Asahi Lina + +[ Upstream commit ddddedaa0db99481c5e5abe628ad54f65e8765bc ] + +Other functions touching shmem->sgt take the pages lock, so do that here +too. drm_gem_shmem_get_pages() & co take the same lock, so move to the +_locked() variants to avoid recursive locking. + +Discovered while auditing locking to write the Rust abstractions. + +Fixes: 2194a63a818d ("drm: Add library for shmem backed GEM objects") +Fixes: 4fa3d66f132b ("drm/shmem: Do dma_unmap_sg before purging pages") +Signed-off-by: Asahi Lina +Reviewed-by: Javier Martinez Canillas +Signed-off-by: Javier Martinez Canillas +Link: https://patchwork.freedesktop.org/patch/msgid/20230205125124.2260-1-lina@asahilina.net +(cherry picked from commit aa8c85affe3facd3842c8912186623415931cc72) +Signed-off-by: Javier Martinez Canillas +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_gem_shmem_helper.c | 54 ++++++++++++++++---------- + 1 file changed, 34 insertions(+), 20 deletions(-) + +diff --git a/drivers/gpu/drm/drm_gem_shmem_helper.c b/drivers/gpu/drm/drm_gem_shmem_helper.c +index 15c3849e995bd..1af541c12a45f 100644 +--- a/drivers/gpu/drm/drm_gem_shmem_helper.c ++++ b/drivers/gpu/drm/drm_gem_shmem_helper.c +@@ -651,23 +651,7 @@ struct sg_table *drm_gem_shmem_get_sg_table(struct drm_gem_shmem_object *shmem) + } + EXPORT_SYMBOL_GPL(drm_gem_shmem_get_sg_table); + +-/** +- * drm_gem_shmem_get_pages_sgt - Pin pages, dma map them, and return a +- * scatter/gather table for a shmem GEM object. +- * @shmem: shmem GEM object +- * +- * This function returns a scatter/gather table suitable for driver usage. If +- * the sg table doesn't exist, the pages are pinned, dma-mapped, and a sg +- * table created. +- * +- * This is the main function for drivers to get at backing storage, and it hides +- * and difference between dma-buf imported and natively allocated objects. +- * drm_gem_shmem_get_sg_table() should not be directly called by drivers. +- * +- * Returns: +- * A pointer to the scatter/gather table of pinned pages or errno on failure. +- */ +-struct sg_table *drm_gem_shmem_get_pages_sgt(struct drm_gem_shmem_object *shmem) ++static struct sg_table *drm_gem_shmem_get_pages_sgt_locked(struct drm_gem_shmem_object *shmem) + { + struct drm_gem_object *obj = &shmem->base; + int ret; +@@ -678,7 +662,7 @@ struct sg_table *drm_gem_shmem_get_pages_sgt(struct drm_gem_shmem_object *shmem) + + WARN_ON(obj->import_attach); + +- ret = drm_gem_shmem_get_pages(shmem); ++ ret = drm_gem_shmem_get_pages_locked(shmem); + if (ret) + return ERR_PTR(ret); + +@@ -700,10 +684,40 @@ struct sg_table *drm_gem_shmem_get_pages_sgt(struct drm_gem_shmem_object *shmem) + sg_free_table(sgt); + kfree(sgt); + err_put_pages: +- drm_gem_shmem_put_pages(shmem); ++ drm_gem_shmem_put_pages_locked(shmem); + return ERR_PTR(ret); + } +-EXPORT_SYMBOL_GPL(drm_gem_shmem_get_pages_sgt); ++ ++/** ++ * drm_gem_shmem_get_pages_sgt - Pin pages, dma map them, and return a ++ * scatter/gather table for a shmem GEM object. ++ * @shmem: shmem GEM object ++ * ++ * This function returns a scatter/gather table suitable for driver usage. If ++ * the sg table doesn't exist, the pages are pinned, dma-mapped, and a sg ++ * table created. ++ * ++ * This is the main function for drivers to get at backing storage, and it hides ++ * and difference between dma-buf imported and natively allocated objects. ++ * drm_gem_shmem_get_sg_table() should not be directly called by drivers. ++ * ++ * Returns: ++ * A pointer to the scatter/gather table of pinned pages or errno on failure. ++ */ ++struct sg_table *drm_gem_shmem_get_pages_sgt(struct drm_gem_shmem_object *shmem) ++{ ++ int ret; ++ struct sg_table *sgt; ++ ++ ret = mutex_lock_interruptible(&shmem->pages_lock); ++ if (ret) ++ return ERR_PTR(ret); ++ sgt = drm_gem_shmem_get_pages_sgt_locked(shmem); ++ mutex_unlock(&shmem->pages_lock); ++ ++ return sgt; ++} ++EXPORT_SYMBOL(drm_gem_shmem_get_pages_sgt); + + /** + * drm_gem_shmem_prime_import_sg_table - Produce a shmem GEM object from +-- +2.39.2 + diff --git a/queue-5.15/drm-shmem-helper-revert-accidental-non-gpl-export.patch b/queue-5.15/drm-shmem-helper-revert-accidental-non-gpl-export.patch new file mode 100644 index 00000000000..0f9c3d99594 --- /dev/null +++ b/queue-5.15/drm-shmem-helper-revert-accidental-non-gpl-export.patch @@ -0,0 +1,39 @@ +From f128716ac551fc528a28aca17bd5bc4f0f36a5c0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Feb 2023 18:04:21 +0900 +Subject: drm/shmem-helper: Revert accidental non-GPL export + +From: Asahi Lina + +[ Upstream commit 047a754558d640eaa080fce3b22ca9f3d4e04626 ] + +The referenced commit added a wrapper for drm_gem_shmem_get_pages_sgt(), +but in the process it accidentally changed the export type from GPL to +non-GPL. Switch it back to GPL. + +Reported-by: Dmitry Osipenko +Fixes: ddddedaa0db9 ("drm/shmem-helper: Fix locking for drm_gem_shmem_get_pages_sgt()") +Signed-off-by: Asahi Lina +Signed-off-by: Thomas Zimmermann +Link: https://patchwork.freedesktop.org/patch/msgid/20230227-shmem-export-fix-v1-1-8880b2c25e81@asahilina.net +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_gem_shmem_helper.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/drm_gem_shmem_helper.c b/drivers/gpu/drm/drm_gem_shmem_helper.c +index 1af541c12a45f..d58e8e12d3ae8 100644 +--- a/drivers/gpu/drm/drm_gem_shmem_helper.c ++++ b/drivers/gpu/drm/drm_gem_shmem_helper.c +@@ -717,7 +717,7 @@ struct sg_table *drm_gem_shmem_get_pages_sgt(struct drm_gem_shmem_object *shmem) + + return sgt; + } +-EXPORT_SYMBOL(drm_gem_shmem_get_pages_sgt); ++EXPORT_SYMBOL_GPL(drm_gem_shmem_get_pages_sgt); + + /** + * drm_gem_shmem_prime_import_sg_table - Produce a shmem GEM object from +-- +2.39.2 + diff --git a/queue-5.15/drm-tegra-firewall-check-for-is_addr_reg-existence-i.patch b/queue-5.15/drm-tegra-firewall-check-for-is_addr_reg-existence-i.patch new file mode 100644 index 00000000000..f3a92b3a6a4 --- /dev/null +++ b/queue-5.15/drm-tegra-firewall-check-for-is_addr_reg-existence-i.patch @@ -0,0 +1,36 @@ +From 9fe620c9f09b4d392df975ebedaaad603311b3d2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Jan 2023 15:39:01 +0200 +Subject: drm/tegra: firewall: Check for is_addr_reg existence in IMM check + +From: Mikko Perttunen + +[ Upstream commit 1b5c09de25e8c08655c270a70e5e74e93b6bad1f ] + +In the IMM opcode check, don't call is_addr_reg if it's not set. + +Fixes: 8cc95f3fd35e ("drm/tegra: Add job firewall") +Signed-off-by: Mikko Perttunen +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/tegra/firewall.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/gpu/drm/tegra/firewall.c b/drivers/gpu/drm/tegra/firewall.c +index 1824d2db0e2ce..d53f890fa6893 100644 +--- a/drivers/gpu/drm/tegra/firewall.c ++++ b/drivers/gpu/drm/tegra/firewall.c +@@ -97,6 +97,9 @@ static int fw_check_regs_imm(struct tegra_drm_firewall *fw, u32 offset) + { + bool is_addr; + ++ if (!fw->client->ops->is_addr_reg) ++ return 0; ++ + is_addr = fw->client->ops->is_addr_reg(fw->client->base.dev, fw->class, + offset); + if (is_addr) +-- +2.39.2 + diff --git a/queue-5.15/drm-tidss-fix-pixel-format-definition.patch b/queue-5.15/drm-tidss-fix-pixel-format-definition.patch new file mode 100644 index 00000000000..96fcdbafc12 --- /dev/null +++ b/queue-5.15/drm-tidss-fix-pixel-format-definition.patch @@ -0,0 +1,45 @@ +From e44568aeef3dde75b58446cc28b417c02cc07ce3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Dec 2022 18:18:03 -0600 +Subject: drm: tidss: Fix pixel format definition + +From: Randolph Sapp + +[ Upstream commit 2df0433b18f2735a49d2c3a968b40fa2881137c0 ] + +There was a long-standing bug from a typo that created 2 ARGB1555 and +ABGR1555 pixel format entries. Weston 10 has a sanity check that alerted +me to this issue. + +According to the Supported Pixel Data formats table we have the later +entries should have been for Alpha-X instead. + +Signed-off-by: Randolph Sapp +Fixes: 32a1795f57eecc ("drm/tidss: New driver for TI Keystone platform Display SubSystem") +Reviewed-by: Aradhya Bhatia +Acked-by: Andrew Davis +Signed-off-by: Tomi Valkeinen +Link: https://patchwork.freedesktop.org/patch/msgid/20221202001803.1765805-1-rs@ti.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/tidss/tidss_dispc.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/tidss/tidss_dispc.c b/drivers/gpu/drm/tidss/tidss_dispc.c +index 60b92df615aa5..f54517698710f 100644 +--- a/drivers/gpu/drm/tidss/tidss_dispc.c ++++ b/drivers/gpu/drm/tidss/tidss_dispc.c +@@ -1855,8 +1855,8 @@ static const struct { + { DRM_FORMAT_XBGR4444, 0x21, }, + { DRM_FORMAT_RGBX4444, 0x22, }, + +- { DRM_FORMAT_ARGB1555, 0x25, }, +- { DRM_FORMAT_ABGR1555, 0x26, }, ++ { DRM_FORMAT_XRGB1555, 0x25, }, ++ { DRM_FORMAT_XBGR1555, 0x26, }, + + { DRM_FORMAT_XRGB8888, 0x27, }, + { DRM_FORMAT_XBGR8888, 0x28, }, +-- +2.39.2 + diff --git a/queue-5.15/drm-tiny-ili9486-do-not-assume-8-bit-only-spi-contro.patch b/queue-5.15/drm-tiny-ili9486-do-not-assume-8-bit-only-spi-contro.patch new file mode 100644 index 00000000000..21c705a199b --- /dev/null +++ b/queue-5.15/drm-tiny-ili9486-do-not-assume-8-bit-only-spi-contro.patch @@ -0,0 +1,85 @@ +From 3a5cef27c27a334ba5d44d5afb9bd8bfc1794733 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Dec 2022 10:02:38 +0100 +Subject: drm/tiny: ili9486: Do not assume 8-bit only SPI controllers + +From: Carlo Caione + +[ Upstream commit 77772e607522daa61f3af74df018559db75c43d6 ] + +The pixel data for the ILI9486 is always 16-bits wide and it must be +sent over the SPI bus. When the controller is only able to deal with +8-bit transfers, this 16-bits data needs to be swapped before the +sending to account for the big endian bus, this is on the contrary not +needed when the SPI controller already supports 16-bits transfers. + +The decision about swapping the pixel data or not is taken in the MIPI +DBI code by probing the controller capabilities: if the controller only +suppors 8-bit transfers the data is swapped, otherwise it is not. + +This swapping/non-swapping is relying on the assumption that when the +controller does support 16-bit transactions then the data is sent +unswapped in 16-bits-per-word over SPI. + +The problem with the ILI9486 driver is that it is forcing 8-bit +transactions also for controllers supporting 16-bits, violating the +assumption and corrupting the pixel data. + +Align the driver to what is done in the MIPI DBI code by adjusting the +transfer size to the maximum allowed by the SPI controller. + +Reviewed-by: Neil Armstrong +Signed-off-by: Carlo Caione +Reviewed-by: Kamlesh Gurudasani +Signed-off-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/20221116-s905x_spi_ili9486-v4-2-f86b4463b9e4@baylibre.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/tiny/ili9486.c | 13 +++++++++---- + 1 file changed, 9 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/tiny/ili9486.c b/drivers/gpu/drm/tiny/ili9486.c +index e9a63f4b2993c..e159dfb5f7fe5 100644 +--- a/drivers/gpu/drm/tiny/ili9486.c ++++ b/drivers/gpu/drm/tiny/ili9486.c +@@ -43,6 +43,7 @@ static int waveshare_command(struct mipi_dbi *mipi, u8 *cmd, u8 *par, + size_t num) + { + struct spi_device *spi = mipi->spi; ++ unsigned int bpw = 8; + void *data = par; + u32 speed_hz; + int i, ret; +@@ -56,8 +57,6 @@ static int waveshare_command(struct mipi_dbi *mipi, u8 *cmd, u8 *par, + * The displays are Raspberry Pi HATs and connected to the 8-bit only + * SPI controller, so 16-bit command and parameters need byte swapping + * before being transferred as 8-bit on the big endian SPI bus. +- * Pixel data bytes have already been swapped before this function is +- * called. + */ + buf[0] = cpu_to_be16(*cmd); + gpiod_set_value_cansleep(mipi->dc, 0); +@@ -71,12 +70,18 @@ static int waveshare_command(struct mipi_dbi *mipi, u8 *cmd, u8 *par, + for (i = 0; i < num; i++) + buf[i] = cpu_to_be16(par[i]); + num *= 2; +- speed_hz = mipi_dbi_spi_cmd_max_speed(spi, num); + data = buf; + } + ++ /* ++ * Check whether pixel data bytes needs to be swapped or not ++ */ ++ if (*cmd == MIPI_DCS_WRITE_MEMORY_START && !mipi->swap_bytes) ++ bpw = 16; ++ + gpiod_set_value_cansleep(mipi->dc, 1); +- ret = mipi_dbi_spi_transfer(spi, speed_hz, 8, data, num); ++ speed_hz = mipi_dbi_spi_cmd_max_speed(spi, num); ++ ret = mipi_dbi_spi_transfer(spi, speed_hz, bpw, data, num); + free: + kfree(buf); + +-- +2.39.2 + diff --git a/queue-5.15/drm-vc4-dpi-add-option-for-inverting-pixel-clock-and.patch b/queue-5.15/drm-vc4-dpi-add-option-for-inverting-pixel-clock-and.patch new file mode 100644 index 00000000000..38e4340a79e --- /dev/null +++ b/queue-5.15/drm-vc4-dpi-add-option-for-inverting-pixel-clock-and.patch @@ -0,0 +1,104 @@ +From 0be79da87cb0d462469e19699e4310ba0688bb50 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Jun 2022 16:47:36 +0200 +Subject: drm/vc4: dpi: Add option for inverting pixel clock and output enable + +From: Dave Stevenson + +[ Upstream commit 3c2707632146b22e97b0fbf6778bab8add2eaa1d ] + +DRM provides flags for inverting pixel clock and output enable +signals, but these were not mapped to the relevant registers. + +Add those mappings. + +Signed-off-by: Dave Stevenson +Link: https://lore.kernel.org/r/20220613144800.326124-10-maxime@cerno.tech +Signed-off-by: Maxime Ripard +Stable-dep-of: 0870d86eac8a ("drm/vc4: dpi: Fix format mapping for RGB565") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vc4/vc4_dpi.c | 66 ++++++++++++++++++++--------------- + 1 file changed, 38 insertions(+), 28 deletions(-) + +diff --git a/drivers/gpu/drm/vc4/vc4_dpi.c b/drivers/gpu/drm/vc4/vc4_dpi.c +index a90f2545baee0..0e25add2df071 100644 +--- a/drivers/gpu/drm/vc4/vc4_dpi.c ++++ b/drivers/gpu/drm/vc4/vc4_dpi.c +@@ -148,35 +148,45 @@ static void vc4_dpi_encoder_enable(struct drm_encoder *encoder) + } + drm_connector_list_iter_end(&conn_iter); + +- if (connector && connector->display_info.num_bus_formats) { +- u32 bus_format = connector->display_info.bus_formats[0]; +- +- switch (bus_format) { +- case MEDIA_BUS_FMT_RGB888_1X24: +- dpi_c |= VC4_SET_FIELD(DPI_FORMAT_24BIT_888_RGB, +- DPI_FORMAT); +- break; +- case MEDIA_BUS_FMT_BGR888_1X24: +- dpi_c |= VC4_SET_FIELD(DPI_FORMAT_24BIT_888_RGB, +- DPI_FORMAT); +- dpi_c |= VC4_SET_FIELD(DPI_ORDER_BGR, DPI_ORDER); +- break; +- case MEDIA_BUS_FMT_RGB666_1X24_CPADHI: +- dpi_c |= VC4_SET_FIELD(DPI_FORMAT_18BIT_666_RGB_2, +- DPI_FORMAT); +- break; +- case MEDIA_BUS_FMT_RGB666_1X18: +- dpi_c |= VC4_SET_FIELD(DPI_FORMAT_18BIT_666_RGB_1, +- DPI_FORMAT); +- break; +- case MEDIA_BUS_FMT_RGB565_1X16: +- dpi_c |= VC4_SET_FIELD(DPI_FORMAT_16BIT_565_RGB_3, +- DPI_FORMAT); +- break; +- default: +- DRM_ERROR("Unknown media bus format %d\n", bus_format); +- break; ++ if (connector) { ++ if (connector->display_info.num_bus_formats) { ++ u32 bus_format = connector->display_info.bus_formats[0]; ++ ++ switch (bus_format) { ++ case MEDIA_BUS_FMT_RGB888_1X24: ++ dpi_c |= VC4_SET_FIELD(DPI_FORMAT_24BIT_888_RGB, ++ DPI_FORMAT); ++ break; ++ case MEDIA_BUS_FMT_BGR888_1X24: ++ dpi_c |= VC4_SET_FIELD(DPI_FORMAT_24BIT_888_RGB, ++ DPI_FORMAT); ++ dpi_c |= VC4_SET_FIELD(DPI_ORDER_BGR, ++ DPI_ORDER); ++ break; ++ case MEDIA_BUS_FMT_RGB666_1X24_CPADHI: ++ dpi_c |= VC4_SET_FIELD(DPI_FORMAT_18BIT_666_RGB_2, ++ DPI_FORMAT); ++ break; ++ case MEDIA_BUS_FMT_RGB666_1X18: ++ dpi_c |= VC4_SET_FIELD(DPI_FORMAT_18BIT_666_RGB_1, ++ DPI_FORMAT); ++ break; ++ case MEDIA_BUS_FMT_RGB565_1X16: ++ dpi_c |= VC4_SET_FIELD(DPI_FORMAT_16BIT_565_RGB_3, ++ DPI_FORMAT); ++ break; ++ default: ++ DRM_ERROR("Unknown media bus format %d\n", ++ bus_format); ++ break; ++ } + } ++ ++ if (connector->display_info.bus_flags & DRM_BUS_FLAG_PIXDATA_DRIVE_NEGEDGE) ++ dpi_c |= DPI_PIXEL_CLK_INVERT; ++ ++ if (connector->display_info.bus_flags & DRM_BUS_FLAG_DE_LOW) ++ dpi_c |= DPI_OUTPUT_ENABLE_INVERT; + } else { + /* Default to 24bit if no connector found. */ + dpi_c |= VC4_SET_FIELD(DPI_FORMAT_24BIT_888_RGB, DPI_FORMAT); +-- +2.39.2 + diff --git a/queue-5.15/drm-vc4-dpi-fix-format-mapping-for-rgb565.patch b/queue-5.15/drm-vc4-dpi-fix-format-mapping-for-rgb565.patch new file mode 100644 index 00000000000..fb9847dcdf3 --- /dev/null +++ b/queue-5.15/drm-vc4-dpi-fix-format-mapping-for-rgb565.patch @@ -0,0 +1,38 @@ +From d23a1383cd60ca093b730d9310c1ea57494a25b6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Dec 2022 09:42:52 +0100 +Subject: drm/vc4: dpi: Fix format mapping for RGB565 + +From: Dave Stevenson + +[ Upstream commit 0870d86eac8a9abd89a0be1b719d5dc5bac936f0 ] + +The mapping is incorrect for RGB565_1X16 as it should be +DPI_FORMAT_18BIT_666_RGB_1 instead of DPI_FORMAT_18BIT_666_RGB_3. + +Fixes: 08302c35b59d ("drm/vc4: Add DPI driver") +Signed-off-by: Dave Stevenson +Reviewed-by: Laurent Pinchart +Link: https://lore.kernel.org/r/20221013-rpi-dpi-improvements-v3-7-eb76e26a772d@cerno.tech +Signed-off-by: Maxime Ripard +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vc4/vc4_dpi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/vc4/vc4_dpi.c b/drivers/gpu/drm/vc4/vc4_dpi.c +index 0e25add2df071..9c8a71d7426a0 100644 +--- a/drivers/gpu/drm/vc4/vc4_dpi.c ++++ b/drivers/gpu/drm/vc4/vc4_dpi.c +@@ -172,7 +172,7 @@ static void vc4_dpi_encoder_enable(struct drm_encoder *encoder) + DPI_FORMAT); + break; + case MEDIA_BUS_FMT_RGB565_1X16: +- dpi_c |= VC4_SET_FIELD(DPI_FORMAT_16BIT_565_RGB_3, ++ dpi_c |= VC4_SET_FIELD(DPI_FORMAT_16BIT_565_RGB_1, + DPI_FORMAT); + break; + default: +-- +2.39.2 + diff --git a/queue-5.15/drm-vc4-hdmi-correct-interlaced-timings-again.patch b/queue-5.15/drm-vc4-hdmi-correct-interlaced-timings-again.patch new file mode 100644 index 00000000000..c59b93e80df --- /dev/null +++ b/queue-5.15/drm-vc4-hdmi-correct-interlaced-timings-again.patch @@ -0,0 +1,44 @@ +From deeb3964829a565ce223565e3538eb5447747b8e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Dec 2022 12:53:25 +0100 +Subject: drm/vc4: hdmi: Correct interlaced timings again + +From: Dave Stevenson + +[ Upstream commit 771d6539f27bd55f43d8a95d53a7eeaaffa2681c ] + +The back porch timings were correct, only the sync offset was wrong. +Correct timing is now reported for 1080i and 576i, but the h offset is +incorrect for 480i for non-obvious reasons. + +Fixes: fb10dc451c0f ("drm/vc4: hdmi: Correct HDMI timing registers for interlaced modes") +Signed-off-by: Dave Stevenson +Link: https://lore.kernel.org/r/20221207-rpi-hvs-crtc-misc-v1-14-1f8e0770798b@cerno.tech +Signed-off-by: Maxime Ripard +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vc4/vc4_hdmi.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/vc4/vc4_hdmi.c b/drivers/gpu/drm/vc4/vc4_hdmi.c +index 665f772f9ffc4..7a8353d7ab36a 100644 +--- a/drivers/gpu/drm/vc4/vc4_hdmi.c ++++ b/drivers/gpu/drm/vc4/vc4_hdmi.c +@@ -785,11 +785,12 @@ static void vc5_hdmi_set_timings(struct vc4_hdmi *vc4_hdmi, + VC4_SET_FIELD(mode->crtc_vdisplay, VC5_HDMI_VERTA_VAL)); + u32 vertb = (VC4_SET_FIELD(mode->htotal >> (2 - pixel_rep), + VC5_HDMI_VERTB_VSPO) | +- VC4_SET_FIELD(mode->crtc_vtotal - mode->crtc_vsync_end, ++ VC4_SET_FIELD(mode->crtc_vtotal - mode->crtc_vsync_end + ++ interlaced, + VC4_HDMI_VERTB_VBP)); + u32 vertb_even = (VC4_SET_FIELD(0, VC5_HDMI_VERTB_VSPO) | + VC4_SET_FIELD(mode->crtc_vtotal - +- mode->crtc_vsync_end - interlaced, ++ mode->crtc_vsync_end, + VC4_HDMI_VERTB_VBP)); + unsigned char gcp; + bool gcp_en; +-- +2.39.2 + diff --git a/queue-5.15/drm-vc4-hvs-fix-colour-order-for-xrgb1555-on-hvs5.patch b/queue-5.15/drm-vc4-hvs-fix-colour-order-for-xrgb1555-on-hvs5.patch new file mode 100644 index 00000000000..59bbdbfce5f --- /dev/null +++ b/queue-5.15/drm-vc4-hvs-fix-colour-order-for-xrgb1555-on-hvs5.patch @@ -0,0 +1,43 @@ +From b5fa86f6886052bd626ac8bb90e7c5e87672de41 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Dec 2022 12:53:17 +0100 +Subject: drm/vc4: hvs: Fix colour order for xRGB1555 on HVS5 + +From: Dave Stevenson + +[ Upstream commit 902973dc1a049c0d7bf0c222b8f2b3876f01b4a2 ] + +Same as the xRGB8888 formats, HVS5 has managed to swap the colour +channels for the xRGB1555 formats as well. Add the relevant +config for pixel_order_hvs5. + +Fixes: c54619b0bfb3 ("drm/vc4: Add support for the BCM2711 HVS5") +Signed-off-by: Dave Stevenson +Link: https://lore.kernel.org/r/20221207-rpi-hvs-crtc-misc-v1-6-1f8e0770798b@cerno.tech +Signed-off-by: Maxime Ripard +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vc4/vc4_plane.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/vc4/vc4_plane.c b/drivers/gpu/drm/vc4/vc4_plane.c +index 8574acefd40e7..4404059810d0a 100644 +--- a/drivers/gpu/drm/vc4/vc4_plane.c ++++ b/drivers/gpu/drm/vc4/vc4_plane.c +@@ -72,11 +72,13 @@ static const struct hvs_format { + .drm = DRM_FORMAT_ARGB1555, + .hvs = HVS_PIXEL_FORMAT_RGBA5551, + .pixel_order = HVS_PIXEL_ORDER_ABGR, ++ .pixel_order_hvs5 = HVS_PIXEL_ORDER_ARGB, + }, + { + .drm = DRM_FORMAT_XRGB1555, + .hvs = HVS_PIXEL_FORMAT_RGBA5551, + .pixel_order = HVS_PIXEL_ORDER_ABGR, ++ .pixel_order_hvs5 = HVS_PIXEL_ORDER_ARGB, + }, + { + .drm = DRM_FORMAT_RGB888, +-- +2.39.2 + diff --git a/queue-5.15/drm-vc4-hvs-set-axi-panic-modes.patch b/queue-5.15/drm-vc4-hvs-set-axi-panic-modes.patch new file mode 100644 index 00000000000..ee4abb19fbd --- /dev/null +++ b/queue-5.15/drm-vc4-hvs-set-axi-panic-modes.patch @@ -0,0 +1,70 @@ +From 0ff5b14005c54c025b77943b383134c326bc3cbc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Dec 2022 12:53:13 +0100 +Subject: drm/vc4: hvs: Set AXI panic modes + +From: Dave Stevenson + +[ Upstream commit df993fced230daa8452892406f3180c93ebf7e7b ] + +The HVS can change AXI request mode based on how full the COB +FIFOs are. +Until now the vc4 driver has been relying on the firmware to +have set these to sensible values. + +With HVS channel 2 now being used for live video, change the +panic mode for all channels to be explicitly set by the driver, +and the same for all channels. + +Fixes: c54619b0bfb3 ("drm/vc4: Add support for the BCM2711 HVS5") +Signed-off-by: Dave Stevenson +Link: https://lore.kernel.org/r/20221207-rpi-hvs-crtc-misc-v1-2-1f8e0770798b@cerno.tech +Signed-off-by: Maxime Ripard +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vc4/vc4_hvs.c | 11 +++++++++++ + drivers/gpu/drm/vc4/vc4_regs.h | 6 ++++++ + 2 files changed, 17 insertions(+) + +diff --git a/drivers/gpu/drm/vc4/vc4_hvs.c b/drivers/gpu/drm/vc4/vc4_hvs.c +index 9d88bfb50c9b0..3856ac289d380 100644 +--- a/drivers/gpu/drm/vc4/vc4_hvs.c ++++ b/drivers/gpu/drm/vc4/vc4_hvs.c +@@ -718,6 +718,17 @@ static int vc4_hvs_bind(struct device *dev, struct device *master, void *data) + SCALER_DISPCTRL_DSPEISLUR(2) | + SCALER_DISPCTRL_SCLEIRQ); + ++ /* Set AXI panic mode. ++ * VC4 panics when < 2 lines in FIFO. ++ * VC5 panics when less than 1 line in the FIFO. ++ */ ++ dispctrl &= ~(SCALER_DISPCTRL_PANIC0_MASK | ++ SCALER_DISPCTRL_PANIC1_MASK | ++ SCALER_DISPCTRL_PANIC2_MASK); ++ dispctrl |= VC4_SET_FIELD(2, SCALER_DISPCTRL_PANIC0); ++ dispctrl |= VC4_SET_FIELD(2, SCALER_DISPCTRL_PANIC1); ++ dispctrl |= VC4_SET_FIELD(2, SCALER_DISPCTRL_PANIC2); ++ + HVS_WRITE(SCALER_DISPCTRL, dispctrl); + + ret = devm_request_irq(dev, platform_get_irq(pdev, 0), +diff --git a/drivers/gpu/drm/vc4/vc4_regs.h b/drivers/gpu/drm/vc4/vc4_regs.h +index 8ac2f088106a6..fe6d0e21ddd8d 100644 +--- a/drivers/gpu/drm/vc4/vc4_regs.h ++++ b/drivers/gpu/drm/vc4/vc4_regs.h +@@ -220,6 +220,12 @@ + #define SCALER_DISPCTRL 0x00000000 + /* Global register for clock gating the HVS */ + # define SCALER_DISPCTRL_ENABLE BIT(31) ++# define SCALER_DISPCTRL_PANIC0_MASK VC4_MASK(25, 24) ++# define SCALER_DISPCTRL_PANIC0_SHIFT 24 ++# define SCALER_DISPCTRL_PANIC1_MASK VC4_MASK(27, 26) ++# define SCALER_DISPCTRL_PANIC1_SHIFT 26 ++# define SCALER_DISPCTRL_PANIC2_MASK VC4_MASK(29, 28) ++# define SCALER_DISPCTRL_PANIC2_SHIFT 28 + # define SCALER_DISPCTRL_DSP3_MUX_MASK VC4_MASK(19, 18) + # define SCALER_DISPCTRL_DSP3_MUX_SHIFT 18 + +-- +2.39.2 + diff --git a/queue-5.15/drm-vkms-fix-memory-leak-in-vkms_init.patch b/queue-5.15/drm-vkms-fix-memory-leak-in-vkms_init.patch new file mode 100644 index 00000000000..1f32d1f706e --- /dev/null +++ b/queue-5.15/drm-vkms-fix-memory-leak-in-vkms_init.patch @@ -0,0 +1,75 @@ +From 6c1122aa116c53285ab5281b43333fdfb5044df0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Nov 2022 06:51:55 +0000 +Subject: drm/vkms: Fix memory leak in vkms_init() + +From: Yuan Can + +[ Upstream commit 0d0b368b9d104b437e1f4850ae94bdb9a3601e89 ] + +A memory leak was reported after the vkms module install failed. + +unreferenced object 0xffff88810bc28520 (size 16): + comm "modprobe", pid 9662, jiffies 4298009455 (age 42.590s) + hex dump (first 16 bytes): + 01 01 00 64 81 88 ff ff 00 00 dc 0a 81 88 ff ff ...d............ + backtrace: + [<00000000e7561ff8>] kmalloc_trace+0x27/0x60 + [<000000000b1954a0>] 0xffffffffc45200a9 + [<00000000abbf1da0>] do_one_initcall+0xd0/0x4f0 + [<000000001505ee87>] do_init_module+0x1a4/0x680 + [<00000000958079ad>] load_module+0x6249/0x7110 + [<00000000117e4696>] __do_sys_finit_module+0x140/0x200 + [<00000000f74b12d2>] do_syscall_64+0x35/0x80 + [<000000008fc6fcde>] entry_SYSCALL_64_after_hwframe+0x46/0xb0 + +The reason is that the vkms_init() returns without checking the return +value of vkms_create(), and if the vkms_create() failed, the config +allocated at the beginning of vkms_init() is leaked. + + vkms_init() + config = kmalloc(...) # config allocated + ... + return vkms_create() # vkms_create failed and config is leaked + +Fix this problem by checking return value of vkms_create() and free the +config if error happened. + +Fixes: 2df7af93fdad ("drm/vkms: Add vkms_config type") +Signed-off-by: Yuan Can +Reviewed-by: Melissa Wen +Signed-off-by: Melissa Wen +Link: https://patchwork.freedesktop.org/patch/msgid/20221101065156.41584-2-yuancan@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vkms/vkms_drv.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/vkms/vkms_drv.c b/drivers/gpu/drm/vkms/vkms_drv.c +index 0ffe5f0e33f75..dfe983eaa07ff 100644 +--- a/drivers/gpu/drm/vkms/vkms_drv.c ++++ b/drivers/gpu/drm/vkms/vkms_drv.c +@@ -218,6 +218,7 @@ static int vkms_create(struct vkms_config *config) + + static int __init vkms_init(void) + { ++ int ret; + struct vkms_config *config; + + config = kmalloc(sizeof(*config), GFP_KERNEL); +@@ -230,7 +231,11 @@ static int __init vkms_init(void) + config->writeback = enable_writeback; + config->overlay = enable_overlay; + +- return vkms_create(config); ++ ret = vkms_create(config); ++ if (ret) ++ kfree(config); ++ ++ return ret; + } + + static void vkms_destroy(struct vkms_config *config) +-- +2.39.2 + diff --git a/queue-5.15/drm-vkms-fix-null-ptr-deref-in-vkms_release.patch b/queue-5.15/drm-vkms-fix-null-ptr-deref-in-vkms_release.patch new file mode 100644 index 00000000000..3245e8ca158 --- /dev/null +++ b/queue-5.15/drm-vkms-fix-null-ptr-deref-in-vkms_release.patch @@ -0,0 +1,79 @@ +From 2c00a62b4b040a52adb37cd1bf3a8e35259041c0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Nov 2022 06:51:56 +0000 +Subject: drm/vkms: Fix null-ptr-deref in vkms_release() + +From: Yuan Can + +[ Upstream commit 2fe2a8f40c21161ffe7653cc234e7934db5b7cc5 ] + +A null-ptr-deref is triggered when it tries to destroy the workqueue in +vkms->output.composer_workq in vkms_release(). + + KASAN: null-ptr-deref in range [0x0000000000000118-0x000000000000011f] + CPU: 5 PID: 17193 Comm: modprobe Not tainted 6.0.0-11331-gd465bff130bf #24 + RIP: 0010:destroy_workqueue+0x2f/0x710 + ... + Call Trace: + + ? vkms_config_debugfs_init+0x50/0x50 [vkms] + __devm_drm_dev_alloc+0x15a/0x1c0 [drm] + vkms_init+0x245/0x1000 [vkms] + do_one_initcall+0xd0/0x4f0 + do_init_module+0x1a4/0x680 + load_module+0x6249/0x7110 + __do_sys_finit_module+0x140/0x200 + do_syscall_64+0x35/0x80 + entry_SYSCALL_64_after_hwframe+0x46/0xb0 + +The reason is that an OOM happened which triggers the destroy of the +workqueue, however, the workqueue is alloced in the later process, +thus a null-ptr-deref happened. A simple call graph is shown as below: + + vkms_init() + vkms_create() + devm_drm_dev_alloc() + __devm_drm_dev_alloc() + devm_drm_dev_init() + devm_add_action_or_reset() + devm_add_action() # an error happened + devm_drm_dev_init_release() + drm_dev_put() + kref_put() + drm_dev_release() + vkms_release() + destroy_workqueue() # null-ptr-deref happened + vkms_modeset_init() + vkms_output_init() + vkms_crtc_init() # where the workqueue get allocated + +Fix this by checking if composer_workq is NULL before passing it to +the destroy_workqueue() in vkms_release(). + +Fixes: 6c234fe37c57 ("drm/vkms: Implement CRC debugfs API") +Signed-off-by: Yuan Can +Reviewed-by: Melissa Wen +Signed-off-by: Melissa Wen +Link: https://patchwork.freedesktop.org/patch/msgid/20221101065156.41584-3-yuancan@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vkms/vkms_drv.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/vkms/vkms_drv.c b/drivers/gpu/drm/vkms/vkms_drv.c +index dfe983eaa07ff..f716c5796f5fc 100644 +--- a/drivers/gpu/drm/vkms/vkms_drv.c ++++ b/drivers/gpu/drm/vkms/vkms_drv.c +@@ -57,7 +57,8 @@ static void vkms_release(struct drm_device *dev) + { + struct vkms_device *vkms = drm_device_to_vkms_device(dev); + +- destroy_workqueue(vkms->output.composer_workq); ++ if (vkms->output.composer_workq) ++ destroy_workqueue(vkms->output.composer_workq); + } + + static void vkms_atomic_commit_tail(struct drm_atomic_state *old_state) +-- +2.39.2 + diff --git a/queue-5.15/eeprom-idt_89hpesx-fix-error-handling-in-idt_init.patch b/queue-5.15/eeprom-idt_89hpesx-fix-error-handling-in-idt_init.patch new file mode 100644 index 00000000000..53268bcaefc --- /dev/null +++ b/queue-5.15/eeprom-idt_89hpesx-fix-error-handling-in-idt_init.patch @@ -0,0 +1,68 @@ +From 68a8996000496bfbc0ad4900de8e90929cf18308 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Nov 2022 02:00:30 +0000 +Subject: eeprom: idt_89hpesx: Fix error handling in idt_init() + +From: Yuan Can + +[ Upstream commit d717a3ab282f51ec45142f911f7ef8a55c057de5 ] + +A problem about idt_89hpesx create debugfs failed is triggered with the +following log given: + + [ 4973.269647] debugfs: Directory 'idt_csr' with parent '/' already present! + +The reason is that idt_init() returns i2c_add_driver() directly without +checking its return value, if i2c_add_driver() failed, it returns without +destroy the newly created debugfs, resulting the debugfs of idt_csr can +never be created later. + + idt_init() + debugfs_create_dir() # create debugfs directory + i2c_add_driver() + driver_register() + bus_add_driver() + priv = kzalloc(...) # OOM happened + # return without destroy debugfs directory + +Fix by removing debugfs when i2c_add_driver() returns error. + +Fixes: cfad6425382e ("eeprom: Add IDT 89HPESx EEPROM/CSR driver") +Signed-off-by: Yuan Can +Acked-by: Serge Semin +Link: https://lore.kernel.org/r/20221110020030.47711-1-yuancan@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/misc/eeprom/idt_89hpesx.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/drivers/misc/eeprom/idt_89hpesx.c b/drivers/misc/eeprom/idt_89hpesx.c +index 7f430742ce2b8..5298be4cc14c1 100644 +--- a/drivers/misc/eeprom/idt_89hpesx.c ++++ b/drivers/misc/eeprom/idt_89hpesx.c +@@ -1568,12 +1568,20 @@ static struct i2c_driver idt_driver = { + */ + static int __init idt_init(void) + { ++ int ret; ++ + /* Create Debugfs directory first */ + if (debugfs_initialized()) + csr_dbgdir = debugfs_create_dir("idt_csr", NULL); + + /* Add new i2c-device driver */ +- return i2c_add_driver(&idt_driver); ++ ret = i2c_add_driver(&idt_driver); ++ if (ret) { ++ debugfs_remove_recursive(csr_dbgdir); ++ return ret; ++ } ++ ++ return 0; + } + module_init(idt_init); + +-- +2.39.2 + diff --git a/queue-5.15/firmware-dmi-sysfs-fix-null-ptr-deref-in-dmi_sysfs_r.patch b/queue-5.15/firmware-dmi-sysfs-fix-null-ptr-deref-in-dmi_sysfs_r.patch new file mode 100644 index 00000000000..8c05fe6f844 --- /dev/null +++ b/queue-5.15/firmware-dmi-sysfs-fix-null-ptr-deref-in-dmi_sysfs_r.patch @@ -0,0 +1,75 @@ +From 4a2c0bdf6f1e6ae6381d5f8424a35add4ddb0cc5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Nov 2022 09:53:26 +0800 +Subject: firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle + +From: Chen Zhongjin + +[ Upstream commit 18e126e97c961f7a93823795c879d7c085fe5098 ] + +KASAN reported a null-ptr-deref error: + +KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] +CPU: 0 PID: 1373 Comm: modprobe +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) +RIP: 0010:dmi_sysfs_entry_release +... +Call Trace: + + kobject_put + dmi_sysfs_register_handle (drivers/firmware/dmi-sysfs.c:540) dmi_sysfs + dmi_decode_table (drivers/firmware/dmi_scan.c:133) + dmi_walk (drivers/firmware/dmi_scan.c:1115) + dmi_sysfs_init (drivers/firmware/dmi-sysfs.c:149) dmi_sysfs + do_one_initcall (init/main.c:1296) + ... +Kernel panic - not syncing: Fatal exception +Kernel Offset: 0x4000000 from 0xffffffff81000000 +---[ end Kernel panic - not syncing: Fatal exception ]--- + +It is because previous patch added kobject_put() to release the memory +which will call dmi_sysfs_entry_release() and list_del(). + +However, list_add_tail(entry->list) is called after the error block, +so the list_head is uninitialized and cannot be deleted. + +Move error handling to after list_add_tail to fix this. + +Fixes: 660ba678f999 ("firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle") +Signed-off-by: Chen Zhongjin +Link: https://lore.kernel.org/r/20221111015326.251650-2-chenzhongjin@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/firmware/dmi-sysfs.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/firmware/dmi-sysfs.c b/drivers/firmware/dmi-sysfs.c +index 4a93fb490cb46..3d57b08320df9 100644 +--- a/drivers/firmware/dmi-sysfs.c ++++ b/drivers/firmware/dmi-sysfs.c +@@ -602,16 +602,16 @@ static void __init dmi_sysfs_register_handle(const struct dmi_header *dh, + *ret = kobject_init_and_add(&entry->kobj, &dmi_sysfs_entry_ktype, NULL, + "%d-%d", dh->type, entry->instance); + +- if (*ret) { +- kobject_put(&entry->kobj); +- return; +- } +- + /* Thread on the global list for cleanup */ + spin_lock(&entry_list_lock); + list_add_tail(&entry->list, &entry_list); + spin_unlock(&entry_list_lock); + ++ if (*ret) { ++ kobject_put(&entry->kobj); ++ return; ++ } ++ + /* Handle specializations by type */ + switch (dh->type) { + case DMI_ENTRY_SYSTEM_EVENT_LOG: +-- +2.39.2 + diff --git a/queue-5.15/firmware-stratix10-svc-add-missing-gen_pool_destroy-.patch b/queue-5.15/firmware-stratix10-svc-add-missing-gen_pool_destroy-.patch new file mode 100644 index 00000000000..0e653b11fb7 --- /dev/null +++ b/queue-5.15/firmware-stratix10-svc-add-missing-gen_pool_destroy-.patch @@ -0,0 +1,70 @@ +From ceb2c8916063ce25ee4d2d1674dd56a3fe388bd3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Nov 2022 10:36:01 -0600 +Subject: firmware: stratix10-svc: add missing gen_pool_destroy() in + stratix10_svc_drv_probe() + +From: Yang Yingliang + +[ Upstream commit 9175ee1a99d57ec07d66ff572e1d5a724477ab37 ] + +In error path in stratix10_svc_drv_probe(), gen_pool_destroy() should be called +to destroy the memory pool that created by svc_create_memory_pool(). + +Fixes: 7ca5ce896524 ("firmware: add Intel Stratix10 service layer driver") +Signed-off-by: Yang Yingliang +Signed-off-by: Dinh Nguyen +Link: https://lore.kernel.org/r/20221129163602.462369-1-dinguyen@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/firmware/stratix10-svc.c | 16 +++++++++++----- + 1 file changed, 11 insertions(+), 5 deletions(-) + +diff --git a/drivers/firmware/stratix10-svc.c b/drivers/firmware/stratix10-svc.c +index 7dd0ac1a0cfc7..4fdd75f1e86ea 100644 +--- a/drivers/firmware/stratix10-svc.c ++++ b/drivers/firmware/stratix10-svc.c +@@ -994,13 +994,17 @@ static int stratix10_svc_drv_probe(struct platform_device *pdev) + + /* allocate service controller and supporting channel */ + controller = devm_kzalloc(dev, sizeof(*controller), GFP_KERNEL); +- if (!controller) +- return -ENOMEM; ++ if (!controller) { ++ ret = -ENOMEM; ++ goto err_destroy_pool; ++ } + + chans = devm_kmalloc_array(dev, SVC_NUM_CHANNEL, + sizeof(*chans), GFP_KERNEL | __GFP_ZERO); +- if (!chans) +- return -ENOMEM; ++ if (!chans) { ++ ret = -ENOMEM; ++ goto err_destroy_pool; ++ } + + controller->dev = dev; + controller->num_chans = SVC_NUM_CHANNEL; +@@ -1015,7 +1019,7 @@ static int stratix10_svc_drv_probe(struct platform_device *pdev) + ret = kfifo_alloc(&controller->svc_fifo, fifo_size, GFP_KERNEL); + if (ret) { + dev_err(dev, "failed to allocate FIFO\n"); +- return ret; ++ goto err_destroy_pool; + } + spin_lock_init(&controller->svc_fifo_lock); + +@@ -1060,6 +1064,8 @@ static int stratix10_svc_drv_probe(struct platform_device *pdev) + platform_device_put(svc->stratix10_svc_rsu); + err_free_kfifo: + kfifo_free(&controller->svc_fifo); ++err_destroy_pool: ++ gen_pool_destroy(genpool); + return ret; + } + +-- +2.39.2 + diff --git a/queue-5.15/fotg210-udc-add-missing-completion-handler.patch b/queue-5.15/fotg210-udc-add-missing-completion-handler.patch new file mode 100644 index 00000000000..c8247273eeb --- /dev/null +++ b/queue-5.15/fotg210-udc-add-missing-completion-handler.patch @@ -0,0 +1,59 @@ +From 067dd3f8709c37ff5564a45ec18a4e4ded2f9b56 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 23 Jan 2023 08:35:06 +0100 +Subject: fotg210-udc: Add missing completion handler + +From: Fabian Vogt + +[ Upstream commit e55f67391fa986f7357edba0ca59e668d99c3a5f ] + +This is used when responding to GET_STATUS requests. Without this, it +crashes on completion. + +Fixes: b84a8dee23fd ("usb: gadget: add Faraday fotg210_udc driver") +Signed-off-by: Fabian Vogt +Signed-off-by: Linus Walleij +Link: https://lore.kernel.org/r/20230123073508.2350402-2-linus.walleij@linaro.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/fotg210-udc.c | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +diff --git a/drivers/usb/gadget/udc/fotg210-udc.c b/drivers/usb/gadget/udc/fotg210-udc.c +index d0e051beb3af9..6f7ade156437a 100644 +--- a/drivers/usb/gadget/udc/fotg210-udc.c ++++ b/drivers/usb/gadget/udc/fotg210-udc.c +@@ -706,6 +706,20 @@ static int fotg210_is_epnstall(struct fotg210_ep *ep) + return value & INOUTEPMPSR_STL_EP ? 1 : 0; + } + ++/* For EP0 requests triggered by this driver (currently GET_STATUS response) */ ++static void fotg210_ep0_complete(struct usb_ep *_ep, struct usb_request *req) ++{ ++ struct fotg210_ep *ep; ++ struct fotg210_udc *fotg210; ++ ++ ep = container_of(_ep, struct fotg210_ep, ep); ++ fotg210 = ep->fotg210; ++ ++ if (req->status || req->actual != req->length) { ++ dev_warn(&fotg210->gadget.dev, "EP0 request failed: %d\n", req->status); ++ } ++} ++ + static void fotg210_get_status(struct fotg210_udc *fotg210, + struct usb_ctrlrequest *ctrl) + { +@@ -1172,6 +1186,8 @@ static int fotg210_udc_probe(struct platform_device *pdev) + if (fotg210->ep0_req == NULL) + goto err_map; + ++ fotg210->ep0_req->complete = fotg210_ep0_complete; ++ + fotg210_init(fotg210); + + fotg210_disable_unplug(fotg210); +-- +2.39.2 + diff --git a/queue-5.15/genirq-fix-the-return-type-of-kstat_cpu_irqs_sum.patch b/queue-5.15/genirq-fix-the-return-type-of-kstat_cpu_irqs_sum.patch new file mode 100644 index 00000000000..722ba855d74 --- /dev/null +++ b/queue-5.15/genirq-fix-the-return-type-of-kstat_cpu_irqs_sum.patch @@ -0,0 +1,44 @@ +From 20177224cf627fe5e93b714cfe0c45a2b462e598 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 19 Nov 2022 17:25:03 +0800 +Subject: genirq: Fix the return type of kstat_cpu_irqs_sum() + +From: Zhen Lei + +[ Upstream commit 47904aed898a08f028572b9b5a5cc101ddfb2d82 ] + +The type of member ->irqs_sum is unsigned long, but kstat_cpu_irqs_sum() +returns int, which can result in truncation. Therefore, change the +kstat_cpu_irqs_sum() function's return value to unsigned long to avoid +truncation. + +Fixes: f2c66cd8eedd ("/proc/stat: scalability of irq num per cpu") +Reported-by: Elliott, Robert (Servers) +Signed-off-by: Zhen Lei +Cc: Tejun Heo +Cc: "Peter Zijlstra (Intel)" +Cc: Josh Don +Cc: Andrew Morton +Reviewed-by: Frederic Weisbecker +Signed-off-by: Paul E. McKenney +Signed-off-by: Sasha Levin +--- + include/linux/kernel_stat.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/linux/kernel_stat.h b/include/linux/kernel_stat.h +index 69ae6b2784645..f9460fbea0a81 100644 +--- a/include/linux/kernel_stat.h ++++ b/include/linux/kernel_stat.h +@@ -72,7 +72,7 @@ extern unsigned int kstat_irqs_usr(unsigned int irq); + /* + * Number of interrupts per cpu, since bootup + */ +-static inline unsigned int kstat_cpu_irqs_sum(unsigned int cpu) ++static inline unsigned long kstat_cpu_irqs_sum(unsigned int cpu) + { + return kstat_cpu(cpu).irqs_sum; + } +-- +2.39.2 + diff --git a/queue-5.15/gfs2-improve-gfs2_make_fs_rw-error-handling.patch b/queue-5.15/gfs2-improve-gfs2_make_fs_rw-error-handling.patch new file mode 100644 index 00000000000..1db5a34d2f8 --- /dev/null +++ b/queue-5.15/gfs2-improve-gfs2_make_fs_rw-error-handling.patch @@ -0,0 +1,55 @@ +From c52ca5925d79e32a40926854835f6aefe86465d4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 Jan 2023 15:06:53 +0100 +Subject: gfs2: Improve gfs2_make_fs_rw error handling + +From: Andreas Gruenbacher + +[ Upstream commit b66f723bb552ad59c2acb5d45ea45c890f84498b ] + +In gfs2_make_fs_rw(), make sure to call gfs2_consist() to report an +inconsistency and mark the filesystem as withdrawn when +gfs2_find_jhead() fails. + +At the end of gfs2_make_fs_rw(), when we discover that the filesystem +has been withdrawn, make sure we report an error. This also replaces +the gfs2_withdrawn() check after gfs2_find_jhead(). + +Reported-by: Tetsuo Handa +Cc: syzbot+f51cb4b9afbd87ec06f2@syzkaller.appspotmail.com +Signed-off-by: Andreas Gruenbacher +Signed-off-by: Sasha Levin +--- + fs/gfs2/super.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/fs/gfs2/super.c b/fs/gfs2/super.c +index d615974ce4183..775ac3fb10c67 100644 +--- a/fs/gfs2/super.c ++++ b/fs/gfs2/super.c +@@ -138,8 +138,10 @@ int gfs2_make_fs_rw(struct gfs2_sbd *sdp) + return -EIO; + + error = gfs2_find_jhead(sdp->sd_jdesc, &head, false); +- if (error || gfs2_withdrawn(sdp)) ++ if (error) { ++ gfs2_consist(sdp); + return error; ++ } + + if (!(head.lh_flags & GFS2_LOG_HEAD_UNMOUNT)) { + gfs2_consist(sdp); +@@ -151,7 +153,9 @@ int gfs2_make_fs_rw(struct gfs2_sbd *sdp) + gfs2_log_pointers_init(sdp, head.lh_blkno); + + error = gfs2_quota_init(sdp); +- if (!error && !gfs2_withdrawn(sdp)) ++ if (!error && gfs2_withdrawn(sdp)) ++ error = -EIO; ++ if (!error) + set_bit(SDF_JOURNAL_LIVE, &sdp->sd_flags); + return error; + } +-- +2.39.2 + diff --git a/queue-5.15/gfs2-jdata-writepage-fix.patch b/queue-5.15/gfs2-jdata-writepage-fix.patch new file mode 100644 index 00000000000..75c8b49c1bd --- /dev/null +++ b/queue-5.15/gfs2-jdata-writepage-fix.patch @@ -0,0 +1,45 @@ +From b9956bc8528fe057fc4b8638f2494efb2e26b166 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Feb 2023 15:08:50 +0100 +Subject: gfs2: jdata writepage fix + +From: Andreas Gruenbacher + +[ Upstream commit cbb60951ce18c9b6e91d2eb97deb41d8ff616622 ] + +The ->writepage() and ->writepages() operations are supposed to write +entire pages. However, on filesystems with a block size smaller than +PAGE_SIZE, __gfs2_jdata_writepage() only adds the first block to the +current transaction instead of adding the entire page. Fix that. + +Fixes: 18ec7d5c3f43 ("[GFS2] Make journaled data files identical to normal files on disk") +Signed-off-by: Andreas Gruenbacher +Signed-off-by: Sasha Levin +--- + fs/gfs2/aops.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/fs/gfs2/aops.c b/fs/gfs2/aops.c +index 4bbfb156e6a40..ee212c9310ad0 100644 +--- a/fs/gfs2/aops.c ++++ b/fs/gfs2/aops.c +@@ -152,7 +152,6 @@ static int __gfs2_jdata_writepage(struct page *page, struct writeback_control *w + { + struct inode *inode = page->mapping->host; + struct gfs2_inode *ip = GFS2_I(inode); +- struct gfs2_sbd *sdp = GFS2_SB(inode); + + if (PageChecked(page)) { + ClearPageChecked(page); +@@ -160,7 +159,7 @@ static int __gfs2_jdata_writepage(struct page *page, struct writeback_control *w + create_empty_buffers(page, inode->i_sb->s_blocksize, + BIT(BH_Dirty)|BIT(BH_Uptodate)); + } +- gfs2_page_add_databufs(ip, page, 0, sdp->sd_vfs->s_blocksize); ++ gfs2_page_add_databufs(ip, page, 0, PAGE_SIZE); + } + return gfs2_write_jdata_page(page, wbc); + } +-- +2.39.2 + diff --git a/queue-5.15/gpio-vf610-connect-gpio-label-to-dev-name.patch b/queue-5.15/gpio-vf610-connect-gpio-label-to-dev-name.patch new file mode 100644 index 00000000000..102e841a3c7 --- /dev/null +++ b/queue-5.15/gpio-vf610-connect-gpio-label-to-dev-name.patch @@ -0,0 +1,38 @@ +From af1e0b5a8e486b20e68f5f2ab2159b541c10fb63 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Dec 2022 17:02:47 +0800 +Subject: gpio: vf610: connect GPIO label to dev name + +From: Haibo Chen + +[ Upstream commit 6f8ecb7f85f441eb7d78ba2a4df45ee8a821934e ] + +Current GPIO label is fixed, so can't distinguish different GPIO +controllers through labels. Use dev name instead. + +Fixes: 7f2691a19627 ("gpio: vf610: add gpiolib/IRQ chip driver for Vybrid") +Signed-off-by: Clark Wang +Signed-off-by: Haibo Chen +Reviewed-by: Linus Walleij +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-vf610.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpio/gpio-vf610.c b/drivers/gpio/gpio-vf610.c +index 47e191e11c696..edb28af7ba3b0 100644 +--- a/drivers/gpio/gpio-vf610.c ++++ b/drivers/gpio/gpio-vf610.c +@@ -304,7 +304,7 @@ static int vf610_gpio_probe(struct platform_device *pdev) + gc = &port->gc; + gc->of_node = np; + gc->parent = dev; +- gc->label = "vf610-gpio"; ++ gc->label = dev_name(dev); + gc->ngpio = VF610_GPIO_PER_PORT; + gc->base = of_alias_get_id(np, "gpio") * VF610_GPIO_PER_PORT; + +-- +2.39.2 + diff --git a/queue-5.15/gpu-host1x-don-t-skip-assigning-syncpoints-to-channe.patch b/queue-5.15/gpu-host1x-don-t-skip-assigning-syncpoints-to-channe.patch new file mode 100644 index 00000000000..7273938e3ff --- /dev/null +++ b/queue-5.15/gpu-host1x-don-t-skip-assigning-syncpoints-to-channe.patch @@ -0,0 +1,40 @@ +From cfcf662027bd91a21eaf13e90e9a33b5ca796f73 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Jan 2023 15:39:00 +0200 +Subject: gpu: host1x: Don't skip assigning syncpoints to channels + +From: Mikko Perttunen + +[ Upstream commit eb258cc1fd458e584082be987dbc6ec42668c05e ] + +The code to write the syncpoint channel assignment register +incorrectly skips the write if hypervisor registers are not available. + +The register, however, is within the guest aperture so remove the +check and assign syncpoints properly even on virtualized systems. + +Fixes: c3f52220f276 ("gpu: host1x: Enable Tegra186 syncpoint protection") +Signed-off-by: Mikko Perttunen +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + drivers/gpu/host1x/hw/syncpt_hw.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/gpu/host1x/hw/syncpt_hw.c b/drivers/gpu/host1x/hw/syncpt_hw.c +index dd39d67ccec36..8cf35b2eff3db 100644 +--- a/drivers/gpu/host1x/hw/syncpt_hw.c ++++ b/drivers/gpu/host1x/hw/syncpt_hw.c +@@ -106,9 +106,6 @@ static void syncpt_assign_to_channel(struct host1x_syncpt *sp, + #if HOST1X_HW >= 6 + struct host1x *host = sp->host; + +- if (!host->hv_regs) +- return; +- + host1x_sync_writel(host, + HOST1X_SYNC_SYNCPT_CH_APP_CH(ch ? ch->id : 0xff), + HOST1X_SYNC_SYNCPT_CH_APP(sp->id)); +-- +2.39.2 + diff --git a/queue-5.15/gpu-ipu-v3-common-add-of_node_put-for-reference-retu.patch b/queue-5.15/gpu-ipu-v3-common-add-of_node_put-for-reference-retu.patch new file mode 100644 index 00000000000..21060335c22 --- /dev/null +++ b/queue-5.15/gpu-ipu-v3-common-add-of_node_put-for-reference-retu.patch @@ -0,0 +1,39 @@ +From dc79caa7e1c2af1ed9fafdf55ca1c91a31e18a43 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Jul 2022 23:22:27 +0800 +Subject: gpu: ipu-v3: common: Add of_node_put() for reference returned by + of_graph_get_port_by_id() + +From: Liang He + +[ Upstream commit 9afdf98cfdfa2ba8ec068cf08c5fcdc1ed8daf3f ] + +In ipu_add_client_devices(), we need to call of_node_put() for +reference returned by of_graph_get_port_by_id() in fail path. + +Fixes: 17e052175039 ("gpu: ipu-v3: Do not bail out on missing optional port nodes") +Signed-off-by: Liang He +Reviewed-by: Philipp Zabel +Link: https://lore.kernel.org/r/20220720152227.1288413-1-windhl@126.com +Signed-off-by: Philipp Zabel +Link: https://patchwork.freedesktop.org/patch/msgid/20220720152227.1288413-1-windhl@126.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/ipu-v3/ipu-common.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/ipu-v3/ipu-common.c b/drivers/gpu/ipu-v3/ipu-common.c +index 118318513e2d2..c35eac1116f5f 100644 +--- a/drivers/gpu/ipu-v3/ipu-common.c ++++ b/drivers/gpu/ipu-v3/ipu-common.c +@@ -1165,6 +1165,7 @@ static int ipu_add_client_devices(struct ipu_soc *ipu, unsigned long ipu_base) + pdev = platform_device_alloc(reg->name, id++); + if (!pdev) { + ret = -ENOMEM; ++ of_node_put(of_node); + goto err_register; + } + +-- +2.39.2 + diff --git a/queue-5.15/hid-add-mapping-for-system-microphone-mute.patch b/queue-5.15/hid-add-mapping-for-system-microphone-mute.patch new file mode 100644 index 00000000000..c30392262d8 --- /dev/null +++ b/queue-5.15/hid-add-mapping-for-system-microphone-mute.patch @@ -0,0 +1,58 @@ +From 0680a87087f1dcef60ca4a9b9f2c4dec741a227a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Dec 2022 22:53:30 +0000 +Subject: HID: Add Mapping for System Microphone Mute + +From: Jingyuan Liang + +[ Upstream commit 2d60f9f4f26785a00273cb81fe60eff129ebd449 ] + +HUTRR110 added a new usage code for a key that is supposed to +mute/unmute microphone system-wide. + +Map the new usage code(0x01 0xa9) to keycode KEY_MICMUTE. +Additionally hid-debug is adjusted to recognize this keycode as well. + +Signed-off-by: Jingyuan Liang +Reviewed-by: Dmitry Torokhov +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-debug.c | 1 + + drivers/hid/hid-input.c | 8 ++++++++ + 2 files changed, 9 insertions(+) + +diff --git a/drivers/hid/hid-debug.c b/drivers/hid/hid-debug.c +index f48d3534e0200..03da865e423c7 100644 +--- a/drivers/hid/hid-debug.c ++++ b/drivers/hid/hid-debug.c +@@ -937,6 +937,7 @@ static const char *keys[KEY_MAX + 1] = { + [KEY_KBD_LAYOUT_NEXT] = "KbdLayoutNext", + [KEY_EMOJI_PICKER] = "EmojiPicker", + [KEY_DICTATE] = "Dictate", ++ [KEY_MICMUTE] = "MicrophoneMute", + [KEY_BRIGHTNESS_MIN] = "BrightnessMin", + [KEY_BRIGHTNESS_MAX] = "BrightnessMax", + [KEY_BRIGHTNESS_AUTO] = "BrightnessAuto", +diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c +index f197aed6444a5..0ae959e54462b 100644 +--- a/drivers/hid/hid-input.c ++++ b/drivers/hid/hid-input.c +@@ -709,6 +709,14 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel + break; + } + ++ if ((usage->hid & 0xf0) == 0xa0) { /* SystemControl */ ++ switch (usage->hid & 0xf) { ++ case 0x9: map_key_clear(KEY_MICMUTE); break; ++ default: goto ignore; ++ } ++ break; ++ } ++ + if ((usage->hid & 0xf0) == 0xb0) { /* SC - Display */ + switch (usage->hid & 0xf) { + case 0x05: map_key_clear(KEY_SWITCHVIDEOMODE); break; +-- +2.39.2 + diff --git a/queue-5.15/hid-bigben-use-spinlock-to-protect-concurrent-access.patch b/queue-5.15/hid-bigben-use-spinlock-to-protect-concurrent-access.patch new file mode 100644 index 00000000000..8347d7f465b --- /dev/null +++ b/queue-5.15/hid-bigben-use-spinlock-to-protect-concurrent-access.patch @@ -0,0 +1,173 @@ +From 2dfe0f020abe14c1217e05ac4aaae4eaa444e09f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 12 Feb 2023 18:59:59 +0000 +Subject: HID: bigben: use spinlock to protect concurrent accesses + +From: Pietro Borrello + +[ Upstream commit 9fefb6201c4f8dd9f58c581b2a66e5cde2895ea2 ] + +bigben driver has a worker that may access data concurrently. +Proct the accesses using a spinlock. + +Fixes: 256a90ed9e46 ("HID: hid-bigbenff: driver for BigBen Interactive PS3OFMINIPAD gamepad") +Signed-off-by: Pietro Borrello +Link: https://lore.kernel.org/r/20230125-hid-unregister-leds-v4-1-7860c5763c38@diag.uniroma1.it +Signed-off-by: Benjamin Tissoires +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-bigbenff.c | 52 ++++++++++++++++++++++++++++++++++++-- + 1 file changed, 50 insertions(+), 2 deletions(-) + +diff --git a/drivers/hid/hid-bigbenff.c b/drivers/hid/hid-bigbenff.c +index e8b16665860d6..ed3d2d7bc1dd4 100644 +--- a/drivers/hid/hid-bigbenff.c ++++ b/drivers/hid/hid-bigbenff.c +@@ -174,6 +174,7 @@ static __u8 pid0902_rdesc_fixed[] = { + struct bigben_device { + struct hid_device *hid; + struct hid_report *report; ++ spinlock_t lock; + bool removed; + u8 led_state; /* LED1 = 1 .. LED4 = 8 */ + u8 right_motor_on; /* right motor off/on 0/1 */ +@@ -190,12 +191,27 @@ static void bigben_worker(struct work_struct *work) + struct bigben_device *bigben = container_of(work, + struct bigben_device, worker); + struct hid_field *report_field = bigben->report->field[0]; ++ bool do_work_led = false; ++ bool do_work_ff = false; ++ u8 *buf; ++ u32 len; ++ unsigned long flags; + + if (bigben->removed || !report_field) + return; + ++ buf = hid_alloc_report_buf(bigben->report, GFP_KERNEL); ++ if (!buf) ++ return; ++ ++ len = hid_report_len(bigben->report); ++ ++ /* LED work */ ++ spin_lock_irqsave(&bigben->lock, flags); ++ + if (bigben->work_led) { + bigben->work_led = false; ++ do_work_led = true; + report_field->value[0] = 0x01; /* 1 = led message */ + report_field->value[1] = 0x08; /* reserved value, always 8 */ + report_field->value[2] = bigben->led_state; +@@ -204,11 +220,22 @@ static void bigben_worker(struct work_struct *work) + report_field->value[5] = 0x00; /* padding */ + report_field->value[6] = 0x00; /* padding */ + report_field->value[7] = 0x00; /* padding */ +- hid_hw_request(bigben->hid, bigben->report, HID_REQ_SET_REPORT); ++ hid_output_report(bigben->report, buf); ++ } ++ ++ spin_unlock_irqrestore(&bigben->lock, flags); ++ ++ if (do_work_led) { ++ hid_hw_raw_request(bigben->hid, bigben->report->id, buf, len, ++ bigben->report->type, HID_REQ_SET_REPORT); + } + ++ /* FF work */ ++ spin_lock_irqsave(&bigben->lock, flags); ++ + if (bigben->work_ff) { + bigben->work_ff = false; ++ do_work_ff = true; + report_field->value[0] = 0x02; /* 2 = rumble effect message */ + report_field->value[1] = 0x08; /* reserved value, always 8 */ + report_field->value[2] = bigben->right_motor_on; +@@ -217,8 +244,17 @@ static void bigben_worker(struct work_struct *work) + report_field->value[5] = 0x00; /* padding */ + report_field->value[6] = 0x00; /* padding */ + report_field->value[7] = 0x00; /* padding */ +- hid_hw_request(bigben->hid, bigben->report, HID_REQ_SET_REPORT); ++ hid_output_report(bigben->report, buf); ++ } ++ ++ spin_unlock_irqrestore(&bigben->lock, flags); ++ ++ if (do_work_ff) { ++ hid_hw_raw_request(bigben->hid, bigben->report->id, buf, len, ++ bigben->report->type, HID_REQ_SET_REPORT); + } ++ ++ kfree(buf); + } + + static int hid_bigben_play_effect(struct input_dev *dev, void *data, +@@ -228,6 +264,7 @@ static int hid_bigben_play_effect(struct input_dev *dev, void *data, + struct bigben_device *bigben = hid_get_drvdata(hid); + u8 right_motor_on; + u8 left_motor_force; ++ unsigned long flags; + + if (!bigben) { + hid_err(hid, "no device data\n"); +@@ -242,9 +279,12 @@ static int hid_bigben_play_effect(struct input_dev *dev, void *data, + + if (right_motor_on != bigben->right_motor_on || + left_motor_force != bigben->left_motor_force) { ++ spin_lock_irqsave(&bigben->lock, flags); + bigben->right_motor_on = right_motor_on; + bigben->left_motor_force = left_motor_force; + bigben->work_ff = true; ++ spin_unlock_irqrestore(&bigben->lock, flags); ++ + schedule_work(&bigben->worker); + } + +@@ -259,6 +299,7 @@ static void bigben_set_led(struct led_classdev *led, + struct bigben_device *bigben = hid_get_drvdata(hid); + int n; + bool work; ++ unsigned long flags; + + if (!bigben) { + hid_err(hid, "no device data\n"); +@@ -267,6 +308,7 @@ static void bigben_set_led(struct led_classdev *led, + + for (n = 0; n < NUM_LEDS; n++) { + if (led == bigben->leds[n]) { ++ spin_lock_irqsave(&bigben->lock, flags); + if (value == LED_OFF) { + work = (bigben->led_state & BIT(n)); + bigben->led_state &= ~BIT(n); +@@ -274,6 +316,7 @@ static void bigben_set_led(struct led_classdev *led, + work = !(bigben->led_state & BIT(n)); + bigben->led_state |= BIT(n); + } ++ spin_unlock_irqrestore(&bigben->lock, flags); + + if (work) { + bigben->work_led = true; +@@ -307,8 +350,12 @@ static enum led_brightness bigben_get_led(struct led_classdev *led) + static void bigben_remove(struct hid_device *hid) + { + struct bigben_device *bigben = hid_get_drvdata(hid); ++ unsigned long flags; + ++ spin_lock_irqsave(&bigben->lock, flags); + bigben->removed = true; ++ spin_unlock_irqrestore(&bigben->lock, flags); ++ + cancel_work_sync(&bigben->worker); + hid_hw_stop(hid); + } +@@ -362,6 +409,7 @@ static int bigben_probe(struct hid_device *hid, + set_bit(FF_RUMBLE, hidinput->input->ffbit); + + INIT_WORK(&bigben->worker, bigben_worker); ++ spin_lock_init(&bigben->lock); + + error = input_ff_create_memless(hidinput->input, NULL, + hid_bigben_play_effect); +-- +2.39.2 + diff --git a/queue-5.15/hid-bigben-use-spinlock-to-safely-schedule-workers.patch b/queue-5.15/hid-bigben-use-spinlock-to-safely-schedule-workers.patch new file mode 100644 index 00000000000..d04c7b94805 --- /dev/null +++ b/queue-5.15/hid-bigben-use-spinlock-to-safely-schedule-workers.patch @@ -0,0 +1,83 @@ +From ce2360c59884fd0aca93a6760545412ddbbb2331 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 12 Feb 2023 19:00:01 +0000 +Subject: HID: bigben: use spinlock to safely schedule workers + +From: Pietro Borrello + +[ Upstream commit 76ca8da989c7d97a7f76c75d475fe95a584439d7 ] + +Use spinlocks to deal with workers introducing a wrapper +bigben_schedule_work(), and several spinlock checks. +Otherwise, bigben_set_led() may schedule bigben->worker after the +structure has been freed, causing a use-after-free. + +Fixes: 4eb1b01de5b9 ("HID: hid-bigbenff: fix race condition for scheduled work during removal") +Signed-off-by: Pietro Borrello +Link: https://lore.kernel.org/r/20230125-hid-unregister-leds-v4-3-7860c5763c38@diag.uniroma1.it +Signed-off-by: Benjamin Tissoires +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-bigbenff.c | 18 ++++++++++++------ + 1 file changed, 12 insertions(+), 6 deletions(-) + +diff --git a/drivers/hid/hid-bigbenff.c b/drivers/hid/hid-bigbenff.c +index b98c5f31c184b..9d6560db762b1 100644 +--- a/drivers/hid/hid-bigbenff.c ++++ b/drivers/hid/hid-bigbenff.c +@@ -185,6 +185,15 @@ struct bigben_device { + struct work_struct worker; + }; + ++static inline void bigben_schedule_work(struct bigben_device *bigben) ++{ ++ unsigned long flags; ++ ++ spin_lock_irqsave(&bigben->lock, flags); ++ if (!bigben->removed) ++ schedule_work(&bigben->worker); ++ spin_unlock_irqrestore(&bigben->lock, flags); ++} + + static void bigben_worker(struct work_struct *work) + { +@@ -197,9 +206,6 @@ static void bigben_worker(struct work_struct *work) + u32 len; + unsigned long flags; + +- if (bigben->removed) +- return; +- + buf = hid_alloc_report_buf(bigben->report, GFP_KERNEL); + if (!buf) + return; +@@ -285,7 +291,7 @@ static int hid_bigben_play_effect(struct input_dev *dev, void *data, + bigben->work_ff = true; + spin_unlock_irqrestore(&bigben->lock, flags); + +- schedule_work(&bigben->worker); ++ bigben_schedule_work(bigben); + } + + return 0; +@@ -320,7 +326,7 @@ static void bigben_set_led(struct led_classdev *led, + + if (work) { + bigben->work_led = true; +- schedule_work(&bigben->worker); ++ bigben_schedule_work(bigben); + } + return; + } +@@ -450,7 +456,7 @@ static int bigben_probe(struct hid_device *hid, + bigben->left_motor_force = 0; + bigben->work_led = true; + bigben->work_ff = true; +- schedule_work(&bigben->worker); ++ bigben_schedule_work(bigben); + + hid_info(hid, "LED and force feedback support for BigBen gamepad\n"); + +-- +2.39.2 + diff --git a/queue-5.15/hid-bigben_probe-validate-report-count.patch b/queue-5.15/hid-bigben_probe-validate-report-count.patch new file mode 100644 index 00000000000..b77b5a9a6ce --- /dev/null +++ b/queue-5.15/hid-bigben_probe-validate-report-count.patch @@ -0,0 +1,57 @@ +From 1f30f3aee9dec7e8b56ce6eacd4f75695fa36977 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 12 Feb 2023 00:01:44 +0000 +Subject: hid: bigben_probe(): validate report count + +From: Pietro Borrello + +[ Upstream commit b94335f899542a0da5fafc38af8edcaf90195843 ] + +bigben_probe() does not validate that the output report has the +needed report values in the first field. +A malicious device registering a report with one field and a single +value causes an head OOB write in bigben_worker() when +accessing report_field->value[1] to report_field->value[7]. +Use hid_validate_values() which takes care of all the needed checks. + +Fixes: 256a90ed9e46 ("HID: hid-bigbenff: driver for BigBen Interactive PS3OFMINIPAD gamepad") +Signed-off-by: Pietro Borrello +Link: https://lore.kernel.org/r/20230211-bigben-oob-v1-1-d2849688594c@diag.uniroma1.it +Signed-off-by: Benjamin Tissoires +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-bigbenff.c | 7 ++----- + 1 file changed, 2 insertions(+), 5 deletions(-) + +diff --git a/drivers/hid/hid-bigbenff.c b/drivers/hid/hid-bigbenff.c +index 9d6560db762b1..a02cb517b4c47 100644 +--- a/drivers/hid/hid-bigbenff.c ++++ b/drivers/hid/hid-bigbenff.c +@@ -371,7 +371,6 @@ static int bigben_probe(struct hid_device *hid, + { + struct bigben_device *bigben; + struct hid_input *hidinput; +- struct list_head *report_list; + struct led_classdev *led; + char *name; + size_t name_sz; +@@ -396,14 +395,12 @@ static int bigben_probe(struct hid_device *hid, + return error; + } + +- report_list = &hid->report_enum[HID_OUTPUT_REPORT].report_list; +- if (list_empty(report_list)) { ++ bigben->report = hid_validate_values(hid, HID_OUTPUT_REPORT, 0, 0, 8); ++ if (!bigben->report) { + hid_err(hid, "no output report found\n"); + error = -ENODEV; + goto error_hw_stop; + } +- bigben->report = list_entry(report_list->next, +- struct hid_report, list); + + if (list_empty(&hid->inputs)) { + hid_err(hid, "no inputs found\n"); +-- +2.39.2 + diff --git a/queue-5.15/hid-bigben_worker-remove-unneeded-check-on-report_fi.patch b/queue-5.15/hid-bigben_worker-remove-unneeded-check-on-report_fi.patch new file mode 100644 index 00000000000..15e5fb2bcd0 --- /dev/null +++ b/queue-5.15/hid-bigben_worker-remove-unneeded-check-on-report_fi.patch @@ -0,0 +1,44 @@ +From cc3bee826450668671234797a7d51296abe9d2c4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 12 Feb 2023 19:00:00 +0000 +Subject: HID: bigben_worker() remove unneeded check on report_field + +From: Pietro Borrello + +[ Upstream commit 27d2a2fd844ec7da70d19fabb482304fd1e0595b ] + +bigben_worker() checks report_field to be non-NULL. +The check has been added in commit +918aa1ef104d ("HID: bigbenff: prevent null pointer dereference") +to prevent a NULL pointer crash. +However, the true root cause was a missing check for output +reports, patched in commit +c7bf714f8755 ("HID: check empty report_list in bigben_probe()"), +where the type-confused report list_entry was overlapping with +a NULL pointer, which was then causing the crash. + +Fixes: 918aa1ef104d ("HID: bigbenff: prevent null pointer dereference") +Signed-off-by: Pietro Borrello +Link: https://lore.kernel.org/r/20230125-hid-unregister-leds-v4-2-7860c5763c38@diag.uniroma1.it +Signed-off-by: Benjamin Tissoires +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-bigbenff.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/hid/hid-bigbenff.c b/drivers/hid/hid-bigbenff.c +index ed3d2d7bc1dd4..b98c5f31c184b 100644 +--- a/drivers/hid/hid-bigbenff.c ++++ b/drivers/hid/hid-bigbenff.c +@@ -197,7 +197,7 @@ static void bigben_worker(struct work_struct *work) + u32 len; + unsigned long flags; + +- if (bigben->removed || !report_field) ++ if (bigben->removed) + return; + + buf = hid_alloc_report_buf(bigben->report, GFP_KERNEL); +-- +2.39.2 + diff --git a/queue-5.15/hid-logitech-hidpp-don-t-restart-communication-if-no.patch b/queue-5.15/hid-logitech-hidpp-don-t-restart-communication-if-no.patch new file mode 100644 index 00000000000..c495e7cb511 --- /dev/null +++ b/queue-5.15/hid-logitech-hidpp-don-t-restart-communication-if-no.patch @@ -0,0 +1,96 @@ +From 9b32cfef1f5035970e007cf51787e48f330edd9a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 Jan 2023 13:17:22 +0100 +Subject: HID: logitech-hidpp: Don't restart communication if not necessary + +From: Bastien Nocera + +[ Upstream commit 498ba20690357691103de0f766960355247c78be ] + +Don't stop and restart communication with the device unless we need to +modify the connect flags used because of a device quirk. + +Signed-off-by: Bastien Nocera +Link: https://lore.kernel.org/r/20230125121723.3122-1-hadess@hadess.net +Signed-off-by: Benjamin Tissoires +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-logitech-hidpp.c | 32 ++++++++++++++++++++------------ + 1 file changed, 20 insertions(+), 12 deletions(-) + +diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c +index 81de88ab2ecc7..601ab673727dc 100644 +--- a/drivers/hid/hid-logitech-hidpp.c ++++ b/drivers/hid/hid-logitech-hidpp.c +@@ -4049,6 +4049,7 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id) + bool connected; + unsigned int connect_mask = HID_CONNECT_DEFAULT; + struct hidpp_ff_private_data data; ++ bool will_restart = false; + + /* report_fixup needs drvdata to be set before we call hid_parse */ + hidpp = devm_kzalloc(&hdev->dev, sizeof(*hidpp), GFP_KERNEL); +@@ -4104,6 +4105,10 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id) + return ret; + } + ++ if (hidpp->quirks & HIDPP_QUIRK_DELAYED_INIT || ++ hidpp->quirks & HIDPP_QUIRK_UNIFYING) ++ will_restart = true; ++ + INIT_WORK(&hidpp->work, delayed_work_cb); + mutex_init(&hidpp->send_mutex); + init_waitqueue_head(&hidpp->wait); +@@ -4118,7 +4123,7 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id) + * Plain USB connections need to actually call start and open + * on the transport driver to allow incoming data. + */ +- ret = hid_hw_start(hdev, 0); ++ ret = hid_hw_start(hdev, will_restart ? 0 : connect_mask); + if (ret) { + hid_err(hdev, "hw start failed\n"); + goto hid_hw_start_fail; +@@ -4155,6 +4160,7 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id) + hidpp->wireless_feature_index = 0; + else if (ret) + goto hid_hw_init_fail; ++ ret = 0; + } + + if (connected && (hidpp->quirks & HIDPP_QUIRK_CLASS_WTP)) { +@@ -4169,19 +4175,21 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id) + + hidpp_connect_event(hidpp); + +- /* Reset the HID node state */ +- hid_device_io_stop(hdev); +- hid_hw_close(hdev); +- hid_hw_stop(hdev); ++ if (will_restart) { ++ /* Reset the HID node state */ ++ hid_device_io_stop(hdev); ++ hid_hw_close(hdev); ++ hid_hw_stop(hdev); + +- if (hidpp->quirks & HIDPP_QUIRK_NO_HIDINPUT) +- connect_mask &= ~HID_CONNECT_HIDINPUT; ++ if (hidpp->quirks & HIDPP_QUIRK_NO_HIDINPUT) ++ connect_mask &= ~HID_CONNECT_HIDINPUT; + +- /* Now export the actual inputs and hidraw nodes to the world */ +- ret = hid_hw_start(hdev, connect_mask); +- if (ret) { +- hid_err(hdev, "%s:hid_hw_start returned error\n", __func__); +- goto hid_hw_start_fail; ++ /* Now export the actual inputs and hidraw nodes to the world */ ++ ret = hid_hw_start(hdev, connect_mask); ++ if (ret) { ++ hid_err(hdev, "%s:hid_hw_start returned error\n", __func__); ++ goto hid_hw_start_fail; ++ } + } + + if (hidpp->quirks & HIDPP_QUIRK_CLASS_G920) { +-- +2.39.2 + diff --git a/queue-5.15/hid-multitouch-add-quirks-for-flipped-axes.patch b/queue-5.15/hid-multitouch-add-quirks-for-flipped-axes.patch new file mode 100644 index 00000000000..d39d5f45b42 --- /dev/null +++ b/queue-5.15/hid-multitouch-add-quirks-for-flipped-axes.patch @@ -0,0 +1,228 @@ +From 5b2beb661a00a978919df73a9c3a45731de965ef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Jan 2023 20:25:50 +0000 +Subject: HID: multitouch: Add quirks for flipped axes + +From: Allen Ballway + +[ Upstream commit a2f416bf062a38bb76cccd526d2d286b8e4db4d9 ] + +Certain touchscreen devices, such as the ELAN9034, are oriented +incorrectly and report touches on opposite points on the X and Y axes. +For example, a 100x200 screen touched at (10,20) would report (90, 180) +and vice versa. + +This is fixed by adding device quirks to transform the touch points +into the correct spaces, from X -> MAX(X) - X, and Y -> MAX(Y) - Y. + +Signed-off-by: Allen Ballway +Signed-off-by: Jiri Kosina +Stable-dep-of: 03a86105556e ("HID: retain initial quirks set up when creating HID devices") +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-multitouch.c | 39 ++++++++++++++++++--- + drivers/hid/hid-quirks.c | 6 ++++ + drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c | 43 ++++++++++++++++++++++++ + drivers/hid/i2c-hid/i2c-hid.h | 3 ++ + 4 files changed, 87 insertions(+), 4 deletions(-) + +diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c +index 6b86d368d5e74..592ffdd546fb4 100644 +--- a/drivers/hid/hid-multitouch.c ++++ b/drivers/hid/hid-multitouch.c +@@ -71,6 +71,7 @@ MODULE_LICENSE("GPL"); + #define MT_QUIRK_SEPARATE_APP_REPORT BIT(19) + #define MT_QUIRK_FORCE_MULTI_INPUT BIT(20) + #define MT_QUIRK_DISABLE_WAKEUP BIT(21) ++#define MT_QUIRK_ORIENTATION_INVERT BIT(22) + + #define MT_INPUTMODE_TOUCHSCREEN 0x02 + #define MT_INPUTMODE_TOUCHPAD 0x03 +@@ -1009,6 +1010,7 @@ static int mt_process_slot(struct mt_device *td, struct input_dev *input, + struct mt_usages *slot) + { + struct input_mt *mt = input->mt; ++ struct hid_device *hdev = td->hdev; + __s32 quirks = app->quirks; + bool valid = true; + bool confidence_state = true; +@@ -1086,6 +1088,10 @@ static int mt_process_slot(struct mt_device *td, struct input_dev *input, + int orientation = wide; + int max_azimuth; + int azimuth; ++ int x; ++ int y; ++ int cx; ++ int cy; + + if (slot->a != DEFAULT_ZERO) { + /* +@@ -1104,6 +1110,9 @@ static int mt_process_slot(struct mt_device *td, struct input_dev *input, + if (azimuth > max_azimuth * 2) + azimuth -= max_azimuth * 4; + orientation = -azimuth; ++ if (quirks & MT_QUIRK_ORIENTATION_INVERT) ++ orientation = -orientation; ++ + } + + if (quirks & MT_QUIRK_TOUCH_SIZE_SCALING) { +@@ -1115,10 +1124,23 @@ static int mt_process_slot(struct mt_device *td, struct input_dev *input, + minor = minor >> 1; + } + +- input_event(input, EV_ABS, ABS_MT_POSITION_X, *slot->x); +- input_event(input, EV_ABS, ABS_MT_POSITION_Y, *slot->y); +- input_event(input, EV_ABS, ABS_MT_TOOL_X, *slot->cx); +- input_event(input, EV_ABS, ABS_MT_TOOL_Y, *slot->cy); ++ x = hdev->quirks & HID_QUIRK_X_INVERT ? ++ input_abs_get_max(input, ABS_MT_POSITION_X) - *slot->x : ++ *slot->x; ++ y = hdev->quirks & HID_QUIRK_Y_INVERT ? ++ input_abs_get_max(input, ABS_MT_POSITION_Y) - *slot->y : ++ *slot->y; ++ cx = hdev->quirks & HID_QUIRK_X_INVERT ? ++ input_abs_get_max(input, ABS_MT_POSITION_X) - *slot->cx : ++ *slot->cx; ++ cy = hdev->quirks & HID_QUIRK_Y_INVERT ? ++ input_abs_get_max(input, ABS_MT_POSITION_Y) - *slot->cy : ++ *slot->cy; ++ ++ input_event(input, EV_ABS, ABS_MT_POSITION_X, x); ++ input_event(input, EV_ABS, ABS_MT_POSITION_Y, y); ++ input_event(input, EV_ABS, ABS_MT_TOOL_X, cx); ++ input_event(input, EV_ABS, ABS_MT_TOOL_Y, cy); + input_event(input, EV_ABS, ABS_MT_DISTANCE, !*slot->tip_state); + input_event(input, EV_ABS, ABS_MT_ORIENTATION, orientation); + input_event(input, EV_ABS, ABS_MT_PRESSURE, *slot->p); +@@ -1738,6 +1760,15 @@ static int mt_probe(struct hid_device *hdev, const struct hid_device_id *id) + if (id->vendor == HID_ANY_ID && id->product == HID_ANY_ID) + td->serial_maybe = true; + ++ ++ /* Orientation is inverted if the X or Y axes are ++ * flipped, but normalized if both are inverted. ++ */ ++ if (hdev->quirks & (HID_QUIRK_X_INVERT | HID_QUIRK_Y_INVERT) && ++ !((hdev->quirks & HID_QUIRK_X_INVERT) ++ && (hdev->quirks & HID_QUIRK_Y_INVERT))) ++ td->mtclass.quirks = MT_QUIRK_ORIENTATION_INVERT; ++ + /* This allows the driver to correctly support devices + * that emit events over several HID messages. + */ +diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c +index 4a8c32148e58f..bad1c1e3adec4 100644 +--- a/drivers/hid/hid-quirks.c ++++ b/drivers/hid/hid-quirks.c +@@ -19,6 +19,7 @@ + #include + + #include "hid-ids.h" ++#include "i2c-hid/i2c-hid.h" + + /* + * Alphabetically sorted by vendor then product. +@@ -1278,6 +1279,11 @@ unsigned long hid_lookup_quirk(const struct hid_device *hdev) + quirks = hid_gets_squirk(hdev); + mutex_unlock(&dquirks_lock); + ++ /* Get quirks specific to I2C devices */ ++ if (IS_ENABLED(CONFIG_I2C_DMI_CORE) && IS_ENABLED(CONFIG_DMI) && ++ hdev->bus == BUS_I2C) ++ quirks |= i2c_hid_get_dmi_quirks(hdev->vendor, hdev->product); ++ + return quirks; + } + EXPORT_SYMBOL_GPL(hid_lookup_quirk); +diff --git a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c +index 8e0f67455c098..554a7dc285365 100644 +--- a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c ++++ b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c +@@ -10,8 +10,10 @@ + #include + #include + #include ++#include + + #include "i2c-hid.h" ++#include "../hid-ids.h" + + + struct i2c_hid_desc_override { +@@ -416,6 +418,28 @@ static const struct dmi_system_id i2c_hid_dmi_desc_override_table[] = { + { } /* Terminate list */ + }; + ++static const struct hid_device_id i2c_hid_elan_flipped_quirks = { ++ HID_DEVICE(BUS_I2C, HID_GROUP_MULTITOUCH_WIN_8, USB_VENDOR_ID_ELAN, 0x2dcd), ++ HID_QUIRK_X_INVERT | HID_QUIRK_Y_INVERT ++}; ++ ++/* ++ * This list contains devices which have specific issues based on the system ++ * they're on and not just the device itself. The driver_data will have a ++ * specific hid device to match against. ++ */ ++static const struct dmi_system_id i2c_hid_dmi_quirk_table[] = { ++ { ++ .ident = "DynaBook K50/FR", ++ .matches = { ++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Dynabook Inc."), ++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "dynabook K50/FR"), ++ }, ++ .driver_data = (void *)&i2c_hid_elan_flipped_quirks, ++ }, ++ { } /* Terminate list */ ++}; ++ + + struct i2c_hid_desc *i2c_hid_get_dmi_i2c_hid_desc_override(uint8_t *i2c_name) + { +@@ -450,3 +474,22 @@ char *i2c_hid_get_dmi_hid_report_desc_override(uint8_t *i2c_name, + *size = override->hid_report_desc_size; + return override->hid_report_desc; + } ++ ++u32 i2c_hid_get_dmi_quirks(const u16 vendor, const u16 product) ++{ ++ u32 quirks = 0; ++ const struct dmi_system_id *system_id = ++ dmi_first_match(i2c_hid_dmi_quirk_table); ++ ++ if (system_id) { ++ const struct hid_device_id *device_id = ++ (struct hid_device_id *)(system_id->driver_data); ++ ++ if (device_id && device_id->vendor == vendor && ++ device_id->product == product) ++ quirks = device_id->driver_data; ++ } ++ ++ return quirks; ++} ++EXPORT_SYMBOL_GPL(i2c_hid_get_dmi_quirks); +diff --git a/drivers/hid/i2c-hid/i2c-hid.h b/drivers/hid/i2c-hid/i2c-hid.h +index 236cc062d5ef8..7b93b6c21f126 100644 +--- a/drivers/hid/i2c-hid/i2c-hid.h ++++ b/drivers/hid/i2c-hid/i2c-hid.h +@@ -9,6 +9,7 @@ + struct i2c_hid_desc *i2c_hid_get_dmi_i2c_hid_desc_override(uint8_t *i2c_name); + char *i2c_hid_get_dmi_hid_report_desc_override(uint8_t *i2c_name, + unsigned int *size); ++u32 i2c_hid_get_dmi_quirks(const u16 vendor, const u16 product); + #else + static inline struct i2c_hid_desc + *i2c_hid_get_dmi_i2c_hid_desc_override(uint8_t *i2c_name) +@@ -16,6 +17,8 @@ static inline struct i2c_hid_desc + static inline char *i2c_hid_get_dmi_hid_report_desc_override(uint8_t *i2c_name, + unsigned int *size) + { return NULL; } ++static inline u32 i2c_hid_get_dmi_quirks(const u16 vendor, const u16 product) ++{ return 0; } + #endif + + /** +-- +2.39.2 + diff --git a/queue-5.15/hid-retain-initial-quirks-set-up-when-creating-hid-d.patch b/queue-5.15/hid-retain-initial-quirks-set-up-when-creating-hid-d.patch new file mode 100644 index 00000000000..fb233e26e17 --- /dev/null +++ b/queue-5.15/hid-retain-initial-quirks-set-up-when-creating-hid-d.patch @@ -0,0 +1,119 @@ +From 30894f322812d5cdb909905f0c2dfd1100de3411 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Feb 2023 15:03:30 -0800 +Subject: HID: retain initial quirks set up when creating HID devices + +From: Dmitry Torokhov + +[ Upstream commit 03a86105556e23650e4470c09f91cf7c360d5e28 ] + +In certain circumstances, such as when creating I2C-connected HID +devices, we want to pass and retain some quirks (axis inversion, etc). +The source of such quirks may be device tree, or DMI data, or something +else not readily available to the HID core itself and therefore cannot +be reconstructed easily. To allow this, introduce "initial_quirks" field +in hid_device structure and use it when determining the final set of +quirks. + +This fixes the problem with i2c-hid setting up device-tree sourced +quirks too late and losing them on device rebind, and also allows to +sever the tie between hid-code and i2c-hid when applying DMI-based +quirks. + +Fixes: b60d3c803d76 ("HID: i2c-hid-of: Expose the touchscreen-inverted properties") +Fixes: a2f416bf062a ("HID: multitouch: Add quirks for flipped axes") +Reviewed-by: Guenter Roeck +Tested-by: Allen Ballway +Signed-off-by: Dmitry Torokhov +Reviewed-by: Alistair Francis +Link: https://lore.kernel.org/r/Y+LYwu3Zs13hdVDy@google.com +Signed-off-by: Benjamin Tissoires +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-quirks.c | 8 +------- + drivers/hid/i2c-hid/i2c-hid-core.c | 6 ++++-- + drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c | 1 - + include/linux/hid.h | 1 + + 4 files changed, 6 insertions(+), 10 deletions(-) + +diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c +index bad1c1e3adec4..c7c06aa958c4d 100644 +--- a/drivers/hid/hid-quirks.c ++++ b/drivers/hid/hid-quirks.c +@@ -19,7 +19,6 @@ + #include + + #include "hid-ids.h" +-#include "i2c-hid/i2c-hid.h" + + /* + * Alphabetically sorted by vendor then product. +@@ -1218,7 +1217,7 @@ EXPORT_SYMBOL_GPL(hid_quirks_exit); + static unsigned long hid_gets_squirk(const struct hid_device *hdev) + { + const struct hid_device_id *bl_entry; +- unsigned long quirks = 0; ++ unsigned long quirks = hdev->initial_quirks; + + if (hid_match_id(hdev, hid_ignore_list)) + quirks |= HID_QUIRK_IGNORE; +@@ -1279,11 +1278,6 @@ unsigned long hid_lookup_quirk(const struct hid_device *hdev) + quirks = hid_gets_squirk(hdev); + mutex_unlock(&dquirks_lock); + +- /* Get quirks specific to I2C devices */ +- if (IS_ENABLED(CONFIG_I2C_DMI_CORE) && IS_ENABLED(CONFIG_DMI) && +- hdev->bus == BUS_I2C) +- quirks |= i2c_hid_get_dmi_quirks(hdev->vendor, hdev->product); +- + return quirks; + } + EXPORT_SYMBOL_GPL(hid_lookup_quirk); +diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c +index 65c1f20ec420a..7c61bb9291e4e 100644 +--- a/drivers/hid/i2c-hid/i2c-hid-core.c ++++ b/drivers/hid/i2c-hid/i2c-hid-core.c +@@ -1012,6 +1012,10 @@ int i2c_hid_core_probe(struct i2c_client *client, struct i2chid_ops *ops, + hid->vendor = le16_to_cpu(ihid->hdesc.wVendorID); + hid->product = le16_to_cpu(ihid->hdesc.wProductID); + ++ hid->initial_quirks = quirks; ++ hid->initial_quirks |= i2c_hid_get_dmi_quirks(hid->vendor, ++ hid->product); ++ + snprintf(hid->name, sizeof(hid->name), "%s %04X:%04X", + client->name, (u16)hid->vendor, (u16)hid->product); + strlcpy(hid->phys, dev_name(&client->dev), sizeof(hid->phys)); +@@ -1025,8 +1029,6 @@ int i2c_hid_core_probe(struct i2c_client *client, struct i2chid_ops *ops, + goto err_mem_free; + } + +- hid->quirks |= quirks; +- + return 0; + + err_mem_free: +diff --git a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c +index 554a7dc285365..210f17c3a0be0 100644 +--- a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c ++++ b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c +@@ -492,4 +492,3 @@ u32 i2c_hid_get_dmi_quirks(const u16 vendor, const u16 product) + + return quirks; + } +-EXPORT_SYMBOL_GPL(i2c_hid_get_dmi_quirks); +diff --git a/include/linux/hid.h b/include/linux/hid.h +index 26742ca14609a..3cfbffd94a058 100644 +--- a/include/linux/hid.h ++++ b/include/linux/hid.h +@@ -599,6 +599,7 @@ struct hid_device { /* device report descriptor */ + unsigned long status; /* see STAT flags above */ + unsigned claimed; /* Claimed by hidinput, hiddev? */ + unsigned quirks; /* Various quirks the device can pull on us */ ++ unsigned initial_quirks; /* Initial set of quirks supplied when creating device */ + bool io_started; /* If IO has started */ + + struct list_head inputs; /* The list of inputs */ +-- +2.39.2 + diff --git a/queue-5.15/hv_netvsc-check-status-in-send_rndis_pkt-completion-.patch b/queue-5.15/hv_netvsc-check-status-in-send_rndis_pkt-completion-.patch new file mode 100644 index 00000000000..b959ac65c41 --- /dev/null +++ b/queue-5.15/hv_netvsc-check-status-in-send_rndis_pkt-completion-.patch @@ -0,0 +1,64 @@ +From 6f337231b8d9d1597b20836b5039ee171f1e9db4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 12 Feb 2023 21:08:01 -0800 +Subject: hv_netvsc: Check status in SEND_RNDIS_PKT completion message + +From: Michael Kelley + +[ Upstream commit dca5161f9bd052e9e73be90716ffd57e8762c697 ] + +Completion responses to SEND_RNDIS_PKT messages are currently processed +regardless of the status in the response, so that resources associated +with the request are freed. While this is appropriate, code bugs that +cause sending a malformed message, or errors on the Hyper-V host, go +undetected. Fix this by checking the status and outputting a rate-limited +message if there is an error. + +Signed-off-by: Michael Kelley +Reviewed-by: Haiyang Zhang +Link: https://lore.kernel.org/r/1676264881-48928-1-git-send-email-mikelley@microsoft.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/hyperv/netvsc.c | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) + +diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c +index fb2448f9a8b17..4156299e039d8 100644 +--- a/drivers/net/hyperv/netvsc.c ++++ b/drivers/net/hyperv/netvsc.c +@@ -814,6 +814,7 @@ static void netvsc_send_completion(struct net_device *ndev, + u32 msglen = hv_pkt_datalen(desc); + struct nvsp_message *pkt_rqst; + u64 cmd_rqst; ++ u32 status; + + /* First check if this is a VMBUS completion without data payload */ + if (!msglen) { +@@ -885,6 +886,23 @@ static void netvsc_send_completion(struct net_device *ndev, + break; + + case NVSP_MSG1_TYPE_SEND_RNDIS_PKT_COMPLETE: ++ if (msglen < sizeof(struct nvsp_message_header) + ++ sizeof(struct nvsp_1_message_send_rndis_packet_complete)) { ++ if (net_ratelimit()) ++ netdev_err(ndev, "nvsp_rndis_pkt_complete length too small: %u\n", ++ msglen); ++ return; ++ } ++ ++ /* If status indicates an error, output a message so we know ++ * there's a problem. But process the completion anyway so the ++ * resources are released. ++ */ ++ status = nvsp_packet->msg.v1_msg.send_rndis_pkt_complete.status; ++ if (status != NVSP_STAT_SUCCESS && net_ratelimit()) ++ netdev_err(ndev, "nvsp_rndis_pkt_complete error status: %x\n", ++ status); ++ + netvsc_send_tx_complete(ndev, net_device, incoming_channel, + desc, budget); + break; +-- +2.39.2 + diff --git a/queue-5.15/hwmon-coretemp-simplify-platform-device-handling.patch b/queue-5.15/hwmon-coretemp-simplify-platform-device-handling.patch new file mode 100644 index 00000000000..53488467121 --- /dev/null +++ b/queue-5.15/hwmon-coretemp-simplify-platform-device-handling.patch @@ -0,0 +1,280 @@ +From 8a1ff3f25ead9e828046971c7e551971fd4a17cf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Jan 2023 12:46:20 +0100 +Subject: hwmon: (coretemp) Simplify platform device handling + +From: Robin Murphy + +[ Upstream commit 6d03bbff456befeccdd4d663177c4d6c75d0c4ff ] + +Coretemp's platform driver is unconventional. All the real work is done +globally by the initcall and CPU hotplug notifiers, while the "driver" +effectively just wraps an allocation and the registration of the hwmon +interface in a long-winded round-trip through the driver core. The whole +logic of dynamically creating and destroying platform devices to bring +the interfaces up and down is error prone, since it assumes +platform_device_add() will synchronously bind the driver and set drvdata +before it returns, thus results in a NULL dereference if drivers_autoprobe +is turned off for the platform bus. Furthermore, the unusual approach of +doing that from within a CPU hotplug notifier, already commented in the +code that it deadlocks suspend, also causes lockdep issues for other +drivers or subsystems which may want to legitimately register a CPU +hotplug notifier from a platform bus notifier. + +All of these issues can be solved by ripping this unusual behaviour out +completely, simply tying the platform devices to the lifetime of the +module itself, and directly managing the hwmon interfaces from the +hotplug notifiers. There is a slight user-visible change in that +/sys/bus/platform/drivers/coretemp will no longer appear, and +/sys/devices/platform/coretemp.n will remain present if package n is +hotplugged off, but hwmon users should really only be looking for the +presence of the hwmon interfaces, whose behaviour remains unchanged. + +Link: https://lore.kernel.org/lkml/20220922101036.87457-1-janusz.krzysztofik@linux.intel.com/ +Link: https://gitlab.freedesktop.org/drm/intel/issues/6641 +Signed-off-by: Robin Murphy +Signed-off-by: Janusz Krzysztofik +Link: https://lore.kernel.org/r/20230103114620.15319-1-janusz.krzysztofik@linux.intel.com +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/coretemp.c | 128 ++++++++++++++++++--------------------- + 1 file changed, 58 insertions(+), 70 deletions(-) + +diff --git a/drivers/hwmon/coretemp.c b/drivers/hwmon/coretemp.c +index 42b84ebff0579..eaae5de2ab616 100644 +--- a/drivers/hwmon/coretemp.c ++++ b/drivers/hwmon/coretemp.c +@@ -550,66 +550,49 @@ static void coretemp_remove_core(struct platform_data *pdata, int indx) + ida_free(&pdata->ida, indx - BASE_SYSFS_ATTR_NO); + } + +-static int coretemp_probe(struct platform_device *pdev) ++static int coretemp_device_add(int zoneid) + { +- struct device *dev = &pdev->dev; ++ struct platform_device *pdev; + struct platform_data *pdata; ++ int err; + + /* Initialize the per-zone data structures */ +- pdata = devm_kzalloc(dev, sizeof(struct platform_data), GFP_KERNEL); ++ pdata = kzalloc(sizeof(*pdata), GFP_KERNEL); + if (!pdata) + return -ENOMEM; + +- pdata->pkg_id = pdev->id; ++ pdata->pkg_id = zoneid; + ida_init(&pdata->ida); +- platform_set_drvdata(pdev, pdata); + +- pdata->hwmon_dev = devm_hwmon_device_register_with_groups(dev, DRVNAME, +- pdata, NULL); +- return PTR_ERR_OR_ZERO(pdata->hwmon_dev); +-} +- +-static int coretemp_remove(struct platform_device *pdev) +-{ +- struct platform_data *pdata = platform_get_drvdata(pdev); +- int i; ++ pdev = platform_device_alloc(DRVNAME, zoneid); ++ if (!pdev) { ++ err = -ENOMEM; ++ goto err_free_pdata; ++ } + +- for (i = MAX_CORE_DATA - 1; i >= 0; --i) +- if (pdata->core_data[i]) +- coretemp_remove_core(pdata, i); ++ err = platform_device_add(pdev); ++ if (err) ++ goto err_put_dev; + +- ida_destroy(&pdata->ida); ++ platform_set_drvdata(pdev, pdata); ++ zone_devices[zoneid] = pdev; + return 0; +-} + +-static struct platform_driver coretemp_driver = { +- .driver = { +- .name = DRVNAME, +- }, +- .probe = coretemp_probe, +- .remove = coretemp_remove, +-}; ++err_put_dev: ++ platform_device_put(pdev); ++err_free_pdata: ++ kfree(pdata); ++ return err; ++} + +-static struct platform_device *coretemp_device_add(unsigned int cpu) ++static void coretemp_device_remove(int zoneid) + { +- int err, zoneid = topology_logical_die_id(cpu); +- struct platform_device *pdev; +- +- if (zoneid < 0) +- return ERR_PTR(-ENOMEM); +- +- pdev = platform_device_alloc(DRVNAME, zoneid); +- if (!pdev) +- return ERR_PTR(-ENOMEM); +- +- err = platform_device_add(pdev); +- if (err) { +- platform_device_put(pdev); +- return ERR_PTR(err); +- } ++ struct platform_device *pdev = zone_devices[zoneid]; ++ struct platform_data *pdata = platform_get_drvdata(pdev); + +- zone_devices[zoneid] = pdev; +- return pdev; ++ ida_destroy(&pdata->ida); ++ kfree(pdata); ++ platform_device_unregister(pdev); + } + + static int coretemp_cpu_online(unsigned int cpu) +@@ -633,7 +616,10 @@ static int coretemp_cpu_online(unsigned int cpu) + if (!cpu_has(c, X86_FEATURE_DTHERM)) + return -ENODEV; + +- if (!pdev) { ++ pdata = platform_get_drvdata(pdev); ++ if (!pdata->hwmon_dev) { ++ struct device *hwmon; ++ + /* Check the microcode version of the CPU */ + if (chk_ucode_version(cpu)) + return -EINVAL; +@@ -644,9 +630,11 @@ static int coretemp_cpu_online(unsigned int cpu) + * online. So, initialize per-pkg data structures and + * then bring this core online. + */ +- pdev = coretemp_device_add(cpu); +- if (IS_ERR(pdev)) +- return PTR_ERR(pdev); ++ hwmon = hwmon_device_register_with_groups(&pdev->dev, DRVNAME, ++ pdata, NULL); ++ if (IS_ERR(hwmon)) ++ return PTR_ERR(hwmon); ++ pdata->hwmon_dev = hwmon; + + /* + * Check whether pkgtemp support is available. +@@ -656,7 +644,6 @@ static int coretemp_cpu_online(unsigned int cpu) + coretemp_add_core(pdev, cpu, 1); + } + +- pdata = platform_get_drvdata(pdev); + /* + * Check whether a thread sibling is already online. If not add the + * interface for this CPU core. +@@ -675,18 +662,14 @@ static int coretemp_cpu_offline(unsigned int cpu) + struct temp_data *tdata; + int i, indx = -1, target; + +- /* +- * Don't execute this on suspend as the device remove locks +- * up the machine. +- */ ++ /* No need to tear down any interfaces for suspend */ + if (cpuhp_tasks_frozen) + return 0; + + /* If the physical CPU device does not exist, just return */ +- if (!pdev) +- return 0; +- + pd = platform_get_drvdata(pdev); ++ if (!pd->hwmon_dev) ++ return 0; + + for (i = 0; i < NUM_REAL_CORES; i++) { + if (pd->cpu_map[i] == topology_core_id(cpu)) { +@@ -718,13 +701,14 @@ static int coretemp_cpu_offline(unsigned int cpu) + } + + /* +- * If all cores in this pkg are offline, remove the device. This +- * will invoke the platform driver remove function, which cleans up +- * the rest. ++ * If all cores in this pkg are offline, remove the interface. + */ ++ tdata = pd->core_data[PKG_SYSFS_ATTR_NO]; + if (cpumask_empty(&pd->cpumask)) { +- zone_devices[topology_logical_die_id(cpu)] = NULL; +- platform_device_unregister(pdev); ++ if (tdata) ++ coretemp_remove_core(pd, PKG_SYSFS_ATTR_NO); ++ hwmon_device_unregister(pd->hwmon_dev); ++ pd->hwmon_dev = NULL; + return 0; + } + +@@ -732,7 +716,6 @@ static int coretemp_cpu_offline(unsigned int cpu) + * Check whether this core is the target for the package + * interface. We need to assign it to some other cpu. + */ +- tdata = pd->core_data[PKG_SYSFS_ATTR_NO]; + if (tdata && tdata->cpu == cpu) { + target = cpumask_first(&pd->cpumask); + mutex_lock(&tdata->update_lock); +@@ -751,7 +734,7 @@ static enum cpuhp_state coretemp_hp_online; + + static int __init coretemp_init(void) + { +- int err; ++ int i, err; + + /* + * CPUID.06H.EAX[0] indicates whether the CPU has thermal +@@ -767,20 +750,22 @@ static int __init coretemp_init(void) + if (!zone_devices) + return -ENOMEM; + +- err = platform_driver_register(&coretemp_driver); +- if (err) +- goto outzone; ++ for (i = 0; i < max_zones; i++) { ++ err = coretemp_device_add(i); ++ if (err) ++ goto outzone; ++ } + + err = cpuhp_setup_state(CPUHP_AP_ONLINE_DYN, "hwmon/coretemp:online", + coretemp_cpu_online, coretemp_cpu_offline); + if (err < 0) +- goto outdrv; ++ goto outzone; + coretemp_hp_online = err; + return 0; + +-outdrv: +- platform_driver_unregister(&coretemp_driver); + outzone: ++ while (i--) ++ coretemp_device_remove(i); + kfree(zone_devices); + return err; + } +@@ -788,8 +773,11 @@ module_init(coretemp_init) + + static void __exit coretemp_exit(void) + { ++ int i; ++ + cpuhp_remove_state(coretemp_hp_online); +- platform_driver_unregister(&coretemp_driver); ++ for (i = 0; i < max_zones; i++) ++ coretemp_device_remove(i); + kfree(zone_devices); + } + module_exit(coretemp_exit) +-- +2.39.2 + diff --git a/queue-5.15/hwmon-ftsteutates-fix-scaling-of-measurements.patch b/queue-5.15/hwmon-ftsteutates-fix-scaling-of-measurements.patch new file mode 100644 index 00000000000..80533659116 --- /dev/null +++ b/queue-5.15/hwmon-ftsteutates-fix-scaling-of-measurements.patch @@ -0,0 +1,124 @@ +From 3dcd07e8ab830970eab0dcfa7062e455a809763c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 24 Dec 2022 05:18:53 +0100 +Subject: hwmon: (ftsteutates) Fix scaling of measurements + +From: Armin Wolf + +[ Upstream commit ca8fd8c16a8b77dfcf7f6ce52d2c863220693a78 ] + +A user complained that the ftsteutates driver was displaying +bogus values since its introduction. This happens because the +sensor measurements need to be scaled in order to produce +meaningful results: +- the fan speed needs to be multiplied by 60 since its in RPS +- the temperature is in degrees celsius and needs an offset of 64 +- the voltage is in 1/256 of 3.3V + +The offical datasheet says the voltage needs to be divided by 256, +but this is likely an off-by-one-error, since even the BIOS +devides by 255 (otherwise 3.3V could not be measured). + +The voltage channels additionally need a board-specific multiplier, +however this can be done by the driver since its board-specific. + +The reason the missing scaling of measurements is the way Fujitsu +used this driver when it was still out-of-tree. Back then, all +scaling was done in userspace by libsensors, even the generic one. + +Tested on a Fujitsu DS3401-B1. + +Fixes: 08426eda58e0 ("hwmon: Add driver for FTS BMC chip "Teutates"") +Signed-off-by: Armin Wolf +Link: https://lore.kernel.org/r/20221224041855.83981-2-W_Armin@gmx.de +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + Documentation/hwmon/ftsteutates.rst | 4 ++++ + drivers/hwmon/ftsteutates.c | 19 +++++++++++++------ + 2 files changed, 17 insertions(+), 6 deletions(-) + +diff --git a/Documentation/hwmon/ftsteutates.rst b/Documentation/hwmon/ftsteutates.rst +index 58a2483d8d0da..198fa8e2819da 100644 +--- a/Documentation/hwmon/ftsteutates.rst ++++ b/Documentation/hwmon/ftsteutates.rst +@@ -22,6 +22,10 @@ enhancements. It can monitor up to 4 voltages, 16 temperatures and + 8 fans. It also contains an integrated watchdog which is currently + implemented in this driver. + ++The 4 voltages require a board-specific multiplier, since the BMC can ++only measure voltages up to 3.3V and thus relies on voltage dividers. ++Consult your motherboard manual for details. ++ + To clear a temperature or fan alarm, execute the following command with the + correct path to the alarm file:: + +diff --git a/drivers/hwmon/ftsteutates.c b/drivers/hwmon/ftsteutates.c +index ceffc76a0c515..2998d8cdce006 100644 +--- a/drivers/hwmon/ftsteutates.c ++++ b/drivers/hwmon/ftsteutates.c +@@ -12,6 +12,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -347,13 +348,15 @@ static ssize_t in_value_show(struct device *dev, + { + struct fts_data *data = dev_get_drvdata(dev); + int index = to_sensor_dev_attr(devattr)->index; +- int err; ++ int value, err; + + err = fts_update_device(data); + if (err < 0) + return err; + +- return sprintf(buf, "%u\n", data->volt[index]); ++ value = DIV_ROUND_CLOSEST(data->volt[index] * 3300, 255); ++ ++ return sprintf(buf, "%d\n", value); + } + + static ssize_t temp_value_show(struct device *dev, +@@ -361,13 +364,15 @@ static ssize_t temp_value_show(struct device *dev, + { + struct fts_data *data = dev_get_drvdata(dev); + int index = to_sensor_dev_attr(devattr)->index; +- int err; ++ int value, err; + + err = fts_update_device(data); + if (err < 0) + return err; + +- return sprintf(buf, "%u\n", data->temp_input[index]); ++ value = (data->temp_input[index] - 64) * 1000; ++ ++ return sprintf(buf, "%d\n", value); + } + + static ssize_t temp_fault_show(struct device *dev, +@@ -436,13 +441,15 @@ static ssize_t fan_value_show(struct device *dev, + { + struct fts_data *data = dev_get_drvdata(dev); + int index = to_sensor_dev_attr(devattr)->index; +- int err; ++ int value, err; + + err = fts_update_device(data); + if (err < 0) + return err; + +- return sprintf(buf, "%u\n", data->fan_input[index]); ++ value = data->fan_input[index] * 60; ++ ++ return sprintf(buf, "%d\n", value); + } + + static ssize_t fan_source_show(struct device *dev, +-- +2.39.2 + diff --git a/queue-5.15/hwmon-ltc2945-handle-error-case-in-ltc2945_value_sto.patch b/queue-5.15/hwmon-ltc2945-handle-error-case-in-ltc2945_value_sto.patch new file mode 100644 index 00000000000..8b084060049 --- /dev/null +++ b/queue-5.15/hwmon-ltc2945-handle-error-case-in-ltc2945_value_sto.patch @@ -0,0 +1,38 @@ +From 09e8ea9b0569b631d63cf76b768fafa42ce3db3f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Jan 2023 17:32:25 -0500 +Subject: hwmon: (ltc2945) Handle error case in ltc2945_value_store + +From: Jonathan Cormier + +[ Upstream commit 178b01eccfb0b8149682f61388400bd3d903dddc ] + +ltc2945_val_to_reg errors were not being handled +which would have resulted in register being set to +0 (clamped) instead of being left alone. + +Fixes: 6700ce035f83 ("hwmon: Driver for Linear Technologies LTC2945") + +Signed-off-by: Jonathan Cormier +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/ltc2945.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/hwmon/ltc2945.c b/drivers/hwmon/ltc2945.c +index 9adebb59f6042..c06ab7317431f 100644 +--- a/drivers/hwmon/ltc2945.c ++++ b/drivers/hwmon/ltc2945.c +@@ -248,6 +248,8 @@ static ssize_t ltc2945_value_store(struct device *dev, + + /* convert to register value, then clamp and write result */ + regval = ltc2945_val_to_reg(dev, reg, val); ++ if (regval < 0) ++ return regval; + if (is_power_reg(reg)) { + regval = clamp_val(regval, 0, 0xffffff); + regbuf[0] = regval >> 16; +-- +2.39.2 + diff --git a/queue-5.15/hwmon-mlxreg-fan-return-zero-speed-for-broken-fan.patch b/queue-5.15/hwmon-mlxreg-fan-return-zero-speed-for-broken-fan.patch new file mode 100644 index 00000000000..0d5fa7c8803 --- /dev/null +++ b/queue-5.15/hwmon-mlxreg-fan-return-zero-speed-for-broken-fan.patch @@ -0,0 +1,46 @@ +From 889654de46c3c400b6d521bb6ac832dc68f538c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 12 Feb 2023 16:57:30 +0200 +Subject: hwmon: (mlxreg-fan) Return zero speed for broken fan + +From: Vadim Pasternak + +[ Upstream commit a1ffd3c46267ee5c807acd780e15df9bb692223f ] + +Currently for broken fan driver returns value calculated based on error +code (0xFF) in related fan speed register. +Thus, for such fan user gets fan{n}_fault to 1 and fan{n}_input with +misleading value. + +Add check for fan fault prior return speed value and return zero if +fault is detected. + +Fixes: 65afb4c8e7e4 ("hwmon: (mlxreg-fan) Add support for Mellanox FAN driver") +Signed-off-by: Vadim Pasternak +Link: https://lore.kernel.org/r/20230212145730.24247-1-vadimp@nvidia.com +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/mlxreg-fan.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/hwmon/mlxreg-fan.c b/drivers/hwmon/mlxreg-fan.c +index 89fe7b9fe26be..6ecc45c06849c 100644 +--- a/drivers/hwmon/mlxreg-fan.c ++++ b/drivers/hwmon/mlxreg-fan.c +@@ -151,6 +151,12 @@ mlxreg_fan_read(struct device *dev, enum hwmon_sensor_types type, u32 attr, + if (err) + return err; + ++ if (MLXREG_FAN_GET_FAULT(regval, tacho->mask)) { ++ /* FAN is broken - return zero for FAN speed. */ ++ *val = 0; ++ return 0; ++ } ++ + *val = MLXREG_FAN_GET_RPM(regval, fan->divider, + fan->samples); + break; +-- +2.39.2 + diff --git a/queue-5.15/i2c-designware-fix-i2c_dw_clk_rate-return-size-to-be.patch b/queue-5.15/i2c-designware-fix-i2c_dw_clk_rate-return-size-to-be.patch new file mode 100644 index 00000000000..de58c3415aa --- /dev/null +++ b/queue-5.15/i2c-designware-fix-i2c_dw_clk_rate-return-size-to-be.patch @@ -0,0 +1,52 @@ +From e9332f5b51db3d0731fb751e85d367857745b216 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Dec 2022 17:23:45 +0000 +Subject: i2c: designware: fix i2c_dw_clk_rate() return size to be u32 + +From: Hanna Hawa + +[ Upstream commit f2e1fa99550dd7a882229e2c2cd9ecab4ce773d0 ] + +Make i2c_dw_clk_rate() to return u32 instead of unsigned long, as the +function return the value of get_clk_rate_khz() which returns u32. + +Fixes: b33af11de236 ("i2c: designware: Do not require clock when SSCN and FFCN are provided") +Signed-off-by: Hanna Hawa +Reviewed-by: Andy Shevchenko +Acked-by: Jarkko Nikula +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-designware-common.c | 2 +- + drivers/i2c/busses/i2c-designware-core.h | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-designware-common.c b/drivers/i2c/busses/i2c-designware-common.c +index 4af65f101dac4..4e752321b95e0 100644 +--- a/drivers/i2c/busses/i2c-designware-common.c ++++ b/drivers/i2c/busses/i2c-designware-common.c +@@ -465,7 +465,7 @@ void __i2c_dw_disable(struct dw_i2c_dev *dev) + dev_warn(dev->dev, "timeout in disabling adapter\n"); + } + +-unsigned long i2c_dw_clk_rate(struct dw_i2c_dev *dev) ++u32 i2c_dw_clk_rate(struct dw_i2c_dev *dev) + { + /* + * Clock is not necessary if we got LCNT/HCNT values directly from +diff --git a/drivers/i2c/busses/i2c-designware-core.h b/drivers/i2c/busses/i2c-designware-core.h +index 9be81dbebede7..59b36e0644f31 100644 +--- a/drivers/i2c/busses/i2c-designware-core.h ++++ b/drivers/i2c/busses/i2c-designware-core.h +@@ -310,7 +310,7 @@ int i2c_dw_init_regmap(struct dw_i2c_dev *dev); + u32 i2c_dw_scl_hcnt(u32 ic_clk, u32 tSYMBOL, u32 tf, int cond, int offset); + u32 i2c_dw_scl_lcnt(u32 ic_clk, u32 tLOW, u32 tf, int offset); + int i2c_dw_set_sda_hold(struct dw_i2c_dev *dev); +-unsigned long i2c_dw_clk_rate(struct dw_i2c_dev *dev); ++u32 i2c_dw_clk_rate(struct dw_i2c_dev *dev); + int i2c_dw_prepare_clk(struct dw_i2c_dev *dev, bool prepare); + int i2c_dw_acquire_lock(struct dw_i2c_dev *dev); + void i2c_dw_release_lock(struct dw_i2c_dev *dev); +-- +2.39.2 + diff --git a/queue-5.15/ib-hfi1-fix-math-bugs-in-hfi1_can_pin_pages.patch b/queue-5.15/ib-hfi1-fix-math-bugs-in-hfi1_can_pin_pages.patch new file mode 100644 index 00000000000..3e183dc38da --- /dev/null +++ b/queue-5.15/ib-hfi1-fix-math-bugs-in-hfi1_can_pin_pages.patch @@ -0,0 +1,105 @@ +From 016c85c66bd6de7261696711334b609f92d036a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Feb 2023 11:56:23 -0500 +Subject: IB/hfi1: Fix math bugs in hfi1_can_pin_pages() + +From: Patrick Kelsey + +[ Upstream commit a0d198f79a8d033bd46605b779859193649f1f99 ] + +Fix arithmetic and logic errors in hfi1_can_pin_pages() that would allow +hfi1 to attempt pinning pages in cases where it should not because of +resource limits or lack of required capability. + +Fixes: 2c97ce4f3c29 ("IB/hfi1: Add pin query function") +Link: https://lore.kernel.org/r/167656658362.2223096.10954762619837718026.stgit@awfm-02.cornelisnetworks.com +Signed-off-by: Brendan Cunningham +Signed-off-by: Patrick Kelsey +Signed-off-by: Dennis Dalessandro +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hfi1/user_pages.c | 61 ++++++++++++++++--------- + 1 file changed, 40 insertions(+), 21 deletions(-) + +diff --git a/drivers/infiniband/hw/hfi1/user_pages.c b/drivers/infiniband/hw/hfi1/user_pages.c +index 7bce963e2ae69..36aaedc651456 100644 +--- a/drivers/infiniband/hw/hfi1/user_pages.c ++++ b/drivers/infiniband/hw/hfi1/user_pages.c +@@ -29,33 +29,52 @@ MODULE_PARM_DESC(cache_size, "Send and receive side cache size limit (in MB)"); + bool hfi1_can_pin_pages(struct hfi1_devdata *dd, struct mm_struct *mm, + u32 nlocked, u32 npages) + { +- unsigned long ulimit = rlimit(RLIMIT_MEMLOCK), pinned, cache_limit, +- size = (cache_size * (1UL << 20)); /* convert to bytes */ +- unsigned int usr_ctxts = +- dd->num_rcv_contexts - dd->first_dyn_alloc_ctxt; +- bool can_lock = capable(CAP_IPC_LOCK); ++ unsigned long ulimit_pages; ++ unsigned long cache_limit_pages; ++ unsigned int usr_ctxts; + + /* +- * Calculate per-cache size. The calculation below uses only a quarter +- * of the available per-context limit. This leaves space for other +- * pinning. Should we worry about shared ctxts? ++ * Perform RLIMIT_MEMLOCK based checks unless CAP_IPC_LOCK is present. + */ +- cache_limit = (ulimit / usr_ctxts) / 4; +- +- /* If ulimit isn't set to "unlimited" and is smaller than cache_size. */ +- if (ulimit != (-1UL) && size > cache_limit) +- size = cache_limit; +- +- /* Convert to number of pages */ +- size = DIV_ROUND_UP(size, PAGE_SIZE); +- +- pinned = atomic64_read(&mm->pinned_vm); ++ if (!capable(CAP_IPC_LOCK)) { ++ ulimit_pages = ++ DIV_ROUND_DOWN_ULL(rlimit(RLIMIT_MEMLOCK), PAGE_SIZE); ++ ++ /* ++ * Pinning these pages would exceed this process's locked memory ++ * limit. ++ */ ++ if (atomic64_read(&mm->pinned_vm) + npages > ulimit_pages) ++ return false; ++ ++ /* ++ * Only allow 1/4 of the user's RLIMIT_MEMLOCK to be used for HFI ++ * caches. This fraction is then equally distributed among all ++ * existing user contexts. Note that if RLIMIT_MEMLOCK is ++ * 'unlimited' (-1), the value of this limit will be > 2^42 pages ++ * (2^64 / 2^12 / 2^8 / 2^2). ++ * ++ * The effectiveness of this check may be reduced if I/O occurs on ++ * some user contexts before all user contexts are created. This ++ * check assumes that this process is the only one using this ++ * context (e.g., the corresponding fd was not passed to another ++ * process for concurrent access) as there is no per-context, ++ * per-process tracking of pinned pages. It also assumes that each ++ * user context has only one cache to limit. ++ */ ++ usr_ctxts = dd->num_rcv_contexts - dd->first_dyn_alloc_ctxt; ++ if (nlocked + npages > (ulimit_pages / usr_ctxts / 4)) ++ return false; ++ } + +- /* First, check the absolute limit against all pinned pages. */ +- if (pinned + npages >= ulimit && !can_lock) ++ /* ++ * Pinning these pages would exceed the size limit for this cache. ++ */ ++ cache_limit_pages = cache_size * (1024 * 1024) / PAGE_SIZE; ++ if (nlocked + npages > cache_limit_pages) + return false; + +- return ((nlocked + npages) <= size) || can_lock; ++ return true; + } + + int hfi1_acquire_user_pages(struct mm_struct *mm, unsigned long vaddr, size_t npages, +-- +2.39.2 + diff --git a/queue-5.15/ib-hfi1-fix-sdma.h-tx-num_descs-off-by-one-errors.patch b/queue-5.15/ib-hfi1-fix-sdma.h-tx-num_descs-off-by-one-errors.patch new file mode 100644 index 00000000000..9c8456a3f44 --- /dev/null +++ b/queue-5.15/ib-hfi1-fix-sdma.h-tx-num_descs-off-by-one-errors.patch @@ -0,0 +1,110 @@ +From db1592bfacca0f1462b0e0462306a79ff1848d83 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Feb 2023 11:56:28 -0500 +Subject: IB/hfi1: Fix sdma.h tx->num_descs off-by-one errors + +From: Patrick Kelsey + +[ Upstream commit fd8958efe8779d3db19c9124fce593ce681ac709 ] + +Fix three sources of error involving struct sdma_txreq.num_descs. + +When _extend_sdma_tx_descs() extends the descriptor array, it uses the +value of tx->num_descs to determine how many existing entries from the +tx's original, internal descriptor array to copy to the newly allocated +one. As this value was incremented before the call, the copy loop will +access one entry past the internal descriptor array, copying its contents +into the corresponding slot in the new array. + +If the call to _extend_sdma_tx_descs() fails, _pad_smda_tx_descs() then +invokes __sdma_tx_clean() which uses the value of tx->num_desc to drive a +loop that unmaps all descriptor entries in use. As this value was +incremented before the call, the unmap loop will invoke sdma_unmap_desc() +on a descriptor entry whose contents consist of whatever random data was +copied into it during (1), leading to cascading further calls into the +kernel and driver using arbitrary data. + +_sdma_close_tx() was using tx->num_descs instead of tx->num_descs - 1. + +Fix all of the above by: +- Only increment .num_descs after .descp is extended. +- Use .num_descs - 1 instead of .num_descs for last .descp entry. + +Fixes: f4d26d81ad7f ("staging/rdma/hfi1: Add coalescing support for SDMA TX descriptors") +Link: https://lore.kernel.org/r/167656658879.2223096.10026561343022570690.stgit@awfm-02.cornelisnetworks.com +Signed-off-by: Brendan Cunningham +Signed-off-by: Patrick Kelsey +Signed-off-by: Dennis Dalessandro +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hfi1/sdma.c | 4 ++-- + drivers/infiniband/hw/hfi1/sdma.h | 15 +++++++-------- + 2 files changed, 9 insertions(+), 10 deletions(-) + +diff --git a/drivers/infiniband/hw/hfi1/sdma.c b/drivers/infiniband/hw/hfi1/sdma.c +index a95b654f52540..8ed20392e9f0d 100644 +--- a/drivers/infiniband/hw/hfi1/sdma.c ++++ b/drivers/infiniband/hw/hfi1/sdma.c +@@ -3160,8 +3160,7 @@ int _pad_sdma_tx_descs(struct hfi1_devdata *dd, struct sdma_txreq *tx) + { + int rval = 0; + +- tx->num_desc++; +- if ((unlikely(tx->num_desc == tx->desc_limit))) { ++ if ((unlikely(tx->num_desc + 1 == tx->desc_limit))) { + rval = _extend_sdma_tx_descs(dd, tx); + if (rval) { + __sdma_txclean(dd, tx); +@@ -3174,6 +3173,7 @@ int _pad_sdma_tx_descs(struct hfi1_devdata *dd, struct sdma_txreq *tx) + SDMA_MAP_NONE, + dd->sdma_pad_phys, + sizeof(u32) - (tx->packet_len & (sizeof(u32) - 1))); ++ tx->num_desc++; + _sdma_close_tx(dd, tx); + return rval; + } +diff --git a/drivers/infiniband/hw/hfi1/sdma.h b/drivers/infiniband/hw/hfi1/sdma.h +index d8170fcbfbdd5..b023fc461bd51 100644 +--- a/drivers/infiniband/hw/hfi1/sdma.h ++++ b/drivers/infiniband/hw/hfi1/sdma.h +@@ -631,14 +631,13 @@ static inline void sdma_txclean(struct hfi1_devdata *dd, struct sdma_txreq *tx) + static inline void _sdma_close_tx(struct hfi1_devdata *dd, + struct sdma_txreq *tx) + { +- tx->descp[tx->num_desc].qw[0] |= +- SDMA_DESC0_LAST_DESC_FLAG; +- tx->descp[tx->num_desc].qw[1] |= +- dd->default_desc1; ++ u16 last_desc = tx->num_desc - 1; ++ ++ tx->descp[last_desc].qw[0] |= SDMA_DESC0_LAST_DESC_FLAG; ++ tx->descp[last_desc].qw[1] |= dd->default_desc1; + if (tx->flags & SDMA_TXREQ_F_URGENT) +- tx->descp[tx->num_desc].qw[1] |= +- (SDMA_DESC1_HEAD_TO_HOST_FLAG | +- SDMA_DESC1_INT_REQ_FLAG); ++ tx->descp[last_desc].qw[1] |= (SDMA_DESC1_HEAD_TO_HOST_FLAG | ++ SDMA_DESC1_INT_REQ_FLAG); + } + + static inline int _sdma_txadd_daddr( +@@ -655,6 +654,7 @@ static inline int _sdma_txadd_daddr( + type, + addr, len); + WARN_ON(len > tx->tlen); ++ tx->num_desc++; + tx->tlen -= len; + /* special cases for last */ + if (!tx->tlen) { +@@ -666,7 +666,6 @@ static inline int _sdma_txadd_daddr( + _sdma_close_tx(dd, tx); + } + } +- tx->num_desc++; + return rval; + } + +-- +2.39.2 + diff --git a/queue-5.15/ice-add-missing-checks-for-pf-vsi-type.patch b/queue-5.15/ice-add-missing-checks-for-pf-vsi-type.patch new file mode 100644 index 00000000000..c0afdf3a620 --- /dev/null +++ b/queue-5.15/ice-add-missing-checks-for-pf-vsi-type.patch @@ -0,0 +1,72 @@ +From 1a2cb25fb72a6d881fbe07eee2629be58219dcd0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Dec 2022 16:01:31 -0800 +Subject: ice: add missing checks for PF vsi type + +From: Jesse Brandeburg + +[ Upstream commit 6a8d013e904ad9a66706fcc926ec9993bed7d190 ] + +There were a few places we had missed checking the VSI type to make sure +it was definitely a PF VSI, before calling setup functions intended only +for the PF VSI. + +This doesn't fix any explicit bugs but cleans up the code in a few +places and removes one explicit != vsi->type check that can be +superseded by this code (it's a super set) + +Signed-off-by: Jesse Brandeburg +Tested-by: Gurucharan G (A Contingent worker at Intel) +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ice/ice_main.c | 17 ++++++++--------- + 1 file changed, 8 insertions(+), 9 deletions(-) + +diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c +index 6f674cd117d3d..13afbffc4758a 100644 +--- a/drivers/net/ethernet/intel/ice/ice_main.c ++++ b/drivers/net/ethernet/intel/ice/ice_main.c +@@ -5477,15 +5477,12 @@ int ice_vsi_cfg(struct ice_vsi *vsi) + { + int err; + +- if (vsi->netdev) { ++ if (vsi->netdev && vsi->type == ICE_VSI_PF) { + ice_set_rx_mode(vsi->netdev); + +- if (vsi->type != ICE_VSI_LB) { +- err = ice_vsi_vlan_setup(vsi); +- +- if (err) +- return err; +- } ++ err = ice_vsi_vlan_setup(vsi); ++ if (err) ++ return err; + } + ice_vsi_cfg_dcb_rings(vsi); + +@@ -5651,7 +5648,7 @@ static int ice_up_complete(struct ice_vsi *vsi) + + if (vsi->port_info && + (vsi->port_info->phy.link_info.link_info & ICE_AQ_LINK_UP) && +- vsi->netdev) { ++ vsi->netdev && vsi->type == ICE_VSI_PF) { + ice_print_link_msg(vsi, true); + netif_tx_start_all_queues(vsi->netdev); + netif_carrier_on(vsi->netdev); +@@ -5661,7 +5658,9 @@ static int ice_up_complete(struct ice_vsi *vsi) + * set the baseline so counters are ready when interface is up + */ + ice_update_eth_stats(vsi); +- ice_service_task_schedule(pf); ++ ++ if (vsi->type == ICE_VSI_PF) ++ ice_service_task_schedule(pf); + + return 0; + } +-- +2.39.2 + diff --git a/queue-5.15/ice-restrict-ptp-hw-clock-freq-adjustments-to-100-00.patch b/queue-5.15/ice-restrict-ptp-hw-clock-freq-adjustments-to-100-00.patch new file mode 100644 index 00000000000..ea2a50fe935 --- /dev/null +++ b/queue-5.15/ice-restrict-ptp-hw-clock-freq-adjustments-to-100-00.patch @@ -0,0 +1,57 @@ +From 77f5d39e4bab1b33ae9aaf2d9878f059328de7bc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Nov 2022 15:11:35 +0530 +Subject: ice: restrict PTP HW clock freq adjustments to 100, 000, 000 PPB + +From: Siddaraju DH + +[ Upstream commit 8aa4318c3a122b8670bc09af142de3872ca63b88 ] + +The PHY provides only 39b timestamp. With current timing +implementation, we discard lower 7b, leaving 32b timestamp. +The driver reconstructs the full 64b timestamp by correlating the +32b timestamp with cached_time for performance. The reconstruction +algorithm does both forward & backward interpolation. + +The 32b timeval has overflow duration of 2^32 counts ~= 4.23 second. +Due to interpolation in both direction, its now ~= 2.125 second +IIRC, going with at least half a duration, the cached_time is updated +with periodic thread of 1 second (worst-case) periodicity. + +But the 1 second periodicity is based on System-timer. +With PPB adjustments, if the 1588 timers increments at say +double the rate, (2s in-place of 1s), the Nyquist rate/half duration +sampling/update of cached_time with 1 second periodic thread will +lead to incorrect interpolations. + +Hence we should restrict the PPB adjustments to at least half duration +of cached_time update which translates to 500,000,000 PPB. + +Since the periodicity of the cached-time system thread can vary, +it is good to have some buffer time and considering practicality of +PPB adjustments, limiting the max_adj to 100,000,000. + +Signed-off-by: Siddaraju DH +Tested-by: Gurucharan G (A Contingent worker at Intel) +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ice/ice_ptp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/ice/ice_ptp.c b/drivers/net/ethernet/intel/ice/ice_ptp.c +index 9b50e9e6042a5..4d7aa49b7c147 100644 +--- a/drivers/net/ethernet/intel/ice/ice_ptp.c ++++ b/drivers/net/ethernet/intel/ice/ice_ptp.c +@@ -1090,7 +1090,7 @@ static void ice_ptp_set_caps(struct ice_pf *pf) + snprintf(info->name, sizeof(info->name) - 1, "%s-%s-clk", + dev_driver_string(dev), dev_name(dev)); + info->owner = THIS_MODULE; +- info->max_adj = 999999999; ++ info->max_adj = 100000000; + info->adjtime = ice_ptp_adjtime; + info->adjfine = ice_ptp_adjfine; + info->gettimex64 = ice_ptp_gettimex64; +-- +2.39.2 + diff --git a/queue-5.15/iio-light-tsl2563-do-not-hardcode-interrupt-trigger-.patch b/queue-5.15/iio-light-tsl2563-do-not-hardcode-interrupt-trigger-.patch new file mode 100644 index 00000000000..e47e4b138ec --- /dev/null +++ b/queue-5.15/iio-light-tsl2563-do-not-hardcode-interrupt-trigger-.patch @@ -0,0 +1,57 @@ +From 55f650957d32a4c8a9dcdb2e0393aad1db6f3cb0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Dec 2022 21:03:38 +0200 +Subject: iio: light: tsl2563: Do not hardcode interrupt trigger type + +From: Ferry Toth + +[ Upstream commit 027641b52fe37b64af61025298ce160c8b9b7a73 ] + +Instead of hardcoding IRQ trigger type to IRQF_TRIGGER_RAISING, +let's respect the settings specified in the firmware description. +To be compatible with the older firmware descriptions, if trigger +type is not set up there, we'll set it to default (raising edge). + +Fixes: 388be4883952 ("staging:iio: tsl2563 abi fixes and interrupt handling") +Fixes: bdab1001738f ("staging:iio:light:tsl2563 remove old style event registration.") +Signed-off-by: Ferry Toth +Signed-off-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20221207190348.9347-1-andriy.shevchenko@linux.intel.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/light/tsl2563.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/iio/light/tsl2563.c b/drivers/iio/light/tsl2563.c +index 5bf2bfbc5379e..af616352fe715 100644 +--- a/drivers/iio/light/tsl2563.c ++++ b/drivers/iio/light/tsl2563.c +@@ -705,6 +705,7 @@ static int tsl2563_probe(struct i2c_client *client, + struct iio_dev *indio_dev; + struct tsl2563_chip *chip; + struct tsl2563_platform_data *pdata = client->dev.platform_data; ++ unsigned long irq_flags; + int err = 0; + u8 id = 0; + +@@ -760,10 +761,15 @@ static int tsl2563_probe(struct i2c_client *client, + indio_dev->info = &tsl2563_info_no_irq; + + if (client->irq) { ++ irq_flags = irq_get_trigger_type(client->irq); ++ if (irq_flags == IRQF_TRIGGER_NONE) ++ irq_flags = IRQF_TRIGGER_RISING; ++ irq_flags |= IRQF_ONESHOT; ++ + err = devm_request_threaded_irq(&client->dev, client->irq, + NULL, + &tsl2563_event_handler, +- IRQF_TRIGGER_RISING | IRQF_ONESHOT, ++ irq_flags, + "tsl2563_event", + indio_dev); + if (err) { +-- +2.39.2 + diff --git a/queue-5.15/inet-fix-fast-path-in-__inet_hash_connect.patch b/queue-5.15/inet-fix-fast-path-in-__inet_hash_connect.patch new file mode 100644 index 00000000000..59e97b1192d --- /dev/null +++ b/queue-5.15/inet-fix-fast-path-in-__inet_hash_connect.patch @@ -0,0 +1,56 @@ +From 4548b4bcd02a59a295b05cea009b9d4e77dbb939 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 14 Jan 2023 13:11:41 +0000 +Subject: inet: fix fast path in __inet_hash_connect() + +From: Pietro Borrello + +[ Upstream commit 21cbd90a6fab7123905386985e3e4a80236b8714 ] + +__inet_hash_connect() has a fast path taken if sk_head(&tb->owners) is +equal to the sk parameter. +sk_head() returns the hlist_entry() with respect to the sk_node field. +However entries in the tb->owners list are inserted with respect to the +sk_bind_node field with sk_add_bind_node(). +Thus the check would never pass and the fast path never execute. + +This fast path has never been executed or tested as this bug seems +to be present since commit 1da177e4c3f4 ("Linux-2.6.12-rc2"), thus +remove it to reduce code complexity. + +Signed-off-by: Pietro Borrello +Reviewed-by: Kuniyuki Iwashima +Reviewed-by: Eric Dumazet +Link: https://lore.kernel.org/r/20230112-inet_hash_connect_bind_head-v3-1-b591fd212b93@diag.uniroma1.it +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/ipv4/inet_hashtables.c | 12 +----------- + 1 file changed, 1 insertion(+), 11 deletions(-) + +diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c +index 410b6b7998caf..39b3db5b61190 100644 +--- a/net/ipv4/inet_hashtables.c ++++ b/net/ipv4/inet_hashtables.c +@@ -760,17 +760,7 @@ int __inet_hash_connect(struct inet_timewait_death_row *death_row, + u32 index; + + if (port) { +- head = &hinfo->bhash[inet_bhashfn(net, port, +- hinfo->bhash_size)]; +- tb = inet_csk(sk)->icsk_bind_hash; +- spin_lock_bh(&head->lock); +- if (sk_head(&tb->owners) == sk && !sk->sk_bind_node.next) { +- inet_ehash_nolisten(sk, NULL, NULL); +- spin_unlock_bh(&head->lock); +- return 0; +- } +- spin_unlock(&head->lock); +- /* No definite answer... Walk to established hash table */ ++ local_bh_disable(); + ret = check_established(death_row, sk, port, NULL); + local_bh_enable(); + return ret; +-- +2.39.2 + diff --git a/queue-5.15/iommu-fix-error-unwind-in-iommu_group_alloc.patch b/queue-5.15/iommu-fix-error-unwind-in-iommu_group_alloc.patch new file mode 100644 index 00000000000..bb857fb3631 --- /dev/null +++ b/queue-5.15/iommu-fix-error-unwind-in-iommu_group_alloc.patch @@ -0,0 +1,53 @@ +From 1034ebbf6275327e2a633f4041f5892d68c4fac6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Feb 2023 21:21:16 -0400 +Subject: iommu: Fix error unwind in iommu_group_alloc() + +From: Jason Gunthorpe + +[ Upstream commit 4daa861174d56023c2068ddb03de0752f07fa199 ] + +If either iommu_group_grate_file() fails then the +iommu_group is leaked. + +Destroy it on these error paths. + +Found by kselftest/iommu/iommufd_fail_nth + +Fixes: bc7d12b91bd3 ("iommu: Implement reserved_regions iommu-group sysfs file") +Fixes: c52c72d3dee8 ("iommu: Add sysfs attribyte for domain type") +Signed-off-by: Jason Gunthorpe +Reviewed-by: Lu Baolu +Link: https://lore.kernel.org/r/0-v1-8f616bee028d+8b-iommu_group_alloc_leak_jgg@nvidia.com +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/iommu.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c +index 7f409e9eea4b7..d06dbf035c7c7 100644 +--- a/drivers/iommu/iommu.c ++++ b/drivers/iommu/iommu.c +@@ -656,12 +656,16 @@ struct iommu_group *iommu_group_alloc(void) + + ret = iommu_group_create_file(group, + &iommu_group_attr_reserved_regions); +- if (ret) ++ if (ret) { ++ kobject_put(group->devices_kobj); + return ERR_PTR(ret); ++ } + + ret = iommu_group_create_file(group, &iommu_group_attr_type); +- if (ret) ++ if (ret) { ++ kobject_put(group->devices_kobj); + return ERR_PTR(ret); ++ } + + pr_debug("Allocated group %d\n", group->id); + +-- +2.39.2 + diff --git a/queue-5.15/iommu-vt-d-allow-to-use-flush-queue-when-first-level.patch b/queue-5.15/iommu-vt-d-allow-to-use-flush-queue-when-first-level.patch new file mode 100644 index 00000000000..cb47da39375 --- /dev/null +++ b/queue-5.15/iommu-vt-d-allow-to-use-flush-queue-when-first-level.patch @@ -0,0 +1,73 @@ +From c861954b7b86ff7a459b359843c5659bc30a51cf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Feb 2023 21:08:16 +0800 +Subject: iommu/vt-d: Allow to use flush-queue when first level is default + +From: Tina Zhang + +[ Upstream commit 257ec290741924f8df678927d0dfecb1deebb9c5 ] + +Commit 29b32839725f ("iommu/vt-d: Do not use flush-queue when caching-mode +is on") forced default domains to be strict mode as long as IOMMU +caching-mode is flagged. The reason for doing this is that when vIOMMU +uses VT-d caching mode to synchronize shadowing page tables, the strict +mode shows better performance. + +However, this optimization is orthogonal to the first-level page table +because the Intel VT-d architecture does not define the caching mode of +the first-level page table. Refer to VT-d spec, section 6.1, "When the +CM field is reported as Set, any software updates to remapping +structures other than first-stage mapping (including updates to not- +present entries or present entries whose programming resulted in +translation faults) requires explicit invalidation of the caches." +Exclude the first-level page table from this optimization. + +Generally using first-stage translation in vIOMMU implies nested +translation enabled in the physical IOMMU. In this case the first-stage +page table is wholly captured by the guest. The vIOMMU only needs to +transfer the cache invalidations on vIOMMU to the physical IOMMU. +Forcing the default domain to strict mode will cause more frequent +cache invalidations, resulting in performance degradation. In a real +performance benchmark test measured by iperf receive, the performance +result on Sapphire Rapids 100Gb NIC shows: +w/ this fix ~51 Gbits/s, w/o this fix ~39.3 Gbits/s. + +Theoretically a first-stage IOMMU page table can still be shadowed +in absence of the caching mode, e.g. with host write-protecting guest +IOMMU page table to synchronize changed PTEs with the physical +IOMMU page table. In this case the shadowing overhead is decoupled +from emulating IOTLB invalidation then the overhead of the latter part +is solely decided by the frequency of IOTLB invalidations. Hence +allowing guest default dma domain to be lazy can also benefit the +overall performance by reducing the total VM-exit numbers. + +Fixes: 29b32839725f ("iommu/vt-d: Do not use flush-queue when caching-mode is on") +Reported-by: Sanjay Kumar +Suggested-by: Sanjay Kumar +Signed-off-by: Tina Zhang +Reviewed-by: Kevin Tian +Link: https://lore.kernel.org/r/20230214025618.2292889-1-tina.zhang@intel.com +Signed-off-by: Lu Baolu +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/intel/iommu.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c +index 850b0590c24a5..9666391240928 100644 +--- a/drivers/iommu/intel/iommu.c ++++ b/drivers/iommu/intel/iommu.c +@@ -4423,7 +4423,8 @@ int __init intel_iommu_init(void) + * is likely to be much lower than the overhead of synchronizing + * the virtual and physical IOMMU page-tables. + */ +- if (cap_caching_mode(iommu->cap)) { ++ if (cap_caching_mode(iommu->cap) && ++ !first_level_by_default(IOMMU_DOMAIN_DMA)) { + pr_info_once("IOMMU batching disallowed due to virtualization\n"); + iommu_set_dma_strict(); + } +-- +2.39.2 + diff --git a/queue-5.15/iommu-vt-d-check-fl-and-sl-capability-sanity-in-scal.patch b/queue-5.15/iommu-vt-d-check-fl-and-sl-capability-sanity-in-scal.patch new file mode 100644 index 00000000000..e1f0c6ac6d5 --- /dev/null +++ b/queue-5.15/iommu-vt-d-check-fl-and-sl-capability-sanity-in-scal.patch @@ -0,0 +1,71 @@ +From 41e77bdb6308aed9975ef44299495f077979a453 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Oct 2021 13:38:34 +0800 +Subject: iommu/vt-d: Check FL and SL capability sanity in scalable mode + +From: Lu Baolu + +[ Upstream commit 7afd7f6aa21a2929aff3a059b741933ee1819c6b ] + +An iommu domain could be allocated and mapped before it's attached to any +device. This requires that in scalable mode, when the domain is allocated, +the format (FL or SL) of the page table must be determined. In order to +achieve this, the platform should support consistent SL or FL capabilities +on all IOMMU's. This adds a check for this and aborts IOMMU probing if it +doesn't meet this requirement. + +Signed-off-by: Lu Baolu +Reviewed-by: Kevin Tian +Link: https://lore.kernel.org/r/20210926114535.923263-1-baolu.lu@linux.intel.com +Link: https://lore.kernel.org/r/20211014053839.727419-5-baolu.lu@linux.intel.com +Signed-off-by: Joerg Roedel +Stable-dep-of: 257ec2907419 ("iommu/vt-d: Allow to use flush-queue when first level is default") +Signed-off-by: Sasha Levin +--- + drivers/iommu/intel/cap_audit.c | 13 +++++++++++++ + drivers/iommu/intel/cap_audit.h | 1 + + 2 files changed, 14 insertions(+) + +diff --git a/drivers/iommu/intel/cap_audit.c b/drivers/iommu/intel/cap_audit.c +index b12e421a2f1ab..b39d223926a49 100644 +--- a/drivers/iommu/intel/cap_audit.c ++++ b/drivers/iommu/intel/cap_audit.c +@@ -163,6 +163,14 @@ static int cap_audit_static(struct intel_iommu *iommu, enum cap_audit_type type) + check_irq_capabilities(iommu, i); + } + ++ /* ++ * If the system is sane to support scalable mode, either SL or FL ++ * should be sane. ++ */ ++ if (intel_cap_smts_sanity() && ++ !intel_cap_flts_sanity() && !intel_cap_slts_sanity()) ++ return -EOPNOTSUPP; ++ + out: + rcu_read_unlock(); + return 0; +@@ -203,3 +211,8 @@ bool intel_cap_flts_sanity(void) + { + return ecap_flts(intel_iommu_ecap_sanity); + } ++ ++bool intel_cap_slts_sanity(void) ++{ ++ return ecap_slts(intel_iommu_ecap_sanity); ++} +diff --git a/drivers/iommu/intel/cap_audit.h b/drivers/iommu/intel/cap_audit.h +index 74cfccae0e817..d07b75938961f 100644 +--- a/drivers/iommu/intel/cap_audit.h ++++ b/drivers/iommu/intel/cap_audit.h +@@ -111,6 +111,7 @@ bool intel_cap_smts_sanity(void); + bool intel_cap_pasid_sanity(void); + bool intel_cap_nest_sanity(void); + bool intel_cap_flts_sanity(void); ++bool intel_cap_slts_sanity(void); + + static inline bool scalable_mode_support(void) + { +-- +2.39.2 + diff --git a/queue-5.15/iommu-vt-d-fix-error-handling-in-sva-enable-disable-.patch b/queue-5.15/iommu-vt-d-fix-error-handling-in-sva-enable-disable-.patch new file mode 100644 index 00000000000..cbde5d5960a --- /dev/null +++ b/queue-5.15/iommu-vt-d-fix-error-handling-in-sva-enable-disable-.patch @@ -0,0 +1,59 @@ +From e8f05cef9e6c0372e364d2c442e8a54677c55600 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Feb 2023 21:08:13 +0800 +Subject: iommu/vt-d: Fix error handling in sva enable/disable paths + +From: Lu Baolu + +[ Upstream commit 60b1daa3b168fbc648ae2ad28a84759223e49e18 ] + +Roll back all previous actions in error paths of intel_iommu_enable_sva() +and intel_iommu_disable_sva(). + +Fixes: d5b9e4bfe0d8 ("iommu/vt-d: Report prq to io-pgfault framework") +Reviewed-by: Kevin Tian +Signed-off-by: Lu Baolu +Link: https://lore.kernel.org/r/20230208051559.700109-1-baolu.lu@linux.intel.com +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/intel/iommu.c | 16 ++++++++++++---- + 1 file changed, 12 insertions(+), 4 deletions(-) + +diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c +index 751ff91af0ff6..5a4163f71a933 100644 +--- a/drivers/iommu/intel/iommu.c ++++ b/drivers/iommu/intel/iommu.c +@@ -5405,8 +5405,12 @@ static int intel_iommu_enable_sva(struct device *dev) + return -EINVAL; + + ret = iopf_queue_add_device(iommu->iopf_queue, dev); +- if (!ret) +- ret = iommu_register_device_fault_handler(dev, iommu_queue_iopf, dev); ++ if (ret) ++ return ret; ++ ++ ret = iommu_register_device_fault_handler(dev, iommu_queue_iopf, dev); ++ if (ret) ++ iopf_queue_remove_device(iommu->iopf_queue, dev); + + return ret; + } +@@ -5418,8 +5422,12 @@ static int intel_iommu_disable_sva(struct device *dev) + int ret; + + ret = iommu_unregister_device_fault_handler(dev); +- if (!ret) +- ret = iopf_queue_remove_device(iommu->iopf_queue, dev); ++ if (ret) ++ return ret; ++ ++ ret = iopf_queue_remove_device(iommu->iopf_queue, dev); ++ if (ret) ++ iommu_register_device_fault_handler(dev, iommu_queue_iopf, dev); + + return ret; + } +-- +2.39.2 + diff --git a/queue-5.15/iommu-vt-d-remove-duplicate-identity-domain-flag.patch b/queue-5.15/iommu-vt-d-remove-duplicate-identity-domain-flag.patch new file mode 100644 index 00000000000..bc3387a511d --- /dev/null +++ b/queue-5.15/iommu-vt-d-remove-duplicate-identity-domain-flag.patch @@ -0,0 +1,91 @@ +From b5e602e100119540abf3ebce537193490b3311e8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Oct 2021 13:38:33 +0800 +Subject: iommu/vt-d: Remove duplicate identity domain flag + +From: Lu Baolu + +[ Upstream commit b34380a6d767c54480a937951e6189a7f9699443 ] + +The iommu_domain data structure already has the "type" field to keep the +type of a domain. It's unnecessary to have the DOMAIN_FLAG_STATIC_IDENTITY +flag in the vt-d implementation. This cleans it up with no functionality +change. + +Signed-off-by: Lu Baolu +Reviewed-by: Kevin Tian +Link: https://lore.kernel.org/r/20210926114535.923263-1-baolu.lu@linux.intel.com +Link: https://lore.kernel.org/r/20211014053839.727419-4-baolu.lu@linux.intel.com +Signed-off-by: Joerg Roedel +Stable-dep-of: 257ec2907419 ("iommu/vt-d: Allow to use flush-queue when first level is default") +Signed-off-by: Sasha Levin +--- + drivers/iommu/intel/iommu.c | 9 ++++----- + include/linux/intel-iommu.h | 3 --- + 2 files changed, 4 insertions(+), 8 deletions(-) + +diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c +index 5a4163f71a933..6be0fb10cb8a9 100644 +--- a/drivers/iommu/intel/iommu.c ++++ b/drivers/iommu/intel/iommu.c +@@ -514,7 +514,7 @@ static inline void free_devinfo_mem(void *vaddr) + + static inline int domain_type_is_si(struct dmar_domain *domain) + { +- return domain->flags & DOMAIN_FLAG_STATIC_IDENTITY; ++ return domain->domain.type == IOMMU_DOMAIN_IDENTITY; + } + + static inline bool domain_use_first_level(struct dmar_domain *domain) +@@ -1922,7 +1922,7 @@ static bool first_level_by_default(void) + return scalable_mode_support() && intel_cap_flts_sanity(); + } + +-static struct dmar_domain *alloc_domain(int flags) ++static struct dmar_domain *alloc_domain(unsigned int type) + { + struct dmar_domain *domain; + +@@ -1932,7 +1932,6 @@ static struct dmar_domain *alloc_domain(int flags) + + memset(domain, 0, sizeof(*domain)); + domain->nid = NUMA_NO_NODE; +- domain->flags = flags; + if (first_level_by_default()) + domain->flags |= DOMAIN_FLAG_USE_FIRST_LEVEL; + domain->has_iotlb_device = false; +@@ -2753,7 +2752,7 @@ static int __init si_domain_init(int hw) + struct device *dev; + int i, nid, ret; + +- si_domain = alloc_domain(DOMAIN_FLAG_STATIC_IDENTITY); ++ si_domain = alloc_domain(IOMMU_DOMAIN_IDENTITY); + if (!si_domain) + return -EFAULT; + +@@ -4555,7 +4554,7 @@ static struct iommu_domain *intel_iommu_domain_alloc(unsigned type) + case IOMMU_DOMAIN_DMA: + case IOMMU_DOMAIN_DMA_FQ: + case IOMMU_DOMAIN_UNMANAGED: +- dmar_domain = alloc_domain(0); ++ dmar_domain = alloc_domain(type); + if (!dmar_domain) { + pr_err("Can't allocate dmar_domain\n"); + return NULL; +diff --git a/include/linux/intel-iommu.h b/include/linux/intel-iommu.h +index 81da7107e3bd0..0cf00786a164f 100644 +--- a/include/linux/intel-iommu.h ++++ b/include/linux/intel-iommu.h +@@ -515,9 +515,6 @@ struct context_entry { + u64 hi; + }; + +-/* si_domain contains mulitple devices */ +-#define DOMAIN_FLAG_STATIC_IDENTITY BIT(0) +- + /* + * When VT-d works in the scalable mode, it allows DMA translation to + * happen through either first level or second level page table. This +-- +2.39.2 + diff --git a/queue-5.15/iommu-vt-d-set-no-execute-enable-bit-in-pasid-table-.patch b/queue-5.15/iommu-vt-d-set-no-execute-enable-bit-in-pasid-table-.patch new file mode 100644 index 00000000000..297294a7c9a --- /dev/null +++ b/queue-5.15/iommu-vt-d-set-no-execute-enable-bit-in-pasid-table-.patch @@ -0,0 +1,55 @@ +From a5246d0673856e5b2d205da7e78e2f9232feac3a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 Jan 2023 15:37:33 +0800 +Subject: iommu/vt-d: Set No Execute Enable bit in PASID table entry + +From: Lu Baolu + +[ Upstream commit e06d24435596c8afcaa81c0c498f5b0ec4ee2b7c ] + +Setup No Execute Enable bit (Bit 133) of a scalable mode PASID entry. +This is to allow the use of XD bit of the first level page table. + +Fixes: ddf09b6d43ec ("iommu/vt-d: Setup pasid entries for iova over first level") +Signed-off-by: Ashok Raj +Signed-off-by: Lu Baolu +Reviewed-by: Kevin Tian +Link: https://lore.kernel.org/r/20230126095438.354205-1-baolu.lu@linux.intel.com +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/intel/pasid.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/drivers/iommu/intel/pasid.c b/drivers/iommu/intel/pasid.c +index 0060bd089dc7f..9a3dd55aaa1c2 100644 +--- a/drivers/iommu/intel/pasid.c ++++ b/drivers/iommu/intel/pasid.c +@@ -425,6 +425,16 @@ static inline void pasid_set_page_snoop(struct pasid_entry *pe, bool value) + pasid_set_bits(&pe->val[1], 1 << 23, value << 23); + } + ++/* ++ * Setup No Execute Enable bit (Bit 133) of a scalable mode PASID ++ * entry. It is required when XD bit of the first level page table ++ * entry is about to be set. ++ */ ++static inline void pasid_set_nxe(struct pasid_entry *pe) ++{ ++ pasid_set_bits(&pe->val[2], 1 << 5, 1 << 5); ++} ++ + /* + * Setup the Page Snoop (PGSNP) field (Bit 88) of a scalable mode + * PASID entry. +@@ -631,6 +641,7 @@ int intel_pasid_setup_first_level(struct intel_iommu *iommu, + pasid_set_domain_id(pte, did); + pasid_set_address_width(pte, iommu->agaw); + pasid_set_page_snoop(pte, !!ecap_smpwc(iommu->ecap)); ++ pasid_set_nxe(pte); + + /* Setup Present and PASID Granular Transfer Type: */ + pasid_set_translation_type(pte, PASID_ENTRY_PGTT_FL_ONLY); +-- +2.39.2 + diff --git a/queue-5.15/iommu-vt-d-use-second-level-for-gpa-hpa-translation.patch b/queue-5.15/iommu-vt-d-use-second-level-for-gpa-hpa-translation.patch new file mode 100644 index 00000000000..3c762a27979 --- /dev/null +++ b/queue-5.15/iommu-vt-d-use-second-level-for-gpa-hpa-translation.patch @@ -0,0 +1,69 @@ +From a0a0957698459620a047567ae51f8683f94f8797 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Oct 2021 13:38:35 +0800 +Subject: iommu/vt-d: Use second level for GPA->HPA translation + +From: Lu Baolu + +[ Upstream commit 032c5ee40e9fc68ed650a3f86f23259376ec93fc ] + +The IOMMU VT-d implementation uses the first level for GPA->HPA translation +by default. Although both the first level and the second level could handle +the DMA translation, they're different in some way. For example, the second +level translation has separate controls for the Access/Dirty page tracking. +With the first level translation, there's no such control. On the other +hand, the second level translation has the page-level control for forcing +snoop, but the first level only has global control with pasid granularity. + +This uses the second level for GPA->HPA translation so that we can provide +a consistent hardware interface for use cases like dirty page tracking for +live migration. + +Signed-off-by: Lu Baolu +Reviewed-by: Kevin Tian +Link: https://lore.kernel.org/r/20210926114535.923263-1-baolu.lu@linux.intel.com +Link: https://lore.kernel.org/r/20211014053839.727419-6-baolu.lu@linux.intel.com +Signed-off-by: Joerg Roedel +Stable-dep-of: 257ec2907419 ("iommu/vt-d: Allow to use flush-queue when first level is default") +Signed-off-by: Sasha Levin +--- + drivers/iommu/intel/iommu.c | 15 ++++++++++++--- + 1 file changed, 12 insertions(+), 3 deletions(-) + +diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c +index 6be0fb10cb8a9..850b0590c24a5 100644 +--- a/drivers/iommu/intel/iommu.c ++++ b/drivers/iommu/intel/iommu.c +@@ -1917,9 +1917,18 @@ static void free_dmar_iommu(struct intel_iommu *iommu) + * Check and return whether first level is used by default for + * DMA translation. + */ +-static bool first_level_by_default(void) ++static bool first_level_by_default(unsigned int type) + { +- return scalable_mode_support() && intel_cap_flts_sanity(); ++ /* Only SL is available in legacy mode */ ++ if (!scalable_mode_support()) ++ return false; ++ ++ /* Only level (either FL or SL) is available, just use it */ ++ if (intel_cap_flts_sanity() ^ intel_cap_slts_sanity()) ++ return intel_cap_flts_sanity(); ++ ++ /* Both levels are available, decide it based on domain type */ ++ return type != IOMMU_DOMAIN_UNMANAGED; + } + + static struct dmar_domain *alloc_domain(unsigned int type) +@@ -1932,7 +1941,7 @@ static struct dmar_domain *alloc_domain(unsigned int type) + + memset(domain, 0, sizeof(*domain)); + domain->nid = NUMA_NO_NODE; +- if (first_level_by_default()) ++ if (first_level_by_default(type)) + domain->flags |= DOMAIN_FLAG_USE_FIRST_LEVEL; + domain->has_iotlb_device = false; + INIT_LIST_HEAD(&domain->devices); +-- +2.39.2 + diff --git a/queue-5.15/irqchip-alpine-msi-fix-refcount-leak-in-alpine_msix_.patch b/queue-5.15/irqchip-alpine-msi-fix-refcount-leak-in-alpine_msix_.patch new file mode 100644 index 00000000000..39251f8ac55 --- /dev/null +++ b/queue-5.15/irqchip-alpine-msi-fix-refcount-leak-in-alpine_msix_.patch @@ -0,0 +1,37 @@ +From 3f22f9d7025a3752c5dcfcebf359065192bc3eb8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Jan 2023 12:28:10 +0400 +Subject: irqchip/alpine-msi: Fix refcount leak in alpine_msix_init_domains + +From: Miaoqian Lin + +[ Upstream commit 071d068b89e95d1b078aa6bbcb9d0961b77d6aa1 ] + +of_irq_find_parent() returns a node pointer with refcount incremented, +We should use of_node_put() on it when not needed anymore. +Add missing of_node_put() to avoid refcount leak. + +Fixes: e6b78f2c3e14 ("irqchip: Add the Alpine MSIX interrupt controller") +Signed-off-by: Miaoqian Lin +Signed-off-by: Marc Zyngier +Link: https://lore.kernel.org/r/20230102082811.3947760-1-linmq006@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/irqchip/irq-alpine-msi.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/irqchip/irq-alpine-msi.c b/drivers/irqchip/irq-alpine-msi.c +index 5ddb8e578ac6a..fc1ef7de37973 100644 +--- a/drivers/irqchip/irq-alpine-msi.c ++++ b/drivers/irqchip/irq-alpine-msi.c +@@ -199,6 +199,7 @@ static int alpine_msix_init_domains(struct alpine_msix_data *priv, + } + + gic_domain = irq_find_host(gic_node); ++ of_node_put(gic_node); + if (!gic_domain) { + pr_err("Failed to find the GIC domain\n"); + return -ENXIO; +-- +2.39.2 + diff --git a/queue-5.15/irqchip-fix-refcount-leak-in-platform_irqchip_probe.patch b/queue-5.15/irqchip-fix-refcount-leak-in-platform_irqchip_probe.patch new file mode 100644 index 00000000000..02d31c8c664 --- /dev/null +++ b/queue-5.15/irqchip-fix-refcount-leak-in-platform_irqchip_probe.patch @@ -0,0 +1,53 @@ +From f16065041be93f9833e000aa02dadadc2205099d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Jan 2023 16:13:18 +0400 +Subject: irqchip: Fix refcount leak in platform_irqchip_probe + +From: Miaoqian Lin + +[ Upstream commit 6caa5a2b78f5f53c433d3a3781e53325da22f0ac ] + +of_irq_find_parent() returns a node pointer with refcount incremented, +We should use of_node_put() on it when not needed anymore. +Add missing of_node_put() to avoid refcount leak. + +Fixes: f8410e626569 ("irqchip: Add IRQCHIP_PLATFORM_DRIVER_BEGIN/END and IRQCHIP_MATCH helper macros") +Signed-off-by: Miaoqian Lin +Signed-off-by: Marc Zyngier +Link: https://lore.kernel.org/r/20230102121318.3990586-1-linmq006@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/irqchip/irqchip.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/irqchip/irqchip.c b/drivers/irqchip/irqchip.c +index 3570f0a588c4b..7899607fbee8d 100644 +--- a/drivers/irqchip/irqchip.c ++++ b/drivers/irqchip/irqchip.c +@@ -38,8 +38,10 @@ int platform_irqchip_probe(struct platform_device *pdev) + struct device_node *par_np = of_irq_find_parent(np); + of_irq_init_cb_t irq_init_cb = of_device_get_match_data(&pdev->dev); + +- if (!irq_init_cb) ++ if (!irq_init_cb) { ++ of_node_put(par_np); + return -EINVAL; ++ } + + if (par_np == np) + par_np = NULL; +@@ -52,8 +54,10 @@ int platform_irqchip_probe(struct platform_device *pdev) + * interrupt controller. The actual initialization callback of this + * interrupt controller can check for specific domains as necessary. + */ +- if (par_np && !irq_find_matching_host(par_np, DOMAIN_BUS_ANY)) ++ if (par_np && !irq_find_matching_host(par_np, DOMAIN_BUS_ANY)) { ++ of_node_put(par_np); + return -EPROBE_DEFER; ++ } + + return irq_init_cb(np, par_np); + } +-- +2.39.2 + diff --git a/queue-5.15/irqchip-irq-bcm7120-l2-set-irq_level-for-level-trigg.patch b/queue-5.15/irqchip-irq-bcm7120-l2-set-irq_level-for-level-trigg.patch new file mode 100644 index 00000000000..94eac86ba47 --- /dev/null +++ b/queue-5.15/irqchip-irq-bcm7120-l2-set-irq_level-for-level-trigg.patch @@ -0,0 +1,44 @@ +From 3376d7fafab5b1d75a8434221eba9dd824836272 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Dec 2022 15:09:34 -0800 +Subject: irqchip/irq-bcm7120-l2: Set IRQ_LEVEL for level triggered interrupts +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Florian Fainelli + +[ Upstream commit 13a157b38ca5b4f9eed81442b8821db293755961 ] + +When support for the interrupt controller was added with a5042de2688d, +we forgot to update the flags to be set to contain IRQ_LEVEL. While the +flow handler is correct, the output from /proc/interrupts does not show +such interrupts as being level triggered when they are, correct that. + +Fixes: a5042de2688d ("irqchip: bcm7120-l2: Add Broadcom BCM7120-style Level 2 interrupt controller") +Signed-off-by: Florian Fainelli +Reviewed-by: Philippe Mathieu-Daudé +Signed-off-by: Marc Zyngier +Link: https://lore.kernel.org/r/20221216230934.2478345-3-f.fainelli@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/irqchip/irq-bcm7120-l2.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/irqchip/irq-bcm7120-l2.c b/drivers/irqchip/irq-bcm7120-l2.c +index f23d7651ea847..e91b38a6fc3df 100644 +--- a/drivers/irqchip/irq-bcm7120-l2.c ++++ b/drivers/irqchip/irq-bcm7120-l2.c +@@ -271,7 +271,8 @@ static int __init bcm7120_l2_intc_probe(struct device_node *dn, + flags |= IRQ_GC_BE_IO; + + ret = irq_alloc_domain_generic_chips(data->domain, IRQS_PER_WORD, 1, +- dn->full_name, handle_level_irq, clr, 0, flags); ++ dn->full_name, handle_level_irq, clr, ++ IRQ_LEVEL, flags); + if (ret) { + pr_err("failed to allocate generic irq chip\n"); + goto out_free_domain; +-- +2.39.2 + diff --git a/queue-5.15/irqchip-irq-brcmstb-l2-set-irq_level-for-level-trigg.patch b/queue-5.15/irqchip-irq-brcmstb-l2-set-irq_level-for-level-trigg.patch new file mode 100644 index 00000000000..2febade3f5c --- /dev/null +++ b/queue-5.15/irqchip-irq-brcmstb-l2-set-irq_level-for-level-trigg.patch @@ -0,0 +1,57 @@ +From cd98a1850c7a966287d9764bb0c38f92bcb25d08 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Dec 2022 15:09:33 -0800 +Subject: irqchip/irq-brcmstb-l2: Set IRQ_LEVEL for level triggered interrupts +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Florian Fainelli + +[ Upstream commit 94debe03e8afa1267f95a9001786a6aa506b9ff3 ] + +When support for the level triggered interrupt controller flavor was +added with c0ca7262088e, we forgot to update the flags to be set to +contain IRQ_LEVEL. While the flow handler is correct, the output from +/proc/interrupts does not show such interrupts as being level triggered +when they are, correct that. + +Fixes: c0ca7262088e ("irqchip/brcmstb-l2: Add support for the BCM7271 L2 controller") +Signed-off-by: Florian Fainelli +Reviewed-by: Philippe Mathieu-Daudé +Signed-off-by: Marc Zyngier +Link: https://lore.kernel.org/r/20221216230934.2478345-2-f.fainelli@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/irqchip/irq-brcmstb-l2.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/irqchip/irq-brcmstb-l2.c b/drivers/irqchip/irq-brcmstb-l2.c +index 8e0911561f2d1..fddea72272464 100644 +--- a/drivers/irqchip/irq-brcmstb-l2.c ++++ b/drivers/irqchip/irq-brcmstb-l2.c +@@ -161,6 +161,7 @@ static int __init brcmstb_l2_intc_of_init(struct device_node *np, + *init_params) + { + unsigned int clr = IRQ_NOREQUEST | IRQ_NOPROBE | IRQ_NOAUTOEN; ++ unsigned int set = 0; + struct brcmstb_l2_intc_data *data; + struct irq_chip_type *ct; + int ret; +@@ -208,9 +209,12 @@ static int __init brcmstb_l2_intc_of_init(struct device_node *np, + if (IS_ENABLED(CONFIG_MIPS) && IS_ENABLED(CONFIG_CPU_BIG_ENDIAN)) + flags |= IRQ_GC_BE_IO; + ++ if (init_params->handler == handle_level_irq) ++ set |= IRQ_LEVEL; ++ + /* Allocate a single Generic IRQ chip for this node */ + ret = irq_alloc_domain_generic_chips(data->domain, 32, 1, +- np->full_name, init_params->handler, clr, 0, flags); ++ np->full_name, init_params->handler, clr, set, flags); + if (ret) { + pr_err("failed to allocate generic irq chip\n"); + goto out_free_domain; +-- +2.39.2 + diff --git a/queue-5.15/irqchip-irq-mvebu-gicp-fix-refcount-leak-in-mvebu_gi.patch b/queue-5.15/irqchip-irq-mvebu-gicp-fix-refcount-leak-in-mvebu_gi.patch new file mode 100644 index 00000000000..e69d72997de --- /dev/null +++ b/queue-5.15/irqchip-irq-mvebu-gicp-fix-refcount-leak-in-mvebu_gi.patch @@ -0,0 +1,37 @@ +From d8d82b370e8e56b9d80002399d674fb356400967 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Jan 2023 12:42:08 +0400 +Subject: irqchip/irq-mvebu-gicp: Fix refcount leak in mvebu_gicp_probe + +From: Miaoqian Lin + +[ Upstream commit 9419e700021a393f67be36abd0c4f3acc6139041 ] + +of_irq_find_parent() returns a node pointer with refcount incremented, +We should use of_node_put() on it when not needed anymore. +Add missing of_node_put() to avoid refcount leak. + +Fixes: a68a63cb4dfc ("irqchip/irq-mvebu-gicp: Add new driver for Marvell GICP") +Signed-off-by: Miaoqian Lin +Signed-off-by: Marc Zyngier +Link: https://lore.kernel.org/r/20230102084208.3951758-1-linmq006@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/irqchip/irq-mvebu-gicp.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/irqchip/irq-mvebu-gicp.c b/drivers/irqchip/irq-mvebu-gicp.c +index fe88a782173dd..c43a345061d53 100644 +--- a/drivers/irqchip/irq-mvebu-gicp.c ++++ b/drivers/irqchip/irq-mvebu-gicp.c +@@ -221,6 +221,7 @@ static int mvebu_gicp_probe(struct platform_device *pdev) + } + + parent_domain = irq_find_host(irq_parent_dn); ++ of_node_put(irq_parent_dn); + if (!parent_domain) { + dev_err(&pdev->dev, "failed to find parent IRQ domain\n"); + return -ENODEV; +-- +2.39.2 + diff --git a/queue-5.15/irqchip-ti-sci-fix-refcount-leak-in-ti_sci_intr_irq_.patch b/queue-5.15/irqchip-ti-sci-fix-refcount-leak-in-ti_sci_intr_irq_.patch new file mode 100644 index 00000000000..9f0b5a0beee --- /dev/null +++ b/queue-5.15/irqchip-ti-sci-fix-refcount-leak-in-ti_sci_intr_irq_.patch @@ -0,0 +1,37 @@ +From 2dab07d316d5e6d4bc94f2a7ff757b24f1c26b3c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Jan 2023 12:56:10 +0400 +Subject: irqchip/ti-sci: Fix refcount leak in ti_sci_intr_irq_domain_probe + +From: Miaoqian Lin + +[ Upstream commit 02298b7bae12936ca313975b02e7f98b06670d37 ] + +of_irq_find_parent() returns a node pointer with refcount incremented, +We should use of_node_put() on it when not needed anymore. +Add missing of_node_put() to avoid refcount leak. + +Fixes: cd844b0715ce ("irqchip/ti-sci-intr: Add support for Interrupt Router driver") +Signed-off-by: Miaoqian Lin +Signed-off-by: Marc Zyngier +Link: https://lore.kernel.org/r/20230102085611.3955984-1-linmq006@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/irqchip/irq-ti-sci-intr.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/irqchip/irq-ti-sci-intr.c b/drivers/irqchip/irq-ti-sci-intr.c +index fe8fad22bcf96..020ddf29efb80 100644 +--- a/drivers/irqchip/irq-ti-sci-intr.c ++++ b/drivers/irqchip/irq-ti-sci-intr.c +@@ -236,6 +236,7 @@ static int ti_sci_intr_irq_domain_probe(struct platform_device *pdev) + } + + parent_domain = irq_find_host(parent_node); ++ of_node_put(parent_node); + if (!parent_domain) { + dev_err(dev, "Failed to find IRQ parent domain\n"); + return -ENODEV; +-- +2.39.2 + diff --git a/queue-5.15/iw_cxgb4-fix-potential-null-dereference-in-c4iw_fill.patch b/queue-5.15/iw_cxgb4-fix-potential-null-dereference-in-c4iw_fill.patch new file mode 100644 index 00000000000..723a83f5d69 --- /dev/null +++ b/queue-5.15/iw_cxgb4-fix-potential-null-dereference-in-c4iw_fill.patch @@ -0,0 +1,40 @@ +From 94394085155ab05e5ad7d7715de83ca5bd586b0d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Feb 2023 18:43:38 +0300 +Subject: iw_cxgb4: Fix potential NULL dereference in + c4iw_fill_res_cm_id_entry() + +From: Dan Carpenter + +[ Upstream commit 4ca446b127c568b59cb8d9748b6f70499624bb18 ] + +This condition needs to match the previous "if (epcp->state == LISTEN) {" +exactly to avoid a NULL dereference of either "listen_ep" or "ep". The +problem is that "epcp" has been re-assigned so just testing +"if (epcp->state == LISTEN) {" a second time is not sufficient. + +Fixes: 116aeb887371 ("iw_cxgb4: provide detailed provider-specific CM_ID information") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/Y+usKuWIKr4dimZh@kili +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/cxgb4/restrack.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/cxgb4/restrack.c b/drivers/infiniband/hw/cxgb4/restrack.c +index ff645b955a082..fd22c85d35f4f 100644 +--- a/drivers/infiniband/hw/cxgb4/restrack.c ++++ b/drivers/infiniband/hw/cxgb4/restrack.c +@@ -238,7 +238,7 @@ int c4iw_fill_res_cm_id_entry(struct sk_buff *msg, + if (rdma_nl_put_driver_u64_hex(msg, "history", epcp->history)) + goto err_cancel_table; + +- if (epcp->state == LISTEN) { ++ if (listen_ep) { + if (rdma_nl_put_driver_u32(msg, "stid", listen_ep->stid)) + goto err_cancel_table; + if (rdma_nl_put_driver_u32(msg, "backlog", listen_ep->backlog)) +-- +2.39.2 + diff --git a/queue-5.15/keys-asymmetric-fix-ecdsa-use-via-keyctl-uapi.patch b/queue-5.15/keys-asymmetric-fix-ecdsa-use-via-keyctl-uapi.patch new file mode 100644 index 00000000000..c2f165cff3f --- /dev/null +++ b/queue-5.15/keys-asymmetric-fix-ecdsa-use-via-keyctl-uapi.patch @@ -0,0 +1,65 @@ +From 627f727bf5884fdaede88fb05a5da5a8e5612e93 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Aug 2022 09:51:19 -0500 +Subject: KEYS: asymmetric: Fix ECDSA use via keyctl uapi + +From: Denis Kenzior + +[ Upstream commit 10de7b54293995368c52d9aa153f3e7a359f04a1 ] + +When support for ECDSA keys was added, constraints for data & signature +sizes were never updated. This makes it impossible to use such keys via +keyctl API from userspace. + +Update constraint on max_data_size to 64 bytes in order to support +SHA512-based signatures. Also update the signature length constraints +per ECDSA signature encoding described in RFC 5480. + +Fixes: 299f561a6693 ("x509: Add support for parsing x509 certs with ECDSA keys") +Signed-off-by: Denis Kenzior +Reviewed-by: Stefan Berger +Reviewed-by: Jarkko Sakkinen +Signed-off-by: Jarkko Sakkinen +Signed-off-by: Sasha Levin +--- + crypto/asymmetric_keys/public_key.c | 24 ++++++++++++++++++++++-- + 1 file changed, 22 insertions(+), 2 deletions(-) + +diff --git a/crypto/asymmetric_keys/public_key.c b/crypto/asymmetric_keys/public_key.c +index 2f8352e888602..eca5671ad3f22 100644 +--- a/crypto/asymmetric_keys/public_key.c ++++ b/crypto/asymmetric_keys/public_key.c +@@ -186,8 +186,28 @@ static int software_key_query(const struct kernel_pkey_params *params, + + len = crypto_akcipher_maxsize(tfm); + info->key_size = len * 8; +- info->max_data_size = len; +- info->max_sig_size = len; ++ ++ if (strncmp(pkey->pkey_algo, "ecdsa", 5) == 0) { ++ /* ++ * ECDSA key sizes are much smaller than RSA, and thus could ++ * operate on (hashed) inputs that are larger than key size. ++ * For example SHA384-hashed input used with secp256r1 ++ * based keys. Set max_data_size to be at least as large as ++ * the largest supported hash size (SHA512) ++ */ ++ info->max_data_size = 64; ++ ++ /* ++ * Verify takes ECDSA-Sig (described in RFC 5480) as input, ++ * which is actually 2 'key_size'-bit integers encoded in ++ * ASN.1. Account for the ASN.1 encoding overhead here. ++ */ ++ info->max_sig_size = 2 * (len + 3) + 2; ++ } else { ++ info->max_data_size = len; ++ info->max_sig_size = len; ++ } ++ + info->max_enc_size = len; + info->max_dec_size = len; + info->supported_ops = (KEYCTL_SUPPORTS_ENCRYPT | +-- +2.39.2 + diff --git a/queue-5.15/kobject-fix-slab-out-of-bounds-in-fill_kobj_path.patch b/queue-5.15/kobject-fix-slab-out-of-bounds-in-fill_kobj_path.patch new file mode 100644 index 00000000000..cf6bac1f5d4 --- /dev/null +++ b/queue-5.15/kobject-fix-slab-out-of-bounds-in-fill_kobj_path.patch @@ -0,0 +1,148 @@ +From 09e0ec1cbeea796f23eb4a66207f13e6eaaeba34 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Dec 2022 09:21:43 +0800 +Subject: kobject: Fix slab-out-of-bounds in fill_kobj_path() + +From: Wang Hai + +[ Upstream commit 3bb2a01caa813d3a1845d378bbe4169ef280d394 ] + +In kobject_get_path(), if kobj->name is changed between calls +get_kobj_path_length() and fill_kobj_path() and the length becomes +longer, then fill_kobj_path() will have an out-of-bounds bug. + +The actual current problem occurs when the ixgbe probe. + +In ixgbe_mii_bus_init(), if the length of netdev->dev.kobj.name +length becomes longer, out-of-bounds will occur. + +cpu0 cpu1 +ixgbe_probe + register_netdev(netdev) + netdev_register_kobject + device_add + kobject_uevent // Sending ADD events + systemd-udevd // rename netdev + dev_change_name + device_rename + kobject_rename + ixgbe_mii_bus_init | + mdiobus_register | + __mdiobus_register | + device_register | + device_add | + kobject_uevent | + kobject_get_path | + len = get_kobj_path_length // old name | + path = kzalloc(len, gfp_mask); | + kobj->name = name; + /* name length becomes + * longer + */ + fill_kobj_path /* kobj path length is + * longer than path, + * resulting in out of + * bounds when filling path + */ + +This is the kasan report: + +================================================================== +BUG: KASAN: slab-out-of-bounds in fill_kobj_path+0x50/0xc0 +Write of size 7 at addr ff1100090573d1fd by task kworker/28:1/673 + + Workqueue: events work_for_cpu_fn + Call Trace: + + dump_stack_lvl+0x34/0x48 + print_address_description.constprop.0+0x86/0x1e7 + print_report+0x36/0x4f + kasan_report+0xad/0x130 + kasan_check_range+0x35/0x1c0 + memcpy+0x39/0x60 + fill_kobj_path+0x50/0xc0 + kobject_get_path+0x5a/0xc0 + kobject_uevent_env+0x140/0x460 + device_add+0x5c7/0x910 + __mdiobus_register+0x14e/0x490 + ixgbe_probe.cold+0x441/0x574 [ixgbe] + local_pci_probe+0x78/0xc0 + work_for_cpu_fn+0x26/0x40 + process_one_work+0x3b6/0x6a0 + worker_thread+0x368/0x520 + kthread+0x165/0x1a0 + ret_from_fork+0x1f/0x30 + +This reproducer triggers that bug: + +while: +do + rmmod ixgbe + sleep 0.5 + modprobe ixgbe + sleep 0.5 + +When calling fill_kobj_path() to fill path, if the name length of +kobj becomes longer, return failure and retry. This fixes the problem. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Wang Hai +Link: https://lore.kernel.org/r/20221220012143.52141-1-wanghai38@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + lib/kobject.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/lib/kobject.c b/lib/kobject.c +index 94ff7fd5d80bc..184a3dab26991 100644 +--- a/lib/kobject.c ++++ b/lib/kobject.c +@@ -144,7 +144,7 @@ static int get_kobj_path_length(const struct kobject *kobj) + return length; + } + +-static void fill_kobj_path(const struct kobject *kobj, char *path, int length) ++static int fill_kobj_path(const struct kobject *kobj, char *path, int length) + { + const struct kobject *parent; + +@@ -153,12 +153,16 @@ static void fill_kobj_path(const struct kobject *kobj, char *path, int length) + int cur = strlen(kobject_name(parent)); + /* back up enough to print this name with '/' */ + length -= cur; ++ if (length <= 0) ++ return -EINVAL; + memcpy(path + length, kobject_name(parent), cur); + *(path + --length) = '/'; + } + + pr_debug("kobject: '%s' (%p): %s: path = '%s'\n", kobject_name(kobj), + kobj, __func__, path); ++ ++ return 0; + } + + /** +@@ -173,13 +177,17 @@ char *kobject_get_path(const struct kobject *kobj, gfp_t gfp_mask) + char *path; + int len; + ++retry: + len = get_kobj_path_length(kobj); + if (len == 0) + return NULL; + path = kzalloc(len, gfp_mask); + if (!path) + return NULL; +- fill_kobj_path(kobj, path, len); ++ if (fill_kobj_path(kobj, path, len)) { ++ kfree(path); ++ goto retry; ++ } + + return path; + } +-- +2.39.2 + diff --git a/queue-5.15/kobject-modify-kobject_get_path-to-take-a-const.patch b/queue-5.15/kobject-modify-kobject_get_path-to-take-a-const.patch new file mode 100644 index 00000000000..e81cc317fcc --- /dev/null +++ b/queue-5.15/kobject-modify-kobject_get_path-to-take-a-const.patch @@ -0,0 +1,76 @@ +From f2893f113e357be42e59d1a54be64a4f3477eb5e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 1 Oct 2022 18:53:15 +0200 +Subject: kobject: modify kobject_get_path() to take a const * + +From: Greg Kroah-Hartman + +[ Upstream commit 33a0a1e3b3d17445832177981dc7a1c6a5b009f8 ] + +kobject_get_path() does not modify the kobject passed to it, so make the +pointer constant. + +Cc: "Rafael J. Wysocki" +Link: https://lore.kernel.org/r/20221001165315.2690141-1-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: 3bb2a01caa81 ("kobject: Fix slab-out-of-bounds in fill_kobj_path()") +Signed-off-by: Sasha Levin +--- + include/linux/kobject.h | 2 +- + lib/kobject.c | 10 +++++----- + 2 files changed, 6 insertions(+), 6 deletions(-) + +diff --git a/include/linux/kobject.h b/include/linux/kobject.h +index ea30529fba08a..d38916e598a59 100644 +--- a/include/linux/kobject.h ++++ b/include/linux/kobject.h +@@ -116,7 +116,7 @@ extern void kobject_put(struct kobject *kobj); + extern const void *kobject_namespace(struct kobject *kobj); + extern void kobject_get_ownership(struct kobject *kobj, + kuid_t *uid, kgid_t *gid); +-extern char *kobject_get_path(struct kobject *kobj, gfp_t flag); ++extern char *kobject_get_path(const struct kobject *kobj, gfp_t flag); + + /** + * kobject_has_children - Returns whether a kobject has children. +diff --git a/lib/kobject.c b/lib/kobject.c +index ea53b30cf4837..94ff7fd5d80bc 100644 +--- a/lib/kobject.c ++++ b/lib/kobject.c +@@ -126,10 +126,10 @@ static int create_dir(struct kobject *kobj) + return 0; + } + +-static int get_kobj_path_length(struct kobject *kobj) ++static int get_kobj_path_length(const struct kobject *kobj) + { + int length = 1; +- struct kobject *parent = kobj; ++ const struct kobject *parent = kobj; + + /* walk up the ancestors until we hit the one pointing to the + * root. +@@ -144,9 +144,9 @@ static int get_kobj_path_length(struct kobject *kobj) + return length; + } + +-static void fill_kobj_path(struct kobject *kobj, char *path, int length) ++static void fill_kobj_path(const struct kobject *kobj, char *path, int length) + { +- struct kobject *parent; ++ const struct kobject *parent; + + --length; + for (parent = kobj; parent; parent = parent->parent) { +@@ -168,7 +168,7 @@ static void fill_kobj_path(struct kobject *kobj, char *path, int length) + * + * Return: The newly allocated memory, caller must free with kfree(). + */ +-char *kobject_get_path(struct kobject *kobj, gfp_t gfp_mask) ++char *kobject_get_path(const struct kobject *kobj, gfp_t gfp_mask) + { + char *path; + int len; +-- +2.39.2 + diff --git a/queue-5.15/l2tp-avoid-possible-recursive-deadlock-in-l2tp_tunne.patch b/queue-5.15/l2tp-avoid-possible-recursive-deadlock-in-l2tp_tunne.patch new file mode 100644 index 00000000000..c424baf4813 --- /dev/null +++ b/queue-5.15/l2tp-avoid-possible-recursive-deadlock-in-l2tp_tunne.patch @@ -0,0 +1,302 @@ +From 95e7b04a7d0c8fbb0fa335f8c0aea6b4c328050f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Feb 2023 01:37:10 +0900 +Subject: l2tp: Avoid possible recursive deadlock in l2tp_tunnel_register() + +From: Shigeru Yoshida + +[ Upstream commit 9ca5e7ecab064f1f47da07f7c1ddf40e4bc0e5ac ] + +When a file descriptor of pppol2tp socket is passed as file descriptor +of UDP socket, a recursive deadlock occurs in l2tp_tunnel_register(). +This situation is reproduced by the following program: + +int main(void) +{ + int sock; + struct sockaddr_pppol2tp addr; + + sock = socket(AF_PPPOX, SOCK_DGRAM, PX_PROTO_OL2TP); + if (sock < 0) { + perror("socket"); + return 1; + } + + addr.sa_family = AF_PPPOX; + addr.sa_protocol = PX_PROTO_OL2TP; + addr.pppol2tp.pid = 0; + addr.pppol2tp.fd = sock; + addr.pppol2tp.addr.sin_family = PF_INET; + addr.pppol2tp.addr.sin_port = htons(0); + addr.pppol2tp.addr.sin_addr.s_addr = inet_addr("192.168.0.1"); + addr.pppol2tp.s_tunnel = 1; + addr.pppol2tp.s_session = 0; + addr.pppol2tp.d_tunnel = 0; + addr.pppol2tp.d_session = 0; + + if (connect(sock, (const struct sockaddr *)&addr, sizeof(addr)) < 0) { + perror("connect"); + return 1; + } + + return 0; +} + +This program causes the following lockdep warning: + + ============================================ + WARNING: possible recursive locking detected + 6.2.0-rc5-00205-gc96618275234 #56 Not tainted + -------------------------------------------- + repro/8607 is trying to acquire lock: + ffff8880213c8130 (sk_lock-AF_PPPOX){+.+.}-{0:0}, at: l2tp_tunnel_register+0x2b7/0x11c0 + + but task is already holding lock: + ffff8880213c8130 (sk_lock-AF_PPPOX){+.+.}-{0:0}, at: pppol2tp_connect+0xa82/0x1a30 + + other info that might help us debug this: + Possible unsafe locking scenario: + + CPU0 + ---- + lock(sk_lock-AF_PPPOX); + lock(sk_lock-AF_PPPOX); + + *** DEADLOCK *** + + May be due to missing lock nesting notation + + 1 lock held by repro/8607: + #0: ffff8880213c8130 (sk_lock-AF_PPPOX){+.+.}-{0:0}, at: pppol2tp_connect+0xa82/0x1a30 + + stack backtrace: + CPU: 0 PID: 8607 Comm: repro Not tainted 6.2.0-rc5-00205-gc96618275234 #56 + Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014 + Call Trace: + + dump_stack_lvl+0x100/0x178 + __lock_acquire.cold+0x119/0x3b9 + ? lockdep_hardirqs_on_prepare+0x410/0x410 + lock_acquire+0x1e0/0x610 + ? l2tp_tunnel_register+0x2b7/0x11c0 + ? lock_downgrade+0x710/0x710 + ? __fget_files+0x283/0x3e0 + lock_sock_nested+0x3a/0xf0 + ? l2tp_tunnel_register+0x2b7/0x11c0 + l2tp_tunnel_register+0x2b7/0x11c0 + ? sprintf+0xc4/0x100 + ? l2tp_tunnel_del_work+0x6b0/0x6b0 + ? debug_object_deactivate+0x320/0x320 + ? lockdep_init_map_type+0x16d/0x7a0 + ? lockdep_init_map_type+0x16d/0x7a0 + ? l2tp_tunnel_create+0x2bf/0x4b0 + ? l2tp_tunnel_create+0x3c6/0x4b0 + pppol2tp_connect+0x14e1/0x1a30 + ? pppol2tp_put_sk+0xd0/0xd0 + ? aa_sk_perm+0x2b7/0xa80 + ? aa_af_perm+0x260/0x260 + ? bpf_lsm_socket_connect+0x9/0x10 + ? pppol2tp_put_sk+0xd0/0xd0 + __sys_connect_file+0x14f/0x190 + __sys_connect+0x133/0x160 + ? __sys_connect_file+0x190/0x190 + ? lockdep_hardirqs_on+0x7d/0x100 + ? ktime_get_coarse_real_ts64+0x1b7/0x200 + ? ktime_get_coarse_real_ts64+0x147/0x200 + ? __audit_syscall_entry+0x396/0x500 + __x64_sys_connect+0x72/0xb0 + do_syscall_64+0x38/0xb0 + entry_SYSCALL_64_after_hwframe+0x63/0xcd + +This patch fixes the issue by getting/creating the tunnel before +locking the pppol2tp socket. + +Fixes: 0b2c59720e65 ("l2tp: close all race conditions in l2tp_tunnel_register()") +Cc: Cong Wang +Signed-off-by: Shigeru Yoshida +Reviewed-by: Guillaume Nault +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/l2tp/l2tp_ppp.c | 125 ++++++++++++++++++++++++-------------------- + 1 file changed, 67 insertions(+), 58 deletions(-) + +diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c +index bf35710127dd0..9cef8e080f644 100644 +--- a/net/l2tp/l2tp_ppp.c ++++ b/net/l2tp/l2tp_ppp.c +@@ -651,54 +651,22 @@ static int pppol2tp_tunnel_mtu(const struct l2tp_tunnel *tunnel) + return mtu - PPPOL2TP_HEADER_OVERHEAD; + } + +-/* connect() handler. Attach a PPPoX socket to a tunnel UDP socket +- */ +-static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr, +- int sockaddr_len, int flags) ++static struct l2tp_tunnel *pppol2tp_tunnel_get(struct net *net, ++ const struct l2tp_connect_info *info, ++ bool *new_tunnel) + { +- struct sock *sk = sock->sk; +- struct pppox_sock *po = pppox_sk(sk); +- struct l2tp_session *session = NULL; +- struct l2tp_connect_info info; + struct l2tp_tunnel *tunnel; +- struct pppol2tp_session *ps; +- struct l2tp_session_cfg cfg = { 0, }; +- bool drop_refcnt = false; +- bool drop_tunnel = false; +- bool new_session = false; +- bool new_tunnel = false; + int error; + +- error = pppol2tp_sockaddr_get_info(uservaddr, sockaddr_len, &info); +- if (error < 0) +- return error; ++ *new_tunnel = false; + +- lock_sock(sk); +- +- /* Check for already bound sockets */ +- error = -EBUSY; +- if (sk->sk_state & PPPOX_CONNECTED) +- goto end; +- +- /* We don't supporting rebinding anyway */ +- error = -EALREADY; +- if (sk->sk_user_data) +- goto end; /* socket is already attached */ +- +- /* Don't bind if tunnel_id is 0 */ +- error = -EINVAL; +- if (!info.tunnel_id) +- goto end; +- +- tunnel = l2tp_tunnel_get(sock_net(sk), info.tunnel_id); +- if (tunnel) +- drop_tunnel = true; ++ tunnel = l2tp_tunnel_get(net, info->tunnel_id); + + /* Special case: create tunnel context if session_id and + * peer_session_id is 0. Otherwise look up tunnel using supplied + * tunnel id. + */ +- if (!info.session_id && !info.peer_session_id) { ++ if (!info->session_id && !info->peer_session_id) { + if (!tunnel) { + struct l2tp_tunnel_cfg tcfg = { + .encap = L2TP_ENCAPTYPE_UDP, +@@ -707,40 +675,82 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr, + /* Prevent l2tp_tunnel_register() from trying to set up + * a kernel socket. + */ +- if (info.fd < 0) { +- error = -EBADF; +- goto end; +- } ++ if (info->fd < 0) ++ return ERR_PTR(-EBADF); + +- error = l2tp_tunnel_create(info.fd, +- info.version, +- info.tunnel_id, +- info.peer_tunnel_id, &tcfg, ++ error = l2tp_tunnel_create(info->fd, ++ info->version, ++ info->tunnel_id, ++ info->peer_tunnel_id, &tcfg, + &tunnel); + if (error < 0) +- goto end; ++ return ERR_PTR(error); + + l2tp_tunnel_inc_refcount(tunnel); +- error = l2tp_tunnel_register(tunnel, sock_net(sk), +- &tcfg); ++ error = l2tp_tunnel_register(tunnel, net, &tcfg); + if (error < 0) { + kfree(tunnel); +- goto end; ++ return ERR_PTR(error); + } +- drop_tunnel = true; +- new_tunnel = true; ++ ++ *new_tunnel = true; + } + } else { + /* Error if we can't find the tunnel */ +- error = -ENOENT; + if (!tunnel) +- goto end; ++ return ERR_PTR(-ENOENT); + + /* Error if socket is not prepped */ +- if (!tunnel->sock) +- goto end; ++ if (!tunnel->sock) { ++ l2tp_tunnel_dec_refcount(tunnel); ++ return ERR_PTR(-ENOENT); ++ } + } + ++ return tunnel; ++} ++ ++/* connect() handler. Attach a PPPoX socket to a tunnel UDP socket ++ */ ++static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr, ++ int sockaddr_len, int flags) ++{ ++ struct sock *sk = sock->sk; ++ struct pppox_sock *po = pppox_sk(sk); ++ struct l2tp_session *session = NULL; ++ struct l2tp_connect_info info; ++ struct l2tp_tunnel *tunnel; ++ struct pppol2tp_session *ps; ++ struct l2tp_session_cfg cfg = { 0, }; ++ bool drop_refcnt = false; ++ bool new_session = false; ++ bool new_tunnel = false; ++ int error; ++ ++ error = pppol2tp_sockaddr_get_info(uservaddr, sockaddr_len, &info); ++ if (error < 0) ++ return error; ++ ++ /* Don't bind if tunnel_id is 0 */ ++ if (!info.tunnel_id) ++ return -EINVAL; ++ ++ tunnel = pppol2tp_tunnel_get(sock_net(sk), &info, &new_tunnel); ++ if (IS_ERR(tunnel)) ++ return PTR_ERR(tunnel); ++ ++ lock_sock(sk); ++ ++ /* Check for already bound sockets */ ++ error = -EBUSY; ++ if (sk->sk_state & PPPOX_CONNECTED) ++ goto end; ++ ++ /* We don't supporting rebinding anyway */ ++ error = -EALREADY; ++ if (sk->sk_user_data) ++ goto end; /* socket is already attached */ ++ + if (tunnel->peer_tunnel_id == 0) + tunnel->peer_tunnel_id = info.peer_tunnel_id; + +@@ -841,8 +851,7 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr, + } + if (drop_refcnt) + l2tp_session_dec_refcount(session); +- if (drop_tunnel) +- l2tp_tunnel_dec_refcount(tunnel); ++ l2tp_tunnel_dec_refcount(tunnel); + release_sock(sk); + + return error; +-- +2.39.2 + diff --git a/queue-5.15/leds-led-class-add-missing-put_device-to-led_put.patch b/queue-5.15/leds-led-class-add-missing-put_device-to-led_put.patch new file mode 100644 index 00000000000..50db27683bd --- /dev/null +++ b/queue-5.15/leds-led-class-add-missing-put_device-to-led_put.patch @@ -0,0 +1,58 @@ +From d26d6276ce22efe890c31fde04ce38aab3874678 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Jan 2023 12:45:14 +0100 +Subject: leds: led-class: Add missing put_device() to led_put() + +From: Hans de Goede + +[ Upstream commit 445110941eb94709216363f9d807d2508e64abd7 ] + +led_put() is used to "undo" a successful of_led_get() call, +of_led_get() uses class_find_device_by_of_node() which returns +a reference to the device which must be free-ed with put_device() +when the caller is done with it. + +Add a put_device() call to led_put() to free the reference returned +by class_find_device_by_of_node(). + +And also add a put_device() in the error-exit case of try_module_get() +failing. + +Fixes: 699a8c7c4bd3 ("leds: Add of_led_get() and led_put()") +Reviewed-by: Andy Shevchenko +Reviewed-by: Linus Walleij +Signed-off-by: Hans de Goede +Signed-off-by: Lee Jones +Link: https://lore.kernel.org/r/20230120114524.408368-2-hdegoede@redhat.com +Signed-off-by: Sasha Levin +--- + drivers/leds/led-class.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/leds/led-class.c b/drivers/leds/led-class.c +index f4bb02f6e0428..6e88df4c87fa8 100644 +--- a/drivers/leds/led-class.c ++++ b/drivers/leds/led-class.c +@@ -241,8 +241,10 @@ struct led_classdev *of_led_get(struct device_node *np, int index) + + led_cdev = dev_get_drvdata(led_dev); + +- if (!try_module_get(led_cdev->dev->parent->driver->owner)) ++ if (!try_module_get(led_cdev->dev->parent->driver->owner)) { ++ put_device(led_cdev->dev); + return ERR_PTR(-ENODEV); ++ } + + return led_cdev; + } +@@ -255,6 +257,7 @@ EXPORT_SYMBOL_GPL(of_led_get); + void led_put(struct led_classdev *led_cdev) + { + module_put(led_cdev->dev->parent->driver->owner); ++ put_device(led_cdev->dev); + } + EXPORT_SYMBOL_GPL(led_put); + +-- +2.39.2 + diff --git a/queue-5.15/leds-led-core-fix-refcount-leak-in-of_led_get.patch b/queue-5.15/leds-led-core-fix-refcount-leak-in-of_led_get.patch new file mode 100644 index 00000000000..f79e5c83b23 --- /dev/null +++ b/queue-5.15/leds-led-core-fix-refcount-leak-in-of_led_get.patch @@ -0,0 +1,37 @@ +From e0c25878491fe207e6aca5b9122bdd3f3b7d5406 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Dec 2022 16:18:07 +0400 +Subject: leds: led-core: Fix refcount leak in of_led_get() + +From: Miaoqian Lin + +[ Upstream commit da1afe8e6099980fe1e2fd7436dca284af9d3f29 ] + +class_find_device_by_of_node() calls class_find_device(), it will take +the reference, use the put_device() to drop the reference when not need +anymore. + +Fixes: 699a8c7c4bd3 ("leds: Add of_led_get() and led_put()") +Signed-off-by: Miaoqian Lin +Signed-off-by: Lee Jones +Link: https://lore.kernel.org/r/20221220121807.1543790-1-linmq006@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/leds/led-class.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/leds/led-class.c b/drivers/leds/led-class.c +index 6e88df4c87fa8..1024b1562aafc 100644 +--- a/drivers/leds/led-class.c ++++ b/drivers/leds/led-class.c +@@ -235,6 +235,7 @@ struct led_classdev *of_led_get(struct device_node *np, int index) + + led_dev = class_find_device_by_of_node(leds_class, led_node); + of_node_put(led_node); ++ put_device(led_dev); + + if (!led_dev) + return ERR_PTR(-EPROBE_DEFER); +-- +2.39.2 + diff --git a/queue-5.15/lib-mpi-fix-buffer-overrun-when-sg-is-too-long.patch b/queue-5.15/lib-mpi-fix-buffer-overrun-when-sg-is-too-long.patch new file mode 100644 index 00000000000..7ca21006d22 --- /dev/null +++ b/queue-5.15/lib-mpi-fix-buffer-overrun-when-sg-is-too-long.patch @@ -0,0 +1,41 @@ +From 26ac7705bb81adf8a1bb8b1dffabb8677f1db38b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Dec 2022 15:27:39 +0100 +Subject: lib/mpi: Fix buffer overrun when SG is too long + +From: Herbert Xu + +[ Upstream commit 7361d1bc307b926cbca214ab67b641123c2d6357 ] + +The helper mpi_read_raw_from_sgl sets the number of entries in +the SG list according to nbytes. However, if the last entry +in the SG list contains more data than nbytes, then it may overrun +the buffer because it only allocates enough memory for nbytes. + +Fixes: 2d4d1eea540b ("lib/mpi: Add mpi sgl helpers") +Reported-by: Roberto Sassu +Signed-off-by: Herbert Xu +Reviewed-by: Eric Biggers +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + lib/mpi/mpicoder.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/lib/mpi/mpicoder.c b/lib/mpi/mpicoder.c +index 39c4c67310946..3cb6bd148fa9e 100644 +--- a/lib/mpi/mpicoder.c ++++ b/lib/mpi/mpicoder.c +@@ -504,7 +504,8 @@ MPI mpi_read_raw_from_sgl(struct scatterlist *sgl, unsigned int nbytes) + + while (sg_miter_next(&miter)) { + buff = miter.addr; +- len = miter.length; ++ len = min_t(unsigned, miter.length, nbytes); ++ nbytes -= len; + + for (x = 0; x < len; x++) { + a <<= 8; +-- +2.39.2 + diff --git a/queue-5.15/libbpf-fix-alen-calculation-in-libbpf_nla_dump_error.patch b/queue-5.15/libbpf-fix-alen-calculation-in-libbpf_nla_dump_error.patch new file mode 100644 index 00000000000..62eda9303c9 --- /dev/null +++ b/queue-5.15/libbpf-fix-alen-calculation-in-libbpf_nla_dump_error.patch @@ -0,0 +1,38 @@ +From ab0f41f19d2342c1ed29356dea487ad0283c2e1c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Feb 2023 01:12:01 +0100 +Subject: libbpf: Fix alen calculation in libbpf_nla_dump_errormsg() + +From: Ilya Leoshkevich + +[ Upstream commit 17bcd27a08a21397698edf143084d7c87ce17946 ] + +The code assumes that everything that comes after nlmsgerr are nlattrs. +When calculating their size, it does not account for the initial +nlmsghdr. This may lead to accessing uninitialized memory. + +Fixes: bbf48c18ee0c ("libbpf: add error reporting in XDP") +Signed-off-by: Ilya Leoshkevich +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20230210001210.395194-8-iii@linux.ibm.com +Signed-off-by: Sasha Levin +--- + tools/lib/bpf/nlattr.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/lib/bpf/nlattr.c b/tools/lib/bpf/nlattr.c +index f57e77a6e40fd..2dbe7b99f28f1 100644 +--- a/tools/lib/bpf/nlattr.c ++++ b/tools/lib/bpf/nlattr.c +@@ -178,7 +178,7 @@ int libbpf_nla_dump_errormsg(struct nlmsghdr *nlh) + hlen += nlmsg_len(&err->msg); + + attr = (struct nlattr *) ((void *) err + hlen); +- alen = nlh->nlmsg_len - hlen; ++ alen = (void *)nlh + nlh->nlmsg_len - (void *)attr; + + if (libbpf_nla_parse(tb, NLMSGERR_ATTR_MAX, attr, alen, + extack_policy) != 0) { +-- +2.39.2 + diff --git a/queue-5.15/libbpf-fix-btf__align_of-by-taking-into-account-fiel.patch b/queue-5.15/libbpf-fix-btf__align_of-by-taking-into-account-fiel.patch new file mode 100644 index 00000000000..f3d0ec0df11 --- /dev/null +++ b/queue-5.15/libbpf-fix-btf__align_of-by-taking-into-account-fiel.patch @@ -0,0 +1,59 @@ +From fdecec6fc075fbe7315c4bf34bf4c1a3de8fb428 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Dec 2022 13:15:03 -0800 +Subject: libbpf: Fix btf__align_of() by taking into account field offsets + +From: Andrii Nakryiko + +[ Upstream commit 25a4481b4136af7794e1df2d6c90ed2f354d60ce ] + +btf__align_of() is supposed to be return alignment requirement of +a requested BTF type. For STRUCT/UNION it doesn't always return correct +value, because it calculates alignment only based on field types. But +for packed structs this is not enough, we need to also check field +offsets and struct size. If field offset isn't aligned according to +field type's natural alignment, then struct must be packed. Similarly, +if struct size is not a multiple of struct's natural alignment, then +struct must be packed as well. + +This patch fixes this issue precisely by additionally checking these +conditions. + +Fixes: 3d208f4ca111 ("libbpf: Expose btf__align_of() API") +Signed-off-by: Andrii Nakryiko +Signed-off-by: Daniel Borkmann +Link: https://lore.kernel.org/bpf/20221212211505.558851-5-andrii@kernel.org +Signed-off-by: Sasha Levin +--- + tools/lib/bpf/btf.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +diff --git a/tools/lib/bpf/btf.c b/tools/lib/bpf/btf.c +index 3ed759f53e7c2..fd23095129782 100644 +--- a/tools/lib/bpf/btf.c ++++ b/tools/lib/bpf/btf.c +@@ -647,8 +647,21 @@ int btf__align_of(const struct btf *btf, __u32 id) + if (align <= 0) + return libbpf_err(align); + max_align = max(max_align, align); ++ ++ /* if field offset isn't aligned according to field ++ * type's alignment, then struct must be packed ++ */ ++ if (btf_member_bitfield_size(t, i) == 0 && ++ (m->offset % (8 * align)) != 0) ++ return 1; + } + ++ /* if struct/union size isn't a multiple of its alignment, ++ * then struct must be packed ++ */ ++ if ((t->size % max_align) != 0) ++ return 1; ++ + return max_align; + } + default: +-- +2.39.2 + diff --git a/queue-5.15/locking-rwsem-disable-preemption-in-all-down_read-an.patch b/queue-5.15/locking-rwsem-disable-preemption-in-all-down_read-an.patch new file mode 100644 index 00000000000..e093708be20 --- /dev/null +++ b/queue-5.15/locking-rwsem-disable-preemption-in-all-down_read-an.patch @@ -0,0 +1,135 @@ +From aecc333e3f3be69f50c1479efd8711031b23ff24 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 Jan 2023 19:36:26 -0500 +Subject: locking/rwsem: Disable preemption in all down_read*() and up_read() + code paths + +From: Waiman Long + +[ Upstream commit 3f5245538a1964ae186ab7e1636020a41aa63143 ] + +Commit: + + 91d2a812dfb9 ("locking/rwsem: Make handoff writer optimistically spin on owner") + +... assumes that when the owner field is changed to NULL, the lock will +become free soon. But commit: + + 48dfb5d2560d ("locking/rwsem: Disable preemption while trying for rwsem lock") + +... disabled preemption when acquiring rwsem for write. + +However, preemption has not yet been disabled when acquiring a read lock +on a rwsem. So a reader can add a RWSEM_READER_BIAS to count without +setting owner to signal a reader, got preempted out by a RT task which +then spins in the writer slowpath as owner remains NULL leading to live lock. + +One easy way to fix this problem is to disable preemption at all the +down_read*() and up_read() code paths as implemented in this patch. + +Fixes: 91d2a812dfb9 ("locking/rwsem: Make handoff writer optimistically spin on owner") +Reported-by: Mukesh Ojha +Suggested-by: Peter Zijlstra +Signed-off-by: Waiman Long +Signed-off-by: Ingo Molnar +Link: https://lore.kernel.org/r/20230126003628.365092-3-longman@redhat.com +Signed-off-by: Sasha Levin +--- + kernel/locking/rwsem.c | 30 ++++++++++++++++++++++++------ + 1 file changed, 24 insertions(+), 6 deletions(-) + +diff --git a/kernel/locking/rwsem.c b/kernel/locking/rwsem.c +index 73cff464dde00..bd1d714a7ea08 100644 +--- a/kernel/locking/rwsem.c ++++ b/kernel/locking/rwsem.c +@@ -1045,7 +1045,7 @@ rwsem_down_read_slowpath(struct rw_semaphore *sem, long count, unsigned int stat + /* Ordered by sem->wait_lock against rwsem_mark_wake(). */ + break; + } +- schedule(); ++ schedule_preempt_disabled(); + lockevent_inc(rwsem_sleep_reader); + } + +@@ -1224,14 +1224,20 @@ static struct rw_semaphore *rwsem_downgrade_wake(struct rw_semaphore *sem) + */ + static inline int __down_read_common(struct rw_semaphore *sem, int state) + { ++ int ret = 0; + long count; + ++ preempt_disable(); + if (!rwsem_read_trylock(sem, &count)) { +- if (IS_ERR(rwsem_down_read_slowpath(sem, count, state))) +- return -EINTR; ++ if (IS_ERR(rwsem_down_read_slowpath(sem, count, state))) { ++ ret = -EINTR; ++ goto out; ++ } + DEBUG_RWSEMS_WARN_ON(!is_rwsem_reader_owned(sem), sem); + } +- return 0; ++out: ++ preempt_enable(); ++ return ret; + } + + static inline void __down_read(struct rw_semaphore *sem) +@@ -1251,19 +1257,23 @@ static inline int __down_read_killable(struct rw_semaphore *sem) + + static inline int __down_read_trylock(struct rw_semaphore *sem) + { ++ int ret = 0; + long tmp; + + DEBUG_RWSEMS_WARN_ON(sem->magic != sem, sem); + ++ preempt_disable(); + tmp = atomic_long_read(&sem->count); + while (!(tmp & RWSEM_READ_FAILED_MASK)) { + if (atomic_long_try_cmpxchg_acquire(&sem->count, &tmp, + tmp + RWSEM_READER_BIAS)) { + rwsem_set_reader_owned(sem); +- return 1; ++ ret = 1; ++ break; + } + } +- return 0; ++ preempt_enable(); ++ return ret; + } + + /* +@@ -1305,6 +1315,7 @@ static inline void __up_read(struct rw_semaphore *sem) + DEBUG_RWSEMS_WARN_ON(sem->magic != sem, sem); + DEBUG_RWSEMS_WARN_ON(!is_rwsem_reader_owned(sem), sem); + ++ preempt_disable(); + rwsem_clear_reader_owned(sem); + tmp = atomic_long_add_return_release(-RWSEM_READER_BIAS, &sem->count); + DEBUG_RWSEMS_WARN_ON(tmp < 0, sem); +@@ -1313,6 +1324,7 @@ static inline void __up_read(struct rw_semaphore *sem) + clear_nonspinnable(sem); + rwsem_wake(sem); + } ++ preempt_enable(); + } + + /* +@@ -1630,6 +1642,12 @@ void down_read_non_owner(struct rw_semaphore *sem) + { + might_sleep(); + __down_read(sem); ++ /* ++ * The owner value for a reader-owned lock is mostly for debugging ++ * purpose only and is not critical to the correct functioning of ++ * rwsem. So it is perfectly fine to set it in a preempt-enabled ++ * context here. ++ */ + __rwsem_set_reader_owned(sem, NULL); + } + EXPORT_SYMBOL(down_read_non_owner); +-- +2.39.2 + diff --git a/queue-5.15/locking-rwsem-optimize-down_read_trylock-under-highl.patch b/queue-5.15/locking-rwsem-optimize-down_read_trylock-under-highl.patch new file mode 100644 index 00000000000..5cdd1ee3eaf --- /dev/null +++ b/queue-5.15/locking-rwsem-optimize-down_read_trylock-under-highl.patch @@ -0,0 +1,179 @@ +From b99aecd98e4ba3264108e4f92f60a7779d1fb1fc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Nov 2021 17:44:55 +0800 +Subject: locking/rwsem: Optimize down_read_trylock() under highly contended + case +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Muchun Song + +[ Upstream commit 14c24048841151548a3f4d9e218510c844c1b737 ] + +We found that a process with 10 thousnads threads has been encountered +a regression problem from Linux-v4.14 to Linux-v5.4. It is a kind of +workload which will concurrently allocate lots of memory in different +threads sometimes. In this case, we will see the down_read_trylock() +with a high hotspot. Therefore, we suppose that rwsem has a regression +at least since Linux-v5.4. In order to easily debug this problem, we +write a simply benchmark to create the similar situation lile the +following. + + ```c++ + #include + #include + #include + #include + + #include + #include + #include + #include + #include + + volatile int mutex; + + void trigger(int cpu, char* ptr, std::size_t sz) + { + cpu_set_t set; + CPU_ZERO(&set); + CPU_SET(cpu, &set); + assert(pthread_setaffinity_np(pthread_self(), sizeof(set), &set) == 0); + + while (mutex); + + for (std::size_t i = 0; i < sz; i += 4096) { + *ptr = '\0'; + ptr += 4096; + } + } + + int main(int argc, char* argv[]) + { + std::size_t sz = 100; + + if (argc > 1) + sz = atoi(argv[1]); + + auto nproc = std::thread::hardware_concurrency(); + std::vector thr; + sz <<= 30; + auto* ptr = mmap(nullptr, sz, PROT_READ | PROT_WRITE, MAP_ANON | + MAP_PRIVATE, -1, 0); + assert(ptr != MAP_FAILED); + char* cptr = static_cast(ptr); + auto run = sz / nproc; + run = (run >> 12) << 12; + + mutex = 1; + + for (auto i = 0U; i < nproc; ++i) { + thr.emplace_back(std::thread([i, cptr, run]() { trigger(i, cptr, run); })); + cptr += run; + } + + rusage usage_start; + getrusage(RUSAGE_SELF, &usage_start); + auto start = std::chrono::system_clock::now(); + + mutex = 0; + + for (auto& t : thr) + t.join(); + + rusage usage_end; + getrusage(RUSAGE_SELF, &usage_end); + auto end = std::chrono::system_clock::now(); + timeval utime; + timeval stime; + timersub(&usage_end.ru_utime, &usage_start.ru_utime, &utime); + timersub(&usage_end.ru_stime, &usage_start.ru_stime, &stime); + printf("usr: %ld.%06ld\n", utime.tv_sec, utime.tv_usec); + printf("sys: %ld.%06ld\n", stime.tv_sec, stime.tv_usec); + printf("real: %lu\n", + std::chrono::duration_cast(end - + start).count()); + + return 0; + } + ``` + +The functionality of above program is simply which creates `nproc` +threads and each of them are trying to touch memory (trigger page +fault) on different CPU. Then we will see the similar profile by +`perf top`. + + 25.55% [kernel] [k] down_read_trylock + 14.78% [kernel] [k] handle_mm_fault + 13.45% [kernel] [k] up_read + 8.61% [kernel] [k] clear_page_erms + 3.89% [kernel] [k] __do_page_fault + +The highest hot instruction, which accounts for about 92%, in +down_read_trylock() is cmpxchg like the following. + + 91.89 │ lock cmpxchg %rdx,(%rdi) + +Sice the problem is found by migrating from Linux-v4.14 to Linux-v5.4, +so we easily found that the commit ddb20d1d3aed ("locking/rwsem: Optimize +down_read_trylock()") caused the regression. The reason is that the +commit assumes the rwsem is not contended at all. But it is not always +true for mmap lock which could be contended with thousands threads. +So most threads almost need to run at least 2 times of "cmpxchg" to +acquire the lock. The overhead of atomic operation is higher than +non-atomic instructions, which caused the regression. + +By using the above benchmark, the real executing time on a x86-64 system +before and after the patch were: + + Before Patch After Patch + # of Threads real real reduced by + ------------ ------ ------ ---------- + 1 65,373 65,206 ~0.0% + 4 15,467 15,378 ~0.5% + 40 6,214 5,528 ~11.0% + +For the uncontended case, the new down_read_trylock() is the same as +before. For the contended cases, the new down_read_trylock() is faster +than before. The more contended, the more fast. + +Signed-off-by: Muchun Song +Signed-off-by: Peter Zijlstra (Intel) +Acked-by: Waiman Long +Link: https://lore.kernel.org/r/20211118094455.9068-1-songmuchun@bytedance.com +Stable-dep-of: 3f5245538a19 ("locking/rwsem: Disable preemption in all down_read*() and up_read() code paths") +Signed-off-by: Sasha Levin +--- + kernel/locking/rwsem.c | 11 ++++------- + 1 file changed, 4 insertions(+), 7 deletions(-) + +diff --git a/kernel/locking/rwsem.c b/kernel/locking/rwsem.c +index 4cc73e6f8974b..73cff464dde00 100644 +--- a/kernel/locking/rwsem.c ++++ b/kernel/locking/rwsem.c +@@ -1255,17 +1255,14 @@ static inline int __down_read_trylock(struct rw_semaphore *sem) + + DEBUG_RWSEMS_WARN_ON(sem->magic != sem, sem); + +- /* +- * Optimize for the case when the rwsem is not locked at all. +- */ +- tmp = RWSEM_UNLOCKED_VALUE; +- do { ++ tmp = atomic_long_read(&sem->count); ++ while (!(tmp & RWSEM_READ_FAILED_MASK)) { + if (atomic_long_try_cmpxchg_acquire(&sem->count, &tmp, +- tmp + RWSEM_READER_BIAS)) { ++ tmp + RWSEM_READER_BIAS)) { + rwsem_set_reader_owned(sem); + return 1; + } +- } while (!(tmp & RWSEM_READ_FAILED_MASK)); ++ } + return 0; + } + +-- +2.39.2 + diff --git a/queue-5.15/m68k-check-syscall_trace_enter-return-code.patch b/queue-5.15/m68k-check-syscall_trace_enter-return-code.patch new file mode 100644 index 00000000000..d1372c950cc --- /dev/null +++ b/queue-5.15/m68k-check-syscall_trace_enter-return-code.patch @@ -0,0 +1,72 @@ +From 15f959adb854afece6d2211650891b1cc843c9ca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Jan 2023 16:55:27 +1300 +Subject: m68k: Check syscall_trace_enter() return code + +From: Michael Schmitz + +[ Upstream commit 2ca8a1de4437f21562e57f9ac123914747a8e7a1 ] + +Check return code of syscall_trace_enter(), and skip syscall +if -1. Return code will be left at what had been set by +ptrace or seccomp (in regs->d0). + +No regression seen in testing with strace on ARAnyM. + +Signed-off-by: Michael Schmitz +Reviewed-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/20230112035529.13521-2-schmitzmic@gmail.com +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + arch/m68k/68000/entry.S | 2 ++ + arch/m68k/coldfire/entry.S | 2 ++ + arch/m68k/kernel/entry.S | 3 +++ + 3 files changed, 7 insertions(+) + +diff --git a/arch/m68k/68000/entry.S b/arch/m68k/68000/entry.S +index 997b549330156..7d63e2f1555a0 100644 +--- a/arch/m68k/68000/entry.S ++++ b/arch/m68k/68000/entry.S +@@ -45,6 +45,8 @@ do_trace: + jbsr syscall_trace_enter + RESTORE_SWITCH_STACK + addql #4,%sp ++ addql #1,%d0 ++ jeq ret_from_exception + movel %sp@(PT_OFF_ORIG_D0),%d1 + movel #-ENOSYS,%d0 + cmpl #NR_syscalls,%d1 +diff --git a/arch/m68k/coldfire/entry.S b/arch/m68k/coldfire/entry.S +index 9f337c70243a3..35104c5417ff4 100644 +--- a/arch/m68k/coldfire/entry.S ++++ b/arch/m68k/coldfire/entry.S +@@ -90,6 +90,8 @@ ENTRY(system_call) + jbsr syscall_trace_enter + RESTORE_SWITCH_STACK + addql #4,%sp ++ addql #1,%d0 ++ jeq ret_from_exception + movel %d3,%a0 + jbsr %a0@ + movel %d0,%sp@(PT_OFF_D0) /* save the return value */ +diff --git a/arch/m68k/kernel/entry.S b/arch/m68k/kernel/entry.S +index 9434fca68de5d..9f3663facaa0e 100644 +--- a/arch/m68k/kernel/entry.S ++++ b/arch/m68k/kernel/entry.S +@@ -184,9 +184,12 @@ do_trace_entry: + jbsr syscall_trace + RESTORE_SWITCH_STACK + addql #4,%sp ++ addql #1,%d0 | optimization for cmpil #-1,%d0 ++ jeq ret_from_syscall + movel %sp@(PT_OFF_ORIG_D0),%d0 + cmpl #NR_syscalls,%d0 + jcs syscall ++ jra ret_from_syscall + badsys: + movel #-ENOSYS,%sp@(PT_OFF_D0) + jra ret_from_syscall +-- +2.39.2 + diff --git a/queue-5.15/m68k-proc-hardware-should-depend-on-proc_fs.patch b/queue-5.15/m68k-proc-hardware-should-depend-on-proc_fs.patch new file mode 100644 index 00000000000..1158bac4a3c --- /dev/null +++ b/queue-5.15/m68k-proc-hardware-should-depend-on-proc_fs.patch @@ -0,0 +1,42 @@ +From 6368ddeb089ef305d72c6b74eda841ba922de03e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Feb 2023 17:08:25 -0800 +Subject: m68k: /proc/hardware should depend on PROC_FS + +From: Randy Dunlap + +[ Upstream commit 1e5b5df65af99013b4d31607ddb3ca5731dbe44d ] + +When CONFIG_PROC_FS is not set, there is a build error for an unused +function. Make PROC_HARDWARE depend on PROC_FS to prevent this error. + +In file included from ../arch/m68k/kernel/setup.c:3: +../arch/m68k/kernel/setup_mm.c:477:12: error: 'hardware_proc_show' defined but not used [-Werror=unused-function] + 477 | static int hardware_proc_show(struct seq_file *m, void *v) + | ^~~~~~~~~~~~~~~~~~ + +Fixes: 66d857b08b8c ("m68k: merge m68k and m68knommu arch directories") # v3.0 +Signed-off-by: Randy Dunlap +Reviewed-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/20230209010825.24136-1-rdunlap@infradead.org +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + arch/m68k/Kconfig.devices | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/m68k/Kconfig.devices b/arch/m68k/Kconfig.devices +index 6a87b4a5fcac2..e6e3efac18407 100644 +--- a/arch/m68k/Kconfig.devices ++++ b/arch/m68k/Kconfig.devices +@@ -19,6 +19,7 @@ config HEARTBEAT + # We have a dedicated heartbeat LED. :-) + config PROC_HARDWARE + bool "/proc/hardware support" ++ depends on PROC_FS + help + Say Y here to support the /proc/hardware file, which gives you + access to information about the machine you're running on, +-- +2.39.2 + diff --git a/queue-5.15/media-i2c-imx219-fix-binning-for-raw8-capture.patch b/queue-5.15/media-i2c-imx219-fix-binning-for-raw8-capture.patch new file mode 100644 index 00000000000..43abe5eb058 --- /dev/null +++ b/queue-5.15/media-i2c-imx219-fix-binning-for-raw8-capture.patch @@ -0,0 +1,180 @@ +From d18bb7987ad82224f6a0523bf22305a0f37b63ba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Jan 2023 09:16:23 +0100 +Subject: media: i2c: imx219: Fix binning for RAW8 capture + +From: Jai Luthra + +[ Upstream commit ef86447e775fb1f2ced00d4c7fff2c0a1c63f165 ] + +2x2 binning works fine for RAW10 capture, but for RAW8 1232p mode it +leads to corrupted frames [1][2]. + +Using the special 2x2 analog binning mode fixes the issue, but causes +artefacts for RAW10 1232p capture. So here we choose the binning mode +depending upon the frame format selected. + +As both binning modes work fine for 480p RAW8 and RAW10 capture, it can +share the same code path as 1232p for selecting binning mode. + +[1] https://forums.raspberrypi.com/viewtopic.php?t=332103 +[2] https://github.com/raspberrypi/libcamera-apps/issues/281 + +Fixes: 22da1d56e982 ("media: i2c: imx219: Add support for RAW8 bit bayer format") +Signed-off-by: Jai Luthra +Reviewed-by: Dave Stevenson +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/imx219.c | 57 ++++++++++++++++++++++++++++++++------ + 1 file changed, 49 insertions(+), 8 deletions(-) + +diff --git a/drivers/media/i2c/imx219.c b/drivers/media/i2c/imx219.c +index faa5dab3c2ec8..de1f0aa6fff4a 100644 +--- a/drivers/media/i2c/imx219.c ++++ b/drivers/media/i2c/imx219.c +@@ -89,6 +89,12 @@ + + #define IMX219_REG_ORIENTATION 0x0172 + ++/* Binning Mode */ ++#define IMX219_REG_BINNING_MODE 0x0174 ++#define IMX219_BINNING_NONE 0x0000 ++#define IMX219_BINNING_2X2 0x0101 ++#define IMX219_BINNING_2X2_ANALOG 0x0303 ++ + /* Test Pattern Control */ + #define IMX219_REG_TEST_PATTERN 0x0600 + #define IMX219_TEST_PATTERN_DISABLE 0 +@@ -143,6 +149,9 @@ struct imx219_mode { + + /* Default register values */ + struct imx219_reg_list reg_list; ++ ++ /* 2x2 binning is used */ ++ bool binning; + }; + + static const struct imx219_reg imx219_common_regs[] = { +@@ -212,8 +221,6 @@ static const struct imx219_reg mode_3280x2464_regs[] = { + {0x016d, 0xd0}, + {0x016e, 0x09}, + {0x016f, 0xa0}, +- {0x0174, 0x00}, /* No-Binning */ +- {0x0175, 0x00}, + {0x0624, 0x0c}, + {0x0625, 0xd0}, + {0x0626, 0x09}, +@@ -233,8 +240,6 @@ static const struct imx219_reg mode_1920_1080_regs[] = { + {0x016d, 0x80}, + {0x016e, 0x04}, + {0x016f, 0x38}, +- {0x0174, 0x00}, /* No-Binning */ +- {0x0175, 0x00}, + {0x0624, 0x07}, + {0x0625, 0x80}, + {0x0626, 0x04}, +@@ -254,8 +259,6 @@ static const struct imx219_reg mode_1640_1232_regs[] = { + {0x016d, 0x68}, + {0x016e, 0x04}, + {0x016f, 0xd0}, +- {0x0174, 0x01}, /* x2-Binning */ +- {0x0175, 0x01}, + {0x0624, 0x06}, + {0x0625, 0x68}, + {0x0626, 0x04}, +@@ -275,8 +278,6 @@ static const struct imx219_reg mode_640_480_regs[] = { + {0x016d, 0x80}, + {0x016e, 0x01}, + {0x016f, 0xe0}, +- {0x0174, 0x03}, /* x2-analog binning */ +- {0x0175, 0x03}, + {0x0624, 0x06}, + {0x0625, 0x68}, + {0x0626, 0x04}, +@@ -390,6 +391,7 @@ static const struct imx219_mode supported_modes[] = { + .num_of_regs = ARRAY_SIZE(mode_3280x2464_regs), + .regs = mode_3280x2464_regs, + }, ++ .binning = false, + }, + { + /* 1080P 30fps cropped */ +@@ -406,6 +408,7 @@ static const struct imx219_mode supported_modes[] = { + .num_of_regs = ARRAY_SIZE(mode_1920_1080_regs), + .regs = mode_1920_1080_regs, + }, ++ .binning = false, + }, + { + /* 2x2 binned 30fps mode */ +@@ -422,6 +425,7 @@ static const struct imx219_mode supported_modes[] = { + .num_of_regs = ARRAY_SIZE(mode_1640_1232_regs), + .regs = mode_1640_1232_regs, + }, ++ .binning = true, + }, + { + /* 640x480 30fps mode */ +@@ -438,6 +442,7 @@ static const struct imx219_mode supported_modes[] = { + .num_of_regs = ARRAY_SIZE(mode_640_480_regs), + .regs = mode_640_480_regs, + }, ++ .binning = true, + }, + }; + +@@ -884,6 +889,35 @@ static int imx219_set_framefmt(struct imx219 *imx219) + return -EINVAL; + } + ++static int imx219_set_binning(struct imx219 *imx219) ++{ ++ if (!imx219->mode->binning) { ++ return imx219_write_reg(imx219, IMX219_REG_BINNING_MODE, ++ IMX219_REG_VALUE_16BIT, ++ IMX219_BINNING_NONE); ++ } ++ ++ switch (imx219->fmt.code) { ++ case MEDIA_BUS_FMT_SRGGB8_1X8: ++ case MEDIA_BUS_FMT_SGRBG8_1X8: ++ case MEDIA_BUS_FMT_SGBRG8_1X8: ++ case MEDIA_BUS_FMT_SBGGR8_1X8: ++ return imx219_write_reg(imx219, IMX219_REG_BINNING_MODE, ++ IMX219_REG_VALUE_16BIT, ++ IMX219_BINNING_2X2_ANALOG); ++ ++ case MEDIA_BUS_FMT_SRGGB10_1X10: ++ case MEDIA_BUS_FMT_SGRBG10_1X10: ++ case MEDIA_BUS_FMT_SGBRG10_1X10: ++ case MEDIA_BUS_FMT_SBGGR10_1X10: ++ return imx219_write_reg(imx219, IMX219_REG_BINNING_MODE, ++ IMX219_REG_VALUE_16BIT, ++ IMX219_BINNING_2X2); ++ } ++ ++ return -EINVAL; ++} ++ + static const struct v4l2_rect * + __imx219_get_pad_crop(struct imx219 *imx219, + struct v4l2_subdev_state *sd_state, +@@ -968,6 +1002,13 @@ static int imx219_start_streaming(struct imx219 *imx219) + goto err_rpm_put; + } + ++ ret = imx219_set_binning(imx219); ++ if (ret) { ++ dev_err(&client->dev, "%s failed to set binning: %d\n", ++ __func__, ret); ++ goto err_rpm_put; ++ } ++ + /* Apply customized values from user */ + ret = __v4l2_ctrl_handler_setup(imx219->sd.ctrl_handler); + if (ret) +-- +2.39.2 + diff --git a/queue-5.15/media-i2c-imx219-split-common-registers-from-mode-ta.patch b/queue-5.15/media-i2c-imx219-split-common-registers-from-mode-ta.patch new file mode 100644 index 00000000000..eb93d679637 --- /dev/null +++ b/queue-5.15/media-i2c-imx219-split-common-registers-from-mode-ta.patch @@ -0,0 +1,314 @@ +From 252b1ddffebc9bfe87eb3b81f651b829a5fd7494 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Dec 2022 13:07:53 +0100 +Subject: media: i2c: imx219: Split common registers from mode tables + +From: Adam Ford + +[ Upstream commit 8508455961d5a9e8907bcfd8dcd58f19d9b6ce47 ] + +There are four modes, and each mode has a table of registers. +Some of the registers are common to all modes, so create new +tables for these common registers to reduce duplicate code. + +Signed-off-by: Adam Ford +Reviewed-by: Dave Stevenson +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Stable-dep-of: ef86447e775f ("media: i2c: imx219: Fix binning for RAW8 capture") +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/imx219.c | 206 +++++++++++-------------------------- + 1 file changed, 59 insertions(+), 147 deletions(-) + +diff --git a/drivers/media/i2c/imx219.c b/drivers/media/i2c/imx219.c +index e10af3f74b38f..faa5dab3c2ec8 100644 +--- a/drivers/media/i2c/imx219.c ++++ b/drivers/media/i2c/imx219.c +@@ -145,23 +145,61 @@ struct imx219_mode { + struct imx219_reg_list reg_list; + }; + +-/* +- * Register sets lifted off the i2C interface from the Raspberry Pi firmware +- * driver. +- * 3280x2464 = mode 2, 1920x1080 = mode 1, 1640x1232 = mode 4, 640x480 = mode 7. +- */ +-static const struct imx219_reg mode_3280x2464_regs[] = { +- {0x0100, 0x00}, ++static const struct imx219_reg imx219_common_regs[] = { ++ {0x0100, 0x00}, /* Mode Select */ ++ ++ /* To Access Addresses 3000-5fff, send the following commands */ + {0x30eb, 0x0c}, + {0x30eb, 0x05}, + {0x300a, 0xff}, + {0x300b, 0xff}, + {0x30eb, 0x05}, + {0x30eb, 0x09}, +- {0x0114, 0x01}, +- {0x0128, 0x00}, +- {0x012a, 0x18}, ++ ++ /* PLL Clock Table */ ++ {0x0301, 0x05}, /* VTPXCK_DIV */ ++ {0x0303, 0x01}, /* VTSYSCK_DIV */ ++ {0x0304, 0x03}, /* PREPLLCK_VT_DIV 0x03 = AUTO set */ ++ {0x0305, 0x03}, /* PREPLLCK_OP_DIV 0x03 = AUTO set */ ++ {0x0306, 0x00}, /* PLL_VT_MPY */ ++ {0x0307, 0x39}, ++ {0x030b, 0x01}, /* OP_SYS_CLK_DIV */ ++ {0x030c, 0x00}, /* PLL_OP_MPY */ ++ {0x030d, 0x72}, ++ ++ /* Undocumented registers */ ++ {0x455e, 0x00}, ++ {0x471e, 0x4b}, ++ {0x4767, 0x0f}, ++ {0x4750, 0x14}, ++ {0x4540, 0x00}, ++ {0x47b4, 0x14}, ++ {0x4713, 0x30}, ++ {0x478b, 0x10}, ++ {0x478f, 0x10}, ++ {0x4793, 0x10}, ++ {0x4797, 0x0e}, ++ {0x479b, 0x0e}, ++ ++ /* Frame Bank Register Group "A" */ ++ {0x0162, 0x0d}, /* Line_Length_A */ ++ {0x0163, 0x78}, ++ {0x0170, 0x01}, /* X_ODD_INC_A */ ++ {0x0171, 0x01}, /* Y_ODD_INC_A */ ++ ++ /* Output setup registers */ ++ {0x0114, 0x01}, /* CSI 2-Lane Mode */ ++ {0x0128, 0x00}, /* DPHY Auto Mode */ ++ {0x012a, 0x18}, /* EXCK_Freq */ + {0x012b, 0x00}, ++}; ++ ++/* ++ * Register sets lifted off the i2C interface from the Raspberry Pi firmware ++ * driver. ++ * 3280x2464 = mode 2, 1920x1080 = mode 1, 1640x1232 = mode 4, 640x480 = mode 7. ++ */ ++static const struct imx219_reg mode_3280x2464_regs[] = { + {0x0164, 0x00}, + {0x0165, 0x00}, + {0x0166, 0x0c}, +@@ -174,53 +212,15 @@ static const struct imx219_reg mode_3280x2464_regs[] = { + {0x016d, 0xd0}, + {0x016e, 0x09}, + {0x016f, 0xa0}, +- {0x0170, 0x01}, +- {0x0171, 0x01}, +- {0x0174, 0x00}, ++ {0x0174, 0x00}, /* No-Binning */ + {0x0175, 0x00}, +- {0x0301, 0x05}, +- {0x0303, 0x01}, +- {0x0304, 0x03}, +- {0x0305, 0x03}, +- {0x0306, 0x00}, +- {0x0307, 0x39}, +- {0x030b, 0x01}, +- {0x030c, 0x00}, +- {0x030d, 0x72}, + {0x0624, 0x0c}, + {0x0625, 0xd0}, + {0x0626, 0x09}, + {0x0627, 0xa0}, +- {0x455e, 0x00}, +- {0x471e, 0x4b}, +- {0x4767, 0x0f}, +- {0x4750, 0x14}, +- {0x4540, 0x00}, +- {0x47b4, 0x14}, +- {0x4713, 0x30}, +- {0x478b, 0x10}, +- {0x478f, 0x10}, +- {0x4793, 0x10}, +- {0x4797, 0x0e}, +- {0x479b, 0x0e}, +- {0x0162, 0x0d}, +- {0x0163, 0x78}, + }; + + static const struct imx219_reg mode_1920_1080_regs[] = { +- {0x0100, 0x00}, +- {0x30eb, 0x05}, +- {0x30eb, 0x0c}, +- {0x300a, 0xff}, +- {0x300b, 0xff}, +- {0x30eb, 0x05}, +- {0x30eb, 0x09}, +- {0x0114, 0x01}, +- {0x0128, 0x00}, +- {0x012a, 0x18}, +- {0x012b, 0x00}, +- {0x0162, 0x0d}, +- {0x0163, 0x78}, + {0x0164, 0x02}, + {0x0165, 0xa8}, + {0x0166, 0x0a}, +@@ -233,49 +233,15 @@ static const struct imx219_reg mode_1920_1080_regs[] = { + {0x016d, 0x80}, + {0x016e, 0x04}, + {0x016f, 0x38}, +- {0x0170, 0x01}, +- {0x0171, 0x01}, +- {0x0174, 0x00}, ++ {0x0174, 0x00}, /* No-Binning */ + {0x0175, 0x00}, +- {0x0301, 0x05}, +- {0x0303, 0x01}, +- {0x0304, 0x03}, +- {0x0305, 0x03}, +- {0x0306, 0x00}, +- {0x0307, 0x39}, +- {0x030b, 0x01}, +- {0x030c, 0x00}, +- {0x030d, 0x72}, + {0x0624, 0x07}, + {0x0625, 0x80}, + {0x0626, 0x04}, + {0x0627, 0x38}, +- {0x455e, 0x00}, +- {0x471e, 0x4b}, +- {0x4767, 0x0f}, +- {0x4750, 0x14}, +- {0x4540, 0x00}, +- {0x47b4, 0x14}, +- {0x4713, 0x30}, +- {0x478b, 0x10}, +- {0x478f, 0x10}, +- {0x4793, 0x10}, +- {0x4797, 0x0e}, +- {0x479b, 0x0e}, + }; + + static const struct imx219_reg mode_1640_1232_regs[] = { +- {0x0100, 0x00}, +- {0x30eb, 0x0c}, +- {0x30eb, 0x05}, +- {0x300a, 0xff}, +- {0x300b, 0xff}, +- {0x30eb, 0x05}, +- {0x30eb, 0x09}, +- {0x0114, 0x01}, +- {0x0128, 0x00}, +- {0x012a, 0x18}, +- {0x012b, 0x00}, + {0x0164, 0x00}, + {0x0165, 0x00}, + {0x0166, 0x0c}, +@@ -288,53 +254,15 @@ static const struct imx219_reg mode_1640_1232_regs[] = { + {0x016d, 0x68}, + {0x016e, 0x04}, + {0x016f, 0xd0}, +- {0x0170, 0x01}, +- {0x0171, 0x01}, +- {0x0174, 0x01}, ++ {0x0174, 0x01}, /* x2-Binning */ + {0x0175, 0x01}, +- {0x0301, 0x05}, +- {0x0303, 0x01}, +- {0x0304, 0x03}, +- {0x0305, 0x03}, +- {0x0306, 0x00}, +- {0x0307, 0x39}, +- {0x030b, 0x01}, +- {0x030c, 0x00}, +- {0x030d, 0x72}, + {0x0624, 0x06}, + {0x0625, 0x68}, + {0x0626, 0x04}, + {0x0627, 0xd0}, +- {0x455e, 0x00}, +- {0x471e, 0x4b}, +- {0x4767, 0x0f}, +- {0x4750, 0x14}, +- {0x4540, 0x00}, +- {0x47b4, 0x14}, +- {0x4713, 0x30}, +- {0x478b, 0x10}, +- {0x478f, 0x10}, +- {0x4793, 0x10}, +- {0x4797, 0x0e}, +- {0x479b, 0x0e}, +- {0x0162, 0x0d}, +- {0x0163, 0x78}, + }; + + static const struct imx219_reg mode_640_480_regs[] = { +- {0x0100, 0x00}, +- {0x30eb, 0x05}, +- {0x30eb, 0x0c}, +- {0x300a, 0xff}, +- {0x300b, 0xff}, +- {0x30eb, 0x05}, +- {0x30eb, 0x09}, +- {0x0114, 0x01}, +- {0x0128, 0x00}, +- {0x012a, 0x18}, +- {0x012b, 0x00}, +- {0x0162, 0x0d}, +- {0x0163, 0x78}, + {0x0164, 0x03}, + {0x0165, 0xe8}, + {0x0166, 0x08}, +@@ -347,35 +275,12 @@ static const struct imx219_reg mode_640_480_regs[] = { + {0x016d, 0x80}, + {0x016e, 0x01}, + {0x016f, 0xe0}, +- {0x0170, 0x01}, +- {0x0171, 0x01}, +- {0x0174, 0x03}, ++ {0x0174, 0x03}, /* x2-analog binning */ + {0x0175, 0x03}, +- {0x0301, 0x05}, +- {0x0303, 0x01}, +- {0x0304, 0x03}, +- {0x0305, 0x03}, +- {0x0306, 0x00}, +- {0x0307, 0x39}, +- {0x030b, 0x01}, +- {0x030c, 0x00}, +- {0x030d, 0x72}, + {0x0624, 0x06}, + {0x0625, 0x68}, + {0x0626, 0x04}, + {0x0627, 0xd0}, +- {0x455e, 0x00}, +- {0x471e, 0x4b}, +- {0x4767, 0x0f}, +- {0x4750, 0x14}, +- {0x4540, 0x00}, +- {0x47b4, 0x14}, +- {0x4713, 0x30}, +- {0x478b, 0x10}, +- {0x478f, 0x10}, +- {0x4793, 0x10}, +- {0x4797, 0x0e}, +- {0x479b, 0x0e}, + }; + + static const struct imx219_reg raw8_framefmt_regs[] = { +@@ -1041,6 +946,13 @@ static int imx219_start_streaming(struct imx219 *imx219) + if (ret < 0) + return ret; + ++ /* Send all registers that are common to all modes */ ++ ret = imx219_write_regs(imx219, imx219_common_regs, ARRAY_SIZE(imx219_common_regs)); ++ if (ret) { ++ dev_err(&client->dev, "%s failed to send mfg header\n", __func__); ++ goto err_rpm_put; ++ } ++ + /* Apply default values of current mode */ + reg_list = &imx219->mode->reg_list; + ret = imx219_write_regs(imx219, reg_list->regs, reg_list->num_of_regs); +-- +2.39.2 + diff --git a/queue-5.15/media-i2c-ov7670-0-instead-of-einval-was-returned.patch b/queue-5.15/media-i2c-ov7670-0-instead-of-einval-was-returned.patch new file mode 100644 index 00000000000..4b7dfda852e --- /dev/null +++ b/queue-5.15/media-i2c-ov7670-0-instead-of-einval-was-returned.patch @@ -0,0 +1,41 @@ +From c77ab260c59493e96a6b1861ff8dc6f068920cde Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Jan 2023 14:03:51 +0100 +Subject: media: i2c: ov7670: 0 instead of -EINVAL was returned + +From: Hans Verkuil + +[ Upstream commit 6a4c664539e6de9b32b65ddcf767ec1bcc1d7f8a ] + +If the media bus is unsupported, then return -EINVAL. Instead it +returned 'ret' which happened to be 0. + +This fixes a smatch warning: + +ov7670.c:1843 ov7670_parse_dt() warn: missing error code? 'ret' + +Signed-off-by: Hans Verkuil +Fixes: 01b8444828fc ("media: v4l2: i2c: ov7670: Implement OF mbus configuration") +Acked-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/ov7670.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/i2c/ov7670.c b/drivers/media/i2c/ov7670.c +index 1be2c0e5bdc15..23001ede138c1 100644 +--- a/drivers/media/i2c/ov7670.c ++++ b/drivers/media/i2c/ov7670.c +@@ -1841,7 +1841,7 @@ static int ov7670_parse_dt(struct device *dev, + + if (bus_cfg.bus_type != V4L2_MBUS_PARALLEL) { + dev_err(dev, "Unsupported media bus type\n"); +- return ret; ++ return -EINVAL; + } + info->mbus_config = bus_cfg.bus.parallel.flags; + +-- +2.39.2 + diff --git a/queue-5.15/media-i2c-ov772x-fix-memleak-in-ov772x_probe.patch b/queue-5.15/media-i2c-ov772x-fix-memleak-in-ov772x_probe.patch new file mode 100644 index 00000000000..6eb3d609bea --- /dev/null +++ b/queue-5.15/media-i2c-ov772x-fix-memleak-in-ov772x_probe.patch @@ -0,0 +1,94 @@ +From 8e030f316031f820eaf795b767035e644e780d46 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Dec 2022 09:06:25 +0100 +Subject: media: i2c: ov772x: Fix memleak in ov772x_probe() + +From: Yuan Can + +[ Upstream commit 7485edb2b6ca5960205c0a49bedfd09bba30e521 ] + +A memory leak was reported when testing ov772x with bpf mock device: + +AssertionError: unreferenced object 0xffff888109afa7a8 (size 8): + comm "python3", pid 279, jiffies 4294805921 (age 20.681s) + hex dump (first 8 bytes): + 80 22 88 15 81 88 ff ff ."...... + backtrace: + [<000000009990b438>] __kmalloc_node+0x44/0x1b0 + [<000000009e32f7d7>] kvmalloc_node+0x34/0x180 + [<00000000faf48134>] v4l2_ctrl_handler_init_class+0x11d/0x180 [videodev] + [<00000000da376937>] ov772x_probe+0x1c3/0x68c [ov772x] + [<000000003f0d225e>] i2c_device_probe+0x28d/0x680 + [<00000000e0b6db89>] really_probe+0x17c/0x3f0 + [<000000001b19fcee>] __driver_probe_device+0xe3/0x170 + [<0000000048370519>] driver_probe_device+0x49/0x120 + [<000000005ead07a0>] __device_attach_driver+0xf7/0x150 + [<0000000043f452b8>] bus_for_each_drv+0x114/0x180 + [<00000000358e5596>] __device_attach+0x1e5/0x2d0 + [<0000000043f83c5d>] bus_probe_device+0x126/0x140 + [<00000000ee0f3046>] device_add+0x810/0x1130 + [<00000000e0278184>] i2c_new_client_device+0x359/0x4f0 + [<0000000070baf34f>] of_i2c_register_device+0xf1/0x110 + [<00000000a9f2159d>] of_i2c_notify+0x100/0x160 +unreferenced object 0xffff888119825c00 (size 256): + comm "python3", pid 279, jiffies 4294805921 (age 20.681s) + hex dump (first 32 bytes): + 00 b4 a5 17 81 88 ff ff 00 5e 82 19 81 88 ff ff .........^...... + 10 5c 82 19 81 88 ff ff 10 5c 82 19 81 88 ff ff .\.......\...... + backtrace: + [<000000009990b438>] __kmalloc_node+0x44/0x1b0 + [<000000009e32f7d7>] kvmalloc_node+0x34/0x180 + [<0000000073d88e0b>] v4l2_ctrl_new.cold+0x19b/0x86f [videodev] + [<00000000b1f576fb>] v4l2_ctrl_new_std+0x16f/0x210 [videodev] + [<00000000caf7ac99>] ov772x_probe+0x1fa/0x68c [ov772x] + [<000000003f0d225e>] i2c_device_probe+0x28d/0x680 + [<00000000e0b6db89>] really_probe+0x17c/0x3f0 + [<000000001b19fcee>] __driver_probe_device+0xe3/0x170 + [<0000000048370519>] driver_probe_device+0x49/0x120 + [<000000005ead07a0>] __device_attach_driver+0xf7/0x150 + [<0000000043f452b8>] bus_for_each_drv+0x114/0x180 + [<00000000358e5596>] __device_attach+0x1e5/0x2d0 + [<0000000043f83c5d>] bus_probe_device+0x126/0x140 + [<00000000ee0f3046>] device_add+0x810/0x1130 + [<00000000e0278184>] i2c_new_client_device+0x359/0x4f0 + [<0000000070baf34f>] of_i2c_register_device+0xf1/0x110 + +The reason is that if priv->hdl.error is set, ov772x_probe() jumps to the +error_mutex_destroy without doing v4l2_ctrl_handler_free(), and all +resources allocated in v4l2_ctrl_handler_init() and v4l2_ctrl_new_std() +are leaked. + +Fixes: 1112babde214 ("media: i2c: Copy ov772x soc_camera sensor driver") +Signed-off-by: Yuan Can +Reviewed-by: Laurent Pinchart +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/ov772x.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/media/i2c/ov772x.c b/drivers/media/i2c/ov772x.c +index 78602a2f70b0f..e05b48c90faed 100644 +--- a/drivers/media/i2c/ov772x.c ++++ b/drivers/media/i2c/ov772x.c +@@ -1462,7 +1462,7 @@ static int ov772x_probe(struct i2c_client *client) + priv->subdev.ctrl_handler = &priv->hdl; + if (priv->hdl.error) { + ret = priv->hdl.error; +- goto error_mutex_destroy; ++ goto error_ctrl_free; + } + + priv->clk = clk_get(&client->dev, NULL); +@@ -1515,7 +1515,6 @@ static int ov772x_probe(struct i2c_client *client) + clk_put(priv->clk); + error_ctrl_free: + v4l2_ctrl_handler_free(&priv->hdl); +-error_mutex_destroy: + mutex_destroy(&priv->lock); + + return ret; +-- +2.39.2 + diff --git a/queue-5.15/media-imx-jpeg-apply-clk_bulk-api-instead-of-operati.patch b/queue-5.15/media-imx-jpeg-apply-clk_bulk-api-instead-of-operati.patch new file mode 100644 index 00000000000..606edabaa96 --- /dev/null +++ b/queue-5.15/media-imx-jpeg-apply-clk_bulk-api-instead-of-operati.patch @@ -0,0 +1,106 @@ +From 27ca28f1269134149ee2479343c74679fcb6d3f5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Jan 2023 10:47:02 +0100 +Subject: media: imx-jpeg: Apply clk_bulk api instead of operating specific clk + +From: Ming Qian + +[ Upstream commit 61fe43dc9f454bc3caa99dbdd8f5fa3ba813981a ] + +using the api of clk_bulk can simplify the code. +and the clock of the jpeg codec may be changed, +the clk_bulk api can be compatible with the future change. + +Fixes: 4c2e5156d9fa ("media: imx-jpeg: Add pm-runtime support for imx-jpeg") +Signed-off-by: Ming Qian +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/imx-jpeg/mxc-jpeg.c | 35 +++++----------------- + drivers/media/platform/imx-jpeg/mxc-jpeg.h | 4 +-- + 2 files changed, 10 insertions(+), 29 deletions(-) + +diff --git a/drivers/media/platform/imx-jpeg/mxc-jpeg.c b/drivers/media/platform/imx-jpeg/mxc-jpeg.c +index 984fcdfa0f098..e515325683a47 100644 +--- a/drivers/media/platform/imx-jpeg/mxc-jpeg.c ++++ b/drivers/media/platform/imx-jpeg/mxc-jpeg.c +@@ -2105,19 +2105,12 @@ static int mxc_jpeg_probe(struct platform_device *pdev) + jpeg->mode = mode; + + /* Get clocks */ +- jpeg->clk_ipg = devm_clk_get(dev, "ipg"); +- if (IS_ERR(jpeg->clk_ipg)) { +- dev_err(dev, "failed to get clock: ipg\n"); +- ret = PTR_ERR(jpeg->clk_ipg); +- goto err_clk; +- } +- +- jpeg->clk_per = devm_clk_get(dev, "per"); +- if (IS_ERR(jpeg->clk_per)) { +- dev_err(dev, "failed to get clock: per\n"); +- ret = PTR_ERR(jpeg->clk_per); ++ ret = devm_clk_bulk_get_all(&pdev->dev, &jpeg->clks); ++ if (ret < 0) { ++ dev_err(dev, "failed to get clock\n"); + goto err_clk; + } ++ jpeg->num_clks = ret; + + ret = mxc_jpeg_attach_pm_domains(jpeg); + if (ret < 0) { +@@ -2214,32 +2207,20 @@ static int mxc_jpeg_runtime_resume(struct device *dev) + struct mxc_jpeg_dev *jpeg = dev_get_drvdata(dev); + int ret; + +- ret = clk_prepare_enable(jpeg->clk_ipg); +- if (ret < 0) { +- dev_err(dev, "failed to enable clock: ipg\n"); +- goto err_ipg; +- } +- +- ret = clk_prepare_enable(jpeg->clk_per); ++ ret = clk_bulk_prepare_enable(jpeg->num_clks, jpeg->clks); + if (ret < 0) { +- dev_err(dev, "failed to enable clock: per\n"); +- goto err_per; ++ dev_err(dev, "failed to enable clock\n"); ++ return ret; + } + + return 0; +- +-err_per: +- clk_disable_unprepare(jpeg->clk_ipg); +-err_ipg: +- return ret; + } + + static int mxc_jpeg_runtime_suspend(struct device *dev) + { + struct mxc_jpeg_dev *jpeg = dev_get_drvdata(dev); + +- clk_disable_unprepare(jpeg->clk_ipg); +- clk_disable_unprepare(jpeg->clk_per); ++ clk_bulk_disable_unprepare(jpeg->num_clks, jpeg->clks); + + return 0; + } +diff --git a/drivers/media/platform/imx-jpeg/mxc-jpeg.h b/drivers/media/platform/imx-jpeg/mxc-jpeg.h +index 542993eb8d5b0..495000800d552 100644 +--- a/drivers/media/platform/imx-jpeg/mxc-jpeg.h ++++ b/drivers/media/platform/imx-jpeg/mxc-jpeg.h +@@ -112,8 +112,8 @@ struct mxc_jpeg_dev { + spinlock_t hw_lock; /* hardware access lock */ + unsigned int mode; + struct mutex lock; /* v4l2 ioctls serialization */ +- struct clk *clk_ipg; +- struct clk *clk_per; ++ struct clk_bulk_data *clks; ++ int num_clks; + struct platform_device *pdev; + struct device *dev; + void __iomem *base_reg; +-- +2.39.2 + diff --git a/queue-5.15/media-max9286-fix-memleak-in-max9286_v4l2_register.patch b/queue-5.15/media-max9286-fix-memleak-in-max9286_v4l2_register.patch new file mode 100644 index 00000000000..f7dc9d2286e --- /dev/null +++ b/queue-5.15/media-max9286-fix-memleak-in-max9286_v4l2_register.patch @@ -0,0 +1,66 @@ +From e0b2d9bb512ca8826eb93d3d35e212d29c57d13a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Dec 2022 14:05:55 +0100 +Subject: media: max9286: Fix memleak in max9286_v4l2_register() + +From: Shang XiaoJing + +[ Upstream commit 8636c5fc7658c7c6299fb8b352d24ea4b9ba99e2 ] + +There is a kmemleak when testing the media/i2c/max9286.c with bpf mock +device: + +kmemleak: 5 new suspected memory leaks (see /sys/kernel/debug/kmemleak) + +unreferenced object 0xffff88810defc400 (size 256): + comm "python3", pid 278, jiffies 4294737563 (age 31.978s) + hex dump (first 32 bytes): + 28 06 a7 0a 81 88 ff ff 00 fe 22 12 81 88 ff ff (........."..... + 10 c4 ef 0d 81 88 ff ff 10 c4 ef 0d 81 88 ff ff ................ + backtrace: + [<00000000191de6a7>] __kmalloc_node+0x44/0x1b0 + [<000000002f4912b7>] kvmalloc_node+0x34/0x180 + [<0000000057dc4cae>] v4l2_ctrl_new+0x325/0x10f0 [videodev] + [<0000000026030272>] v4l2_ctrl_new_std+0x16f/0x210 [videodev] + [<00000000f0d9ea2f>] max9286_probe+0x76e/0xbff [max9286] + [<00000000ea8f6455>] i2c_device_probe+0x28d/0x680 + [<0000000087529af3>] really_probe+0x17c/0x3f0 + [<00000000b08be526>] __driver_probe_device+0xe3/0x170 + [<000000004382edea>] driver_probe_device+0x49/0x120 + [<000000007bde528a>] __device_attach_driver+0xf7/0x150 + [<000000009f9c6ab4>] bus_for_each_drv+0x114/0x180 + [<00000000c8aaf588>] __device_attach+0x1e5/0x2d0 + [<0000000041cc06b9>] bus_probe_device+0x126/0x140 + [<000000002309860d>] device_add+0x810/0x1130 + [<000000002827bf98>] i2c_new_client_device+0x359/0x4f0 + [<00000000593bdc85>] of_i2c_register_device+0xf1/0x110 + +max9286_v4l2_register() calls v4l2_ctrl_new_std(), but won't free the +created v412_ctrl when fwnode_graph_get_endpoint_by_id() failed, which +causes the memleak. Call v4l2_ctrl_handler_free() to free the v412_ctrl. + +Fixes: 66d8c9d2422d ("media: i2c: Add MAX9286 driver") +Signed-off-by: Shang XiaoJing +Reviewed-by: Laurent Pinchart +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/max9286.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/media/i2c/max9286.c b/drivers/media/i2c/max9286.c +index ce943702ffe9c..b9513e93ac617 100644 +--- a/drivers/media/i2c/max9286.c ++++ b/drivers/media/i2c/max9286.c +@@ -928,6 +928,7 @@ static int max9286_v4l2_register(struct max9286_priv *priv) + err_put_node: + fwnode_handle_put(ep); + err_async: ++ v4l2_ctrl_handler_free(&priv->ctrls); + max9286_v4l2_notifier_unregister(priv); + + return ret; +-- +2.39.2 + diff --git a/queue-5.15/media-ov2740-fix-memleak-in-ov2740_init_controls.patch b/queue-5.15/media-ov2740-fix-memleak-in-ov2740_init_controls.patch new file mode 100644 index 00000000000..bd3fe63ba3c --- /dev/null +++ b/queue-5.15/media-ov2740-fix-memleak-in-ov2740_init_controls.patch @@ -0,0 +1,67 @@ +From a429bbe8e82d4068e7a03dabe4b68788d47d27d7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Dec 2022 08:59:37 +0100 +Subject: media: ov2740: Fix memleak in ov2740_init_controls() + +From: Shang XiaoJing + +[ Upstream commit 2d899592ed7829d0d5140853bac4d58742a6b8af ] + +There is a kmemleak when testing the media/i2c/ov2740.c with bpf mock +device: + +unreferenced object 0xffff8881090e19e0 (size 16): + comm "51-i2c-ov2740", pid 278, jiffies 4294781584 (age 23.613s) + hex dump (first 16 bytes): + 00 f3 7c 0b 81 88 ff ff 80 75 6a 09 81 88 ff ff ..|......uj..... + backtrace: + [<000000004e9fad8f>] __kmalloc_node+0x44/0x1b0 + [<0000000039c802f4>] kvmalloc_node+0x34/0x180 + [<000000009b8b5c63>] v4l2_ctrl_handler_init_class+0x11d/0x180 +[videodev] + [<0000000038644056>] ov2740_probe+0x37d/0x84f [ov2740] + [<0000000092489f59>] i2c_device_probe+0x28d/0x680 + [<000000001038babe>] really_probe+0x17c/0x3f0 + [<0000000098c7af1c>] __driver_probe_device+0xe3/0x170 + [<00000000e1b3dc24>] device_driver_attach+0x34/0x80 + [<000000005a04a34d>] bind_store+0x10b/0x1a0 + [<00000000ce25d4f2>] drv_attr_store+0x49/0x70 + [<000000007d9f4e9a>] sysfs_kf_write+0x8c/0xb0 + [<00000000be6cff0f>] kernfs_fop_write_iter+0x216/0x2e0 + [<0000000031ddb40a>] vfs_write+0x658/0x810 + [<0000000041beecdd>] ksys_write+0xd6/0x1b0 + [<0000000023755840>] do_syscall_64+0x38/0x90 + [<00000000b2cc2da2>] entry_SYSCALL_64_after_hwframe+0x63/0xcd + +ov2740_init_controls() won't clean all the allocated resources in fail +path, which may causes the memleaks. Add v4l2_ctrl_handler_free() to +prevent memleak. + +Fixes: 866edc895171 ("media: i2c: Add ov2740 image sensor driver") +Signed-off-by: Shang XiaoJing +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/ov2740.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/i2c/ov2740.c b/drivers/media/i2c/ov2740.c +index 934c9d65cb097..4b1ab3e07910e 100644 +--- a/drivers/media/i2c/ov2740.c ++++ b/drivers/media/i2c/ov2740.c +@@ -603,8 +603,10 @@ static int ov2740_init_controls(struct ov2740 *ov2740) + V4L2_CID_TEST_PATTERN, + ARRAY_SIZE(ov2740_test_pattern_menu) - 1, + 0, 0, ov2740_test_pattern_menu); +- if (ctrl_hdlr->error) ++ if (ctrl_hdlr->error) { ++ v4l2_ctrl_handler_free(ctrl_hdlr); + return ctrl_hdlr->error; ++ } + + ov2740->sd.ctrl_handler = ctrl_hdlr; + +-- +2.39.2 + diff --git a/queue-5.15/media-ov5675-fix-memleak-in-ov5675_init_controls.patch b/queue-5.15/media-ov5675-fix-memleak-in-ov5675_init_controls.patch new file mode 100644 index 00000000000..33456a3f724 --- /dev/null +++ b/queue-5.15/media-ov5675-fix-memleak-in-ov5675_init_controls.patch @@ -0,0 +1,67 @@ +From f2a71e9919e8c8b35ca5da710259dc7e599d2706 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Dec 2022 08:59:38 +0100 +Subject: media: ov5675: Fix memleak in ov5675_init_controls() + +From: Shang XiaoJing + +[ Upstream commit dd74ed6c213003533e3abf4c204374ef01d86978 ] + +There is a kmemleak when testing the media/i2c/ov5675.c with bpf mock +device: + +AssertionError: unreferenced object 0xffff888107362160 (size 16): + comm "python3", pid 277, jiffies 4294832798 (age 20.722s) + hex dump (first 16 bytes): + 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + backtrace: + [<00000000abe7d67c>] __kmalloc_node+0x44/0x1b0 + [<000000008a725aac>] kvmalloc_node+0x34/0x180 + [<000000009a53cd11>] v4l2_ctrl_handler_init_class+0x11d/0x180 +[videodev] + [<0000000055b46db0>] ov5675_probe+0x38b/0x897 [ov5675] + [<00000000153d886c>] i2c_device_probe+0x28d/0x680 + [<000000004afb7e8f>] really_probe+0x17c/0x3f0 + [<00000000ff2f18e4>] __driver_probe_device+0xe3/0x170 + [<000000000a001029>] driver_probe_device+0x49/0x120 + [<00000000e39743c7>] __device_attach_driver+0xf7/0x150 + [<00000000d32fd070>] bus_for_each_drv+0x114/0x180 + [<000000009083ac41>] __device_attach+0x1e5/0x2d0 + [<0000000015b4a830>] bus_probe_device+0x126/0x140 + [<000000007813deaf>] device_add+0x810/0x1130 + [<000000007becb867>] i2c_new_client_device+0x386/0x540 + [<000000007f9cf4b4>] of_i2c_register_device+0xf1/0x110 + [<00000000ebfdd032>] of_i2c_notify+0xfc/0x1f0 + +ov5675_init_controls() won't clean all the allocated resources in fail +path, which may causes the memleaks. Add v4l2_ctrl_handler_free() to +prevent memleak. + +Fixes: bf27502b1f3b ("media: ov5675: Add support for OV5675 sensor") +Signed-off-by: Shang XiaoJing +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/ov5675.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/i2c/ov5675.c b/drivers/media/i2c/ov5675.c +index da5850b7ad07f..2104589dd4343 100644 +--- a/drivers/media/i2c/ov5675.c ++++ b/drivers/media/i2c/ov5675.c +@@ -791,8 +791,10 @@ static int ov5675_init_controls(struct ov5675 *ov5675) + v4l2_ctrl_new_std(ctrl_hdlr, &ov5675_ctrl_ops, + V4L2_CID_VFLIP, 0, 1, 1, 0); + +- if (ctrl_hdlr->error) ++ if (ctrl_hdlr->error) { ++ v4l2_ctrl_handler_free(ctrl_hdlr); + return ctrl_hdlr->error; ++ } + + ov5675->sd.ctrl_handler = ctrl_hdlr; + +-- +2.39.2 + diff --git a/queue-5.15/media-platform-ti-add-missing-check-for-devm_regulat.patch b/queue-5.15/media-platform-ti-add-missing-check-for-devm_regulat.patch new file mode 100644 index 00000000000..da2acfa0651 --- /dev/null +++ b/queue-5.15/media-platform-ti-add-missing-check-for-devm_regulat.patch @@ -0,0 +1,45 @@ +From 391d6ae740e8e9a6756988d3ade3c2054d715c25 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Jan 2023 09:55:37 +0100 +Subject: media: platform: ti: Add missing check for devm_regulator_get + +From: Jiasheng Jiang + +[ Upstream commit da8e05f84a11c3cc3b0ba0a3c62d20e358002d99 ] + +Add check for the return value of devm_regulator_get since it may return +error pointer. + +Fixes: 448de7e7850b ("[media] omap3isp: OMAP3 ISP core") +Signed-off-by: Jiasheng Jiang +Signed-off-by: Laurent Pinchart +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/omap3isp/isp.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/drivers/media/platform/omap3isp/isp.c b/drivers/media/platform/omap3isp/isp.c +index 20f59c59ff8a2..3222c98b83630 100644 +--- a/drivers/media/platform/omap3isp/isp.c ++++ b/drivers/media/platform/omap3isp/isp.c +@@ -2306,7 +2306,16 @@ static int isp_probe(struct platform_device *pdev) + + /* Regulators */ + isp->isp_csiphy1.vdd = devm_regulator_get(&pdev->dev, "vdd-csiphy1"); ++ if (IS_ERR(isp->isp_csiphy1.vdd)) { ++ ret = PTR_ERR(isp->isp_csiphy1.vdd); ++ goto error; ++ } ++ + isp->isp_csiphy2.vdd = devm_regulator_get(&pdev->dev, "vdd-csiphy2"); ++ if (IS_ERR(isp->isp_csiphy2.vdd)) { ++ ret = PTR_ERR(isp->isp_csiphy2.vdd); ++ goto error; ++ } + + /* Clocks + * +-- +2.39.2 + diff --git a/queue-5.15/media-rc-fix-use-after-free-bugs-caused-by-ene_tx_ir.patch b/queue-5.15/media-rc-fix-use-after-free-bugs-caused-by-ene_tx_ir.patch new file mode 100644 index 00000000000..2b29de55833 --- /dev/null +++ b/queue-5.15/media-rc-fix-use-after-free-bugs-caused-by-ene_tx_ir.patch @@ -0,0 +1,83 @@ +From a9d900a1e63a5001eea36edf5c4b247bd632a8f2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Jan 2023 08:55:33 +0100 +Subject: media: rc: Fix use-after-free bugs caused by ene_tx_irqsim() + +From: Duoming Zhou + +[ Upstream commit 29b0589a865b6f66d141d79b2dd1373e4e50fe17 ] + +When the ene device is detaching, function ene_remove() will +be called. But there is no function to cancel tx_sim_timer +in ene_remove(), the timer handler ene_tx_irqsim() could race +with ene_remove(). As a result, the UAF bugs could happen, +the process is shown below. + + (cleanup routine) | (timer routine) + | mod_timer(&dev->tx_sim_timer, ..) +ene_remove() | (wait a time) + | ene_tx_irqsim() + | dev->hw_lock //USE + | ene_tx_sample(dev) //USE + +Fix by adding del_timer_sync(&dev->tx_sim_timer) in ene_remove(), +The tx_sim_timer could stop before ene device is deallocated. + +What's more, The rc_unregister_device() and del_timer_sync() +should be called first in ene_remove() and the deallocated +functions such as free_irq(), release_region() and so on +should be called behind them. Because the rc_unregister_device() +is well synchronized. Otherwise, race conditions may happen. The +situations that may lead to race conditions are shown below. + +Firstly, the rx receiver is disabled with ene_rx_disable() +before rc_unregister_device() in ene_remove(), which means it +can be enabled again if a process opens /dev/lirc0 between +ene_rx_disable() and rc_unregister_device(). + +Secondly, the irqaction descriptor is freed by free_irq() +before the rc device is unregistered, which means irqaction +descriptor may be accessed again after it is deallocated. + +Thirdly, the timer can call ene_tx_sample() that can write +to the io ports, which means the io ports could be accessed +again after they are deallocated by release_region(). + +Therefore, the rc_unregister_device() and del_timer_sync() +should be called first in ene_remove(). + +Suggested by: Sean Young + +Fixes: 9ea53b74df9c ("V4L/DVB: STAGING: remove lirc_ene0100 driver") +Signed-off-by: Duoming Zhou +Signed-off-by: Sean Young +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/rc/ene_ir.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/rc/ene_ir.c b/drivers/media/rc/ene_ir.c +index e09270916fbca..11ee21a7db8f0 100644 +--- a/drivers/media/rc/ene_ir.c ++++ b/drivers/media/rc/ene_ir.c +@@ -1106,6 +1106,8 @@ static void ene_remove(struct pnp_dev *pnp_dev) + struct ene_device *dev = pnp_get_drvdata(pnp_dev); + unsigned long flags; + ++ rc_unregister_device(dev->rdev); ++ del_timer_sync(&dev->tx_sim_timer); + spin_lock_irqsave(&dev->hw_lock, flags); + ene_rx_disable(dev); + ene_rx_restore_hw_buffer(dev); +@@ -1113,7 +1115,6 @@ static void ene_remove(struct pnp_dev *pnp_dev) + + free_irq(dev->irq, dev); + release_region(dev->hw_io, ENE_IO_SIZE); +- rc_unregister_device(dev->rdev); + kfree(dev); + } + +-- +2.39.2 + diff --git a/queue-5.15/media-saa7134-use-video_unregister_device-for-radio_.patch b/queue-5.15/media-saa7134-use-video_unregister_device-for-radio_.patch new file mode 100644 index 00000000000..812bdca5076 --- /dev/null +++ b/queue-5.15/media-saa7134-use-video_unregister_device-for-radio_.patch @@ -0,0 +1,39 @@ +From 1fac2110ebf956f015e0c38df139f519b468ab9e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Jan 2023 12:00:59 +0100 +Subject: media: saa7134: Use video_unregister_device for radio_dev + +From: Tasos Sahanidis + +[ Upstream commit bc7635c6435c77a0c168e2cc6535740adfaff4e4 ] + +The radio device doesn't use vb2, thus calling vb2_video_unregister_device() +which results in the following warning being printed on module unload. + +WARNING: CPU: 1 PID: 215963 at drivers/media/common/videobuf2/videobuf2-v4l2.c:1236 vb2_video_unregister_device+0xc6/0xe0 [videobuf2_v4l2] + +Fixes: 11788d9b7e91 ("media: media/pci: use vb2_video_unregister_device()") +Signed-off-by: Tasos Sahanidis +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/pci/saa7134/saa7134-core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/pci/saa7134/saa7134-core.c b/drivers/media/pci/saa7134/saa7134-core.c +index 96328b0af1641..cf2871306987c 100644 +--- a/drivers/media/pci/saa7134/saa7134-core.c ++++ b/drivers/media/pci/saa7134/saa7134-core.c +@@ -978,7 +978,7 @@ static void saa7134_unregister_video(struct saa7134_dev *dev) + } + if (dev->radio_dev) { + if (video_is_registered(dev->radio_dev)) +- vb2_video_unregister_device(dev->radio_dev); ++ video_unregister_device(dev->radio_dev); + else + video_device_release(dev->radio_dev); + dev->radio_dev = NULL; +-- +2.39.2 + diff --git a/queue-5.15/media-ti-cal-fix-possible-memory-leak-in-cal_ctx_cre.patch b/queue-5.15/media-ti-cal-fix-possible-memory-leak-in-cal_ctx_cre.patch new file mode 100644 index 00000000000..9aaf419bd64 --- /dev/null +++ b/queue-5.15/media-ti-cal-fix-possible-memory-leak-in-cal_ctx_cre.patch @@ -0,0 +1,41 @@ +From 864503702f7c08ac3a8fc3fd4e30306e7eb99251 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Nov 2022 12:01:59 +0100 +Subject: media: ti: cal: fix possible memory leak in cal_ctx_create() + +From: Gaosheng Cui + +[ Upstream commit 7acd650a0484d92985a0d6d867d980c6dd019885 ] + +The memory of ctx is allocated in cal_ctx_create(), but it will +not be freed when cal_ctx_v4l2_init() fails, so add kfree() when +cal_ctx_v4l2_init() fails to fix it. + +Fixes: d68a94e98a89 ("media: ti-vpe: cal: Split video device initialization and registration") +Signed-off-by: Gaosheng Cui +Signed-off-by: Laurent Pinchart +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/ti-vpe/cal.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/platform/ti-vpe/cal.c b/drivers/media/platform/ti-vpe/cal.c +index 8e469d518a742..35d62eb1321fb 100644 +--- a/drivers/media/platform/ti-vpe/cal.c ++++ b/drivers/media/platform/ti-vpe/cal.c +@@ -940,8 +940,10 @@ static struct cal_ctx *cal_ctx_create(struct cal_dev *cal, int inst) + ctx->datatype = CAL_CSI2_CTX_DT_ANY; + + ret = cal_ctx_v4l2_init(ctx); +- if (ret) ++ if (ret) { ++ kfree(ctx); + return NULL; ++ } + + return ctx; + } +-- +2.39.2 + diff --git a/queue-5.15/media-usb-siano-fix-use-after-free-bugs-caused-by-do.patch b/queue-5.15/media-usb-siano-fix-use-after-free-bugs-caused-by-do.patch new file mode 100644 index 00000000000..ec0436fd911 --- /dev/null +++ b/queue-5.15/media-usb-siano-fix-use-after-free-bugs-caused-by-do.patch @@ -0,0 +1,233 @@ +From f48c14eb3f970c30315cf87ce6275c2be91f8388 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 23 Jan 2023 03:04:38 +0100 +Subject: media: usb: siano: Fix use after free bugs caused by do_submit_urb + +From: Duoming Zhou + +[ Upstream commit ebad8e731c1c06adf04621d6fd327b860c0861b5 ] + +There are UAF bugs caused by do_submit_urb(). One of the KASan reports +is shown below: + +[ 36.403605] BUG: KASAN: use-after-free in worker_thread+0x4a2/0x890 +[ 36.406105] Read of size 8 at addr ffff8880059600e8 by task kworker/0:2/49 +[ 36.408316] +[ 36.408867] CPU: 0 PID: 49 Comm: kworker/0:2 Not tainted 6.2.0-rc3-15798-g5a41237ad1d4-dir8 +[ 36.411696] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g15584 +[ 36.416157] Workqueue: 0x0 (events) +[ 36.417654] Call Trace: +[ 36.418546] +[ 36.419320] dump_stack_lvl+0x96/0xd0 +[ 36.420522] print_address_description+0x75/0x350 +[ 36.421992] print_report+0x11b/0x250 +[ 36.423174] ? _raw_spin_lock_irqsave+0x87/0xd0 +[ 36.424806] ? __virt_addr_valid+0xcf/0x170 +[ 36.426069] ? worker_thread+0x4a2/0x890 +[ 36.427355] kasan_report+0x131/0x160 +[ 36.428556] ? worker_thread+0x4a2/0x890 +[ 36.430053] worker_thread+0x4a2/0x890 +[ 36.431297] ? worker_clr_flags+0x90/0x90 +[ 36.432479] kthread+0x166/0x190 +[ 36.433493] ? kthread_blkcg+0x50/0x50 +[ 36.434669] ret_from_fork+0x22/0x30 +[ 36.435923] +[ 36.436684] +[ 36.437215] Allocated by task 24: +[ 36.438289] kasan_set_track+0x50/0x80 +[ 36.439436] __kasan_kmalloc+0x89/0xa0 +[ 36.440566] smsusb_probe+0x374/0xc90 +[ 36.441920] usb_probe_interface+0x2d1/0x4c0 +[ 36.443253] really_probe+0x1d5/0x580 +[ 36.444539] __driver_probe_device+0xe3/0x130 +[ 36.446085] driver_probe_device+0x49/0x220 +[ 36.447423] __device_attach_driver+0x19e/0x1b0 +[ 36.448931] bus_for_each_drv+0xcb/0x110 +[ 36.450217] __device_attach+0x132/0x1f0 +[ 36.451470] bus_probe_device+0x59/0xf0 +[ 36.452563] device_add+0x4ec/0x7b0 +[ 36.453830] usb_set_configuration+0xc63/0xe10 +[ 36.455230] usb_generic_driver_probe+0x3b/0x80 +[ 36.456166] printk: console [ttyGS0] disabled +[ 36.456569] usb_probe_device+0x90/0x110 +[ 36.459523] really_probe+0x1d5/0x580 +[ 36.461027] __driver_probe_device+0xe3/0x130 +[ 36.462465] driver_probe_device+0x49/0x220 +[ 36.463847] __device_attach_driver+0x19e/0x1b0 +[ 36.465229] bus_for_each_drv+0xcb/0x110 +[ 36.466466] __device_attach+0x132/0x1f0 +[ 36.467799] bus_probe_device+0x59/0xf0 +[ 36.469010] device_add+0x4ec/0x7b0 +[ 36.470125] usb_new_device+0x863/0xa00 +[ 36.471374] hub_event+0x18c7/0x2220 +[ 36.472746] process_one_work+0x34c/0x5b0 +[ 36.474041] worker_thread+0x4b7/0x890 +[ 36.475216] kthread+0x166/0x190 +[ 36.476267] ret_from_fork+0x22/0x30 +[ 36.477447] +[ 36.478160] Freed by task 24: +[ 36.479239] kasan_set_track+0x50/0x80 +[ 36.480512] kasan_save_free_info+0x2b/0x40 +[ 36.481808] ____kasan_slab_free+0x122/0x1a0 +[ 36.483173] __kmem_cache_free+0xc4/0x200 +[ 36.484563] smsusb_term_device+0xcd/0xf0 +[ 36.485896] smsusb_probe+0xc85/0xc90 +[ 36.486976] usb_probe_interface+0x2d1/0x4c0 +[ 36.488303] really_probe+0x1d5/0x580 +[ 36.489498] __driver_probe_device+0xe3/0x130 +[ 36.491140] driver_probe_device+0x49/0x220 +[ 36.492475] __device_attach_driver+0x19e/0x1b0 +[ 36.493988] bus_for_each_drv+0xcb/0x110 +[ 36.495171] __device_attach+0x132/0x1f0 +[ 36.496617] bus_probe_device+0x59/0xf0 +[ 36.497875] device_add+0x4ec/0x7b0 +[ 36.498972] usb_set_configuration+0xc63/0xe10 +[ 36.500264] usb_generic_driver_probe+0x3b/0x80 +[ 36.501740] usb_probe_device+0x90/0x110 +[ 36.503084] really_probe+0x1d5/0x580 +[ 36.504241] __driver_probe_device+0xe3/0x130 +[ 36.505548] driver_probe_device+0x49/0x220 +[ 36.506766] __device_attach_driver+0x19e/0x1b0 +[ 36.508368] bus_for_each_drv+0xcb/0x110 +[ 36.509646] __device_attach+0x132/0x1f0 +[ 36.510911] bus_probe_device+0x59/0xf0 +[ 36.512103] device_add+0x4ec/0x7b0 +[ 36.513215] usb_new_device+0x863/0xa00 +[ 36.514736] hub_event+0x18c7/0x2220 +[ 36.516130] process_one_work+0x34c/0x5b0 +[ 36.517396] worker_thread+0x4b7/0x890 +[ 36.518591] kthread+0x166/0x190 +[ 36.519599] ret_from_fork+0x22/0x30 +[ 36.520851] +[ 36.521405] Last potentially related work creation: +[ 36.523143] kasan_save_stack+0x3f/0x60 +[ 36.524275] kasan_record_aux_stack_noalloc+0x9d/0xb0 +[ 36.525831] insert_work+0x25/0x130 +[ 36.527039] __queue_work+0x4d4/0x620 +[ 36.528236] queue_work_on+0x72/0xb0 +[ 36.529344] __usb_hcd_giveback_urb+0x13f/0x1b0 +[ 36.530819] dummy_timer+0x350/0x1a40 +[ 36.532149] call_timer_fn+0x2c/0x190 +[ 36.533567] expire_timers+0x69/0x1f0 +[ 36.534736] __run_timers+0x289/0x2d0 +[ 36.535841] run_timer_softirq+0x2d/0x60 +[ 36.537110] __do_softirq+0x116/0x380 +[ 36.538377] +[ 36.538950] Second to last potentially related work creation: +[ 36.540855] kasan_save_stack+0x3f/0x60 +[ 36.542084] kasan_record_aux_stack_noalloc+0x9d/0xb0 +[ 36.543592] insert_work+0x25/0x130 +[ 36.544891] __queue_work+0x4d4/0x620 +[ 36.546168] queue_work_on+0x72/0xb0 +[ 36.547328] __usb_hcd_giveback_urb+0x13f/0x1b0 +[ 36.548805] dummy_timer+0x350/0x1a40 +[ 36.550116] call_timer_fn+0x2c/0x190 +[ 36.551570] expire_timers+0x69/0x1f0 +[ 36.552762] __run_timers+0x289/0x2d0 +[ 36.553916] run_timer_softirq+0x2d/0x60 +[ 36.555118] __do_softirq+0x116/0x380 +[ 36.556239] +[ 36.556807] The buggy address belongs to the object at ffff888005960000 +[ 36.556807] which belongs to the cache kmalloc-4k of size 4096 +[ 36.560652] The buggy address is located 232 bytes inside of +[ 36.560652] 4096-byte region [ffff888005960000, ffff888005961000) +[ 36.564791] +[ 36.565355] The buggy address belongs to the physical page: +[ 36.567212] page:000000004f0a0731 refcount:1 mapcount:0 mapping:0000000000000000 index:0x00 +[ 36.570534] head:000000004f0a0731 order:3 compound_mapcount:0 subpages_mapcount:0 compound0 +[ 36.573717] flags: 0x100000000010200(slab|head|node=0|zone=1) +[ 36.575481] raw: 0100000000010200 ffff888001042140 dead000000000122 0000000000000000 +[ 36.577842] raw: 0000000000000000 0000000000040004 00000001ffffffff 0000000000000000 +[ 36.580175] page dumped because: kasan: bad access detected +[ 36.581994] +[ 36.582548] Memory state around the buggy address: +[ 36.583983] ffff88800595ff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc +[ 36.586240] ffff888005960000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb +[ 36.588884] >ffff888005960080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb +[ 36.591071] ^ +[ 36.593295] ffff888005960100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb +[ 36.595705] ffff888005960180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb +[ 36.598026] ================================================================== +[ 36.600224] Disabling lock debugging due to kernel taint +[ 36.602681] general protection fault, probably for non-canonical address 0x43600a000000060I +[ 36.607129] CPU: 0 PID: 49 Comm: kworker/0:2 Tainted: G B 6.2.0-rc3-15798-8 +[ 36.611115] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g15584 +[ 36.615026] Workqueue: events do_submit_urb +[ 36.616290] RIP: 0010:_raw_spin_lock_irqsave+0x8a/0xd0 +[ 36.618107] Code: 24 00 00 00 00 48 89 df be 04 00 00 00 e8 9e b5 c6 fe 48 89 ef be 04 00 5 +[ 36.623522] RSP: 0018:ffff888004b6fcf0 EFLAGS: 00010046 +[ 36.625072] RAX: 0000000000000000 RBX: 043600a000000060 RCX: ffffffff9fc0e0d7 +[ 36.627206] RDX: 0000000000000000 RSI: dffffc0000000000 RDI: ffff888004b6fcf0 +[ 36.629813] RBP: ffff888004b6fcf0 R08: dffffc0000000000 R09: ffffed100096df9f +[ 36.631974] R10: dfffe9100096dfa0 R11: 1ffff1100096df9e R12: ffff888005960020 +[ 36.634285] R13: ffff8880059600f0 R14: 0000000000000246 R15: 0000000000000001 +[ 36.636438] FS: 0000000000000000(0000) GS:ffff88806d600000(0000) knlGS:0000000000000000 +[ 36.639092] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 36.640951] CR2: 00007f07476819a3 CR3: 0000000004a34000 CR4: 00000000000006f0 +[ 36.643411] Call Trace: +[ 36.644215] +[ 36.644902] smscore_getbuffer+0x3e/0x1e0 +[ 36.646147] do_submit_urb+0x4f/0x190 +[ 36.647449] process_one_work+0x34c/0x5b0 +[ 36.648777] worker_thread+0x4b7/0x890 +[ 36.649984] ? worker_clr_flags+0x90/0x90 +[ 36.651166] kthread+0x166/0x190 +[ 36.652151] ? kthread_blkcg+0x50/0x50 +[ 36.653547] ret_from_fork+0x22/0x30 +[ 36.655051] +[ 36.655733] Modules linked in: +[ 36.656787] ---[ end trace 0000000000000000 ]--- +[ 36.658328] RIP: 0010:_raw_spin_lock_irqsave+0x8a/0xd0 +[ 36.660045] Code: 24 00 00 00 00 48 89 df be 04 00 00 00 e8 9e b5 c6 fe 48 89 ef be 04 00 5 +[ 36.665730] RSP: 0018:ffff888004b6fcf0 EFLAGS: 00010046 +[ 36.667448] RAX: 0000000000000000 RBX: 043600a000000060 RCX: ffffffff9fc0e0d7 +[ 36.669675] RDX: 0000000000000000 RSI: dffffc0000000000 RDI: ffff888004b6fcf0 +[ 36.672645] RBP: ffff888004b6fcf0 R08: dffffc0000000000 R09: ffffed100096df9f +[ 36.674921] R10: dfffe9100096dfa0 R11: 1ffff1100096df9e R12: ffff888005960020 +[ 36.677034] R13: ffff8880059600f0 R14: 0000000000000246 R15: 0000000000000001 +[ 36.679184] FS: 0000000000000000(0000) GS:ffff88806d600000(0000) knlGS:0000000000000000 +[ 36.681655] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 36.683383] CR2: 00007f07476819a3 CR3: 0000000004a34000 CR4: 00000000000006f0 +[ 36.685733] Kernel panic - not syncing: Fatal exception +[ 36.688585] Kernel Offset: 0x1d400000 from 0xffffffff81000000 (relocation range: 0xfffffff) +[ 36.692199] ---[ end Kernel panic - not syncing: Fatal exception ]--- + +When the siano device is plugged in, it may call the following functions +to initialize the device. + +smsusb_probe()-->smsusb_init_device()-->smscore_start_device(). + +When smscore_start_device() gets failed, the function smsusb_term_device() +will be called and smsusb_device_t will be deallocated. Although we use +usb_kill_urb() in smsusb_stop_streaming() to cancel transfer requests +and wait for them to finish, the worker threads that are scheduled by +smsusb_onresponse() may be still running. As a result, the UAF bugs +could happen. + +We add cancel_work_sync() in smsusb_stop_streaming() in order that the +worker threads could finish before the smsusb_device_t is deallocated. + +Fixes: dd47fbd40e6e ("[media] smsusb: don't sleep while atomic") +Signed-off-by: Duoming Zhou +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/usb/siano/smsusb.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/media/usb/siano/smsusb.c b/drivers/media/usb/siano/smsusb.c +index df4c5dcba39cd..1babfe6e2c361 100644 +--- a/drivers/media/usb/siano/smsusb.c ++++ b/drivers/media/usb/siano/smsusb.c +@@ -179,6 +179,7 @@ static void smsusb_stop_streaming(struct smsusb_device_t *dev) + + for (i = 0; i < MAX_URBS; i++) { + usb_kill_urb(&dev->surbs[i].urb); ++ cancel_work_sync(&dev->surbs[i].wq); + + if (dev->surbs[i].cb) { + smscore_putbuffer(dev->coredev, dev->surbs[i].cb); +-- +2.39.2 + diff --git a/queue-5.15/media-uvcvideo-add-support-for-v4l2_ctrl_type_ctrl_c.patch b/queue-5.15/media-uvcvideo-add-support-for-v4l2_ctrl_type_ctrl_c.patch new file mode 100644 index 00000000000..a59b773e218 --- /dev/null +++ b/queue-5.15/media-uvcvideo-add-support-for-v4l2_ctrl_type_ctrl_c.patch @@ -0,0 +1,207 @@ +From 08fd58c04024c2a20c79ea485ad2ce1541359b44 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Jun 2021 14:29:11 +0200 +Subject: media: uvcvideo: Add support for V4L2_CTRL_TYPE_CTRL_CLASS + +From: Ricardo Ribalda + +[ Upstream commit 9b31ea808a4468d5d606d1f82c58b7e7bfb99f66 ] + +Create all the class controls for the device defined controls. + +Fixes v4l2-compliance: +Control ioctls (Input 0): + fail: v4l2-test-controls.cpp(216): missing control class for class 00980000 + fail: v4l2-test-controls.cpp(216): missing control tclass for class 009a0000 + test VIDIOC_QUERY_EXT_CTRL/QUERYMENU: FAIL + +Reviewed-by: Hans Verkuil +Signed-off-by: Ricardo Ribalda +Signed-off-by: Laurent Pinchart +Signed-off-by: Mauro Carvalho Chehab +Stable-dep-of: 9f582f0418ed ("media: uvcvideo: Check for INACTIVE in uvc_ctrl_is_accessible()") +Signed-off-by: Sasha Levin +--- + drivers/media/usb/uvc/uvc_ctrl.c | 90 ++++++++++++++++++++++++++++++++ + drivers/media/usb/uvc/uvcvideo.h | 1 + + 2 files changed, 91 insertions(+) + +diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c +index 6b089103878ac..769088a7f9375 100644 +--- a/drivers/media/usb/uvc/uvc_ctrl.c ++++ b/drivers/media/usb/uvc/uvc_ctrl.c +@@ -357,6 +357,11 @@ static const struct uvc_control_info uvc_ctrls[] = { + }, + }; + ++static const u32 uvc_control_classes[] = { ++ V4L2_CID_CAMERA_CLASS, ++ V4L2_CID_USER_CLASS, ++}; ++ + static const struct uvc_menu_info power_line_frequency_controls[] = { + { 0, "Disabled" }, + { 1, "50 Hz" }, +@@ -1044,6 +1049,49 @@ static int __uvc_ctrl_get(struct uvc_video_chain *chain, + return 0; + } + ++static int __uvc_query_v4l2_class(struct uvc_video_chain *chain, u32 req_id, ++ u32 found_id) ++{ ++ bool find_next = req_id & V4L2_CTRL_FLAG_NEXT_CTRL; ++ unsigned int i; ++ ++ req_id &= V4L2_CTRL_ID_MASK; ++ ++ for (i = 0; i < ARRAY_SIZE(uvc_control_classes); i++) { ++ if (!(chain->ctrl_class_bitmap & BIT(i))) ++ continue; ++ if (!find_next) { ++ if (uvc_control_classes[i] == req_id) ++ return i; ++ continue; ++ } ++ if (uvc_control_classes[i] > req_id && ++ uvc_control_classes[i] < found_id) ++ return i; ++ } ++ ++ return -ENODEV; ++} ++ ++static int uvc_query_v4l2_class(struct uvc_video_chain *chain, u32 req_id, ++ u32 found_id, struct v4l2_queryctrl *v4l2_ctrl) ++{ ++ int idx; ++ ++ idx = __uvc_query_v4l2_class(chain, req_id, found_id); ++ if (idx < 0) ++ return -ENODEV; ++ ++ memset(v4l2_ctrl, 0, sizeof(*v4l2_ctrl)); ++ v4l2_ctrl->id = uvc_control_classes[idx]; ++ strscpy(v4l2_ctrl->name, v4l2_ctrl_get_name(v4l2_ctrl->id), ++ sizeof(v4l2_ctrl->name)); ++ v4l2_ctrl->type = V4L2_CTRL_TYPE_CTRL_CLASS; ++ v4l2_ctrl->flags = V4L2_CTRL_FLAG_WRITE_ONLY ++ | V4L2_CTRL_FLAG_READ_ONLY; ++ return 0; ++} ++ + static int __uvc_query_v4l2_ctrl(struct uvc_video_chain *chain, + struct uvc_control *ctrl, + struct uvc_control_mapping *mapping, +@@ -1147,12 +1195,31 @@ int uvc_query_v4l2_ctrl(struct uvc_video_chain *chain, + if (ret < 0) + return -ERESTARTSYS; + ++ /* Check if the ctrl is a know class */ ++ if (!(v4l2_ctrl->id & V4L2_CTRL_FLAG_NEXT_CTRL)) { ++ ret = uvc_query_v4l2_class(chain, v4l2_ctrl->id, 0, v4l2_ctrl); ++ if (!ret) ++ goto done; ++ } ++ + ctrl = uvc_find_control(chain, v4l2_ctrl->id, &mapping); + if (ctrl == NULL) { + ret = -EINVAL; + goto done; + } + ++ /* ++ * If we're enumerating control with V4L2_CTRL_FLAG_NEXT_CTRL, check if ++ * a class should be inserted between the previous control and the one ++ * we have just found. ++ */ ++ if (v4l2_ctrl->id & V4L2_CTRL_FLAG_NEXT_CTRL) { ++ ret = uvc_query_v4l2_class(chain, v4l2_ctrl->id, mapping->id, ++ v4l2_ctrl); ++ if (!ret) ++ goto done; ++ } ++ + ret = __uvc_query_v4l2_ctrl(chain, ctrl, mapping, v4l2_ctrl); + done: + mutex_unlock(&chain->ctrl_mutex); +@@ -1446,6 +1513,11 @@ static int uvc_ctrl_add_event(struct v4l2_subscribed_event *sev, unsigned elems) + if (ret < 0) + return -ERESTARTSYS; + ++ if (__uvc_query_v4l2_class(handle->chain, sev->id, 0) >= 0) { ++ ret = 0; ++ goto done; ++ } ++ + ctrl = uvc_find_control(handle->chain, sev->id, &mapping); + if (ctrl == NULL) { + ret = -EINVAL; +@@ -1479,7 +1551,10 @@ static void uvc_ctrl_del_event(struct v4l2_subscribed_event *sev) + struct uvc_fh *handle = container_of(sev->fh, struct uvc_fh, vfh); + + mutex_lock(&handle->chain->ctrl_mutex); ++ if (__uvc_query_v4l2_class(handle->chain, sev->id, 0) >= 0) ++ goto done; + list_del(&sev->node); ++done: + mutex_unlock(&handle->chain->ctrl_mutex); + } + +@@ -1597,6 +1672,9 @@ int uvc_ctrl_get(struct uvc_video_chain *chain, + struct uvc_control *ctrl; + struct uvc_control_mapping *mapping; + ++ if (__uvc_query_v4l2_class(chain, xctrl->id, 0) >= 0) ++ return -EACCES; ++ + ctrl = uvc_find_control(chain, xctrl->id, &mapping); + if (ctrl == NULL) + return -EINVAL; +@@ -1616,6 +1694,9 @@ int uvc_ctrl_set(struct uvc_fh *handle, + s32 max; + int ret; + ++ if (__uvc_query_v4l2_class(chain, xctrl->id, 0) >= 0) ++ return -EACCES; ++ + ctrl = uvc_find_control(chain, xctrl->id, &mapping); + if (ctrl == NULL) + return -EINVAL; +@@ -2071,6 +2152,7 @@ static int __uvc_ctrl_add_mapping(struct uvc_video_chain *chain, + { + struct uvc_control_mapping *map; + unsigned int size; ++ unsigned int i; + + /* Most mappings come from static kernel data and need to be duplicated. + * Mappings that come from userspace will be unnecessarily duplicated, +@@ -2094,6 +2176,14 @@ static int __uvc_ctrl_add_mapping(struct uvc_video_chain *chain, + if (map->set == NULL) + map->set = uvc_set_le_value; + ++ for (i = 0; i < ARRAY_SIZE(uvc_control_classes); i++) { ++ if (V4L2_CTRL_ID2WHICH(uvc_control_classes[i]) == ++ V4L2_CTRL_ID2WHICH(map->id)) { ++ chain->ctrl_class_bitmap |= BIT(i); ++ break; ++ } ++ } ++ + list_add_tail(&map->list, &ctrl->info.mappings); + uvc_dbg(chain->dev, CONTROL, "Adding mapping '%s' to control %pUl/%u\n", + map->name, ctrl->info.entity, ctrl->info.selector); +diff --git a/drivers/media/usb/uvc/uvcvideo.h b/drivers/media/usb/uvc/uvcvideo.h +index c3ea6a53869f5..2c57a50f6a79b 100644 +--- a/drivers/media/usb/uvc/uvcvideo.h ++++ b/drivers/media/usb/uvc/uvcvideo.h +@@ -476,6 +476,7 @@ struct uvc_video_chain { + + struct v4l2_prio_state prio; /* V4L2 priority state */ + u32 caps; /* V4L2 chain-wide caps */ ++ u8 ctrl_class_bitmap; /* Bitmap of valid classes */ + }; + + struct uvc_stats_frame { +-- +2.39.2 + diff --git a/queue-5.15/media-uvcvideo-check-controls-flags-before-accessing.patch b/queue-5.15/media-uvcvideo-check-controls-flags-before-accessing.patch new file mode 100644 index 00000000000..2d4de0e1708 --- /dev/null +++ b/queue-5.15/media-uvcvideo-check-controls-flags-before-accessing.patch @@ -0,0 +1,182 @@ +From 95649ad873ebe7cada5c3c8b73a5eee339ddff1f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Jun 2021 14:29:16 +0200 +Subject: media: uvcvideo: Check controls flags before accessing them + +From: Ricardo Ribalda + +[ Upstream commit ee929d5a10ca433a1c21b9aaeb70a67c5507c101 ] + +We can figure out if reading/writing a set of controls can fail without +accessing them by checking their flags. + +This way we can honor the API closer: + +If an error is found when validating the list of controls passed with +VIDIOC_G_EXT_CTRLS, then error_idx shall be set to ctrls->count to +indicate to userspace that no actual hardware was touched. + +Fixes v4l2-compliance: +Control ioctls (Input 0): + warn: v4l2-test-controls.cpp(765): g_ext_ctrls(0) invalid error_idx 0 + fail: v4l2-test-controls.cpp(645): invalid error index write only control + test VIDIOC_G/S/TRY_EXT_CTRLS: FAIL + +Reviewed-by: Hans Verkuil +Signed-off-by: Ricardo Ribalda +Signed-off-by: Laurent Pinchart +Signed-off-by: Mauro Carvalho Chehab +Stable-dep-of: 9f582f0418ed ("media: uvcvideo: Check for INACTIVE in uvc_ctrl_is_accessible()") +Signed-off-by: Sasha Levin +--- + drivers/media/usb/uvc/uvc_ctrl.c | 22 ++++++++++++++++++ + drivers/media/usb/uvc/uvc_v4l2.c | 39 ++++++++++++++++++++++++++++---- + drivers/media/usb/uvc/uvcvideo.h | 2 ++ + 3 files changed, 58 insertions(+), 5 deletions(-) + +diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c +index 748f87af5e43e..fcfbd0f726936 100644 +--- a/drivers/media/usb/uvc/uvc_ctrl.c ++++ b/drivers/media/usb/uvc/uvc_ctrl.c +@@ -1062,6 +1062,28 @@ static int uvc_query_v4l2_class(struct uvc_video_chain *chain, u32 req_id, + return 0; + } + ++int uvc_ctrl_is_accessible(struct uvc_video_chain *chain, u32 v4l2_id, ++ bool read) ++{ ++ struct uvc_control_mapping *mapping; ++ struct uvc_control *ctrl; ++ ++ if (__uvc_query_v4l2_class(chain, v4l2_id, 0) >= 0) ++ return -EACCES; ++ ++ ctrl = uvc_find_control(chain, v4l2_id, &mapping); ++ if (!ctrl) ++ return -EINVAL; ++ ++ if (!(ctrl->info.flags & UVC_CTRL_FLAG_GET_CUR) && read) ++ return -EACCES; ++ ++ if (!(ctrl->info.flags & UVC_CTRL_FLAG_SET_CUR) && !read) ++ return -EACCES; ++ ++ return 0; ++} ++ + static const char *uvc_map_get_name(const struct uvc_control_mapping *map) + { + const char *name; +diff --git a/drivers/media/usb/uvc/uvc_v4l2.c b/drivers/media/usb/uvc/uvc_v4l2.c +index 533c4a0645ee4..7dd387e96c9de 100644 +--- a/drivers/media/usb/uvc/uvc_v4l2.c ++++ b/drivers/media/usb/uvc/uvc_v4l2.c +@@ -1006,6 +1006,26 @@ static int uvc_ioctl_query_ext_ctrl(struct file *file, void *fh, + return 0; + } + ++static int uvc_ctrl_check_access(struct uvc_video_chain *chain, ++ struct v4l2_ext_controls *ctrls, ++ unsigned long ioctl) ++{ ++ struct v4l2_ext_control *ctrl = ctrls->controls; ++ unsigned int i; ++ int ret = 0; ++ ++ for (i = 0; i < ctrls->count; ++ctrl, ++i) { ++ ret = uvc_ctrl_is_accessible(chain, ctrl->id, ++ ioctl == VIDIOC_G_EXT_CTRLS); ++ if (ret) ++ break; ++ } ++ ++ ctrls->error_idx = ioctl == VIDIOC_TRY_EXT_CTRLS ? i : ctrls->count; ++ ++ return ret; ++} ++ + static int uvc_ioctl_g_ext_ctrls(struct file *file, void *fh, + struct v4l2_ext_controls *ctrls) + { +@@ -1015,6 +1035,10 @@ static int uvc_ioctl_g_ext_ctrls(struct file *file, void *fh, + unsigned int i; + int ret; + ++ ret = uvc_ctrl_check_access(chain, ctrls, VIDIOC_G_EXT_CTRLS); ++ if (ret < 0) ++ return ret; ++ + if (ctrls->which == V4L2_CTRL_WHICH_DEF_VAL) { + for (i = 0; i < ctrls->count; ++ctrl, ++i) { + struct v4l2_queryctrl qc = { .id = ctrl->id }; +@@ -1051,13 +1075,17 @@ static int uvc_ioctl_g_ext_ctrls(struct file *file, void *fh, + + static int uvc_ioctl_s_try_ext_ctrls(struct uvc_fh *handle, + struct v4l2_ext_controls *ctrls, +- bool commit) ++ unsigned long ioctl) + { + struct v4l2_ext_control *ctrl = ctrls->controls; + struct uvc_video_chain *chain = handle->chain; + unsigned int i; + int ret; + ++ ret = uvc_ctrl_check_access(chain, ctrls, ioctl); ++ if (ret < 0) ++ return ret; ++ + ret = uvc_ctrl_begin(chain); + if (ret < 0) + return ret; +@@ -1066,14 +1094,15 @@ static int uvc_ioctl_s_try_ext_ctrls(struct uvc_fh *handle, + ret = uvc_ctrl_set(handle, ctrl); + if (ret < 0) { + uvc_ctrl_rollback(handle); +- ctrls->error_idx = commit ? ctrls->count : i; ++ ctrls->error_idx = ioctl == VIDIOC_S_EXT_CTRLS ? ++ ctrls->count : i; + return ret; + } + } + + ctrls->error_idx = 0; + +- if (commit) ++ if (ioctl == VIDIOC_S_EXT_CTRLS) + return uvc_ctrl_commit(handle, ctrls->controls, ctrls->count); + else + return uvc_ctrl_rollback(handle); +@@ -1084,7 +1113,7 @@ static int uvc_ioctl_s_ext_ctrls(struct file *file, void *fh, + { + struct uvc_fh *handle = fh; + +- return uvc_ioctl_s_try_ext_ctrls(handle, ctrls, true); ++ return uvc_ioctl_s_try_ext_ctrls(handle, ctrls, VIDIOC_S_EXT_CTRLS); + } + + static int uvc_ioctl_try_ext_ctrls(struct file *file, void *fh, +@@ -1092,7 +1121,7 @@ static int uvc_ioctl_try_ext_ctrls(struct file *file, void *fh, + { + struct uvc_fh *handle = fh; + +- return uvc_ioctl_s_try_ext_ctrls(handle, ctrls, false); ++ return uvc_ioctl_s_try_ext_ctrls(handle, ctrls, VIDIOC_TRY_EXT_CTRLS); + } + + static int uvc_ioctl_querymenu(struct file *file, void *fh, +diff --git a/drivers/media/usb/uvc/uvcvideo.h b/drivers/media/usb/uvc/uvcvideo.h +index 33befa48fb493..d414a22244057 100644 +--- a/drivers/media/usb/uvc/uvcvideo.h ++++ b/drivers/media/usb/uvc/uvcvideo.h +@@ -901,6 +901,8 @@ static inline int uvc_ctrl_rollback(struct uvc_fh *handle) + + int uvc_ctrl_get(struct uvc_video_chain *chain, struct v4l2_ext_control *xctrl); + int uvc_ctrl_set(struct uvc_fh *handle, struct v4l2_ext_control *xctrl); ++int uvc_ctrl_is_accessible(struct uvc_video_chain *chain, u32 v4l2_id, ++ bool read); + + int uvc_xu_ctrl_query(struct uvc_video_chain *chain, + struct uvc_xu_control_query *xqry); +-- +2.39.2 + diff --git a/queue-5.15/media-uvcvideo-check-for-inactive-in-uvc_ctrl_is_acc.patch b/queue-5.15/media-uvcvideo-check-for-inactive-in-uvc_ctrl_is_acc.patch new file mode 100644 index 00000000000..fe54ea420fb --- /dev/null +++ b/queue-5.15/media-uvcvideo-check-for-inactive-in-uvc_ctrl_is_acc.patch @@ -0,0 +1,151 @@ +From f2ce699e5d63c27fbe792a432d631c7196601b6a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Jan 2023 15:36:19 +0100 +Subject: media: uvcvideo: Check for INACTIVE in uvc_ctrl_is_accessible() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Hans Verkuil + +[ Upstream commit 9f582f0418ed1c18f92c9e4628075d6ec9a7d9fb ] + +Check for inactive controls in uvc_ctrl_is_accessible(). + +Use the new value for the master_id controls if present, otherwise +use the existing value to determine if it is OK to set the control. +Doing this here avoids attempting to set an inactive control, which +will return an error from the USB device, which returns an invalid +errorcode. + +This fixes: + warn: v4l2-test-controls.cpp(483): s_ctrl returned EIO +  warn: v4l2-test-controls.cpp(483): s_ctrl returned EIO +test VIDIOC_G/S_CTRL: OK +  warn: v4l2-test-controls.cpp(739): s_ext_ctrls returned EIO +  warn: v4l2-test-controls.cpp(739): s_ext_ctrls returned EIO +  warn: v4l2-test-controls.cpp(816): s_ext_ctrls returned EIO +test VIDIOC_G/S/TRY_EXT_CTRLS: OK + +Tested with: +v4l2-ctl -c auto_exposure=1 +OK +v4l2-ctl -c exposure_time_absolute=251 +OK +v4l2-ctl -c auto_exposure=3 +OK +v4l2-ctl -c exposure_time_absolute=251 +VIDIOC_S_EXT_CTRLS: failed: Input/output error +exposure_time_absolute: Input/output error +ERROR +v4l2-ctl -c auto_exposure=3,exposure_time_absolute=251,auto_exposure=1 +v4l2-ctl -C auto_exposure,exposure_time_absolute   +auto_exposure: 1 +exposure_time_absolute: 251 + +Reviewed-by: Laurent Pinchart +Reviewed-by: Ricardo Ribalda +Signed-off-by: Hans Verkuil +Signed-off-by: Laurent Pinchart +Signed-off-by: Sasha Levin +--- + drivers/media/usb/uvc/uvc_ctrl.c | 42 +++++++++++++++++++++++++++++++- + drivers/media/usb/uvc/uvc_v4l2.c | 3 +-- + drivers/media/usb/uvc/uvcvideo.h | 3 ++- + 3 files changed, 44 insertions(+), 4 deletions(-) + +diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c +index fcfbd0f726936..4b3a44264b2ce 100644 +--- a/drivers/media/usb/uvc/uvc_ctrl.c ++++ b/drivers/media/usb/uvc/uvc_ctrl.c +@@ -1062,11 +1062,28 @@ static int uvc_query_v4l2_class(struct uvc_video_chain *chain, u32 req_id, + return 0; + } + ++/* ++ * Check if control @v4l2_id can be accessed by the given control @ioctl ++ * (VIDIOC_G_EXT_CTRLS, VIDIOC_TRY_EXT_CTRLS or VIDIOC_S_EXT_CTRLS). ++ * ++ * For set operations on slave controls, check if the master's value is set to ++ * manual, either in the others controls set in the same ioctl call, or from ++ * the master's current value. This catches VIDIOC_S_EXT_CTRLS calls that set ++ * both the master and slave control, such as for instance setting ++ * auto_exposure=1, exposure_time_absolute=251. ++ */ + int uvc_ctrl_is_accessible(struct uvc_video_chain *chain, u32 v4l2_id, +- bool read) ++ const struct v4l2_ext_controls *ctrls, ++ unsigned long ioctl) + { ++ struct uvc_control_mapping *master_map = NULL; ++ struct uvc_control *master_ctrl = NULL; + struct uvc_control_mapping *mapping; + struct uvc_control *ctrl; ++ bool read = ioctl == VIDIOC_G_EXT_CTRLS; ++ s32 val; ++ int ret; ++ int i; + + if (__uvc_query_v4l2_class(chain, v4l2_id, 0) >= 0) + return -EACCES; +@@ -1081,6 +1098,29 @@ int uvc_ctrl_is_accessible(struct uvc_video_chain *chain, u32 v4l2_id, + if (!(ctrl->info.flags & UVC_CTRL_FLAG_SET_CUR) && !read) + return -EACCES; + ++ if (ioctl != VIDIOC_S_EXT_CTRLS || !mapping->master_id) ++ return 0; ++ ++ /* ++ * Iterate backwards in cases where the master control is accessed ++ * multiple times in the same ioctl. We want the last value. ++ */ ++ for (i = ctrls->count - 1; i >= 0; i--) { ++ if (ctrls->controls[i].id == mapping->master_id) ++ return ctrls->controls[i].value == ++ mapping->master_manual ? 0 : -EACCES; ++ } ++ ++ __uvc_find_control(ctrl->entity, mapping->master_id, &master_map, ++ &master_ctrl, 0); ++ ++ if (!master_ctrl || !(master_ctrl->info.flags & UVC_CTRL_FLAG_GET_CUR)) ++ return 0; ++ ++ ret = __uvc_ctrl_get(chain, master_ctrl, master_map, &val); ++ if (ret >= 0 && val != mapping->master_manual) ++ return -EACCES; ++ + return 0; + } + +diff --git a/drivers/media/usb/uvc/uvc_v4l2.c b/drivers/media/usb/uvc/uvc_v4l2.c +index 7dd387e96c9de..077e1eb7535be 100644 +--- a/drivers/media/usb/uvc/uvc_v4l2.c ++++ b/drivers/media/usb/uvc/uvc_v4l2.c +@@ -1015,8 +1015,7 @@ static int uvc_ctrl_check_access(struct uvc_video_chain *chain, + int ret = 0; + + for (i = 0; i < ctrls->count; ++ctrl, ++i) { +- ret = uvc_ctrl_is_accessible(chain, ctrl->id, +- ioctl == VIDIOC_G_EXT_CTRLS); ++ ret = uvc_ctrl_is_accessible(chain, ctrl->id, ctrls, ioctl); + if (ret) + break; + } +diff --git a/drivers/media/usb/uvc/uvcvideo.h b/drivers/media/usb/uvc/uvcvideo.h +index d414a22244057..d7c4f6f5fca92 100644 +--- a/drivers/media/usb/uvc/uvcvideo.h ++++ b/drivers/media/usb/uvc/uvcvideo.h +@@ -902,7 +902,8 @@ static inline int uvc_ctrl_rollback(struct uvc_fh *handle) + int uvc_ctrl_get(struct uvc_video_chain *chain, struct v4l2_ext_control *xctrl); + int uvc_ctrl_set(struct uvc_fh *handle, struct v4l2_ext_control *xctrl); + int uvc_ctrl_is_accessible(struct uvc_video_chain *chain, u32 v4l2_id, +- bool read); ++ const struct v4l2_ext_controls *ctrls, ++ unsigned long ioctl); + + int uvc_xu_ctrl_query(struct uvc_video_chain *chain, + struct uvc_xu_control_query *xqry); +-- +2.39.2 + diff --git a/queue-5.15/media-uvcvideo-do-not-check-for-v4l2_ctrl_which_def_.patch b/queue-5.15/media-uvcvideo-do-not-check-for-v4l2_ctrl_which_def_.patch new file mode 100644 index 00000000000..8254b98a3b7 --- /dev/null +++ b/queue-5.15/media-uvcvideo-do-not-check-for-v4l2_ctrl_which_def_.patch @@ -0,0 +1,40 @@ +From 94394b1bcac2f73bda26ca60c970191350c1b9e8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Jun 2021 14:29:05 +0200 +Subject: media: uvcvideo: Do not check for V4L2_CTRL_WHICH_DEF_VAL + +From: Ricardo Ribalda + +[ Upstream commit a2f8a484fbc96b8209a760cb3f2c95ca49c2cdb1 ] + +The framework already checks for us if V4L2_CTRL_WHICH_DEF_VAL is +written. + +Reviewed-by: Hans Verkuil +Signed-off-by: Ricardo Ribalda +Signed-off-by: Laurent Pinchart +Signed-off-by: Mauro Carvalho Chehab +Stable-dep-of: 9f582f0418ed ("media: uvcvideo: Check for INACTIVE in uvc_ctrl_is_accessible()") +Signed-off-by: Sasha Levin +--- + drivers/media/usb/uvc/uvc_v4l2.c | 4 ---- + 1 file changed, 4 deletions(-) + +diff --git a/drivers/media/usb/uvc/uvc_v4l2.c b/drivers/media/usb/uvc/uvc_v4l2.c +index 63842eb223a18..d2e633f6ec671 100644 +--- a/drivers/media/usb/uvc/uvc_v4l2.c ++++ b/drivers/media/usb/uvc/uvc_v4l2.c +@@ -1106,10 +1106,6 @@ static int uvc_ioctl_s_try_ext_ctrls(struct uvc_fh *handle, + unsigned int i; + int ret; + +- /* Default value cannot be changed */ +- if (ctrls->which == V4L2_CTRL_WHICH_DEF_VAL) +- return -EINVAL; +- + ret = uvc_ctrl_begin(chain); + if (ret < 0) + return ret; +-- +2.39.2 + diff --git a/queue-5.15/media-uvcvideo-refactor-__uvc_ctrl_add_mapping.patch b/queue-5.15/media-uvcvideo-refactor-__uvc_ctrl_add_mapping.patch new file mode 100644 index 00000000000..7b067df4f80 --- /dev/null +++ b/queue-5.15/media-uvcvideo-refactor-__uvc_ctrl_add_mapping.patch @@ -0,0 +1,179 @@ +From b3ead9eee363854283170bf670f5ae89e0f5ad2e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Jun 2021 14:29:10 +0200 +Subject: media: uvcvideo: refactor __uvc_ctrl_add_mapping + +From: Ricardo Ribalda + +[ Upstream commit 866c6bdd5663d4df7cf384b381b6ef8ba9ffd0e4 ] + +Pass the chain instead of the device. We want to keep the reference to +the chain that controls belong to. + +We need to delay the initialization of the controls after the chains +have been initialized. + +This is a cleanup needed for the next patches. + +Reviewed-by: Hans Verkuil +Signed-off-by: Ricardo Ribalda +Signed-off-by: Laurent Pinchart +Signed-off-by: Mauro Carvalho Chehab +Stable-dep-of: 9f582f0418ed ("media: uvcvideo: Check for INACTIVE in uvc_ctrl_is_accessible()") +Signed-off-by: Sasha Levin +--- + drivers/media/usb/uvc/uvc_ctrl.c | 41 ++++++++++++++++++++---------- + drivers/media/usb/uvc/uvc_driver.c | 8 +++--- + 2 files changed, 32 insertions(+), 17 deletions(-) + +diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c +index 5bb29fc49538e..6b089103878ac 100644 +--- a/drivers/media/usb/uvc/uvc_ctrl.c ++++ b/drivers/media/usb/uvc/uvc_ctrl.c +@@ -2066,7 +2066,7 @@ static int uvc_ctrl_add_info(struct uvc_device *dev, struct uvc_control *ctrl, + /* + * Add a control mapping to a given control. + */ +-static int __uvc_ctrl_add_mapping(struct uvc_device *dev, ++static int __uvc_ctrl_add_mapping(struct uvc_video_chain *chain, + struct uvc_control *ctrl, const struct uvc_control_mapping *mapping) + { + struct uvc_control_mapping *map; +@@ -2095,7 +2095,7 @@ static int __uvc_ctrl_add_mapping(struct uvc_device *dev, + map->set = uvc_set_le_value; + + list_add_tail(&map->list, &ctrl->info.mappings); +- uvc_dbg(dev, CONTROL, "Adding mapping '%s' to control %pUl/%u\n", ++ uvc_dbg(chain->dev, CONTROL, "Adding mapping '%s' to control %pUl/%u\n", + map->name, ctrl->info.entity, ctrl->info.selector); + + return 0; +@@ -2177,7 +2177,7 @@ int uvc_ctrl_add_mapping(struct uvc_video_chain *chain, + goto done; + } + +- ret = __uvc_ctrl_add_mapping(dev, ctrl, mapping); ++ ret = __uvc_ctrl_add_mapping(chain, ctrl, mapping); + if (ret < 0) + atomic_dec(&dev->nmappings); + +@@ -2253,7 +2253,8 @@ static void uvc_ctrl_prune_entity(struct uvc_device *dev, + * Add control information and hardcoded stock control mappings to the given + * device. + */ +-static void uvc_ctrl_init_ctrl(struct uvc_device *dev, struct uvc_control *ctrl) ++static void uvc_ctrl_init_ctrl(struct uvc_video_chain *chain, ++ struct uvc_control *ctrl) + { + const struct uvc_control_info *info = uvc_ctrls; + const struct uvc_control_info *iend = info + ARRAY_SIZE(uvc_ctrls); +@@ -2272,14 +2273,14 @@ static void uvc_ctrl_init_ctrl(struct uvc_device *dev, struct uvc_control *ctrl) + for (; info < iend; ++info) { + if (uvc_entity_match_guid(ctrl->entity, info->entity) && + ctrl->index == info->index) { +- uvc_ctrl_add_info(dev, ctrl, info); ++ uvc_ctrl_add_info(chain->dev, ctrl, info); + /* + * Retrieve control flags from the device. Ignore errors + * and work with default flag values from the uvc_ctrl + * array when the device doesn't properly implement + * GET_INFO on standard controls. + */ +- uvc_ctrl_get_flags(dev, ctrl, &ctrl->info); ++ uvc_ctrl_get_flags(chain->dev, ctrl, &ctrl->info); + break; + } + } +@@ -2290,22 +2291,20 @@ static void uvc_ctrl_init_ctrl(struct uvc_device *dev, struct uvc_control *ctrl) + for (; mapping < mend; ++mapping) { + if (uvc_entity_match_guid(ctrl->entity, mapping->entity) && + ctrl->info.selector == mapping->selector) +- __uvc_ctrl_add_mapping(dev, ctrl, mapping); ++ __uvc_ctrl_add_mapping(chain, ctrl, mapping); + } + } + + /* + * Initialize device controls. + */ +-int uvc_ctrl_init_device(struct uvc_device *dev) ++static int uvc_ctrl_init_chain(struct uvc_video_chain *chain) + { + struct uvc_entity *entity; + unsigned int i; + +- INIT_WORK(&dev->async_ctrl.work, uvc_ctrl_status_event_work); +- + /* Walk the entities list and instantiate controls */ +- list_for_each_entry(entity, &dev->entities, list) { ++ list_for_each_entry(entity, &chain->entities, chain) { + struct uvc_control *ctrl; + unsigned int bControlSize = 0, ncontrols; + u8 *bmControls = NULL; +@@ -2325,7 +2324,7 @@ int uvc_ctrl_init_device(struct uvc_device *dev) + } + + /* Remove bogus/blacklisted controls */ +- uvc_ctrl_prune_entity(dev, entity); ++ uvc_ctrl_prune_entity(chain->dev, entity); + + /* Count supported controls and allocate the controls array */ + ncontrols = memweight(bmControls, bControlSize); +@@ -2347,7 +2346,7 @@ int uvc_ctrl_init_device(struct uvc_device *dev) + ctrl->entity = entity; + ctrl->index = i; + +- uvc_ctrl_init_ctrl(dev, ctrl); ++ uvc_ctrl_init_ctrl(chain, ctrl); + ctrl++; + } + } +@@ -2355,6 +2354,22 @@ int uvc_ctrl_init_device(struct uvc_device *dev) + return 0; + } + ++int uvc_ctrl_init_device(struct uvc_device *dev) ++{ ++ struct uvc_video_chain *chain; ++ int ret; ++ ++ INIT_WORK(&dev->async_ctrl.work, uvc_ctrl_status_event_work); ++ ++ list_for_each_entry(chain, &dev->chains, list) { ++ ret = uvc_ctrl_init_chain(chain); ++ if (ret) ++ return ret; ++ } ++ ++ return 0; ++} ++ + /* + * Cleanup device controls. + */ +diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c +index 72fff7264b549..ceae2eabc0a1c 100644 +--- a/drivers/media/usb/uvc/uvc_driver.c ++++ b/drivers/media/usb/uvc/uvc_driver.c +@@ -2455,14 +2455,14 @@ static int uvc_probe(struct usb_interface *intf, + if (v4l2_device_register(&intf->dev, &dev->vdev) < 0) + goto error; + +- /* Initialize controls. */ +- if (uvc_ctrl_init_device(dev) < 0) +- goto error; +- + /* Scan the device for video chains. */ + if (uvc_scan_device(dev) < 0) + goto error; + ++ /* Initialize controls. */ ++ if (uvc_ctrl_init_device(dev) < 0) ++ goto error; ++ + /* Register video device nodes. */ + if (uvc_register_chains(dev) < 0) + goto error; +-- +2.39.2 + diff --git a/queue-5.15/media-uvcvideo-remove-s_ctrl-and-g_ctrl.patch b/queue-5.15/media-uvcvideo-remove-s_ctrl-and-g_ctrl.patch new file mode 100644 index 00000000000..ca799c11bc8 --- /dev/null +++ b/queue-5.15/media-uvcvideo-remove-s_ctrl-and-g_ctrl.patch @@ -0,0 +1,100 @@ +From af784f52b4aefc6af87cc0b588c6262801b0572b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Jun 2021 14:29:07 +0200 +Subject: media: uvcvideo: Remove s_ctrl and g_ctrl + +From: Ricardo Ribalda + +[ Upstream commit 0c6bcbdfefa83b8a1e9659b3c127758dce0fe7ac ] + +If we do not implement these callbacks the framework will call the +ext_ctrl callbaks instead, which are a superset of this functions. + +Suggested-by: Hans Verkuil +Reviewed-by: Hans Verkuil +Signed-off-by: Ricardo Ribalda +Signed-off-by: Laurent Pinchart +Signed-off-by: Mauro Carvalho Chehab +Stable-dep-of: 9f582f0418ed ("media: uvcvideo: Check for INACTIVE in uvc_ctrl_is_accessible()") +Signed-off-by: Sasha Levin +--- + drivers/media/usb/uvc/uvc_v4l2.c | 56 -------------------------------- + 1 file changed, 56 deletions(-) + +diff --git a/drivers/media/usb/uvc/uvc_v4l2.c b/drivers/media/usb/uvc/uvc_v4l2.c +index d2e633f6ec671..6955ed080d7dc 100644 +--- a/drivers/media/usb/uvc/uvc_v4l2.c ++++ b/drivers/media/usb/uvc/uvc_v4l2.c +@@ -1000,60 +1000,6 @@ static int uvc_ioctl_query_ext_ctrl(struct file *file, void *fh, + return 0; + } + +-static int uvc_ioctl_g_ctrl(struct file *file, void *fh, +- struct v4l2_control *ctrl) +-{ +- struct uvc_fh *handle = fh; +- struct uvc_video_chain *chain = handle->chain; +- struct v4l2_ext_control xctrl; +- int ret; +- +- memset(&xctrl, 0, sizeof(xctrl)); +- xctrl.id = ctrl->id; +- +- ret = uvc_ctrl_begin(chain); +- if (ret < 0) +- return ret; +- +- ret = uvc_ctrl_get(chain, &xctrl); +- uvc_ctrl_rollback(handle); +- if (ret < 0) +- return ret; +- +- ctrl->value = xctrl.value; +- return 0; +-} +- +-static int uvc_ioctl_s_ctrl(struct file *file, void *fh, +- struct v4l2_control *ctrl) +-{ +- struct uvc_fh *handle = fh; +- struct uvc_video_chain *chain = handle->chain; +- struct v4l2_ext_control xctrl; +- int ret; +- +- memset(&xctrl, 0, sizeof(xctrl)); +- xctrl.id = ctrl->id; +- xctrl.value = ctrl->value; +- +- ret = uvc_ctrl_begin(chain); +- if (ret < 0) +- return ret; +- +- ret = uvc_ctrl_set(handle, &xctrl); +- if (ret < 0) { +- uvc_ctrl_rollback(handle); +- return ret; +- } +- +- ret = uvc_ctrl_commit(handle, &xctrl, 1); +- if (ret < 0) +- return ret; +- +- ctrl->value = xctrl.value; +- return 0; +-} +- + static int uvc_ioctl_g_ext_ctrls(struct file *file, void *fh, + struct v4l2_ext_controls *ctrls) + { +@@ -1539,8 +1485,6 @@ const struct v4l2_ioctl_ops uvc_ioctl_ops = { + .vidioc_s_input = uvc_ioctl_s_input, + .vidioc_queryctrl = uvc_ioctl_queryctrl, + .vidioc_query_ext_ctrl = uvc_ioctl_query_ext_ctrl, +- .vidioc_g_ctrl = uvc_ioctl_g_ctrl, +- .vidioc_s_ctrl = uvc_ioctl_s_ctrl, + .vidioc_g_ext_ctrls = uvc_ioctl_g_ext_ctrls, + .vidioc_s_ext_ctrls = uvc_ioctl_s_ext_ctrls, + .vidioc_try_ext_ctrls = uvc_ioctl_try_ext_ctrls, +-- +2.39.2 + diff --git a/queue-5.15/media-uvcvideo-use-control-names-from-framework.patch b/queue-5.15/media-uvcvideo-use-control-names-from-framework.patch new file mode 100644 index 00000000000..efda4564477 --- /dev/null +++ b/queue-5.15/media-uvcvideo-use-control-names-from-framework.patch @@ -0,0 +1,380 @@ +From da0da61a6c1f243d18361450577680f84b566b33 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Jun 2021 14:29:15 +0200 +Subject: media: uvcvideo: Use control names from framework + +From: Ricardo Ribalda + +[ Upstream commit 70fa906d6fceb07a49198d2f31cadecc76787419 ] + +The framework already contains a map of IDs to names, lets use it when +possible. + +Reviewed-by: Hans Verkuil +Suggested-by: Hans Verkuil +Signed-off-by: Ricardo Ribalda +Signed-off-by: Laurent Pinchart +Signed-off-by: Mauro Carvalho Chehab +Stable-dep-of: 9f582f0418ed ("media: uvcvideo: Check for INACTIVE in uvc_ctrl_is_accessible()") +Signed-off-by: Sasha Levin +--- + drivers/media/usb/uvc/uvc_ctrl.c | 57 ++++++++++++-------------------- + drivers/media/usb/uvc/uvc_v4l2.c | 8 ++++- + drivers/media/usb/uvc/uvcvideo.h | 2 +- + 3 files changed, 30 insertions(+), 37 deletions(-) + +diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c +index 769088a7f9375..748f87af5e43e 100644 +--- a/drivers/media/usb/uvc/uvc_ctrl.c ++++ b/drivers/media/usb/uvc/uvc_ctrl.c +@@ -432,7 +432,6 @@ static void uvc_ctrl_set_rel_speed(struct uvc_control_mapping *mapping, + static const struct uvc_control_mapping uvc_ctrl_mappings[] = { + { + .id = V4L2_CID_BRIGHTNESS, +- .name = "Brightness", + .entity = UVC_GUID_UVC_PROCESSING, + .selector = UVC_PU_BRIGHTNESS_CONTROL, + .size = 16, +@@ -442,7 +441,6 @@ static const struct uvc_control_mapping uvc_ctrl_mappings[] = { + }, + { + .id = V4L2_CID_CONTRAST, +- .name = "Contrast", + .entity = UVC_GUID_UVC_PROCESSING, + .selector = UVC_PU_CONTRAST_CONTROL, + .size = 16, +@@ -452,7 +450,6 @@ static const struct uvc_control_mapping uvc_ctrl_mappings[] = { + }, + { + .id = V4L2_CID_HUE, +- .name = "Hue", + .entity = UVC_GUID_UVC_PROCESSING, + .selector = UVC_PU_HUE_CONTROL, + .size = 16, +@@ -464,7 +461,6 @@ static const struct uvc_control_mapping uvc_ctrl_mappings[] = { + }, + { + .id = V4L2_CID_SATURATION, +- .name = "Saturation", + .entity = UVC_GUID_UVC_PROCESSING, + .selector = UVC_PU_SATURATION_CONTROL, + .size = 16, +@@ -474,7 +470,6 @@ static const struct uvc_control_mapping uvc_ctrl_mappings[] = { + }, + { + .id = V4L2_CID_SHARPNESS, +- .name = "Sharpness", + .entity = UVC_GUID_UVC_PROCESSING, + .selector = UVC_PU_SHARPNESS_CONTROL, + .size = 16, +@@ -484,7 +479,6 @@ static const struct uvc_control_mapping uvc_ctrl_mappings[] = { + }, + { + .id = V4L2_CID_GAMMA, +- .name = "Gamma", + .entity = UVC_GUID_UVC_PROCESSING, + .selector = UVC_PU_GAMMA_CONTROL, + .size = 16, +@@ -494,7 +488,6 @@ static const struct uvc_control_mapping uvc_ctrl_mappings[] = { + }, + { + .id = V4L2_CID_BACKLIGHT_COMPENSATION, +- .name = "Backlight Compensation", + .entity = UVC_GUID_UVC_PROCESSING, + .selector = UVC_PU_BACKLIGHT_COMPENSATION_CONTROL, + .size = 16, +@@ -504,7 +497,6 @@ static const struct uvc_control_mapping uvc_ctrl_mappings[] = { + }, + { + .id = V4L2_CID_GAIN, +- .name = "Gain", + .entity = UVC_GUID_UVC_PROCESSING, + .selector = UVC_PU_GAIN_CONTROL, + .size = 16, +@@ -514,7 +506,6 @@ static const struct uvc_control_mapping uvc_ctrl_mappings[] = { + }, + { + .id = V4L2_CID_POWER_LINE_FREQUENCY, +- .name = "Power Line Frequency", + .entity = UVC_GUID_UVC_PROCESSING, + .selector = UVC_PU_POWER_LINE_FREQUENCY_CONTROL, + .size = 2, +@@ -526,7 +517,6 @@ static const struct uvc_control_mapping uvc_ctrl_mappings[] = { + }, + { + .id = V4L2_CID_HUE_AUTO, +- .name = "Hue, Auto", + .entity = UVC_GUID_UVC_PROCESSING, + .selector = UVC_PU_HUE_AUTO_CONTROL, + .size = 1, +@@ -537,7 +527,6 @@ static const struct uvc_control_mapping uvc_ctrl_mappings[] = { + }, + { + .id = V4L2_CID_EXPOSURE_AUTO, +- .name = "Exposure, Auto", + .entity = UVC_GUID_UVC_CAMERA, + .selector = UVC_CT_AE_MODE_CONTROL, + .size = 4, +@@ -550,7 +539,6 @@ static const struct uvc_control_mapping uvc_ctrl_mappings[] = { + }, + { + .id = V4L2_CID_EXPOSURE_AUTO_PRIORITY, +- .name = "Exposure, Auto Priority", + .entity = UVC_GUID_UVC_CAMERA, + .selector = UVC_CT_AE_PRIORITY_CONTROL, + .size = 1, +@@ -560,7 +548,6 @@ static const struct uvc_control_mapping uvc_ctrl_mappings[] = { + }, + { + .id = V4L2_CID_EXPOSURE_ABSOLUTE, +- .name = "Exposure (Absolute)", + .entity = UVC_GUID_UVC_CAMERA, + .selector = UVC_CT_EXPOSURE_TIME_ABSOLUTE_CONTROL, + .size = 32, +@@ -572,7 +559,6 @@ static const struct uvc_control_mapping uvc_ctrl_mappings[] = { + }, + { + .id = V4L2_CID_AUTO_WHITE_BALANCE, +- .name = "White Balance Temperature, Auto", + .entity = UVC_GUID_UVC_PROCESSING, + .selector = UVC_PU_WHITE_BALANCE_TEMPERATURE_AUTO_CONTROL, + .size = 1, +@@ -583,7 +569,6 @@ static const struct uvc_control_mapping uvc_ctrl_mappings[] = { + }, + { + .id = V4L2_CID_WHITE_BALANCE_TEMPERATURE, +- .name = "White Balance Temperature", + .entity = UVC_GUID_UVC_PROCESSING, + .selector = UVC_PU_WHITE_BALANCE_TEMPERATURE_CONTROL, + .size = 16, +@@ -595,7 +580,6 @@ static const struct uvc_control_mapping uvc_ctrl_mappings[] = { + }, + { + .id = V4L2_CID_AUTO_WHITE_BALANCE, +- .name = "White Balance Component, Auto", + .entity = UVC_GUID_UVC_PROCESSING, + .selector = UVC_PU_WHITE_BALANCE_COMPONENT_AUTO_CONTROL, + .size = 1, +@@ -607,7 +591,6 @@ static const struct uvc_control_mapping uvc_ctrl_mappings[] = { + }, + { + .id = V4L2_CID_BLUE_BALANCE, +- .name = "White Balance Blue Component", + .entity = UVC_GUID_UVC_PROCESSING, + .selector = UVC_PU_WHITE_BALANCE_COMPONENT_CONTROL, + .size = 16, +@@ -619,7 +602,6 @@ static const struct uvc_control_mapping uvc_ctrl_mappings[] = { + }, + { + .id = V4L2_CID_RED_BALANCE, +- .name = "White Balance Red Component", + .entity = UVC_GUID_UVC_PROCESSING, + .selector = UVC_PU_WHITE_BALANCE_COMPONENT_CONTROL, + .size = 16, +@@ -631,7 +613,6 @@ static const struct uvc_control_mapping uvc_ctrl_mappings[] = { + }, + { + .id = V4L2_CID_FOCUS_ABSOLUTE, +- .name = "Focus (absolute)", + .entity = UVC_GUID_UVC_CAMERA, + .selector = UVC_CT_FOCUS_ABSOLUTE_CONTROL, + .size = 16, +@@ -643,7 +624,6 @@ static const struct uvc_control_mapping uvc_ctrl_mappings[] = { + }, + { + .id = V4L2_CID_FOCUS_AUTO, +- .name = "Focus, Auto", + .entity = UVC_GUID_UVC_CAMERA, + .selector = UVC_CT_FOCUS_AUTO_CONTROL, + .size = 1, +@@ -654,7 +634,6 @@ static const struct uvc_control_mapping uvc_ctrl_mappings[] = { + }, + { + .id = V4L2_CID_IRIS_ABSOLUTE, +- .name = "Iris, Absolute", + .entity = UVC_GUID_UVC_CAMERA, + .selector = UVC_CT_IRIS_ABSOLUTE_CONTROL, + .size = 16, +@@ -664,7 +643,6 @@ static const struct uvc_control_mapping uvc_ctrl_mappings[] = { + }, + { + .id = V4L2_CID_IRIS_RELATIVE, +- .name = "Iris, Relative", + .entity = UVC_GUID_UVC_CAMERA, + .selector = UVC_CT_IRIS_RELATIVE_CONTROL, + .size = 8, +@@ -674,7 +652,6 @@ static const struct uvc_control_mapping uvc_ctrl_mappings[] = { + }, + { + .id = V4L2_CID_ZOOM_ABSOLUTE, +- .name = "Zoom, Absolute", + .entity = UVC_GUID_UVC_CAMERA, + .selector = UVC_CT_ZOOM_ABSOLUTE_CONTROL, + .size = 16, +@@ -684,7 +661,6 @@ static const struct uvc_control_mapping uvc_ctrl_mappings[] = { + }, + { + .id = V4L2_CID_ZOOM_CONTINUOUS, +- .name = "Zoom, Continuous", + .entity = UVC_GUID_UVC_CAMERA, + .selector = UVC_CT_ZOOM_RELATIVE_CONTROL, + .size = 0, +@@ -696,7 +672,6 @@ static const struct uvc_control_mapping uvc_ctrl_mappings[] = { + }, + { + .id = V4L2_CID_PAN_ABSOLUTE, +- .name = "Pan (Absolute)", + .entity = UVC_GUID_UVC_CAMERA, + .selector = UVC_CT_PANTILT_ABSOLUTE_CONTROL, + .size = 32, +@@ -706,7 +681,6 @@ static const struct uvc_control_mapping uvc_ctrl_mappings[] = { + }, + { + .id = V4L2_CID_TILT_ABSOLUTE, +- .name = "Tilt (Absolute)", + .entity = UVC_GUID_UVC_CAMERA, + .selector = UVC_CT_PANTILT_ABSOLUTE_CONTROL, + .size = 32, +@@ -716,7 +690,6 @@ static const struct uvc_control_mapping uvc_ctrl_mappings[] = { + }, + { + .id = V4L2_CID_PAN_SPEED, +- .name = "Pan (Speed)", + .entity = UVC_GUID_UVC_CAMERA, + .selector = UVC_CT_PANTILT_RELATIVE_CONTROL, + .size = 16, +@@ -728,7 +701,6 @@ static const struct uvc_control_mapping uvc_ctrl_mappings[] = { + }, + { + .id = V4L2_CID_TILT_SPEED, +- .name = "Tilt (Speed)", + .entity = UVC_GUID_UVC_CAMERA, + .selector = UVC_CT_PANTILT_RELATIVE_CONTROL, + .size = 16, +@@ -740,7 +712,6 @@ static const struct uvc_control_mapping uvc_ctrl_mappings[] = { + }, + { + .id = V4L2_CID_PRIVACY, +- .name = "Privacy", + .entity = UVC_GUID_UVC_CAMERA, + .selector = UVC_CT_PRIVACY_CONTROL, + .size = 1, +@@ -750,7 +721,6 @@ static const struct uvc_control_mapping uvc_ctrl_mappings[] = { + }, + { + .id = V4L2_CID_PRIVACY, +- .name = "Privacy", + .entity = UVC_GUID_EXT_GPIO_CONTROLLER, + .selector = UVC_CT_PRIVACY_CONTROL, + .size = 1, +@@ -1092,6 +1062,20 @@ static int uvc_query_v4l2_class(struct uvc_video_chain *chain, u32 req_id, + return 0; + } + ++static const char *uvc_map_get_name(const struct uvc_control_mapping *map) ++{ ++ const char *name; ++ ++ if (map->name) ++ return map->name; ++ ++ name = v4l2_ctrl_get_name(map->id); ++ if (name) ++ return name; ++ ++ return "Unknown Control"; ++} ++ + static int __uvc_query_v4l2_ctrl(struct uvc_video_chain *chain, + struct uvc_control *ctrl, + struct uvc_control_mapping *mapping, +@@ -1105,7 +1089,8 @@ static int __uvc_query_v4l2_ctrl(struct uvc_video_chain *chain, + memset(v4l2_ctrl, 0, sizeof(*v4l2_ctrl)); + v4l2_ctrl->id = mapping->id; + v4l2_ctrl->type = mapping->v4l2_type; +- strscpy(v4l2_ctrl->name, mapping->name, sizeof(v4l2_ctrl->name)); ++ strscpy(v4l2_ctrl->name, uvc_map_get_name(mapping), ++ sizeof(v4l2_ctrl->name)); + v4l2_ctrl->flags = 0; + + if (!(ctrl->info.flags & UVC_CTRL_FLAG_GET_CUR)) +@@ -2186,7 +2171,8 @@ static int __uvc_ctrl_add_mapping(struct uvc_video_chain *chain, + + list_add_tail(&map->list, &ctrl->info.mappings); + uvc_dbg(chain->dev, CONTROL, "Adding mapping '%s' to control %pUl/%u\n", +- map->name, ctrl->info.entity, ctrl->info.selector); ++ uvc_map_get_name(map), ctrl->info.entity, ++ ctrl->info.selector); + + return 0; + } +@@ -2204,7 +2190,7 @@ int uvc_ctrl_add_mapping(struct uvc_video_chain *chain, + if (mapping->id & ~V4L2_CTRL_ID_MASK) { + uvc_dbg(dev, CONTROL, + "Can't add mapping '%s', control id 0x%08x is invalid\n", +- mapping->name, mapping->id); ++ uvc_map_get_name(mapping), mapping->id); + return -EINVAL; + } + +@@ -2251,7 +2237,7 @@ int uvc_ctrl_add_mapping(struct uvc_video_chain *chain, + if (mapping->id == map->id) { + uvc_dbg(dev, CONTROL, + "Can't add mapping '%s', control id 0x%08x already exists\n", +- mapping->name, mapping->id); ++ uvc_map_get_name(mapping), mapping->id); + ret = -EEXIST; + goto done; + } +@@ -2262,7 +2248,7 @@ int uvc_ctrl_add_mapping(struct uvc_video_chain *chain, + atomic_dec(&dev->nmappings); + uvc_dbg(dev, CONTROL, + "Can't add mapping '%s', maximum mappings count (%u) exceeded\n", +- mapping->name, UVC_MAX_CONTROL_MAPPINGS); ++ uvc_map_get_name(mapping), UVC_MAX_CONTROL_MAPPINGS); + ret = -ENOMEM; + goto done; + } +@@ -2471,6 +2457,7 @@ static void uvc_ctrl_cleanup_mappings(struct uvc_device *dev, + list_for_each_entry_safe(mapping, nm, &ctrl->info.mappings, list) { + list_del(&mapping->list); + kfree(mapping->menu_info); ++ kfree(mapping->name); + kfree(mapping); + } + } +diff --git a/drivers/media/usb/uvc/uvc_v4l2.c b/drivers/media/usb/uvc/uvc_v4l2.c +index 6955ed080d7dc..533c4a0645ee4 100644 +--- a/drivers/media/usb/uvc/uvc_v4l2.c ++++ b/drivers/media/usb/uvc/uvc_v4l2.c +@@ -40,7 +40,13 @@ static int uvc_ioctl_ctrl_map(struct uvc_video_chain *chain, + return -ENOMEM; + + map->id = xmap->id; +- memcpy(map->name, xmap->name, sizeof(map->name)); ++ /* Non standard control id. */ ++ if (v4l2_ctrl_get_name(map->id) == NULL) { ++ map->name = kmemdup(xmap->name, sizeof(xmap->name), ++ GFP_KERNEL); ++ if (!map->name) ++ return -ENOMEM; ++ } + memcpy(map->entity, xmap->entity, sizeof(map->entity)); + map->selector = xmap->selector; + map->size = xmap->size; +diff --git a/drivers/media/usb/uvc/uvcvideo.h b/drivers/media/usb/uvc/uvcvideo.h +index 2c57a50f6a79b..33befa48fb493 100644 +--- a/drivers/media/usb/uvc/uvcvideo.h ++++ b/drivers/media/usb/uvc/uvcvideo.h +@@ -241,7 +241,7 @@ struct uvc_control_mapping { + struct list_head ev_subs; + + u32 id; +- u8 name[32]; ++ char *name; + u8 entity[16]; + u8 selector; + +-- +2.39.2 + diff --git a/queue-5.15/media-v4l2-jpeg-correct-the-skip-count-in-jpeg_parse.patch b/queue-5.15/media-v4l2-jpeg-correct-the-skip-count-in-jpeg_parse.patch new file mode 100644 index 00000000000..d93ba3dee8d --- /dev/null +++ b/queue-5.15/media-v4l2-jpeg-correct-the-skip-count-in-jpeg_parse.patch @@ -0,0 +1,44 @@ +From c45d1d2632e123d6d6c56e3c7cd964cdc7df5b94 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Dec 2022 09:30:33 +0100 +Subject: media: v4l2-jpeg: correct the skip count in jpeg_parse_app14_data + +From: Ming Qian + +[ Upstream commit 41959c4f973b837a12061b84d3a436fc64c73a30 ] + +The curr pointer has advanced 14 bytes in jpeg_parse_app14_data. +1. jpeg_get_word_be(stream), it goes forward 2 bytes. +2. jpeg_skip(stream, 11), it goes forward 11 bytes. +3. jpeg_get_byte(stream), it goes forward 1 bytes. + +so the remain bytes of this segment should be (lp - 2 - 11 - 1), +but not (lp - 2 - 11). + +if driver skip 1 extra bytes, the following parsing may go wrong. + +Fixes: b8035f7988a8 ("media: Add parsing for APP14 data segment in jpeg helpers") +Signed-off-by: Ming Qian +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/v4l2-core/v4l2-jpeg.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/v4l2-core/v4l2-jpeg.c b/drivers/media/v4l2-core/v4l2-jpeg.c +index c2513b775f6a7..75c2af763d55e 100644 +--- a/drivers/media/v4l2-core/v4l2-jpeg.c ++++ b/drivers/media/v4l2-core/v4l2-jpeg.c +@@ -474,7 +474,7 @@ static int jpeg_parse_app14_data(struct jpeg_stream *stream, + *tf = ret; + + /* skip the rest of the segment, this ensures at least it is complete */ +- skip = lp - 2 - 11; ++ skip = lp - 2 - 11 - 1; + return jpeg_skip(stream, skip); + } + +-- +2.39.2 + diff --git a/queue-5.15/media-v4l2-jpeg-ignore-the-unknown-app14-marker.patch b/queue-5.15/media-v4l2-jpeg-ignore-the-unknown-app14-marker.patch new file mode 100644 index 00000000000..11a31295a41 --- /dev/null +++ b/queue-5.15/media-v4l2-jpeg-ignore-the-unknown-app14-marker.patch @@ -0,0 +1,40 @@ +From 6781892e79ec33f017fd862e15d8ea7ff9fb3d39 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Dec 2022 10:08:44 +0100 +Subject: media: v4l2-jpeg: ignore the unknown APP14 marker + +From: Ming Qian + +[ Upstream commit 251c0ea6efd3c3ea0f8a55fdd96c749a98639bd3 ] + +The legal identifier of APP14 is "Adobe\0", +but sometimes it may be +"This is an unknown APP marker . Compliant decoders must ignore it." +In this case, just ignore it. +It won't affect the decode result. + +Fixes: b8035f7988a8 ("media: Add parsing for APP14 data segment in jpeg helpers") +Signed-off-by: Ming Qian +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/v4l2-core/v4l2-jpeg.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/v4l2-core/v4l2-jpeg.c b/drivers/media/v4l2-core/v4l2-jpeg.c +index 75c2af763d55e..94435a7b68169 100644 +--- a/drivers/media/v4l2-core/v4l2-jpeg.c ++++ b/drivers/media/v4l2-core/v4l2-jpeg.c +@@ -460,7 +460,7 @@ static int jpeg_parse_app14_data(struct jpeg_stream *stream, + /* Check for "Adobe\0" in Ap1..6 */ + if (stream->curr + 6 > stream->end || + strncmp(stream->curr, "Adobe\0", 6)) +- return -EINVAL; ++ return jpeg_skip(stream, lp - 2); + + /* get to Ap12 */ + ret = jpeg_skip(stream, 11); +-- +2.39.2 + diff --git a/queue-5.15/mfd-cs5535-don-t-build-on-uml.patch b/queue-5.15/mfd-cs5535-don-t-build-on-uml.patch new file mode 100644 index 00000000000..fb6fe56188a --- /dev/null +++ b/queue-5.15/mfd-cs5535-don-t-build-on-uml.patch @@ -0,0 +1,62 @@ +From 140d71d12f531f62acc2e206de8bf0aa8b7c9373 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Nov 2022 17:25:41 -0800 +Subject: mfd: cs5535: Don't build on UML +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Randy Dunlap + +[ Upstream commit 5ec32a3e4053c1a726b45381d56aa9e39eaf3911 ] + +The cs5535-mfd driver uses CPU-specific data that is not available +for ARCH=um builds, so don't allow it to be built for UML. + +Prevents these build errors: + +In file included from ../arch/x86/include/asm/olpc.h:7, + from ../drivers/mfd/cs5535-mfd.c:17: +../arch/x86/include/asm/geode.h: In function ‘is_geode_gx’: +../arch/x86/include/asm/geode.h:16:31: error: ‘struct cpuinfo_um’ has no member named ‘x86_vendor’ + 16 | return ((boot_cpu_data.x86_vendor == X86_VENDOR_NSC) && +../arch/x86/include/asm/geode.h:16:46: error: ‘X86_VENDOR_NSC’ undeclared (first use in this function); did you mean ‘X86_VENDOR_ANY’? + 16 | return ((boot_cpu_data.x86_vendor == X86_VENDOR_NSC) && +../arch/x86/include/asm/geode.h:17:31: error: ‘struct cpuinfo_um’ has no member named ‘x86’ + 17 | (boot_cpu_data.x86 == 5) && +../arch/x86/include/asm/geode.h:18:31: error: ‘struct cpuinfo_um’ has no member named ‘x86_model’ + 18 | (boot_cpu_data.x86_model == 5)); +../arch/x86/include/asm/geode.h: In function ‘is_geode_lx’: +../arch/x86/include/asm/geode.h:23:31: error: ‘struct cpuinfo_um’ has no member named ‘x86_vendor’ + 23 | return ((boot_cpu_data.x86_vendor == X86_VENDOR_AMD) && +../arch/x86/include/asm/geode.h:23:46: error: ‘X86_VENDOR_AMD’ undeclared (first use in this function); did you mean ‘X86_VENDOR_ANY’? + 23 | return ((boot_cpu_data.x86_vendor == X86_VENDOR_AMD) && +../arch/x86/include/asm/geode.h:24:31: error: ‘struct cpuinfo_um’ has no member named ‘x86’ + 24 | (boot_cpu_data.x86 == 5) && +../arch/x86/include/asm/geode.h:25:31: error: ‘struct cpuinfo_um’ has no member named ‘x86_model’ + 25 | (boot_cpu_data.x86_model == 10)); + +Fixes: 68f5d3f3b654 ("um: add PCI over virtio emulation driver") +Signed-off-by: Randy Dunlap +Signed-off-by: Lee Jones +Link: https://lore.kernel.org/r/20221201012541.11809-1-rdunlap@infradead.org +Signed-off-by: Sasha Levin +--- + drivers/mfd/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/mfd/Kconfig b/drivers/mfd/Kconfig +index 5dd7ea0ebd46c..ef550d33af920 100644 +--- a/drivers/mfd/Kconfig ++++ b/drivers/mfd/Kconfig +@@ -15,6 +15,7 @@ config MFD_CS5535 + tristate "AMD CS5535 and CS5536 southbridge core functions" + select MFD_CORE + depends on PCI && (X86_32 || (X86 && COMPILE_TEST)) ++ depends on !UML + help + This is the core driver for CS5535/CS5536 MFD functions. This is + necessary for using the board's GPIO and MFGPT functionality. +-- +2.39.2 + diff --git a/queue-5.15/mfd-pcf50633-adc-fix-potential-memleak-in-pcf50633_a.patch b/queue-5.15/mfd-pcf50633-adc-fix-potential-memleak-in-pcf50633_a.patch new file mode 100644 index 00000000000..3594c661982 --- /dev/null +++ b/queue-5.15/mfd-pcf50633-adc-fix-potential-memleak-in-pcf50633_a.patch @@ -0,0 +1,50 @@ +From d439b1bb523178f05d2764eb6f24f6106553538d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Dec 2022 14:15:55 +0800 +Subject: mfd: pcf50633-adc: Fix potential memleak in pcf50633_adc_async_read() + +From: Qiheng Lin + +[ Upstream commit 8b450dcff23aa254844492831a8e2b508a9d522d ] + +`req` is allocated in pcf50633_adc_async_read(), but +adc_enqueue_request() could fail to insert the `req` into queue. +We need to check the return value and free it in the case of failure. + +Fixes: 08c3e06a5eb2 ("mfd: PCF50633 adc driver") +Signed-off-by: Qiheng Lin +Signed-off-by: Lee Jones +Link: https://lore.kernel.org/r/20221208061555.8776-1-linqiheng@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/mfd/pcf50633-adc.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/mfd/pcf50633-adc.c b/drivers/mfd/pcf50633-adc.c +index 5cd653e615125..191b1bc6141c2 100644 +--- a/drivers/mfd/pcf50633-adc.c ++++ b/drivers/mfd/pcf50633-adc.c +@@ -136,6 +136,7 @@ int pcf50633_adc_async_read(struct pcf50633 *pcf, int mux, int avg, + void *callback_param) + { + struct pcf50633_adc_request *req; ++ int ret; + + /* req is freed when the result is ready, in interrupt handler */ + req = kmalloc(sizeof(*req), GFP_KERNEL); +@@ -147,7 +148,11 @@ int pcf50633_adc_async_read(struct pcf50633 *pcf, int mux, int avg, + req->callback = callback; + req->callback_param = callback_param; + +- return adc_enqueue_request(pcf, req); ++ ret = adc_enqueue_request(pcf, req); ++ if (ret) ++ kfree(req); ++ ++ return ret; + } + EXPORT_SYMBOL_GPL(pcf50633_adc_async_read); + +-- +2.39.2 + diff --git a/queue-5.15/misc-mei-hdcp-use-correct-macros-to-initialize-uuid_.patch b/queue-5.15/misc-mei-hdcp-use-correct-macros-to-initialize-uuid_.patch new file mode 100644 index 00000000000..451c49a92ce --- /dev/null +++ b/queue-5.15/misc-mei-hdcp-use-correct-macros-to-initialize-uuid_.patch @@ -0,0 +1,41 @@ +From d42cd96f5e0160541e18105eddfd9626556fe234 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Dec 2022 18:05:00 +0200 +Subject: misc/mei/hdcp: Use correct macros to initialize uuid_le + +From: Andy Shevchenko + +[ Upstream commit 512ba04d8211dd1a54dd36adc3ecc527a28069c5 ] + +GUID_INIT() is for internal guid_t type and shouldn't be used +for the uuid_le. I.o.w. relying on the implementation details +is layering violation. Use correct macros to initialize uuid_le. + +Fixes: 64e9bbdd9588 ("misc/mei/hdcp: Client driver for HDCP application") +Signed-off-by: Andy Shevchenko +Acked-by: Tomas Winkler +Link: https://lore.kernel.org/r/20221228160500.21220-1-andriy.shevchenko@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/misc/mei/hdcp/mei_hdcp.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/misc/mei/hdcp/mei_hdcp.c b/drivers/misc/mei/hdcp/mei_hdcp.c +index ec2a4fce85818..5c4295d366eae 100644 +--- a/drivers/misc/mei/hdcp/mei_hdcp.c ++++ b/drivers/misc/mei/hdcp/mei_hdcp.c +@@ -859,8 +859,8 @@ static void mei_hdcp_remove(struct mei_cl_device *cldev) + dev_warn(&cldev->dev, "mei_cldev_disable() failed\n"); + } + +-#define MEI_UUID_HDCP GUID_INIT(0xB638AB7E, 0x94E2, 0x4EA2, 0xA5, \ +- 0x52, 0xD1, 0xC5, 0x4B, 0x62, 0x7F, 0x04) ++#define MEI_UUID_HDCP UUID_LE(0xB638AB7E, 0x94E2, 0x4EA2, 0xA5, \ ++ 0x52, 0xD1, 0xC5, 0x4B, 0x62, 0x7F, 0x04) + + static const struct mei_cl_device_id mei_hdcp_tbl[] = { + { .uuid = MEI_UUID_HDCP, .version = MEI_CL_VERSION_ANY }, +-- +2.39.2 + diff --git a/queue-5.15/mt76-mt7915-fix-polling-firmware-own-status.patch b/queue-5.15/mt76-mt7915-fix-polling-firmware-own-status.patch new file mode 100644 index 00000000000..6230876666b --- /dev/null +++ b/queue-5.15/mt76-mt7915-fix-polling-firmware-own-status.patch @@ -0,0 +1,46 @@ +From ea1dd37df613cfa2314998fd3f1a361d8e26d2a5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 23 Nov 2020 14:06:50 +0100 +Subject: mt76: mt7915: fix polling firmware-own status + +From: Felix Fietkau + +[ Upstream commit 71bb496ce17f6976c8a75b054861781965b07ac0 ] + +Check the register status bit instead of the trigger bit + +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 2 +- + drivers/net/wireless/mediatek/mt76/mt7915/regs.h | 1 + + 2 files changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c +index e9d854e3293e4..1c900454cf58c 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c +@@ -2689,7 +2689,7 @@ static int mt7915_driver_own(struct mt7915_dev *dev) + { + mt76_wr(dev, MT_TOP_LPCR_HOST_BAND0, MT_TOP_LPCR_HOST_DRV_OWN); + if (!mt76_poll_msec(dev, MT_TOP_LPCR_HOST_BAND0, +- MT_TOP_LPCR_HOST_FW_OWN, 0, 500)) { ++ MT_TOP_LPCR_HOST_FW_OWN_STAT, 0, 500)) { + dev_err(dev->mt76.dev, "Timeout for driver own\n"); + return -EIO; + } +diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/regs.h b/drivers/net/wireless/mediatek/mt76/mt7915/regs.h +index a213b5cb82f81..f4101cc9f9eb1 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7915/regs.h ++++ b/drivers/net/wireless/mediatek/mt76/mt7915/regs.h +@@ -426,6 +426,7 @@ + #define MT_TOP_LPCR_HOST_BAND0 MT_TOP(0x10) + #define MT_TOP_LPCR_HOST_FW_OWN BIT(0) + #define MT_TOP_LPCR_HOST_DRV_OWN BIT(1) ++#define MT_TOP_LPCR_HOST_FW_OWN_STAT BIT(2) + + #define MT_TOP_MISC MT_TOP(0xf0) + #define MT_TOP_MISC_FW_STATE GENMASK(2, 0) +-- +2.39.2 + diff --git a/queue-5.15/net-add-sock_init_data_uid.patch b/queue-5.15/net-add-sock_init_data_uid.patch new file mode 100644 index 00000000000..6b6b078cf75 --- /dev/null +++ b/queue-5.15/net-add-sock_init_data_uid.patch @@ -0,0 +1,89 @@ +From 4b1df883818002096d30177249239c47329ab7bf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 4 Feb 2023 17:39:20 +0000 +Subject: net: add sock_init_data_uid() + +From: Pietro Borrello + +[ Upstream commit 584f3742890e966d2f0a1f3c418c9ead70b2d99e ] + +Add sock_init_data_uid() to explicitly initialize the socket uid. +To initialise the socket uid, sock_init_data() assumes a the struct +socket* sock is always embedded in a struct socket_alloc, used to +access the corresponding inode uid. This may not be true. +Examples are sockets created in tun_chr_open() and tap_open(). + +Fixes: 86741ec25462 ("net: core: Add a UID field to struct sock.") +Signed-off-by: Pietro Borrello +Reviewed-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/net/sock.h | 7 ++++++- + net/core/sock.c | 15 ++++++++++++--- + 2 files changed, 18 insertions(+), 4 deletions(-) + +diff --git a/include/net/sock.h b/include/net/sock.h +index cd6f2ae28ecf2..3a4e81399edc6 100644 +--- a/include/net/sock.h ++++ b/include/net/sock.h +@@ -1847,7 +1847,12 @@ void sk_common_release(struct sock *sk); + * Default socket callbacks and setup code + */ + +-/* Initialise core socket variables */ ++/* Initialise core socket variables using an explicit uid. */ ++void sock_init_data_uid(struct socket *sock, struct sock *sk, kuid_t uid); ++ ++/* Initialise core socket variables. ++ * Assumes struct socket *sock is embedded in a struct socket_alloc. ++ */ + void sock_init_data(struct socket *sock, struct sock *sk); + + /* +diff --git a/net/core/sock.c b/net/core/sock.c +index b7ac53e72d1ad..ff7e8fc80731d 100644 +--- a/net/core/sock.c ++++ b/net/core/sock.c +@@ -3118,7 +3118,7 @@ void sk_stop_timer_sync(struct sock *sk, struct timer_list *timer) + } + EXPORT_SYMBOL(sk_stop_timer_sync); + +-void sock_init_data(struct socket *sock, struct sock *sk) ++void sock_init_data_uid(struct socket *sock, struct sock *sk, kuid_t uid) + { + sk_init_common(sk); + sk->sk_send_head = NULL; +@@ -3137,11 +3137,10 @@ void sock_init_data(struct socket *sock, struct sock *sk) + sk->sk_type = sock->type; + RCU_INIT_POINTER(sk->sk_wq, &sock->wq); + sock->sk = sk; +- sk->sk_uid = SOCK_INODE(sock)->i_uid; + } else { + RCU_INIT_POINTER(sk->sk_wq, NULL); +- sk->sk_uid = make_kuid(sock_net(sk)->user_ns, 0); + } ++ sk->sk_uid = uid; + + rwlock_init(&sk->sk_callback_lock); + if (sk->sk_kern_sock) +@@ -3199,6 +3198,16 @@ void sock_init_data(struct socket *sock, struct sock *sk) + refcount_set(&sk->sk_refcnt, 1); + atomic_set(&sk->sk_drops, 0); + } ++EXPORT_SYMBOL(sock_init_data_uid); ++ ++void sock_init_data(struct socket *sock, struct sock *sk) ++{ ++ kuid_t uid = sock ? ++ SOCK_INODE(sock)->i_uid : ++ make_kuid(sock_net(sk)->user_ns, 0); ++ ++ sock_init_data_uid(sock, sk, uid); ++} + EXPORT_SYMBOL(sock_init_data); + + void lock_sock_nested(struct sock *sk, int subclass) +-- +2.39.2 + diff --git a/queue-5.15/net-bcmgenet-add-a-check-for-oversized-packets.patch b/queue-5.15/net-bcmgenet-add-a-check-for-oversized-packets.patch new file mode 100644 index 00000000000..62ef9abcb84 --- /dev/null +++ b/queue-5.15/net-bcmgenet-add-a-check-for-oversized-packets.patch @@ -0,0 +1,43 @@ +From 0016bf607ce203a57ecf1c951a0612aca0fa98c5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Jan 2023 16:08:19 -0800 +Subject: net: bcmgenet: Add a check for oversized packets + +From: Florian Fainelli + +[ Upstream commit 5c0862c2c962052ed5055220a00ac1cefb92fbcd ] + +Occasionnaly we may get oversized packets from the hardware which +exceed the nomimal 2KiB buffer size we allocate SKBs with. Add an early +check which drops the packet to avoid invoking skb_over_panic() and move +on to processing the next packet. + +Signed-off-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/genet/bcmgenet.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c +index ea13917537526..92cd2916e8015 100644 +--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c ++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c +@@ -2267,6 +2267,14 @@ static unsigned int bcmgenet_desc_rx(struct bcmgenet_rx_ring *ring, + __func__, p_index, ring->c_index, + ring->read_ptr, dma_length_status); + ++ if (unlikely(len > RX_BUF_LENGTH)) { ++ netif_err(priv, rx_status, dev, "oversized packet\n"); ++ dev->stats.rx_length_errors++; ++ dev->stats.rx_errors++; ++ dev_kfree_skb_any(skb); ++ goto next; ++ } ++ + if (unlikely(!(dma_flag & DMA_EOP) || !(dma_flag & DMA_SOP))) { + netif_err(priv, rx_status, dev, + "dropping fragmented packet!\n"); +-- +2.39.2 + diff --git a/queue-5.15/net-bcmgenet-fix-moca-led-control.patch b/queue-5.15/net-bcmgenet-fix-moca-led-control.patch new file mode 100644 index 00000000000..237aae0c199 --- /dev/null +++ b/queue-5.15/net-bcmgenet-fix-moca-led-control.patch @@ -0,0 +1,54 @@ +From 5acb3d9e57e45f9de291924fcfa7529eb47d6477 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Feb 2023 11:41:28 -0800 +Subject: net: bcmgenet: fix MoCA LED control + +From: Doug Berger + +[ Upstream commit a7515af9fb8f0890fe540b108def4a86b9e8330a ] + +When the bcmgenet_mii_config() code was refactored it was missed +that the LED control for the MoCA interface got overwritten by +the port_ctrl value. Its previous programming is restored here. + +Fixes: 4f8d81b77e66 ("net: bcmgenet: Refactor register access in bcmgenet_mii_config") +Signed-off-by: Doug Berger +Acked-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/genet/bcmmii.c | 11 ++--------- + 1 file changed, 2 insertions(+), 9 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/genet/bcmmii.c b/drivers/net/ethernet/broadcom/genet/bcmmii.c +index dbd2ede53f946..f61f832ea19ca 100644 +--- a/drivers/net/ethernet/broadcom/genet/bcmmii.c ++++ b/drivers/net/ethernet/broadcom/genet/bcmmii.c +@@ -165,15 +165,6 @@ void bcmgenet_phy_power_set(struct net_device *dev, bool enable) + + static void bcmgenet_moca_phy_setup(struct bcmgenet_priv *priv) + { +- u32 reg; +- +- if (!GENET_IS_V5(priv)) { +- /* Speed settings are set in bcmgenet_mii_setup() */ +- reg = bcmgenet_sys_readl(priv, SYS_PORT_CTRL); +- reg |= LED_ACT_SOURCE_MAC; +- bcmgenet_sys_writel(priv, reg, SYS_PORT_CTRL); +- } +- + if (priv->hw_params->flags & GENET_HAS_MOCA_LINK_DET) + fixed_phy_set_link_update(priv->dev->phydev, + bcmgenet_fixed_phy_link_update); +@@ -206,6 +197,8 @@ int bcmgenet_mii_config(struct net_device *dev, bool init) + + if (!phy_name) { + phy_name = "MoCA"; ++ if (!GENET_IS_V5(priv)) ++ port_ctrl |= LED_ACT_SOURCE_MAC; + bcmgenet_moca_phy_setup(priv); + } + break; +-- +2.39.2 + diff --git a/queue-5.15/net-mlx5-enhance-debug-print-in-page-allocation-fail.patch b/queue-5.15/net-mlx5-enhance-debug-print-in-page-allocation-fail.patch new file mode 100644 index 00000000000..45a40036459 --- /dev/null +++ b/queue-5.15/net-mlx5-enhance-debug-print-in-page-allocation-fail.patch @@ -0,0 +1,38 @@ +From 264ab1608c91594aac696ede70b080435768a78a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Jan 2023 19:57:04 +0200 +Subject: net/mlx5: Enhance debug print in page allocation failure + +From: Jack Morgenstein + +[ Upstream commit 7eef93003e5d20e1a6a6e59e12d914b5431cbda2 ] + +Provide more details to aid debugging. + +Fixes: bf0bf77f6519 ("mlx5: Support communicating arbitrary host page size to firmware") +Signed-off-by: Eran Ben Elisha +Signed-off-by: Majd Dibbiny +Signed-off-by: Jack Morgenstein +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c +index 110c0837f95b9..ae6ac51b8ab03 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c +@@ -216,7 +216,8 @@ static int alloc_4k(struct mlx5_core_dev *dev, u64 *addr, u32 function) + + n = find_first_bit(&fp->bitmask, 8 * sizeof(fp->bitmask)); + if (n >= MLX5_NUM_4K_IN_PAGE) { +- mlx5_core_warn(dev, "alloc 4k bug\n"); ++ mlx5_core_warn(dev, "alloc 4k bug: fw page = 0x%llx, n = %u, bitmask: %lu, max num of 4K pages: %d\n", ++ fp->addr, n, fp->bitmask, MLX5_NUM_4K_IN_PAGE); + return -ENOENT; + } + clear_bit(n, &fp->bitmask); +-- +2.39.2 + diff --git a/queue-5.15/net-mlx5-fw_tracer-fix-debug-print.patch b/queue-5.15/net-mlx5-fw_tracer-fix-debug-print.patch new file mode 100644 index 00000000000..8a4649f6a1f --- /dev/null +++ b/queue-5.15/net-mlx5-fw_tracer-fix-debug-print.patch @@ -0,0 +1,36 @@ +From 0b82e5eea3b2852cf435270b61cccb426410819a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Jan 2023 13:34:02 +0200 +Subject: net/mlx5: fw_tracer: Fix debug print + +From: Shay Drory + +[ Upstream commit 988c2352273997a242f15c4fc3711773515006a2 ] + +The debug message specify tdsn, but takes as an argument the +tmsn. The correct argument is tmsn, hence, fix the print. + +Signed-off-by: Shay Drory +Reviewed-by: Moshe Shemesh +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c b/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c +index 1c72fc0b7b68a..05c7c2140909f 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c +@@ -603,7 +603,7 @@ static int mlx5_tracer_handle_string_trace(struct mlx5_fw_tracer *tracer, + } else { + cur_string = mlx5_tracer_message_get(tracer, tracer_event); + if (!cur_string) { +- pr_debug("%s Got string event for unknown string tdsm: %d\n", ++ pr_debug("%s Got string event for unknown string tmsn: %d\n", + __func__, tracer_event->string_event.tmsn); + return -1; + } +-- +2.39.2 + diff --git a/queue-5.15/netfilter-nf_tables-null-pointer-dereference-in-nf_t.patch b/queue-5.15/netfilter-nf_tables-null-pointer-dereference-in-nf_t.patch new file mode 100644 index 00000000000..21cc917fedd --- /dev/null +++ b/queue-5.15/netfilter-nf_tables-null-pointer-dereference-in-nf_t.patch @@ -0,0 +1,40 @@ +From 466fde36c32ab6028d7a662977f4cfea2e29808e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Jan 2023 07:45:49 -0800 +Subject: netfilter: nf_tables: NULL pointer dereference in nf_tables_updobj() + +From: Alok Tiwari + +[ Upstream commit dac7f50a45216d652887fb92d6cd3b7ca7f006ea ] + +static analyzer detect null pointer dereference case for 'type' +function __nft_obj_type_get() can return NULL value which require to handle +if type is NULL pointer return -ENOENT. + +This is a theoretical issue, since an existing object has a type, but +better add this failsafe check. + +Signed-off-by: Alok Tiwari +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_tables_api.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index 81bd13b3d8fd4..a02a25b7eae6d 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -6794,6 +6794,9 @@ static int nf_tables_newobj(struct sk_buff *skb, const struct nfnl_info *info, + return -EOPNOTSUPP; + + type = __nft_obj_type_get(objtype); ++ if (WARN_ON_ONCE(!type)) ++ return -ENOENT; ++ + nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); + + return nf_tables_updobj(&ctx, type, nla[NFTA_OBJ_DATA], obj); +-- +2.39.2 + diff --git a/queue-5.15/nfs-fix-disabling-of-swap.patch b/queue-5.15/nfs-fix-disabling-of-swap.patch new file mode 100644 index 00000000000..8f290af67b4 --- /dev/null +++ b/queue-5.15/nfs-fix-disabling-of-swap.patch @@ -0,0 +1,69 @@ +From 1149ac31bc7848b00367651dc032241ae7f30f4d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Feb 2023 15:45:38 +1100 +Subject: NFS: fix disabling of swap + +From: NeilBrown + +[ Upstream commit 5bab56fff53ce161ed859d9559a10361d4f79578 ] + +When swap is activated to a file on an NFSv4 mount we arrange that the +state manager thread is always present as starting a new thread requires +memory allocations that might block waiting for swap. + +Unfortunately the code for allowing the state manager thread to exit when +swap is disabled was not tested properly and does not work. +This can be seen by examining /proc/fs/nfsfs/servers after disabling swap +and unmounting the filesystem. The servers file will still list one +entry. Also a "ps" listing will show the state manager thread is still +present. + +There are two problems. + 1/ rpc_clnt_swap_deactivate() doesn't walk up the ->cl_parent list to + find the primary client on which the state manager runs. + + 2/ The thread is not woken up properly and it immediately goes back to + sleep without checking whether it is really needed. Using + nfs4_schedule_state_manager() ensures a proper wake-up. + +Reported-by: Olga Kornievskaia +Fixes: 4dc73c679114 ("NFSv4: keep state manager thread active if swap is enabled") +Signed-off-by: NeilBrown +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs4proc.c | 4 +++- + net/sunrpc/clnt.c | 2 ++ + 2 files changed, 5 insertions(+), 1 deletion(-) + +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c +index 5b671ca429d2b..27cafeada8651 100644 +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -10545,7 +10545,9 @@ static void nfs4_disable_swap(struct inode *inode) + /* The state manager thread will now exit once it is + * woken. + */ +- wake_up_var(&NFS_SERVER(inode)->nfs_client->cl_state); ++ struct nfs_client *clp = NFS_SERVER(inode)->nfs_client; ++ ++ nfs4_schedule_state_manager(clp); + } + + static const struct inode_operations nfs4_dir_inode_operations = { +diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c +index 6622dc1fa8f2f..ad3e9a40b0610 100644 +--- a/net/sunrpc/clnt.c ++++ b/net/sunrpc/clnt.c +@@ -3138,6 +3138,8 @@ rpc_clnt_swap_deactivate_callback(struct rpc_clnt *clnt, + void + rpc_clnt_swap_deactivate(struct rpc_clnt *clnt) + { ++ while (clnt != clnt->cl_parent) ++ clnt = clnt->cl_parent; + if (atomic_dec_if_positive(&clnt->cl_swapper) == 0) + rpc_clnt_iterate_for_each_xprt(clnt, + rpc_clnt_swap_deactivate_callback, NULL); +-- +2.39.2 + diff --git a/queue-5.15/nfs4trace-fix-state-manager-flag-printing.patch b/queue-5.15/nfs4trace-fix-state-manager-flag-printing.patch new file mode 100644 index 00000000000..37a8497b816 --- /dev/null +++ b/queue-5.15/nfs4trace-fix-state-manager-flag-printing.patch @@ -0,0 +1,81 @@ +From bc5da070665db1218d1ca3876bbdd0c5d970fbdd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Feb 2023 08:18:23 -0500 +Subject: nfs4trace: fix state manager flag printing + +From: Benjamin Coddington + +[ Upstream commit b46d80bd2d6e7e063c625a20de54248afe8d4889 ] + +__print_flags wants a mask, not the enum value. Add two more flags. + +Fixes: 511ba52e4c01 ("NFS4: Trace state recovery operation") +Signed-off-by: Benjamin Coddington +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs4trace.h | 42 ++++++++++++++++++++++-------------------- + 1 file changed, 22 insertions(+), 20 deletions(-) + +diff --git a/fs/nfs/nfs4trace.h b/fs/nfs/nfs4trace.h +index 7a2567aa2b86d..bcd18e96b44fa 100644 +--- a/fs/nfs/nfs4trace.h ++++ b/fs/nfs/nfs4trace.h +@@ -584,32 +584,34 @@ TRACE_DEFINE_ENUM(NFS4CLNT_MOVED); + TRACE_DEFINE_ENUM(NFS4CLNT_LEASE_MOVED); + TRACE_DEFINE_ENUM(NFS4CLNT_DELEGATION_EXPIRED); + TRACE_DEFINE_ENUM(NFS4CLNT_RUN_MANAGER); ++TRACE_DEFINE_ENUM(NFS4CLNT_MANAGER_AVAILABLE); + TRACE_DEFINE_ENUM(NFS4CLNT_RECALL_RUNNING); + TRACE_DEFINE_ENUM(NFS4CLNT_RECALL_ANY_LAYOUT_READ); + TRACE_DEFINE_ENUM(NFS4CLNT_RECALL_ANY_LAYOUT_RW); ++TRACE_DEFINE_ENUM(NFS4CLNT_DELEGRETURN_DELAYED); + + #define show_nfs4_clp_state(state) \ + __print_flags(state, "|", \ +- { NFS4CLNT_MANAGER_RUNNING, "MANAGER_RUNNING" }, \ +- { NFS4CLNT_CHECK_LEASE, "CHECK_LEASE" }, \ +- { NFS4CLNT_LEASE_EXPIRED, "LEASE_EXPIRED" }, \ +- { NFS4CLNT_RECLAIM_REBOOT, "RECLAIM_REBOOT" }, \ +- { NFS4CLNT_RECLAIM_NOGRACE, "RECLAIM_NOGRACE" }, \ +- { NFS4CLNT_DELEGRETURN, "DELEGRETURN" }, \ +- { NFS4CLNT_SESSION_RESET, "SESSION_RESET" }, \ +- { NFS4CLNT_LEASE_CONFIRM, "LEASE_CONFIRM" }, \ +- { NFS4CLNT_SERVER_SCOPE_MISMATCH, \ +- "SERVER_SCOPE_MISMATCH" }, \ +- { NFS4CLNT_PURGE_STATE, "PURGE_STATE" }, \ +- { NFS4CLNT_BIND_CONN_TO_SESSION, \ +- "BIND_CONN_TO_SESSION" }, \ +- { NFS4CLNT_MOVED, "MOVED" }, \ +- { NFS4CLNT_LEASE_MOVED, "LEASE_MOVED" }, \ +- { NFS4CLNT_DELEGATION_EXPIRED, "DELEGATION_EXPIRED" }, \ +- { NFS4CLNT_RUN_MANAGER, "RUN_MANAGER" }, \ +- { NFS4CLNT_RECALL_RUNNING, "RECALL_RUNNING" }, \ +- { NFS4CLNT_RECALL_ANY_LAYOUT_READ, "RECALL_ANY_LAYOUT_READ" }, \ +- { NFS4CLNT_RECALL_ANY_LAYOUT_RW, "RECALL_ANY_LAYOUT_RW" }) ++ { BIT(NFS4CLNT_MANAGER_RUNNING), "MANAGER_RUNNING" }, \ ++ { BIT(NFS4CLNT_CHECK_LEASE), "CHECK_LEASE" }, \ ++ { BIT(NFS4CLNT_LEASE_EXPIRED), "LEASE_EXPIRED" }, \ ++ { BIT(NFS4CLNT_RECLAIM_REBOOT), "RECLAIM_REBOOT" }, \ ++ { BIT(NFS4CLNT_RECLAIM_NOGRACE), "RECLAIM_NOGRACE" }, \ ++ { BIT(NFS4CLNT_DELEGRETURN), "DELEGRETURN" }, \ ++ { BIT(NFS4CLNT_SESSION_RESET), "SESSION_RESET" }, \ ++ { BIT(NFS4CLNT_LEASE_CONFIRM), "LEASE_CONFIRM" }, \ ++ { BIT(NFS4CLNT_SERVER_SCOPE_MISMATCH), "SERVER_SCOPE_MISMATCH" }, \ ++ { BIT(NFS4CLNT_PURGE_STATE), "PURGE_STATE" }, \ ++ { BIT(NFS4CLNT_BIND_CONN_TO_SESSION), "BIND_CONN_TO_SESSION" }, \ ++ { BIT(NFS4CLNT_MOVED), "MOVED" }, \ ++ { BIT(NFS4CLNT_LEASE_MOVED), "LEASE_MOVED" }, \ ++ { BIT(NFS4CLNT_DELEGATION_EXPIRED), "DELEGATION_EXPIRED" }, \ ++ { BIT(NFS4CLNT_RUN_MANAGER), "RUN_MANAGER" }, \ ++ { BIT(NFS4CLNT_MANAGER_AVAILABLE), "MANAGER_AVAILABLE" }, \ ++ { BIT(NFS4CLNT_RECALL_RUNNING), "RECALL_RUNNING" }, \ ++ { BIT(NFS4CLNT_RECALL_ANY_LAYOUT_READ), "RECALL_ANY_LAYOUT_READ" }, \ ++ { BIT(NFS4CLNT_RECALL_ANY_LAYOUT_RW), "RECALL_ANY_LAYOUT_RW" }, \ ++ { BIT(NFS4CLNT_DELEGRETURN_DELAYED), "DELERETURN_DELAYED" }) + + TRACE_EVENT(nfs4_state_mgr, + TP_PROTO( +-- +2.39.2 + diff --git a/queue-5.15/nfsd-fix-race-to-check-ls_layouts.patch b/queue-5.15/nfsd-fix-race-to-check-ls_layouts.patch new file mode 100644 index 00000000000..4312424dbd9 --- /dev/null +++ b/queue-5.15/nfsd-fix-race-to-check-ls_layouts.patch @@ -0,0 +1,46 @@ +From abc2dac29b4c3023f2e9040a14d4ae265576c0ae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Jan 2023 11:18:56 -0500 +Subject: nfsd: fix race to check ls_layouts + +From: Benjamin Coddington + +[ Upstream commit fb610c4dbc996415d57d7090957ecddd4fd64fb6 ] + +Its possible for __break_lease to find the layout's lease before we've +added the layout to the owner's ls_layouts list. In that case, setting +ls_recalled = true without actually recalling the layout will cause the +server to never send a recall callback. + +Move the check for ls_layouts before setting ls_recalled. + +Fixes: c5c707f96fc9 ("nfsd: implement pNFS layout recalls") +Signed-off-by: Benjamin Coddington +Reviewed-by: Jeff Layton +Signed-off-by: Chuck Lever +Signed-off-by: Sasha Levin +--- + fs/nfsd/nfs4layouts.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/fs/nfsd/nfs4layouts.c b/fs/nfsd/nfs4layouts.c +index a97873f2d22b0..2673019d30ecd 100644 +--- a/fs/nfsd/nfs4layouts.c ++++ b/fs/nfsd/nfs4layouts.c +@@ -322,11 +322,11 @@ nfsd4_recall_file_layout(struct nfs4_layout_stateid *ls) + if (ls->ls_recalled) + goto out_unlock; + +- ls->ls_recalled = true; +- atomic_inc(&ls->ls_stid.sc_file->fi_lo_recalls); + if (list_empty(&ls->ls_layouts)) + goto out_unlock; + ++ ls->ls_recalled = true; ++ atomic_inc(&ls->ls_stid.sc_file->fi_lo_recalls); + trace_nfsd_layout_recall(&ls->ls_stid.sc_stateid); + + refcount_inc(&ls->ls_stid.sc_count); +-- +2.39.2 + diff --git a/queue-5.15/nfsd-zero-out-pointers-after-putting-nfsd_files-on-c.patch b/queue-5.15/nfsd-zero-out-pointers-after-putting-nfsd_files-on-c.patch new file mode 100644 index 00000000000..2ed1d83137a --- /dev/null +++ b/queue-5.15/nfsd-zero-out-pointers-after-putting-nfsd_files-on-c.patch @@ -0,0 +1,42 @@ +From a846e6b8dbad74c2d3739b22555370d62d8d3047 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Jan 2023 14:38:30 -0500 +Subject: nfsd: zero out pointers after putting nfsd_files on COPY setup error + +From: Jeff Layton + +[ Upstream commit 1f0001d43d0c0ac2a19a34a914f6595ad97cbc1d ] + +At first, I thought this might be a source of nfsd_file overputs, but +the current callers seem to avoid an extra put when nfsd4_verify_copy +returns an error. + +Still, it's "bad form" to leave the pointers filled out when we don't +have a reference to them anymore, and that might lead to bugs later. +Zero them out as a defensive coding measure. + +Signed-off-by: Jeff Layton +Signed-off-by: Chuck Lever +Signed-off-by: Sasha Levin +--- + fs/nfsd/nfs4proc.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c +index 0a900b9e39eac..57af9c30eb48d 100644 +--- a/fs/nfsd/nfs4proc.c ++++ b/fs/nfsd/nfs4proc.c +@@ -1088,8 +1088,10 @@ nfsd4_verify_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, + return status; + out_put_dst: + nfsd_file_put(*dst); ++ *dst = NULL; + out_put_src: + nfsd_file_put(*src); ++ *src = NULL; + goto out; + } + +-- +2.39.2 + diff --git a/queue-5.15/nfsv4-keep-state-manager-thread-active-if-swap-is-en.patch b/queue-5.15/nfsv4-keep-state-manager-thread-active-if-swap-is-en.patch new file mode 100644 index 00000000000..4bcec3d1862 --- /dev/null +++ b/queue-5.15/nfsv4-keep-state-manager-thread-active-if-swap-is-en.patch @@ -0,0 +1,227 @@ +From 237c8961dfc5116be7d13d1ea85c60f0800ecc97 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Mar 2022 10:41:44 +1100 +Subject: NFSv4: keep state manager thread active if swap is enabled + +From: NeilBrown + +[ Upstream commit 4dc73c679114a2f408567e2e44770ed934190db2 ] + +If we are swapping over NFSv4, we may not be able to allocate memory to +start the state-manager thread at the time when we need it. +So keep it always running when swap is enabled, and just signal it to +start. + +This requires updating and testing the cl_swapper count on the root +rpc_clnt after following all ->cl_parent links. + +Signed-off-by: NeilBrown +Signed-off-by: Trond Myklebust +Stable-dep-of: b46d80bd2d6e ("nfs4trace: fix state manager flag printing") +Signed-off-by: Sasha Levin +--- + fs/nfs/file.c | 15 ++++++++++++--- + fs/nfs/nfs4_fs.h | 1 + + fs/nfs/nfs4proc.c | 20 ++++++++++++++++++++ + fs/nfs/nfs4state.c | 40 +++++++++++++++++++++++++++++++++------- + include/linux/nfs_xdr.h | 2 ++ + net/sunrpc/clnt.c | 2 ++ + 6 files changed, 70 insertions(+), 10 deletions(-) + +diff --git a/fs/nfs/file.c b/fs/nfs/file.c +index ad5114e480097..dd53d0f97c57d 100644 +--- a/fs/nfs/file.c ++++ b/fs/nfs/file.c +@@ -484,8 +484,9 @@ static int nfs_swap_activate(struct swap_info_struct *sis, struct file *file, + { + unsigned long blocks; + long long isize; +- struct rpc_clnt *clnt = NFS_CLIENT(file->f_mapping->host); +- struct inode *inode = file->f_mapping->host; ++ struct inode *inode = file_inode(file); ++ struct rpc_clnt *clnt = NFS_CLIENT(inode); ++ struct nfs_client *cl = NFS_SERVER(inode)->nfs_client; + + spin_lock(&inode->i_lock); + blocks = inode->i_blocks; +@@ -498,14 +499,22 @@ static int nfs_swap_activate(struct swap_info_struct *sis, struct file *file, + + *span = sis->pages; + ++ ++ if (cl->rpc_ops->enable_swap) ++ cl->rpc_ops->enable_swap(inode); ++ + return rpc_clnt_swap_activate(clnt); + } + + static void nfs_swap_deactivate(struct file *file) + { +- struct rpc_clnt *clnt = NFS_CLIENT(file->f_mapping->host); ++ struct inode *inode = file_inode(file); ++ struct rpc_clnt *clnt = NFS_CLIENT(inode); ++ struct nfs_client *cl = NFS_SERVER(inode)->nfs_client; + + rpc_clnt_swap_deactivate(clnt); ++ if (cl->rpc_ops->disable_swap) ++ cl->rpc_ops->disable_swap(file_inode(file)); + } + + const struct address_space_operations nfs_file_aops = { +diff --git a/fs/nfs/nfs4_fs.h b/fs/nfs/nfs4_fs.h +index f8672a34fd635..0a1e1c64b131a 100644 +--- a/fs/nfs/nfs4_fs.h ++++ b/fs/nfs/nfs4_fs.h +@@ -42,6 +42,7 @@ enum nfs4_client_state { + NFS4CLNT_LEASE_MOVED, + NFS4CLNT_DELEGATION_EXPIRED, + NFS4CLNT_RUN_MANAGER, ++ NFS4CLNT_MANAGER_AVAILABLE, + NFS4CLNT_RECALL_RUNNING, + NFS4CLNT_RECALL_ANY_LAYOUT_READ, + NFS4CLNT_RECALL_ANY_LAYOUT_RW, +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c +index b6b1fad031c78..5b671ca429d2b 100644 +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -10530,6 +10530,24 @@ static ssize_t nfs4_listxattr(struct dentry *dentry, char *list, size_t size) + return error + error2 + error3; + } + ++static void nfs4_enable_swap(struct inode *inode) ++{ ++ /* The state manager thread must always be running. ++ * It will notice the client is a swapper, and stay put. ++ */ ++ struct nfs_client *clp = NFS_SERVER(inode)->nfs_client; ++ ++ nfs4_schedule_state_manager(clp); ++} ++ ++static void nfs4_disable_swap(struct inode *inode) ++{ ++ /* The state manager thread will now exit once it is ++ * woken. ++ */ ++ wake_up_var(&NFS_SERVER(inode)->nfs_client->cl_state); ++} ++ + static const struct inode_operations nfs4_dir_inode_operations = { + .create = nfs_create, + .lookup = nfs_lookup, +@@ -10607,6 +10625,8 @@ const struct nfs_rpc_ops nfs_v4_clientops = { + .create_server = nfs4_create_server, + .clone_server = nfs_clone_server, + .discover_trunking = nfs4_discover_trunking, ++ .enable_swap = nfs4_enable_swap, ++ .disable_swap = nfs4_disable_swap, + }; + + static const struct xattr_handler nfs4_xattr_nfs4_acl_handler = { +diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c +index 0cd803b4d90ce..7223816bc5d53 100644 +--- a/fs/nfs/nfs4state.c ++++ b/fs/nfs/nfs4state.c +@@ -1209,10 +1209,17 @@ void nfs4_schedule_state_manager(struct nfs_client *clp) + { + struct task_struct *task; + char buf[INET6_ADDRSTRLEN + sizeof("-manager") + 1]; ++ struct rpc_clnt *cl = clp->cl_rpcclient; ++ ++ while (cl != cl->cl_parent) ++ cl = cl->cl_parent; + + set_bit(NFS4CLNT_RUN_MANAGER, &clp->cl_state); +- if (test_and_set_bit(NFS4CLNT_MANAGER_RUNNING, &clp->cl_state) != 0) ++ if (test_and_set_bit(NFS4CLNT_MANAGER_AVAILABLE, &clp->cl_state) != 0) { ++ wake_up_var(&clp->cl_state); + return; ++ } ++ set_bit(NFS4CLNT_MANAGER_RUNNING, &clp->cl_state); + __module_get(THIS_MODULE); + refcount_inc(&clp->cl_count); + +@@ -1230,6 +1237,7 @@ void nfs4_schedule_state_manager(struct nfs_client *clp) + if (!nfs_client_init_is_complete(clp)) + nfs_mark_client_ready(clp, PTR_ERR(task)); + nfs4_clear_state_manager_bit(clp); ++ clear_bit(NFS4CLNT_MANAGER_AVAILABLE, &clp->cl_state); + nfs_put_client(clp); + module_put(THIS_MODULE); + } +@@ -2689,12 +2697,8 @@ static void nfs4_state_manager(struct nfs_client *clp) + clear_bit(NFS4CLNT_RECALL_RUNNING, &clp->cl_state); + } + +- /* Did we race with an attempt to give us more work? */ +- if (!test_bit(NFS4CLNT_RUN_MANAGER, &clp->cl_state)) +- return; +- if (test_and_set_bit(NFS4CLNT_MANAGER_RUNNING, &clp->cl_state) != 0) +- return; +- memflags = memalloc_nofs_save(); ++ return; ++ + } while (refcount_read(&clp->cl_count) > 1 && !signalled()); + goto out_drain; + +@@ -2715,9 +2719,31 @@ static void nfs4_state_manager(struct nfs_client *clp) + static int nfs4_run_state_manager(void *ptr) + { + struct nfs_client *clp = ptr; ++ struct rpc_clnt *cl = clp->cl_rpcclient; ++ ++ while (cl != cl->cl_parent) ++ cl = cl->cl_parent; + + allow_signal(SIGKILL); ++again: ++ set_bit(NFS4CLNT_MANAGER_RUNNING, &clp->cl_state); + nfs4_state_manager(clp); ++ if (atomic_read(&cl->cl_swapper)) { ++ wait_var_event_interruptible(&clp->cl_state, ++ test_bit(NFS4CLNT_RUN_MANAGER, ++ &clp->cl_state)); ++ if (atomic_read(&cl->cl_swapper) && ++ test_bit(NFS4CLNT_RUN_MANAGER, &clp->cl_state)) ++ goto again; ++ /* Either no longer a swapper, or were signalled */ ++ } ++ clear_bit(NFS4CLNT_MANAGER_AVAILABLE, &clp->cl_state); ++ ++ if (refcount_read(&clp->cl_count) > 1 && !signalled() && ++ test_bit(NFS4CLNT_RUN_MANAGER, &clp->cl_state) && ++ !test_and_set_bit(NFS4CLNT_MANAGER_AVAILABLE, &clp->cl_state)) ++ goto again; ++ + nfs_put_client(clp); + module_put_and_exit(0); + return 0; +diff --git a/include/linux/nfs_xdr.h b/include/linux/nfs_xdr.h +index 783f871b4e12d..7fcd56c6ded65 100644 +--- a/include/linux/nfs_xdr.h ++++ b/include/linux/nfs_xdr.h +@@ -1806,6 +1806,8 @@ struct nfs_rpc_ops { + struct nfs_server *(*clone_server)(struct nfs_server *, struct nfs_fh *, + struct nfs_fattr *, rpc_authflavor_t); + int (*discover_trunking)(struct nfs_server *, struct nfs_fh *); ++ void (*enable_swap)(struct inode *inode); ++ void (*disable_swap)(struct inode *inode); + }; + + /* +diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c +index bbeb80e1133df..6622dc1fa8f2f 100644 +--- a/net/sunrpc/clnt.c ++++ b/net/sunrpc/clnt.c +@@ -3117,6 +3117,8 @@ rpc_clnt_swap_activate_callback(struct rpc_clnt *clnt, + int + rpc_clnt_swap_activate(struct rpc_clnt *clnt) + { ++ while (clnt != clnt->cl_parent) ++ clnt = clnt->cl_parent; + if (atomic_inc_return(&clnt->cl_swapper) == 1) + return rpc_clnt_iterate_for_each_xprt(clnt, + rpc_clnt_swap_activate_callback, NULL); +-- +2.39.2 + diff --git a/queue-5.15/objtool-add-uaccess-exceptions-for-__tsan_volatile_r.patch b/queue-5.15/objtool-add-uaccess-exceptions-for-__tsan_volatile_r.patch new file mode 100644 index 00000000000..0f145994e52 --- /dev/null +++ b/queue-5.15/objtool-add-uaccess-exceptions-for-__tsan_volatile_r.patch @@ -0,0 +1,56 @@ +From 2194b3a4d5b9cd081916548d5bdea46517008114 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Feb 2023 14:00:58 +0100 +Subject: objtool: add UACCESS exceptions for __tsan_volatile_read/write + +From: Arnd Bergmann + +[ Upstream commit d5d469247264e56960705dc5ae7e1d014861fe40 ] + +A lot of the tsan helpers are already excempt from the UACCESS warnings, +but some more functions were added that need the same thing: + +kernel/kcsan/core.o: warning: objtool: __tsan_volatile_read16+0x0: call to __tsan_unaligned_read16() with UACCESS enabled +kernel/kcsan/core.o: warning: objtool: __tsan_volatile_write16+0x0: call to __tsan_unaligned_write16() with UACCESS enabled +vmlinux.o: warning: objtool: __tsan_unaligned_volatile_read16+0x4: call to __tsan_unaligned_read16() with UACCESS enabled +vmlinux.o: warning: objtool: __tsan_unaligned_volatile_write16+0x4: call to __tsan_unaligned_write16() with UACCESS enabled + +As Marco points out, these functions don't even call each other +explicitly but instead gcc (but not clang) notices the functions +being identical and turns one symbol into a direct branch to the +other. + +Link: https://lkml.kernel.org/r/20230215130058.3836177-4-arnd@kernel.org +Fixes: 75d75b7a4d54 ("kcsan: Support distinguishing volatile accesses") +Signed-off-by: Arnd Bergmann +Acked-by: Marco Elver +Cc: Alexander Potapenko +Cc: Andrey Konovalov +Cc: Andrey Ryabinin +Cc: Dmitry Vyukov +Cc: Josh Poimboeuf +Cc: Kuan-Ying Lee +Cc: Peter Zijlstra (Intel) +Cc: Vincenzo Frascino +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + tools/objtool/check.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/tools/objtool/check.c b/tools/objtool/check.c +index 3ef767284b3f0..2fc0270e3c1f7 100644 +--- a/tools/objtool/check.c ++++ b/tools/objtool/check.c +@@ -908,6 +908,8 @@ static const char *uaccess_safe_builtin[] = { + "__tsan_atomic64_compare_exchange_val", + "__tsan_atomic_thread_fence", + "__tsan_atomic_signal_fence", ++ "__tsan_unaligned_read16", ++ "__tsan_unaligned_write16", + /* KCOV */ + "write_comp_data", + "check_kcov_mode", +-- +2.39.2 + diff --git a/queue-5.15/opp-fix-error-checking-in-opp_migrate_dentry.patch b/queue-5.15/opp-fix-error-checking-in-opp_migrate_dentry.patch new file mode 100644 index 00000000000..79029b296c7 --- /dev/null +++ b/queue-5.15/opp-fix-error-checking-in-opp_migrate_dentry.patch @@ -0,0 +1,38 @@ +From e27394c04861d2be31a5b7d0051d25d7e72f97b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Feb 2023 12:00:37 +0800 +Subject: OPP: fix error checking in opp_migrate_dentry() + +From: Qi Zheng + +[ Upstream commit eca4c0eea53432ec4b711b2a8ad282cbad231b4f ] + +Since commit ff9fb72bc077 ("debugfs: return error values, +not NULL") changed return value of debugfs_rename() in +error cases from %NULL to %ERR_PTR(-ERROR), we should +also check error values instead of NULL. + +Fixes: ff9fb72bc077 ("debugfs: return error values, not NULL") +Signed-off-by: Qi Zheng +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/opp/debugfs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/opp/debugfs.c b/drivers/opp/debugfs.c +index b5f2f9f393926..9eb71f47487b2 100644 +--- a/drivers/opp/debugfs.c ++++ b/drivers/opp/debugfs.c +@@ -209,7 +209,7 @@ static void opp_migrate_dentry(struct opp_device *opp_dev, + + dentry = debugfs_rename(rootdir, opp_dev->dentry, rootdir, + opp_table->dentry_name); +- if (!dentry) { ++ if (IS_ERR(dentry)) { + dev_err(dev, "%s: Failed to rename link from: %s to %s\n", + __func__, dev_name(opp_dev->dev), dev_name(dev)); + return; +-- +2.39.2 + diff --git a/queue-5.15/pci-iov-enlarge-virtfn-sysfs-name-buffer.patch b/queue-5.15/pci-iov-enlarge-virtfn-sysfs-name-buffer.patch new file mode 100644 index 00000000000..6114b6a43e5 --- /dev/null +++ b/queue-5.15/pci-iov-enlarge-virtfn-sysfs-name-buffer.patch @@ -0,0 +1,41 @@ +From e074a2d08a3dce3fed082d4f5e6c41f617d4a841 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 18 Dec 2022 06:33:47 +0300 +Subject: PCI/IOV: Enlarge virtfn sysfs name buffer + +From: Alexey V. Vissarionov + +[ Upstream commit ea0b5aa5f184cf8293c93163f0fb00505190d431 ] + +The sysfs link name "virtfn%u" constructed by pci_iov_sysfs_link() requires +17 bytes to contain the longest possible string. Increase VIRTFN_ID_LEN to +accommodate that. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +[bhelgaas: commit log, comment at #define] +Fixes: dd7cc44d0bce ("PCI: add SR-IOV API for Physical Function driver") +Link: https://lore.kernel.org/r/20221218033347.23743-1-gremlin@altlinux.org +Signed-off-by: Alexey V. Vissarionov +Signed-off-by: Bjorn Helgaas +Signed-off-by: Sasha Levin +--- + drivers/pci/iov.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pci/iov.c b/drivers/pci/iov.c +index dafdc652fcd06..ef71c1a204004 100644 +--- a/drivers/pci/iov.c ++++ b/drivers/pci/iov.c +@@ -14,7 +14,7 @@ + #include + #include "pci.h" + +-#define VIRTFN_ID_LEN 16 ++#define VIRTFN_ID_LEN 17 /* "virtfn%u\0" for 2^32 - 1 */ + + int pci_iov_virtfn_bus(struct pci_dev *dev, int vf_id) + { +-- +2.39.2 + diff --git a/queue-5.15/pci-switchtec-return-efault-for-copy_to_user-errors.patch b/queue-5.15/pci-switchtec-return-efault-for-copy_to_user-errors.patch new file mode 100644 index 00000000000..cd611bcea89 --- /dev/null +++ b/queue-5.15/pci-switchtec-return-efault-for-copy_to_user-errors.patch @@ -0,0 +1,57 @@ +From 27e415dafbdf58afabdb935cf511ed4f1802377e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Dec 2022 10:21:26 -0600 +Subject: PCI: switchtec: Return -EFAULT for copy_to_user() errors + +From: Bjorn Helgaas + +[ Upstream commit ddc10938e08cd7aac63d8385f7305f7889df5179 ] + +switchtec_dev_read() didn't handle copy_to_user() errors correctly: it +assigned "rc = -EFAULT", but actually returned either "size", -ENXIO, or +-EBADMSG instead. + +Update the failure cases to unlock mrpc_mutex and return -EFAULT directly. + +Link: https://lore.kernel.org/r/20221216162126.207863-3-helgaas@kernel.org +Fixes: 080b47def5e5 ("MicroSemi Switchtec management interface driver") +Signed-off-by: Bjorn Helgaas +Reviewed-by: Logan Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/pci/switch/switchtec.c | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +diff --git a/drivers/pci/switch/switchtec.c b/drivers/pci/switch/switchtec.c +index 0b301f8be9ed5..d021ef3fb165b 100644 +--- a/drivers/pci/switch/switchtec.c ++++ b/drivers/pci/switch/switchtec.c +@@ -552,21 +552,20 @@ static ssize_t switchtec_dev_read(struct file *filp, char __user *data, + rc = copy_to_user(data, &stuser->return_code, + sizeof(stuser->return_code)); + if (rc) { +- rc = -EFAULT; +- goto out; ++ mutex_unlock(&stdev->mrpc_mutex); ++ return -EFAULT; + } + + data += sizeof(stuser->return_code); + rc = copy_to_user(data, &stuser->data, + size - sizeof(stuser->return_code)); + if (rc) { +- rc = -EFAULT; +- goto out; ++ mutex_unlock(&stdev->mrpc_mutex); ++ return -EFAULT; + } + + stuser_set_state(stuser, MRPC_IDLE); + +-out: + mutex_unlock(&stdev->mrpc_mutex); + + if (stuser->status == SWITCHTEC_MRPC_STATUS_DONE) +-- +2.39.2 + diff --git a/queue-5.15/perf-inject-use-perf_data__read-for-auxtrace.patch b/queue-5.15/perf-inject-use-perf_data__read-for-auxtrace.patch new file mode 100644 index 00000000000..c1a9b9a65c7 --- /dev/null +++ b/queue-5.15/perf-inject-use-perf_data__read-for-auxtrace.patch @@ -0,0 +1,73 @@ +From 21a44645b607233897c5b4922884439558510390 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Jan 2023 18:33:47 -0800 +Subject: perf inject: Use perf_data__read() for auxtrace + +From: Namhyung Kim + +[ Upstream commit 1746212daeba95e9ae1639227dc0c3591d41deeb ] + +In copy_bytes(), it reads the data from the (input) fd and writes it to +the output file. But it does with the read(2) unconditionally which +caused a problem of mixing buffered vs unbuffered I/O together. + +You can see the problem when using pipes. + + $ perf record -e intel_pt// -o- true | perf inject -b > /dev/null + [ perf record: Woken up 1 times to write data ] + [ perf record: Captured and wrote 0.000 MB - ] + 0x45c0 [0x30]: failed to process type: 71 + +It should use perf_data__read() to honor the 'use_stdio' setting. + +Fixes: 601366678c93618f ("perf data: Allow to use stdio functions for pipe mode") +Reviewed-by: Adrian Hunter +Reviewed-by: James Clark +Signed-off-by: Namhyung Kim +Cc: Ian Rogers +Cc: Ingo Molnar +Cc: Jiri Olsa +Cc: Leo Yan +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Stephane Eranian +Link: https://lore.kernel.org/r/20230131023350.1903992-2-namhyung@kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/builtin-inject.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/tools/perf/builtin-inject.c b/tools/perf/builtin-inject.c +index 50c2e6892b3e9..f15c146e00548 100644 +--- a/tools/perf/builtin-inject.c ++++ b/tools/perf/builtin-inject.c +@@ -142,14 +142,14 @@ static int perf_event__repipe_event_update(struct perf_tool *tool, + + #ifdef HAVE_AUXTRACE_SUPPORT + +-static int copy_bytes(struct perf_inject *inject, int fd, off_t size) ++static int copy_bytes(struct perf_inject *inject, struct perf_data *data, off_t size) + { + char buf[4096]; + ssize_t ssz; + int ret; + + while (size > 0) { +- ssz = read(fd, buf, min(size, (off_t)sizeof(buf))); ++ ssz = perf_data__read(data, buf, min(size, (off_t)sizeof(buf))); + if (ssz < 0) + return -errno; + ret = output_bytes(inject, buf, ssz); +@@ -187,7 +187,7 @@ static s64 perf_event__repipe_auxtrace(struct perf_session *session, + ret = output_bytes(inject, event, event->header.size); + if (ret < 0) + return ret; +- ret = copy_bytes(inject, perf_data__fd(session->data), ++ ret = copy_bytes(inject, session->data, + event->auxtrace.size); + } else { + ret = output_bytes(inject, event, +-- +2.39.2 + diff --git a/queue-5.15/perf-intel-pt-add-documentation-for-event-trace-and-.patch b/queue-5.15/perf-intel-pt-add-documentation-for-event-trace-and-.patch new file mode 100644 index 00000000000..4580f617106 --- /dev/null +++ b/queue-5.15/perf-intel-pt-add-documentation-for-event-trace-and-.patch @@ -0,0 +1,164 @@ +From 36149e0e727c229593bb757591a4ecebe24d6667 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Jan 2022 10:42:01 +0200 +Subject: perf intel-pt: Add documentation for Event Trace and TNT disable + +From: Adrian Hunter + +[ Upstream commit 24e3599c5a88e0e2995e3f5c9305f80195942dc9 ] + +Add documentation for Event Trace and TNT disable to the perf Intel PT man +page. + +Signed-off-by: Adrian Hunter +Cc: Alexander Shishkin +Cc: Andi Kleen +Cc: Jiri Olsa +Link: https://lore.kernel.org/r/20220124084201.2699795-26-adrian.hunter@intel.com +Signed-off-by: Arnaldo Carvalho de Melo +Stable-dep-of: aeb802f872a7 ("perf intel-pt: Do not try to queue auxtrace data on pipe") +Signed-off-by: Sasha Levin +--- + tools/perf/Documentation/perf-intel-pt.txt | 104 ++++++++++++++++++++- + 1 file changed, 102 insertions(+), 2 deletions(-) + +diff --git a/tools/perf/Documentation/perf-intel-pt.txt b/tools/perf/Documentation/perf-intel-pt.txt +index db465fa7ee918..48460923a0e4e 100644 +--- a/tools/perf/Documentation/perf-intel-pt.txt ++++ b/tools/perf/Documentation/perf-intel-pt.txt +@@ -108,9 +108,10 @@ displayed as follows: + + perf script --itrace=ibxwpe -F+flags + +-The flags are "bcrosyiABExgh" which stand for branch, call, return, conditional, ++The flags are "bcrosyiABExghDt" which stand for branch, call, return, conditional, + system, asynchronous, interrupt, transaction abort, trace begin, trace end, +-in transaction, VM-entry, and VM-exit respectively. ++in transaction, VM-entry, VM-exit, interrupt disabled, and interrupt disable ++toggle respectively. + + perf script also supports higher level ways to dump instruction traces: + +@@ -472,6 +473,30 @@ pwr_evt Enable power events. The power events provide information about + which contains "1" if the feature is supported and + "0" otherwise. + ++event Enable Event Trace. The events provide information about asynchronous ++ events. ++ ++ Support for this feature is indicated by: ++ ++ /sys/bus/event_source/devices/intel_pt/caps/event_trace ++ ++ which contains "1" if the feature is supported and ++ "0" otherwise. ++ ++notnt Disable TNT packets. Without TNT packets, it is not possible to walk ++ executable code to reconstruct control flow, however FUP, TIP, TIP.PGE ++ and TIP.PGD packets still indicate asynchronous control flow, and (if ++ return compression is disabled - see noretcomp) return statements. ++ The advantage of eliminating TNT packets is reducing the size of the ++ trace and corresponding tracing overhead. ++ ++ Support for this feature is indicated by: ++ ++ /sys/bus/event_source/devices/intel_pt/caps/tnt_disable ++ ++ which contains "1" if the feature is supported and ++ "0" otherwise. ++ + + AUX area sampling option + ~~~~~~~~~~~~~~~~~~~~~~~~ +@@ -865,6 +890,8 @@ The letters are: + p synthesize "power" events (incl. PSB events) + c synthesize branches events (calls only) + r synthesize branches events (returns only) ++ o synthesize PEBS-via-PT events ++ I synthesize Event Trace events + e synthesize tracing error events + d create a debug log + g synthesize a call chain (use with i or x) +@@ -1338,6 +1365,79 @@ There were none. + :17006 17006 [001] 11500.262869216: ffffffff8220116e error_entry+0xe ([guest.kernel.kallsyms]) pushq %rax + + ++Event Trace ++----------- ++ ++Event Trace records information about asynchronous events, for example interrupts, ++faults, VM exits and entries. The information is recorded in CFE and EVD packets, ++and also the Interrupt Flag is recorded on the MODE.Exec packet. The CFE packet ++contains a type field to identify one of the following: ++ ++ 1 INTR interrupt, fault, exception, NMI ++ 2 IRET interrupt return ++ 3 SMI system management interrupt ++ 4 RSM resume from system management mode ++ 5 SIPI startup interprocessor interrupt ++ 6 INIT INIT signal ++ 7 VMENTRY VM-Entry ++ 8 VMEXIT VM-Entry ++ 9 VMEXIT_INTR VM-Exit due to interrupt ++ 10 SHUTDOWN Shutdown ++ ++For more details, refer to the Intel 64 and IA-32 Architectures Software ++Developer Manuals (version 076 or later). ++ ++The capability to do Event Trace is indicated by the ++/sys/bus/event_source/devices/intel_pt/caps/event_trace file. ++ ++Event trace is selected for recording using the "event" config term. e.g. ++ ++ perf record -e intel_pt/event/u uname ++ ++Event trace events are output using the --itrace I option. e.g. ++ ++ perf script --itrace=Ie ++ ++perf script displays events containing CFE type, vector and event data, ++in the form: ++ ++ evt: hw int (t) cfe: INTR IP: 1 vector: 3 PFA: 0x8877665544332211 ++ ++The IP flag indicates if the event binds to an IP, which includes any case where ++flow control packet generation is enabled, as well as when CFE packet IP bit is ++set. ++ ++perf script displays events containing changes to the Interrupt Flag in the form: ++ ++ iflag: t IFLAG: 1->0 via branch ++ ++where "via branch" indicates a branch (interrupt or return from interrupt) and ++"non branch" indicates an instruction such as CFI, STI or POPF). ++ ++In addition, the current state of the interrupt flag is indicated by the presence ++or absence of the "D" (interrupt disabled) perf script flag. If the interrupt ++flag is changed, then the "t" flag is also included i.e. ++ ++ no flag, interrupts enabled IF=1 ++ t interrupts become disabled IF=1 -> IF=0 ++ D interrupts are disabled IF=0 ++ Dt interrupts become enabled IF=0 -> IF=1 ++ ++The intel-pt-events.py script illustrates how to access Event Trace information ++using a Python script. ++ ++ ++TNT Disable ++----------- ++ ++TNT packets are disabled using the "notnt" config term. e.g. ++ ++ perf record -e intel_pt/notnt/u uname ++ ++In that case the --itrace q option is forced because walking executable code ++to reconstruct the control flow is not possible. ++ ++ + + SEE ALSO + -------- +-- +2.39.2 + diff --git a/queue-5.15/perf-intel-pt-add-link-to-the-perf-wiki-s-intel-pt-p.patch b/queue-5.15/perf-intel-pt-add-link-to-the-perf-wiki-s-intel-pt-p.patch new file mode 100644 index 00000000000..ee93c7c77fa --- /dev/null +++ b/queue-5.15/perf-intel-pt-add-link-to-the-perf-wiki-s-intel-pt-p.patch @@ -0,0 +1,42 @@ +From 10677a5843ff083c0edadda94756389e97306ab1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Apr 2022 16:32:13 +0300 +Subject: perf intel-pt: Add link to the perf wiki's Intel PT page + +From: Adrian Hunter + +[ Upstream commit 9e5e641045ff09ded4eb52828c4c7e110635422a ] + +Add an EXAMPLE section and link to the perf wiki's Intel PT page. + +Signed-off-by: Adrian Hunter +Cc: Jiri Olsa +Link: http://lore.kernel.org/lkml/20220426133213.248475-1-adrian.hunter@intel.com +Signed-off-by: Arnaldo Carvalho de Melo +Stable-dep-of: aeb802f872a7 ("perf intel-pt: Do not try to queue auxtrace data on pipe") +Signed-off-by: Sasha Levin +--- + tools/perf/Documentation/perf-intel-pt.txt | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/tools/perf/Documentation/perf-intel-pt.txt b/tools/perf/Documentation/perf-intel-pt.txt +index 48460923a0e4e..d44e6a332dfb1 100644 +--- a/tools/perf/Documentation/perf-intel-pt.txt ++++ b/tools/perf/Documentation/perf-intel-pt.txt +@@ -1438,6 +1438,13 @@ In that case the --itrace q option is forced because walking executable code + to reconstruct the control flow is not possible. + + ++EXAMPLE ++------- ++ ++Examples can be found on perf wiki page "Perf tools support for Intel® Processor Trace": ++ ++https://perf.wiki.kernel.org/index.php/Perf_tools_support_for_Intel%C2%AE_Processor_Trace ++ + + SEE ALSO + -------- +-- +2.39.2 + diff --git a/queue-5.15/perf-intel-pt-add-support-for-emulated-ptwrite.patch b/queue-5.15/perf-intel-pt-add-support-for-emulated-ptwrite.patch new file mode 100644 index 00000000000..50b0a0334cb --- /dev/null +++ b/queue-5.15/perf-intel-pt-add-support-for-emulated-ptwrite.patch @@ -0,0 +1,394 @@ +From 2f443227c2d188807018b5770fd43f62b38c987c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 May 2022 18:23:58 +0300 +Subject: perf intel-pt: Add support for emulated ptwrite + +From: Adrian Hunter + +[ Upstream commit d7015e50a9ed180dcc3947635bb2b5711c37f48b ] + +ptwrite is an Intel x86 instruction that writes arbitrary values into an +Intel PT trace. It is not supported on all hardware, so provide an +alternative that makes use of TNT packets to convey the payload data. +TNT packets encode Taken/Not-taken conditional branch information, so +taking branches based on the payload value will encode the value into +the TNT packet. Refer to the changes to the documentation file +perf-intel-pt.txt in this patch for an example. + +Signed-off-by: Adrian Hunter +Cc: Jiri Olsa +Link: https://lore.kernel.org/r/20220509152400.376613-2-adrian.hunter@intel.com +Signed-off-by: Arnaldo Carvalho de Melo +Stable-dep-of: aeb802f872a7 ("perf intel-pt: Do not try to queue auxtrace data on pipe") +Signed-off-by: Sasha Levin +--- + tools/perf/Documentation/perf-intel-pt.txt | 88 +++++++++++++++++ + .../util/intel-pt-decoder/intel-pt-decoder.c | 99 ++++++++++++++++++- + .../util/intel-pt-decoder/intel-pt-decoder.h | 1 + + .../intel-pt-decoder/intel-pt-insn-decoder.c | 1 + + .../intel-pt-decoder/intel-pt-insn-decoder.h | 1 + + tools/perf/util/intel-pt.c | 37 ++++++- + 6 files changed, 224 insertions(+), 3 deletions(-) + +diff --git a/tools/perf/Documentation/perf-intel-pt.txt b/tools/perf/Documentation/perf-intel-pt.txt +index d44e6a332dfb1..5415c4993c6b4 100644 +--- a/tools/perf/Documentation/perf-intel-pt.txt ++++ b/tools/perf/Documentation/perf-intel-pt.txt +@@ -457,6 +457,8 @@ ptw Enable PTWRITE packets which are produced when a ptwrite instruction + which contains "1" if the feature is supported and + "0" otherwise. + ++ As an alternative, refer to "Emulated PTWRITE" further below. ++ + fup_on_ptw Enable a FUP packet to follow the PTWRITE packet. The FUP packet + provides the address of the ptwrite instruction. In the absence of + fup_on_ptw, the decoder will use the address of the previous branch +@@ -1438,6 +1440,92 @@ In that case the --itrace q option is forced because walking executable code + to reconstruct the control flow is not possible. + + ++Emulated PTWRITE ++---------------- ++ ++Later perf tools support a method to emulate the ptwrite instruction, which ++can be useful if hardware does not support the ptwrite instruction. ++ ++Instead of using the ptwrite instruction, a function is used which produces ++a trace that encodes the payload data into TNT packets. Here is an example ++of the function: ++ ++ #include ++ ++ void perf_emulate_ptwrite(uint64_t x) ++ __attribute__((externally_visible, noipa, no_instrument_function, naked)); ++ ++ #define PERF_EMULATE_PTWRITE_8_BITS \ ++ "1: shl %rax\n" \ ++ " jc 1f\n" \ ++ "1: shl %rax\n" \ ++ " jc 1f\n" \ ++ "1: shl %rax\n" \ ++ " jc 1f\n" \ ++ "1: shl %rax\n" \ ++ " jc 1f\n" \ ++ "1: shl %rax\n" \ ++ " jc 1f\n" \ ++ "1: shl %rax\n" \ ++ " jc 1f\n" \ ++ "1: shl %rax\n" \ ++ " jc 1f\n" \ ++ "1: shl %rax\n" \ ++ " jc 1f\n" ++ ++ /* Undefined instruction */ ++ #define PERF_EMULATE_PTWRITE_UD2 ".byte 0x0f, 0x0b\n" ++ ++ #define PERF_EMULATE_PTWRITE_MAGIC PERF_EMULATE_PTWRITE_UD2 ".ascii \"perf,ptwrite \"\n" ++ ++ void perf_emulate_ptwrite(uint64_t x __attribute__ ((__unused__))) ++ { ++ /* Assumes SysV ABI : x passed in rdi */ ++ __asm__ volatile ( ++ "jmp 1f\n" ++ PERF_EMULATE_PTWRITE_MAGIC ++ "1: mov %rdi, %rax\n" ++ PERF_EMULATE_PTWRITE_8_BITS ++ PERF_EMULATE_PTWRITE_8_BITS ++ PERF_EMULATE_PTWRITE_8_BITS ++ PERF_EMULATE_PTWRITE_8_BITS ++ PERF_EMULATE_PTWRITE_8_BITS ++ PERF_EMULATE_PTWRITE_8_BITS ++ PERF_EMULATE_PTWRITE_8_BITS ++ PERF_EMULATE_PTWRITE_8_BITS ++ "1: ret\n" ++ ); ++ } ++ ++For example, a test program with the function above: ++ ++ #include ++ #include ++ #include ++ ++ #include "perf_emulate_ptwrite.h" ++ ++ int main(int argc, char *argv[]) ++ { ++ uint64_t x = 0; ++ ++ if (argc > 1) ++ x = strtoull(argv[1], NULL, 0); ++ perf_emulate_ptwrite(x); ++ return 0; ++ } ++ ++Can be compiled and traced: ++ ++ $ gcc -Wall -Wextra -O3 -g -o eg_ptw eg_ptw.c ++ $ perf record -e intel_pt//u ./eg_ptw 0x1234567890abcdef ++ [ perf record: Woken up 1 times to write data ] ++ [ perf record: Captured and wrote 0.017 MB perf.data ] ++ $ perf script --itrace=ew ++ eg_ptw 19875 [007] 8061.235912: ptwrite: IP: 0 payload: 0x1234567890abcdef 55701249a196 perf_emulate_ptwrite+0x16 (/home/user/eg_ptw) ++ $ ++ ++ + EXAMPLE + ------- + +diff --git a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c +index b0034ee4bba50..a7daec6cdc7b2 100644 +--- a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c ++++ b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c +@@ -137,6 +137,7 @@ struct intel_pt_decoder { + bool in_psb; + bool hop; + bool leap; ++ bool emulated_ptwrite; + bool vm_time_correlation; + bool vm_tm_corr_dry_run; + bool vm_tm_corr_reliable; +@@ -473,6 +474,8 @@ static int intel_pt_ext_err(int code) + return INTEL_PT_ERR_LOST; + case -ELOOP: + return INTEL_PT_ERR_NELOOP; ++ case -ECONNRESET: ++ return INTEL_PT_ERR_EPTW; + default: + return INTEL_PT_ERR_UNK; + } +@@ -489,6 +492,7 @@ static const char *intel_pt_err_msgs[] = { + [INTEL_PT_ERR_LOST] = "Lost trace data", + [INTEL_PT_ERR_UNK] = "Unknown error!", + [INTEL_PT_ERR_NELOOP] = "Never-ending loop (refer perf config intel-pt.max-loops)", ++ [INTEL_PT_ERR_EPTW] = "Broken emulated ptwrite", + }; + + int intel_pt__strerror(int code, char *buf, size_t buflen) +@@ -1402,17 +1406,108 @@ static int intel_pt_walk_tip(struct intel_pt_decoder *decoder) + return intel_pt_bug(decoder); + } + ++struct eptw_data { ++ int bit_countdown; ++ uint64_t payload; ++}; ++ ++static int intel_pt_eptw_lookahead_cb(struct intel_pt_pkt_info *pkt_info) ++{ ++ struct eptw_data *data = pkt_info->data; ++ int nr_bits; ++ ++ switch (pkt_info->packet.type) { ++ case INTEL_PT_PAD: ++ case INTEL_PT_MNT: ++ case INTEL_PT_MODE_EXEC: ++ case INTEL_PT_MODE_TSX: ++ case INTEL_PT_MTC: ++ case INTEL_PT_FUP: ++ case INTEL_PT_CYC: ++ case INTEL_PT_CBR: ++ case INTEL_PT_TSC: ++ case INTEL_PT_TMA: ++ case INTEL_PT_PIP: ++ case INTEL_PT_VMCS: ++ case INTEL_PT_PSB: ++ case INTEL_PT_PSBEND: ++ case INTEL_PT_PTWRITE: ++ case INTEL_PT_PTWRITE_IP: ++ case INTEL_PT_EXSTOP: ++ case INTEL_PT_EXSTOP_IP: ++ case INTEL_PT_MWAIT: ++ case INTEL_PT_PWRE: ++ case INTEL_PT_PWRX: ++ case INTEL_PT_BBP: ++ case INTEL_PT_BIP: ++ case INTEL_PT_BEP: ++ case INTEL_PT_BEP_IP: ++ case INTEL_PT_CFE: ++ case INTEL_PT_CFE_IP: ++ case INTEL_PT_EVD: ++ break; ++ ++ case INTEL_PT_TNT: ++ nr_bits = data->bit_countdown; ++ if (nr_bits > pkt_info->packet.count) ++ nr_bits = pkt_info->packet.count; ++ data->payload <<= nr_bits; ++ data->payload |= pkt_info->packet.payload >> (64 - nr_bits); ++ data->bit_countdown -= nr_bits; ++ return !data->bit_countdown; ++ ++ case INTEL_PT_TIP_PGE: ++ case INTEL_PT_TIP_PGD: ++ case INTEL_PT_TIP: ++ case INTEL_PT_BAD: ++ case INTEL_PT_OVF: ++ case INTEL_PT_TRACESTOP: ++ default: ++ return 1; ++ } ++ ++ return 0; ++} ++ ++static int intel_pt_emulated_ptwrite(struct intel_pt_decoder *decoder) ++{ ++ int n = 64 - decoder->tnt.count; ++ struct eptw_data data = { ++ .bit_countdown = n, ++ .payload = decoder->tnt.payload >> n, ++ }; ++ ++ decoder->emulated_ptwrite = false; ++ intel_pt_log("Emulated ptwrite detected\n"); ++ ++ intel_pt_pkt_lookahead(decoder, intel_pt_eptw_lookahead_cb, &data); ++ if (data.bit_countdown) ++ return -ECONNRESET; ++ ++ decoder->state.type = INTEL_PT_PTW; ++ decoder->state.from_ip = decoder->ip; ++ decoder->state.to_ip = 0; ++ decoder->state.ptw_payload = data.payload; ++ return 0; ++} ++ + static int intel_pt_walk_tnt(struct intel_pt_decoder *decoder) + { + struct intel_pt_insn intel_pt_insn; + int err; + + while (1) { ++ if (decoder->emulated_ptwrite) ++ return intel_pt_emulated_ptwrite(decoder); + err = intel_pt_walk_insn(decoder, &intel_pt_insn, 0); +- if (err == INTEL_PT_RETURN) ++ if (err == INTEL_PT_RETURN) { ++ decoder->emulated_ptwrite = intel_pt_insn.emulated_ptwrite; + return 0; +- if (err) ++ } ++ if (err) { ++ decoder->emulated_ptwrite = false; + return err; ++ } + + if (intel_pt_insn.op == INTEL_PT_OP_RET) { + if (!decoder->return_compression) { +diff --git a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.h b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.h +index 4b5e79fcf557f..0a641aba3c7cb 100644 +--- a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.h ++++ b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.h +@@ -55,6 +55,7 @@ enum { + INTEL_PT_ERR_LOST, + INTEL_PT_ERR_UNK, + INTEL_PT_ERR_NELOOP, ++ INTEL_PT_ERR_EPTW, + INTEL_PT_ERR_MAX, + }; + +diff --git a/tools/perf/util/intel-pt-decoder/intel-pt-insn-decoder.c b/tools/perf/util/intel-pt-decoder/intel-pt-insn-decoder.c +index 593f20e9774c0..9f29cf7210773 100644 +--- a/tools/perf/util/intel-pt-decoder/intel-pt-insn-decoder.c ++++ b/tools/perf/util/intel-pt-decoder/intel-pt-insn-decoder.c +@@ -32,6 +32,7 @@ static void intel_pt_insn_decoder(struct insn *insn, + int ext; + + intel_pt_insn->rel = 0; ++ intel_pt_insn->emulated_ptwrite = false; + + if (insn_is_avx(insn)) { + intel_pt_insn->op = INTEL_PT_OP_OTHER; +diff --git a/tools/perf/util/intel-pt-decoder/intel-pt-insn-decoder.h b/tools/perf/util/intel-pt-decoder/intel-pt-insn-decoder.h +index c2861cfdd768d..e3338b56a75f2 100644 +--- a/tools/perf/util/intel-pt-decoder/intel-pt-insn-decoder.h ++++ b/tools/perf/util/intel-pt-decoder/intel-pt-insn-decoder.h +@@ -37,6 +37,7 @@ enum intel_pt_insn_branch { + struct intel_pt_insn { + enum intel_pt_insn_op op; + enum intel_pt_insn_branch branch; ++ bool emulated_ptwrite; + int length; + int32_t rel; + unsigned char buf[INTEL_PT_INSN_BUF_SZ]; +diff --git a/tools/perf/util/intel-pt.c b/tools/perf/util/intel-pt.c +index 6324195467056..89863efedc82c 100644 +--- a/tools/perf/util/intel-pt.c ++++ b/tools/perf/util/intel-pt.c +@@ -506,6 +506,7 @@ struct intel_pt_cache_entry { + u64 byte_cnt; + enum intel_pt_insn_op op; + enum intel_pt_insn_branch branch; ++ bool emulated_ptwrite; + int length; + int32_t rel; + char insn[INTEL_PT_INSN_BUF_SZ]; +@@ -592,6 +593,7 @@ static int intel_pt_cache_add(struct dso *dso, struct machine *machine, + e->byte_cnt = byte_cnt; + e->op = intel_pt_insn->op; + e->branch = intel_pt_insn->branch; ++ e->emulated_ptwrite = intel_pt_insn->emulated_ptwrite; + e->length = intel_pt_insn->length; + e->rel = intel_pt_insn->rel; + memcpy(e->insn, intel_pt_insn->buf, INTEL_PT_INSN_BUF_SZ); +@@ -678,6 +680,28 @@ static int intel_pt_get_guest(struct intel_pt_queue *ptq) + return 0; + } + ++static inline bool intel_pt_jmp_16(struct intel_pt_insn *intel_pt_insn) ++{ ++ return intel_pt_insn->rel == 16 && intel_pt_insn->branch == INTEL_PT_BR_UNCONDITIONAL; ++} ++ ++#define PTWRITE_MAGIC "\x0f\x0bperf,ptwrite " ++#define PTWRITE_MAGIC_LEN 16 ++ ++static bool intel_pt_emulated_ptwrite(struct dso *dso, struct machine *machine, u64 offset) ++{ ++ unsigned char buf[PTWRITE_MAGIC_LEN]; ++ ssize_t len; ++ ++ len = dso__data_read_offset(dso, machine, offset, buf, PTWRITE_MAGIC_LEN); ++ if (len == PTWRITE_MAGIC_LEN && !memcmp(buf, PTWRITE_MAGIC, PTWRITE_MAGIC_LEN)) { ++ intel_pt_log("Emulated ptwrite signature found\n"); ++ return true; ++ } ++ intel_pt_log("Emulated ptwrite signature not found\n"); ++ return false; ++} ++ + static int intel_pt_walk_next_insn(struct intel_pt_insn *intel_pt_insn, + uint64_t *insn_cnt_ptr, uint64_t *ip, + uint64_t to_ip, uint64_t max_insn_cnt, +@@ -740,6 +764,7 @@ static int intel_pt_walk_next_insn(struct intel_pt_insn *intel_pt_insn, + *ip += e->byte_cnt; + intel_pt_insn->op = e->op; + intel_pt_insn->branch = e->branch; ++ intel_pt_insn->emulated_ptwrite = e->emulated_ptwrite; + intel_pt_insn->length = e->length; + intel_pt_insn->rel = e->rel; + memcpy(intel_pt_insn->buf, e->insn, +@@ -771,8 +796,18 @@ static int intel_pt_walk_next_insn(struct intel_pt_insn *intel_pt_insn, + + insn_cnt += 1; + +- if (intel_pt_insn->branch != INTEL_PT_BR_NO_BRANCH) ++ if (intel_pt_insn->branch != INTEL_PT_BR_NO_BRANCH) { ++ bool eptw; ++ u64 offs; ++ ++ if (!intel_pt_jmp_16(intel_pt_insn)) ++ goto out; ++ /* Check for emulated ptwrite */ ++ offs = offset + intel_pt_insn->length; ++ eptw = intel_pt_emulated_ptwrite(al.map->dso, machine, offs); ++ intel_pt_insn->emulated_ptwrite = eptw; + goto out; ++ } + + if (max_insn_cnt && insn_cnt >= max_insn_cnt) + goto out_no_cache; +-- +2.39.2 + diff --git a/queue-5.15/perf-intel-pt-do-not-try-to-queue-auxtrace-data-on-p.patch b/queue-5.15/perf-intel-pt-do-not-try-to-queue-auxtrace-data-on-p.patch new file mode 100644 index 00000000000..7a02161e65b --- /dev/null +++ b/queue-5.15/perf-intel-pt-do-not-try-to-queue-auxtrace-data-on-p.patch @@ -0,0 +1,123 @@ +From aad1d1ea7a9925221ce25b0d3306fac5c845696b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Jan 2023 18:33:48 -0800 +Subject: perf intel-pt: Do not try to queue auxtrace data on pipe + +From: Namhyung Kim + +[ Upstream commit aeb802f872a7c42e4381f36041e77d1745908255 ] + +When it processes AUXTRACE_INFO, it calls to auxtrace_queue_data() to +collect AUXTRACE data first. That won't work with pipe since it needs +lseek() to read the scattered aux data. + + $ perf record -o- -e intel_pt// true | perf report -i- --itrace=i100 + # To display the perf.data header info, please use --header/--header-only options. + # + 0x4118 [0xa0]: failed to process type: 70 + Error: + failed to process sample + +For the pipe mode, it can handle the aux data as it gets. But there's +no guarantee it can get the aux data in time. So the following warning +will be shown at the beginning: + + WARNING: Intel PT with pipe mode is not recommended. + The output cannot relied upon. In particular, + time stamps and the order of events may be incorrect. + +Fixes: dbd134322e74f19d ("perf intel-pt: Add support for decoding AUX area samples") +Reviewed-by: Adrian Hunter +Reviewed-by: James Clark +Signed-off-by: Namhyung Kim +Cc: Adrian Hunter +Cc: Ian Rogers +Cc: Ingo Molnar +Cc: Jiri Olsa +Cc: Leo Yan +Cc: Peter Zijlstra +Cc: Stephane Eranian +Link: https://lore.kernel.org/r/20230131023350.1903992-3-namhyung@kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/Documentation/perf-intel-pt.txt | 30 ++++++++++++++++++++++ + tools/perf/util/auxtrace.c | 3 +++ + tools/perf/util/intel-pt.c | 6 +++++ + 3 files changed, 39 insertions(+) + +diff --git a/tools/perf/Documentation/perf-intel-pt.txt b/tools/perf/Documentation/perf-intel-pt.txt +index 5415c4993c6b4..de63c418e4d1f 100644 +--- a/tools/perf/Documentation/perf-intel-pt.txt ++++ b/tools/perf/Documentation/perf-intel-pt.txt +@@ -1526,6 +1526,36 @@ Can be compiled and traced: + $ + + ++Pipe mode ++--------- ++Pipe mode is a problem for Intel PT and possibly other auxtrace users. ++It's not recommended to use a pipe as data output with Intel PT because ++of the following reason. ++ ++Essentially the auxtrace buffers do not behave like the regular perf ++event buffers. That is because the head and tail are updated by ++software, but in the auxtrace case the data is written by hardware. ++So the head and tail do not get updated as data is written. ++ ++In the Intel PT case, the head and tail are updated only when the trace ++is disabled by software, for example: ++ - full-trace, system wide : when buffer passes watermark ++ - full-trace, not system-wide : when buffer passes watermark or ++ context switches ++ - snapshot mode : as above but also when a snapshot is made ++ - sample mode : as above but also when a sample is made ++ ++That means finished-round ordering doesn't work. An auxtrace buffer ++can turn up that has data that extends back in time, possibly to the ++very beginning of tracing. ++ ++For a perf.data file, that problem is solved by going through the trace ++and queuing up the auxtrace buffers in advance. ++ ++For pipe mode, the order of events and timestamps can presumably ++be messed up. ++ ++ + EXAMPLE + ------- + +diff --git a/tools/perf/util/auxtrace.c b/tools/perf/util/auxtrace.c +index 0ef4cbf21e627..344b65a8f7687 100644 +--- a/tools/perf/util/auxtrace.c ++++ b/tools/perf/util/auxtrace.c +@@ -1107,6 +1107,9 @@ int auxtrace_queue_data(struct perf_session *session, bool samples, bool events) + if (auxtrace__dont_decode(session)) + return 0; + ++ if (perf_data__is_pipe(session->data)) ++ return 0; ++ + if (!session->auxtrace || !session->auxtrace->queue_data) + return -EINVAL; + +diff --git a/tools/perf/util/intel-pt.c b/tools/perf/util/intel-pt.c +index 89863efedc82c..7a2ce387079e3 100644 +--- a/tools/perf/util/intel-pt.c ++++ b/tools/perf/util/intel-pt.c +@@ -3942,6 +3942,12 @@ int intel_pt_process_auxtrace_info(union perf_event *event, + + intel_pt_setup_pebs_events(pt); + ++ if (perf_data__is_pipe(session->data)) { ++ pr_warning("WARNING: Intel PT with pipe mode is not recommended.\n" ++ " The output cannot relied upon. In particular,\n" ++ " timestamps and the order of events may be incorrect.\n"); ++ } ++ + if (pt->sampling_mode || list_empty(&session->auxtrace_index)) + err = auxtrace_queue_data(session, true, true); + else +-- +2.39.2 + diff --git a/queue-5.15/perf-llvm-fix-inadvertent-file-creation.patch b/queue-5.15/perf-llvm-fix-inadvertent-file-creation.patch new file mode 100644 index 00000000000..8160d68fa00 --- /dev/null +++ b/queue-5.15/perf-llvm-fix-inadvertent-file-creation.patch @@ -0,0 +1,91 @@ +From 07f44de77e2db838a776ce0b4decaa3255361b97 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Jan 2023 00:26:09 -0800 +Subject: perf llvm: Fix inadvertent file creation + +From: Ian Rogers + +[ Upstream commit 9f19aab47ced012eddef1e2bc96007efc7713b61 ] + +The LLVM template is first echo-ed into command_out and then +command_out executed. The echo surrounds the template with double +quotes, however, the template itself may contain quotes. This is +generally innocuous but in tools/perf/tests/bpf-script-test-prologue.c +we see: +... +SEC("func=null_lseek file->f_mode offset orig") +... +where the first double quote ends the double quote of the echo, then +the > redirects output into a file called f_mode. + +To avoid this inadvertent behavior substitute redirects and similar +characters to be ASCII control codes, then substitute the output in +the echo back again. + +Fixes: 5eab5a7ee032acaa ("perf llvm: Display eBPF compiling command in debug output") +Signed-off-by: Ian Rogers +Cc: Alexander Shishkin +Cc: Andrii Nakryiko +Cc: bpf@vger.kernel.org +Cc: Ingo Molnar +Cc: Jiri Olsa +Cc: llvm@lists.linux.dev +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Nathan Chancellor +Cc: Nick Desaulniers +Cc: Peter Zijlstra +Cc: Tom Rix +Link: https://lore.kernel.org/r/20230105082609.344538-1-irogers@google.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/llvm-utils.c | 25 ++++++++++++++++++++++++- + 1 file changed, 24 insertions(+), 1 deletion(-) + +diff --git a/tools/perf/util/llvm-utils.c b/tools/perf/util/llvm-utils.c +index 96c8ef60f4f84..8ee3a947b1599 100644 +--- a/tools/perf/util/llvm-utils.c ++++ b/tools/perf/util/llvm-utils.c +@@ -531,14 +531,37 @@ int llvm__compile_bpf(const char *path, void **p_obj_buf, + + pr_debug("llvm compiling command template: %s\n", template); + ++ /* ++ * Below, substitute control characters for values that can cause the ++ * echo to misbehave, then substitute the values back. ++ */ + err = -ENOMEM; +- if (asprintf(&command_echo, "echo -n \"%s\"", template) < 0) ++ if (asprintf(&command_echo, "echo -n \a%s\a", template) < 0) + goto errout; + ++#define SWAP_CHAR(a, b) do { if (*p == a) *p = b; } while (0) ++ for (char *p = command_echo; *p; p++) { ++ SWAP_CHAR('<', '\001'); ++ SWAP_CHAR('>', '\002'); ++ SWAP_CHAR('"', '\003'); ++ SWAP_CHAR('\'', '\004'); ++ SWAP_CHAR('|', '\005'); ++ SWAP_CHAR('&', '\006'); ++ SWAP_CHAR('\a', '"'); ++ } + err = read_from_pipe(command_echo, (void **) &command_out, NULL); + if (err) + goto errout; + ++ for (char *p = command_out; *p; p++) { ++ SWAP_CHAR('\001', '<'); ++ SWAP_CHAR('\002', '>'); ++ SWAP_CHAR('\003', '"'); ++ SWAP_CHAR('\004', '\''); ++ SWAP_CHAR('\005', '|'); ++ SWAP_CHAR('\006', '&'); ++ } ++#undef SWAP_CHAR + pr_debug("llvm compiling command : %s\n", command_out); + + err = read_from_pipe(template, &obj_buf, &obj_buf_sz); +-- +2.39.2 + diff --git a/queue-5.15/perf-tools-fix-auto-complete-on-aarch64.patch b/queue-5.15/perf-tools-fix-auto-complete-on-aarch64.patch new file mode 100644 index 00000000000..d9cd83237e9 --- /dev/null +++ b/queue-5.15/perf-tools-fix-auto-complete-on-aarch64.patch @@ -0,0 +1,72 @@ +From 2243a29de6d884806fe787883836839bd2d0cade Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Feb 2023 11:50:57 +0800 +Subject: perf tools: Fix auto-complete on aarch64 + +From: Yicong Yang + +[ Upstream commit ffd1240e8f0814262ceb957dbe961f6e0aef1e7a ] + +On aarch64 CPU related events are not under event_source/devices/cpu/events, +they're under event_source/devices/armv8_pmuv3_0/events on my machine. +Using current auto-complete script will generate below error: + + [root@localhost bin]# perf stat -e + ls: cannot access '/sys/bus/event_source/devices/cpu/events': No such file or directory + +Fix this by not testing /sys/bus/event_source/devices/cpu/events on +aarch64 machine. + +Fixes: 74cd5815d9af6e6c ("perf tool: Improve bash command line auto-complete for multiple events with comma") +Reviewed-by: James Clark +Signed-off-by: Yicong Yang +Cc: Alexander Shishkin +Cc: Ingo Molnar +Cc: Jin Yao +Cc: Jiri Olsa +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: linux-arm-kernel@lists.infradead.org +Cc: linuxarm@huawei.com +Cc: prime.zeng@hisilicon.com +Link: https://lore.kernel.org/r/20230207035057.43394-1-yangyicong@huawei.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/perf-completion.sh | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/tools/perf/perf-completion.sh b/tools/perf/perf-completion.sh +index fdf75d45efff7..978249d7868c2 100644 +--- a/tools/perf/perf-completion.sh ++++ b/tools/perf/perf-completion.sh +@@ -165,7 +165,12 @@ __perf_main () + + local cur1=${COMP_WORDS[COMP_CWORD]} + local raw_evts=$($cmd list --raw-dump) +- local arr s tmp result ++ local arr s tmp result cpu_evts ++ ++ # aarch64 doesn't have /sys/bus/event_source/devices/cpu/events ++ if [[ `uname -m` != aarch64 ]]; then ++ cpu_evts=$(ls /sys/bus/event_source/devices/cpu/events) ++ fi + + if [[ "$cur1" == */* && ${cur1#*/} =~ ^[A-Z] ]]; then + OLD_IFS="$IFS" +@@ -183,9 +188,9 @@ __perf_main () + fi + done + +- evts=${result}" "$(ls /sys/bus/event_source/devices/cpu/events) ++ evts=${result}" "${cpu_evts} + else +- evts=${raw_evts}" "$(ls /sys/bus/event_source/devices/cpu/events) ++ evts=${raw_evts}" "${cpu_evts} + fi + + if [[ "$cur1" == , ]]; then +-- +2.39.2 + diff --git a/queue-5.15/phy-rockchip-typec-fix-tcphy_get_mode-error-case.patch b/queue-5.15/phy-rockchip-typec-fix-tcphy_get_mode-error-case.patch new file mode 100644 index 00000000000..e325f91770e --- /dev/null +++ b/queue-5.15/phy-rockchip-typec-fix-tcphy_get_mode-error-case.patch @@ -0,0 +1,54 @@ +From 42f522343960577ec19fbb9fa1f427523f9cac10 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Jan 2023 00:10:12 +0000 +Subject: phy: rockchip-typec: fix tcphy_get_mode error case + +From: Neill Kapron + +[ Upstream commit 4ca651df07183e29cdad7272255e23aec0169a1b ] + +The existing logic in tcphy_get_mode() can cause the phy to be +incorrectly configured to USB UFP or DisplayPort mode when +extcon_get_state returns an error code. + +extcon_get_state() can return 0, 1, or a negative error code. + +It is possible to get into the failing state with an extcon driver +which does not support the extcon connector id specified as the +second argument to extcon_get_state(). + +tcphy_get_mode() +->extcon_get_state() +-->find_cable_index_by_id() +--->return -EINVAL; + +Fixes: e96be45cb84e ("phy: Add USB Type-C PHY driver for rk3399") +Signed-off-by: Neill Kapron +Reviewed-by: Lee Jones +Link: https://lore.kernel.org/r/20230126001013.3707873-1-nkapron@google.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/rockchip/phy-rockchip-typec.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/phy/rockchip/phy-rockchip-typec.c b/drivers/phy/rockchip/phy-rockchip-typec.c +index d2bbdc96a1672..5b9a254c45524 100644 +--- a/drivers/phy/rockchip/phy-rockchip-typec.c ++++ b/drivers/phy/rockchip/phy-rockchip-typec.c +@@ -821,10 +821,10 @@ static int tcphy_get_mode(struct rockchip_typec_phy *tcphy) + mode = MODE_DFP_USB; + id = EXTCON_USB_HOST; + +- if (ufp) { ++ if (ufp > 0) { + mode = MODE_UFP_USB; + id = EXTCON_USB; +- } else if (dp) { ++ } else if (dp > 0) { + mode = MODE_DFP_DP; + id = EXTCON_DISP_DP; + +-- +2.39.2 + diff --git a/queue-5.15/pinctrl-at91-use-devm_kasprintf-to-avoid-potential-l.patch b/queue-5.15/pinctrl-at91-use-devm_kasprintf-to-avoid-potential-l.patch new file mode 100644 index 00000000000..4eb2d293218 --- /dev/null +++ b/queue-5.15/pinctrl-at91-use-devm_kasprintf-to-avoid-potential-l.patch @@ -0,0 +1,53 @@ +From 9e42387b6cd4dcb1c9d85f82bd9e64ed565b4caf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Feb 2023 15:27:14 +0200 +Subject: pinctrl: at91: use devm_kasprintf() to avoid potential leaks + +From: Claudiu Beznea + +[ Upstream commit 1c4e5c470a56f7f7c649c0c70e603abc1eab15c4 ] + +Use devm_kasprintf() instead of kasprintf() to avoid any potential +leaks. At the moment drivers have no remove functionality thus +there is no need for fixes tag. + +Signed-off-by: Claudiu Beznea +Link: https://lore.kernel.org/r/20230203132714.1931596-1-claudiu.beznea@microchip.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/pinctrl-at91-pio4.c | 4 ++-- + drivers/pinctrl/pinctrl-at91.c | 2 +- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/pinctrl/pinctrl-at91-pio4.c b/drivers/pinctrl/pinctrl-at91-pio4.c +index 03c32b2c5d303..c86fcdfaf825c 100644 +--- a/drivers/pinctrl/pinctrl-at91-pio4.c ++++ b/drivers/pinctrl/pinctrl-at91-pio4.c +@@ -1126,8 +1126,8 @@ static int atmel_pinctrl_probe(struct platform_device *pdev) + + pin_desc[i].number = i; + /* Pin naming convention: P(bank_name)(bank_pin_number). */ +- pin_desc[i].name = kasprintf(GFP_KERNEL, "P%c%d", +- bank + 'A', line); ++ pin_desc[i].name = devm_kasprintf(&pdev->dev, GFP_KERNEL, "P%c%d", ++ bank + 'A', line); + + group->name = group_names[i] = pin_desc[i].name; + group->pin = pin_desc[i].number; +diff --git a/drivers/pinctrl/pinctrl-at91.c b/drivers/pinctrl/pinctrl-at91.c +index 6022496bb6a98..3b0341c730ee0 100644 +--- a/drivers/pinctrl/pinctrl-at91.c ++++ b/drivers/pinctrl/pinctrl-at91.c +@@ -1891,7 +1891,7 @@ static int at91_gpio_probe(struct platform_device *pdev) + } + + for (i = 0; i < chip->ngpio; i++) +- names[i] = kasprintf(GFP_KERNEL, "pio%c%d", alias_idx + 'A', i); ++ names[i] = devm_kasprintf(&pdev->dev, GFP_KERNEL, "pio%c%d", alias_idx + 'A', i); + + chip->names = (const char *const *)names; + +-- +2.39.2 + diff --git a/queue-5.15/pinctrl-bcm2835-remove-of_node_put-in-bcm2835_of_gpi.patch b/queue-5.15/pinctrl-bcm2835-remove-of_node_put-in-bcm2835_of_gpi.patch new file mode 100644 index 00000000000..05f504d4785 --- /dev/null +++ b/queue-5.15/pinctrl-bcm2835-remove-of_node_put-in-bcm2835_of_gpi.patch @@ -0,0 +1,43 @@ +From 6c867b86634feb567bb1dbc21dbfbb8a45e4acb6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Jan 2023 23:53:50 +0200 +Subject: pinctrl: bcm2835: Remove of_node_put() in + bcm2835_of_gpio_ranges_fallback() + +From: Andy Shevchenko + +[ Upstream commit 2d578dd27871372f7159dd3206149ec616700d87 ] + +Remove wrong of_node_put() in bcm2835_of_gpio_ranges_fallback(), +there is no counterpart of_node_get() for it. + +Fixes: d2b67744fd99 ("pinctrl: bcm2835: implement hook for missing gpio-ranges") +Signed-off-by: Andy Shevchenko +Reviewed-by: Stefan Wahren +Tested-by: Stefan Wahren +Tested-by: Florian Fainelli +Reviewed-by: Florian Fainelli +Acked-by: Bartosz Golaszewski +Link: https://lore.kernel.org/r/20230113215352.44272-3-andriy.shevchenko@linux.intel.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/bcm/pinctrl-bcm2835.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/pinctrl/bcm/pinctrl-bcm2835.c b/drivers/pinctrl/bcm/pinctrl-bcm2835.c +index a2938995c7c14..2c10086fd155b 100644 +--- a/drivers/pinctrl/bcm/pinctrl-bcm2835.c ++++ b/drivers/pinctrl/bcm/pinctrl-bcm2835.c +@@ -356,8 +356,6 @@ static int bcm2835_of_gpio_ranges_fallback(struct gpio_chip *gc, + { + struct pinctrl_dev *pctldev = of_pinctrl_get(np); + +- of_node_put(np); +- + if (!pctldev) + return 0; + +-- +2.39.2 + diff --git a/queue-5.15/pinctrl-mediatek-fix-coding-style.patch b/queue-5.15/pinctrl-mediatek-fix-coding-style.patch new file mode 100644 index 00000000000..53b2a954377 --- /dev/null +++ b/queue-5.15/pinctrl-mediatek-fix-coding-style.patch @@ -0,0 +1,60 @@ +From f438eda989385fd522f08a4cc3bf7b2639fe9818 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Sep 2021 16:06:30 +0800 +Subject: pinctrl: mediatek: fix coding style + +From: Zhiyong Tao + +[ Upstream commit 25a74c0f4bf1338af29a32383fb4e1a960ec5063 ] + +Fix Camel spelling coding style to avoid checkpatch +warning in a following patch. + +Signed-off-by: Zhiyong Tao +Reviewed-by: Chen-Yu Tsai +Link: https://lore.kernel.org/r/20210924080632.28410-4-zhiyong.tao@mediatek.com +Signed-off-by: Linus Walleij +Stable-dep-of: a298c70a10c6 ("pinctrl: mediatek: Initialize variable pullen and pullup to zero") +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/mediatek/pinctrl-paris.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/pinctrl/mediatek/pinctrl-paris.c b/drivers/pinctrl/mediatek/pinctrl-paris.c +index 02e2a259edd39..fc3487fccb948 100644 +--- a/drivers/pinctrl/mediatek/pinctrl-paris.c ++++ b/drivers/pinctrl/mediatek/pinctrl-paris.c +@@ -572,7 +572,7 @@ static int mtk_hw_get_value_wrap(struct mtk_pinctrl *hw, unsigned int gpio, int + mtk_hw_get_value_wrap(hw, gpio, PINCTRL_PIN_REG_DRV) + + ssize_t mtk_pctrl_show_one_pin(struct mtk_pinctrl *hw, +- unsigned int gpio, char *buf, unsigned int bufLen) ++ unsigned int gpio, char *buf, unsigned int buf_len) + { + int pinmux, pullup, pullen, len = 0, r1 = -1, r0 = -1; + const struct mtk_pin_desc *desc; +@@ -608,7 +608,7 @@ ssize_t mtk_pctrl_show_one_pin(struct mtk_pinctrl *hw, + } else if (pullen != MTK_DISABLE && pullen != MTK_ENABLE) { + pullen = 0; + } +- len += scnprintf(buf + len, bufLen - len, ++ len += scnprintf(buf + len, buf_len - len, + "%03d: %1d%1d%1d%1d%02d%1d%1d%1d%1d", + gpio, + pinmux, +@@ -622,10 +622,10 @@ ssize_t mtk_pctrl_show_one_pin(struct mtk_pinctrl *hw, + pullup); + + if (r1 != -1) { +- len += scnprintf(buf + len, bufLen - len, " (%1d %1d)\n", ++ len += scnprintf(buf + len, buf_len - len, " (%1d %1d)\n", + r1, r0); + } else { +- len += scnprintf(buf + len, bufLen - len, "\n"); ++ len += scnprintf(buf + len, buf_len - len, "\n"); + } + + return len; +-- +2.39.2 + diff --git a/queue-5.15/pinctrl-mediatek-initialize-variable-buf-to-zero.patch b/queue-5.15/pinctrl-mediatek-initialize-variable-buf-to-zero.patch new file mode 100644 index 00000000000..371b32a3430 --- /dev/null +++ b/queue-5.15/pinctrl-mediatek-initialize-variable-buf-to-zero.patch @@ -0,0 +1,39 @@ +From 8792845b31a56991f63288ad6ee00bab5e20a591 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Jan 2023 14:20:36 +0800 +Subject: pinctrl: mediatek: Initialize variable *buf to zero + +From: Guodong Liu + +[ Upstream commit 2e34f82ba214134ecf590fbe0cdbd87401645a8a ] + +Coverity spotted that *buf is not initialized to zero in +mtk_pctrl_dbg_show. Using uninitialized variable *buf as argument to %s +when calling seq_printf. Fix this coverity by initializing *buf as zero. + +Fixes: 184d8e13f9b1 ("pinctrl: mediatek: Add support for pin configuration dump via debugfs.") +Signed-off-by: Guodong Liu +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20230118062036.26258-3-Guodong.Liu@mediatek.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/mediatek/pinctrl-paris.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pinctrl/mediatek/pinctrl-paris.c b/drivers/pinctrl/mediatek/pinctrl-paris.c +index d151612f4a18c..0fa1c36148c23 100644 +--- a/drivers/pinctrl/mediatek/pinctrl-paris.c ++++ b/drivers/pinctrl/mediatek/pinctrl-paris.c +@@ -637,7 +637,7 @@ static void mtk_pctrl_dbg_show(struct pinctrl_dev *pctldev, struct seq_file *s, + unsigned int gpio) + { + struct mtk_pinctrl *hw = pinctrl_dev_get_drvdata(pctldev); +- char buf[PIN_DBG_BUF_SZ]; ++ char buf[PIN_DBG_BUF_SZ] = { 0 }; + + (void)mtk_pctrl_show_one_pin(hw, gpio, buf, PIN_DBG_BUF_SZ); + +-- +2.39.2 + diff --git a/queue-5.15/pinctrl-mediatek-initialize-variable-pullen-and-pull.patch b/queue-5.15/pinctrl-mediatek-initialize-variable-pullen-and-pull.patch new file mode 100644 index 00000000000..742fa1832f1 --- /dev/null +++ b/queue-5.15/pinctrl-mediatek-initialize-variable-pullen-and-pull.patch @@ -0,0 +1,41 @@ +From 9486a9234c64e09c6520b2c9e542288408bf07b2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Jan 2023 14:20:35 +0800 +Subject: pinctrl: mediatek: Initialize variable pullen and pullup to zero + +From: Guodong Liu + +[ Upstream commit a298c70a10c604a6b3df5a0aa56597b705ba0f6b ] + +Coverity spotted that pullen and pullup is not initialized to zero in +mtk_pctrl_show_one_pin. The uninitialized variable pullen is used in +assignment statement "rsel = pullen;" in mtk_pctrl_show_one_pin, and +Uninitialized variable pullup is used when calling scnprintf. Fix this +coverity by initializing pullen and pullup as zero. + +Fixes: 184d8e13f9b1 ("pinctrl: mediatek: Add support for pin configuration dump via debugfs.") +Signed-off-by: Guodong Liu +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20230118062036.26258-2-Guodong.Liu@mediatek.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/mediatek/pinctrl-paris.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pinctrl/mediatek/pinctrl-paris.c b/drivers/pinctrl/mediatek/pinctrl-paris.c +index fc3487fccb948..d151612f4a18c 100644 +--- a/drivers/pinctrl/mediatek/pinctrl-paris.c ++++ b/drivers/pinctrl/mediatek/pinctrl-paris.c +@@ -574,7 +574,7 @@ static int mtk_hw_get_value_wrap(struct mtk_pinctrl *hw, unsigned int gpio, int + ssize_t mtk_pctrl_show_one_pin(struct mtk_pinctrl *hw, + unsigned int gpio, char *buf, unsigned int buf_len) + { +- int pinmux, pullup, pullen, len = 0, r1 = -1, r0 = -1; ++ int pinmux, pullup = 0, pullen = 0, len = 0, r1 = -1, r0 = -1; + const struct mtk_pin_desc *desc; + + if (gpio >= hw->soc->npins) +-- +2.39.2 + diff --git a/queue-5.15/pinctrl-qcom-pinctrl-msm8976-correct-function-names-.patch b/queue-5.15/pinctrl-qcom-pinctrl-msm8976-correct-function-names-.patch new file mode 100644 index 00000000000..9b899a81229 --- /dev/null +++ b/queue-5.15/pinctrl-qcom-pinctrl-msm8976-correct-function-names-.patch @@ -0,0 +1,50 @@ +From 09fd8ae1eca2c67e43c73f02f7ff270248967918 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 31 Dec 2022 17:42:50 +0100 +Subject: pinctrl: qcom: pinctrl-msm8976: Correct function names for wcss pins + +From: Adam Skladowski + +[ Upstream commit a7cc0e2685082a0d79baec02df184dfa83cbfac3 ] + +Adjust names of function for wcss pins, also fix third gpio in bt group. + +Fixes: bcd11493f0ab ("pinctrl: qcom: Add a pinctrl driver for MSM8976 and 8956") +Signed-off-by: Adam Skladowski +Reviewed-by: Marijn Suijten +Link: https://lore.kernel.org/r/20221231164250.74550-1-a39.skl@gmail.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/qcom/pinctrl-msm8976.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/pinctrl/qcom/pinctrl-msm8976.c b/drivers/pinctrl/qcom/pinctrl-msm8976.c +index ec43edf9b660a..e11d845847190 100644 +--- a/drivers/pinctrl/qcom/pinctrl-msm8976.c ++++ b/drivers/pinctrl/qcom/pinctrl-msm8976.c +@@ -733,7 +733,7 @@ static const char * const codec_int2_groups[] = { + "gpio74", + }; + static const char * const wcss_bt_groups[] = { +- "gpio39", "gpio47", "gpio88", ++ "gpio39", "gpio47", "gpio48", + }; + static const char * const sdc3_groups[] = { + "gpio39", "gpio40", "gpio41", +@@ -958,9 +958,9 @@ static const struct msm_pingroup msm8976_groups[] = { + PINGROUP(37, NA, NA, NA, qdss_tracedata_b, NA, NA, NA, NA, NA), + PINGROUP(38, NA, NA, NA, NA, NA, NA, NA, qdss_tracedata_b, NA), + PINGROUP(39, wcss_bt, sdc3, NA, qdss_tracedata_a, NA, NA, NA, NA, NA), +- PINGROUP(40, wcss_wlan, sdc3, NA, qdss_tracedata_a, NA, NA, NA, NA, NA), +- PINGROUP(41, wcss_wlan, sdc3, NA, qdss_tracedata_a, NA, NA, NA, NA, NA), +- PINGROUP(42, wcss_wlan, sdc3, NA, qdss_tracedata_a, NA, NA, NA, NA, NA), ++ PINGROUP(40, wcss_wlan2, sdc3, NA, qdss_tracedata_a, NA, NA, NA, NA, NA), ++ PINGROUP(41, wcss_wlan1, sdc3, NA, qdss_tracedata_a, NA, NA, NA, NA, NA), ++ PINGROUP(42, wcss_wlan0, sdc3, NA, qdss_tracedata_a, NA, NA, NA, NA, NA), + PINGROUP(43, wcss_wlan, sdc3, NA, NA, qdss_tracedata_a, NA, NA, NA, NA), + PINGROUP(44, wcss_wlan, sdc3, NA, NA, NA, NA, NA, NA, NA), + PINGROUP(45, wcss_fm, NA, qdss_tracectl_a, NA, NA, NA, NA, NA, NA), +-- +2.39.2 + diff --git a/queue-5.15/pinctrl-rockchip-fix-refcount-leak-in-rockchip_pinct.patch b/queue-5.15/pinctrl-rockchip-fix-refcount-leak-in-rockchip_pinct.patch new file mode 100644 index 00000000000..a8c865562d6 --- /dev/null +++ b/queue-5.15/pinctrl-rockchip-fix-refcount-leak-in-rockchip_pinct.patch @@ -0,0 +1,37 @@ +From db3ca85dc9f57e137a03e9f67d93f8db2a34059b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Jan 2023 15:28:45 +0400 +Subject: pinctrl: rockchip: Fix refcount leak in rockchip_pinctrl_parse_groups + +From: Miaoqian Lin + +[ Upstream commit c818ae563bf99457f02e8170aabd6b174f629f65 ] + +of_find_node_by_phandle() returns a node pointer with refcount incremented, +We should use of_node_put() on it when not needed anymore. +Add missing of_node_put() to avoid refcount leak. + +Fixes: d3e5116119bd ("pinctrl: add pinctrl driver for Rockchip SoCs") +Signed-off-by: Miaoqian Lin +Link: https://lore.kernel.org/r/20230102112845.3982407-1-linmq006@gmail.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/pinctrl-rockchip.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/pinctrl/pinctrl-rockchip.c b/drivers/pinctrl/pinctrl-rockchip.c +index c33cbf7568db5..a6f4aca9c61c4 100644 +--- a/drivers/pinctrl/pinctrl-rockchip.c ++++ b/drivers/pinctrl/pinctrl-rockchip.c +@@ -2499,6 +2499,7 @@ static int rockchip_pinctrl_parse_groups(struct device_node *np, + np_config = of_find_node_by_phandle(be32_to_cpup(phandle)); + ret = pinconf_generic_parse_dt_config(np_config, NULL, + &grp->data[j].configs, &grp->data[j].nconfigs); ++ of_node_put(np_config); + if (ret) + return ret; + } +-- +2.39.2 + diff --git a/queue-5.15/pinctrl-stm32-fix-refcount-leak-in-stm32_pctrl_get_i.patch b/queue-5.15/pinctrl-stm32-fix-refcount-leak-in-stm32_pctrl_get_i.patch new file mode 100644 index 00000000000..886eb41be6f --- /dev/null +++ b/queue-5.15/pinctrl-stm32-fix-refcount-leak-in-stm32_pctrl_get_i.patch @@ -0,0 +1,37 @@ +From 256d7078300333a755b5997e839de882abc37176 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Jan 2023 12:24:56 +0400 +Subject: pinctrl: stm32: Fix refcount leak in stm32_pctrl_get_irq_domain + +From: Miaoqian Lin + +[ Upstream commit dcef18c8ac40aa85bb339f64c1dd31dd458b06fb ] + +of_irq_find_parent() returns a node pointer with refcount incremented, +We should use of_node_put() on it when not needed anymore. +Add missing of_node_put() to avoid refcount leak. + +Fixes: d86f4d71e42a ("pinctrl: stm32: check irq controller availability at probe") +Signed-off-by: Miaoqian Lin +Link: https://lore.kernel.org/r/20230102082503.3944927-1-linmq006@gmail.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/stm32/pinctrl-stm32.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/pinctrl/stm32/pinctrl-stm32.c b/drivers/pinctrl/stm32/pinctrl-stm32.c +index d3fa8cf0d72c4..abb12a5c3c329 100644 +--- a/drivers/pinctrl/stm32/pinctrl-stm32.c ++++ b/drivers/pinctrl/stm32/pinctrl-stm32.c +@@ -1334,6 +1334,7 @@ static struct irq_domain *stm32_pctrl_get_irq_domain(struct device_node *np) + return ERR_PTR(-ENXIO); + + domain = irq_find_host(parent); ++ of_node_put(parent); + if (!domain) + /* domain not registered yet */ + return ERR_PTR(-EPROBE_DEFER); +-- +2.39.2 + diff --git a/queue-5.15/pm-domains-fix-memory-leak-with-using-debugfs_lookup.patch b/queue-5.15/pm-domains-fix-memory-leak-with-using-debugfs_lookup.patch new file mode 100644 index 00000000000..a6e1ac60900 --- /dev/null +++ b/queue-5.15/pm-domains-fix-memory-leak-with-using-debugfs_lookup.patch @@ -0,0 +1,44 @@ +From f8ccad195fce89b906a91ba92d277f39bd4ea391 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Feb 2023 15:15:45 +0100 +Subject: PM: domains: fix memory leak with using debugfs_lookup() + +From: Greg Kroah-Hartman + +[ Upstream commit 0b6200e1e9f53dabdc30d0f6c51af9a5f664d32b ] + +When calling debugfs_lookup() the result must have dput() called on it, +otherwise the memory will leak over time. To make things simpler, just +call debugfs_lookup_and_remove() instead which handles all of the logic +at once. + +Signed-off-by: Greg Kroah-Hartman +Reviewed-by: Ulf Hansson +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/base/power/domain.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/drivers/base/power/domain.c b/drivers/base/power/domain.c +index 94fe30c187ad8..24a82e252b7e1 100644 +--- a/drivers/base/power/domain.c ++++ b/drivers/base/power/domain.c +@@ -217,13 +217,10 @@ static void genpd_debug_add(struct generic_pm_domain *genpd); + + static void genpd_debug_remove(struct generic_pm_domain *genpd) + { +- struct dentry *d; +- + if (!genpd_debugfs_dir) + return; + +- d = debugfs_lookup(genpd->name, genpd_debugfs_dir); +- debugfs_remove(d); ++ debugfs_lookup_and_remove(genpd->name, genpd_debugfs_dir); + } + + static void genpd_update_accounting(struct generic_pm_domain *genpd) +-- +2.39.2 + diff --git a/queue-5.15/pm-em-fix-memory-leak-with-using-debugfs_lookup.patch b/queue-5.15/pm-em-fix-memory-leak-with-using-debugfs_lookup.patch new file mode 100644 index 00000000000..3327ceb0f50 --- /dev/null +++ b/queue-5.15/pm-em-fix-memory-leak-with-using-debugfs_lookup.patch @@ -0,0 +1,40 @@ +From 17930114c5ca5e362f7dfef459deee79af7f55cb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Feb 2023 16:15:15 +0100 +Subject: PM: EM: fix memory leak with using debugfs_lookup() + +From: Greg Kroah-Hartman + +[ Upstream commit a0e8c13ccd6a9a636d27353da62c2410c4eca337 ] + +When calling debugfs_lookup() the result must have dput() called on it, +otherwise the memory will leak over time. To make things simpler, just +call debugfs_lookup_and_remove() instead which handles all of the logic +at once. + +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + kernel/power/energy_model.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/kernel/power/energy_model.c b/kernel/power/energy_model.c +index 97e62469a6b32..1b902f986f91c 100644 +--- a/kernel/power/energy_model.c ++++ b/kernel/power/energy_model.c +@@ -85,10 +85,7 @@ static void em_debug_create_pd(struct device *dev) + + static void em_debug_remove_pd(struct device *dev) + { +- struct dentry *debug_dir; +- +- debug_dir = debugfs_lookup(dev_name(dev), rootdir); +- debugfs_remove_recursive(debug_dir); ++ debugfs_lookup_and_remove(dev_name(dev), rootdir); + } + + static int __init em_debug_init(void) +-- +2.39.2 + diff --git a/queue-5.15/power-supply-remove-faulty-cooling-logic.patch b/queue-5.15/power-supply-remove-faulty-cooling-logic.patch new file mode 100644 index 00000000000..a6b052c0b39 --- /dev/null +++ b/queue-5.15/power-supply-remove-faulty-cooling-logic.patch @@ -0,0 +1,183 @@ +From 01426091491785abf5fc0a8619706c76eb46cc0c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 21 Jan 2023 12:16:21 +0100 +Subject: power: supply: remove faulty cooling logic + +From: Andreas Kemnade + +[ Upstream commit c85c191694cb1cf290b11059b3d2de8a2732ffd0 ] + +The rn5t618 power driver fails to register +a cooling device because POWER_SUPPLY_PROP_CHARGE_CONTROL_LIMIT_MAX +is missing but availability is not checked before registering +cooling device. After improved error checking in the thermal +code, the registration of the power supply fails entirely. + +Checking for availability of _MAX before registering cooling device +fixes the rn5t618 problem. But the whole logic feels questionable. + +First, the logic is inverted here: +the code tells: max_current = max_cooling but +0 = max_cooling, so there needs to be some inversion +in the code which cannot be found. Comparing with other +cooling devices, it can be found that value for fan speed is not +inverted, value for cpufreq cooling is inverted (similar situation +as here lowest frequency = max cooling) + +Second, analyzing usage of _MAX: it is seems that maximum capabilities +of charging controller are specified and not of the battery. Probably +there is not too much mismatch in the drivers actually implementing +that. So nothing has exploded yet. So there is no easy and safe way +to specifify a max cooling value now. + +Conclusion for now (as a regression fix) just remove the cooling device +registration and do it properly later on. + +Fixes: e49a1e1ee078 ("thermal/core: fix error code in __thermal_cooling_device_register()") +Fixes: 952aeeb3ee28 ("power_supply: Register power supply for thermal cooling device") +Signed-off-by: Andreas Kemnade +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + drivers/power/supply/power_supply_core.c | 97 ------------------------ + 1 file changed, 97 deletions(-) + +diff --git a/drivers/power/supply/power_supply_core.c b/drivers/power/supply/power_supply_core.c +index 3f9c60c5b250b..8161fad081a96 100644 +--- a/drivers/power/supply/power_supply_core.c ++++ b/drivers/power/supply/power_supply_core.c +@@ -1014,87 +1014,6 @@ static void psy_unregister_thermal(struct power_supply *psy) + thermal_zone_device_unregister(psy->tzd); + } + +-/* thermal cooling device callbacks */ +-static int ps_get_max_charge_cntl_limit(struct thermal_cooling_device *tcd, +- unsigned long *state) +-{ +- struct power_supply *psy; +- union power_supply_propval val; +- int ret; +- +- psy = tcd->devdata; +- ret = power_supply_get_property(psy, +- POWER_SUPPLY_PROP_CHARGE_CONTROL_LIMIT_MAX, &val); +- if (ret) +- return ret; +- +- *state = val.intval; +- +- return ret; +-} +- +-static int ps_get_cur_charge_cntl_limit(struct thermal_cooling_device *tcd, +- unsigned long *state) +-{ +- struct power_supply *psy; +- union power_supply_propval val; +- int ret; +- +- psy = tcd->devdata; +- ret = power_supply_get_property(psy, +- POWER_SUPPLY_PROP_CHARGE_CONTROL_LIMIT, &val); +- if (ret) +- return ret; +- +- *state = val.intval; +- +- return ret; +-} +- +-static int ps_set_cur_charge_cntl_limit(struct thermal_cooling_device *tcd, +- unsigned long state) +-{ +- struct power_supply *psy; +- union power_supply_propval val; +- int ret; +- +- psy = tcd->devdata; +- val.intval = state; +- ret = psy->desc->set_property(psy, +- POWER_SUPPLY_PROP_CHARGE_CONTROL_LIMIT, &val); +- +- return ret; +-} +- +-static const struct thermal_cooling_device_ops psy_tcd_ops = { +- .get_max_state = ps_get_max_charge_cntl_limit, +- .get_cur_state = ps_get_cur_charge_cntl_limit, +- .set_cur_state = ps_set_cur_charge_cntl_limit, +-}; +- +-static int psy_register_cooler(struct power_supply *psy) +-{ +- int i; +- +- /* Register for cooling device if psy can control charging */ +- for (i = 0; i < psy->desc->num_properties; i++) { +- if (psy->desc->properties[i] == +- POWER_SUPPLY_PROP_CHARGE_CONTROL_LIMIT) { +- psy->tcd = thermal_cooling_device_register( +- (char *)psy->desc->name, +- psy, &psy_tcd_ops); +- return PTR_ERR_OR_ZERO(psy->tcd); +- } +- } +- return 0; +-} +- +-static void psy_unregister_cooler(struct power_supply *psy) +-{ +- if (IS_ERR_OR_NULL(psy->tcd)) +- return; +- thermal_cooling_device_unregister(psy->tcd); +-} + #else + static int psy_register_thermal(struct power_supply *psy) + { +@@ -1104,15 +1023,6 @@ static int psy_register_thermal(struct power_supply *psy) + static void psy_unregister_thermal(struct power_supply *psy) + { + } +- +-static int psy_register_cooler(struct power_supply *psy) +-{ +- return 0; +-} +- +-static void psy_unregister_cooler(struct power_supply *psy) +-{ +-} + #endif + + static struct power_supply *__must_check +@@ -1188,10 +1098,6 @@ __power_supply_register(struct device *parent, + if (rc) + goto register_thermal_failed; + +- rc = psy_register_cooler(psy); +- if (rc) +- goto register_cooler_failed; +- + rc = power_supply_create_triggers(psy); + if (rc) + goto create_triggers_failed; +@@ -1221,8 +1127,6 @@ __power_supply_register(struct device *parent, + add_hwmon_sysfs_failed: + power_supply_remove_triggers(psy); + create_triggers_failed: +- psy_unregister_cooler(psy); +-register_cooler_failed: + psy_unregister_thermal(psy); + register_thermal_failed: + wakeup_init_failed: +@@ -1374,7 +1278,6 @@ void power_supply_unregister(struct power_supply *psy) + sysfs_remove_link(&psy->dev.kobj, "powers"); + power_supply_remove_hwmon_sysfs(psy); + power_supply_remove_triggers(psy); +- psy_unregister_cooler(psy); + psy_unregister_thermal(psy); + device_init_wakeup(&psy->dev, false); + device_unregister(&psy->dev); +-- +2.39.2 + diff --git a/queue-5.15/powercap-fix-possible-name-leak-in-powercap_register.patch b/queue-5.15/powercap-fix-possible-name-leak-in-powercap_register.patch new file mode 100644 index 00000000000..3570ee22310 --- /dev/null +++ b/queue-5.15/powercap-fix-possible-name-leak-in-powercap_register.patch @@ -0,0 +1,60 @@ +From ff215cd9ded9566aab8274e2027e5c20385f4bfc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Jan 2023 20:57:26 +0800 +Subject: powercap: fix possible name leak in powercap_register_zone() + +From: Yang Yingliang + +[ Upstream commit 1b6599f741a4525ca761ecde46e5885ff1e6ba58 ] + +In the error path after calling dev_set_name(), the device +name is leaked. To fix this, calling dev_set_name() before +device_register(), and call put_device() if it returns error. + +All the resources is released in powercap_release(), so it +can return from powercap_register_zone() directly. + +Fixes: 75d2364ea0ca ("PowerCap: Add class driver") +Signed-off-by: Yang Yingliang +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/powercap/powercap_sys.c | 14 +++++++++----- + 1 file changed, 9 insertions(+), 5 deletions(-) + +diff --git a/drivers/powercap/powercap_sys.c b/drivers/powercap/powercap_sys.c +index f0654a932b372..ff736b006198f 100644 +--- a/drivers/powercap/powercap_sys.c ++++ b/drivers/powercap/powercap_sys.c +@@ -529,9 +529,6 @@ struct powercap_zone *powercap_register_zone( + power_zone->name = kstrdup(name, GFP_KERNEL); + if (!power_zone->name) + goto err_name_alloc; +- dev_set_name(&power_zone->dev, "%s:%x", +- dev_name(power_zone->dev.parent), +- power_zone->id); + power_zone->constraints = kcalloc(nr_constraints, + sizeof(*power_zone->constraints), + GFP_KERNEL); +@@ -554,9 +551,16 @@ struct powercap_zone *powercap_register_zone( + power_zone->dev_attr_groups[0] = &power_zone->dev_zone_attr_group; + power_zone->dev_attr_groups[1] = NULL; + power_zone->dev.groups = power_zone->dev_attr_groups; ++ dev_set_name(&power_zone->dev, "%s:%x", ++ dev_name(power_zone->dev.parent), ++ power_zone->id); + result = device_register(&power_zone->dev); +- if (result) +- goto err_dev_ret; ++ if (result) { ++ put_device(&power_zone->dev); ++ mutex_unlock(&control_type->lock); ++ ++ return ERR_PTR(result); ++ } + + control_type->nr_zones++; + mutex_unlock(&control_type->lock); +-- +2.39.2 + diff --git a/queue-5.15/powerpc-remove-linker-flag-from-kbuild_aflags.patch b/queue-5.15/powerpc-remove-linker-flag-from-kbuild_aflags.patch new file mode 100644 index 00000000000..64ecb825008 --- /dev/null +++ b/queue-5.15/powerpc-remove-linker-flag-from-kbuild_aflags.patch @@ -0,0 +1,72 @@ +From 5ce91c64379aae3c533f60bd18d0766cd175cc80 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Jan 2023 20:05:02 -0700 +Subject: powerpc: Remove linker flag from KBUILD_AFLAGS + +From: Nathan Chancellor + +[ Upstream commit 31f48f16264bc70962fb3e7ec62da64d0a2ba04a ] + +When clang's -Qunused-arguments is dropped from KBUILD_CPPFLAGS, it +points out that KBUILD_AFLAGS contains a linker flag, which will be +unused: + + clang: error: -Wl,-a32: 'linker' input unused [-Werror,-Wunused-command-line-argument] + +This was likely supposed to be '-Wa,-a$(BITS)'. However, this change is +unnecessary, as all supported versions of clang and gcc will pass '-a64' +or '-a32' to GNU as based on the value of '-m'; the behavior of the +latest stable release of the oldest supported major version of each +compiler is shown below and each compiler's latest release exhibits the +same behavior (GCC 12.2.0 and Clang 15.0.6). + + $ powerpc64-linux-gcc --version | head -1 + powerpc64-linux-gcc (GCC) 5.5.0 + + $ powerpc64-linux-gcc -m64 -### -x assembler-with-cpp -c -o /dev/null /dev/null &| grep 'as ' + .../as -a64 -mppc64 -many -mbig -o /dev/null /tmp/cctwuBzZ.s + + $ powerpc64-linux-gcc -m32 -### -x assembler-with-cpp -c -o /dev/null /dev/null &| grep 'as ' + .../as -a32 -mppc -many -mbig -o /dev/null /tmp/ccaZP4mF.sg + + $ clang --version | head -1 + Ubuntu clang version 11.1.0-++20211011094159+1fdec59bffc1-1~exp1~20211011214622.5 + + $ clang --target=powerpc64-linux-gnu -fno-integrated-as -m64 -### \ + -x assembler-with-cpp -c -o /dev/null /dev/null &| grep gnu-as + "/usr/bin/powerpc64-linux-gnu-as" "-a64" "-mppc64" "-many" "-o" "/dev/null" "/tmp/null-80267c.s" + + $ clang --target=powerpc64-linux-gnu -fno-integrated-as -m64 -### \ + -x assembler-with-cpp -c -o /dev/null /dev/null &| grep gnu-as + "/usr/bin/powerpc64-linux-gnu-as" "-a32" "-mppc" "-many" "-o" "/dev/null" "/tmp/null-ab8f8d.s" + +Remove this flag altogether to avoid future issues. + +Fixes: 1421dc6d4829 ("powerpc/kbuild: Use flags variables rather than overriding LD/CC/AS") +Signed-off-by: Nathan Chancellor +Reviewed-by: Nick Desaulniers +Tested-by: Linux Kernel Functional Testing +Tested-by: Anders Roxell +Acked-by: Michael Ellerman +Signed-off-by: Masahiro Yamada +Signed-off-by: Sasha Levin +--- + arch/powerpc/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile +index 7859ae56fcdcd..a8e52e64c1a5b 100644 +--- a/arch/powerpc/Makefile ++++ b/arch/powerpc/Makefile +@@ -92,7 +92,7 @@ aflags-$(CONFIG_CPU_LITTLE_ENDIAN) += -mlittle-endian + + ifeq ($(HAS_BIARCH),y) + KBUILD_CFLAGS += -m$(BITS) +-KBUILD_AFLAGS += -m$(BITS) -Wl,-a$(BITS) ++KBUILD_AFLAGS += -m$(BITS) + KBUILD_LDFLAGS += -m elf$(BITS)$(LDEMULATION) + endif + +-- +2.39.2 + diff --git a/queue-5.15/printf-fix-errname.c-list.patch b/queue-5.15/printf-fix-errname.c-list.patch new file mode 100644 index 00000000000..72a1eff523e --- /dev/null +++ b/queue-5.15/printf-fix-errname.c-list.patch @@ -0,0 +1,110 @@ +From b40e8162bf0570bbbfb9eccf15248e4473950c5d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Feb 2023 20:40:57 +0100 +Subject: printf: fix errname.c list +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Arnd Bergmann + +[ Upstream commit 0c2baf6509af1d11310ae4c1c839481a6e9a4bc4 ] + +On most architectures, gcc -Wextra warns about the list of error +numbers containing both EDEADLK and EDEADLOCK: + +lib/errname.c:15:67: warning: initialized field overwritten [-Woverride-init] + 15 | #define E(err) [err + BUILD_BUG_ON_ZERO(err <= 0 || err > 300)] = "-" #err + | ^~~ +lib/errname.c:172:2: note: in expansion of macro 'E' + 172 | E(EDEADLK), /* EDEADLOCK */ + | ^ + +On parisc, a similar error happens with -ECANCELLED, which is an +alias for ECANCELED. + +Make the EDEADLK printing conditional on the number being distinct +from EDEADLOCK, and remove the -ECANCELLED bit completely as it +can never be hit. + +To ensure these are correct, add static_assert lines that verify +all the remaining aliases are in fact identical to the canonical +name. + +Fixes: 57f5677e535b ("printf: add support for printing symbolic error names") +Cc: Petr Mladek +Suggested-by: Rasmus Villemoes +Acked-by: Uwe Kleine-König +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/all/20210514213456.745039-1-arnd@kernel.org/ +Link: https://lore.kernel.org/all/20210927123409.1109737-1-arnd@kernel.org/ +Signed-off-by: Arnd Bergmann +Reviewed-by: Sergey Senozhatsky +Acked-by: Rasmus Villemoes +Reviewed-by: Petr Mladek +Signed-off-by: Petr Mladek +Link: https://lore.kernel.org/r/20230206194126.380350-1-arnd@kernel.org +Signed-off-by: Sasha Levin +--- + lib/errname.c | 22 ++++++++++++++-------- + 1 file changed, 14 insertions(+), 8 deletions(-) + +diff --git a/lib/errname.c b/lib/errname.c +index 05cbf731545f0..67739b174a8cc 100644 +--- a/lib/errname.c ++++ b/lib/errname.c +@@ -21,6 +21,7 @@ static const char *names_0[] = { + E(EADDRNOTAVAIL), + E(EADV), + E(EAFNOSUPPORT), ++ E(EAGAIN), /* EWOULDBLOCK */ + E(EALREADY), + E(EBADE), + E(EBADF), +@@ -31,15 +32,17 @@ static const char *names_0[] = { + E(EBADSLT), + E(EBFONT), + E(EBUSY), +-#ifdef ECANCELLED +- E(ECANCELLED), +-#endif ++ E(ECANCELED), /* ECANCELLED */ + E(ECHILD), + E(ECHRNG), + E(ECOMM), + E(ECONNABORTED), ++ E(ECONNREFUSED), /* EREFUSED */ + E(ECONNRESET), ++ E(EDEADLK), /* EDEADLOCK */ ++#if EDEADLK != EDEADLOCK /* mips, sparc, powerpc */ + E(EDEADLOCK), ++#endif + E(EDESTADDRREQ), + E(EDOM), + E(EDOTDOT), +@@ -166,14 +169,17 @@ static const char *names_0[] = { + E(EUSERS), + E(EXDEV), + E(EXFULL), +- +- E(ECANCELED), /* ECANCELLED */ +- E(EAGAIN), /* EWOULDBLOCK */ +- E(ECONNREFUSED), /* EREFUSED */ +- E(EDEADLK), /* EDEADLOCK */ + }; + #undef E + ++#ifdef EREFUSED /* parisc */ ++static_assert(EREFUSED == ECONNREFUSED); ++#endif ++#ifdef ECANCELLED /* parisc */ ++static_assert(ECANCELLED == ECANCELED); ++#endif ++static_assert(EAGAIN == EWOULDBLOCK); /* everywhere */ ++ + #define E(err) [err - 512 + BUILD_BUG_ON_ZERO(err < 512 || err > 550)] = "-" #err + static const char *names_512[] = { + E(ERESTARTSYS), +-- +2.39.2 + diff --git a/queue-5.15/rcu-make-rcu_lockdep_warn-avoid-early-lockdep-checks.patch b/queue-5.15/rcu-make-rcu_lockdep_warn-avoid-early-lockdep-checks.patch new file mode 100644 index 00000000000..96b48e6bc61 --- /dev/null +++ b/queue-5.15/rcu-make-rcu_lockdep_warn-avoid-early-lockdep-checks.patch @@ -0,0 +1,58 @@ +From 029a55261f29f3e6e7ba211d231d4db212aeb6b8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Dec 2022 11:41:44 -0800 +Subject: rcu: Make RCU_LOCKDEP_WARN() avoid early lockdep checks + +From: Paul E. McKenney + +[ Upstream commit 0cae5ded535c3a80aed94f119bbd4ee3ae284a65 ] + +Currently, RCU_LOCKDEP_WARN() checks the condition before checking +to see if lockdep is still enabled. This is necessary to avoid the +false-positive splats fixed by commit 3066820034b5dd ("rcu: Reject +RCU_LOCKDEP_WARN() false positives"). However, the current state can +result in false-positive splats during early boot before lockdep is fully +initialized. This commit therefore checks debug_lockdep_rcu_enabled() +both before and after checking the condition, thus avoiding both sets +of false-positive error reports. + +Reported-by: Steven Rostedt +Reported-by: Masami Hiramatsu (Google) +Reported-by: Mathieu Desnoyers +Signed-off-by: Paul E. McKenney +Reviewed-by: Mathieu Desnoyers +Cc: Boqun Feng +Cc: Matthew Wilcox +Cc: Thomas Gleixner +Signed-off-by: Sasha Levin +--- + include/linux/rcupdate.h | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/include/linux/rcupdate.h b/include/linux/rcupdate.h +index 1e937a32da33d..13bddb841ceb1 100644 +--- a/include/linux/rcupdate.h ++++ b/include/linux/rcupdate.h +@@ -313,11 +313,18 @@ static inline int rcu_read_lock_any_held(void) + * RCU_LOCKDEP_WARN - emit lockdep splat if specified condition is met + * @c: condition to check + * @s: informative message ++ * ++ * This checks debug_lockdep_rcu_enabled() before checking (c) to ++ * prevent early boot splats due to lockdep not yet being initialized, ++ * and rechecks it after checking (c) to prevent false-positive splats ++ * due to races with lockdep being disabled. See commit 3066820034b5dd ++ * ("rcu: Reject RCU_LOCKDEP_WARN() false positives") for more detail. + */ + #define RCU_LOCKDEP_WARN(c, s) \ + do { \ + static bool __section(".data.unlikely") __warned; \ +- if ((c) && debug_lockdep_rcu_enabled() && !__warned) { \ ++ if (debug_lockdep_rcu_enabled() && (c) && \ ++ debug_lockdep_rcu_enabled() && !__warned) { \ + __warned = true; \ + lockdep_rcu_suspicious(__FILE__, __LINE__, s); \ + } \ +-- +2.39.2 + diff --git a/queue-5.15/rcu-suppress-smp_processor_id-complaint-in-synchroni.patch b/queue-5.15/rcu-suppress-smp_processor_id-complaint-in-synchroni.patch new file mode 100644 index 00000000000..dd60bf3f27c --- /dev/null +++ b/queue-5.15/rcu-suppress-smp_processor_id-complaint-in-synchroni.patch @@ -0,0 +1,43 @@ +From b7802e058ddfce18651e8f5981078fd598e02f74 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Dec 2022 15:55:48 -0800 +Subject: rcu: Suppress smp_processor_id() complaint in + synchronize_rcu_expedited_wait() + +From: Paul E. McKenney + +[ Upstream commit 2d7f00b2f01301d6e41fd4a28030dab0442265be ] + +The normal grace period's RCU CPU stall warnings are invoked from the +scheduling-clock interrupt handler, and can thus invoke smp_processor_id() +with impunity, which allows them to directly invoke dump_cpu_task(). +In contrast, the expedited grace period's RCU CPU stall warnings are +invoked from process context, which causes the dump_cpu_task() function's +calls to smp_processor_id() to complain bitterly in debug kernels. + +This commit therefore causes synchronize_rcu_expedited_wait() to disable +preemption around its call to dump_cpu_task(). + +Signed-off-by: Paul E. McKenney +Signed-off-by: Sasha Levin +--- + kernel/rcu/tree_exp.h | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/kernel/rcu/tree_exp.h b/kernel/rcu/tree_exp.h +index 16f94118ca34b..f9fb2793b0193 100644 +--- a/kernel/rcu/tree_exp.h ++++ b/kernel/rcu/tree_exp.h +@@ -565,7 +565,9 @@ static void synchronize_rcu_expedited_wait(void) + mask = leaf_node_cpu_bit(rnp, cpu); + if (!(READ_ONCE(rnp->expmask) & mask)) + continue; ++ preempt_disable(); // For smp_processor_id() in dump_cpu_task(). + dump_cpu_task(cpu); ++ preempt_enable(); + } + } + jiffies_stall = 3 * rcu_jiffies_till_stall_check() + 3; +-- +2.39.2 + diff --git a/queue-5.15/rcu-tasks-fix-synchronize_rcu_tasks-vs-zap_pid_ns_pr.patch b/queue-5.15/rcu-tasks-fix-synchronize_rcu_tasks-vs-zap_pid_ns_pr.patch new file mode 100644 index 00000000000..f1a84d64d2e --- /dev/null +++ b/queue-5.15/rcu-tasks-fix-synchronize_rcu_tasks-vs-zap_pid_ns_pr.patch @@ -0,0 +1,155 @@ +From 714e9855a4f036a4190c80024bb19870a371d9ed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Nov 2022 14:55:00 +0100 +Subject: rcu-tasks: Fix synchronize_rcu_tasks() VS zap_pid_ns_processes() + +From: Frederic Weisbecker + +[ Upstream commit 28319d6dc5e2ffefa452c2377dd0f71621b5bff0 ] + +RCU Tasks and PID-namespace unshare can interact in do_exit() in a +complicated circular dependency: + +1) TASK A calls unshare(CLONE_NEWPID), this creates a new PID namespace + that every subsequent child of TASK A will belong to. But TASK A + doesn't itself belong to that new PID namespace. + +2) TASK A forks() and creates TASK B. TASK A stays attached to its PID + namespace (let's say PID_NS1) and TASK B is the first task belonging + to the new PID namespace created by unshare() (let's call it PID_NS2). + +3) Since TASK B is the first task attached to PID_NS2, it becomes the + PID_NS2 child reaper. + +4) TASK A forks() again and creates TASK C which get attached to PID_NS2. + Note how TASK C has TASK A as a parent (belonging to PID_NS1) but has + TASK B (belonging to PID_NS2) as a pid_namespace child_reaper. + +5) TASK B exits and since it is the child reaper for PID_NS2, it has to + kill all other tasks attached to PID_NS2, and wait for all of them to + die before getting reaped itself (zap_pid_ns_process()). + +6) TASK A calls synchronize_rcu_tasks() which leads to + synchronize_srcu(&tasks_rcu_exit_srcu). + +7) TASK B is waiting for TASK C to get reaped. But TASK B is under a + tasks_rcu_exit_srcu SRCU critical section (exit_notify() is between + exit_tasks_rcu_start() and exit_tasks_rcu_finish()), blocking TASK A. + +8) TASK C exits and since TASK A is its parent, it waits for it to reap + TASK C, but it can't because TASK A waits for TASK B that waits for + TASK C. + +Pid_namespace semantics can hardly be changed at this point. But the +coverage of tasks_rcu_exit_srcu can be reduced instead. + +The current task is assumed not to be concurrently reapable at this +stage of exit_notify() and therefore tasks_rcu_exit_srcu can be +temporarily relaxed without breaking its constraints, providing a way +out of the deadlock scenario. + +[ paulmck: Fix build failure by adding additional declaration. ] + +Fixes: 3f95aa81d265 ("rcu: Make TASKS_RCU handle tasks that are almost done exiting") +Reported-by: Pengfei Xu +Suggested-by: Boqun Feng +Suggested-by: Neeraj Upadhyay +Suggested-by: Paul E. McKenney +Cc: Oleg Nesterov +Cc: Lai Jiangshan +Cc: Eric W . Biederman +Signed-off-by: Frederic Weisbecker +Signed-off-by: Paul E. McKenney +Signed-off-by: Sasha Levin +--- + include/linux/rcupdate.h | 2 ++ + kernel/pid_namespace.c | 17 +++++++++++++++++ + kernel/rcu/tasks.h | 15 +++++++++++++-- + 3 files changed, 32 insertions(+), 2 deletions(-) + +diff --git a/include/linux/rcupdate.h b/include/linux/rcupdate.h +index 434d12fe2d4f5..1e937a32da33d 100644 +--- a/include/linux/rcupdate.h ++++ b/include/linux/rcupdate.h +@@ -193,6 +193,7 @@ void synchronize_rcu_tasks_rude(void); + + #define rcu_note_voluntary_context_switch(t) rcu_tasks_qs(t, false) + void exit_tasks_rcu_start(void); ++void exit_tasks_rcu_stop(void); + void exit_tasks_rcu_finish(void); + #else /* #ifdef CONFIG_TASKS_RCU_GENERIC */ + #define rcu_tasks_qs(t, preempt) do { } while (0) +@@ -200,6 +201,7 @@ void exit_tasks_rcu_finish(void); + #define call_rcu_tasks call_rcu + #define synchronize_rcu_tasks synchronize_rcu + static inline void exit_tasks_rcu_start(void) { } ++static inline void exit_tasks_rcu_stop(void) { } + static inline void exit_tasks_rcu_finish(void) { } + #endif /* #else #ifdef CONFIG_TASKS_RCU_GENERIC */ + +diff --git a/kernel/pid_namespace.c b/kernel/pid_namespace.c +index a46a3723bc662..259fc4ca0d9cc 100644 +--- a/kernel/pid_namespace.c ++++ b/kernel/pid_namespace.c +@@ -244,7 +244,24 @@ void zap_pid_ns_processes(struct pid_namespace *pid_ns) + set_current_state(TASK_INTERRUPTIBLE); + if (pid_ns->pid_allocated == init_pids) + break; ++ /* ++ * Release tasks_rcu_exit_srcu to avoid following deadlock: ++ * ++ * 1) TASK A unshare(CLONE_NEWPID) ++ * 2) TASK A fork() twice -> TASK B (child reaper for new ns) ++ * and TASK C ++ * 3) TASK B exits, kills TASK C, waits for TASK A to reap it ++ * 4) TASK A calls synchronize_rcu_tasks() ++ * -> synchronize_srcu(tasks_rcu_exit_srcu) ++ * 5) *DEADLOCK* ++ * ++ * It is considered safe to release tasks_rcu_exit_srcu here ++ * because we assume the current task can not be concurrently ++ * reaped at this point. ++ */ ++ exit_tasks_rcu_stop(); + schedule(); ++ exit_tasks_rcu_start(); + } + __set_current_state(TASK_RUNNING); + +diff --git a/kernel/rcu/tasks.h b/kernel/rcu/tasks.h +index 2408ca633872a..5533e3106ba01 100644 +--- a/kernel/rcu/tasks.h ++++ b/kernel/rcu/tasks.h +@@ -640,16 +640,27 @@ void exit_tasks_rcu_start(void) __acquires(&tasks_rcu_exit_srcu) + * task is exiting and may be removed from the tasklist. See + * corresponding synchronize_srcu() for further details. + */ +-void exit_tasks_rcu_finish(void) __releases(&tasks_rcu_exit_srcu) ++void exit_tasks_rcu_stop(void) __releases(&tasks_rcu_exit_srcu) + { + struct task_struct *t = current; + + __srcu_read_unlock(&tasks_rcu_exit_srcu, t->rcu_tasks_idx); +- exit_tasks_rcu_finish_trace(t); ++} ++ ++/* ++ * Contribute to protect against tasklist scan blind spot while the ++ * task is exiting and may be removed from the tasklist. See ++ * corresponding synchronize_srcu() for further details. ++ */ ++void exit_tasks_rcu_finish(void) ++{ ++ exit_tasks_rcu_stop(); ++ exit_tasks_rcu_finish_trace(current); + } + + #else /* #ifdef CONFIG_TASKS_RCU */ + void exit_tasks_rcu_start(void) { } ++void exit_tasks_rcu_stop(void) { } + void exit_tasks_rcu_finish(void) { exit_tasks_rcu_finish_trace(current); } + #endif /* #else #ifdef CONFIG_TASKS_RCU */ + +-- +2.39.2 + diff --git a/queue-5.15/rcu-tasks-improve-comments-explaining-tasks_rcu_exit.patch b/queue-5.15/rcu-tasks-improve-comments-explaining-tasks_rcu_exit.patch new file mode 100644 index 00000000000..404ac66e702 --- /dev/null +++ b/queue-5.15/rcu-tasks-improve-comments-explaining-tasks_rcu_exit.patch @@ -0,0 +1,99 @@ +From aa4e9355c0f4ef59b47bec1609a7255367203f1e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Nov 2022 14:54:58 +0100 +Subject: rcu-tasks: Improve comments explaining tasks_rcu_exit_srcu purpose + +From: Frederic Weisbecker + +[ Upstream commit e4e1e8089c5fd948da12cb9f4adc93821036945f ] + +Make sure we don't need to look again into the depths of git blame in +order not to miss a subtle part about how rcu-tasks is dealing with +exiting tasks. + +Suggested-by: Boqun Feng +Suggested-by: Neeraj Upadhyay +Suggested-by: Paul E. McKenney +Cc: Oleg Nesterov +Cc: Lai Jiangshan +Cc: Eric W. Biederman +Signed-off-by: Frederic Weisbecker +Signed-off-by: Paul E. McKenney +Stable-dep-of: 28319d6dc5e2 ("rcu-tasks: Fix synchronize_rcu_tasks() VS zap_pid_ns_processes()") +Signed-off-by: Sasha Levin +--- + kernel/rcu/tasks.h | 37 +++++++++++++++++++++++++++++-------- + 1 file changed, 29 insertions(+), 8 deletions(-) + +diff --git a/kernel/rcu/tasks.h b/kernel/rcu/tasks.h +index 4bd07cc3c0eab..d937bacf27b68 100644 +--- a/kernel/rcu/tasks.h ++++ b/kernel/rcu/tasks.h +@@ -451,11 +451,21 @@ static void rcu_tasks_pertask(struct task_struct *t, struct list_head *hop) + static void rcu_tasks_postscan(struct list_head *hop) + { + /* +- * Wait for tasks that are in the process of exiting. This +- * does only part of the job, ensuring that all tasks that were +- * previously exiting reach the point where they have disabled +- * preemption, allowing the later synchronize_rcu() to finish +- * the job. ++ * Exiting tasks may escape the tasklist scan. Those are vulnerable ++ * until their final schedule() with TASK_DEAD state. To cope with ++ * this, divide the fragile exit path part in two intersecting ++ * read side critical sections: ++ * ++ * 1) An _SRCU_ read side starting before calling exit_notify(), ++ * which may remove the task from the tasklist, and ending after ++ * the final preempt_disable() call in do_exit(). ++ * ++ * 2) An _RCU_ read side starting with the final preempt_disable() ++ * call in do_exit() and ending with the final call to schedule() ++ * with TASK_DEAD state. ++ * ++ * This handles the part 1). And postgp will handle part 2) with a ++ * call to synchronize_rcu(). + */ + synchronize_srcu(&tasks_rcu_exit_srcu); + } +@@ -522,7 +532,10 @@ static void rcu_tasks_postgp(struct rcu_tasks *rtp) + * + * In addition, this synchronize_rcu() waits for exiting tasks + * to complete their final preempt_disable() region of execution, +- * cleaning up after the synchronize_srcu() above. ++ * cleaning up after synchronize_srcu(&tasks_rcu_exit_srcu), ++ * enforcing the whole region before tasklist removal until ++ * the final schedule() with TASK_DEAD state to be an RCU TASKS ++ * read side critical section. + */ + synchronize_rcu(); + } +@@ -612,7 +625,11 @@ void show_rcu_tasks_classic_gp_kthread(void) + EXPORT_SYMBOL_GPL(show_rcu_tasks_classic_gp_kthread); + #endif // !defined(CONFIG_TINY_RCU) + +-/* Do the srcu_read_lock() for the above synchronize_srcu(). */ ++/* ++ * Contribute to protect against tasklist scan blind spot while the ++ * task is exiting and may be removed from the tasklist. See ++ * corresponding synchronize_srcu() for further details. ++ */ + void exit_tasks_rcu_start(void) __acquires(&tasks_rcu_exit_srcu) + { + preempt_disable(); +@@ -620,7 +637,11 @@ void exit_tasks_rcu_start(void) __acquires(&tasks_rcu_exit_srcu) + preempt_enable(); + } + +-/* Do the srcu_read_unlock() for the above synchronize_srcu(). */ ++/* ++ * Contribute to protect against tasklist scan blind spot while the ++ * task is exiting and may be removed from the tasklist. See ++ * corresponding synchronize_srcu() for further details. ++ */ + void exit_tasks_rcu_finish(void) __releases(&tasks_rcu_exit_srcu) + { + struct task_struct *t = current; +-- +2.39.2 + diff --git a/queue-5.15/rcu-tasks-make-rude-rcu-tasks-work-well-with-cpu-hot.patch b/queue-5.15/rcu-tasks-make-rude-rcu-tasks-work-well-with-cpu-hot.patch new file mode 100644 index 00000000000..5bda5b3f9c1 --- /dev/null +++ b/queue-5.15/rcu-tasks-make-rude-rcu-tasks-work-well-with-cpu-hot.patch @@ -0,0 +1,108 @@ +From a1c023d0aa96608f7beb327c95a57a38f0064c18 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Dec 2022 07:45:33 +0800 +Subject: rcu-tasks: Make rude RCU-Tasks work well with CPU hotplug + +From: Zqiang + +[ Upstream commit ea5c8987fef20a8cca07e428aa28bc64649c5104 ] + +The synchronize_rcu_tasks_rude() function invokes rcu_tasks_rude_wait_gp() +to wait one rude RCU-tasks grace period. The rcu_tasks_rude_wait_gp() +function in turn checks if there is only a single online CPU. If so, it +will immediately return, because a call to synchronize_rcu_tasks_rude() +is by definition a grace period on a single-CPU system. (We could +have blocked!) + +Unfortunately, this check uses num_online_cpus() without synchronization, +which can result in too-short grace periods. To see this, consider the +following scenario: + + CPU0 CPU1 (going offline) + migration/1 task: + cpu_stopper_thread + -> take_cpu_down + -> _cpu_disable + (dec __num_online_cpus) + ->cpuhp_invoke_callback + preempt_disable + access old_data0 + task1 + del old_data0 ..... + synchronize_rcu_tasks_rude() + task1 schedule out + .... + task2 schedule in + rcu_tasks_rude_wait_gp() + ->__num_online_cpus == 1 + ->return + .... + task1 schedule in + ->free old_data0 + preempt_enable + +When CPU1 decrements __num_online_cpus, its value becomes 1. However, +CPU1 has not finished going offline, and will take one last trip through +the scheduler and the idle loop before it actually stops executing +instructions. Because synchronize_rcu_tasks_rude() is mostly used for +tracing, and because both the scheduler and the idle loop can be traced, +this means that CPU0's prematurely ended grace period might disrupt the +tracing on CPU1. Given that this disruption might include CPU1 executing +instructions in memory that was just now freed (and maybe reallocated), +this is a matter of some concern. + +This commit therefore removes that problematic single-CPU check from the +rcu_tasks_rude_wait_gp() function. This dispenses with the single-CPU +optimization, but there is no evidence indicating that this optimization +is important. In addition, synchronize_rcu_tasks_generic() contains a +similar optimization (albeit only for early boot), which also splats. +(As in exactly why are you invoking synchronize_rcu_tasks_rude() so +early in boot, anyway???) + +It is OK for the synchronize_rcu_tasks_rude() function's check to be +unsynchronized because the only times that this check can evaluate to +true is when there is only a single CPU running with preemption +disabled. + +While in the area, this commit also fixes a minor bug in which a +call to synchronize_rcu_tasks_rude() would instead be attributed to +synchronize_rcu_tasks(). + +[ paulmck: Add "synchronize_" prefix and "()" suffix. ] + +Signed-off-by: Zqiang +Signed-off-by: Paul E. McKenney +Signed-off-by: Sasha Levin +--- + kernel/rcu/tasks.h | 8 +++----- + 1 file changed, 3 insertions(+), 5 deletions(-) + +diff --git a/kernel/rcu/tasks.h b/kernel/rcu/tasks.h +index 5533e3106ba01..94b8ee84bc78a 100644 +--- a/kernel/rcu/tasks.h ++++ b/kernel/rcu/tasks.h +@@ -171,8 +171,9 @@ static void call_rcu_tasks_generic(struct rcu_head *rhp, rcu_callback_t func, + static void synchronize_rcu_tasks_generic(struct rcu_tasks *rtp) + { + /* Complain if the scheduler has not started. */ +- WARN_ONCE(rcu_scheduler_active == RCU_SCHEDULER_INACTIVE, +- "synchronize_rcu_tasks called too soon"); ++ if (WARN_ONCE(rcu_scheduler_active == RCU_SCHEDULER_INACTIVE, ++ "synchronize_%s() called too soon", rtp->name)) ++ return; + + /* Wait for the grace period. */ + wait_rcu_gp(rtp->call_func); +@@ -688,9 +689,6 @@ static void rcu_tasks_be_rude(struct work_struct *work) + // Wait for one rude RCU-tasks grace period. + static void rcu_tasks_rude_wait_gp(struct rcu_tasks *rtp) + { +- if (num_online_cpus() <= 1) +- return; // Fastpath for only one CPU. +- + rtp->n_ipis += cpumask_weight(cpu_online_mask); + schedule_on_each_cpu(rcu_tasks_be_rude); + } +-- +2.39.2 + diff --git a/queue-5.15/rcu-tasks-remove-preemption-disablement-around-srcu_.patch b/queue-5.15/rcu-tasks-remove-preemption-disablement-around-srcu_.patch new file mode 100644 index 00000000000..236562af385 --- /dev/null +++ b/queue-5.15/rcu-tasks-remove-preemption-disablement-around-srcu_.patch @@ -0,0 +1,61 @@ +From e8bc19fe6e6cbb0be238342e2cce37ea28536691 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Nov 2022 14:54:59 +0100 +Subject: rcu-tasks: Remove preemption disablement around srcu_read_[un]lock() + calls + +From: Frederic Weisbecker + +[ Upstream commit 44757092958bdd749775022f915b7ac974384c2a ] + +Ever since the following commit: + + 5a41344a3d83 ("srcu: Simplify __srcu_read_unlock() via this_cpu_dec()") + +SRCU doesn't rely anymore on preemption to be disabled in order to +modify the per-CPU counter. And even then it used to be done from the API +itself. + +Therefore and after checking further, it appears to be safe to remove +the preemption disablement around __srcu_read_[un]lock() in +exit_tasks_rcu_start() and exit_tasks_rcu_finish() + +Suggested-by: Boqun Feng +Suggested-by: Paul E. McKenney +Suggested-by: Neeraj Upadhyay +Cc: Lai Jiangshan +Signed-off-by: Frederic Weisbecker +Signed-off-by: Paul E. McKenney +Stable-dep-of: 28319d6dc5e2 ("rcu-tasks: Fix synchronize_rcu_tasks() VS zap_pid_ns_processes()") +Signed-off-by: Sasha Levin +--- + kernel/rcu/tasks.h | 4 ---- + 1 file changed, 4 deletions(-) + +diff --git a/kernel/rcu/tasks.h b/kernel/rcu/tasks.h +index d937bacf27b68..2408ca633872a 100644 +--- a/kernel/rcu/tasks.h ++++ b/kernel/rcu/tasks.h +@@ -632,9 +632,7 @@ EXPORT_SYMBOL_GPL(show_rcu_tasks_classic_gp_kthread); + */ + void exit_tasks_rcu_start(void) __acquires(&tasks_rcu_exit_srcu) + { +- preempt_disable(); + current->rcu_tasks_idx = __srcu_read_lock(&tasks_rcu_exit_srcu); +- preempt_enable(); + } + + /* +@@ -646,9 +644,7 @@ void exit_tasks_rcu_finish(void) __releases(&tasks_rcu_exit_srcu) + { + struct task_struct *t = current; + +- preempt_disable(); + __srcu_read_unlock(&tasks_rcu_exit_srcu, t->rcu_tasks_idx); +- preempt_enable(); + exit_tasks_rcu_finish_trace(t); + } + +-- +2.39.2 + diff --git a/queue-5.15/rdma-cxgb4-add-null-ptr-check-after-ip_dev_find.patch b/queue-5.15/rdma-cxgb4-add-null-ptr-check-after-ip_dev_find.patch new file mode 100644 index 00000000000..6558f3866ad --- /dev/null +++ b/queue-5.15/rdma-cxgb4-add-null-ptr-check-after-ip_dev_find.patch @@ -0,0 +1,43 @@ +From ce0fd898becaca98892a837c76a3f687138cca7f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Feb 2023 09:21:03 -0800 +Subject: RDMA/cxgb4: add null-ptr-check after ip_dev_find() + +From: Nikita Zhandarovich + +[ Upstream commit ef42520240aacfc0d46c8d780c051d135a8dc9b7 ] + +ip_dev_find() may return NULL and assign it to pdev which is +dereferenced later. +Fix this by checking the return value of ip_dev_find() for NULL +similar to the way it is done with other instances of said function. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 1cab775c3e75 ("RDMA/cxgb4: Fix LE hash collision bug for passive open connection") +Signed-off-by: Nikita Zhandarovich +Link: https://lore.kernel.org/r/20230201172103.17261-1-n.zhandarovich@fintech.ru +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/cxgb4/cm.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c +index 291471d12197f..56f46a16e6575 100644 +--- a/drivers/infiniband/hw/cxgb4/cm.c ++++ b/drivers/infiniband/hw/cxgb4/cm.c +@@ -4150,6 +4150,10 @@ static int rx_pkt(struct c4iw_dev *dev, struct sk_buff *skb) + + if (neigh->dev->flags & IFF_LOOPBACK) { + pdev = ip_dev_find(&init_net, iph->daddr); ++ if (!pdev) { ++ pr_err("%s - failed to find device!\n", __func__); ++ goto free_dst; ++ } + e = cxgb4_l2t_get(dev->rdev.lldi.l2t, neigh, + pdev, 0); + pi = (struct port_info *)netdev_priv(pdev); +-- +2.39.2 + diff --git a/queue-5.15/rdma-cxgb4-fix-potential-null-ptr-deref-in-pass_esta.patch b/queue-5.15/rdma-cxgb4-fix-potential-null-ptr-deref-in-pass_esta.patch new file mode 100644 index 00000000000..6699ed45610 --- /dev/null +++ b/queue-5.15/rdma-cxgb4-fix-potential-null-ptr-deref-in-pass_esta.patch @@ -0,0 +1,41 @@ +From 1bea08755e7f4fe2338f764279d96108e32b9a7a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Feb 2023 10:48:50 -0800 +Subject: RDMA/cxgb4: Fix potential null-ptr-deref in pass_establish() + +From: Nikita Zhandarovich + +[ Upstream commit 283861a4c52c1ea4df3dd1b6fc75a50796ce3524 ] + +If get_ep_from_tid() fails to lookup non-NULL value for ep, ep is +dereferenced later regardless of whether it is empty. +This patch adds a simple sanity check to fix the issue. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 944661dd97f4 ("RDMA/iw_cxgb4: atomically lookup ep and get a reference") +Signed-off-by: Nikita Zhandarovich +Link: https://lore.kernel.org/r/20230202184850.29882-1-n.zhandarovich@fintech.ru +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/cxgb4/cm.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c +index 56f46a16e6575..a3e4913904b75 100644 +--- a/drivers/infiniband/hw/cxgb4/cm.c ++++ b/drivers/infiniband/hw/cxgb4/cm.c +@@ -2682,6 +2682,9 @@ static int pass_establish(struct c4iw_dev *dev, struct sk_buff *skb) + u16 tcp_opt = ntohs(req->tcp_opt); + + ep = get_ep_from_tid(dev, tid); ++ if (!ep) ++ return 0; ++ + pr_debug("ep %p tid %u\n", ep, ep->hwtid); + ep->snd_seq = be32_to_cpu(req->snd_isn); + ep->rcv_seq = be32_to_cpu(req->rcv_isn); +-- +2.39.2 + diff --git a/queue-5.15/rdma-irdma-cap-msix-used-to-online-cpus-1.patch b/queue-5.15/rdma-irdma-cap-msix-used-to-online-cpus-1.patch new file mode 100644 index 00000000000..8965c2d164b --- /dev/null +++ b/queue-5.15/rdma-irdma-cap-msix-used-to-online-cpus-1.patch @@ -0,0 +1,96 @@ +From 44be2f3b4be8cd90e36cc46d15b0fb7097fe64bb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Feb 2023 14:19:38 -0600 +Subject: RDMA/irdma: Cap MSIX used to online CPUs + 1 + +From: Mustafa Ismail + +[ Upstream commit 9cd9842c46996ef62173c36619c746f57416bcb0 ] + +The irdma driver can use a maximum number of msix vectors equal +to num_online_cpus() + 1 and the kernel warning stack below is shown +if that number is exceeded. + +The kernel throws a warning as the driver tries to update the affinity +hint with a CPU mask greater than the max CPU IDs. Fix this by capping +the MSIX vectors to num_online_cpus() + 1. + + WARNING: CPU: 7 PID: 23655 at include/linux/cpumask.h:106 irdma_cfg_ceq_vector+0x34c/0x3f0 [irdma] + RIP: 0010:irdma_cfg_ceq_vector+0x34c/0x3f0 [irdma] + Call Trace: + irdma_rt_init_hw+0xa62/0x1290 [irdma] + ? irdma_alloc_local_mac_entry+0x1a0/0x1a0 [irdma] + ? __is_kernel_percpu_address+0x63/0x310 + ? rcu_read_lock_held_common+0xe/0xb0 + ? irdma_lan_unregister_qset+0x280/0x280 [irdma] + ? irdma_request_reset+0x80/0x80 [irdma] + ? ice_get_qos_params+0x84/0x390 [ice] + irdma_probe+0xa40/0xfc0 [irdma] + ? rcu_read_lock_bh_held+0xd0/0xd0 + ? irdma_remove+0x140/0x140 [irdma] + ? rcu_read_lock_sched_held+0x62/0xe0 + ? down_write+0x187/0x3d0 + ? auxiliary_match_id+0xf0/0x1a0 + ? irdma_remove+0x140/0x140 [irdma] + auxiliary_bus_probe+0xa6/0x100 + __driver_probe_device+0x4a4/0xd50 + ? __device_attach_driver+0x2c0/0x2c0 + driver_probe_device+0x4a/0x110 + __driver_attach+0x1aa/0x350 + bus_for_each_dev+0x11d/0x1b0 + ? subsys_dev_iter_init+0xe0/0xe0 + bus_add_driver+0x3b1/0x610 + driver_register+0x18e/0x410 + ? 0xffffffffc0b88000 + irdma_init_module+0x50/0xaa [irdma] + do_one_initcall+0x103/0x5f0 + ? perf_trace_initcall_level+0x420/0x420 + ? do_init_module+0x4e/0x700 + ? __kasan_kmalloc+0x7d/0xa0 + ? kmem_cache_alloc_trace+0x188/0x2b0 + ? kasan_unpoison+0x21/0x50 + do_init_module+0x1d1/0x700 + load_module+0x3867/0x5260 + ? layout_and_allocate+0x3990/0x3990 + ? rcu_read_lock_held_common+0xe/0xb0 + ? rcu_read_lock_sched_held+0x62/0xe0 + ? rcu_read_lock_bh_held+0xd0/0xd0 + ? __vmalloc_node_range+0x46b/0x890 + ? lock_release+0x5c8/0xba0 + ? alloc_vm_area+0x120/0x120 + ? selinux_kernel_module_from_file+0x2a5/0x300 + ? __inode_security_revalidate+0xf0/0xf0 + ? __do_sys_init_module+0x1db/0x260 + __do_sys_init_module+0x1db/0x260 + ? load_module+0x5260/0x5260 + ? do_syscall_64+0x22/0x450 + do_syscall_64+0xa5/0x450 + entry_SYSCALL_64_after_hwframe+0x66/0xdb + +Fixes: 44d9e52977a1 ("RDMA/irdma: Implement device initialization definitions") +Signed-off-by: Mustafa Ismail +Signed-off-by: Shiraz Saleem +Signed-off-by: Sindhu Devale +Link: https://lore.kernel.org/r/20230207201938.1329-1-sindhu.devale@intel.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/irdma/hw.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/infiniband/hw/irdma/hw.c b/drivers/infiniband/hw/irdma/hw.c +index c14f19cff5343..b918f80d2e2c6 100644 +--- a/drivers/infiniband/hw/irdma/hw.c ++++ b/drivers/infiniband/hw/irdma/hw.c +@@ -483,6 +483,8 @@ static enum irdma_status_code irdma_save_msix_info(struct irdma_pci_f *rf) + iw_qvlist->num_vectors = rf->msix_count; + if (rf->msix_count <= num_online_cpus()) + rf->msix_shared = true; ++ else if (rf->msix_count > num_online_cpus() + 1) ++ rf->msix_count = num_online_cpus() + 1; + + pmsix = rf->msix_entries; + for (i = 0, ceq_idx = 0; i < rf->msix_count; i++, iw_qvinfo++) { +-- +2.39.2 + diff --git a/queue-5.15/rdma-siw-fix-user-page-pinning-accounting.patch b/queue-5.15/rdma-siw-fix-user-page-pinning-accounting.patch new file mode 100644 index 00000000000..7c9773f9e42 --- /dev/null +++ b/queue-5.15/rdma-siw-fix-user-page-pinning-accounting.patch @@ -0,0 +1,89 @@ +From bd3e40b047e7434cefcce43165bac16403389b0d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Feb 2023 11:10:00 +0100 +Subject: RDMA/siw: Fix user page pinning accounting + +From: Bernard Metzler + +[ Upstream commit 65a8fc30fb6722fc25adec6d7dd5b53b0bb85820 ] + +To avoid racing with other user memory reservations, immediately +account full amount of pages to be pinned. + +Fixes: 2251334dcac9 ("rdma/siw: application buffer management") +Reported-by: Jason Gunthorpe +Suggested-by: Alistair Popple +Reviewed-by: Alistair Popple +Signed-off-by: Bernard Metzler +Link: https://lore.kernel.org/r/20230202101000.402990-1-bmt@zurich.ibm.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/siw/siw_mem.c | 23 ++++++++++++----------- + 1 file changed, 12 insertions(+), 11 deletions(-) + +diff --git a/drivers/infiniband/sw/siw/siw_mem.c b/drivers/infiniband/sw/siw/siw_mem.c +index b2b33dd3b4fa1..f51ab2ccf1511 100644 +--- a/drivers/infiniband/sw/siw/siw_mem.c ++++ b/drivers/infiniband/sw/siw/siw_mem.c +@@ -398,7 +398,7 @@ struct siw_umem *siw_umem_get(u64 start, u64 len, bool writable) + + mlock_limit = rlimit(RLIMIT_MEMLOCK) >> PAGE_SHIFT; + +- if (num_pages + atomic64_read(&mm_s->pinned_vm) > mlock_limit) { ++ if (atomic64_add_return(num_pages, &mm_s->pinned_vm) > mlock_limit) { + rv = -ENOMEM; + goto out_sem_up; + } +@@ -411,30 +411,27 @@ struct siw_umem *siw_umem_get(u64 start, u64 len, bool writable) + goto out_sem_up; + } + for (i = 0; num_pages; i++) { +- int got, nents = min_t(int, num_pages, PAGES_PER_CHUNK); +- +- umem->page_chunk[i].plist = ++ int nents = min_t(int, num_pages, PAGES_PER_CHUNK); ++ struct page **plist = + kcalloc(nents, sizeof(struct page *), GFP_KERNEL); +- if (!umem->page_chunk[i].plist) { ++ ++ if (!plist) { + rv = -ENOMEM; + goto out_sem_up; + } +- got = 0; ++ umem->page_chunk[i].plist = plist; + while (nents) { +- struct page **plist = &umem->page_chunk[i].plist[got]; +- + rv = pin_user_pages(first_page_va, nents, foll_flags, + plist, NULL); + if (rv < 0) + goto out_sem_up; + + umem->num_pages += rv; +- atomic64_add(rv, &mm_s->pinned_vm); + first_page_va += rv * PAGE_SIZE; ++ plist += rv; + nents -= rv; +- got += rv; ++ num_pages -= rv; + } +- num_pages -= got; + } + out_sem_up: + mmap_read_unlock(mm_s); +@@ -442,6 +439,10 @@ struct siw_umem *siw_umem_get(u64 start, u64 len, bool writable) + if (rv > 0) + return umem; + ++ /* Adjust accounting for pages not pinned */ ++ if (num_pages) ++ atomic64_sub(num_pages, &mm_s->pinned_vm); ++ + siw_umem_release(umem, false); + + return ERR_PTR(rv); +-- +2.39.2 + diff --git a/queue-5.15/rdma-siw-remove-foll_force-usage.patch b/queue-5.15/rdma-siw-remove-foll_force-usage.patch new file mode 100644 index 00000000000..96cd0ee3b40 --- /dev/null +++ b/queue-5.15/rdma-siw-remove-foll_force-usage.patch @@ -0,0 +1,68 @@ +From dba305c6ba7aebc95f1023375438ad7d70353453 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Nov 2022 11:26:51 +0100 +Subject: RDMA/siw: remove FOLL_FORCE usage + +From: David Hildenbrand + +[ Upstream commit 129e636fe9837fcfea68bfd368a07548d9880726 ] + +GUP now supports reliable R/O long-term pinning in COW mappings, such +that we break COW early. MAP_SHARED VMAs only use the shared zeropage so +far in one corner case (DAXFS file with holes), which can be ignored +because GUP does not support long-term pinning in fsdax (see +check_vma_flags()). + +Consequently, FOLL_FORCE | FOLL_WRITE | FOLL_LONGTERM is no longer required +for reliable R/O long-term pinning: FOLL_LONGTERM is sufficient. So stop +using FOLL_FORCE, which is really only for ptrace access. + +Link: https://lkml.kernel.org/r/20221116102659.70287-13-david@redhat.com +Signed-off-by: David Hildenbrand +Reviewed-by: Jason Gunthorpe +Cc: Bernard Metzler +Cc: Leon Romanovsky +Signed-off-by: Andrew Morton +Stable-dep-of: 65a8fc30fb67 ("RDMA/siw: Fix user page pinning accounting") +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/siw/siw_mem.c | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +diff --git a/drivers/infiniband/sw/siw/siw_mem.c b/drivers/infiniband/sw/siw/siw_mem.c +index 61c17db70d658..b2b33dd3b4fa1 100644 +--- a/drivers/infiniband/sw/siw/siw_mem.c ++++ b/drivers/infiniband/sw/siw/siw_mem.c +@@ -368,7 +368,7 @@ struct siw_umem *siw_umem_get(u64 start, u64 len, bool writable) + struct mm_struct *mm_s; + u64 first_page_va; + unsigned long mlock_limit; +- unsigned int foll_flags = FOLL_WRITE; ++ unsigned int foll_flags = FOLL_LONGTERM; + int num_pages, num_chunks, i, rv = 0; + + if (!can_do_mlock()) +@@ -391,8 +391,8 @@ struct siw_umem *siw_umem_get(u64 start, u64 len, bool writable) + + mmgrab(mm_s); + +- if (!writable) +- foll_flags |= FOLL_FORCE; ++ if (writable) ++ foll_flags |= FOLL_WRITE; + + mmap_read_lock(mm_s); + +@@ -423,8 +423,7 @@ struct siw_umem *siw_umem_get(u64 start, u64 len, bool writable) + while (nents) { + struct page **plist = &umem->page_chunk[i].plist[got]; + +- rv = pin_user_pages(first_page_va, nents, +- foll_flags | FOLL_LONGTERM, ++ rv = pin_user_pages(first_page_va, nents, foll_flags, + plist, NULL); + if (rv < 0) + goto out_sem_up; +-- +2.39.2 + diff --git a/queue-5.15/rds-rds_rm_zerocopy_callback-correct-order-for-list_.patch b/queue-5.15/rds-rds_rm_zerocopy_callback-correct-order-for-list_.patch new file mode 100644 index 00000000000..e40d7a28b14 --- /dev/null +++ b/queue-5.15/rds-rds_rm_zerocopy_callback-correct-order-for-list_.patch @@ -0,0 +1,38 @@ +From 12ac7335c077164a766a26fbb8e471c042060b4c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Feb 2023 12:26:23 +0000 +Subject: rds: rds_rm_zerocopy_callback() correct order for list_add_tail() + +From: Pietro Borrello + +[ Upstream commit 68762148d1b011d47bc2ceed7321739b5aea1e63 ] + +rds_rm_zerocopy_callback() uses list_add_tail() with swapped +arguments. This links the list head with the new entry, losing +the references to the remaining part of the list. + +Fixes: 9426bbc6de99 ("rds: use list structure to track information for zerocopy completion notification") +Suggested-by: Paolo Abeni +Signed-off-by: Pietro Borrello +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/rds/message.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/rds/message.c b/net/rds/message.c +index b363ef13c75ef..8fa3d19c2e667 100644 +--- a/net/rds/message.c ++++ b/net/rds/message.c +@@ -118,7 +118,7 @@ static void rds_rm_zerocopy_callback(struct rds_sock *rs, + ck = &info->zcookies; + memset(ck, 0, sizeof(*ck)); + WARN_ON(!rds_zcookie_add(info, cookie)); +- list_add_tail(&q->zcookie_head, &info->rs_zcookie_next); ++ list_add_tail(&info->rs_zcookie_next, &q->zcookie_head); + + spin_unlock_irqrestore(&q->lock, flags); + /* caller invokes rds_wake_sk_sleep() */ +-- +2.39.2 + diff --git a/queue-5.15/regulator-max77802-bounds-check-regulator-id-against.patch b/queue-5.15/regulator-max77802-bounds-check-regulator-id-against.patch new file mode 100644 index 00000000000..29c79613f64 --- /dev/null +++ b/queue-5.15/regulator-max77802-bounds-check-regulator-id-against.patch @@ -0,0 +1,137 @@ +From 3ddc37308b1dc18b902a639c7d98d53c2a3d0fa2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Jan 2023 14:52:07 -0800 +Subject: regulator: max77802: Bounds check regulator id against opmode + +From: Kees Cook + +[ Upstream commit 4fd8bcec5fd7c0d586206fa2f42bd67b06cdaa7e ] + +Explicitly bounds-check the id before accessing the opmode array. Seen +with GCC 13: + +../drivers/regulator/max77802-regulator.c: In function 'max77802_enable': +../drivers/regulator/max77802-regulator.c:217:29: warning: array subscript [0, 41] is outside array bounds of 'unsigned int[42]' [-Warray-bounds=] + 217 | if (max77802->opmode[id] == MAX77802_OFF_PWRREQ) + | ~~~~~~~~~~~~~~~~^~~~ +../drivers/regulator/max77802-regulator.c:62:22: note: while referencing 'opmode' + 62 | unsigned int opmode[MAX77802_REG_MAX]; + | ^~~~~~ + +Cc: Javier Martinez Canillas +Cc: Liam Girdwood +Cc: Mark Brown +Signed-off-by: Kees Cook +Acked-by: Javier Martinez Canillas +Link: https://lore.kernel.org/r/20230127225203.never.864-kees@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/max77802-regulator.c | 34 ++++++++++++++++++-------- + 1 file changed, 24 insertions(+), 10 deletions(-) + +diff --git a/drivers/regulator/max77802-regulator.c b/drivers/regulator/max77802-regulator.c +index 21e0eb0f43f94..befe5f319819b 100644 +--- a/drivers/regulator/max77802-regulator.c ++++ b/drivers/regulator/max77802-regulator.c +@@ -94,9 +94,11 @@ static int max77802_set_suspend_disable(struct regulator_dev *rdev) + { + unsigned int val = MAX77802_OFF_PWRREQ; + struct max77802_regulator_prv *max77802 = rdev_get_drvdata(rdev); +- int id = rdev_get_id(rdev); ++ unsigned int id = rdev_get_id(rdev); + int shift = max77802_get_opmode_shift(id); + ++ if (WARN_ON_ONCE(id >= ARRAY_SIZE(max77802->opmode))) ++ return -EINVAL; + max77802->opmode[id] = val; + return regmap_update_bits(rdev->regmap, rdev->desc->enable_reg, + rdev->desc->enable_mask, val << shift); +@@ -110,7 +112,7 @@ static int max77802_set_suspend_disable(struct regulator_dev *rdev) + static int max77802_set_mode(struct regulator_dev *rdev, unsigned int mode) + { + struct max77802_regulator_prv *max77802 = rdev_get_drvdata(rdev); +- int id = rdev_get_id(rdev); ++ unsigned int id = rdev_get_id(rdev); + unsigned int val; + int shift = max77802_get_opmode_shift(id); + +@@ -127,6 +129,9 @@ static int max77802_set_mode(struct regulator_dev *rdev, unsigned int mode) + return -EINVAL; + } + ++ if (WARN_ON_ONCE(id >= ARRAY_SIZE(max77802->opmode))) ++ return -EINVAL; ++ + max77802->opmode[id] = val; + return regmap_update_bits(rdev->regmap, rdev->desc->enable_reg, + rdev->desc->enable_mask, val << shift); +@@ -135,8 +140,10 @@ static int max77802_set_mode(struct regulator_dev *rdev, unsigned int mode) + static unsigned max77802_get_mode(struct regulator_dev *rdev) + { + struct max77802_regulator_prv *max77802 = rdev_get_drvdata(rdev); +- int id = rdev_get_id(rdev); ++ unsigned int id = rdev_get_id(rdev); + ++ if (WARN_ON_ONCE(id >= ARRAY_SIZE(max77802->opmode))) ++ return -EINVAL; + return max77802_map_mode(max77802->opmode[id]); + } + +@@ -160,10 +167,13 @@ static int max77802_set_suspend_mode(struct regulator_dev *rdev, + unsigned int mode) + { + struct max77802_regulator_prv *max77802 = rdev_get_drvdata(rdev); +- int id = rdev_get_id(rdev); ++ unsigned int id = rdev_get_id(rdev); + unsigned int val; + int shift = max77802_get_opmode_shift(id); + ++ if (WARN_ON_ONCE(id >= ARRAY_SIZE(max77802->opmode))) ++ return -EINVAL; ++ + /* + * If the regulator has been disabled for suspend + * then is invalid to try setting a suspend mode. +@@ -209,9 +219,11 @@ static int max77802_set_suspend_mode(struct regulator_dev *rdev, + static int max77802_enable(struct regulator_dev *rdev) + { + struct max77802_regulator_prv *max77802 = rdev_get_drvdata(rdev); +- int id = rdev_get_id(rdev); ++ unsigned int id = rdev_get_id(rdev); + int shift = max77802_get_opmode_shift(id); + ++ if (WARN_ON_ONCE(id >= ARRAY_SIZE(max77802->opmode))) ++ return -EINVAL; + if (max77802->opmode[id] == MAX77802_OFF_PWRREQ) + max77802->opmode[id] = MAX77802_OPMODE_NORMAL; + +@@ -495,7 +507,7 @@ static int max77802_pmic_probe(struct platform_device *pdev) + + for (i = 0; i < MAX77802_REG_MAX; i++) { + struct regulator_dev *rdev; +- int id = regulators[i].id; ++ unsigned int id = regulators[i].id; + int shift = max77802_get_opmode_shift(id); + int ret; + +@@ -513,10 +525,12 @@ static int max77802_pmic_probe(struct platform_device *pdev) + * the hardware reports OFF as the regulator operating mode. + * Default to operating mode NORMAL in that case. + */ +- if (val == MAX77802_STATUS_OFF) +- max77802->opmode[id] = MAX77802_OPMODE_NORMAL; +- else +- max77802->opmode[id] = val; ++ if (id < ARRAY_SIZE(max77802->opmode)) { ++ if (val == MAX77802_STATUS_OFF) ++ max77802->opmode[id] = MAX77802_OPMODE_NORMAL; ++ else ++ max77802->opmode[id] = val; ++ } + + rdev = devm_regulator_register(&pdev->dev, + ®ulators[i], &config); +-- +2.39.2 + diff --git a/queue-5.15/regulator-s5m8767-bounds-check-id-indexing-into-arra.patch b/queue-5.15/regulator-s5m8767-bounds-check-id-indexing-into-arra.patch new file mode 100644 index 00000000000..1ecb65b4486 --- /dev/null +++ b/queue-5.15/regulator-s5m8767-bounds-check-id-indexing-into-arra.patch @@ -0,0 +1,55 @@ +From dad556d795bf1a54a4a19ebcba30203360cca38b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Jan 2023 16:53:58 -0800 +Subject: regulator: s5m8767: Bounds check id indexing into arrays + +From: Kees Cook + +[ Upstream commit e314e15a0b58f9d051c00b25951073bcdae61953 ] + +The compiler has no way to know if "id" is within the array bounds of +the regulators array. Add a check for this and a build-time check that +the regulators and reg_voltage_map arrays are sized the same. Seen with +GCC 13: + +../drivers/regulator/s5m8767.c: In function 's5m8767_pmic_probe': +../drivers/regulator/s5m8767.c:936:35: warning: array subscript [0, 36] is outside array bounds of 'struct regulator_desc[37]' [-Warray-bounds=] + 936 | regulators[id].vsel_reg = + | ~~~~~~~~~~^~~~ + +Cc: Krzysztof Kozlowski +Cc: Liam Girdwood +Cc: Mark Brown +Cc: linux-samsung-soc@vger.kernel.org +Signed-off-by: Kees Cook +Reviewed-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20230128005358.never.313-kees@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/s5m8767.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/regulator/s5m8767.c b/drivers/regulator/s5m8767.c +index 35269f9982105..754c6fcc6e642 100644 +--- a/drivers/regulator/s5m8767.c ++++ b/drivers/regulator/s5m8767.c +@@ -923,10 +923,14 @@ static int s5m8767_pmic_probe(struct platform_device *pdev) + + for (i = 0; i < pdata->num_regulators; i++) { + const struct sec_voltage_desc *desc; +- int id = pdata->regulators[i].id; ++ unsigned int id = pdata->regulators[i].id; + int enable_reg, enable_val; + struct regulator_dev *rdev; + ++ BUILD_BUG_ON(ARRAY_SIZE(regulators) != ARRAY_SIZE(reg_voltage_map)); ++ if (WARN_ON_ONCE(id >= ARRAY_SIZE(regulators))) ++ continue; ++ + desc = reg_voltage_map[id]; + if (desc) { + regulators[id].n_voltages = +-- +2.39.2 + diff --git a/queue-5.15/remoteproc-qcom_q6v5_mss-use-a-carveout-to-authentic.patch b/queue-5.15/remoteproc-qcom_q6v5_mss-use-a-carveout-to-authentic.patch new file mode 100644 index 00000000000..96b54c9f17e --- /dev/null +++ b/queue-5.15/remoteproc-qcom_q6v5_mss-use-a-carveout-to-authentic.patch @@ -0,0 +1,139 @@ +From 9c66ef702bcc7809043f209f551d499a79655f1c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Jan 2023 14:28:35 +0530 +Subject: remoteproc: qcom_q6v5_mss: Use a carveout to authenticate modem + headers + +From: Sibi Sankar + +[ Upstream commit 57f72170a2b2a362c35bb9407fc844eac5afdec1 ] + +Any access to the dynamically allocated metadata region by the application +processor after assigning it to the remote Q6 will result in a XPU +violation. Fix this by replacing the dynamically allocated memory region +with a no-map carveout and unmap the modem metadata memory region before +passing control to the remote Q6. + +Reported-and-tested-by: Amit Pundir +Fixes: 6c5a9dc2481b ("remoteproc: qcom: Make secure world call for mem ownership switch") +Signed-off-by: Sibi Sankar +Reviewed-by: Manivannan Sadhasivam +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230117085840.32356-7-quic_sibis@quicinc.com +Signed-off-by: Sasha Levin +--- + drivers/remoteproc/qcom_q6v5_mss.c | 59 +++++++++++++++++++++++++++--- + 1 file changed, 53 insertions(+), 6 deletions(-) + +diff --git a/drivers/remoteproc/qcom_q6v5_mss.c b/drivers/remoteproc/qcom_q6v5_mss.c +index ca1c7387776b5..93eefefd514c7 100644 +--- a/drivers/remoteproc/qcom_q6v5_mss.c ++++ b/drivers/remoteproc/qcom_q6v5_mss.c +@@ -17,6 +17,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -192,6 +193,9 @@ struct q6v5 { + size_t mba_size; + size_t dp_size; + ++ phys_addr_t mdata_phys; ++ size_t mdata_size; ++ + phys_addr_t mpss_phys; + phys_addr_t mpss_reloc; + size_t mpss_size; +@@ -832,15 +836,35 @@ static int q6v5_mpss_init_image(struct q6v5 *qproc, const struct firmware *fw) + if (IS_ERR(metadata)) + return PTR_ERR(metadata); + +- ptr = dma_alloc_attrs(qproc->dev, size, &phys, GFP_KERNEL, dma_attrs); +- if (!ptr) { +- kfree(metadata); +- dev_err(qproc->dev, "failed to allocate mdt buffer\n"); +- return -ENOMEM; ++ if (qproc->mdata_phys) { ++ if (size > qproc->mdata_size) { ++ ret = -EINVAL; ++ dev_err(qproc->dev, "metadata size outside memory range\n"); ++ goto free_metadata; ++ } ++ ++ phys = qproc->mdata_phys; ++ ptr = memremap(qproc->mdata_phys, size, MEMREMAP_WC); ++ if (!ptr) { ++ ret = -EBUSY; ++ dev_err(qproc->dev, "unable to map memory region: %pa+%zx\n", ++ &qproc->mdata_phys, size); ++ goto free_metadata; ++ } ++ } else { ++ ptr = dma_alloc_attrs(qproc->dev, size, &phys, GFP_KERNEL, dma_attrs); ++ if (!ptr) { ++ ret = -ENOMEM; ++ dev_err(qproc->dev, "failed to allocate mdt buffer\n"); ++ goto free_metadata; ++ } + } + + memcpy(ptr, metadata, size); + ++ if (qproc->mdata_phys) ++ memunmap(ptr); ++ + /* Hypervisor mapping to access metadata by modem */ + mdata_perm = BIT(QCOM_SCM_VMID_HLOS); + ret = q6v5_xfer_mem_ownership(qproc, &mdata_perm, false, true, +@@ -869,7 +893,9 @@ static int q6v5_mpss_init_image(struct q6v5 *qproc, const struct firmware *fw) + "mdt buffer not reclaimed system may become unstable\n"); + + free_dma_attrs: +- dma_free_attrs(qproc->dev, size, ptr, phys, dma_attrs); ++ if (!qproc->mdata_phys) ++ dma_free_attrs(qproc->dev, size, ptr, phys, dma_attrs); ++free_metadata: + kfree(metadata); + + return ret < 0 ? ret : 0; +@@ -1615,6 +1641,7 @@ static int q6v5_init_reset(struct q6v5 *qproc) + static int q6v5_alloc_memory_region(struct q6v5 *qproc) + { + struct device_node *child; ++ struct reserved_mem *rmem; + struct device_node *node; + struct resource r; + int ret; +@@ -1661,6 +1688,26 @@ static int q6v5_alloc_memory_region(struct q6v5 *qproc) + qproc->mpss_phys = qproc->mpss_reloc = r.start; + qproc->mpss_size = resource_size(&r); + ++ if (!child) { ++ node = of_parse_phandle(qproc->dev->of_node, "memory-region", 2); ++ } else { ++ child = of_get_child_by_name(qproc->dev->of_node, "metadata"); ++ node = of_parse_phandle(child, "memory-region", 0); ++ of_node_put(child); ++ } ++ ++ if (!node) ++ return 0; ++ ++ rmem = of_reserved_mem_lookup(node); ++ if (!rmem) { ++ dev_err(qproc->dev, "unable to resolve metadata region\n"); ++ return -EINVAL; ++ } ++ ++ qproc->mdata_phys = rmem->base; ++ qproc->mdata_size = rmem->size; ++ + return 0; + } + +-- +2.39.2 + diff --git a/queue-5.15/revert-char-pcmcia-cm4000_cs-replace-mdelay-with-usl.patch b/queue-5.15/revert-char-pcmcia-cm4000_cs-replace-mdelay-with-usl.patch new file mode 100644 index 00000000000..d33b9dcc207 --- /dev/null +++ b/queue-5.15/revert-char-pcmcia-cm4000_cs-replace-mdelay-with-usl.patch @@ -0,0 +1,61 @@ +From c991db59938d6359c5a10e0e894ab0cfd5bc8330 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Jan 2023 22:10:00 +0800 +Subject: Revert "char: pcmcia: cm4000_cs: Replace mdelay with usleep_range in + set_protocol" + +From: Duoming Zhou + +[ Upstream commit 70fae37a09268455b8ab4f64647086b61da6f39c ] + +This reverts commit be826ada52f1fcabed5b5217c94609ebf5967211. + +The function monitor_card() is a timer handler that runs in an +atomic context, but it calls usleep_range() that can sleep. +As a result, the sleep-in-atomic-context bugs will happen. +The process is shown below: + + (atomic context) +monitor_card() + set_protocol() + usleep_range() //sleep + +The origin commit c1986ee9bea3 ("[PATCH] New Omnikey Cardman +4000 driver") works fine. + +Fixes: be826ada52f1 ("char: pcmcia: cm4000_cs: Replace mdelay with usleep_range in set_protocol") +Signed-off-by: Duoming Zhou +Link: https://lore.kernel.org/r/20230118141000.5580-1-duoming@zju.edu.cn +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/char/pcmcia/cm4000_cs.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/char/pcmcia/cm4000_cs.c b/drivers/char/pcmcia/cm4000_cs.c +index 8f1bce0b4fe50..7057b7bacc8cf 100644 +--- a/drivers/char/pcmcia/cm4000_cs.c ++++ b/drivers/char/pcmcia/cm4000_cs.c +@@ -530,7 +530,8 @@ static int set_protocol(struct cm4000_dev *dev, struct ptsreq *ptsreq) + DEBUGP(5, dev, "NumRecBytes is valid\n"); + break; + } +- usleep_range(10000, 11000); ++ /* can not sleep as this is in atomic context */ ++ mdelay(10); + } + if (i == 100) { + DEBUGP(5, dev, "Timeout waiting for NumRecBytes getting " +@@ -550,7 +551,8 @@ static int set_protocol(struct cm4000_dev *dev, struct ptsreq *ptsreq) + } + break; + } +- usleep_range(10000, 11000); ++ /* can not sleep as this is in atomic context */ ++ mdelay(10); + } + + /* check whether it is a short PTS reply? */ +-- +2.39.2 + diff --git a/queue-5.15/revert-fbcon-don-t-lose-the-console-font-across-gene.patch b/queue-5.15/revert-fbcon-don-t-lose-the-console-font-across-gene.patch new file mode 100644 index 00000000000..d0368f46816 --- /dev/null +++ b/queue-5.15/revert-fbcon-don-t-lose-the-console-font-across-gene.patch @@ -0,0 +1,113 @@ +From 74cadbf007e318af3abc6398b5292ae691467a5d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Dec 2022 17:05:00 +0100 +Subject: Revert "fbcon: don't lose the console font across generic->chip + driver switch" + +From: Thomas Zimmermann + +[ Upstream commit 12d5796d55f9fd9e4b621003127c99e176665064 ] + +This reverts commit ae1287865f5361fa138d4d3b1b6277908b54eac9. + +Always free the console font when deinitializing the framebuffer +console. Subsequent framebuffer consoles will then use the default +font. Rely on userspace to load any user-configured font for these +consoles. + +Commit ae1287865f53 ("fbcon: don't lose the console font across +generic->chip driver switch") was introduced to work around losing +the font during graphics-device handover. [1][2] It kept a dangling +pointer with the font data between loading the two consoles, which is +fairly adventurous hack. It also never covered cases when the other +consoles, such as VGA text mode, where involved. + +The problem has meanwhile been solved in userspace. Systemd comes +with a udev rule that re-installs the configured font when a console +comes up. [3] So the kernel workaround can be removed. + +This also removes one of the two special cases triggered by setting +FBINFO_MISC_FIRMWARE in an fbdev driver. + +Tested during device handover from efifb and simpledrm to radeon. Udev +reloads the configured console font for the new driver's terminal. + +Signed-off-by: Thomas Zimmermann +Link: https://bugzilla.redhat.com/show_bug.cgi?id=892340 # 1 +Link: https://bugzilla.redhat.com/show_bug.cgi?id=1074624 # 2 +Link: https://cgit.freedesktop.org/systemd/systemd/tree/src/vconsole/90-vconsole.rules.in?h=v222 # 3 +Reviewed-by: Javier Martinez Canillas +Link: https://patchwork.freedesktop.org/patch/msgid/20221219160516.23436-3-tzimmermann@suse.de +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/core/fbcon.c | 17 ++++++----------- + 1 file changed, 6 insertions(+), 11 deletions(-) + +diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c +index d90d807c67561..b6712655ec1f0 100644 +--- a/drivers/video/fbdev/core/fbcon.c ++++ b/drivers/video/fbdev/core/fbcon.c +@@ -989,7 +989,7 @@ static const char *fbcon_startup(void) + set_blitting_type(vc, info); + + /* Setup default font */ +- if (!p->fontdata && !vc->vc_font.data) { ++ if (!p->fontdata) { + if (!fontname[0] || !(font = find_font(fontname))) + font = get_default_font(info->var.xres, + info->var.yres, +@@ -999,8 +999,6 @@ static const char *fbcon_startup(void) + vc->vc_font.height = font->height; + vc->vc_font.data = (void *)(p->fontdata = font->data); + vc->vc_font.charcount = font->charcount; +- } else { +- p->fontdata = vc->vc_font.data; + } + + cols = FBCON_SWAP(ops->rotate, info->var.xres, info->var.yres); +@@ -1167,9 +1165,9 @@ static void fbcon_init(struct vc_data *vc, int init) + ops->p = &fb_display[fg_console]; + } + +-static void fbcon_free_font(struct fbcon_display *p, bool freefont) ++static void fbcon_free_font(struct fbcon_display *p) + { +- if (freefont && p->userfont && p->fontdata && (--REFCOUNT(p->fontdata) == 0)) ++ if (p->userfont && p->fontdata && (--REFCOUNT(p->fontdata) == 0)) + kfree(p->fontdata - FONT_EXTRA_WORDS * sizeof(int)); + p->fontdata = NULL; + p->userfont = 0; +@@ -1183,8 +1181,8 @@ static void fbcon_deinit(struct vc_data *vc) + struct fb_info *info; + struct fbcon_ops *ops; + int idx; +- bool free_font = true; + ++ fbcon_free_font(p); + idx = con2fb_map[vc->vc_num]; + + if (idx == -1) +@@ -1195,8 +1193,6 @@ static void fbcon_deinit(struct vc_data *vc) + if (!info) + goto finished; + +- if (info->flags & FBINFO_MISC_FIRMWARE) +- free_font = false; + ops = info->fbcon_par; + + if (!ops) +@@ -1208,9 +1204,8 @@ static void fbcon_deinit(struct vc_data *vc) + ops->flags &= ~FBCON_FLAGS_INIT; + finished: + +- fbcon_free_font(p, free_font); +- if (free_font) +- vc->vc_font.data = NULL; ++ fbcon_free_font(p); ++ vc->vc_font.data = NULL; + + if (vc->vc_hi_font_mask && vc->vc_screenbuf) + set_vc_hi_font(vc, false); +-- +2.39.2 + diff --git a/queue-5.15/risc-v-time-initialize-hrtimer-based-broadcast-clock.patch b/queue-5.15/risc-v-time-initialize-hrtimer-based-broadcast-clock.patch new file mode 100644 index 00000000000..669e9da58bf --- /dev/null +++ b/queue-5.15/risc-v-time-initialize-hrtimer-based-broadcast-clock.patch @@ -0,0 +1,65 @@ +From e1c752138101f07f061242a227a355bec46f11a7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Jan 2023 19:41:00 +0530 +Subject: RISC-V: time: initialize hrtimer based broadcast clock event device + +From: Conor Dooley + +[ Upstream commit 8b3b8fbb4896984b5564789a42240e4b3caddb61 ] + +Similarly to commit 022eb8ae8b5e ("ARM: 8938/1: kernel: initialize +broadcast hrtimer based clock event device"), RISC-V needs to initiate +hrtimer based broadcast clock event device before C3STOP can be used. +Otherwise, the introduction of C3STOP for the RISC-V arch timer in +commit 232ccac1bd9b ("clocksource/drivers/riscv: Events are stopped +during CPU suspend") leaves us without any broadcast timer registered. +This prevents the kernel from entering oneshot mode, which breaks timer +behaviour, for example clock_nanosleep(). + +A test app that sleeps each cpu for 6, 5, 4, 3 ms respectively, HZ=250 +& C3STOP enabled, the sleep times are rounded up to the next jiffy: +== CPU: 1 == == CPU: 2 == == CPU: 3 == == CPU: 4 == +Mean: 7.974992 Mean: 7.976534 Mean: 7.962591 Mean: 3.952179 +Std Dev: 0.154374 Std Dev: 0.156082 Std Dev: 0.171018 Std Dev: 0.076193 +Hi: 9.472000 Hi: 10.495000 Hi: 8.864000 Hi: 4.736000 +Lo: 6.087000 Lo: 6.380000 Lo: 4.872000 Lo: 3.403000 +Samples: 521 Samples: 521 Samples: 521 Samples: 521 + +Link: https://lore.kernel.org/linux-riscv/YzYTNQRxLr7Q9JR0@spud/ +Fixes: 232ccac1bd9b ("clocksource/drivers/riscv: Events are stopped during CPU suspend") +Suggested-by: Samuel Holland +Signed-off-by: Conor Dooley +Signed-off-by: Anup Patel +Reviewed-by: Samuel Holland +Acked-by: Palmer Dabbelt +Link: https://lore.kernel.org/r/20230103141102.772228-2-apatel@ventanamicro.com +Signed-off-by: Daniel Lezcano +Signed-off-by: Sasha Levin +--- + arch/riscv/kernel/time.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/arch/riscv/kernel/time.c b/arch/riscv/kernel/time.c +index 8217b0f67c6cb..1cf21db4fcc77 100644 +--- a/arch/riscv/kernel/time.c ++++ b/arch/riscv/kernel/time.c +@@ -5,6 +5,7 @@ + */ + + #include ++#include + #include + #include + #include +@@ -29,6 +30,8 @@ void __init time_init(void) + + of_clk_init(NULL); + timer_probe(); ++ ++ tick_setup_hrtimer_broadcast(); + } + + void clocksource_arch_init(struct clocksource *cs) +-- +2.39.2 + diff --git a/queue-5.15/rpmsg-glink-avoid-infinite-loop-on-intent-for-missin.patch b/queue-5.15/rpmsg-glink-avoid-infinite-loop-on-intent-for-missin.patch new file mode 100644 index 00000000000..f8ce2fc2b11 --- /dev/null +++ b/queue-5.15/rpmsg-glink-avoid-infinite-loop-on-intent-for-missin.patch @@ -0,0 +1,38 @@ +From 4588601b9e51e6abb8f98c7f27013e15da0d943a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Feb 2023 15:42:31 -0800 +Subject: rpmsg: glink: Avoid infinite loop on intent for missing channel + +From: Bjorn Andersson + +[ Upstream commit 3e74ec2f39362bffbd42854acbb67c7f4cb808f9 ] + +In the event that an intent advertisement arrives on an unknown channel +the fifo is not advanced, resulting in the same message being handled +over and over. + +Fixes: dacbb35e930f ("rpmsg: glink: Receive and store the remote intent buffers") +Signed-off-by: Bjorn Andersson +Reviewed-by: Chris Lew +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230214234231.2069751-1-quic_bjorande@quicinc.com +Signed-off-by: Sasha Levin +--- + drivers/rpmsg/qcom_glink_native.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/rpmsg/qcom_glink_native.c b/drivers/rpmsg/qcom_glink_native.c +index 13c31372337a2..fd4c2f0fa4b1f 100644 +--- a/drivers/rpmsg/qcom_glink_native.c ++++ b/drivers/rpmsg/qcom_glink_native.c +@@ -929,6 +929,7 @@ static void qcom_glink_handle_intent(struct qcom_glink *glink, + spin_unlock_irqrestore(&glink->idr_lock, flags); + if (!channel) { + dev_err(glink->dev, "intents for non-existing channel\n"); ++ qcom_glink_rx_advance(glink, ALIGN(msglen, 8)); + return; + } + +-- +2.39.2 + diff --git a/queue-5.15/s390-ap-fix-status-returned-by-ap_aqic.patch b/queue-5.15/s390-ap-fix-status-returned-by-ap_aqic.patch new file mode 100644 index 00000000000..464d1834c7a --- /dev/null +++ b/queue-5.15/s390-ap-fix-status-returned-by-ap_aqic.patch @@ -0,0 +1,52 @@ +From e8900476976569613a5b5246bca8eca09c97e591 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Feb 2023 00:00:23 +0100 +Subject: s390/ap: fix status returned by ap_aqic() + +From: Halil Pasic + +[ Upstream commit 394740d7645ea767795074287769dd26dbd4d782 ] + +There function ap_aqic() tries to grab the status from the +wrong part of the register. Thus we always end up with +zeros. Which is wrong, among others, because we detect +failures via status.response_code. + +Signed-off-by: Halil Pasic +Reported-by: Janosch Frank +Fixes: 159491f3b509 ("s390/ap: rework assembler functions to use unions for in/out register variables") +Reviewed-by: Harald Freudenberger +Signed-off-by: Heiko Carstens +Signed-off-by: Sasha Levin +--- + arch/s390/include/asm/ap.h | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/arch/s390/include/asm/ap.h b/arch/s390/include/asm/ap.h +index 3afbee21dc1f1..8a8c0b157b551 100644 +--- a/arch/s390/include/asm/ap.h ++++ b/arch/s390/include/asm/ap.h +@@ -236,7 +236,10 @@ static inline struct ap_queue_status ap_aqic(ap_qid_t qid, + union { + unsigned long value; + struct ap_qirq_ctrl qirqctrl; +- struct ap_queue_status status; ++ struct { ++ u32 _pad; ++ struct ap_queue_status status; ++ }; + } reg1; + void *reg2 = ind; + +@@ -250,7 +253,7 @@ static inline struct ap_queue_status ap_aqic(ap_qid_t qid, + " lgr %[reg1],1\n" /* gr1 (status) into reg1 */ + : [reg1] "+&d" (reg1) + : [reg0] "d" (reg0), [reg2] "d" (reg2) +- : "cc", "0", "1", "2"); ++ : "cc", "memory", "0", "1", "2"); + + return reg1.status; + } +-- +2.39.2 + diff --git a/queue-5.15/s390-ap-fix-status-returned-by-ap_qact.patch b/queue-5.15/s390-ap-fix-status-returned-by-ap_qact.patch new file mode 100644 index 00000000000..71b16d44dfe --- /dev/null +++ b/queue-5.15/s390-ap-fix-status-returned-by-ap_qact.patch @@ -0,0 +1,44 @@ +From 47a75d997bc21c391b137e15004c3dc497588a60 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Feb 2023 00:00:24 +0100 +Subject: s390/ap: fix status returned by ap_qact() + +From: Halil Pasic + +[ Upstream commit a2522c80f074c35254974fec39fffe8b8d75befe ] + +Since commit 159491f3b509 ("s390/ap: rework assembler functions to use +unions for in/out register variables") the function ap_qact() tries to +grab the status from the wrong part of the register. Thus we always end +up with zeros. Which is wrong, among others, because we detect failures +via status.response_code. + +Signed-off-by: Halil Pasic +Reported-by: Harald Freudenberger +Fixes: 159491f3b509 ("s390/ap: rework assembler functions to use unions for in/out register variables") +Reviewed-by: Harald Freudenberger +Signed-off-by: Heiko Carstens +Signed-off-by: Sasha Levin +--- + arch/s390/include/asm/ap.h | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/arch/s390/include/asm/ap.h b/arch/s390/include/asm/ap.h +index 8a8c0b157b551..859e6d87b108b 100644 +--- a/arch/s390/include/asm/ap.h ++++ b/arch/s390/include/asm/ap.h +@@ -290,7 +290,10 @@ static inline struct ap_queue_status ap_qact(ap_qid_t qid, int ifbit, + unsigned long reg0 = qid | (5UL << 24) | ((ifbit & 0x01) << 22); + union { + unsigned long value; +- struct ap_queue_status status; ++ struct { ++ u32 _pad; ++ struct ap_queue_status status; ++ }; + } reg1; + unsigned long reg2; + +-- +2.39.2 + diff --git a/queue-5.15/s390-dasd-fix-potential-memleak-in-dasd_eckd_init.patch b/queue-5.15/s390-dasd-fix-potential-memleak-in-dasd_eckd_init.patch new file mode 100644 index 00000000000..1e9a9e8e592 --- /dev/null +++ b/queue-5.15/s390-dasd-fix-potential-memleak-in-dasd_eckd_init.patch @@ -0,0 +1,43 @@ +From 2ba3aa4a905210a7873d4c1591e950deb16f562d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Feb 2023 01:02:53 +0100 +Subject: s390/dasd: Fix potential memleak in dasd_eckd_init() + +From: Qiheng Lin + +[ Upstream commit 460e9bed82e49db1b823dcb4e421783854d86c40 ] + +`dasd_reserve_req` is allocated before `dasd_vol_info_req`, and it +also needs to be freed before the error returns, just like the other +cases in this function. + +Fixes: 9e12e54c7a8f ("s390/dasd: Handle out-of-space constraint") +Signed-off-by: Qiheng Lin +Link: https://lore.kernel.org/r/20221208133809.16796-1-linqiheng@huawei.com +Signed-off-by: Stefan Haberland +Link: https://lore.kernel.org/r/20230210000253.1644903-3-sth@linux.ibm.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/s390/block/dasd_eckd.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c +index 57dfc92aa756f..56ab74aa07f42 100644 +--- a/drivers/s390/block/dasd_eckd.c ++++ b/drivers/s390/block/dasd_eckd.c +@@ -6729,8 +6729,10 @@ dasd_eckd_init(void) + return -ENOMEM; + dasd_vol_info_req = kmalloc(sizeof(*dasd_vol_info_req), + GFP_KERNEL | GFP_DMA); +- if (!dasd_vol_info_req) ++ if (!dasd_vol_info_req) { ++ kfree(dasd_reserve_req); + return -ENOMEM; ++ } + pe_handler_worker = kmalloc(sizeof(*pe_handler_worker), + GFP_KERNEL | GFP_DMA); + if (!pe_handler_worker) { +-- +2.39.2 + diff --git a/queue-5.15/s390-idle-mark-arch_cpu_idle-noinstr.patch b/queue-5.15/s390-idle-mark-arch_cpu_idle-noinstr.patch new file mode 100644 index 00000000000..bc1db4c4856 --- /dev/null +++ b/queue-5.15/s390-idle-mark-arch_cpu_idle-noinstr.patch @@ -0,0 +1,68 @@ +From f7edae94cf2743efebe7916def5063e1b3828479 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Feb 2023 14:49:40 +0100 +Subject: s390/idle: mark arch_cpu_idle() noinstr + +From: Heiko Carstens + +[ Upstream commit a9cbc1b471d291c865907542394f1c483b93a811 ] + +linux-next commit ("cpuidle: tracing: Warn about !rcu_is_watching()") +adds a new warning which hits on s390's arch_cpu_idle() function: + +RCU not on for: arch_cpu_idle+0x0/0x28 +WARNING: CPU: 2 PID: 0 at include/linux/trace_recursion.h:162 arch_ftrace_ops_list_func+0x24c/0x258 +Modules linked in: +CPU: 2 PID: 0 Comm: swapper/2 Not tainted 6.2.0-rc6-next-20230202 #4 +Hardware name: IBM 8561 T01 703 (z/VM 7.3.0) +Krnl PSW : 0404d00180000000 00000000002b55c0 (arch_ftrace_ops_list_func+0x250/0x258) + R:0 T:1 IO:0 EX:0 Key:0 M:1 W:0 P:0 AS:3 CC:1 PM:0 RI:0 EA:3 +Krnl GPRS: c0000000ffffbfff 0000000080000002 0000000000000026 0000000000000000 + 0000037ffffe3a28 0000037ffffe3a20 0000000000000000 0000000000000000 + 0000000000000000 0000000000f4acf6 00000000001044f0 0000037ffffe3cb0 + 0000000000000000 0000000000000000 00000000002b55bc 0000037ffffe3bb8 +Krnl Code: 00000000002b55b0: c02000840051 larl %r2,0000000001335652 + 00000000002b55b6: c0e5fff512d1 brasl %r14,0000000000157b58 + #00000000002b55bc: af000000 mc 0,0 + >00000000002b55c0: a7f4ffe7 brc 15,00000000002b558e + 00000000002b55c4: 0707 bcr 0,%r7 + 00000000002b55c6: 0707 bcr 0,%r7 + 00000000002b55c8: eb6ff0480024 stmg %r6,%r15,72(%r15) + 00000000002b55ce: b90400ef lgr %r14,%r15 +Call Trace: + [<00000000002b55c0>] arch_ftrace_ops_list_func+0x250/0x258 +([<00000000002b55bc>] arch_ftrace_ops_list_func+0x24c/0x258) + [<0000000000f5f0fc>] ftrace_common+0x1c/0x20 + [<00000000001044f6>] arch_cpu_idle+0x6/0x28 + [<0000000000f4acf6>] default_idle_call+0x76/0x128 + [<00000000001cc374>] do_idle+0xf4/0x1b0 + [<00000000001cc6ce>] cpu_startup_entry+0x36/0x40 + [<0000000000119d00>] smp_start_secondary+0x140/0x150 + [<0000000000f5d2ae>] restart_int_handler+0x6e/0x90 + +Mark arch_cpu_idle() noinstr like all other architectures with +CONFIG_ARCH_WANTS_NO_INSTR (should) have it to fix this. + +Reviewed-by: Sven Schnelle +Signed-off-by: Heiko Carstens +Signed-off-by: Sasha Levin +--- + arch/s390/kernel/idle.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/s390/kernel/idle.c b/arch/s390/kernel/idle.c +index 4bf1ee293f2b3..a0da049e73609 100644 +--- a/arch/s390/kernel/idle.c ++++ b/arch/s390/kernel/idle.c +@@ -44,7 +44,7 @@ void account_idle_time_irq(void) + S390_lowcore.last_update_timer = idle->timer_idle_exit; + } + +-void arch_cpu_idle(void) ++void noinstr arch_cpu_idle(void) + { + struct s390_idle_data *idle = this_cpu_ptr(&s390_idle); + unsigned long idle_time; +-- +2.39.2 + diff --git a/queue-5.15/s390-mem_detect-fix-detect_memory-error-handling.patch b/queue-5.15/s390-mem_detect-fix-detect_memory-error-handling.patch new file mode 100644 index 00000000000..116cb5fbe55 --- /dev/null +++ b/queue-5.15/s390-mem_detect-fix-detect_memory-error-handling.patch @@ -0,0 +1,41 @@ +From 9be8eb14960641f60356e58b656a94f5e0b8da8b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Jan 2023 14:03:07 +0100 +Subject: s390/mem_detect: fix detect_memory() error handling + +From: Vasily Gorbik + +[ Upstream commit 3400c35a4090704e6c465449616ab7e67a9209e7 ] + +Currently if for some reason sclp_early_read_info() fails, +sclp_early_get_memsize() will not set max_physmem_end and it +will stay uninitialized. Any garbage value other than 0 will lead +to detect_memory() taking wrong path or returning a garbage value +as max_physmem_end. To avoid that simply initialize max_physmem_end. + +Fixes: 73045a08cf55 ("s390: unify identity mapping limits handling") +Reported-by: Alexander Gordeev +Reviewed-by: Alexander Gordeev +Signed-off-by: Vasily Gorbik +Signed-off-by: Heiko Carstens +Signed-off-by: Sasha Levin +--- + arch/s390/boot/mem_detect.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/s390/boot/mem_detect.c b/arch/s390/boot/mem_detect.c +index 2f949cd9076b8..17a32707d17e0 100644 +--- a/arch/s390/boot/mem_detect.c ++++ b/arch/s390/boot/mem_detect.c +@@ -165,7 +165,7 @@ static void search_mem_end(void) + + unsigned long detect_memory(void) + { +- unsigned long max_physmem_end; ++ unsigned long max_physmem_end = 0; + + sclp_early_get_memsize(&max_physmem_end); + +-- +2.39.2 + diff --git a/queue-5.15/s390-vdso-drop-shared-from-kbuild_cflags_64.patch b/queue-5.15/s390-vdso-drop-shared-from-kbuild_cflags_64.patch new file mode 100644 index 00000000000..01fb83cc825 --- /dev/null +++ b/queue-5.15/s390-vdso-drop-shared-from-kbuild_cflags_64.patch @@ -0,0 +1,45 @@ +From 55dc3566efbf127f0df6a35650359dbec058ff8d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Jan 2023 20:05:07 -0700 +Subject: s390/vdso: Drop '-shared' from KBUILD_CFLAGS_64 + +From: Nathan Chancellor + +[ Upstream commit fd8589dce8107e2ce62e92f76089654462dd67b4 ] + +When clang's -Qunused-arguments is dropped from KBUILD_CPPFLAGS, it +points out that there is a linking phase flag added to CFLAGS, which +will only be used for compiling + + clang-16: error: argument unused during compilation: '-shared' [-Werror,-Wunused-command-line-argument] + +'-shared' is already present in ldflags-y so it can just be dropped. + +Fixes: 2b2a25845d53 ("s390/vdso: Use $(LD) instead of $(CC) to link vDSO") +Signed-off-by: Nathan Chancellor +Acked-by: Heiko Carstens +Reviewed-by: Sven Schnelle +Tested-by: Linux Kernel Functional Testing +Tested-by: Anders Roxell +Signed-off-by: Masahiro Yamada +Signed-off-by: Sasha Levin +--- + arch/s390/kernel/vdso64/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/s390/kernel/vdso64/Makefile b/arch/s390/kernel/vdso64/Makefile +index 9e2b95a222a98..1605ba45ac4c0 100644 +--- a/arch/s390/kernel/vdso64/Makefile ++++ b/arch/s390/kernel/vdso64/Makefile +@@ -25,7 +25,7 @@ KBUILD_AFLAGS_64 := $(filter-out -m64,$(KBUILD_AFLAGS)) + KBUILD_AFLAGS_64 += -m64 -s + + KBUILD_CFLAGS_64 := $(filter-out -m64,$(KBUILD_CFLAGS)) +-KBUILD_CFLAGS_64 += -m64 -fPIC -shared -fno-common -fno-builtin ++KBUILD_CFLAGS_64 += -m64 -fPIC -fno-common -fno-builtin + ldflags-y := -fPIC -shared -soname=linux-vdso64.so.1 \ + --hash-style=both --build-id=sha1 -T + +-- +2.39.2 + diff --git a/queue-5.15/s390-vdso-remove-nostdlib-compiler-flag.patch b/queue-5.15/s390-vdso-remove-nostdlib-compiler-flag.patch new file mode 100644 index 00000000000..62861ca3023 --- /dev/null +++ b/queue-5.15/s390-vdso-remove-nostdlib-compiler-flag.patch @@ -0,0 +1,55 @@ +From e7cfd1284f8cf64167685dfa4e13f3b1f13c467f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Nov 2021 01:21:11 +0900 +Subject: s390/vdso: remove -nostdlib compiler flag + +From: Masahiro Yamada + +[ Upstream commit 7b737adc10d269e7fdf714ae2caa2281b6a801cf ] + +The -nostdlib option requests the compiler to not use the standard +system startup files or libraries when linking. It is effective only +when $(CC) is used as a linker driver. + +Since commit 2b2a25845d53 ("s390/vdso: Use $(LD) instead of $(CC) to +link vDSO"), $(LD) is directly used, hence -nostdlib is unneeded. + +Signed-off-by: Masahiro Yamada +Link: https://lore.kernel.org/r/20211107162111.323701-1-masahiroy@kernel.org +Signed-off-by: Heiko Carstens +Stable-dep-of: fd8589dce810 ("s390/vdso: Drop '-shared' from KBUILD_CFLAGS_64") +Signed-off-by: Sasha Levin +--- + arch/s390/kernel/vdso32/Makefile | 2 +- + arch/s390/kernel/vdso64/Makefile | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/s390/kernel/vdso32/Makefile b/arch/s390/kernel/vdso32/Makefile +index e3e6ac5686df5..245bddfe9bc0e 100644 +--- a/arch/s390/kernel/vdso32/Makefile ++++ b/arch/s390/kernel/vdso32/Makefile +@@ -22,7 +22,7 @@ KBUILD_AFLAGS_32 += -m31 -s + KBUILD_CFLAGS_32 := $(filter-out -m64,$(KBUILD_CFLAGS)) + KBUILD_CFLAGS_32 += -m31 -fPIC -shared -fno-common -fno-builtin + +-LDFLAGS_vdso32.so.dbg += -fPIC -shared -nostdlib -soname=linux-vdso32.so.1 \ ++LDFLAGS_vdso32.so.dbg += -fPIC -shared -soname=linux-vdso32.so.1 \ + --hash-style=both --build-id=sha1 -melf_s390 -T + + $(targets:%=$(obj)/%.dbg): KBUILD_CFLAGS = $(KBUILD_CFLAGS_32) +diff --git a/arch/s390/kernel/vdso64/Makefile b/arch/s390/kernel/vdso64/Makefile +index 0dea82b87e54b..9e2b95a222a98 100644 +--- a/arch/s390/kernel/vdso64/Makefile ++++ b/arch/s390/kernel/vdso64/Makefile +@@ -26,7 +26,7 @@ KBUILD_AFLAGS_64 += -m64 -s + + KBUILD_CFLAGS_64 := $(filter-out -m64,$(KBUILD_CFLAGS)) + KBUILD_CFLAGS_64 += -m64 -fPIC -shared -fno-common -fno-builtin +-ldflags-y := -fPIC -shared -nostdlib -soname=linux-vdso64.so.1 \ ++ldflags-y := -fPIC -shared -soname=linux-vdso64.so.1 \ + --hash-style=both --build-id=sha1 -T + + $(targets:%=$(obj)/%.dbg): KBUILD_CFLAGS = $(KBUILD_CFLAGS_64) +-- +2.39.2 + diff --git a/queue-5.15/s390-vmem-fix-empty-page-tables-cleanup-under-kasan.patch b/queue-5.15/s390-vmem-fix-empty-page-tables-cleanup-under-kasan.patch new file mode 100644 index 00000000000..1c70cb1ee69 --- /dev/null +++ b/queue-5.15/s390-vmem-fix-empty-page-tables-cleanup-under-kasan.patch @@ -0,0 +1,59 @@ +From f4639ddf41190b7217873474a7487ed12b8d911d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 28 Jan 2023 17:35:12 +0100 +Subject: s390/vmem: fix empty page tables cleanup under KASAN + +From: Vasily Gorbik + +[ Upstream commit 108303b0a2d27cb14eed565e33e64ad9eefe5d7e ] + +Commit b9ff81003cf1 ("s390/vmem: cleanup empty page tables") introduced +empty page tables cleanup in vmem code, but when the kernel is built +with KASAN enabled the code has no effect due to wrong KASAN shadow +memory intersection condition, which effectively ignores any memory +range below KASAN shadow. Fix intersection condition to make code +work as anticipated. + +Fixes: b9ff81003cf1 ("s390/vmem: cleanup empty page tables") +Reviewed-by: Alexander Gordeev +Signed-off-by: Vasily Gorbik +Signed-off-by: Heiko Carstens +Signed-off-by: Sasha Levin +--- + arch/s390/mm/vmem.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/s390/mm/vmem.c b/arch/s390/mm/vmem.c +index 2b1c6d916cf9c..39912629b0619 100644 +--- a/arch/s390/mm/vmem.c ++++ b/arch/s390/mm/vmem.c +@@ -297,7 +297,7 @@ static void try_free_pmd_table(pud_t *pud, unsigned long start) + if (end > VMALLOC_START) + return; + #ifdef CONFIG_KASAN +- if (start < KASAN_SHADOW_END && KASAN_SHADOW_START > end) ++ if (start < KASAN_SHADOW_END && end > KASAN_SHADOW_START) + return; + #endif + pmd = pmd_offset(pud, start); +@@ -372,7 +372,7 @@ static void try_free_pud_table(p4d_t *p4d, unsigned long start) + if (end > VMALLOC_START) + return; + #ifdef CONFIG_KASAN +- if (start < KASAN_SHADOW_END && KASAN_SHADOW_START > end) ++ if (start < KASAN_SHADOW_END && end > KASAN_SHADOW_START) + return; + #endif + +@@ -426,7 +426,7 @@ static void try_free_p4d_table(pgd_t *pgd, unsigned long start) + if (end > VMALLOC_START) + return; + #ifdef CONFIG_KASAN +- if (start < KASAN_SHADOW_END && KASAN_SHADOW_START > end) ++ if (start < KASAN_SHADOW_END && end > KASAN_SHADOW_START) + return; + #endif + +-- +2.39.2 + diff --git a/queue-5.15/sched-deadline-rt-remove-unused-parameter-from-pick_.patch b/queue-5.15/sched-deadline-rt-remove-unused-parameter-from-pick_.patch new file mode 100644 index 00000000000..4eae0de4360 --- /dev/null +++ b/queue-5.15/sched-deadline-rt-remove-unused-parameter-from-pick_.patch @@ -0,0 +1,72 @@ +From 4b5c7f6c73357e1bf985478aed2cae8e66a44353 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Mar 2022 19:34:33 +0100 +Subject: sched/deadline,rt: Remove unused parameter from + pick_next_[rt|dl]_entity() + +From: Dietmar Eggemann + +[ Upstream commit 821aecd09e5ad2f8d4c3d8195333d272b392f7d3 ] + +The `struct rq *rq` parameter isn't used. Remove it. + +Signed-off-by: Dietmar Eggemann +Signed-off-by: Peter Zijlstra (Intel) +Acked-by: Juri Lelli +Link: https://lore.kernel.org/r/20220302183433.333029-7-dietmar.eggemann@arm.com +Stable-dep-of: 7c4a5b89a0b5 ("sched/rt: pick_next_rt_entity(): check list_entry") +Signed-off-by: Sasha Levin +--- + kernel/sched/deadline.c | 5 ++--- + kernel/sched/rt.c | 5 ++--- + 2 files changed, 4 insertions(+), 6 deletions(-) + +diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c +index 2a2f32eaffccd..226c814368d1b 100644 +--- a/kernel/sched/deadline.c ++++ b/kernel/sched/deadline.c +@@ -1846,8 +1846,7 @@ static void set_next_task_dl(struct rq *rq, struct task_struct *p, bool first) + deadline_queue_push_tasks(rq); + } + +-static struct sched_dl_entity *pick_next_dl_entity(struct rq *rq, +- struct dl_rq *dl_rq) ++static struct sched_dl_entity *pick_next_dl_entity(struct dl_rq *dl_rq) + { + struct rb_node *left = rb_first_cached(&dl_rq->root); + +@@ -1866,7 +1865,7 @@ static struct task_struct *pick_task_dl(struct rq *rq) + if (!sched_dl_runnable(rq)) + return NULL; + +- dl_se = pick_next_dl_entity(rq, dl_rq); ++ dl_se = pick_next_dl_entity(dl_rq); + BUG_ON(!dl_se); + p = dl_task_of(dl_se); + +diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c +index add67f811e004..b374ea9f58ab2 100644 +--- a/kernel/sched/rt.c ++++ b/kernel/sched/rt.c +@@ -1614,8 +1614,7 @@ static inline void set_next_task_rt(struct rq *rq, struct task_struct *p, bool f + rt_queue_push_tasks(rq); + } + +-static struct sched_rt_entity *pick_next_rt_entity(struct rq *rq, +- struct rt_rq *rt_rq) ++static struct sched_rt_entity *pick_next_rt_entity(struct rt_rq *rt_rq) + { + struct rt_prio_array *array = &rt_rq->active; + struct sched_rt_entity *next = NULL; +@@ -1637,7 +1636,7 @@ static struct task_struct *_pick_next_task_rt(struct rq *rq) + struct rt_rq *rt_rq = &rq->rt; + + do { +- rt_se = pick_next_rt_entity(rq, rt_rq); ++ rt_se = pick_next_rt_entity(rt_rq); + BUG_ON(!rt_se); + rt_rq = group_rt_rq(rt_se); + } while (rt_rq); +-- +2.39.2 + diff --git a/queue-5.15/sched-fair-sanitize-vruntime-of-entity-being-placed.patch b/queue-5.15/sched-fair-sanitize-vruntime-of-entity-being-placed.patch new file mode 100644 index 00000000000..f935f7df5a9 --- /dev/null +++ b/queue-5.15/sched-fair-sanitize-vruntime-of-entity-being-placed.patch @@ -0,0 +1,70 @@ +From bcfd9147a5efa95a66562cf4834b860b1e0b77ff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Jan 2023 13:22:16 +0100 +Subject: sched/fair: sanitize vruntime of entity being placed + +From: Zhang Qiao + +[ Upstream commit 829c1651e9c4a6f78398d3e67651cef9bb6b42cc ] + +When a scheduling entity is placed onto cfs_rq, its vruntime is pulled +to the base level (around cfs_rq->min_vruntime), so that the entity +doesn't gain extra boost when placed backwards. + +However, if the entity being placed wasn't executed for a long time, its +vruntime may get too far behind (e.g. while cfs_rq was executing a +low-weight hog), which can inverse the vruntime comparison due to s64 +overflow. This results in the entity being placed with its original +vruntime way forwards, so that it will effectively never get to the cpu. + +To prevent that, ignore the vruntime of the entity being placed if it +didn't execute for much longer than the characteristic sheduler time +scale. + +[rkagan: formatted, adjusted commit log, comments, cutoff value] +Signed-off-by: Zhang Qiao +Co-developed-by: Roman Kagan +Signed-off-by: Roman Kagan +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lkml.kernel.org/r/20230130122216.3555094-1-rkagan@amazon.de +Signed-off-by: Sasha Levin +--- + kernel/sched/fair.c | 15 +++++++++++++-- + 1 file changed, 13 insertions(+), 2 deletions(-) + +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index 6648683cd9644..671bbd71ff26c 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -4331,6 +4331,7 @@ static void + place_entity(struct cfs_rq *cfs_rq, struct sched_entity *se, int initial) + { + u64 vruntime = cfs_rq->min_vruntime; ++ u64 sleep_time; + + /* + * The 'current' period is already promised to the current tasks, +@@ -4355,8 +4356,18 @@ place_entity(struct cfs_rq *cfs_rq, struct sched_entity *se, int initial) + vruntime -= thresh; + } + +- /* ensure we never gain time by being placed backwards. */ +- se->vruntime = max_vruntime(se->vruntime, vruntime); ++ /* ++ * Pull vruntime of the entity being placed to the base level of ++ * cfs_rq, to prevent boosting it if placed backwards. If the entity ++ * slept for a long time, don't even try to compare its vruntime with ++ * the base as it may be too far off and the comparison may get ++ * inversed due to s64 overflow. ++ */ ++ sleep_time = rq_clock_task(rq_of(cfs_rq)) - se->exec_start; ++ if ((s64)sleep_time > 60LL * NSEC_PER_SEC) ++ se->vruntime = vruntime; ++ else ++ se->vruntime = max_vruntime(se->vruntime, vruntime); + } + + static void check_enqueue_throttle(struct cfs_rq *cfs_rq); +-- +2.39.2 + diff --git a/queue-5.15/sched-rt-pick_next_rt_entity-check-list_entry.patch b/queue-5.15/sched-rt-pick_next_rt_entity-check-list_entry.patch new file mode 100644 index 00000000000..1afae94f1a3 --- /dev/null +++ b/queue-5.15/sched-rt-pick_next_rt_entity-check-list_entry.patch @@ -0,0 +1,55 @@ +From 2f75ec9fb3be640ea234c6d4a12d2d1d369fa9c5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Feb 2023 22:33:54 +0000 +Subject: sched/rt: pick_next_rt_entity(): check list_entry + +From: Pietro Borrello + +[ Upstream commit 7c4a5b89a0b5a57a64b601775b296abf77a9fe97 ] + +Commit 326587b84078 ("sched: fix goto retry in pick_next_task_rt()") +removed any path which could make pick_next_rt_entity() return NULL. +However, BUG_ON(!rt_se) in _pick_next_task_rt() (the only caller of +pick_next_rt_entity()) still checks the error condition, which can +never happen, since list_entry() never returns NULL. +Remove the BUG_ON check, and instead emit a warning in the only +possible error condition here: the queue being empty which should +never happen. + +Fixes: 326587b84078 ("sched: fix goto retry in pick_next_task_rt()") +Signed-off-by: Pietro Borrello +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Phil Auld +Reviewed-by: Steven Rostedt (Google) +Link: https://lore.kernel.org/r/20230128-list-entry-null-check-sched-v3-1-b1a71bd1ac6b@diag.uniroma1.it +Signed-off-by: Sasha Levin +--- + kernel/sched/rt.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c +index b374ea9f58ab2..08af6076c8097 100644 +--- a/kernel/sched/rt.c ++++ b/kernel/sched/rt.c +@@ -1625,6 +1625,8 @@ static struct sched_rt_entity *pick_next_rt_entity(struct rt_rq *rt_rq) + BUG_ON(idx >= MAX_RT_PRIO); + + queue = array->queue + idx; ++ if (SCHED_WARN_ON(list_empty(queue))) ++ return NULL; + next = list_entry(queue->next, struct sched_rt_entity, run_list); + + return next; +@@ -1637,7 +1639,8 @@ static struct task_struct *_pick_next_task_rt(struct rq *rq) + + do { + rt_se = pick_next_rt_entity(rt_rq); +- BUG_ON(!rt_se); ++ if (unlikely(!rt_se)) ++ return NULL; + rt_rq = group_rt_rq(rt_se); + } while (rt_rq); + +-- +2.39.2 + diff --git a/queue-5.15/scm-add-user-copy-checks-to-put_cmsg.patch b/queue-5.15/scm-add-user-copy-checks-to-put_cmsg.patch new file mode 100644 index 00000000000..cf62dc84b8e --- /dev/null +++ b/queue-5.15/scm-add-user-copy-checks-to-put_cmsg.patch @@ -0,0 +1,50 @@ +From 14f69e43706984d6e588e4016320b348930768bb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Feb 2023 18:24:54 +0000 +Subject: scm: add user copy checks to put_cmsg() + +From: Eric Dumazet + +[ Upstream commit 5f1eb1ff58ea122e24adf0bc940f268ed2227462 ] + +This is a followup of commit 2558b8039d05 ("net: use a bounce +buffer for copying skb->mark") + +x86 and powerpc define user_access_begin, meaning +that they are not able to perform user copy checks +when using user_write_access_begin() / unsafe_copy_to_user() +and friends [1] + +Instead of waiting bugs to trigger on other arches, +add a check_object_size() in put_cmsg() to make sure +that new code tested on x86 with CONFIG_HARDENED_USERCOPY=y +will perform more security checks. + +[1] We can not generically call check_object_size() from +unsafe_copy_to_user() because UACCESS is enabled at this point. + +Signed-off-by: Eric Dumazet +Cc: Kees Cook +Acked-by: Kees Cook +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/core/scm.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/core/scm.c b/net/core/scm.c +index 5c356f0dee30c..acb7d776fa6ec 100644 +--- a/net/core/scm.c ++++ b/net/core/scm.c +@@ -229,6 +229,8 @@ int put_cmsg(struct msghdr * msg, int level, int type, int len, void *data) + if (msg->msg_control_is_user) { + struct cmsghdr __user *cm = msg->msg_control_user; + ++ check_object_size(data, cmlen - sizeof(*cm), true); ++ + if (!user_write_access_begin(cm, cmlen)) + goto efault; + +-- +2.39.2 + diff --git a/queue-5.15/scsi-aic94xx-add-missing-check-for-dma_map_single.patch b/queue-5.15/scsi-aic94xx-add-missing-check-for-dma_map_single.patch new file mode 100644 index 00000000000..050d8266763 --- /dev/null +++ b/queue-5.15/scsi-aic94xx-add-missing-check-for-dma_map_single.patch @@ -0,0 +1,39 @@ +From 3e8dd38d3957523dfa24f4c5224edd784a427138 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 28 Jan 2023 19:08:32 +0800 +Subject: scsi: aic94xx: Add missing check for dma_map_single() + +From: Jiasheng Jiang + +[ Upstream commit 32fe45274edb5926abc0fac7263d9f889d02d9cf ] + +Add check for dma_map_single() and return error if it fails in order to +avoid invalid DMA address. + +Fixes: 2908d778ab3e ("[SCSI] aic94xx: new driver") +Link: https://lore.kernel.org/r/20230128110832.6792-1-jiasheng@iscas.ac.cn +Signed-off-by: Jiasheng Jiang +Reviewed-by: Jason Yan +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/aic94xx/aic94xx_task.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/scsi/aic94xx/aic94xx_task.c b/drivers/scsi/aic94xx/aic94xx_task.c +index c6b63eae28f51..ce48f34f412f0 100644 +--- a/drivers/scsi/aic94xx/aic94xx_task.c ++++ b/drivers/scsi/aic94xx/aic94xx_task.c +@@ -50,6 +50,9 @@ static int asd_map_scatterlist(struct sas_task *task, + dma_addr_t dma = dma_map_single(&asd_ha->pcidev->dev, p, + task->total_xfer_len, + task->data_dir); ++ if (dma_mapping_error(&asd_ha->pcidev->dev, dma)) ++ return -ENOMEM; ++ + sg_arr[0].bus_addr = cpu_to_le64((u64)dma); + sg_arr[0].size = cpu_to_le32(task->total_xfer_len); + sg_arr[0].flags |= ASD_SG_EL_LIST_EOL; +-- +2.39.2 + diff --git a/queue-5.15/scsi-lpfc-fix-use-after-free-kfence-violation-during.patch b/queue-5.15/scsi-lpfc-fix-use-after-free-kfence-violation-during.patch new file mode 100644 index 00000000000..46958d7c331 --- /dev/null +++ b/queue-5.15/scsi-lpfc-fix-use-after-free-kfence-violation-during.patch @@ -0,0 +1,97 @@ +From f0da1636ceeaaad1b6bf1e802b168b8020d7e1b1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Jan 2023 15:33:13 -0800 +Subject: scsi: lpfc: Fix use-after-free KFENCE violation during sysfs firmware + write + +From: Justin Tee + +[ Upstream commit 21681b81b9ae548c5dae7ae00d931197a27f480c ] + +During the sysfs firmware write process, a use-after-free read warning is +logged from the lpfc_wr_object() routine: + + BUG: KFENCE: use-after-free read in lpfc_wr_object+0x235/0x310 [lpfc] + Use-after-free read at 0x0000000000cf164d (in kfence-#111): + lpfc_wr_object+0x235/0x310 [lpfc] + lpfc_write_firmware.cold+0x206/0x30d [lpfc] + lpfc_sli4_request_firmware_update+0xa6/0x100 [lpfc] + lpfc_request_firmware_upgrade_store+0x66/0xb0 [lpfc] + kernfs_fop_write_iter+0x121/0x1b0 + new_sync_write+0x11c/0x1b0 + vfs_write+0x1ef/0x280 + ksys_write+0x5f/0xe0 + do_syscall_64+0x59/0x90 + entry_SYSCALL_64_after_hwframe+0x63/0xcd + +The driver accessed wr_object pointer data, which was initialized into +mailbox payload memory, after the mailbox object was released back to the +mailbox pool. + +Fix by moving the mailbox free calls to the end of the routine ensuring +that we don't reference internal mailbox memory after release. + +Signed-off-by: Justin Tee +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/lpfc/lpfc_sli.c | 19 +++++++++++++------ + 1 file changed, 13 insertions(+), 6 deletions(-) + +diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c +index df3b190fccd16..7d333167047f5 100644 +--- a/drivers/scsi/lpfc/lpfc_sli.c ++++ b/drivers/scsi/lpfc/lpfc_sli.c +@@ -21066,6 +21066,7 @@ lpfc_wr_object(struct lpfc_hba *phba, struct list_head *dmabuf_list, + struct lpfc_mbx_wr_object *wr_object; + LPFC_MBOXQ_t *mbox; + int rc = 0, i = 0; ++ int mbox_status = 0; + uint32_t shdr_status, shdr_add_status, shdr_add_status_2; + uint32_t shdr_change_status = 0, shdr_csf = 0; + uint32_t mbox_tmo; +@@ -21111,11 +21112,15 @@ lpfc_wr_object(struct lpfc_hba *phba, struct list_head *dmabuf_list, + wr_object->u.request.bde_count = i; + bf_set(lpfc_wr_object_write_length, &wr_object->u.request, written); + if (!phba->sli4_hba.intr_enable) +- rc = lpfc_sli_issue_mbox(phba, mbox, MBX_POLL); ++ mbox_status = lpfc_sli_issue_mbox(phba, mbox, MBX_POLL); + else { + mbox_tmo = lpfc_mbox_tmo_val(phba, mbox); +- rc = lpfc_sli_issue_mbox_wait(phba, mbox, mbox_tmo); ++ mbox_status = lpfc_sli_issue_mbox_wait(phba, mbox, mbox_tmo); + } ++ ++ /* The mbox status needs to be maintained to detect MBOX_TIMEOUT. */ ++ rc = mbox_status; ++ + /* The IOCTL status is embedded in the mailbox subheader. */ + shdr_status = bf_get(lpfc_mbox_hdr_status, + &wr_object->header.cfg_shdr.response); +@@ -21130,10 +21135,6 @@ lpfc_wr_object(struct lpfc_hba *phba, struct list_head *dmabuf_list, + &wr_object->u.response); + } + +- if (!phba->sli4_hba.intr_enable) +- mempool_free(mbox, phba->mbox_mem_pool); +- else if (rc != MBX_TIMEOUT) +- mempool_free(mbox, phba->mbox_mem_pool); + if (shdr_status || shdr_add_status || shdr_add_status_2 || rc) { + lpfc_printf_log(phba, KERN_ERR, LOG_TRACE_EVENT, + "3025 Write Object mailbox failed with " +@@ -21151,6 +21152,12 @@ lpfc_wr_object(struct lpfc_hba *phba, struct list_head *dmabuf_list, + lpfc_log_fw_write_cmpl(phba, shdr_status, shdr_add_status, + shdr_add_status_2, shdr_change_status, + shdr_csf); ++ ++ if (!phba->sli4_hba.intr_enable) ++ mempool_free(mbox, phba->mbox_mem_pool); ++ else if (mbox_status != MBX_TIMEOUT) ++ mempool_free(mbox, phba->mbox_mem_pool); ++ + return rc; + } + +-- +2.39.2 + diff --git a/queue-5.15/scsi-mpt3sas-fix-a-memory-leak.patch b/queue-5.15/scsi-mpt3sas-fix-a-memory-leak.patch new file mode 100644 index 00000000000..6eae7e6ae2e --- /dev/null +++ b/queue-5.15/scsi-mpt3sas-fix-a-memory-leak.patch @@ -0,0 +1,37 @@ +From bce05f4a0e285c24d3b85b87e6c30de8c04359d9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Feb 2023 16:21:59 +0100 +Subject: scsi: mpt3sas: Fix a memory leak + +From: Tomas Henzl + +[ Upstream commit 54dd96015e8d7a2a07359e2dfebf05b529d1780c ] + +Add a forgotten kfree(). + +Fixes: dbec4c9040ed ("scsi: mpt3sas: lockless command submission") +Link: https://lore.kernel.org/r/20230207152159.18627-1-thenzl@redhat.com +Signed-off-by: Tomas Henzl +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/mpt3sas/mpt3sas_base.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c +index 766c3a59a900a..9e674b748e78a 100644 +--- a/drivers/scsi/mpt3sas/mpt3sas_base.c ++++ b/drivers/scsi/mpt3sas/mpt3sas_base.c +@@ -5682,6 +5682,9 @@ _base_release_memory_pools(struct MPT3SAS_ADAPTER *ioc) + } + dma_pool_destroy(ioc->pcie_sgl_dma_pool); + } ++ kfree(ioc->pcie_sg_lookup); ++ ioc->pcie_sg_lookup = NULL; ++ + if (ioc->config_page) { + dexitprintk(ioc, + ioc_info(ioc, "config_page(0x%p): free\n", +-- +2.39.2 + diff --git a/queue-5.15/scsi-qla2xxx-edif-fix-i-o-timeout-due-to-over-subscr.patch b/queue-5.15/scsi-qla2xxx-edif-fix-i-o-timeout-due-to-over-subscr.patch new file mode 100644 index 00000000000..827aab01873 --- /dev/null +++ b/queue-5.15/scsi-qla2xxx-edif-fix-i-o-timeout-due-to-over-subscr.patch @@ -0,0 +1,52 @@ +From b6ae7879ad8f548eb049ed716548283e70edaba5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Jun 2022 04:58:40 -0700 +Subject: scsi: qla2xxx: edif: Fix I/O timeout due to over-subscription + +From: Quinn Tran + +[ Upstream commit 63ab6cb582fad3757a03f466db671729b97f2df8 ] + +The current edif code does not keep track of FW IOCB resources. This led +to IOCB queue full on error recovery (I/O timeout). Make use of the +existing code that tracks IOCB resources to prevent over-subscription. + +Link: https://lore.kernel.org/r/20220608115849.16693-2-njavali@marvell.com +Reviewed-by: Himanshu Madhani +Signed-off-by: Quinn Tran +Signed-off-by: Nilesh Javali +Signed-off-by: Martin K. Petersen +Stable-dep-of: 41e5afe51f75 ("scsi: qla2xxx: Fix exchange oversubscription") +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_edif.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/scsi/qla2xxx/qla_edif.c b/drivers/scsi/qla2xxx/qla_edif.c +index 8e9237434e8b1..a7e2118b3a841 100644 +--- a/drivers/scsi/qla2xxx/qla_edif.c ++++ b/drivers/scsi/qla2xxx/qla_edif.c +@@ -2898,6 +2898,12 @@ qla28xx_start_scsi_edif(srb_t *sp) + + tot_dsds = nseg; + req_cnt = qla24xx_calc_iocbs(vha, tot_dsds); ++ ++ sp->iores.res_type = RESOURCE_INI; ++ sp->iores.iocb_cnt = req_cnt; ++ if (qla_get_iocbs(sp->qpair, &sp->iores)) ++ goto queuing_error; ++ + if (req->cnt < (req_cnt + 2)) { + cnt = IS_SHADOW_REG_CAPABLE(ha) ? *req->out_ptr : + rd_reg_dword(req->req_q_out); +@@ -3089,6 +3095,7 @@ qla28xx_start_scsi_edif(srb_t *sp) + mempool_free(sp->u.scmd.ct6_ctx, ha->ctx_mempool); + sp->u.scmd.ct6_ctx = NULL; + } ++ qla_put_iocbs(sp->qpair, &sp->iores); + spin_unlock_irqrestore(lock, flags); + + return QLA_FUNCTION_FAILED; +-- +2.39.2 + diff --git a/queue-5.15/scsi-qla2xxx-fix-exchange-oversubscription-for-manag.patch b/queue-5.15/scsi-qla2xxx-fix-exchange-oversubscription-for-manag.patch new file mode 100644 index 00000000000..23021c4025b --- /dev/null +++ b/queue-5.15/scsi-qla2xxx-fix-exchange-oversubscription-for-manag.patch @@ -0,0 +1,194 @@ +From 13eabf040b2bec00e4f1784e19930192c6384f0a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Dec 2022 03:07:42 -0800 +Subject: scsi: qla2xxx: Fix exchange oversubscription for management commands + +From: Quinn Tran + +[ Upstream commit 5f63a163ed2f12c34dd4ae9b2757962ec7bb86e5 ] + +Add resource checking for management (non-I/O) commands. + +Fixes: 89c72f4245a8 ("scsi: qla2xxx: Add IOCB resource tracking") +Signed-off-by: Quinn Tran +Signed-off-by: Nilesh Javali +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_dfs.c | 10 ++++- + drivers/scsi/qla2xxx/qla_inline.h | 5 ++- + drivers/scsi/qla2xxx/qla_iocb.c | 67 +++++++++++++++++++++++++++++++ + drivers/scsi/qla2xxx/qla_isr.c | 1 + + 4 files changed, 80 insertions(+), 3 deletions(-) + +diff --git a/drivers/scsi/qla2xxx/qla_dfs.c b/drivers/scsi/qla2xxx/qla_dfs.c +index 85bd0e468d43e..8f6f56c9584ce 100644 +--- a/drivers/scsi/qla2xxx/qla_dfs.c ++++ b/drivers/scsi/qla2xxx/qla_dfs.c +@@ -235,7 +235,7 @@ qla_dfs_fw_resource_cnt_show(struct seq_file *s, void *unused) + uint16_t mb[MAX_IOCB_MB_REG]; + int rc; + struct qla_hw_data *ha = vha->hw; +- u16 iocbs_used, i; ++ u16 iocbs_used, i, exch_used; + + rc = qla24xx_res_count_wait(vha, mb, SIZEOF_IOCB_MB_REG); + if (rc != QLA_SUCCESS) { +@@ -263,13 +263,19 @@ qla_dfs_fw_resource_cnt_show(struct seq_file *s, void *unused) + if (ql2xenforce_iocb_limit) { + /* lock is not require. It's an estimate. */ + iocbs_used = ha->base_qpair->fwres.iocbs_used; ++ exch_used = ha->base_qpair->fwres.exch_used; + for (i = 0; i < ha->max_qpairs; i++) { +- if (ha->queue_pair_map[i]) ++ if (ha->queue_pair_map[i]) { + iocbs_used += ha->queue_pair_map[i]->fwres.iocbs_used; ++ exch_used += ha->queue_pair_map[i]->fwres.exch_used; ++ } + } + + seq_printf(s, "Driver: estimate iocb used [%d] high water limit [%d]\n", + iocbs_used, ha->base_qpair->fwres.iocbs_limit); ++ ++ seq_printf(s, "estimate exchange used[%d] high water limit [%d] n", ++ exch_used, ha->base_qpair->fwres.exch_limit); + } + + return 0; +diff --git a/drivers/scsi/qla2xxx/qla_inline.h b/drivers/scsi/qla2xxx/qla_inline.h +index 2d5a275d8b000..b0ee307b5d4b9 100644 +--- a/drivers/scsi/qla2xxx/qla_inline.h ++++ b/drivers/scsi/qla2xxx/qla_inline.h +@@ -380,7 +380,7 @@ qla2xxx_get_fc4_priority(struct scsi_qla_host *vha) + + enum { + RESOURCE_NONE, +- RESOURCE_IOCB = BIT_0, ++ RESOURCE_IOCB = BIT_0, + RESOURCE_EXCH = BIT_1, /* exchange */ + RESOURCE_FORCE = BIT_2, + }; +@@ -396,6 +396,8 @@ qla_get_fw_resources(struct qla_qpair *qp, struct iocb_resource *iores) + iores->res_type = RESOURCE_NONE; + return 0; + } ++ if (iores->res_type & RESOURCE_FORCE) ++ goto force; + + if ((iores->iocb_cnt + qp->fwres.iocbs_used) >= qp->fwres.iocbs_qp_limit) { + /* no need to acquire qpair lock. It's just rough calculation */ +@@ -423,6 +425,7 @@ qla_get_fw_resources(struct qla_qpair *qp, struct iocb_resource *iores) + return -ENOSPC; + } + } ++force: + qp->fwres.iocbs_used += iores->iocb_cnt; + qp->fwres.exch_used += iores->exch_cnt; + return 0; +diff --git a/drivers/scsi/qla2xxx/qla_iocb.c b/drivers/scsi/qla2xxx/qla_iocb.c +index 399ec8da2d73c..4f48f098ea5a6 100644 +--- a/drivers/scsi/qla2xxx/qla_iocb.c ++++ b/drivers/scsi/qla2xxx/qla_iocb.c +@@ -3817,6 +3817,65 @@ qla24xx_prlo_iocb(srb_t *sp, struct logio_entry_24xx *logio) + logio->vp_index = sp->fcport->vha->vp_idx; + } + ++int qla_get_iocbs_resource(struct srb *sp) ++{ ++ bool get_exch; ++ bool push_it_through = false; ++ ++ if (!ql2xenforce_iocb_limit) { ++ sp->iores.res_type = RESOURCE_NONE; ++ return 0; ++ } ++ sp->iores.res_type = RESOURCE_NONE; ++ ++ switch (sp->type) { ++ case SRB_TM_CMD: ++ case SRB_PRLI_CMD: ++ case SRB_ADISC_CMD: ++ push_it_through = true; ++ fallthrough; ++ case SRB_LOGIN_CMD: ++ case SRB_ELS_CMD_RPT: ++ case SRB_ELS_CMD_HST: ++ case SRB_ELS_CMD_HST_NOLOGIN: ++ case SRB_CT_CMD: ++ case SRB_NVME_LS: ++ case SRB_ELS_DCMD: ++ get_exch = true; ++ break; ++ ++ case SRB_FXIOCB_DCMD: ++ case SRB_FXIOCB_BCMD: ++ sp->iores.res_type = RESOURCE_NONE; ++ return 0; ++ ++ case SRB_SA_UPDATE: ++ case SRB_SA_REPLACE: ++ case SRB_MB_IOCB: ++ case SRB_ABT_CMD: ++ case SRB_NACK_PLOGI: ++ case SRB_NACK_PRLI: ++ case SRB_NACK_LOGO: ++ case SRB_LOGOUT_CMD: ++ case SRB_CTRL_VP: ++ push_it_through = true; ++ fallthrough; ++ default: ++ get_exch = false; ++ } ++ ++ sp->iores.res_type |= RESOURCE_IOCB; ++ sp->iores.iocb_cnt = 1; ++ if (get_exch) { ++ sp->iores.res_type |= RESOURCE_EXCH; ++ sp->iores.exch_cnt = 1; ++ } ++ if (push_it_through) ++ sp->iores.res_type |= RESOURCE_FORCE; ++ ++ return qla_get_fw_resources(sp->qpair, &sp->iores); ++} ++ + int + qla2x00_start_sp(srb_t *sp) + { +@@ -3831,6 +3890,12 @@ qla2x00_start_sp(srb_t *sp) + return -EIO; + + spin_lock_irqsave(qp->qp_lock_ptr, flags); ++ rval = qla_get_iocbs_resource(sp); ++ if (rval) { ++ spin_unlock_irqrestore(qp->qp_lock_ptr, flags); ++ return -EAGAIN; ++ } ++ + pkt = __qla2x00_alloc_iocbs(sp->qpair, sp); + if (!pkt) { + rval = EAGAIN; +@@ -3931,6 +3996,8 @@ qla2x00_start_sp(srb_t *sp) + wmb(); + qla2x00_start_iocbs(vha, qp->req); + done: ++ if (rval) ++ qla_put_fw_resources(sp->qpair, &sp->iores); + spin_unlock_irqrestore(qp->qp_lock_ptr, flags); + return rval; + } +diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c +index c545f39362ffc..5589251c87f0a 100644 +--- a/drivers/scsi/qla2xxx/qla_isr.c ++++ b/drivers/scsi/qla2xxx/qla_isr.c +@@ -3099,6 +3099,7 @@ qla25xx_process_bidir_status_iocb(scsi_qla_host_t *vha, void *pkt, + } + bsg_reply->reply_payload_rcv_len = 0; + ++ qla_put_fw_resources(sp->qpair, &sp->iores); + done: + /* Return the vendor specific reply to API */ + bsg_reply->reply_data.vendor_reply.vendor_rsp[0] = rval; +-- +2.39.2 + diff --git a/queue-5.15/scsi-qla2xxx-fix-exchange-oversubscription.patch b/queue-5.15/scsi-qla2xxx-fix-exchange-oversubscription.patch new file mode 100644 index 00000000000..0c7d4e1d221 --- /dev/null +++ b/queue-5.15/scsi-qla2xxx-fix-exchange-oversubscription.patch @@ -0,0 +1,384 @@ +From e6d56b00aa5d0f089c007a4e64af6dbe626ad47f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Dec 2022 03:07:41 -0800 +Subject: scsi: qla2xxx: Fix exchange oversubscription + +From: Quinn Tran + +[ Upstream commit 41e5afe51f75f2858f5563145348f6c26d307b8f ] + +In large environment, it is possible to experience command timeout and +escalation of path recovery. Currently the driver does not track the number +of exchanges/commands sent to FW. If there is a delay for commands at the +head of the queue, then this will create back pressure for commands at the +back of the queue. + +Check for exchange availability before command submission. + +Fixes: 89c72f4245a8 ("scsi: qla2xxx: Add IOCB resource tracking") +Signed-off-by: Quinn Tran +Signed-off-by: Nilesh Javali +Reviewed-by: Himanshu Madhani +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_def.h | 6 +++- + drivers/scsi/qla2xxx/qla_edif.c | 7 +++-- + drivers/scsi/qla2xxx/qla_init.c | 13 ++++++++ + drivers/scsi/qla2xxx/qla_inline.h | 52 +++++++++++++++++++++---------- + drivers/scsi/qla2xxx/qla_iocb.c | 28 ++++++++++------- + drivers/scsi/qla2xxx/qla_isr.c | 3 +- + drivers/scsi/qla2xxx/qla_nvme.c | 15 ++++++++- + 7 files changed, 88 insertions(+), 36 deletions(-) + +diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h +index 307ffdfe048be..5b499b0e2c867 100644 +--- a/drivers/scsi/qla2xxx/qla_def.h ++++ b/drivers/scsi/qla2xxx/qla_def.h +@@ -655,7 +655,7 @@ enum { + + struct iocb_resource { + u8 res_type; +- u8 pad; ++ u8 exch_cnt; + u16 iocb_cnt; + }; + +@@ -3707,6 +3707,10 @@ struct qla_fw_resources { + u16 iocbs_limit; + u16 iocbs_qp_limit; + u16 iocbs_used; ++ u16 exch_total; ++ u16 exch_limit; ++ u16 exch_used; ++ u16 pad; + }; + + #define QLA_IOCB_PCT_LIMIT 95 +diff --git a/drivers/scsi/qla2xxx/qla_edif.c b/drivers/scsi/qla2xxx/qla_edif.c +index a7e2118b3a841..f81cf85dcdc7b 100644 +--- a/drivers/scsi/qla2xxx/qla_edif.c ++++ b/drivers/scsi/qla2xxx/qla_edif.c +@@ -2899,9 +2899,10 @@ qla28xx_start_scsi_edif(srb_t *sp) + tot_dsds = nseg; + req_cnt = qla24xx_calc_iocbs(vha, tot_dsds); + +- sp->iores.res_type = RESOURCE_INI; ++ sp->iores.res_type = RESOURCE_IOCB | RESOURCE_EXCH; ++ sp->iores.exch_cnt = 1; + sp->iores.iocb_cnt = req_cnt; +- if (qla_get_iocbs(sp->qpair, &sp->iores)) ++ if (qla_get_fw_resources(sp->qpair, &sp->iores)) + goto queuing_error; + + if (req->cnt < (req_cnt + 2)) { +@@ -3095,7 +3096,7 @@ qla28xx_start_scsi_edif(srb_t *sp) + mempool_free(sp->u.scmd.ct6_ctx, ha->ctx_mempool); + sp->u.scmd.ct6_ctx = NULL; + } +- qla_put_iocbs(sp->qpair, &sp->iores); ++ qla_put_fw_resources(sp->qpair, &sp->iores); + spin_unlock_irqrestore(lock, flags); + + return QLA_FUNCTION_FAILED; +diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c +index 30798ab84db91..b61aa5a1a21dc 100644 +--- a/drivers/scsi/qla2xxx/qla_init.c ++++ b/drivers/scsi/qla2xxx/qla_init.c +@@ -128,12 +128,14 @@ static void qla24xx_abort_iocb_timeout(void *data) + sp->cmd_sp)) { + qpair->req->outstanding_cmds[handle] = NULL; + cmdsp_found = 1; ++ qla_put_fw_resources(qpair, &sp->cmd_sp->iores); + } + + /* removing the abort */ + if (qpair->req->outstanding_cmds[handle] == sp) { + qpair->req->outstanding_cmds[handle] = NULL; + sp_found = 1; ++ qla_put_fw_resources(qpair, &sp->iores); + break; + } + } +@@ -2002,6 +2004,7 @@ qla2x00_tmf_iocb_timeout(void *data) + for (h = 1; h < sp->qpair->req->num_outstanding_cmds; h++) { + if (sp->qpair->req->outstanding_cmds[h] == sp) { + sp->qpair->req->outstanding_cmds[h] = NULL; ++ qla_put_fw_resources(sp->qpair, &sp->iores); + break; + } + } +@@ -3945,6 +3948,12 @@ void qla_init_iocb_limit(scsi_qla_host_t *vha) + ha->base_qpair->fwres.iocbs_limit = limit; + ha->base_qpair->fwres.iocbs_qp_limit = limit / num_qps; + ha->base_qpair->fwres.iocbs_used = 0; ++ ++ ha->base_qpair->fwres.exch_total = ha->orig_fw_xcb_count; ++ ha->base_qpair->fwres.exch_limit = (ha->orig_fw_xcb_count * ++ QLA_IOCB_PCT_LIMIT) / 100; ++ ha->base_qpair->fwres.exch_used = 0; ++ + for (i = 0; i < ha->max_qpairs; i++) { + if (ha->queue_pair_map[i]) { + ha->queue_pair_map[i]->fwres.iocbs_total = +@@ -3953,6 +3962,10 @@ void qla_init_iocb_limit(scsi_qla_host_t *vha) + ha->queue_pair_map[i]->fwres.iocbs_qp_limit = + limit / num_qps; + ha->queue_pair_map[i]->fwres.iocbs_used = 0; ++ ha->queue_pair_map[i]->fwres.exch_total = ha->orig_fw_xcb_count; ++ ha->queue_pair_map[i]->fwres.exch_limit = ++ (ha->orig_fw_xcb_count * QLA_IOCB_PCT_LIMIT) / 100; ++ ha->queue_pair_map[i]->fwres.exch_used = 0; + } + } + } +diff --git a/drivers/scsi/qla2xxx/qla_inline.h b/drivers/scsi/qla2xxx/qla_inline.h +index 5185dc5daf80d..2d5a275d8b000 100644 +--- a/drivers/scsi/qla2xxx/qla_inline.h ++++ b/drivers/scsi/qla2xxx/qla_inline.h +@@ -380,13 +380,16 @@ qla2xxx_get_fc4_priority(struct scsi_qla_host *vha) + + enum { + RESOURCE_NONE, +- RESOURCE_INI, ++ RESOURCE_IOCB = BIT_0, ++ RESOURCE_EXCH = BIT_1, /* exchange */ ++ RESOURCE_FORCE = BIT_2, + }; + + static inline int +-qla_get_iocbs(struct qla_qpair *qp, struct iocb_resource *iores) ++qla_get_fw_resources(struct qla_qpair *qp, struct iocb_resource *iores) + { + u16 iocbs_used, i; ++ u16 exch_used; + struct qla_hw_data *ha = qp->vha->hw; + + if (!ql2xenforce_iocb_limit) { +@@ -394,10 +397,7 @@ qla_get_iocbs(struct qla_qpair *qp, struct iocb_resource *iores) + return 0; + } + +- if ((iores->iocb_cnt + qp->fwres.iocbs_used) < qp->fwres.iocbs_qp_limit) { +- qp->fwres.iocbs_used += iores->iocb_cnt; +- return 0; +- } else { ++ if ((iores->iocb_cnt + qp->fwres.iocbs_used) >= qp->fwres.iocbs_qp_limit) { + /* no need to acquire qpair lock. It's just rough calculation */ + iocbs_used = ha->base_qpair->fwres.iocbs_used; + for (i = 0; i < ha->max_qpairs; i++) { +@@ -405,30 +405,48 @@ qla_get_iocbs(struct qla_qpair *qp, struct iocb_resource *iores) + iocbs_used += ha->queue_pair_map[i]->fwres.iocbs_used; + } + +- if ((iores->iocb_cnt + iocbs_used) < qp->fwres.iocbs_limit) { +- qp->fwres.iocbs_used += iores->iocb_cnt; +- return 0; +- } else { ++ if ((iores->iocb_cnt + iocbs_used) >= qp->fwres.iocbs_limit) { ++ iores->res_type = RESOURCE_NONE; ++ return -ENOSPC; ++ } ++ } ++ ++ if (iores->res_type & RESOURCE_EXCH) { ++ exch_used = ha->base_qpair->fwres.exch_used; ++ for (i = 0; i < ha->max_qpairs; i++) { ++ if (ha->queue_pair_map[i]) ++ exch_used += ha->queue_pair_map[i]->fwres.exch_used; ++ } ++ ++ if ((exch_used + iores->exch_cnt) >= qp->fwres.exch_limit) { + iores->res_type = RESOURCE_NONE; + return -ENOSPC; + } + } ++ qp->fwres.iocbs_used += iores->iocb_cnt; ++ qp->fwres.exch_used += iores->exch_cnt; ++ return 0; + } + + static inline void +-qla_put_iocbs(struct qla_qpair *qp, struct iocb_resource *iores) ++qla_put_fw_resources(struct qla_qpair *qp, struct iocb_resource *iores) + { +- switch (iores->res_type) { +- case RESOURCE_NONE: +- break; +- default: ++ if (iores->res_type & RESOURCE_IOCB) { + if (qp->fwres.iocbs_used >= iores->iocb_cnt) { + qp->fwres.iocbs_used -= iores->iocb_cnt; + } else { +- // should not happen ++ /* should not happen */ + qp->fwres.iocbs_used = 0; + } +- break; ++ } ++ ++ if (iores->res_type & RESOURCE_EXCH) { ++ if (qp->fwres.exch_used >= iores->exch_cnt) { ++ qp->fwres.exch_used -= iores->exch_cnt; ++ } else { ++ /* should not happen */ ++ qp->fwres.exch_used = 0; ++ } + } + iores->res_type = RESOURCE_NONE; + } +diff --git a/drivers/scsi/qla2xxx/qla_iocb.c b/drivers/scsi/qla2xxx/qla_iocb.c +index 42ce4e1fe7441..399ec8da2d73c 100644 +--- a/drivers/scsi/qla2xxx/qla_iocb.c ++++ b/drivers/scsi/qla2xxx/qla_iocb.c +@@ -1589,9 +1589,10 @@ qla24xx_start_scsi(srb_t *sp) + tot_dsds = nseg; + req_cnt = qla24xx_calc_iocbs(vha, tot_dsds); + +- sp->iores.res_type = RESOURCE_INI; ++ sp->iores.res_type = RESOURCE_IOCB | RESOURCE_EXCH; ++ sp->iores.exch_cnt = 1; + sp->iores.iocb_cnt = req_cnt; +- if (qla_get_iocbs(sp->qpair, &sp->iores)) ++ if (qla_get_fw_resources(sp->qpair, &sp->iores)) + goto queuing_error; + + if (req->cnt < (req_cnt + 2)) { +@@ -1678,7 +1679,7 @@ qla24xx_start_scsi(srb_t *sp) + if (tot_dsds) + scsi_dma_unmap(cmd); + +- qla_put_iocbs(sp->qpair, &sp->iores); ++ qla_put_fw_resources(sp->qpair, &sp->iores); + spin_unlock_irqrestore(&ha->hardware_lock, flags); + + return QLA_FUNCTION_FAILED; +@@ -1793,9 +1794,10 @@ qla24xx_dif_start_scsi(srb_t *sp) + tot_prot_dsds = nseg; + tot_dsds += nseg; + +- sp->iores.res_type = RESOURCE_INI; ++ sp->iores.res_type = RESOURCE_IOCB | RESOURCE_EXCH; ++ sp->iores.exch_cnt = 1; + sp->iores.iocb_cnt = qla24xx_calc_iocbs(vha, tot_dsds); +- if (qla_get_iocbs(sp->qpair, &sp->iores)) ++ if (qla_get_fw_resources(sp->qpair, &sp->iores)) + goto queuing_error; + + if (req->cnt < (req_cnt + 2)) { +@@ -1883,7 +1885,7 @@ qla24xx_dif_start_scsi(srb_t *sp) + } + /* Cleanup will be performed by the caller (queuecommand) */ + +- qla_put_iocbs(sp->qpair, &sp->iores); ++ qla_put_fw_resources(sp->qpair, &sp->iores); + spin_unlock_irqrestore(&ha->hardware_lock, flags); + + return QLA_FUNCTION_FAILED; +@@ -1952,9 +1954,10 @@ qla2xxx_start_scsi_mq(srb_t *sp) + tot_dsds = nseg; + req_cnt = qla24xx_calc_iocbs(vha, tot_dsds); + +- sp->iores.res_type = RESOURCE_INI; ++ sp->iores.res_type = RESOURCE_IOCB | RESOURCE_EXCH; ++ sp->iores.exch_cnt = 1; + sp->iores.iocb_cnt = req_cnt; +- if (qla_get_iocbs(sp->qpair, &sp->iores)) ++ if (qla_get_fw_resources(sp->qpair, &sp->iores)) + goto queuing_error; + + if (req->cnt < (req_cnt + 2)) { +@@ -2041,7 +2044,7 @@ qla2xxx_start_scsi_mq(srb_t *sp) + if (tot_dsds) + scsi_dma_unmap(cmd); + +- qla_put_iocbs(sp->qpair, &sp->iores); ++ qla_put_fw_resources(sp->qpair, &sp->iores); + spin_unlock_irqrestore(&qpair->qp_lock, flags); + + return QLA_FUNCTION_FAILED; +@@ -2171,9 +2174,10 @@ qla2xxx_dif_start_scsi_mq(srb_t *sp) + tot_prot_dsds = nseg; + tot_dsds += nseg; + +- sp->iores.res_type = RESOURCE_INI; ++ sp->iores.res_type = RESOURCE_IOCB | RESOURCE_EXCH; ++ sp->iores.exch_cnt = 1; + sp->iores.iocb_cnt = qla24xx_calc_iocbs(vha, tot_dsds); +- if (qla_get_iocbs(sp->qpair, &sp->iores)) ++ if (qla_get_fw_resources(sp->qpair, &sp->iores)) + goto queuing_error; + + if (req->cnt < (req_cnt + 2)) { +@@ -2260,7 +2264,7 @@ qla2xxx_dif_start_scsi_mq(srb_t *sp) + } + /* Cleanup will be performed by the caller (queuecommand) */ + +- qla_put_iocbs(sp->qpair, &sp->iores); ++ qla_put_fw_resources(sp->qpair, &sp->iores); + spin_unlock_irqrestore(&qpair->qp_lock, flags); + + return QLA_FUNCTION_FAILED; +diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c +index 59f5918dca95f..c545f39362ffc 100644 +--- a/drivers/scsi/qla2xxx/qla_isr.c ++++ b/drivers/scsi/qla2xxx/qla_isr.c +@@ -3184,7 +3184,7 @@ qla2x00_status_entry(scsi_qla_host_t *vha, struct rsp_que *rsp, void *pkt) + } + return; + } +- qla_put_iocbs(sp->qpair, &sp->iores); ++ qla_put_fw_resources(sp->qpair, &sp->iores); + + if (sp->cmd_type != TYPE_SRB) { + req->outstanding_cmds[handle] = NULL; +@@ -3605,7 +3605,6 @@ qla2x00_error_entry(scsi_qla_host_t *vha, struct rsp_que *rsp, sts_entry_t *pkt) + default: + sp = qla2x00_get_sp_from_handle(vha, func, req, pkt); + if (sp) { +- qla_put_iocbs(sp->qpair, &sp->iores); + sp->done(sp, res); + return 0; + } +diff --git a/drivers/scsi/qla2xxx/qla_nvme.c b/drivers/scsi/qla2xxx/qla_nvme.c +index 3e167dc4eec72..b66e19a8545c9 100644 +--- a/drivers/scsi/qla2xxx/qla_nvme.c ++++ b/drivers/scsi/qla2xxx/qla_nvme.c +@@ -438,13 +438,24 @@ static inline int qla2x00_start_nvme_mq(srb_t *sp) + goto queuing_error; + } + req_cnt = qla24xx_calc_iocbs(vha, tot_dsds); ++ ++ sp->iores.res_type = RESOURCE_IOCB | RESOURCE_EXCH; ++ sp->iores.exch_cnt = 1; ++ sp->iores.iocb_cnt = req_cnt; ++ if (qla_get_fw_resources(sp->qpair, &sp->iores)) { ++ rval = -EBUSY; ++ goto queuing_error; ++ } ++ + if (req->cnt < (req_cnt + 2)) { + if (IS_SHADOW_REG_CAPABLE(ha)) { + cnt = *req->out_ptr; + } else { + cnt = rd_reg_dword_relaxed(req->req_q_out); +- if (qla2x00_check_reg16_for_disconnect(vha, cnt)) ++ if (qla2x00_check_reg16_for_disconnect(vha, cnt)) { ++ rval = -EBUSY; + goto queuing_error; ++ } + } + + if (req->ring_index < cnt) +@@ -589,6 +600,8 @@ static inline int qla2x00_start_nvme_mq(srb_t *sp) + wrt_reg_dword(req->req_q_in, req->ring_index); + + queuing_error: ++ if (rval) ++ qla_put_fw_resources(sp->qpair, &sp->iores); + spin_unlock_irqrestore(&qpair->qp_lock, flags); + + return rval; +-- +2.39.2 + diff --git a/queue-5.15/scsi-snic-fix-memory-leak-with-using-debugfs_lookup.patch b/queue-5.15/scsi-snic-fix-memory-leak-with-using-debugfs_lookup.patch new file mode 100644 index 00000000000..3efc974debf --- /dev/null +++ b/queue-5.15/scsi-snic-fix-memory-leak-with-using-debugfs_lookup.patch @@ -0,0 +1,44 @@ +From 5af32f2e5fd6a75d7cd3d237cb25722dd51a144b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Feb 2023 15:10:09 +0100 +Subject: scsi: snic: Fix memory leak with using debugfs_lookup() + +From: Greg Kroah-Hartman + +[ Upstream commit ad0e4e2fab928477f74d742e6e77d79245d3d3e7 ] + +When calling debugfs_lookup() the result must have dput() called on it, +otherwise the memory will leak over time. To make things simpler, just +call debugfs_lookup_and_remove() instead which handles all of the logic at +once. + +Link: https://lore.kernel.org/r/20230202141009.2290380-1-gregkh@linuxfoundation.org +Cc: Karan Tilak Kumar +Cc: Sesidhar Baddela +Cc: "James E.J. Bottomley" +Cc: "Martin K. Petersen" +Cc: linux-scsi@vger.kernel.org +Cc: linux-kernel@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/snic/snic_debugfs.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/snic/snic_debugfs.c b/drivers/scsi/snic/snic_debugfs.c +index 5e0faeba516e5..76baa4f9a06e3 100644 +--- a/drivers/scsi/snic/snic_debugfs.c ++++ b/drivers/scsi/snic/snic_debugfs.c +@@ -451,6 +451,6 @@ void snic_trc_debugfs_init(void) + void + snic_trc_debugfs_term(void) + { +- debugfs_remove(debugfs_lookup(TRC_FILE, snic_glob->trc_root)); +- debugfs_remove(debugfs_lookup(TRC_ENABLE_FILE, snic_glob->trc_root)); ++ debugfs_lookup_and_remove(TRC_FILE, snic_glob->trc_root); ++ debugfs_lookup_and_remove(TRC_ENABLE_FILE, snic_glob->trc_root); + } +-- +2.39.2 + diff --git a/queue-5.15/sefltests-netdevsim-wait-for-devlink-instance-after-.patch b/queue-5.15/sefltests-netdevsim-wait-for-devlink-instance-after-.patch new file mode 100644 index 00000000000..15744353b78 --- /dev/null +++ b/queue-5.15/sefltests-netdevsim-wait-for-devlink-instance-after-.patch @@ -0,0 +1,75 @@ +From e5964318f04973cf6559b2b988b46cc8dfe2b0e3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Feb 2023 14:23:36 +0100 +Subject: sefltests: netdevsim: wait for devlink instance after netns removal + +From: Jiri Pirko + +[ Upstream commit f922c7b1c1c45740d329bf248936fdb78c0cff6e ] + +When devlink instance is put into network namespace and that network +namespace gets deleted, devlink instance is moved back into init_ns. +This is done as a part of cleanup_net() routine. Since cleanup_net() +is called asynchronously from workqueue, there is no guarantee that +the devlink instance move is done after "ip netns del" returns. + +So fix this race by making sure that the devlink instance is present +before any other operation. + +Reported-by: Amir Tzin +Fixes: b74c37fd35a2 ("selftests: netdevsim: add tests for devlink reload with resources") +Signed-off-by: Jiri Pirko +Reviewed-by: Pavan Chebbi +Link: https://lore.kernel.org/r/20230220132336.198597-1-jiri@resnulli.us +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + .../selftests/drivers/net/netdevsim/devlink.sh | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) + +diff --git a/tools/testing/selftests/drivers/net/netdevsim/devlink.sh b/tools/testing/selftests/drivers/net/netdevsim/devlink.sh +index a08c02abde121..7f7d20f222070 100755 +--- a/tools/testing/selftests/drivers/net/netdevsim/devlink.sh ++++ b/tools/testing/selftests/drivers/net/netdevsim/devlink.sh +@@ -17,6 +17,18 @@ SYSFS_NET_DIR=/sys/bus/netdevsim/devices/$DEV_NAME/net/ + DEBUGFS_DIR=/sys/kernel/debug/netdevsim/$DEV_NAME/ + DL_HANDLE=netdevsim/$DEV_NAME + ++wait_for_devlink() ++{ ++ "$@" | grep -q $DL_HANDLE ++} ++ ++devlink_wait() ++{ ++ local timeout=$1 ++ ++ busywait "$timeout" wait_for_devlink devlink dev ++} ++ + fw_flash_test() + { + RET=0 +@@ -256,6 +268,9 @@ netns_reload_test() + ip netns del testns2 + ip netns del testns1 + ++ # Wait until netns async cleanup is done. ++ devlink_wait 2000 ++ + log_test "netns reload test" + } + +@@ -348,6 +363,9 @@ resource_test() + ip netns del testns2 + ip netns del testns1 + ++ # Wait until netns async cleanup is done. ++ devlink_wait 2000 ++ + log_test "resource test" + } + +-- +2.39.2 + diff --git a/queue-5.15/selftest-fib_tests-always-cleanup-before-exit.patch b/queue-5.15/selftest-fib_tests-always-cleanup-before-exit.patch new file mode 100644 index 00000000000..bb97acdc52c --- /dev/null +++ b/queue-5.15/selftest-fib_tests-always-cleanup-before-exit.patch @@ -0,0 +1,42 @@ +From b22506afe965a7113cf0aaa1ecfaadbd11ae419e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Feb 2023 12:04:00 +0100 +Subject: selftest: fib_tests: Always cleanup before exit + +From: Roxana Nicolescu + +[ Upstream commit b60417a9f2b890a8094477b2204d4f73c535725e ] + +Usage of `set -e` before executing a command causes immediate exit +on failure, without cleanup up the resources allocated at setup. +This can affect the next tests that use the same resources, +leading to a chain of failures. + +A simple fix is to always call cleanup function when the script exists. +This approach is already used by other existing tests. + +Fixes: 1056691b2680 ("selftests: fib_tests: Make test results more verbose") +Signed-off-by: Roxana Nicolescu +Link: https://lore.kernel.org/r/20230220110400.26737-2-roxana.nicolescu@canonical.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/net/fib_tests.sh | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/tools/testing/selftests/net/fib_tests.sh b/tools/testing/selftests/net/fib_tests.sh +index 7df066bf74b87..c64b0b1217621 100755 +--- a/tools/testing/selftests/net/fib_tests.sh ++++ b/tools/testing/selftests/net/fib_tests.sh +@@ -1921,6 +1921,8 @@ EOF + ################################################################################ + # main + ++trap cleanup EXIT ++ + while getopts :t:pPhv o + do + case $o in +-- +2.39.2 + diff --git a/queue-5.15/selftests-bpf-fix-out-of-srctree-build.patch b/queue-5.15/selftests-bpf-fix-out-of-srctree-build.patch new file mode 100644 index 00000000000..3ec96d7085d --- /dev/null +++ b/queue-5.15/selftests-bpf-fix-out-of-srctree-build.patch @@ -0,0 +1,49 @@ +From 46202f180f867a9304c0647d131ab4b6b92b1f9f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Feb 2023 00:12:11 +0100 +Subject: selftests/bpf: Fix out-of-srctree build + +From: Ilya Leoshkevich + +[ Upstream commit 0b0757244754ea1d0721195c824770f5576e119e ] + +Building BPF selftests out of srctree fails with: + + make: *** No rule to make target '/linux-build//ima_setup.sh', needed by 'ima_setup.sh'. Stop. + +The culprit is the rule that defines convenient shorthands like +"make test_progs", which builds $(OUTPUT)/test_progs. These shorthands +make sense only for binaries that are built though; scripts that live +in the source tree do not end up in $(OUTPUT). + +Therefore drop $(TEST_PROGS) and $(TEST_PROGS_EXTENDED) from the rule. + +The issue exists for a while, but it became a problem only after commit +d68ae4982cb7 ("selftests/bpf: Install all required files to run selftests"), +which added dependencies on these scripts. + +Fixes: 03dcb78460c2 ("selftests/bpf: Add simple per-test targets to Makefile") +Signed-off-by: Ilya Leoshkevich +Signed-off-by: Daniel Borkmann +Link: https://lore.kernel.org/bpf/20230208231211.283606-1-iii@linux.ibm.com +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/Makefile | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/tools/testing/selftests/bpf/Makefile b/tools/testing/selftests/bpf/Makefile +index 638966ae8ad97..0d845a0c8599a 100644 +--- a/tools/testing/selftests/bpf/Makefile ++++ b/tools/testing/selftests/bpf/Makefile +@@ -144,8 +144,6 @@ endif + # NOTE: Semicolon at the end is critical to override lib.mk's default static + # rule for binaries. + $(notdir $(TEST_GEN_PROGS) \ +- $(TEST_PROGS) \ +- $(TEST_PROGS_EXTENDED) \ + $(TEST_GEN_PROGS_EXTENDED) \ + $(TEST_CUSTOM_PROGS)): %: $(OUTPUT)/% ; + +-- +2.39.2 + diff --git a/queue-5.15/selftests-ftrace-fix-bash-specific-operator.patch b/queue-5.15/selftests-ftrace-fix-bash-specific-operator.patch new file mode 100644 index 00000000000..c2331ae04d2 --- /dev/null +++ b/queue-5.15/selftests-ftrace-fix-bash-specific-operator.patch @@ -0,0 +1,44 @@ +From 5d4f2b25ab40acae70e1c92d3fd5c2c4cdd125a6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 22 Jan 2023 08:32:50 +0900 +Subject: selftests/ftrace: Fix bash specific "==" operator + +From: Masami Hiramatsu (Google) + +[ Upstream commit 1e6b485c922fbedf41d5a9f4e6449c5aeb923a32 ] + +Since commit a1d6cd88c897 ("selftests/ftrace: event_triggers: wait +longer for test_event_enable") introduced bash specific "==" +comparation operator, that test will fail when we run it on a +posix-shell. `checkbashisms` warned it as below. + +possible bashism in ftrace/func_event_triggers.tc line 45 (should be 'b = a'): + if [ "$e" == $val ]; then + +This replaces it with "=". + +Fixes: a1d6cd88c897 ("selftests/ftrace: event_triggers: wait longer for test_event_enable") +Signed-off-by: Masami Hiramatsu (Google) +Reviewed-by: Steven Rostedt (Google) +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + .../selftests/ftrace/test.d/ftrace/func_event_triggers.tc | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/ftrace/test.d/ftrace/func_event_triggers.tc b/tools/testing/selftests/ftrace/test.d/ftrace/func_event_triggers.tc +index 27a68bbe778be..d9b8127950771 100644 +--- a/tools/testing/selftests/ftrace/test.d/ftrace/func_event_triggers.tc ++++ b/tools/testing/selftests/ftrace/test.d/ftrace/func_event_triggers.tc +@@ -42,7 +42,7 @@ test_event_enabled() { + + while [ $check_times -ne 0 ]; do + e=`cat $EVENT_ENABLE` +- if [ "$e" == $val ]; then ++ if [ "$e" = $val ]; then + return 0 + fi + sleep $SLEEP_TIME +-- +2.39.2 + diff --git a/queue-5.15/selftests-net-interpret-udp_gro-cmsg-data-as-an-int-.patch b/queue-5.15/selftests-net-interpret-udp_gro-cmsg-data-as-an-int-.patch new file mode 100644 index 00000000000..7ac724e2c41 --- /dev/null +++ b/queue-5.15/selftests-net-interpret-udp_gro-cmsg-data-as-an-int-.patch @@ -0,0 +1,66 @@ +From cd124bc2f767bd41e3b83f8fc454c7d2d5c8256a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Feb 2023 13:43:40 +0100 +Subject: selftests/net: Interpret UDP_GRO cmsg data as an int value + +From: Jakub Sitnicki + +[ Upstream commit 436864095a95fcc611c20c44a111985fa9848730 ] + +Data passed to user-space with a (SOL_UDP, UDP_GRO) cmsg carries an +int (see udp_cmsg_recv), not a u16 value, as strace confirms: + + recvmsg(8, {msg_name=..., + msg_iov=[{iov_base="\0\0..."..., iov_len=96000}], + msg_iovlen=1, + msg_control=[{cmsg_len=20, <-- sizeof(cmsghdr) + 4 + cmsg_level=SOL_UDP, + cmsg_type=0x68}], <-- UDP_GRO + msg_controllen=24, + msg_flags=0}, 0) = 11200 + +Interpreting the data as an u16 value won't work on big-endian platforms. +Since it is too late to back out of this API decision [1], fix the test. + +[1]: https://lore.kernel.org/netdev/20230131174601.203127-1-jakub@cloudflare.com/ + +Fixes: 3327a9c46352 ("selftests: add functionals test for UDP GRO") +Suggested-by: Eric Dumazet +Signed-off-by: Jakub Sitnicki +Reviewed-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/net/udpgso_bench_rx.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/tools/testing/selftests/net/udpgso_bench_rx.c b/tools/testing/selftests/net/udpgso_bench_rx.c +index 4058c7451e70d..f35a924d4a303 100644 +--- a/tools/testing/selftests/net/udpgso_bench_rx.c ++++ b/tools/testing/selftests/net/udpgso_bench_rx.c +@@ -214,11 +214,10 @@ static void do_verify_udp(const char *data, int len) + + static int recv_msg(int fd, char *buf, int len, int *gso_size) + { +- char control[CMSG_SPACE(sizeof(uint16_t))] = {0}; ++ char control[CMSG_SPACE(sizeof(int))] = {0}; + struct msghdr msg = {0}; + struct iovec iov = {0}; + struct cmsghdr *cmsg; +- uint16_t *gsosizeptr; + int ret; + + iov.iov_base = buf; +@@ -237,8 +236,7 @@ static int recv_msg(int fd, char *buf, int len, int *gso_size) + cmsg = CMSG_NXTHDR(&msg, cmsg)) { + if (cmsg->cmsg_level == SOL_UDP + && cmsg->cmsg_type == UDP_GRO) { +- gsosizeptr = (uint16_t *) CMSG_DATA(cmsg); +- *gso_size = *gsosizeptr; ++ *gso_size = *(int *)CMSG_DATA(cmsg); + break; + } + } +-- +2.39.2 + diff --git a/queue-5.15/serial-fsl_lpuart-fix-rs485-rts-polariy-inverse-issu.patch b/queue-5.15/serial-fsl_lpuart-fix-rs485-rts-polariy-inverse-issu.patch new file mode 100644 index 00000000000..a95d7165730 --- /dev/null +++ b/queue-5.15/serial-fsl_lpuart-fix-rs485-rts-polariy-inverse-issu.patch @@ -0,0 +1,45 @@ +From 7c9075294f8dc4ff60fa5dacdc0aaa1826b46414 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Feb 2023 10:24:20 -0600 +Subject: serial: fsl_lpuart: fix RS485 RTS polariy inverse issue + +From: Shenwei Wang + +[ Upstream commit 3957b9501a5a8fa709ae4a47483714491471f6db ] + +The previous 'commit 846651eca073 ("serial: fsl_lpuart: RS485 RTS +polariy is inverse")' only fixed the inverse issue on lpuart 8bit +platforms. + +This is a follow-up patch to fix the RS485 polarity inverse +issue on lpuart 32bit platforms. + +Fixes: 03895cf41d18 ("tty: serial: fsl_lpuart: Add support for RS-485") +Reported-by: Sherry Sun +Signed-off-by: Shenwei Wang +Link: https://lore.kernel.org/r/20230207162420.3647904-1-shenwei.wang@nxp.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/fsl_lpuart.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c +index 08096d33af8a6..f4d9dc4648da4 100644 +--- a/drivers/tty/serial/fsl_lpuart.c ++++ b/drivers/tty/serial/fsl_lpuart.c +@@ -1406,9 +1406,9 @@ static int lpuart32_config_rs485(struct uart_port *port, + * Note: UART is assumed to be active high. + */ + if (rs485->flags & SER_RS485_RTS_ON_SEND) +- modem &= ~UARTMODEM_TXRTSPOL; +- else if (rs485->flags & SER_RS485_RTS_AFTER_SEND) + modem |= UARTMODEM_TXRTSPOL; ++ else if (rs485->flags & SER_RS485_RTS_AFTER_SEND) ++ modem &= ~UARTMODEM_TXRTSPOL; + } + + /* Store the new configuration */ +-- +2.39.2 + diff --git a/queue-5.15/serial-tegra-add-missing-clk_disable_unprepare-in-te.patch b/queue-5.15/serial-tegra-add-missing-clk_disable_unprepare-in-te.patch new file mode 100644 index 00000000000..182a40c5de5 --- /dev/null +++ b/queue-5.15/serial-tegra-add-missing-clk_disable_unprepare-in-te.patch @@ -0,0 +1,63 @@ +From 3ba1fd537bf407f9b861c5e34353110a0a89caf3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 26 Nov 2022 10:08:52 +0800 +Subject: serial: tegra: Add missing clk_disable_unprepare() in + tegra_uart_hw_init() + +From: Yi Yang + +[ Upstream commit 38f28cfe9d08e3a47ef008798b275fef8118fc20 ] + +Add the missing clk_disable_unprepare() before return from +tegra_uart_hw_init() in the error handling path. +When request_irq() fails in tegra_uart_startup(), 'tup->uart_clk' +has been enabled, fix it by adding clk_disable_unprepare(). + +Fixes: cc9ca4d95846 ("serial: tegra: Only print FIFO error message when an error occurs") +Fixes: d781ec21bae6 ("serial: tegra: report clk rate errors") +Signed-off-by: Yi Yang +Link: https://lore.kernel.org/r/20221126020852.113378-1-yiyang13@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/serial-tegra.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/tty/serial/serial-tegra.c b/drivers/tty/serial/serial-tegra.c +index 79187ff9ac131..25f34f86a0852 100644 +--- a/drivers/tty/serial/serial-tegra.c ++++ b/drivers/tty/serial/serial-tegra.c +@@ -1047,6 +1047,7 @@ static int tegra_uart_hw_init(struct tegra_uart_port *tup) + if (tup->cdata->fifo_mode_enable_status) { + ret = tegra_uart_wait_fifo_mode_enabled(tup); + if (ret < 0) { ++ clk_disable_unprepare(tup->uart_clk); + dev_err(tup->uport.dev, + "Failed to enable FIFO mode: %d\n", ret); + return ret; +@@ -1068,6 +1069,7 @@ static int tegra_uart_hw_init(struct tegra_uart_port *tup) + */ + ret = tegra_set_baudrate(tup, TEGRA_UART_DEFAULT_BAUD); + if (ret < 0) { ++ clk_disable_unprepare(tup->uart_clk); + dev_err(tup->uport.dev, "Failed to set baud rate\n"); + return ret; + } +@@ -1227,10 +1229,13 @@ static int tegra_uart_startup(struct uart_port *u) + dev_name(u->dev), tup); + if (ret < 0) { + dev_err(u->dev, "Failed to register ISR for IRQ %d\n", u->irq); +- goto fail_hw_init; ++ goto fail_request_irq; + } + return 0; + ++fail_request_irq: ++ /* tup->uart_clk is already enabled in tegra_uart_hw_init */ ++ clk_disable_unprepare(tup->uart_clk); + fail_hw_init: + if (!tup->use_rx_pio) + tegra_uart_dma_channel_free(tup, true); +-- +2.39.2 + diff --git a/queue-5.15/series b/queue-5.15/series index 5c7ab7bf849..80307cdb55f 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -1,3 +1,430 @@ hid-asus-use-spinlock-to-protect-concurrent-accesses.patch hid-asus-use-spinlock-to-safely-schedule-workers.patch powerpc-mm-rearrange-if-else-block-to-avoid-clang-warning.patch +arm-omap2-fix-memory-leak-in-realtime_counter_init.patch +arm64-dts-qcom-qcs404-use-symbol-names-for-pcie-rese.patch +arm64-dts-qcom-msm8996-tone-fix-usb-taking-6-minutes.patch +arm64-dts-qcom-sm8150-kumano-panel-framebuffer-is-2..patch +arm64-dts-qcom-sm6125-reorder-hsusb-phy-clocks-to-ma.patch +arm64-dts-imx8m-align-soc-unique-id-node-unit-addres.patch +arm-zynq-fix-refcount-leak-in-zynq_early_slcr_init.patch +arm64-dts-mediatek-mt8183-fix-systimer-13-mhz-clock-.patch +arm64-dts-qcom-sdm845-db845c-fix-audio-codec-interru.patch +arm64-dts-qcom-sc7180-correct-spmi-bus-address-cells.patch +arm64-dts-qcom-sc7280-correct-spmi-bus-address-cells.patch +arm64-dts-meson-gx-fix-ethernet-mac-address-unit-nam.patch +arm64-dts-meson-g12a-fix-internal-ethernet-phy-unit-.patch +arm64-dts-meson-gx-fix-the-scpi-dvfs-node-name-and-u.patch +arm64-dts-msm8992-bullhead-add-memory-hole-region.patch +arm64-dts-qcom-msm8992-bullhead-fix-cont_splash_mem-.patch +arm64-dts-qcom-msm8992-bullhead-disable-dfps_data_me.patch +arm64-dts-qcom-ipq8074-correct-usb3-qmp-phy-s-clock-.patch +arm64-dts-qcom-fix-ipq8074-pcie-phy-nodes.patch +arm64-dts-qcom-ipq8074-fix-pcie-phy-serdes-size.patch +arm64-dts-qcom-ipq8074-fix-gen3-pcie-qmp-phy.patch +arm64-dts-qcom-ipq8074-correct-gen2-pcie-ranges.patch +arm64-dts-qcom-ipq8074-fix-gen3-pcie-node.patch +arm64-dts-qcom-ipq8074-correct-pcie-qmp-phy-output-c.patch +arm64-dts-meson-remove-cpu-opps-below-1ghz-for-g12a-.patch +arm-omap1-call-platform_device_put-in-error-case-in-.patch +arm-bcm2835_defconfig-enable-the-framebuffer.patch +arm-s3c-fix-s3c64xx_set_timer_source-prototype.patch +arm64-dts-ti-k3-j7200-fix-wakeup-pinmux-range.patch +arm-dts-exynos-correct-wr-active-property-in-exynos3.patch +arm-imx-call-ida_simple_remove-for-ida_simple_get.patch +arm64-dts-amlogic-meson-gx-fix-scpi-clock-dvfs-node-.patch +arm64-dts-amlogic-meson-axg-fix-scpi-clock-dvfs-node.patch +arm64-dts-amlogic-meson-gx-add-missing-scpi-sensors-.patch +arm64-dts-amlogic-meson-gxl-s905d-sml5442tw-drop-inv.patch +arm64-dts-amlogic-meson-gx-add-missing-unit-address-.patch +arm64-dts-amlogic-meson-gxl-add-missing-unit-address.patch +arm64-dts-amlogic-meson-gx-libretech-pc-fix-update-b.patch +arm64-dts-amlogic-meson-sm1-bananapi-m5-fix-adc-keys.patch +arm64-dts-amlogic-meson-gxl-s905d-phicomm-n1-fix-led.patch +arm64-dts-amlogic-meson-gxbb-kii-pro-fix-led-node-na.patch +arm64-dts-amlogic-meson-sm1-odroid-hc4-fix-active-fa.patch +locking-rwsem-optimize-down_read_trylock-under-highl.patch +locking-rwsem-disable-preemption-in-all-down_read-an.patch +arm64-dts-renesas-beacon-renesom-fix-gpio-expander-r.patch +arm64-dts-meson-bananapi-m5-switch-vddio_c-pin-to-op.patch +arm-dts-sun8i-nanopi-duo2-fix-regulator-gpio-referen.patch +arm-dts-imx7s-correct-iomuxc-gpr-mux-controller-cell.patch +arm64-dts-mt8192-fix-cpu-map-for-single-cluster-soc.patch +arm64-dts-mediatek-mt7622-add-missing-pwm-cells-to-p.patch +blk-mq-avoid-sleep-in-blk_mq_alloc_request_hctx.patch +blk-mq-remove-stale-comment-for-blk_mq_sched_mark_re.patch +blk-mq-correct-stale-comment-of-.get_budget.patch +arm64-dts-qcom-msm8992-lg-bullhead-correct-memory-ov.patch +s390-dasd-fix-potential-memleak-in-dasd_eckd_init.patch +sched-deadline-rt-remove-unused-parameter-from-pick_.patch +sched-rt-pick_next_rt_entity-check-list_entry.patch +x86-perf-zhaoxin-add-stepping-check-for-zxc.patch +keys-asymmetric-fix-ecdsa-use-via-keyctl-uapi.patch +arm64-dts-qcom-pmk8350-specify-pbs-register-for-pon.patch +arm64-dts-qcom-pmk8350-use-the-correct-pon-compatibl.patch +block-bio-integrity-copy-flags-when-bio_integrity_pa.patch +wifi-rsi-fix-memory-leak-in-rsi_coex_attach.patch +wifi-rtlwifi-rtl8821ae-don-t-call-kfree_skb-under-sp.patch +wifi-rtlwifi-rtl8188ee-don-t-call-kfree_skb-under-sp.patch +wifi-rtlwifi-rtl8723be-don-t-call-kfree_skb-under-sp.patch +wifi-iwlegacy-common-don-t-call-dev_kfree_skb-under-.patch +wifi-libertas-fix-memory-leak-in-lbs_init_adapter.patch +wifi-rtl8xxxu-don-t-call-dev_kfree_skb-under-spin_lo.patch +wifi-rtlwifi-fix-global-out-of-bounds-bug-in-_rtl881.patch +libbpf-fix-btf__align_of-by-taking-into-account-fiel.patch +wifi-ipw2x00-don-t-call-dev_kfree_skb-under-spin_loc.patch +wifi-ipw2200-fix-memory-leak-in-ipw_wdev_init.patch +wifi-wilc1000-fix-potential-memory-leak-in-wilc_mac_.patch +wifi-brcmfmac-fix-potential-memory-leak-in-brcmf_net.patch +wifi-brcmfmac-unmap-dma-buffer-in-brcmf_msgbuf_alloc.patch +wifi-libertas_tf-don-t-call-kfree_skb-under-spin_loc.patch +wifi-libertas-if_usb-don-t-call-kfree_skb-under-spin.patch +wifi-libertas-main-don-t-call-kfree_skb-under-spin_l.patch +wifi-libertas-cmdresp-don-t-call-kfree_skb-under-spi.patch +wifi-wl3501_cs-don-t-call-kfree_skb-under-spin_lock_.patch +crypto-x86-ghash-fix-unaligned-access-in-ghash_setke.patch +acpica-drop-port-i-o-validation-for-some-regions.patch +genirq-fix-the-return-type-of-kstat_cpu_irqs_sum.patch +rcu-tasks-improve-comments-explaining-tasks_rcu_exit.patch +rcu-tasks-remove-preemption-disablement-around-srcu_.patch +rcu-tasks-fix-synchronize_rcu_tasks-vs-zap_pid_ns_pr.patch +lib-mpi-fix-buffer-overrun-when-sg-is-too-long.patch +crypto-ccp-avoid-page-allocation-failure-warning-for.patch +acpica-nsrepair-handle-cases-without-a-return-value-.patch +thermal-drivers-tsens-drop-msm8976-specific-defines.patch +thermal-drivers-tsens-add-compat-string-for-the-qcom.patch +thermal-drivers-tsens-sort-out-msm8976-vs-msm8956-da.patch +thermal-drivers-tsens-fix-slope-values-for-msm8939.patch +thermal-drivers-tsens-limit-num_sensors-to-9-for-msm.patch +wifi-rtl8xxxu-fix-memory-leaks-with-rtl8723bu-rtl819.patch +wifi-orinoco-check-return-value-of-hermes_write_word.patch +wifi-ath9k-htc_hst-free-skb-in-ath9k_htc_rx_msg-if-t.patch +ath9k-hif_usb-simplify-if-if-to-if-else.patch +ath9k-htc-clean-up-statistics-macros.patch +wifi-ath9k-hif_usb-clean-up-skbs-if-ath9k_hif_usb_rx.patch +wifi-ath9k-fix-potential-stack-out-of-bounds-write-i.patch +wifi-ath11k-fix-memory-leak-in-ath11k_peer_rx_frag_s.patch +wifi-cfg80211-fix-extended-kck-key-length-check-in-n.patch +acpi-battery-fix-missing-nul-termination-with-large-.patch +crypto-ccp-failure-on-re-initialization-due-to-dupli.patch +crypto-essiv-handle-ebusy-correctly.patch +crypto-seqiv-handle-ebusy-correctly.patch +powercap-fix-possible-name-leak-in-powercap_register.patch +x86-mark-stop_this_cpu-__noreturn.patch +x86-microcode-rip-out-the-old_interface.patch +x86-microcode-default-disable-late-loading.patch +x86-microcode-print-previous-version-of-microcode-af.patch +x86-microcode-add-a-parameter-to-microcode_check-to-.patch +x86-microcode-check-cpu-capabilities-after-late-micr.patch +x86-microcode-adjust-late-loading-result-reporting-m.patch +crypto-xts-handle-ebusy-correctly.patch +leds-led-class-add-missing-put_device-to-led_put.patch +crypto-ccp-refactor-out-sev_fw_alloc.patch +crypto-ccp-flush-the-sev-es-tmr-memory-before-giving.patch +bpftool-profile-online-cpus-instead-of-possible.patch +mt76-mt7915-fix-polling-firmware-own-status.patch +net-mlx5-enhance-debug-print-in-page-allocation-fail.patch +irqchip-fix-refcount-leak-in-platform_irqchip_probe.patch +irqchip-alpine-msi-fix-refcount-leak-in-alpine_msix_.patch +irqchip-irq-mvebu-gicp-fix-refcount-leak-in-mvebu_gi.patch +irqchip-ti-sci-fix-refcount-leak-in-ti_sci_intr_irq_.patch +s390-mem_detect-fix-detect_memory-error-handling.patch +s390-vmem-fix-empty-page-tables-cleanup-under-kasan.patch +net-add-sock_init_data_uid.patch +tun-tun_chr_open-correctly-initialize-socket-uid.patch +tap-tap_open-correctly-initialize-socket-uid.patch +opp-fix-error-checking-in-opp_migrate_dentry.patch +bluetooth-l2cap-fix-potential-user-after-free.patch +bluetooth-hci_qca-get-wakeup-status-from-serdev-devi.patch +s390-ap-fix-status-returned-by-ap_aqic.patch +s390-ap-fix-status-returned-by-ap_qact.patch +libbpf-fix-alen-calculation-in-libbpf_nla_dump_error.patch +rds-rds_rm_zerocopy_callback-correct-order-for-list_.patch +crypto-rsa-pkcs1pad-use-akcipher_request_complete.patch +m68k-proc-hardware-should-depend-on-proc_fs.patch +risc-v-time-initialize-hrtimer-based-broadcast-clock.patch +wifi-iwl3945-add-missing-check-for-create_singlethre.patch +wifi-iwl4965-add-missing-check-for-create_singlethre.patch +wifi-mwifiex-fix-loop-iterator-in-mwifiex_update_amp.patch +selftests-bpf-fix-out-of-srctree-build.patch +acpi-resource-add-irq-overrides-for-maingear-vector-.patch +acpi-resource-do-irq-override-on-all-tongfang-gmxrgx.patch +crypto-crypto4xx-call-dma_unmap_page-when-done.patch +wifi-mac80211-make-rate-u32-in-sta_set_rate_info_rx.patch +thermal-drivers-hisi-drop-second-sensor-hi3660.patch +can-esd_usb-move-mislocated-storage-of-sja1000_ecc_s.patch +bpf-fix-global-subprog-context-argument-resolution-l.patch +irqchip-irq-brcmstb-l2-set-irq_level-for-level-trigg.patch +irqchip-irq-bcm7120-l2-set-irq_level-for-level-trigg.patch +selftests-net-interpret-udp_gro-cmsg-data-as-an-int-.patch +l2tp-avoid-possible-recursive-deadlock-in-l2tp_tunne.patch +net-bcmgenet-fix-moca-led-control.patch +selftest-fib_tests-always-cleanup-before-exit.patch +sefltests-netdevsim-wait-for-devlink-instance-after-.patch +drm-fix-potential-null-ptr-deref-due-to-drmm_mode_co.patch +drm-fourcc-add-missing-big-endian-xrgb1555-and-rgb56.patch +drm-bridge-ti-sn65dsi83-fix-delay-after-reset-deasse.patch +drm-mxsfb-drm_mxsfb-should-depend-on-arch_mxs-arch_m.patch +drm-bridge-megachips-fix-error-handling-in-i2c_regis.patch +drm-vkms-fix-memory-leak-in-vkms_init.patch +drm-vkms-fix-null-ptr-deref-in-vkms_release.patch +drm-vc4-dpi-add-option-for-inverting-pixel-clock-and.patch +drm-vc4-dpi-fix-format-mapping-for-rgb565.patch +drm-tidss-fix-pixel-format-definition.patch +gpu-ipu-v3-common-add-of_node_put-for-reference-retu.patch +hwmon-ftsteutates-fix-scaling-of-measurements.patch +drm-msm-hdmi-add-missing-check-for-alloc_ordered_wor.patch +pinctrl-qcom-pinctrl-msm8976-correct-function-names-.patch +pinctrl-stm32-fix-refcount-leak-in-stm32_pctrl_get_i.patch +pinctrl-rockchip-fix-refcount-leak-in-rockchip_pinct.patch +drm-vc4-hvs-set-axi-panic-modes.patch +drm-vc4-hvs-fix-colour-order-for-xrgb1555-on-hvs5.patch +drm-vc4-hdmi-correct-interlaced-timings-again.patch +drm-msm-clean-event_thread-worker-in-case-of-an-erro.patch +scsi-qla2xxx-edif-fix-i-o-timeout-due-to-over-subscr.patch +scsi-qla2xxx-fix-exchange-oversubscription.patch +scsi-qla2xxx-fix-exchange-oversubscription-for-manag.patch +asoc-fsl_sai-update-to-modern-clocking-terminology.patch +asoc-fsl_sai-initialize-is_dsp_mode-flag.patch +drm-msm-adreno-fix-null-ptr-access-in-adreno_gpu_cle.patch +alsa-hda-ca0132-minor-fix-for-allocation-size.patch +drm-msm-gem-add-check-for-kmalloc.patch +drm-msm-dpu-disallow-unallocated-resources-to-be-ret.patch +drm-bridge-lt9611-fix-sleep-mode-setup.patch +drm-bridge-lt9611-fix-hpd-reenablement.patch +drm-bridge-lt9611-fix-polarity-programming.patch +drm-bridge-lt9611-fix-programming-of-video-modes.patch +drm-bridge-lt9611-fix-clock-calculation.patch +drm-bridge-lt9611-pass-a-pointer-to-the-of-node.patch +drm-mipi-dsi-fix-byte-order-of-16-bit-dcs-set-get-br.patch +drm-exynos-dsi-fix-mipi_dsi-_no_-mode-flags.patch +drm-msm-dsi-allow-2-ctrls-on-v2.5.0.patch +drm-msm-use-strscpy-instead-of-strncpy.patch +drm-msm-dpu-add-check-for-cstate.patch +drm-msm-dpu-add-check-for-pstates.patch +drm-msm-mdp5-add-check-for-kzalloc.patch +pinctrl-bcm2835-remove-of_node_put-in-bcm2835_of_gpi.patch +pinctrl-mediatek-fix-coding-style.patch +pinctrl-mediatek-initialize-variable-pullen-and-pull.patch +pinctrl-mediatek-initialize-variable-buf-to-zero.patch +gpu-host1x-don-t-skip-assigning-syncpoints-to-channe.patch +drm-tegra-firewall-check-for-is_addr_reg-existence-i.patch +drm-msm-dpu-set-pdpu-is_rt_pipe-early-in-dpu_plane_s.patch +drm-mediatek-dsi-reduce-the-time-of-dsi-from-lp11-to.patch +drm-mediatek-use-null-instead-of-0-for-null-pointer.patch +drm-mediatek-drop-unbalanced-obj-unref.patch +drm-mediatek-mtk_drm_crtc-add-checks-for-devm_kcallo.patch +drm-mediatek-clean-dangling-pointer-on-bind-error-pa.patch +asoc-soc-compress.c-fixup-private_data-on-snd_soc_ne.patch +gpio-vf610-connect-gpio-label-to-dev-name.patch +spi-dw_bt1-fix-mux_mmio-dependencies.patch +asoc-mchp-spdifrx-fix-controls-which-rely-on-rsr-reg.patch +asoc-mchp-spdifrx-fix-return-value-in-case-completio.patch +asoc-mchp-spdifrx-fix-controls-that-works-with-compl.patch +asoc-mchp-spdifrx-disable-all-interrupts-in-mchp_spd.patch +asoc-rsnd-fixup-endif-position.patch +asoc-mchp-spdifrx-fix-uninitialized-use-of-mr-in-mch.patch +asoc-dt-bindings-meson-fix-gx-card-codec-node-regex.patch +hwmon-ltc2945-handle-error-case-in-ltc2945_value_sto.patch +drm-amdgpu-fix-enum-odm_combine_mode-mismatch.patch +scsi-mpt3sas-fix-a-memory-leak.patch +scsi-aic94xx-add-missing-check-for-dma_map_single.patch +hid-multitouch-add-quirks-for-flipped-axes.patch +hid-retain-initial-quirks-set-up-when-creating-hid-d.patch +asoc-codecs-change-bulk-clock-voting-to-optional-vot.patch +asoc-codecs-rx-macro-move-clk-provider-to-managed-va.patch +asoc-codecs-tx-macro-move-clk-provider-to-managed-va.patch +asoc-codecs-rx-macro-move-to-individual-clks-from-bu.patch +asoc-codecs-tx-macro-move-to-individual-clks-from-bu.patch +asoc-codecs-lpass-fix-incorrect-mclk-rate.patch +spi-bcm63xx-hsspi-endianness-fix-for-arm-based-soc.patch +spi-bcm63xx-hsspi-fix-multi-bit-mode-setting.patch +hwmon-mlxreg-fan-return-zero-speed-for-broken-fan.patch +asoc-tlv320adcx140-fix-ti-gpio-config-dt-property-in.patch +dm-remove-flush_scheduled_work-during-local_exit.patch +nfsv4-keep-state-manager-thread-active-if-swap-is-en.patch +nfs4trace-fix-state-manager-flag-printing.patch +nfs-fix-disabling-of-swap.patch +spi-synquacer-fix-timeout-handling-in-synquacer_spi_.patch +asoc-soc-dapm.h-fixup-warning-struct-snd_pcm_substre.patch +hid-bigben-use-spinlock-to-protect-concurrent-access.patch +hid-bigben_worker-remove-unneeded-check-on-report_fi.patch +hid-bigben-use-spinlock-to-safely-schedule-workers.patch +hid-bigben_probe-validate-report-count.patch +drm-shmem-helper-fix-locking-for-drm_gem_shmem_get_p.patch +nfsd-fix-race-to-check-ls_layouts.patch +cifs-fix-lost-destroy-smbd-connection-when-mr-alloca.patch +cifs-fix-warning-and-uaf-when-destroy-the-mr-list.patch +gfs2-jdata-writepage-fix.patch +perf-llvm-fix-inadvertent-file-creation.patch +leds-led-core-fix-refcount-leak-in-of_led_get.patch +perf-inject-use-perf_data__read-for-auxtrace.patch +perf-intel-pt-add-documentation-for-event-trace-and-.patch +perf-intel-pt-add-link-to-the-perf-wiki-s-intel-pt-p.patch +perf-intel-pt-add-support-for-emulated-ptwrite.patch +perf-intel-pt-do-not-try-to-queue-auxtrace-data-on-p.patch +perf-tools-fix-auto-complete-on-aarch64.patch +sparc-allow-pm-configs-for-sparc32-compile_test.patch +selftests-ftrace-fix-bash-specific-operator.patch +printf-fix-errname.c-list.patch +objtool-add-uaccess-exceptions-for-__tsan_volatile_r.patch +mfd-cs5535-don-t-build-on-uml.patch +mfd-pcf50633-adc-fix-potential-memleak-in-pcf50633_a.patch +dmaengine-idxd-set-traffic-class-values-in-grpcfg-on.patch +dmaengine-hisi_dma-should-depend-on-arch_hisi.patch +iio-light-tsl2563-do-not-hardcode-interrupt-trigger-.patch +usb-gadget-fusb300_udc-free-irq-on-the-error-path-in.patch +i2c-designware-fix-i2c_dw_clk_rate-return-size-to-be.patch +soundwire-cadence-don-t-overflow-the-command-fifos.patch +driver-core-fix-potential-null-ptr-deref-in-device_a.patch +kobject-modify-kobject_get_path-to-take-a-const.patch +kobject-fix-slab-out-of-bounds-in-fill_kobj_path.patch +alpha-boot-tools-objstrip-fix-the-check-for-elf-head.patch +media-uvcvideo-do-not-check-for-v4l2_ctrl_which_def_.patch +media-uvcvideo-remove-s_ctrl-and-g_ctrl.patch +media-uvcvideo-refactor-__uvc_ctrl_add_mapping.patch +media-uvcvideo-add-support-for-v4l2_ctrl_type_ctrl_c.patch +media-uvcvideo-use-control-names-from-framework.patch +media-uvcvideo-check-controls-flags-before-accessing.patch +media-uvcvideo-check-for-inactive-in-uvc_ctrl_is_acc.patch +coresight-etm4x-fix-accesses-to-trcseqrstevr-and-trc.patch +coresight-cti-prevent-negative-values-of-enable-coun.patch +coresight-cti-add-pm-runtime-call-in-enable_store.patch +acpi-resource-add-helper-function-acpi_dev_get_memor.patch +usb-typec-intel_pmc_mux-use-the-helper-acpi_dev_get_.patch +usb-typec-intel_pmc_mux-don-t-leak-the-acpi-device-r.patch +pci-iov-enlarge-virtfn-sysfs-name-buffer.patch +pci-switchtec-return-efault-for-copy_to_user-errors.patch +tty-serial-fsl_lpuart-disable-rx-tx-dma-in-lpuart32_.patch +tty-serial-fsl_lpuart-clear-lpuart-status-register-i.patch +tty-serial-qcom-geni-serial-stop-operations-in-progr.patch +serial-tegra-add-missing-clk_disable_unprepare-in-te.patch +revert-char-pcmcia-cm4000_cs-replace-mdelay-with-usl.patch +eeprom-idt_89hpesx-fix-error-handling-in-idt_init.patch +applicom-fix-pci-device-refcount-leak-in-applicom_in.patch +firmware-stratix10-svc-add-missing-gen_pool_destroy-.patch +vmci-check-context-notify_page-after-call-to-get_use.patch +misc-mei-hdcp-use-correct-macros-to-initialize-uuid_.patch +driver-core-fix-resource-leak-in-device_add.patch +drivers-base-transport_class-fix-possible-memory-lea.patch +drivers-base-transport_class-fix-resource-leak-when-.patch +firmware-dmi-sysfs-fix-null-ptr-deref-in-dmi_sysfs_r.patch +fotg210-udc-add-missing-completion-handler.patch +dmaengine-dw-edma-fix-missing-src-dst-address-of-int.patch +usb-early-xhci-dbc-fix-a-potential-out-of-bound-memo.patch +tty-serial-fsl_lpuart-fix-the-wrong-rxwater-setting-.patch +rdma-cxgb4-add-null-ptr-check-after-ip_dev_find.patch +usb-musb-mediatek-don-t-unregister-something-that-wa.patch +usb-gadget-configfs-use-to_config_usb_cfg-in-os_desc.patch +usb-gadget-configfs-use-to_usb_function_instance-in-.patch +usb-gadget-configfs-remove-using-list-iterator-after.patch +usb-gadget-configfs-restrict-symlink-creation-is-udc.patch +iommu-vt-d-set-no-execute-enable-bit-in-pasid-table-.patch +power-supply-remove-faulty-cooling-logic.patch +rdma-siw-remove-foll_force-usage.patch +rdma-siw-fix-user-page-pinning-accounting.patch +rdma-cxgb4-fix-potential-null-ptr-deref-in-pass_esta.patch +usb-max-3421-fix-setting-of-i-o-pins.patch +rdma-irdma-cap-msix-used-to-online-cpus-1.patch +serial-fsl_lpuart-fix-rs485-rts-polariy-inverse-issu.patch +tty-serial-imx-handle-rs485-de-signal-active-high.patch +tty-serial-imx-disable-ageing-timer-interrupt-reques.patch +driver-core-fw_devlink-add-dl_flag_cycle-support-to-.patch +dmaengine-dw-edma-fix-readq_ch-return-value-truncati.patch +phy-rockchip-typec-fix-tcphy_get_mode-error-case.patch +iw_cxgb4-fix-potential-null-dereference-in-c4iw_fill.patch +iommu-fix-error-unwind-in-iommu_group_alloc.patch +dmaengine-sf-pdma-pdma_desc-memory-leak-fix.patch +dmaengine-dw-axi-dmac-do-not-dereference-null-struct.patch +iommu-vt-d-fix-error-handling-in-sva-enable-disable-.patch +iommu-vt-d-remove-duplicate-identity-domain-flag.patch +iommu-vt-d-check-fl-and-sl-capability-sanity-in-scal.patch +iommu-vt-d-use-second-level-for-gpa-hpa-translation.patch +iommu-vt-d-allow-to-use-flush-queue-when-first-level.patch +ib-hfi1-fix-math-bugs-in-hfi1_can_pin_pages.patch +ib-hfi1-fix-sdma.h-tx-num_descs-off-by-one-errors.patch +remoteproc-qcom_q6v5_mss-use-a-carveout-to-authentic.patch +media-ti-cal-fix-possible-memory-leak-in-cal_ctx_cre.patch +media-platform-ti-add-missing-check-for-devm_regulat.patch +powerpc-remove-linker-flag-from-kbuild_aflags.patch +s390-vdso-remove-nostdlib-compiler-flag.patch +s390-vdso-drop-shared-from-kbuild_cflags_64.patch +builddeb-clean-generated-package-content.patch +media-max9286-fix-memleak-in-max9286_v4l2_register.patch +media-ov2740-fix-memleak-in-ov2740_init_controls.patch +media-ov5675-fix-memleak-in-ov5675_init_controls.patch +media-i2c-ov772x-fix-memleak-in-ov772x_probe.patch +media-i2c-imx219-split-common-registers-from-mode-ta.patch +media-i2c-imx219-fix-binning-for-raw8-capture.patch +media-v4l2-jpeg-correct-the-skip-count-in-jpeg_parse.patch +media-v4l2-jpeg-ignore-the-unknown-app14-marker.patch +media-imx-jpeg-apply-clk_bulk-api-instead-of-operati.patch +media-rc-fix-use-after-free-bugs-caused-by-ene_tx_ir.patch +media-i2c-ov7670-0-instead-of-einval-was-returned.patch +media-usb-siano-fix-use-after-free-bugs-caused-by-do.patch +media-saa7134-use-video_unregister_device-for-radio_.patch +rpmsg-glink-avoid-infinite-loop-on-intent-for-missin.patch +udf-define-efscorrupted-error-code.patch +arm-dts-exynos-use-exynos5420-compatible-for-the-mip.patch +blk-iocost-fix-divide-by-0-error-in-calc_lcoefs.patch +trace-blktrace-fix-memory-leak-with-using-debugfs_lo.patch +sched-fair-sanitize-vruntime-of-entity-being-placed.patch +wifi-ath9k-fix-use-after-free-in-ath9k_hif_usb_disco.patch +wifi-brcmfmac-fix-potential-stack-out-of-bounds-in-b.patch +rcu-make-rcu_lockdep_warn-avoid-early-lockdep-checks.patch +rcu-suppress-smp_processor_id-complaint-in-synchroni.patch +rcu-tasks-make-rude-rcu-tasks-work-well-with-cpu-hot.patch +wifi-ath11k-debugfs-fix-to-work-with-multiple-pci-de.patch +thermal-intel-fix-unsigned-comparison-with-less-than.patch +timers-prevent-union-confusion-from-unexpected-resta.patch +x86-bugs-reset-speculation-control-settings-on-init.patch +wifi-brcmfmac-ensure-clm-version-is-null-terminated-.patch +wifi-mt7601u-fix-an-integer-underflow.patch +inet-fix-fast-path-in-__inet_hash_connect.patch +ice-restrict-ptp-hw-clock-freq-adjustments-to-100-00.patch +ice-add-missing-checks-for-pf-vsi-type.patch +acpi-don-t-build-acpica-with-os.patch +thermal-intel-intel_pch-add-support-for-wellsburg-pc.patch +clocksource-suspend-the-watchdog-temporarily-when-hi.patch +crypto-hisilicon-wipe-entire-pool-on-error.patch +net-bcmgenet-add-a-check-for-oversized-packets.patch +m68k-check-syscall_trace_enter-return-code.patch +netfilter-nf_tables-null-pointer-dereference-in-nf_t.patch +tools-power-x86-intel-speed-select-add-emerald-rapid.patch +wifi-mt76-dma-free-rx_head-in-mt76_dma_rx_cleanup.patch +acpi-video-fix-lenovo-ideapad-z570-dmi-match.patch +net-mlx5-fw_tracer-fix-debug-print.patch +coda-avoid-partial-allocation-of-sig_inputargs.patch +uaccess-add-minimum-bounds-check-on-kernel-buffer-si.patch +s390-idle-mark-arch_cpu_idle-noinstr.patch +time-debug-fix-memory-leak-with-using-debugfs_lookup.patch +pm-domains-fix-memory-leak-with-using-debugfs_lookup.patch +pm-em-fix-memory-leak-with-using-debugfs_lookup.patch +bluetooth-btusb-add-vid-pid-13d3-3529-for-realtek-rt.patch +hv_netvsc-check-status-in-send_rndis_pkt-completion-.patch +scm-add-user-copy-checks-to-put_cmsg.patch +drm-amd-display-revert-reduce-delay-when-sink-device.patch +drm-amd-display-fix-potential-null-deref-in-dm_resum.patch +drm-omap-dsi-fix-excessive-stack-usage.patch +hid-add-mapping-for-system-microphone-mute.patch +drm-tiny-ili9486-do-not-assume-8-bit-only-spi-contro.patch +drm-radeon-free-iio-for-atombios-when-driver-shutdow.patch +scsi-lpfc-fix-use-after-free-kfence-violation-during.patch +revert-fbcon-don-t-lose-the-console-font-across-gene.patch +drm-amd-display-fix-memory-leakage.patch +drm-msm-dsi-add-missing-check-for-alloc_ordered_work.patch +docs-scripts-gdb-add-necessary-make-scripts_gdb-step.patch +asoc-soc-compress-reposition-and-add-pcm_mutex.patch +asoc-kirkwood-iterate-over-array-indexes-instead-of-.patch +regulator-max77802-bounds-check-regulator-id-against.patch +regulator-s5m8767-bounds-check-id-indexing-into-arra.patch +gfs2-improve-gfs2_make_fs_rw-error-handling.patch +hwmon-coretemp-simplify-platform-device-handling.patch +pinctrl-at91-use-devm_kasprintf-to-avoid-potential-l.patch +scsi-snic-fix-memory-leak-with-using-debugfs_lookup.patch +hid-logitech-hidpp-don-t-restart-communication-if-no.patch +drm-panel-orientation-quirks-add-quirk-for-lenovo-id.patch +dm-thin-add-cond_resched-to-various-workqueue-loops.patch +dm-cache-add-cond_resched-to-various-workqueue-loops.patch +nfsd-zero-out-pointers-after-putting-nfsd_files-on-c.patch +drm-shmem-helper-revert-accidental-non-gpl-export.patch diff --git a/queue-5.15/soundwire-cadence-don-t-overflow-the-command-fifos.patch b/queue-5.15/soundwire-cadence-don-t-overflow-the-command-fifos.patch new file mode 100644 index 00000000000..d380385c19a --- /dev/null +++ b/queue-5.15/soundwire-cadence-don-t-overflow-the-command-fifos.patch @@ -0,0 +1,48 @@ +From fe6ab53302270fbba9a3fc27d8d8362d3a92c146 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Dec 2022 16:18:10 +0000 +Subject: soundwire: cadence: Don't overflow the command FIFOs + +From: Richard Fitzgerald + +[ Upstream commit 7cbfee2e2e40d2be54196362a845a3ea0a3f877d ] + +The command FIFOs in the Cadence IP can be configured during design +up to 32 entries, and the code in cadence_master.c was assuming the +full 32-entry FIFO. But all current Intel implementations use an 8-entry +FIFO. + +Up to now the longest message used was 6 entries so this wasn't +causing any problem. But future Cirrus Logic codecs have downloadable +firmware or tuning blobs. It is more efficient for the codec driver to +issue long transfers that can take advantage of any queuing in the +Soundwire controller and avoid the overhead of repeatedly writing the +page registers. + +Signed-off-by: Richard Fitzgerald +Reviewed-by: Pierre-Louis Bossart +Fixes: 2f52a5177caa ("soundwire: cdns: Add cadence library") +Link: https://lore.kernel.org/r/20221202161812.4186897-2-rf@opensource.cirrus.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/soundwire/cadence_master.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/soundwire/cadence_master.c b/drivers/soundwire/cadence_master.c +index 18d2f9b3e2010..0339e6df6eb78 100644 +--- a/drivers/soundwire/cadence_master.c ++++ b/drivers/soundwire/cadence_master.c +@@ -127,7 +127,8 @@ MODULE_PARM_DESC(cdns_mcp_int_mask, "Cadence MCP IntMask"); + + #define CDNS_MCP_CMD_BASE 0x80 + #define CDNS_MCP_RESP_BASE 0x80 +-#define CDNS_MCP_CMD_LEN 0x20 ++/* FIFO can hold 8 commands */ ++#define CDNS_MCP_CMD_LEN 8 + #define CDNS_MCP_CMD_WORD_LEN 0x4 + + #define CDNS_MCP_CMD_SSP_TAG BIT(31) +-- +2.39.2 + diff --git a/queue-5.15/sparc-allow-pm-configs-for-sparc32-compile_test.patch b/queue-5.15/sparc-allow-pm-configs-for-sparc32-compile_test.patch new file mode 100644 index 00000000000..2b1a667a1db --- /dev/null +++ b/queue-5.15/sparc-allow-pm-configs-for-sparc32-compile_test.patch @@ -0,0 +1,86 @@ +From c9e3934582c0fa663a25d7ea70dad7f84a387276 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 4 Feb 2023 16:43:57 -0800 +Subject: sparc: allow PM configs for sparc32 COMPILE_TEST + +From: Randy Dunlap + +[ Upstream commit 7be6a87c2473957090995b7eb541e31d57a2c801 ] + +When doing randconfig builds for sparc32 with COMPILE_TEST, some +(non-Sparc) drivers cause kconfig warnings with the Kconfig symbols PM, +PM_GENERIC_DOMAINS, or PM_GENERIC_DOMAINS_OF. + +This is due to arch/sparc/Kconfig not using the PM Kconfig for +Sparc32: + + if SPARC64 + source "kernel/power/Kconfig" + endif + +Arnd suggested adding "|| COMPILE_TEST" to the conditional, +instead of trying to track down every driver that selects +any of these PM symbols. + +Fixes the following kconfig warnings: + +WARNING: unmet direct dependencies detected for PM + Depends on [n]: SPARC64 [=n] + Selected by [y]: + - SUN20I_PPU [=y] && (ARCH_SUNXI || COMPILE_TEST [=y]) + +WARNING: unmet direct dependencies detected for PM + Depends on [n]: SPARC64 [=n] + Selected by [y]: + - SUN20I_PPU [=y] && (ARCH_SUNXI || COMPILE_TEST [=y]) + +WARNING: unmet direct dependencies detected for PM_GENERIC_DOMAINS + Depends on [n]: SPARC64 [=n] && PM [=y] + Selected by [y]: + - QCOM_GDSC [=y] && COMMON_CLK [=y] && PM [=y] + - SUN20I_PPU [=y] && (ARCH_SUNXI || COMPILE_TEST [=y]) + - MESON_GX_PM_DOMAINS [=y] && (ARCH_MESON || COMPILE_TEST [=y]) && PM [=y] && OF [=y] + - BCM2835_POWER [=y] && (ARCH_BCM2835 || COMPILE_TEST [=y] && OF [=y]) && PM [=y] + - BCM_PMB [=y] && (ARCH_BCMBCA || COMPILE_TEST [=y] && OF [=y]) && PM [=y] + - ROCKCHIP_PM_DOMAINS [=y] && (ARCH_ROCKCHIP || COMPILE_TEST [=y]) && PM [=y] + Selected by [m]: + - ARM_SCPI_POWER_DOMAIN [=m] && (ARM_SCPI_PROTOCOL [=m] || COMPILE_TEST [=y] && OF [=y]) && PM [=y] + - MESON_EE_PM_DOMAINS [=m] && (ARCH_MESON || COMPILE_TEST [=y]) && PM [=y] && OF [=y] + - QCOM_AOSS_QMP [=m] && (ARCH_QCOM || COMPILE_TEST [=y]) && MAILBOX [=y] && COMMON_CLK [=y] && PM [=y] + +WARNING: unmet direct dependencies detected for PM_GENERIC_DOMAINS_OF + Depends on [n]: SPARC64 [=n] && PM_GENERIC_DOMAINS [=y] && OF [=y] + Selected by [y]: + - MESON_GX_PM_DOMAINS [=y] && (ARCH_MESON || COMPILE_TEST [=y]) && PM [=y] && OF [=y] + Selected by [m]: + - MESON_EE_PM_DOMAINS [=m] && (ARCH_MESON || COMPILE_TEST [=y]) && PM [=y] && OF [=y] + +Link: https://lkml.kernel.org/r/20230205004357.29459-1-rdunlap@infradead.org +Fixes: bdde6b3c8ba4 ("sparc64: Hibernation support") +Signed-off-by: Randy Dunlap +Suggested-by: Arnd Bergmann +Acked-by: Sam Ravnborg +Cc: "David S. Miller" +Cc: Kirill Tkhai +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + arch/sparc/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/sparc/Kconfig b/arch/sparc/Kconfig +index b120ed947f50b..eff9116bf7be3 100644 +--- a/arch/sparc/Kconfig ++++ b/arch/sparc/Kconfig +@@ -286,7 +286,7 @@ config FORCE_MAX_ZONEORDER + This config option is actually maximum order plus one. For example, + a value of 13 means that the largest free memory block is 2^12 pages. + +-if SPARC64 ++if SPARC64 || COMPILE_TEST + source "kernel/power/Kconfig" + endif + +-- +2.39.2 + diff --git a/queue-5.15/spi-bcm63xx-hsspi-endianness-fix-for-arm-based-soc.patch b/queue-5.15/spi-bcm63xx-hsspi-endianness-fix-for-arm-based-soc.patch new file mode 100644 index 00000000000..d1da06af94c --- /dev/null +++ b/queue-5.15/spi-bcm63xx-hsspi-endianness-fix-for-arm-based-soc.patch @@ -0,0 +1,41 @@ +From c561c7820378f83268550c350b27a2a953fa7acb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Feb 2023 22:58:17 -0800 +Subject: spi: bcm63xx-hsspi: Endianness fix for ARM based SoC + +From: William Zhang + +[ Upstream commit 85a84a61699990db6a025b5073f337f49933a875 ] + +HSSPI controller uses big endian for the opcode in the message to the +controller ping pong buffer. Use cpu_to_be16 to properly handle the +endianness for both big and little endian host. + +Fixes: 142168eba9dc ("spi: bcm63xx-hsspi: add bcm63xx HSSPI driver") +Signed-off-by: Kursad Oney +Signed-off-by: William Zhang +Acked-by: Florian Fainelli + +Link: https://lore.kernel.org/r/20230207065826.285013-7-william.zhang@broadcom.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-bcm63xx-hsspi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/spi/spi-bcm63xx-hsspi.c b/drivers/spi/spi-bcm63xx-hsspi.c +index b871fd810d801..a74345ed0e2ff 100644 +--- a/drivers/spi/spi-bcm63xx-hsspi.c ++++ b/drivers/spi/spi-bcm63xx-hsspi.c +@@ -194,7 +194,7 @@ static int bcm63xx_hsspi_do_txrx(struct spi_device *spi, struct spi_transfer *t) + tx += curr_step; + } + +- __raw_writew(opcode | curr_step, bs->fifo); ++ __raw_writew((u16)cpu_to_be16(opcode | curr_step), bs->fifo); + + /* enable interrupt */ + __raw_writel(HSSPI_PINGx_CMD_DONE(0), +-- +2.39.2 + diff --git a/queue-5.15/spi-bcm63xx-hsspi-fix-multi-bit-mode-setting.patch b/queue-5.15/spi-bcm63xx-hsspi-fix-multi-bit-mode-setting.patch new file mode 100644 index 00000000000..5b12a7095da --- /dev/null +++ b/queue-5.15/spi-bcm63xx-hsspi-fix-multi-bit-mode-setting.patch @@ -0,0 +1,61 @@ +From 66dedbbf4826e96377144f92c8ef254b14bde7ec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Feb 2023 12:02:41 -0800 +Subject: spi: bcm63xx-hsspi: Fix multi-bit mode setting + +From: William Zhang + +[ Upstream commit 811ff802aaf878ebbbaeac0307a0164fa21e7d40 ] + +Currently the driver always sets the controller to dual data bit mode +for both tx and rx data in the profile mode control register even for +single data bit transfer. Luckily the opcode is set correctly according +to SPI transfer data bit width so it does not actually cause issues. + +This change fixes the problem by setting tx and rx data bit mode field +correctly according to the actual SPI transfer tx and rx data bit width. + +Fixes: 142168eba9dc ("spi: bcm63xx-hsspi: add bcm63xx HSSPI driver") +Signed-off-by: William Zhang +Link: https://lore.kernel.org/r/20230209200246.141520-11-william.zhang@broadcom.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-bcm63xx-hsspi.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/drivers/spi/spi-bcm63xx-hsspi.c b/drivers/spi/spi-bcm63xx-hsspi.c +index a74345ed0e2ff..9ec33745c1472 100644 +--- a/drivers/spi/spi-bcm63xx-hsspi.c ++++ b/drivers/spi/spi-bcm63xx-hsspi.c +@@ -163,6 +163,7 @@ static int bcm63xx_hsspi_do_txrx(struct spi_device *spi, struct spi_transfer *t) + int step_size = HSSPI_BUFFER_LEN; + const u8 *tx = t->tx_buf; + u8 *rx = t->rx_buf; ++ u32 val = 0; + + bcm63xx_hsspi_set_clk(bs, spi, t->speed_hz); + bcm63xx_hsspi_set_cs(bs, spi->chip_select, true); +@@ -178,11 +179,16 @@ static int bcm63xx_hsspi_do_txrx(struct spi_device *spi, struct spi_transfer *t) + step_size -= HSSPI_OPCODE_LEN; + + if ((opcode == HSSPI_OP_READ && t->rx_nbits == SPI_NBITS_DUAL) || +- (opcode == HSSPI_OP_WRITE && t->tx_nbits == SPI_NBITS_DUAL)) ++ (opcode == HSSPI_OP_WRITE && t->tx_nbits == SPI_NBITS_DUAL)) { + opcode |= HSSPI_OP_MULTIBIT; + +- __raw_writel(1 << MODE_CTRL_MULTIDATA_WR_SIZE_SHIFT | +- 1 << MODE_CTRL_MULTIDATA_RD_SIZE_SHIFT | 0xff, ++ if (t->rx_nbits == SPI_NBITS_DUAL) ++ val |= 1 << MODE_CTRL_MULTIDATA_RD_SIZE_SHIFT; ++ if (t->tx_nbits == SPI_NBITS_DUAL) ++ val |= 1 << MODE_CTRL_MULTIDATA_WR_SIZE_SHIFT; ++ } ++ ++ __raw_writel(val | 0xff, + bs->regs + HSSPI_PROFILE_MODE_CTRL_REG(chip_select)); + + while (pending > 0) { +-- +2.39.2 + diff --git a/queue-5.15/spi-dw_bt1-fix-mux_mmio-dependencies.patch b/queue-5.15/spi-dw_bt1-fix-mux_mmio-dependencies.patch new file mode 100644 index 00000000000..d99a1a2c723 --- /dev/null +++ b/queue-5.15/spi-dw_bt1-fix-mux_mmio-dependencies.patch @@ -0,0 +1,48 @@ +From 1d75bd0151659c4b272c4070af253618b5eca919 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Jan 2023 15:01:40 +0100 +Subject: spi: dw_bt1: fix MUX_MMIO dependencies + +From: Arnd Bergmann + +[ Upstream commit d4bde04318c0d33705e9a77d4c7df72f262011e0 ] + +Selecting a symbol with additional dependencies requires +adding the same dependency here: + +WARNING: unmet direct dependencies detected for MUX_MMIO + Depends on [n]: MULTIPLEXER [=y] && OF [=n] + Selected by [y]: + - SPI_DW_BT1 [=y] && SPI [=y] && SPI_MASTER [=y] && SPI_DESIGNWARE [=y] && (MIPS_BAIKAL_T1 || COMPILE_TEST [=y]) + +Drop the 'select' here to avoid the problem. Anyone using +the dw-bt1 SPI driver should make sure they include the +mux driver as well now. + +Fixes: 7218838109fe ("spi: dw-bt1: Fix undefined devm_mux_control_get symbol") +Fixes: abf00907538e ("spi: dw: Add Baikal-T1 SPI Controller glue driver") +Link: https://lore.kernel.org/all/20221218192523.c6vnfo26ua6xqf26@mobilestation/ +Signed-off-by: Arnd Bergmann +Reviewed-by: Serge Semin +Link: https://lore.kernel.org/r/20230130140156.3620863-1-arnd@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/Kconfig | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/spi/Kconfig b/drivers/spi/Kconfig +index 83e352b0c8f9a..4fc23236d3bd2 100644 +--- a/drivers/spi/Kconfig ++++ b/drivers/spi/Kconfig +@@ -272,7 +272,6 @@ config SPI_DW_BT1 + tristate "Baikal-T1 SPI driver for DW SPI core" + depends on MIPS_BAIKAL_T1 || COMPILE_TEST + select MULTIPLEXER +- select MUX_MMIO + help + Baikal-T1 SoC is equipped with three DW APB SSI-based MMIO SPI + controllers. Two of them are pretty much normal: with IRQ, DMA, +-- +2.39.2 + diff --git a/queue-5.15/spi-synquacer-fix-timeout-handling-in-synquacer_spi_.patch b/queue-5.15/spi-synquacer-fix-timeout-handling-in-synquacer_spi_.patch new file mode 100644 index 00000000000..c29126da1e5 --- /dev/null +++ b/queue-5.15/spi-synquacer-fix-timeout-handling-in-synquacer_spi_.patch @@ -0,0 +1,47 @@ +From b9c26f168fdace3093b27c4bf84b1b9f45c7238e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Feb 2023 14:01:28 +0100 +Subject: spi: synquacer: Fix timeout handling in synquacer_spi_transfer_one() + +From: Christophe JAILLET + +[ Upstream commit e6a0b671880207566e1ece983bf989dde60bc1d7 ] + +wait_for_completion_timeout() never returns a <0 value. It returns either +on timeout or a positive value (at least 1, or number of jiffies left +till timeout) + +So, fix the error handling path and return -ETIMEDOUT should a timeout +occur. + +Fixes: b0823ee35cf9 ("spi: Add spi driver for Socionext SynQuacer platform") +Signed-off-by: Christophe JAILLET +Acked-by: Jassi Brar +Link: https://lore.kernel.org/r/c2040bf3cfa201fd8890cfab14fa5a701ffeca14.1676466072.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-synquacer.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/drivers/spi/spi-synquacer.c b/drivers/spi/spi-synquacer.c +index 47cbe73137c23..dc188f9202c97 100644 +--- a/drivers/spi/spi-synquacer.c ++++ b/drivers/spi/spi-synquacer.c +@@ -472,10 +472,9 @@ static int synquacer_spi_transfer_one(struct spi_master *master, + read_fifo(sspi); + } + +- if (status < 0) { +- dev_err(sspi->dev, "failed to transfer. status: 0x%x\n", +- status); +- return status; ++ if (status == 0) { ++ dev_err(sspi->dev, "failed to transfer. Timeout.\n"); ++ return -ETIMEDOUT; + } + + return 0; +-- +2.39.2 + diff --git a/queue-5.15/tap-tap_open-correctly-initialize-socket-uid.patch b/queue-5.15/tap-tap_open-correctly-initialize-socket-uid.patch new file mode 100644 index 00000000000..35ac792e5a2 --- /dev/null +++ b/queue-5.15/tap-tap_open-correctly-initialize-socket-uid.patch @@ -0,0 +1,47 @@ +From d24ad780a3f787e71461de283676bb8ace830d28 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 4 Feb 2023 17:39:22 +0000 +Subject: tap: tap_open(): correctly initialize socket uid + +From: Pietro Borrello + +[ Upstream commit 66b2c338adce580dfce2199591e65e2bab889cff ] + +sock_init_data() assumes that the `struct socket` passed in input is +contained in a `struct socket_alloc` allocated with sock_alloc(). +However, tap_open() passes a `struct socket` embedded in a `struct +tap_queue` allocated with sk_alloc(). +This causes a type confusion when issuing a container_of() with +SOCK_INODE() in sock_init_data() which results in assigning a wrong +sk_uid to the `struct sock` in input. +On default configuration, the type confused field overlaps with +padding bytes between `int vnet_hdr_sz` and `struct tap_dev __rcu +*tap` in `struct tap_queue`, which makes the uid of all tap sockets 0, +i.e., the root one. +Fix the assignment by using sock_init_data_uid(). + +Fixes: 86741ec25462 ("net: core: Add a UID field to struct sock.") +Signed-off-by: Pietro Borrello +Reviewed-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/tap.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/tap.c b/drivers/net/tap.c +index ba2ef5437e167..854ed2f21d32c 100644 +--- a/drivers/net/tap.c ++++ b/drivers/net/tap.c +@@ -523,7 +523,7 @@ static int tap_open(struct inode *inode, struct file *file) + q->sock.state = SS_CONNECTED; + q->sock.file = file; + q->sock.ops = &tap_socket_ops; +- sock_init_data(&q->sock, &q->sk); ++ sock_init_data_uid(&q->sock, &q->sk, inode->i_uid); + q->sk.sk_write_space = tap_sock_write_space; + q->sk.sk_destruct = tap_sock_destruct; + q->flags = IFF_VNET_HDR | IFF_NO_PI | IFF_TAP; +-- +2.39.2 + diff --git a/queue-5.15/thermal-drivers-hisi-drop-second-sensor-hi3660.patch b/queue-5.15/thermal-drivers-hisi-drop-second-sensor-hi3660.patch new file mode 100644 index 00000000000..9d7ade43eca --- /dev/null +++ b/queue-5.15/thermal-drivers-hisi-drop-second-sensor-hi3660.patch @@ -0,0 +1,46 @@ +From 58b60c0f3989d19063dfb3743915f82350107e98 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Feb 2023 22:15:07 +0800 +Subject: thermal/drivers/hisi: Drop second sensor hi3660 + +From: Yongqin Liu + +[ Upstream commit 15cc25829a97c3957e520e971868aacc84341317 ] + +The commit 74c8e6bffbe1 ("driver core: Add __alloc_size hint to devm +allocators") exposes a panic "BRK handler: Fatal exception" on the +hi3660_thermal_probe funciton. +This is because the function allocates memory for only one +sensors array entry, but tries to fill up a second one. + +Fix this by removing the unneeded second access. + +Fixes: 7d3a2a2bbadb ("thermal/drivers/hisi: Fix number of sensors on hi3660") +Signed-off-by: Yongqin Liu +Link: https://lore.kernel.org/linux-mm/20221101223321.1326815-5-keescook@chromium.org/ +Link: https://lore.kernel.org/r/20230210141507.71014-1-yongqin.liu@linaro.org +Signed-off-by: Daniel Lezcano +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/thermal/hisi_thermal.c | 4 ---- + 1 file changed, 4 deletions(-) + +diff --git a/drivers/thermal/hisi_thermal.c b/drivers/thermal/hisi_thermal.c +index 9a21ac0ceb112..29ff1e66dd6e9 100644 +--- a/drivers/thermal/hisi_thermal.c ++++ b/drivers/thermal/hisi_thermal.c +@@ -435,10 +435,6 @@ static int hi3660_thermal_probe(struct hisi_thermal_data *data) + data->sensor[0].irq_name = "tsensor_a73"; + data->sensor[0].data = data; + +- data->sensor[1].id = HI3660_LITTLE_SENSOR; +- data->sensor[1].irq_name = "tsensor_a53"; +- data->sensor[1].data = data; +- + return 0; + } + +-- +2.39.2 + diff --git a/queue-5.15/thermal-drivers-tsens-add-compat-string-for-the-qcom.patch b/queue-5.15/thermal-drivers-tsens-add-compat-string-for-the-qcom.patch new file mode 100644 index 00000000000..1500242ea9d --- /dev/null +++ b/queue-5.15/thermal-drivers-tsens-add-compat-string-for-the-qcom.patch @@ -0,0 +1,39 @@ +From ea2b52e850439457e2365f522c2bca8470d04c19 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Apr 2022 03:26:46 +0300 +Subject: thermal/drivers/tsens: Add compat string for the qcom,msm8960 + +From: Dmitry Baryshkov + +[ Upstream commit 2caf73969de6675318a711d0622406c8c66afc03 ] + +On apq8064 (msm8960) platforms the tsens device is created manually by +the gcc driver. Prepare the tsens driver for the qcom,msm8960-tsens +device instantiated from the device tree. + +Signed-off-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20220406002648.393486-3-dmitry.baryshkov@linaro.org +Signed-off-by: Daniel Lezcano +Stable-dep-of: a7d3006be5ca ("thermal/drivers/tsens: Sort out msm8976 vs msm8956 data") +Signed-off-by: Sasha Levin +--- + drivers/thermal/qcom/tsens.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/thermal/qcom/tsens.c b/drivers/thermal/qcom/tsens.c +index 99a8d9f3e03ca..cef1cbcf03f41 100644 +--- a/drivers/thermal/qcom/tsens.c ++++ b/drivers/thermal/qcom/tsens.c +@@ -978,6 +978,9 @@ static const struct of_device_id tsens_table[] = { + }, { + .compatible = "qcom,msm8939-tsens", + .data = &data_8939, ++ }, { ++ .compatible = "qcom,msm8960-tsens", ++ .data = &data_8960, + }, { + .compatible = "qcom,msm8974-tsens", + .data = &data_8974, +-- +2.39.2 + diff --git a/queue-5.15/thermal-drivers-tsens-drop-msm8976-specific-defines.patch b/queue-5.15/thermal-drivers-tsens-drop-msm8976-specific-defines.patch new file mode 100644 index 00000000000..e9382af7231 --- /dev/null +++ b/queue-5.15/thermal-drivers-tsens-drop-msm8976-specific-defines.patch @@ -0,0 +1,52 @@ +From 2d5fd2af15941298c42879285e1418b2bd86a13d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 1 Jan 2023 21:40:19 +0200 +Subject: thermal/drivers/tsens: Drop msm8976-specific defines + +From: Dmitry Baryshkov + +[ Upstream commit 3bf0ea99e2e32b0335106b86d84404cc85bcd113 ] + +Drop msm8976-specific defines, which duplicate generic ones. + +Fixes: 0e580290170d ("thermal: qcom: tsens-v1: Add support for MSM8956 and MSM8976") +Reviewed-by: AngeloGioacchino Del Regno +Reviewed-by: Konrad Dybcio +Signed-off-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20230101194034.831222-6-dmitry.baryshkov@linaro.org +Signed-off-by: Daniel Lezcano +Signed-off-by: Sasha Levin +--- + drivers/thermal/qcom/tsens-v1.c | 9 ++------- + 1 file changed, 2 insertions(+), 7 deletions(-) + +diff --git a/drivers/thermal/qcom/tsens-v1.c b/drivers/thermal/qcom/tsens-v1.c +index 573e261ccca74..13624263f1dfe 100644 +--- a/drivers/thermal/qcom/tsens-v1.c ++++ b/drivers/thermal/qcom/tsens-v1.c +@@ -78,11 +78,6 @@ + + #define MSM8976_CAL_SEL_MASK 0x3 + +-#define MSM8976_CAL_DEGC_PT1 30 +-#define MSM8976_CAL_DEGC_PT2 120 +-#define MSM8976_SLOPE_FACTOR 1000 +-#define MSM8976_SLOPE_DEFAULT 3200 +- + /* eeprom layout data for qcs404/405 (v1) */ + #define BASE0_MASK 0x000007f8 + #define BASE1_MASK 0x0007f800 +@@ -160,8 +155,8 @@ static void compute_intercept_slope_8976(struct tsens_priv *priv, + priv->sensor[10].slope = 3286; + + for (i = 0; i < priv->num_sensors; i++) { +- priv->sensor[i].offset = (p1[i] * MSM8976_SLOPE_FACTOR) - +- (MSM8976_CAL_DEGC_PT1 * ++ priv->sensor[i].offset = (p1[i] * SLOPE_FACTOR) - ++ (CAL_DEGC_PT1 * + priv->sensor[i].slope); + } + } +-- +2.39.2 + diff --git a/queue-5.15/thermal-drivers-tsens-fix-slope-values-for-msm8939.patch b/queue-5.15/thermal-drivers-tsens-fix-slope-values-for-msm8939.patch new file mode 100644 index 00000000000..f339d8b99c2 --- /dev/null +++ b/queue-5.15/thermal-drivers-tsens-fix-slope-values-for-msm8939.patch @@ -0,0 +1,65 @@ +From b0c20f588eb9a8baece326d5d75700860a65ebfa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 1 Jan 2023 21:40:21 +0200 +Subject: thermal/drivers/tsens: fix slope values for msm8939 + +From: Dmitry Baryshkov + +[ Upstream commit 5aec3b035e0cbf3f042c2a03d654e5ad6748feb7 ] + +According to the vendor kernels (msm-3.10, 3.14 and 3.18), msm8939 +uses non-standard slope values for calibrating the sensors. Fill them +accordingly. + +Fixes: 332bc8ebab2c ("thermal: qcom: tsens-v0_1: Add support for MSM8939") +Cc: Bryan O'Donoghue +Cc: Shawn Guo +Reviewed-by: Konrad Dybcio +Acked-by: Shawn Guo +Signed-off-by: Dmitry Baryshkov +Reviewed-by: Bryan O'Donoghue +Link: https://lore.kernel.org/r/20230101194034.831222-8-dmitry.baryshkov@linaro.org +Signed-off-by: Daniel Lezcano +Signed-off-by: Sasha Levin +--- + drivers/thermal/qcom/tsens-v0_1.c | 17 ++++++++++++++++- + 1 file changed, 16 insertions(+), 1 deletion(-) + +diff --git a/drivers/thermal/qcom/tsens-v0_1.c b/drivers/thermal/qcom/tsens-v0_1.c +index 327f37202c69f..f6d55e6d85dde 100644 +--- a/drivers/thermal/qcom/tsens-v0_1.c ++++ b/drivers/thermal/qcom/tsens-v0_1.c +@@ -534,6 +534,21 @@ static int calibrate_9607(struct tsens_priv *priv) + return 0; + } + ++static int __init init_8939(struct tsens_priv *priv) { ++ priv->sensor[0].slope = 2911; ++ priv->sensor[1].slope = 2789; ++ priv->sensor[2].slope = 2906; ++ priv->sensor[3].slope = 2763; ++ priv->sensor[4].slope = 2922; ++ priv->sensor[5].slope = 2867; ++ priv->sensor[6].slope = 2833; ++ priv->sensor[7].slope = 2838; ++ priv->sensor[8].slope = 2840; ++ priv->sensor[9].slope = 2852; ++ ++ return init_common(priv); ++} ++ + /* v0.1: 8916, 8939, 8974, 9607 */ + + static struct tsens_features tsens_v0_1_feat = { +@@ -596,7 +611,7 @@ struct tsens_plat_data data_8916 = { + }; + + static const struct tsens_ops ops_8939 = { +- .init = init_common, ++ .init = init_8939, + .calibrate = calibrate_8939, + .get_temp = get_temp_common, + }; +-- +2.39.2 + diff --git a/queue-5.15/thermal-drivers-tsens-limit-num_sensors-to-9-for-msm.patch b/queue-5.15/thermal-drivers-tsens-limit-num_sensors-to-9-for-msm.patch new file mode 100644 index 00000000000..b9929646ef1 --- /dev/null +++ b/queue-5.15/thermal-drivers-tsens-limit-num_sensors-to-9-for-msm.patch @@ -0,0 +1,96 @@ +From bda075787d3b15b5ef3cee0033a181a7182ab7af Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 1 Jan 2023 21:40:22 +0200 +Subject: thermal/drivers/tsens: limit num_sensors to 9 for msm8939 + +From: Dmitry Baryshkov + +[ Upstream commit 903238a33c116edf5f64f7a3fd246e6169cccfa6 ] + +On msm8939 last (hwid=10) sensor was added in the hw revision 3.0. +Calibration data for it was placed outside of the main calibration data +blob, so it is not accessible by the current blob-parsing code. + +Moreover data for the sensor's p2 is not contiguous in the fuses. This +makes it hard to use nvmem_cell API to parse calibration data in a +generic way. + +Since the sensor doesn't seem to be actually used by the existing +hardware, disable the sensor for now. + +Fixes: 332bc8ebab2c ("thermal: qcom: tsens-v0_1: Add support for MSM8939") +Cc: Bryan O'Donoghue +Cc: Shawn Guo +Acked-by: Shawn Guo +Signed-off-by: Dmitry Baryshkov +Reviewed-by: Bryan O'Donoghue +Link: https://lore.kernel.org/r/20230101194034.831222-9-dmitry.baryshkov@linaro.org +Signed-off-by: Daniel Lezcano +Signed-off-by: Sasha Levin +--- + drivers/thermal/qcom/tsens-v0_1.c | 13 ++++--------- + 1 file changed, 4 insertions(+), 9 deletions(-) + +diff --git a/drivers/thermal/qcom/tsens-v0_1.c b/drivers/thermal/qcom/tsens-v0_1.c +index f6d55e6d85dde..8d036727b99fe 100644 +--- a/drivers/thermal/qcom/tsens-v0_1.c ++++ b/drivers/thermal/qcom/tsens-v0_1.c +@@ -285,7 +285,7 @@ static int calibrate_8939(struct tsens_priv *priv) + u32 p1[10], p2[10]; + int mode = 0; + u32 *qfprom_cdata; +- u32 cdata[6]; ++ u32 cdata[4]; + + qfprom_cdata = (u32 *)qfprom_read(priv->dev, "calib"); + if (IS_ERR(qfprom_cdata)) +@@ -296,8 +296,6 @@ static int calibrate_8939(struct tsens_priv *priv) + cdata[1] = qfprom_cdata[13]; + cdata[2] = qfprom_cdata[0]; + cdata[3] = qfprom_cdata[1]; +- cdata[4] = qfprom_cdata[22]; +- cdata[5] = qfprom_cdata[21]; + + mode = (cdata[0] & MSM8939_CAL_SEL_MASK) >> MSM8939_CAL_SEL_SHIFT; + dev_dbg(priv->dev, "calibration mode is %d\n", mode); +@@ -314,8 +312,6 @@ static int calibrate_8939(struct tsens_priv *priv) + p2[6] = (cdata[2] & MSM8939_S6_P2_MASK) >> MSM8939_S6_P2_SHIFT; + p2[7] = (cdata[3] & MSM8939_S7_P2_MASK) >> MSM8939_S7_P2_SHIFT; + p2[8] = (cdata[3] & MSM8939_S8_P2_MASK) >> MSM8939_S8_P2_SHIFT; +- p2[9] = (cdata[4] & MSM8939_S9_P2_MASK_0_4) >> MSM8939_S9_P2_SHIFT_0_4; +- p2[9] |= ((cdata[5] & MSM8939_S9_P2_MASK_5) >> MSM8939_S9_P2_SHIFT_5) << 5; + for (i = 0; i < priv->num_sensors; i++) + p2[i] = (base1 + p2[i]) << 2; + fallthrough; +@@ -331,7 +327,6 @@ static int calibrate_8939(struct tsens_priv *priv) + p1[6] = (cdata[2] & MSM8939_S6_P1_MASK) >> MSM8939_S6_P1_SHIFT; + p1[7] = (cdata[3] & MSM8939_S7_P1_MASK) >> MSM8939_S7_P1_SHIFT; + p1[8] = (cdata[3] & MSM8939_S8_P1_MASK) >> MSM8939_S8_P1_SHIFT; +- p1[9] = (cdata[4] & MSM8939_S9_P1_MASK) >> MSM8939_S9_P1_SHIFT; + for (i = 0; i < priv->num_sensors; i++) + p1[i] = ((base0) + p1[i]) << 2; + break; +@@ -544,7 +539,7 @@ static int __init init_8939(struct tsens_priv *priv) { + priv->sensor[6].slope = 2833; + priv->sensor[7].slope = 2838; + priv->sensor[8].slope = 2840; +- priv->sensor[9].slope = 2852; ++ /* priv->sensor[9].slope = 2852; */ + + return init_common(priv); + } +@@ -617,9 +612,9 @@ static const struct tsens_ops ops_8939 = { + }; + + struct tsens_plat_data data_8939 = { +- .num_sensors = 10, ++ .num_sensors = 9, + .ops = &ops_8939, +- .hw_ids = (unsigned int []){ 0, 1, 2, 3, 5, 6, 7, 8, 9, 10 }, ++ .hw_ids = (unsigned int []){ 0, 1, 2, 3, 5, 6, 7, 8, 9, /* 10 */ }, + + .feat = &tsens_v0_1_feat, + .fields = tsens_v0_1_regfields, +-- +2.39.2 + diff --git a/queue-5.15/thermal-drivers-tsens-sort-out-msm8976-vs-msm8956-da.patch b/queue-5.15/thermal-drivers-tsens-sort-out-msm8976-vs-msm8956-da.patch new file mode 100644 index 00000000000..032613dc4cf --- /dev/null +++ b/queue-5.15/thermal-drivers-tsens-sort-out-msm8976-vs-msm8956-da.patch @@ -0,0 +1,156 @@ +From 060508a7b619981c80b1d4cb1ecd48993eb97aa6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 1 Jan 2023 21:40:20 +0200 +Subject: thermal/drivers/tsens: Sort out msm8976 vs msm8956 data + +From: Dmitry Baryshkov + +[ Upstream commit a7d3006be5ca7b04e4b84b5ceaae55a700e511bd ] + +Tsens driver mentions that msm8976 data should be used for both msm8976 +and msm8956 SoCs. This is not quite correct, as according to the +vendor kernels, msm8976 should use standard slope values (3200), while +msm8956 really uses the slope values found in the driver. + +Add separate compatibility string for msm8956, move slope value +overrides to the corresponding init function and use the standard +compute_intercept_slope() function for both platforms. + +Fixes: 0e580290170d ("thermal: qcom: tsens-v1: Add support for MSM8956 and MSM8976") +Cc: AngeloGioacchino Del Regno +Reviewed-by: AngeloGioacchino Del Regno +Reviewed-by: Konrad Dybcio +Signed-off-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20230101194034.831222-7-dmitry.baryshkov@linaro.org +Signed-off-by: Daniel Lezcano +Signed-off-by: Sasha Levin +--- + drivers/thermal/qcom/tsens-v1.c | 56 ++++++++++++++++++--------------- + drivers/thermal/qcom/tsens.c | 3 ++ + drivers/thermal/qcom/tsens.h | 2 +- + 3 files changed, 34 insertions(+), 27 deletions(-) + +diff --git a/drivers/thermal/qcom/tsens-v1.c b/drivers/thermal/qcom/tsens-v1.c +index 13624263f1dfe..faa4576fa028f 100644 +--- a/drivers/thermal/qcom/tsens-v1.c ++++ b/drivers/thermal/qcom/tsens-v1.c +@@ -137,30 +137,6 @@ + #define CAL_SEL_MASK 7 + #define CAL_SEL_SHIFT 0 + +-static void compute_intercept_slope_8976(struct tsens_priv *priv, +- u32 *p1, u32 *p2, u32 mode) +-{ +- int i; +- +- priv->sensor[0].slope = 3313; +- priv->sensor[1].slope = 3275; +- priv->sensor[2].slope = 3320; +- priv->sensor[3].slope = 3246; +- priv->sensor[4].slope = 3279; +- priv->sensor[5].slope = 3257; +- priv->sensor[6].slope = 3234; +- priv->sensor[7].slope = 3269; +- priv->sensor[8].slope = 3255; +- priv->sensor[9].slope = 3239; +- priv->sensor[10].slope = 3286; +- +- for (i = 0; i < priv->num_sensors; i++) { +- priv->sensor[i].offset = (p1[i] * SLOPE_FACTOR) - +- (CAL_DEGC_PT1 * +- priv->sensor[i].slope); +- } +-} +- + static int calibrate_v1(struct tsens_priv *priv) + { + u32 base0 = 0, base1 = 0; +@@ -286,7 +262,7 @@ static int calibrate_8976(struct tsens_priv *priv) + break; + } + +- compute_intercept_slope_8976(priv, p1, p2, mode); ++ compute_intercept_slope(priv, p1, p2, mode); + kfree(qfprom_cdata); + + return 0; +@@ -357,6 +333,22 @@ static const struct reg_field tsens_v1_regfields[MAX_REGFIELDS] = { + [TRDY] = REG_FIELD(TM_TRDY_OFF, 0, 0), + }; + ++static int __init init_8956(struct tsens_priv *priv) { ++ priv->sensor[0].slope = 3313; ++ priv->sensor[1].slope = 3275; ++ priv->sensor[2].slope = 3320; ++ priv->sensor[3].slope = 3246; ++ priv->sensor[4].slope = 3279; ++ priv->sensor[5].slope = 3257; ++ priv->sensor[6].slope = 3234; ++ priv->sensor[7].slope = 3269; ++ priv->sensor[8].slope = 3255; ++ priv->sensor[9].slope = 3239; ++ priv->sensor[10].slope = 3286; ++ ++ return init_common(priv); ++} ++ + static const struct tsens_ops ops_generic_v1 = { + .init = init_common, + .calibrate = calibrate_v1, +@@ -369,13 +361,25 @@ struct tsens_plat_data data_tsens_v1 = { + .fields = tsens_v1_regfields, + }; + ++static const struct tsens_ops ops_8956 = { ++ .init = init_8956, ++ .calibrate = calibrate_8976, ++ .get_temp = get_temp_tsens_valid, ++}; ++ ++struct tsens_plat_data data_8956 = { ++ .num_sensors = 11, ++ .ops = &ops_8956, ++ .feat = &tsens_v1_feat, ++ .fields = tsens_v1_regfields, ++}; ++ + static const struct tsens_ops ops_8976 = { + .init = init_common, + .calibrate = calibrate_8976, + .get_temp = get_temp_tsens_valid, + }; + +-/* Valid for both MSM8956 and MSM8976. */ + struct tsens_plat_data data_8976 = { + .num_sensors = 11, + .ops = &ops_8976, +diff --git a/drivers/thermal/qcom/tsens.c b/drivers/thermal/qcom/tsens.c +index cef1cbcf03f41..926cd8b41132c 100644 +--- a/drivers/thermal/qcom/tsens.c ++++ b/drivers/thermal/qcom/tsens.c +@@ -978,6 +978,9 @@ static const struct of_device_id tsens_table[] = { + }, { + .compatible = "qcom,msm8939-tsens", + .data = &data_8939, ++ }, { ++ .compatible = "qcom,msm8956-tsens", ++ .data = &data_8956, + }, { + .compatible = "qcom,msm8960-tsens", + .data = &data_8960, +diff --git a/drivers/thermal/qcom/tsens.h b/drivers/thermal/qcom/tsens.h +index 1471a2c00f158..c2e5aee159276 100644 +--- a/drivers/thermal/qcom/tsens.h ++++ b/drivers/thermal/qcom/tsens.h +@@ -590,7 +590,7 @@ extern struct tsens_plat_data data_8960; + extern struct tsens_plat_data data_8916, data_8939, data_8974, data_9607; + + /* TSENS v1 targets */ +-extern struct tsens_plat_data data_tsens_v1, data_8976; ++extern struct tsens_plat_data data_tsens_v1, data_8976, data_8956; + + /* TSENS v2 targets */ + extern struct tsens_plat_data data_8996, data_tsens_v2; +-- +2.39.2 + diff --git a/queue-5.15/thermal-intel-fix-unsigned-comparison-with-less-than.patch b/queue-5.15/thermal-intel-fix-unsigned-comparison-with-less-than.patch new file mode 100644 index 00000000000..b8f80e69588 --- /dev/null +++ b/queue-5.15/thermal-intel-fix-unsigned-comparison-with-less-than.patch @@ -0,0 +1,42 @@ +From 08703be9fbd9a44c6fb3426db7fec921dd7e30e9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Jan 2023 08:59:51 +0800 +Subject: thermal: intel: Fix unsigned comparison with less than zero + +From: Yang Li + +[ Upstream commit e7fcfe67f9f410736b758969477b17ea285e8e6c ] + +The return value from the call to intel_tcc_get_tjmax() is int, which can +be a negative error code. However, the return value is being assigned to +an u32 variable 'tj_max', so making 'tj_max' an int. + +Eliminate the following warning: +./drivers/thermal/intel/intel_soc_dts_iosf.c:394:5-11: WARNING: Unsigned expression compared with zero: tj_max < 0 + +Link: https://bugzilla.openanolis.cn/show_bug.cgi?id=3637 +Reported-by: Abaci Robot +Signed-off-by: Yang Li +Acked-by: Zhang Rui +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/thermal/intel/intel_soc_dts_iosf.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/thermal/intel/intel_soc_dts_iosf.c b/drivers/thermal/intel/intel_soc_dts_iosf.c +index 342b0bb5a56d9..8651ff1abe754 100644 +--- a/drivers/thermal/intel/intel_soc_dts_iosf.c ++++ b/drivers/thermal/intel/intel_soc_dts_iosf.c +@@ -405,7 +405,7 @@ struct intel_soc_dts_sensors *intel_soc_dts_iosf_init( + { + struct intel_soc_dts_sensors *sensors; + bool notification; +- u32 tj_max; ++ int tj_max; + int ret; + int i; + +-- +2.39.2 + diff --git a/queue-5.15/thermal-intel-intel_pch-add-support-for-wellsburg-pc.patch b/queue-5.15/thermal-intel-intel_pch-add-support-for-wellsburg-pc.patch new file mode 100644 index 00000000000..0d21a634144 --- /dev/null +++ b/queue-5.15/thermal-intel-intel_pch-add-support-for-wellsburg-pc.patch @@ -0,0 +1,64 @@ +From d3ab9c4cbd155bd66c473abcb11178f7f708c37b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 7 Jan 2023 20:25:13 +0100 +Subject: thermal: intel: intel_pch: Add support for Wellsburg PCH + +From: Tim Zimmermann + +[ Upstream commit 40dc1929089fc844ea06d9f8bdb6211ed4517c2e ] + +Add the PCI ID for the Wellsburg C610 series chipset PCH. + +The driver can read the temperature from the Wellsburg PCH with only +the PCI ID added and no other modifications. + +Signed-off-by: Tim Zimmermann +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/thermal/intel/intel_pch_thermal.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/thermal/intel/intel_pch_thermal.c b/drivers/thermal/intel/intel_pch_thermal.c +index 527c91f5960be..768c66046a599 100644 +--- a/drivers/thermal/intel/intel_pch_thermal.c ++++ b/drivers/thermal/intel/intel_pch_thermal.c +@@ -29,6 +29,7 @@ + #define PCH_THERMAL_DID_CNL_LP 0x02F9 /* CNL-LP PCH */ + #define PCH_THERMAL_DID_CML_H 0X06F9 /* CML-H PCH */ + #define PCH_THERMAL_DID_LWB 0xA1B1 /* Lewisburg PCH */ ++#define PCH_THERMAL_DID_WBG 0x8D24 /* Wellsburg PCH */ + + /* Wildcat Point-LP PCH Thermal registers */ + #define WPT_TEMP 0x0000 /* Temperature */ +@@ -345,6 +346,7 @@ enum board_ids { + board_cnl, + board_cml, + board_lwb, ++ board_wbg, + }; + + static const struct board_info { +@@ -375,6 +377,10 @@ static const struct board_info { + .name = "pch_lewisburg", + .ops = &pch_dev_ops_wpt, + }, ++ [board_wbg] = { ++ .name = "pch_wellsburg", ++ .ops = &pch_dev_ops_wpt, ++ }, + }; + + static int intel_pch_thermal_probe(struct pci_dev *pdev, +@@ -490,6 +496,8 @@ static const struct pci_device_id intel_pch_thermal_id[] = { + .driver_data = board_cml, }, + { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCH_THERMAL_DID_LWB), + .driver_data = board_lwb, }, ++ { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCH_THERMAL_DID_WBG), ++ .driver_data = board_wbg, }, + { 0, }, + }; + MODULE_DEVICE_TABLE(pci, intel_pch_thermal_id); +-- +2.39.2 + diff --git a/queue-5.15/time-debug-fix-memory-leak-with-using-debugfs_lookup.patch b/queue-5.15/time-debug-fix-memory-leak-with-using-debugfs_lookup.patch new file mode 100644 index 00000000000..24631cd4b26 --- /dev/null +++ b/queue-5.15/time-debug-fix-memory-leak-with-using-debugfs_lookup.patch @@ -0,0 +1,38 @@ +From 4492220a3338d74bf9dd3891ebd0590ee9fe44e3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Feb 2023 16:12:14 +0100 +Subject: time/debug: Fix memory leak with using debugfs_lookup() + +From: Greg Kroah-Hartman + +[ Upstream commit 5b268d8abaec6cbd4bd70d062e769098d96670aa ] + +When calling debugfs_lookup() the result must have dput() called on it, +otherwise the memory will leak over time. To make things simpler, just +call debugfs_lookup_and_remove() instead which handles all of the logic at +once. + +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Thomas Gleixner +Link: https://lore.kernel.org/r/20230202151214.2306822-1-gregkh@linuxfoundation.org +Signed-off-by: Sasha Levin +--- + kernel/time/test_udelay.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/time/test_udelay.c b/kernel/time/test_udelay.c +index 13b11eb62685e..20d5df631570e 100644 +--- a/kernel/time/test_udelay.c ++++ b/kernel/time/test_udelay.c +@@ -149,7 +149,7 @@ module_init(udelay_test_init); + static void __exit udelay_test_exit(void) + { + mutex_lock(&udelay_test_lock); +- debugfs_remove(debugfs_lookup(DEBUGFS_FILENAME, NULL)); ++ debugfs_lookup_and_remove(DEBUGFS_FILENAME, NULL); + mutex_unlock(&udelay_test_lock); + } + +-- +2.39.2 + diff --git a/queue-5.15/timers-prevent-union-confusion-from-unexpected-resta.patch b/queue-5.15/timers-prevent-union-confusion-from-unexpected-resta.patch new file mode 100644 index 00000000000..99e43ed532e --- /dev/null +++ b/queue-5.15/timers-prevent-union-confusion-from-unexpected-resta.patch @@ -0,0 +1,108 @@ +From 065419e683b7de1b12ef57ea2a20cf36c48213dd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Jan 2023 14:44:03 +0100 +Subject: timers: Prevent union confusion from unexpected restart_syscall() + +From: Jann Horn + +[ Upstream commit 9f76d59173d9d146e96c66886b671c1915a5c5e5 ] + +The nanosleep syscalls use the restart_block mechanism, with a quirk: +The `type` and `rmtp`/`compat_rmtp` fields are set up unconditionally on +syscall entry, while the rest of the restart_block is only set up in the +unlikely case that the syscall is actually interrupted by a signal (or +pseudo-signal) that doesn't have a signal handler. + +If the restart_block was set up by a previous syscall (futex(..., +FUTEX_WAIT, ...) or poll()) and hasn't been invalidated somehow since then, +this will clobber some of the union fields used by futex_wait_restart() and +do_restart_poll(). + +If userspace afterwards wrongly calls the restart_syscall syscall, +futex_wait_restart()/do_restart_poll() will read struct fields that have +been clobbered. + +This doesn't actually lead to anything particularly interesting because +none of the union fields contain trusted kernel data, and +futex(..., FUTEX_WAIT, ...) and poll() aren't syscalls where it makes much +sense to apply seccomp filters to their arguments. + +So the current consequences are just of the "if userspace does bad stuff, +it can damage itself, and that's not a problem" flavor. + +But still, it seems like a hazard for future developers, so invalidate the +restart_block when partly setting it up in the nanosleep syscalls. + +Signed-off-by: Jann Horn +Signed-off-by: Thomas Gleixner +Link: https://lore.kernel.org/r/20230105134403.754986-1-jannh@google.com +Signed-off-by: Sasha Levin +--- + kernel/time/hrtimer.c | 2 ++ + kernel/time/posix-stubs.c | 2 ++ + kernel/time/posix-timers.c | 2 ++ + 3 files changed, 6 insertions(+) + +diff --git a/kernel/time/hrtimer.c b/kernel/time/hrtimer.c +index 23af5eca11b14..97409581e9dac 100644 +--- a/kernel/time/hrtimer.c ++++ b/kernel/time/hrtimer.c +@@ -2126,6 +2126,7 @@ SYSCALL_DEFINE2(nanosleep, struct __kernel_timespec __user *, rqtp, + if (!timespec64_valid(&tu)) + return -EINVAL; + ++ current->restart_block.fn = do_no_restart_syscall; + current->restart_block.nanosleep.type = rmtp ? TT_NATIVE : TT_NONE; + current->restart_block.nanosleep.rmtp = rmtp; + return hrtimer_nanosleep(timespec64_to_ktime(tu), HRTIMER_MODE_REL, +@@ -2147,6 +2148,7 @@ SYSCALL_DEFINE2(nanosleep_time32, struct old_timespec32 __user *, rqtp, + if (!timespec64_valid(&tu)) + return -EINVAL; + ++ current->restart_block.fn = do_no_restart_syscall; + current->restart_block.nanosleep.type = rmtp ? TT_COMPAT : TT_NONE; + current->restart_block.nanosleep.compat_rmtp = rmtp; + return hrtimer_nanosleep(timespec64_to_ktime(tu), HRTIMER_MODE_REL, +diff --git a/kernel/time/posix-stubs.c b/kernel/time/posix-stubs.c +index fcb3b21d8bdcd..3783d07d60ba0 100644 +--- a/kernel/time/posix-stubs.c ++++ b/kernel/time/posix-stubs.c +@@ -146,6 +146,7 @@ SYSCALL_DEFINE4(clock_nanosleep, const clockid_t, which_clock, int, flags, + return -EINVAL; + if (flags & TIMER_ABSTIME) + rmtp = NULL; ++ current->restart_block.fn = do_no_restart_syscall; + current->restart_block.nanosleep.type = rmtp ? TT_NATIVE : TT_NONE; + current->restart_block.nanosleep.rmtp = rmtp; + texp = timespec64_to_ktime(t); +@@ -239,6 +240,7 @@ SYSCALL_DEFINE4(clock_nanosleep_time32, clockid_t, which_clock, int, flags, + return -EINVAL; + if (flags & TIMER_ABSTIME) + rmtp = NULL; ++ current->restart_block.fn = do_no_restart_syscall; + current->restart_block.nanosleep.type = rmtp ? TT_COMPAT : TT_NONE; + current->restart_block.nanosleep.compat_rmtp = rmtp; + texp = timespec64_to_ktime(t); +diff --git a/kernel/time/posix-timers.c b/kernel/time/posix-timers.c +index 5dead89308b74..0c8a87a11b39d 100644 +--- a/kernel/time/posix-timers.c ++++ b/kernel/time/posix-timers.c +@@ -1270,6 +1270,7 @@ SYSCALL_DEFINE4(clock_nanosleep, const clockid_t, which_clock, int, flags, + return -EINVAL; + if (flags & TIMER_ABSTIME) + rmtp = NULL; ++ current->restart_block.fn = do_no_restart_syscall; + current->restart_block.nanosleep.type = rmtp ? TT_NATIVE : TT_NONE; + current->restart_block.nanosleep.rmtp = rmtp; + +@@ -1297,6 +1298,7 @@ SYSCALL_DEFINE4(clock_nanosleep_time32, clockid_t, which_clock, int, flags, + return -EINVAL; + if (flags & TIMER_ABSTIME) + rmtp = NULL; ++ current->restart_block.fn = do_no_restart_syscall; + current->restart_block.nanosleep.type = rmtp ? TT_COMPAT : TT_NONE; + current->restart_block.nanosleep.compat_rmtp = rmtp; + +-- +2.39.2 + diff --git a/queue-5.15/tools-power-x86-intel-speed-select-add-emerald-rapid.patch b/queue-5.15/tools-power-x86-intel-speed-select-add-emerald-rapid.patch new file mode 100644 index 00000000000..8c1aa37456a --- /dev/null +++ b/queue-5.15/tools-power-x86-intel-speed-select-add-emerald-rapid.patch @@ -0,0 +1,37 @@ +From 044cb14d4dcbea8f975734621b9d9604408c0cec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Aug 2022 15:44:42 +0800 +Subject: tools/power/x86/intel-speed-select: Add Emerald Rapid quirk + +From: Zhang Rui + +[ Upstream commit 61f9fdcdcd01f9a996b6db4e7092fcdfe8414ad5 ] + +Need memory frequency quirk as Sapphire Rapids in Emerald Rapids. +So add Emerald Rapids CPU model check in is_spr_platform(). + +Signed-off-by: Zhang Rui +[srinivas.pandruvada@linux.intel.com: Subject, changelog and code edits] +Signed-off-by: Srinivas Pandruvada +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + tools/power/x86/intel-speed-select/isst-config.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/power/x86/intel-speed-select/isst-config.c b/tools/power/x86/intel-speed-select/isst-config.c +index bf9fd3549a1d5..cd08ffe0d62b0 100644 +--- a/tools/power/x86/intel-speed-select/isst-config.c ++++ b/tools/power/x86/intel-speed-select/isst-config.c +@@ -108,7 +108,7 @@ int is_skx_based_platform(void) + + int is_spr_platform(void) + { +- if (cpu_model == 0x8F) ++ if (cpu_model == 0x8F || cpu_model == 0xCF) + return 1; + + return 0; +-- +2.39.2 + diff --git a/queue-5.15/trace-blktrace-fix-memory-leak-with-using-debugfs_lo.patch b/queue-5.15/trace-blktrace-fix-memory-leak-with-using-debugfs_lo.patch new file mode 100644 index 00000000000..8b11a7f8943 --- /dev/null +++ b/queue-5.15/trace-blktrace-fix-memory-leak-with-using-debugfs_lo.patch @@ -0,0 +1,47 @@ +From 4c69c86af31eb4f5dc6889d01e23fdcd9dc54a70 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Feb 2023 15:19:56 +0100 +Subject: trace/blktrace: fix memory leak with using debugfs_lookup() + +From: Greg Kroah-Hartman + +[ Upstream commit 83e8864fee26f63a7435e941b7c36a20fd6fe93e ] + +When calling debugfs_lookup() the result must have dput() called on it, +otherwise the memory will leak over time. To make things simpler, just +call debugfs_lookup_and_remove() instead which handles all of the logic +at once. + +Cc: Jens Axboe +Cc: Steven Rostedt +Cc: Masami Hiramatsu +Cc: linux-block@vger.kernel.org +Cc: linux-kernel@vger.kernel.org +Cc: linux-trace-kernel@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +Reviewed-by: Bart Van Assche +Link: https://lore.kernel.org/r/20230202141956.2299521-1-gregkh@linuxfoundation.org +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + kernel/trace/blktrace.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c +index 16b0d3fa56e00..e6d03cf148597 100644 +--- a/kernel/trace/blktrace.c ++++ b/kernel/trace/blktrace.c +@@ -319,8 +319,8 @@ static void blk_trace_free(struct request_queue *q, struct blk_trace *bt) + * under 'q->debugfs_dir', thus lookup and remove them. + */ + if (!bt->dir) { +- debugfs_remove(debugfs_lookup("dropped", q->debugfs_dir)); +- debugfs_remove(debugfs_lookup("msg", q->debugfs_dir)); ++ debugfs_lookup_and_remove("dropped", q->debugfs_dir); ++ debugfs_lookup_and_remove("msg", q->debugfs_dir); + } else { + debugfs_remove(bt->dir); + } +-- +2.39.2 + diff --git a/queue-5.15/tty-serial-fsl_lpuart-clear-lpuart-status-register-i.patch b/queue-5.15/tty-serial-fsl_lpuart-clear-lpuart-status-register-i.patch new file mode 100644 index 00000000000..d593b55bcef --- /dev/null +++ b/queue-5.15/tty-serial-fsl_lpuart-clear-lpuart-status-register-i.patch @@ -0,0 +1,40 @@ +From a0d2ae4c201338f64a73966733951aba65e81114 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Nov 2022 18:19:53 +0800 +Subject: tty: serial: fsl_lpuart: clear LPUART Status Register in + lpuart32_shutdown() + +From: Sherry Sun + +[ Upstream commit 4029dfc034febb54f6dd8ea83568accc943bc088 ] + +The LPUART Status Register needs to be cleared when closing the uart +port to get a clean environment when reopening the uart. + +Fixes: 380c966c093e ("tty: serial: fsl_lpuart: add 32-bit register interface support") +Signed-off-by: Sherry Sun +Link: https://lore.kernel.org/r/20221125101953.18753-4-sherry.sun@nxp.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/fsl_lpuart.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c +index 24f9001d10242..ccfd6dd5fbf4e 100644 +--- a/drivers/tty/serial/fsl_lpuart.c ++++ b/drivers/tty/serial/fsl_lpuart.c +@@ -1807,6 +1807,10 @@ static void lpuart32_shutdown(struct uart_port *port) + + spin_lock_irqsave(&port->lock, flags); + ++ /* clear status */ ++ temp = lpuart32_read(&sport->port, UARTSTAT); ++ lpuart32_write(&sport->port, temp, UARTSTAT); ++ + /* disable Rx/Tx DMA */ + temp = lpuart32_read(port, UARTBAUD); + temp &= ~(UARTBAUD_TDMAE | UARTBAUD_RDMAE); +-- +2.39.2 + diff --git a/queue-5.15/tty-serial-fsl_lpuart-disable-rx-tx-dma-in-lpuart32_.patch b/queue-5.15/tty-serial-fsl_lpuart-disable-rx-tx-dma-in-lpuart32_.patch new file mode 100644 index 00000000000..755799d3933 --- /dev/null +++ b/queue-5.15/tty-serial-fsl_lpuart-disable-rx-tx-dma-in-lpuart32_.patch @@ -0,0 +1,42 @@ +From 3d82c68361bf4b40c98ddc3d465ae35a73317640 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Nov 2022 18:19:52 +0800 +Subject: tty: serial: fsl_lpuart: disable Rx/Tx DMA in lpuart32_shutdown() + +From: Sherry Sun + +[ Upstream commit 1d4bd0e4ae4ba95892bef919a8d4d3f08f122d7e ] + +UARTBAUD_RDMAE and UARTBAUD_TDMAE are enabled in lpuart32_startup(), but +lpuart32_shutdown() not disable them, only free the dma ring buffer and +release the dma channels, so here disable the Rx/Tx DMA first in +lpuart32_shutdown(). + +Fixes: 42b68768e51b ("serial: fsl_lpuart: DMA support for 32-bit variant") +Signed-off-by: Sherry Sun +Link: https://lore.kernel.org/r/20221125101953.18753-3-sherry.sun@nxp.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/fsl_lpuart.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c +index fc311df9f1c9d..24f9001d10242 100644 +--- a/drivers/tty/serial/fsl_lpuart.c ++++ b/drivers/tty/serial/fsl_lpuart.c +@@ -1807,6 +1807,11 @@ static void lpuart32_shutdown(struct uart_port *port) + + spin_lock_irqsave(&port->lock, flags); + ++ /* disable Rx/Tx DMA */ ++ temp = lpuart32_read(port, UARTBAUD); ++ temp &= ~(UARTBAUD_TDMAE | UARTBAUD_RDMAE); ++ lpuart32_write(port, temp, UARTBAUD); ++ + /* disable Rx/Tx and interrupts */ + temp = lpuart32_read(port, UARTCTRL); + temp &= ~(UARTCTRL_TE | UARTCTRL_RE | +-- +2.39.2 + diff --git a/queue-5.15/tty-serial-fsl_lpuart-fix-the-wrong-rxwater-setting-.patch b/queue-5.15/tty-serial-fsl_lpuart-fix-the-wrong-rxwater-setting-.patch new file mode 100644 index 00000000000..3fe9951831e --- /dev/null +++ b/queue-5.15/tty-serial-fsl_lpuart-fix-the-wrong-rxwater-setting-.patch @@ -0,0 +1,46 @@ +From 609e7d741e29ec683aef5f11578fdda1d0529b84 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Jan 2023 14:44:46 +0800 +Subject: tty: serial: fsl_lpuart: Fix the wrong RXWATER setting for rx dma + case + +From: Sherry Sun + +[ Upstream commit 9ad9df8447547febe9dd09b040f4528a09e495f0 ] + +The RXWATER value must be greater than 0 according to the LPUART +reference manual. And when the number of datawords in the receive +FIFO is greater than RXWATER, an interrupt or a DMA request is +generated, so no need to set the different value for lpuart interrupt +case and dma case. Here delete the wrong RXWATER setting for dma case +directly. + +Fixes: 42b68768e51b ("serial: fsl_lpuart: DMA support for 32-bit variant") +Signed-off-by: Sherry Sun +Link: https://lore.kernel.org/r/20230130064449.9564-4-sherry.sun@nxp.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/fsl_lpuart.c | 6 ------ + 1 file changed, 6 deletions(-) + +diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c +index ccfd6dd5fbf4e..08096d33af8a6 100644 +--- a/drivers/tty/serial/fsl_lpuart.c ++++ b/drivers/tty/serial/fsl_lpuart.c +@@ -1700,12 +1700,6 @@ static void lpuart32_configure(struct lpuart_port *sport) + { + unsigned long temp; + +- if (sport->lpuart_dma_rx_use) { +- /* RXWATER must be 0 */ +- temp = lpuart32_read(&sport->port, UARTWATER); +- temp &= ~(UARTWATER_WATER_MASK << UARTWATER_RXWATER_OFF); +- lpuart32_write(&sport->port, temp, UARTWATER); +- } + temp = lpuart32_read(&sport->port, UARTCTRL); + if (!sport->lpuart_dma_rx_use) + temp |= UARTCTRL_RIE; +-- +2.39.2 + diff --git a/queue-5.15/tty-serial-imx-disable-ageing-timer-interrupt-reques.patch b/queue-5.15/tty-serial-imx-disable-ageing-timer-interrupt-reques.patch new file mode 100644 index 00000000000..a1fc72ed1f7 --- /dev/null +++ b/queue-5.15/tty-serial-imx-disable-ageing-timer-interrupt-reques.patch @@ -0,0 +1,83 @@ +From dbf8247709de5c3a33b776a50e884657ca26f40e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Feb 2023 09:30:16 +0800 +Subject: tty: serial: imx: disable Ageing Timer interrupt request irq + +From: Peng Fan + +[ Upstream commit ef25e16ea9674b713a68c3bda821556ce9901254 ] + +There maybe pending USR interrupt before requesting irq, however +uart_add_one_port has not executed, so there will be kernel panic: +[ 0.795668] Unable to handle kernel NULL pointer dereference at virtual addre +ss 0000000000000080 +[ 0.802701] Mem abort info: +[ 0.805367] ESR = 0x0000000096000004 +[ 0.808950] EC = 0x25: DABT (current EL), IL = 32 bits +[ 0.814033] SET = 0, FnV = 0 +[ 0.816950] EA = 0, S1PTW = 0 +[ 0.819950] FSC = 0x04: level 0 translation fault +[ 0.824617] Data abort info: +[ 0.827367] ISV = 0, ISS = 0x00000004 +[ 0.831033] CM = 0, WnR = 0 +[ 0.833866] [0000000000000080] user address but active_mm is swapper +[ 0.839951] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP +[ 0.845953] Modules linked in: +[ 0.848869] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.1.1+g56321e101aca #1 +[ 0.855617] Hardware name: Freescale i.MX8MP EVK (DT) +[ 0.860452] pstate: 000000c5 (nzcv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) +[ 0.867117] pc : __imx_uart_rxint.constprop.0+0x11c/0x2c0 +[ 0.872283] lr : imx_uart_int+0xf8/0x1ec + +The issue only happends in the inmate linux when Jailhouse hypervisor +enabled. The test procedure is: +while true; do + jailhouse enable imx8mp.cell + jailhouse cell linux xxxx + sleep 10 + jailhouse cell destroy 1 + jailhouse disable + sleep 5 +done + +And during the upper test, press keys to the 2nd linux console. +When `jailhouse cell destroy 1`, the 2nd linux has no chance to put +the uart to a quiese state, so USR1/2 may has pending interrupts. Then +when `jailhosue cell linux xx` to start 2nd linux again, the issue +trigger. + +In order to disable irqs before requesting them, both UCR1 and UCR2 irqs +should be disabled, so here fix that, disable the Ageing Timer interrupt +in UCR2 as UCR1 does. + +Fixes: 8a61f0c70ae6 ("serial: imx: Disable irqs before requesting them") +Suggested-by: Sherry Sun +Reviewed-by: Sherry Sun +Signed-off-by: Peng Fan +Acked-by: Jason Liu +Link: https://lore.kernel.org/r/20230206013016.29352-1-sherry.sun@nxp.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/imx.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c +index 136da4bebe85a..77a4f4af3b8d5 100644 +--- a/drivers/tty/serial/imx.c ++++ b/drivers/tty/serial/imx.c +@@ -2348,6 +2348,11 @@ static int imx_uart_probe(struct platform_device *pdev) + ucr1 &= ~(UCR1_ADEN | UCR1_TRDYEN | UCR1_IDEN | UCR1_RRDYEN | UCR1_RTSDEN); + imx_uart_writel(sport, ucr1, UCR1); + ++ /* Disable Ageing Timer interrupt */ ++ ucr2 = imx_uart_readl(sport, UCR2); ++ ucr2 &= ~UCR2_ATEN; ++ imx_uart_writel(sport, ucr2, UCR2); ++ + /* + * In case RS485 is enabled without GPIO RTS control, the UART IP + * is used to control CTS signal. Keep both the UART and Receiver +-- +2.39.2 + diff --git a/queue-5.15/tty-serial-imx-handle-rs485-de-signal-active-high.patch b/queue-5.15/tty-serial-imx-handle-rs485-de-signal-active-high.patch new file mode 100644 index 00000000000..dbf0166d909 --- /dev/null +++ b/queue-5.15/tty-serial-imx-handle-rs485-de-signal-active-high.patch @@ -0,0 +1,237 @@ +From 9458f71fa1e6da817ff6d429ae66afceb109995b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Sep 2022 16:44:00 +0200 +Subject: tty: serial: imx: Handle RS485 DE signal active high + +From: Marek Vasut + +[ Upstream commit 79d0224f6bf296d04cd843cfc49921b19c97bb09 ] + +The default polarity of RS485 DE signal is active high. This driver does +not handle such case properly. Currently, when a pin is multiplexed as a +UART CTS_B on boot, this pin is pulled HIGH by the i.MX UART CTS circuit, +which activates DE signal on the RS485 transceiver and thus behave as if +the RS485 was transmitting data, so the system blocks the RS485 bus when +it starts and until user application takes over. This behavior is not OK. +The problem consists of two separate parts. + +First, the i.MX UART IP requires UCR1 UARTEN and UCR2 RXEN to be set for +UCR2 CTSC and CTS bits to have any effect. The UCR2 CTSC bit permits the +driver to set CTS (RTS_B or RS485 DE signal) to either level sychronous +to the internal UART IP clock. Compared to other options, like GPIO CTS +control, this has the benefit of being synchronous to the UART IP clock +and thus without glitches or bus delays. The reason for the CTS design +is likely because when the Receiver is disabled, the UART IP can never +indicate that it is ready to receive data by assering CTS signal, so +the CTS is always pulled HIGH by default. + +When the port is closed by user space, imx_uart_stop_rx() clears UCR2 +RXEN bit, and imx_uart_shutdown() clears UCR1 UARTEN bit. This disables +UART Receiver and UART itself, and forces CTS signal HIGH, which leads +to the RS485 bus being blocked because RS485 DE is incorrectly active. + +The proposed solution for this problem is to keep the Receiver running +even after the port is closed, but in loopback mode. This disconnects +the RX FIFO input from the RXD external signal, and since UCR2 TXEN is +cleared, the UART Transmitter is disabled, so nothing can feed data in +the RX FIFO. Because the Receiver is still enabled, the UCR2 CTSC and +CTS bits still have effect and the CTS (RS485 DE) control is retained. + +Note that in case of RS485 DE signal active low, there is no problem and +no special handling is necessary. The CTS signal defaults to HIGH, thus +the RS485 is by default set to Receive and the bus is not blocked. + +Note that while there is the possibility to control CTS using GPIO with +either CTS polarity, this has the downside of not being synchronous to +the UART IP clock and thus glitchy and susceptible to slow DE switching. + +Second, on boot, before the UART driver probe callback is called, the +driver core triggers pinctrl_init_done() and configures the IOMUXC to +default state. At this point, UCR1 UARTEN and UCR2 RXEN are both still +cleared, but UART CTS_B (RS485 DE) is configured as CTS function, thus +the RTS signal is pulled HIGH by the UART IP CTS circuit. + +One part of the solution here is to enable UCR1 UARTEN and UCR2 RXEN and +UTS loopback in this driver probe callback, thus unblocking the CTSC and +CTS control early on. But this is still too late, since the pin control +is already configured and CTS has been pulled HIGH for a short period +of time. + +When Linux kernel boots and this driver is bound, the pin control is set +to special "init" state if the state is available, and driver can switch +the "default" state afterward when ready. This state can be used to set +the CTS line as a GPIO in DT temporarily, and a GPIO hog can force such +GPIO to LOW, thus keeping the RS485 DE line LOW early on boot. Once the +driver takes over and UCR1 UARTEN and UCR2 RXEN and UTS loopback are all +enabled, the driver can switch to "default" pin control state and control +the CTS line as function instead. DT binding example is below: + +" +&gpio6 { + rts-init-hog { + gpio-hog; + gpios = <5 0>; + output-low; + line-name = "rs485-de"; + }; +}; + +&uart5 { /* DHCOM UART2 */ + pinctrl-0 = <&pinctrl_uart5>; + pinctrl-1 = <&pinctrl_uart5_init>; + pinctrl-names = "default", "init"; + ... +}; +pinctrl_uart5_init: uart5-init-grp { + fsl,pins = < +... + MX6QDL_PAD_CSI0_DAT19__GPIO6_IO05 0x30b1 + >; +}; + +pinctrl_uart5: uart5-grp { + fsl,pins = < +... + MX6QDL_PAD_CSI0_DAT19__UART5_CTS_B 0x30b1 + >; +}; +" + +Tested-by: Christoph Niedermaier +Reviewed-by: Fabio Estevam +Signed-off-by: Marek Vasut +Link: https://lore.kernel.org/r/20220929144400.13571-1-marex@denx.de +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: ef25e16ea967 ("tty: serial: imx: disable Ageing Timer interrupt request irq") +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/imx.c | 64 ++++++++++++++++++++++++++++++++++++---- + 1 file changed, 58 insertions(+), 6 deletions(-) + +diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c +index 711edb835c274..136da4bebe85a 100644 +--- a/drivers/tty/serial/imx.c ++++ b/drivers/tty/serial/imx.c +@@ -484,7 +484,7 @@ static void imx_uart_stop_tx(struct uart_port *port) + static void imx_uart_stop_rx(struct uart_port *port) + { + struct imx_port *sport = (struct imx_port *)port; +- u32 ucr1, ucr2, ucr4; ++ u32 ucr1, ucr2, ucr4, uts; + + ucr1 = imx_uart_readl(sport, UCR1); + ucr2 = imx_uart_readl(sport, UCR2); +@@ -500,7 +500,18 @@ static void imx_uart_stop_rx(struct uart_port *port) + imx_uart_writel(sport, ucr1, UCR1); + imx_uart_writel(sport, ucr4, UCR4); + +- ucr2 &= ~UCR2_RXEN; ++ /* See SER_RS485_ENABLED/UTS_LOOP comment in imx_uart_probe() */ ++ if (port->rs485.flags & SER_RS485_ENABLED && ++ port->rs485.flags & SER_RS485_RTS_ON_SEND && ++ sport->have_rtscts && !sport->have_rtsgpio) { ++ uts = imx_uart_readl(sport, imx_uart_uts_reg(sport)); ++ uts |= UTS_LOOP; ++ imx_uart_writel(sport, uts, imx_uart_uts_reg(sport)); ++ ucr2 |= UCR2_RXEN; ++ } else { ++ ucr2 &= ~UCR2_RXEN; ++ } ++ + imx_uart_writel(sport, ucr2, UCR2); + } + +@@ -1383,7 +1394,7 @@ static int imx_uart_startup(struct uart_port *port) + int retval, i; + unsigned long flags; + int dma_is_inited = 0; +- u32 ucr1, ucr2, ucr3, ucr4; ++ u32 ucr1, ucr2, ucr3, ucr4, uts; + + retval = clk_prepare_enable(sport->clk_per); + if (retval) +@@ -1488,6 +1499,11 @@ static int imx_uart_startup(struct uart_port *port) + imx_uart_writel(sport, ucr2, UCR2); + } + ++ /* See SER_RS485_ENABLED/UTS_LOOP comment in imx_uart_probe() */ ++ uts = imx_uart_readl(sport, imx_uart_uts_reg(sport)); ++ uts &= ~UTS_LOOP; ++ imx_uart_writel(sport, uts, imx_uart_uts_reg(sport)); ++ + spin_unlock_irqrestore(&sport->port.lock, flags); + + return 0; +@@ -1497,7 +1513,7 @@ static void imx_uart_shutdown(struct uart_port *port) + { + struct imx_port *sport = (struct imx_port *)port; + unsigned long flags; +- u32 ucr1, ucr2, ucr4; ++ u32 ucr1, ucr2, ucr4, uts; + + if (sport->dma_is_enabled) { + dmaengine_terminate_sync(sport->dma_chan_tx); +@@ -1541,7 +1557,18 @@ static void imx_uart_shutdown(struct uart_port *port) + spin_lock_irqsave(&sport->port.lock, flags); + + ucr1 = imx_uart_readl(sport, UCR1); +- ucr1 &= ~(UCR1_TRDYEN | UCR1_RRDYEN | UCR1_RTSDEN | UCR1_UARTEN | UCR1_RXDMAEN | UCR1_ATDMAEN); ++ ucr1 &= ~(UCR1_TRDYEN | UCR1_RRDYEN | UCR1_RTSDEN | UCR1_RXDMAEN | UCR1_ATDMAEN); ++ /* See SER_RS485_ENABLED/UTS_LOOP comment in imx_uart_probe() */ ++ if (port->rs485.flags & SER_RS485_ENABLED && ++ port->rs485.flags & SER_RS485_RTS_ON_SEND && ++ sport->have_rtscts && !sport->have_rtsgpio) { ++ uts = imx_uart_readl(sport, imx_uart_uts_reg(sport)); ++ uts |= UTS_LOOP; ++ imx_uart_writel(sport, uts, imx_uart_uts_reg(sport)); ++ ucr1 |= UCR1_UARTEN; ++ } else { ++ ucr1 &= ~UCR1_UARTEN; ++ } + imx_uart_writel(sport, ucr1, UCR1); + + ucr4 = imx_uart_readl(sport, UCR4); +@@ -2189,7 +2216,7 @@ static int imx_uart_probe(struct platform_device *pdev) + void __iomem *base; + u32 dma_buf_conf[2]; + int ret = 0; +- u32 ucr1; ++ u32 ucr1, ucr2, uts; + struct resource *res; + int txirq, rxirq, rtsirq; + +@@ -2321,6 +2348,31 @@ static int imx_uart_probe(struct platform_device *pdev) + ucr1 &= ~(UCR1_ADEN | UCR1_TRDYEN | UCR1_IDEN | UCR1_RRDYEN | UCR1_RTSDEN); + imx_uart_writel(sport, ucr1, UCR1); + ++ /* ++ * In case RS485 is enabled without GPIO RTS control, the UART IP ++ * is used to control CTS signal. Keep both the UART and Receiver ++ * enabled, otherwise the UART IP pulls CTS signal always HIGH no ++ * matter how the UCR2 CTSC and CTS bits are set. To prevent any ++ * data from being fed into the RX FIFO, enable loopback mode in ++ * UTS register, which disconnects the RX path from external RXD ++ * pin and connects it to the Transceiver, which is disabled, so ++ * no data can be fed to the RX FIFO that way. ++ */ ++ if (sport->port.rs485.flags & SER_RS485_ENABLED && ++ sport->have_rtscts && !sport->have_rtsgpio) { ++ uts = imx_uart_readl(sport, imx_uart_uts_reg(sport)); ++ uts |= UTS_LOOP; ++ imx_uart_writel(sport, uts, imx_uart_uts_reg(sport)); ++ ++ ucr1 = imx_uart_readl(sport, UCR1); ++ ucr1 |= UCR1_UARTEN; ++ imx_uart_writel(sport, ucr1, UCR1); ++ ++ ucr2 = imx_uart_readl(sport, UCR2); ++ ucr2 |= UCR2_RXEN; ++ imx_uart_writel(sport, ucr2, UCR2); ++ } ++ + if (!imx_uart_is_imx1(sport) && sport->dte_mode) { + /* + * The DCEDTE bit changes the direction of DSR, DCD, DTR and RI +-- +2.39.2 + diff --git a/queue-5.15/tty-serial-qcom-geni-serial-stop-operations-in-progr.patch b/queue-5.15/tty-serial-qcom-geni-serial-stop-operations-in-progr.patch new file mode 100644 index 00000000000..c20f9a12696 --- /dev/null +++ b/queue-5.15/tty-serial-qcom-geni-serial-stop-operations-in-progr.patch @@ -0,0 +1,40 @@ +From a9b64eb040aa8e32f707de41837ac46341fc12fc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Dec 2022 16:50:17 +0100 +Subject: tty: serial: qcom-geni-serial: stop operations in progress at + shutdown + +From: Bartosz Golaszewski + +[ Upstream commit d8aca2f96813d51df574a811eda9a2cbed00f261 ] + +We don't stop transmissions in progress at shutdown. This is fine with +FIFO SE mode but with DMA (support for which we'll introduce later) it +causes trouble so fix it now. + +Fixes: e83766334f96 ("tty: serial: qcom_geni_serial: No need to stop tx/rx on UART shutdown") +Signed-off-by: Bartosz Golaszewski +Reviewed-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20221229155030.418800-2-brgl@bgdev.pl +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/qcom_geni_serial.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/tty/serial/qcom_geni_serial.c b/drivers/tty/serial/qcom_geni_serial.c +index ce1c81731a2a8..e5ca3c3c27d21 100644 +--- a/drivers/tty/serial/qcom_geni_serial.c ++++ b/drivers/tty/serial/qcom_geni_serial.c +@@ -893,6 +893,8 @@ static int setup_fifos(struct qcom_geni_serial_port *port) + static void qcom_geni_serial_shutdown(struct uart_port *uport) + { + disable_irq(uport->irq); ++ qcom_geni_serial_stop_tx(uport); ++ qcom_geni_serial_stop_rx(uport); + } + + static int qcom_geni_serial_port_setup(struct uart_port *uport) +-- +2.39.2 + diff --git a/queue-5.15/tun-tun_chr_open-correctly-initialize-socket-uid.patch b/queue-5.15/tun-tun_chr_open-correctly-initialize-socket-uid.patch new file mode 100644 index 00000000000..bf2ae28ac4f --- /dev/null +++ b/queue-5.15/tun-tun_chr_open-correctly-initialize-socket-uid.patch @@ -0,0 +1,47 @@ +From dc3a6fd16be0c9cb5b084379112e31f96ff05df9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 4 Feb 2023 17:39:21 +0000 +Subject: tun: tun_chr_open(): correctly initialize socket uid + +From: Pietro Borrello + +[ Upstream commit a096ccca6e503a5c575717ff8a36ace27510ab0a ] + +sock_init_data() assumes that the `struct socket` passed in input is +contained in a `struct socket_alloc` allocated with sock_alloc(). +However, tun_chr_open() passes a `struct socket` embedded in a `struct +tun_file` allocated with sk_alloc(). +This causes a type confusion when issuing a container_of() with +SOCK_INODE() in sock_init_data() which results in assigning a wrong +sk_uid to the `struct sock` in input. +On default configuration, the type confused field overlaps with the +high 4 bytes of `struct tun_struct __rcu *tun` of `struct tun_file`, +NULL at the time of call, which makes the uid of all tun sockets 0, +i.e., the root one. +Fix the assignment by using sock_init_data_uid(). + +Fixes: 86741ec25462 ("net: core: Add a UID field to struct sock.") +Signed-off-by: Pietro Borrello +Reviewed-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/tun.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/tun.c b/drivers/net/tun.c +index a1dda57c812dd..30eea8270c9b2 100644 +--- a/drivers/net/tun.c ++++ b/drivers/net/tun.c +@@ -3411,7 +3411,7 @@ static int tun_chr_open(struct inode *inode, struct file * file) + tfile->socket.file = file; + tfile->socket.ops = &tun_socket_ops; + +- sock_init_data(&tfile->socket, &tfile->sk); ++ sock_init_data_uid(&tfile->socket, &tfile->sk, inode->i_uid); + + tfile->sk.sk_write_space = tun_sock_write_space; + tfile->sk.sk_sndbuf = INT_MAX; +-- +2.39.2 + diff --git a/queue-5.15/uaccess-add-minimum-bounds-check-on-kernel-buffer-si.patch b/queue-5.15/uaccess-add-minimum-bounds-check-on-kernel-buffer-si.patch new file mode 100644 index 00000000000..2b060f836bb --- /dev/null +++ b/queue-5.15/uaccess-add-minimum-bounds-check-on-kernel-buffer-si.patch @@ -0,0 +1,70 @@ +From 98d8695102d3c35ef6081624d2959be0eb97a2bd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 Jan 2023 17:37:59 -0800 +Subject: uaccess: Add minimum bounds check on kernel buffer size + +From: Kees Cook + +[ Upstream commit 04ffde1319a715bd0550ded3580d4ea3bc003776 ] + +While there is logic about the difference between ksize and usize, +copy_struct_from_user() didn't check the size of the destination buffer +(when it was known) against ksize. Add this check so there is an upper +bounds check on the possible memset() call, otherwise lower bounds +checks made by callers will trigger bounds warnings under -Warray-bounds. +Seen under GCC 13: + +In function 'copy_struct_from_user', + inlined from 'iommufd_fops_ioctl' at +../drivers/iommu/iommufd/main.c:333:8: +../include/linux/fortify-string.h:59:33: warning: '__builtin_memset' offset [57, 4294967294] is out of the bounds [0, 56] of object 'buf' with type 'union ucmd_buffer' [-Warray-bounds=] + 59 | #define __underlying_memset __builtin_memset + | ^ +../include/linux/fortify-string.h:453:9: note: in expansion of macro '__underlying_memset' + 453 | __underlying_memset(p, c, __fortify_size); \ + | ^~~~~~~~~~~~~~~~~~~ +../include/linux/fortify-string.h:461:25: note: in expansion of macro '__fortify_memset_chk' + 461 | #define memset(p, c, s) __fortify_memset_chk(p, c, s, \ + | ^~~~~~~~~~~~~~~~~~~~ +../include/linux/uaccess.h:334:17: note: in expansion of macro 'memset' + 334 | memset(dst + size, 0, rest); + | ^~~~~~ +../drivers/iommu/iommufd/main.c: In function 'iommufd_fops_ioctl': +../drivers/iommu/iommufd/main.c:311:27: note: 'buf' declared here + 311 | union ucmd_buffer buf; + | ^~~ + +Cc: Christian Brauner +Cc: Rasmus Villemoes +Cc: Arnd Bergmann +Cc: Dinh Nguyen +Cc: Catalin Marinas +Cc: Andrew Morton +Cc: Geert Uytterhoeven +Cc: Alexander Potapenko +Acked-by: Aleksa Sarai +Signed-off-by: Kees Cook +Link: https://lore.kernel.org/lkml/20230203193523.never.667-kees@kernel.org/ +Signed-off-by: Sasha Levin +--- + include/linux/uaccess.h | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/include/linux/uaccess.h b/include/linux/uaccess.h +index ac0394087f7d4..e1d59ca6530da 100644 +--- a/include/linux/uaccess.h ++++ b/include/linux/uaccess.h +@@ -338,6 +338,10 @@ copy_struct_from_user(void *dst, size_t ksize, const void __user *src, + size_t size = min(ksize, usize); + size_t rest = max(ksize, usize) - size; + ++ /* Double check if ksize is larger than a known object size. */ ++ if (WARN_ON_ONCE(ksize > __builtin_object_size(dst, 1))) ++ return -E2BIG; ++ + /* Deal with trailing bytes. */ + if (usize < ksize) { + memset(dst + size, 0, rest); +-- +2.39.2 + diff --git a/queue-5.15/udf-define-efscorrupted-error-code.patch b/queue-5.15/udf-define-efscorrupted-error-code.patch new file mode 100644 index 00000000000..862e5bd8506 --- /dev/null +++ b/queue-5.15/udf-define-efscorrupted-error-code.patch @@ -0,0 +1,34 @@ +From 5f520e8e55b5ce25eec797a8d1bf87be1c5fd09e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Sep 2022 16:34:45 +0200 +Subject: udf: Define EFSCORRUPTED error code + +From: Jan Kara + +[ Upstream commit 3d2d7e61553dbcc8ba45201d8ae4f383742c8202 ] + +Similarly to other filesystems define EFSCORRUPTED error code for +reporting internal filesystem corruption. + +Signed-off-by: Jan Kara +Signed-off-by: Sasha Levin +--- + fs/udf/udf_sb.h | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/fs/udf/udf_sb.h b/fs/udf/udf_sb.h +index 4fa620543d302..2205859731dc2 100644 +--- a/fs/udf/udf_sb.h ++++ b/fs/udf/udf_sb.h +@@ -51,6 +51,8 @@ + #define MF_DUPLICATE_MD 0x01 + #define MF_MIRROR_FE_LOADED 0x02 + ++#define EFSCORRUPTED EUCLEAN ++ + struct udf_meta_data { + __u32 s_meta_file_loc; + __u32 s_mirror_file_loc; +-- +2.39.2 + diff --git a/queue-5.15/usb-early-xhci-dbc-fix-a-potential-out-of-bound-memo.patch b/queue-5.15/usb-early-xhci-dbc-fix-a-potential-out-of-bound-memo.patch new file mode 100644 index 00000000000..406739a3d0d --- /dev/null +++ b/queue-5.15/usb-early-xhci-dbc-fix-a-potential-out-of-bound-memo.patch @@ -0,0 +1,41 @@ +From e37332b258265767c737611f91da40e029120227 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 29 Jan 2023 19:23:08 +0100 +Subject: usb: early: xhci-dbc: Fix a potential out-of-bound memory access + +From: Christophe JAILLET + +[ Upstream commit a4a97ab3db5c081eb6e7dba91306adefb461e0bd ] + +If xdbc_bulk_write() fails, the values in 'buf' can be anything. So the +string is not guaranteed to be NULL terminated when xdbc_trace() is called. + +Reserve an extra byte, which will be zeroed automatically because 'buf' is +a static variable, in order to avoid troubles, should it happen. + +Fixes: aeb9dd1de98c ("usb/early: Add driver for xhci debug capability") +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/d6a7562c5e839a195cee85db6dc81817f9372cb1.1675016180.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/early/xhci-dbc.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/usb/early/xhci-dbc.c b/drivers/usb/early/xhci-dbc.c +index 6c0434100e38c..b0c4071f0b167 100644 +--- a/drivers/usb/early/xhci-dbc.c ++++ b/drivers/usb/early/xhci-dbc.c +@@ -871,7 +871,8 @@ static int xdbc_bulk_write(const char *bytes, int size) + + static void early_xdbc_write(struct console *con, const char *str, u32 n) + { +- static char buf[XDBC_MAX_PACKET]; ++ /* static variables are zeroed, so buf is always NULL terminated */ ++ static char buf[XDBC_MAX_PACKET + 1]; + int chunk, ret; + int use_cr = 0; + +-- +2.39.2 + diff --git a/queue-5.15/usb-gadget-configfs-remove-using-list-iterator-after.patch b/queue-5.15/usb-gadget-configfs-remove-using-list-iterator-after.patch new file mode 100644 index 00000000000..a48281c56db --- /dev/null +++ b/queue-5.15/usb-gadget-configfs-remove-using-list-iterator-after.patch @@ -0,0 +1,87 @@ +From 53427a05758913b2d6f644b8a22e9a82eb64bf9c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Mar 2022 18:18:09 +0100 +Subject: usb: gadget: configfs: remove using list iterator after loop body as + a ptr + +From: Jakob Koschel + +[ Upstream commit 36f4c25ce32ed8a2e6304ebee6246b7f0b3b9a6f ] + +If the list does not contain the expected element, the value of +list_for_each_entry() iterator will not point to a valid structure. +To avoid type confusion in such case, the list iterator +scope will be limited to list_for_each_entry() loop. + +In preparation to limiting scope of a list iterator to the list traversal +loop, use a dedicated pointer to point to the found element [1]. +Determining if an element was found is then simply checking if +the pointer is != NULL instead of using the potentially bogus pointer. + +Link: https://lore.kernel.org/all/YhdfEIwI4EdtHdym@kroah.com/ +Signed-off-by: Jakob Koschel +Link: https://lore.kernel.org/r/20220308171818.384491-18-jakobkoschel@gmail.com +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: 89e7252d6c7e ("usb: gadget: configfs: Restrict symlink creation is UDC already binded") +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/configfs.c | 24 ++++++++++++++---------- + 1 file changed, 14 insertions(+), 10 deletions(-) + +diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c +index 8166e771e8663..891d8e4023221 100644 +--- a/drivers/usb/gadget/configfs.c ++++ b/drivers/usb/gadget/configfs.c +@@ -418,7 +418,7 @@ static int config_usb_cfg_link( + + struct usb_function_instance *fi = + to_usb_function_instance(usb_func_ci); +- struct usb_function_instance *a_fi; ++ struct usb_function_instance *a_fi = NULL, *iter; + struct usb_function *f; + int ret; + +@@ -428,11 +428,13 @@ static int config_usb_cfg_link( + * from another gadget or a random directory. + * Also a function instance can only be linked once. + */ +- list_for_each_entry(a_fi, &gi->available_func, cfs_list) { +- if (a_fi == fi) +- break; ++ list_for_each_entry(iter, &gi->available_func, cfs_list) { ++ if (iter != fi) ++ continue; ++ a_fi = iter; ++ break; + } +- if (a_fi != fi) { ++ if (!a_fi) { + ret = -EINVAL; + goto out; + } +@@ -889,15 +891,17 @@ static int os_desc_link(struct config_item *os_desc_ci, + struct gadget_info, os_desc_group); + struct usb_composite_dev *cdev = &gi->cdev; + struct config_usb_cfg *c_target = to_config_usb_cfg(usb_cfg_ci); +- struct usb_configuration *c; ++ struct usb_configuration *c = NULL, *iter; + int ret; + + mutex_lock(&gi->lock); +- list_for_each_entry(c, &cdev->configs, list) { +- if (c == &c_target->c) +- break; ++ list_for_each_entry(iter, &cdev->configs, list) { ++ if (iter != &c_target->c) ++ continue; ++ c = iter; ++ break; + } +- if (c != &c_target->c) { ++ if (!c) { + ret = -EINVAL; + goto out; + } +-- +2.39.2 + diff --git a/queue-5.15/usb-gadget-configfs-restrict-symlink-creation-is-udc.patch b/queue-5.15/usb-gadget-configfs-restrict-symlink-creation-is-udc.patch new file mode 100644 index 00000000000..85bded6de66 --- /dev/null +++ b/queue-5.15/usb-gadget-configfs-restrict-symlink-creation-is-udc.patch @@ -0,0 +1,103 @@ +From 2f1d996e94d45d9682b272d65414d040e7c3a476 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Feb 2023 18:53:08 +0530 +Subject: usb: gadget: configfs: Restrict symlink creation is UDC already + binded + +From: Udipto Goswami + +[ Upstream commit 89e7252d6c7e7eeb31971cd7df987316ecc64ff5 ] + +During enumeration or composition switch,a userspace process +agnostic of the conventions of configs can try to create function +symlinks even after the UDC is bound to current config which is +not correct. Potentially it can create duplicates within the +current config. + +Prevent this by adding a check if udc_name already exists, then bail +out of cfg_link. + +Following is an example: + +Step1: +ln -s X1 ffs.a +-->cfg_link +--> usb_get_function(ffs.a) + ->ffs_alloc + + CFG->FUNC_LIST: + C->FUNCTION: + +Step2: +echo udc.name > /config/usb_gadget/g1/UDC +--> UDC_store + ->composite_bind + ->usb_add_function + + CFG->FUNC_LIST: + C->FUNCTION: + +Step3: +ln -s Y1 ffs.a +-->cfg_link +-->usb_get_function(ffs.a) + ->ffs_alloc + + CFG->FUNC_LIST: + C->FUNCTION: + +both the lists corresponds to the same function instance ffs.a +but the usb_function* pointer is different because in step 3 +ffs_alloc has created a new reference to usb_function* for +ffs.a and added it to cfg_list. + +Step4: +Now a composition switch involving is executed. + +the composition switch will involve 3 things: + 1. unlinking the previous functions existing + 2. creating new symlinks + 3. writing UDC + +However, the composition switch is generally taken care by +userspace process which creates the symlinks in its own +nomenclature(X*) and removes only those. +So it won't be able to remove Y1 which user had created +by own. + +Due to this the new symlinks cannot be created for ffs.a +since the entry already exists in CFG->FUNC_LIST. + +The state of the CFG->FUNC_LIST is as follows: + CFG->FUNC_LIST: + +Fixes: 88af8bbe4ef7 ("usb: gadget: the start of the configfs interface") +Signed-off-by: Krishna Kurapati PSSNV +Signed-off-by: Udipto Goswami +Link: https://lore.kernel.org/r/20230201132308.31523-1-quic_ugoswami@quicinc.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/configfs.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c +index 891d8e4023221..5cbf4084daedc 100644 +--- a/drivers/usb/gadget/configfs.c ++++ b/drivers/usb/gadget/configfs.c +@@ -428,6 +428,12 @@ static int config_usb_cfg_link( + * from another gadget or a random directory. + * Also a function instance can only be linked once. + */ ++ ++ if (gi->composite.gadget_driver.udc_name) { ++ ret = -EINVAL; ++ goto out; ++ } ++ + list_for_each_entry(iter, &gi->available_func, cfs_list) { + if (iter != fi) + continue; +-- +2.39.2 + diff --git a/queue-5.15/usb-gadget-configfs-use-to_config_usb_cfg-in-os_desc.patch b/queue-5.15/usb-gadget-configfs-use-to_config_usb_cfg-in-os_desc.patch new file mode 100644 index 00000000000..5ec66195aac --- /dev/null +++ b/queue-5.15/usb-gadget-configfs-use-to_config_usb_cfg-in-os_desc.patch @@ -0,0 +1,39 @@ +From 4d48453cd6bd6fb8de9aef383dabc4ce4956919b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Nov 2021 12:53:32 +0800 +Subject: usb: gadget: configfs: use to_config_usb_cfg() in os_desc_link() + +From: Linyu Yuan + +[ Upstream commit 5d143ec451429891385a21617b292f2ceaa684ea ] + +replace open-coded container_of() with to_config_usb_cfg() helper. + +Reviewed-by: Jack Pham +Signed-off-by: Linyu Yuan +Link: https://lore.kernel.org/r/1637211213-16400-4-git-send-email-quic_linyyuan@quicinc.com +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: 89e7252d6c7e ("usb: gadget: configfs: Restrict symlink creation is UDC already binded") +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/configfs.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c +index 5ade844db4046..7d3b93dc154fe 100644 +--- a/drivers/usb/gadget/configfs.c ++++ b/drivers/usb/gadget/configfs.c +@@ -890,9 +890,7 @@ static int os_desc_link(struct config_item *os_desc_ci, + struct gadget_info *gi = container_of(to_config_group(os_desc_ci), + struct gadget_info, os_desc_group); + struct usb_composite_dev *cdev = &gi->cdev; +- struct config_usb_cfg *c_target = +- container_of(to_config_group(usb_cfg_ci), +- struct config_usb_cfg, group); ++ struct config_usb_cfg *c_target = to_config_usb_cfg(usb_cfg_ci); + struct usb_configuration *c; + int ret; + +-- +2.39.2 + diff --git a/queue-5.15/usb-gadget-configfs-use-to_usb_function_instance-in-.patch b/queue-5.15/usb-gadget-configfs-use-to_usb_function_instance-in-.patch new file mode 100644 index 00000000000..64cb8e07c96 --- /dev/null +++ b/queue-5.15/usb-gadget-configfs-use-to_usb_function_instance-in-.patch @@ -0,0 +1,53 @@ +From c6384ceb99fa6c06e7a3c595106933fd92aa921d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Nov 2021 12:53:33 +0800 +Subject: usb: gadget: configfs: use to_usb_function_instance() in cfg (un)link + func + +From: Linyu Yuan + +[ Upstream commit 5284acccc4a501f38dbeceabaa0340401c107654 ] + +replace open-coded container_of() with to_usb_function_instance() helper. + +Reviewed-by: Jack Pham +Signed-off-by: Linyu Yuan +Link: https://lore.kernel.org/r/1637211213-16400-5-git-send-email-quic_linyyuan@quicinc.com +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: 89e7252d6c7e ("usb: gadget: configfs: Restrict symlink creation is UDC already binded") +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/configfs.c | 10 ++++------ + 1 file changed, 4 insertions(+), 6 deletions(-) + +diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c +index 7d3b93dc154fe..8166e771e8663 100644 +--- a/drivers/usb/gadget/configfs.c ++++ b/drivers/usb/gadget/configfs.c +@@ -416,9 +416,8 @@ static int config_usb_cfg_link( + struct usb_composite_dev *cdev = cfg->c.cdev; + struct gadget_info *gi = container_of(cdev, struct gadget_info, cdev); + +- struct config_group *group = to_config_group(usb_func_ci); +- struct usb_function_instance *fi = container_of(group, +- struct usb_function_instance, group); ++ struct usb_function_instance *fi = ++ to_usb_function_instance(usb_func_ci); + struct usb_function_instance *a_fi; + struct usb_function *f; + int ret; +@@ -467,9 +466,8 @@ static void config_usb_cfg_unlink( + struct usb_composite_dev *cdev = cfg->c.cdev; + struct gadget_info *gi = container_of(cdev, struct gadget_info, cdev); + +- struct config_group *group = to_config_group(usb_func_ci); +- struct usb_function_instance *fi = container_of(group, +- struct usb_function_instance, group); ++ struct usb_function_instance *fi = ++ to_usb_function_instance(usb_func_ci); + struct usb_function *f; + + /* +-- +2.39.2 + diff --git a/queue-5.15/usb-gadget-fusb300_udc-free-irq-on-the-error-path-in.patch b/queue-5.15/usb-gadget-fusb300_udc-free-irq-on-the-error-path-in.patch new file mode 100644 index 00000000000..67387f343d8 --- /dev/null +++ b/queue-5.15/usb-gadget-fusb300_udc-free-irq-on-the-error-path-in.patch @@ -0,0 +1,73 @@ +From 57eefe92ae060d3285bbd678e7d221909f7c6301 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Nov 2022 09:41:21 +0800 +Subject: usb: gadget: fusb300_udc: free irq on the error path in + fusb300_probe() + +From: Gaosheng Cui + +[ Upstream commit a8d3392e0e5cfeb03f0cea1f2bc3f5f183c1deb4 ] + +When request_irq(ires1->start) failed in w5300_hw_probe(), irq +ires->start has not been freed, and on the clean_up3 error path, +we also need to free ires1->start irq, fix it. + +In addition, We should add free_irq in fusb300_remove(), and give +the lables a proper name so that they can be understood easily, +so add free_irq in fusb300_remove(), and update clean_up3 to +err_alloc_request. + +Fixes: 0fe6f1d1f612 ("usb: udc: add Faraday fusb300 driver") +Signed-off-by: Gaosheng Cui +Link: https://lore.kernel.org/r/20221123014121.1989721-1-cuigaosheng1@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/fusb300_udc.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/drivers/usb/gadget/udc/fusb300_udc.c b/drivers/usb/gadget/udc/fusb300_udc.c +index 9af8b415f303b..5e9e8e56e2d09 100644 +--- a/drivers/usb/gadget/udc/fusb300_udc.c ++++ b/drivers/usb/gadget/udc/fusb300_udc.c +@@ -1347,6 +1347,7 @@ static int fusb300_remove(struct platform_device *pdev) + usb_del_gadget_udc(&fusb300->gadget); + iounmap(fusb300->reg); + free_irq(platform_get_irq(pdev, 0), fusb300); ++ free_irq(platform_get_irq(pdev, 1), fusb300); + + fusb300_free_request(&fusb300->ep[0]->ep, fusb300->ep0_req); + for (i = 0; i < FUSB300_MAX_NUM_EP; i++) +@@ -1432,7 +1433,7 @@ static int fusb300_probe(struct platform_device *pdev) + IRQF_SHARED, udc_name, fusb300); + if (ret < 0) { + pr_err("request_irq1 error (%d)\n", ret); +- goto clean_up; ++ goto err_request_irq1; + } + + INIT_LIST_HEAD(&fusb300->gadget.ep_list); +@@ -1471,7 +1472,7 @@ static int fusb300_probe(struct platform_device *pdev) + GFP_KERNEL); + if (fusb300->ep0_req == NULL) { + ret = -ENOMEM; +- goto clean_up3; ++ goto err_alloc_request; + } + + init_controller(fusb300); +@@ -1486,7 +1487,10 @@ static int fusb300_probe(struct platform_device *pdev) + err_add_udc: + fusb300_free_request(&fusb300->ep[0]->ep, fusb300->ep0_req); + +-clean_up3: ++err_alloc_request: ++ free_irq(ires1->start, fusb300); ++ ++err_request_irq1: + free_irq(ires->start, fusb300); + + clean_up: +-- +2.39.2 + diff --git a/queue-5.15/usb-max-3421-fix-setting-of-i-o-pins.patch b/queue-5.15/usb-max-3421-fix-setting-of-i-o-pins.patch new file mode 100644 index 00000000000..19859580d04 --- /dev/null +++ b/queue-5.15/usb-max-3421-fix-setting-of-i-o-pins.patch @@ -0,0 +1,39 @@ +From 58b7918f15eaffe30e5991d3d67185169bd90711 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Feb 2023 16:33:37 +1300 +Subject: usb: max-3421: Fix setting of I/O pins + +From: Mark Tomlinson + +[ Upstream commit a7efe3fc7cbe27c6eb2c2a3ab612194f8f800f4c ] + +To update the I/O pins, the registers are read/modified/written. The +read operation incorrectly always read the first register. Although +wrong, there wasn't any impact as all the output pins are always +written, and the inputs are read only anyway. + +Fixes: 2d53139f3162 ("Add support for using a MAX3421E chip as a host driver.") +Signed-off-by: Mark Tomlinson +Link: https://lore.kernel.org/r/20230207033337.18112-1-mark.tomlinson@alliedtelesis.co.nz +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/host/max3421-hcd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/host/max3421-hcd.c b/drivers/usb/host/max3421-hcd.c +index 30de85a707fef..994dc562b2db0 100644 +--- a/drivers/usb/host/max3421-hcd.c ++++ b/drivers/usb/host/max3421-hcd.c +@@ -1436,7 +1436,7 @@ max3421_spi_thread(void *dev_id) + * use spi_wr_buf(). + */ + for (i = 0; i < ARRAY_SIZE(max3421_hcd->iopins); ++i) { +- u8 val = spi_rd8(hcd, MAX3421_REG_IOPINS1); ++ u8 val = spi_rd8(hcd, MAX3421_REG_IOPINS1 + i); + + val = ((val & 0xf0) | + (max3421_hcd->iopins[i] & 0x0f)); +-- +2.39.2 + diff --git a/queue-5.15/usb-musb-mediatek-don-t-unregister-something-that-wa.patch b/queue-5.15/usb-musb-mediatek-don-t-unregister-something-that-wa.patch new file mode 100644 index 00000000000..f1ac69ccc47 --- /dev/null +++ b/queue-5.15/usb-musb-mediatek-don-t-unregister-something-that-wa.patch @@ -0,0 +1,40 @@ +From 11a6e7c6d68544d93c594d5f94f757fce83429ff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Jan 2023 18:20:46 +0300 +Subject: usb: musb: mediatek: don't unregister something that wasn't + registered + +From: Dan Carpenter + +[ Upstream commit ba883de971d1ad018f3083d9195b8abe54d87407 ] + +This function only calls mtk_otg_switch_init() when the ->port_mode +is MUSB_OTG so the clean up code should only call mtk_otg_switch_exit() +for that mode. + +Fixes: 0990366bab3c ("usb: musb: Add support for MediaTek musb controller") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/Y8/3TqpqiSr0RxFH@kili +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/musb/mediatek.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/usb/musb/mediatek.c b/drivers/usb/musb/mediatek.c +index 6b92d037d8fc8..4f52b92c45974 100644 +--- a/drivers/usb/musb/mediatek.c ++++ b/drivers/usb/musb/mediatek.c +@@ -346,7 +346,8 @@ static int mtk_musb_init(struct musb *musb) + err_phy_power_on: + phy_exit(glue->phy); + err_phy_init: +- mtk_otg_switch_exit(glue); ++ if (musb->port_mode == MUSB_OTG) ++ mtk_otg_switch_exit(glue); + return ret; + } + +-- +2.39.2 + diff --git a/queue-5.15/usb-typec-intel_pmc_mux-don-t-leak-the-acpi-device-r.patch b/queue-5.15/usb-typec-intel_pmc_mux-don-t-leak-the-acpi-device-r.patch new file mode 100644 index 00000000000..6cf809b2abd --- /dev/null +++ b/queue-5.15/usb-typec-intel_pmc_mux-don-t-leak-the-acpi-device-r.patch @@ -0,0 +1,41 @@ +From 69d780e5956d64482f3b0e4d884e4fd4c6d215f2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Jan 2023 22:29:32 +0200 +Subject: usb: typec: intel_pmc_mux: Don't leak the ACPI device reference count + +From: Andy Shevchenko + +[ Upstream commit c3194949ae8fcbe2b7e38670e7c6a5cfd2605edc ] + +When acpi_dev_get_memory_resources() fails, the reference count is +left bumped. Drop it as it's done in the other error paths. + +Fixes: 43d596e32276 ("usb: typec: intel_pmc_mux: Check the port status before connect") +Signed-off-by: Andy Shevchenko +Reviewed-by: Heikki Krogerus +Link: https://lore.kernel.org/r/20230102202933.15968-1-andriy.shevchenko@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/typec/mux/intel_pmc_mux.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/usb/typec/mux/intel_pmc_mux.c b/drivers/usb/typec/mux/intel_pmc_mux.c +index 8af60f0720435..a7313c2d9f0fe 100644 +--- a/drivers/usb/typec/mux/intel_pmc_mux.c ++++ b/drivers/usb/typec/mux/intel_pmc_mux.c +@@ -597,8 +597,10 @@ static int pmc_usb_probe_iom(struct pmc_usb *pmc) + + INIT_LIST_HEAD(&resource_list); + ret = acpi_dev_get_memory_resources(adev, &resource_list); +- if (ret < 0) ++ if (ret < 0) { ++ acpi_dev_put(adev); + return ret; ++ } + + rentry = list_first_entry_or_null(&resource_list, struct resource_entry, node); + if (rentry) +-- +2.39.2 + diff --git a/queue-5.15/usb-typec-intel_pmc_mux-use-the-helper-acpi_dev_get_.patch b/queue-5.15/usb-typec-intel_pmc_mux-use-the-helper-acpi_dev_get_.patch new file mode 100644 index 00000000000..d63681aaaa6 --- /dev/null +++ b/queue-5.15/usb-typec-intel_pmc_mux-use-the-helper-acpi_dev_get_.patch @@ -0,0 +1,53 @@ +From 7151997b164ade0f8a1b32204394d4c2c224a6d0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Sep 2022 13:30:07 +0300 +Subject: usb: typec: intel_pmc_mux: Use the helper + acpi_dev_get_memory_resources() + +From: Heikki Krogerus + +[ Upstream commit 1538dc8c1561f0de4ba57a69e2a421a1a3951618 ] + +It removes the need to check the resource data type +separately. + +Signed-off-by: Heikki Krogerus +Signed-off-by: Rafael J. Wysocki +Stable-dep-of: c3194949ae8f ("usb: typec: intel_pmc_mux: Don't leak the ACPI device reference count") +Signed-off-by: Sasha Levin +--- + drivers/usb/typec/mux/intel_pmc_mux.c | 11 +---------- + 1 file changed, 1 insertion(+), 10 deletions(-) + +diff --git a/drivers/usb/typec/mux/intel_pmc_mux.c b/drivers/usb/typec/mux/intel_pmc_mux.c +index a2f5cfdcf02ac..8af60f0720435 100644 +--- a/drivers/usb/typec/mux/intel_pmc_mux.c ++++ b/drivers/usb/typec/mux/intel_pmc_mux.c +@@ -563,15 +563,6 @@ static int pmc_usb_register_port(struct pmc_usb *pmc, int index, + return ret; + } + +-static int is_memory(struct acpi_resource *res, void *data) +-{ +- struct resource_win win = {}; +- struct resource *r = &win.res; +- +- return !(acpi_dev_resource_memory(res, r) || +- acpi_dev_resource_address_space(res, &win)); +-} +- + /* IOM ACPI IDs and IOM_PORT_STATUS_OFFSET */ + static const struct acpi_device_id iom_acpi_ids[] = { + /* TigerLake */ +@@ -605,7 +596,7 @@ static int pmc_usb_probe_iom(struct pmc_usb *pmc) + return -ENODEV; + + INIT_LIST_HEAD(&resource_list); +- ret = acpi_dev_get_resources(adev, &resource_list, is_memory, NULL); ++ ret = acpi_dev_get_memory_resources(adev, &resource_list); + if (ret < 0) + return ret; + +-- +2.39.2 + diff --git a/queue-5.15/vmci-check-context-notify_page-after-call-to-get_use.patch b/queue-5.15/vmci-check-context-notify_page-after-call-to-get_use.patch new file mode 100644 index 00000000000..9223c0a0ff7 --- /dev/null +++ b/queue-5.15/vmci-check-context-notify_page-after-call-to-get_use.patch @@ -0,0 +1,55 @@ +From 107cdd8ccae5fbeedbe98f794a7de40138d96399 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Nov 2022 15:18:25 -0500 +Subject: VMCI: check context->notify_page after call to get_user_pages_fast() + to avoid GPF + +From: George Kennedy + +[ Upstream commit 1a726cb47fd204109c767409fa9ca15a96328f14 ] + +The call to get_user_pages_fast() in vmci_host_setup_notify() can return +NULL context->notify_page causing a GPF. To avoid GPF check if +context->notify_page == NULL and return error if so. + +general protection fault, probably for non-canonical address + 0xe0009d1000000060: 0000 [#1] PREEMPT SMP KASAN NOPTI +KASAN: maybe wild-memory-access in range [0x0005088000000300- + 0x0005088000000307] +CPU: 2 PID: 26180 Comm: repro_34802241 Not tainted 6.1.0-rc4 #1 +Hardware name: Red Hat KVM, BIOS 1.15.0-2.module+el8.6.0 04/01/2014 +RIP: 0010:vmci_ctx_check_signal_notify+0x91/0xe0 +Call Trace: + + vmci_host_unlocked_ioctl+0x362/0x1f40 + __x64_sys_ioctl+0x1a1/0x230 + do_syscall_64+0x3a/0x90 + entry_SYSCALL_64_after_hwframe+0x63/0xcd + +Fixes: a1d88436d53a ("VMCI: Fix two UVA mapping bugs") +Reported-by: syzkaller +Signed-off-by: George Kennedy +Reviewed-by: Vishnu Dasa +Link: https://lore.kernel.org/r/1669666705-24012-1-git-send-email-george.kennedy@oracle.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/misc/vmw_vmci/vmci_host.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/misc/vmw_vmci/vmci_host.c b/drivers/misc/vmw_vmci/vmci_host.c +index da1e2a773823e..857b9851402a6 100644 +--- a/drivers/misc/vmw_vmci/vmci_host.c ++++ b/drivers/misc/vmw_vmci/vmci_host.c +@@ -242,6 +242,8 @@ static int vmci_host_setup_notify(struct vmci_ctx *context, + context->notify_page = NULL; + return VMCI_ERROR_GENERIC; + } ++ if (context->notify_page == NULL) ++ return VMCI_ERROR_UNAVAILABLE; + + /* + * Map the locked page and set up notify pointer. +-- +2.39.2 + diff --git a/queue-5.15/wifi-ath11k-debugfs-fix-to-work-with-multiple-pci-de.patch b/queue-5.15/wifi-ath11k-debugfs-fix-to-work-with-multiple-pci-de.patch new file mode 100644 index 00000000000..d73643e81e0 --- /dev/null +++ b/queue-5.15/wifi-ath11k-debugfs-fix-to-work-with-multiple-pci-de.patch @@ -0,0 +1,151 @@ +From 638ac4b53dd4368d23ad63750cd8cdcd54162ed5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Dec 2022 19:15:59 +0200 +Subject: wifi: ath11k: debugfs: fix to work with multiple PCI devices + +From: Kalle Valo + +[ Upstream commit 323d91d4684d238f6bc3693fed93caf795378fe0 ] + +ath11k fails to load if there are multiple ath11k PCI devices with same name: + + ath11k_pci 0000:01:00.0: Hardware name qcn9074 hw1.0 + debugfs: Directory 'ath11k' with parent '/' already present! + ath11k_pci 0000:01:00.0: failed to create ath11k debugfs + ath11k_pci 0000:01:00.0: failed to create soc core: -17 + ath11k_pci 0000:01:00.0: failed to init core: -17 + ath11k_pci: probe of 0000:01:00.0 failed with error -17 + +Fix this by creating a directory for each ath11k device using schema +-, for example "pci-0000:06:00.0". This directory created under +the top-level ath11k directory, for example /sys/kernel/debug/ath11k. + +The reference to the toplevel ath11k directory is not stored anymore within ath11k, instead +it's retrieved using debugfs_lookup(). If the directory does not exist it will +be created. After the last directory from the ath11k directory is removed, for +example when doing rmmod ath11k, the empty ath11k directory is left in place, +it's a minor cosmetic issue anyway. + +Here's an example hierarchy with one WCN6855: + +ath11k +`-- pci-0000:06:00.0 + |-- mac0 + | |-- dfs_block_radar_events + | |-- dfs_simulate_radar + | |-- ext_rx_stats + | |-- ext_tx_stats + | |-- fw_dbglog_config + | |-- fw_stats + | | |-- beacon_stats + | | |-- pdev_stats + | | `-- vdev_stats + | |-- htt_stats + | |-- htt_stats_reset + | |-- htt_stats_type + | `-- pktlog_filter + |-- simulate_fw_crash + `-- soc_dp_stats + +I didn't have a test setup where I could connect multiple ath11k devices to the +same the host, so I have only tested this with one device. + +Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.9 +Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.5.0.1-01208-QCAHKSWPL_SILICONZ-1 +Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.5.0.1-01208-QCAHKSWPL_SILICONZ-1 + +Tested-by: Robert Marko +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20221220121231.20120-1-kvalo@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath11k/core.h | 1 - + drivers/net/wireless/ath/ath11k/debugfs.c | 48 +++++++++++++++++++---- + 2 files changed, 40 insertions(+), 9 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath11k/core.h b/drivers/net/wireless/ath/ath11k/core.h +index caa8f6eba0097..fda1c2db05d0a 100644 +--- a/drivers/net/wireless/ath/ath11k/core.h ++++ b/drivers/net/wireless/ath/ath11k/core.h +@@ -731,7 +731,6 @@ struct ath11k_base { + enum ath11k_dfs_region dfs_region; + #ifdef CONFIG_ATH11K_DEBUGFS + struct dentry *debugfs_soc; +- struct dentry *debugfs_ath11k; + #endif + struct ath11k_soc_dp_stats soc_stats; + +diff --git a/drivers/net/wireless/ath/ath11k/debugfs.c b/drivers/net/wireless/ath/ath11k/debugfs.c +index 554feaf1ed5cd..f827035f0dd2e 100644 +--- a/drivers/net/wireless/ath/ath11k/debugfs.c ++++ b/drivers/net/wireless/ath/ath11k/debugfs.c +@@ -836,10 +836,6 @@ int ath11k_debugfs_pdev_create(struct ath11k_base *ab) + if (test_bit(ATH11K_FLAG_REGISTERED, &ab->dev_flags)) + return 0; + +- ab->debugfs_soc = debugfs_create_dir(ab->hw_params.name, ab->debugfs_ath11k); +- if (IS_ERR(ab->debugfs_soc)) +- return PTR_ERR(ab->debugfs_soc); +- + debugfs_create_file("simulate_fw_crash", 0600, ab->debugfs_soc, ab, + &fops_simulate_fw_crash); + +@@ -857,15 +853,51 @@ void ath11k_debugfs_pdev_destroy(struct ath11k_base *ab) + + int ath11k_debugfs_soc_create(struct ath11k_base *ab) + { +- ab->debugfs_ath11k = debugfs_create_dir("ath11k", NULL); ++ struct dentry *root; ++ bool dput_needed; ++ char name[64]; ++ int ret; ++ ++ root = debugfs_lookup("ath11k", NULL); ++ if (!root) { ++ root = debugfs_create_dir("ath11k", NULL); ++ if (IS_ERR_OR_NULL(root)) ++ return PTR_ERR(root); ++ ++ dput_needed = false; ++ } else { ++ /* a dentry from lookup() needs dput() after we don't use it */ ++ dput_needed = true; ++ } ++ ++ scnprintf(name, sizeof(name), "%s-%s", ath11k_bus_str(ab->hif.bus), ++ dev_name(ab->dev)); ++ ++ ab->debugfs_soc = debugfs_create_dir(name, root); ++ if (IS_ERR_OR_NULL(ab->debugfs_soc)) { ++ ret = PTR_ERR(ab->debugfs_soc); ++ goto out; ++ } ++ ++ ret = 0; + +- return PTR_ERR_OR_ZERO(ab->debugfs_ath11k); ++out: ++ if (dput_needed) ++ dput(root); ++ ++ return ret; + } + + void ath11k_debugfs_soc_destroy(struct ath11k_base *ab) + { +- debugfs_remove_recursive(ab->debugfs_ath11k); +- ab->debugfs_ath11k = NULL; ++ debugfs_remove_recursive(ab->debugfs_soc); ++ ab->debugfs_soc = NULL; ++ ++ /* We are not removing ath11k directory on purpose, even if it ++ * would be empty. This simplifies the directory handling and it's ++ * a minor cosmetic issue to leave an empty ath11k directory to ++ * debugfs. ++ */ + } + EXPORT_SYMBOL(ath11k_debugfs_soc_destroy); + +-- +2.39.2 + diff --git a/queue-5.15/wifi-ath11k-fix-memory-leak-in-ath11k_peer_rx_frag_s.patch b/queue-5.15/wifi-ath11k-fix-memory-leak-in-ath11k_peer_rx_frag_s.patch new file mode 100644 index 00000000000..59f0ce1732e --- /dev/null +++ b/queue-5.15/wifi-ath11k-fix-memory-leak-in-ath11k_peer_rx_frag_s.patch @@ -0,0 +1,38 @@ +From 361ee741024a5aaa6737df4c29c7a73d192447d4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Jan 2023 12:11:42 +0400 +Subject: wifi: ath11k: Fix memory leak in ath11k_peer_rx_frag_setup + +From: Miaoqian Lin + +[ Upstream commit ed3f83b3459a67a3ab9d806490ac304b567b1c2d ] + +crypto_alloc_shash() allocates resources, which should be released by +crypto_free_shash(). When ath11k_peer_find() fails, there has memory +leak. Add missing crypto_free_shash() to fix this. + +Fixes: 243874c64c81 ("ath11k: handle RX fragments") +Signed-off-by: Miaoqian Lin +Reviewed-by: Leon Romanovsky +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230102081142.3937570-1-linmq006@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath11k/dp_rx.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/wireless/ath/ath11k/dp_rx.c b/drivers/net/wireless/ath/ath11k/dp_rx.c +index 0ae6bebff801d..3c64d33d0133b 100644 +--- a/drivers/net/wireless/ath/ath11k/dp_rx.c ++++ b/drivers/net/wireless/ath/ath11k/dp_rx.c +@@ -3056,6 +3056,7 @@ int ath11k_peer_rx_frag_setup(struct ath11k *ar, const u8 *peer_mac, int vdev_id + if (!peer) { + ath11k_warn(ab, "failed to find the peer to set up fragment info\n"); + spin_unlock_bh(&ab->base_lock); ++ crypto_free_shash(tfm); + return -ENOENT; + } + +-- +2.39.2 + diff --git a/queue-5.15/wifi-ath9k-fix-potential-stack-out-of-bounds-write-i.patch b/queue-5.15/wifi-ath9k-fix-potential-stack-out-of-bounds-write-i.patch new file mode 100644 index 00000000000..e89185a3dce --- /dev/null +++ b/queue-5.15/wifi-ath9k-fix-potential-stack-out-of-bounds-write-i.patch @@ -0,0 +1,62 @@ +From 45415787a3240d4c3b9eebd037a4638db33ae082 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Jan 2023 21:41:30 +0900 +Subject: wifi: ath9k: Fix potential stack-out-of-bounds write in + ath9k_wmi_rsp_callback() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Minsuk Kang + +[ Upstream commit 8a2f35b9830692f7a616f2f627f943bc748af13a ] + +Fix a stack-out-of-bounds write that occurs in a WMI response callback +function that is called after a timeout occurs in ath9k_wmi_cmd(). +The callback writes to wmi->cmd_rsp_buf, a stack-allocated buffer that +could no longer be valid when a timeout occurs. Set wmi->last_seq_id to +0 when a timeout occurred. + +Found by a modified version of syzkaller. + +BUG: KASAN: stack-out-of-bounds in ath9k_wmi_ctrl_rx +Write of size 4 +Call Trace: + memcpy + ath9k_wmi_ctrl_rx + ath9k_htc_rx_msg + ath9k_hif_usb_reg_in_cb + __usb_hcd_giveback_urb + usb_hcd_giveback_urb + dummy_timer + call_timer_fn + run_timer_softirq + __do_softirq + irq_exit_rcu + sysvec_apic_timer_interrupt + +Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.") +Signed-off-by: Minsuk Kang +Acked-by: Toke Høiland-Jørgensen +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230104124130.10996-1-linuxlovemin@yonsei.ac.kr +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath9k/wmi.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/wireless/ath/ath9k/wmi.c b/drivers/net/wireless/ath/ath9k/wmi.c +index f315c54bd3ac0..19345b8f7bfd5 100644 +--- a/drivers/net/wireless/ath/ath9k/wmi.c ++++ b/drivers/net/wireless/ath/ath9k/wmi.c +@@ -341,6 +341,7 @@ int ath9k_wmi_cmd(struct wmi *wmi, enum wmi_cmd_id cmd_id, + if (!time_left) { + ath_dbg(common, WMI, "Timeout waiting for WMI command: %s\n", + wmi_cmd_to_name(cmd_id)); ++ wmi->last_seq_id = 0; + mutex_unlock(&wmi->op_mutex); + return -ETIMEDOUT; + } +-- +2.39.2 + diff --git a/queue-5.15/wifi-ath9k-fix-use-after-free-in-ath9k_hif_usb_disco.patch b/queue-5.15/wifi-ath9k-fix-use-after-free-in-ath9k_hif_usb_disco.patch new file mode 100644 index 00000000000..1c5c01f76ec --- /dev/null +++ b/queue-5.15/wifi-ath9k-fix-use-after-free-in-ath9k_hif_usb_disco.patch @@ -0,0 +1,162 @@ +From d10e898d4efa81f1562f19264e2bbf1d0547f669 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Dec 2022 10:43:08 +0900 +Subject: wifi: ath9k: Fix use-after-free in ath9k_hif_usb_disconnect() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Minsuk Kang + +[ Upstream commit f099c5c9e2ba08a379bd354a82e05ef839ae29ac ] + +This patch fixes a use-after-free in ath9k that occurs in +ath9k_hif_usb_disconnect() when ath9k_destroy_wmi() is trying to access +'drv_priv' that has already been freed by ieee80211_free_hw(), called by +ath9k_htc_hw_deinit(). The patch moves ath9k_destroy_wmi() before +ieee80211_free_hw(). Note that urbs from the driver should be killed +before freeing 'wmi' with ath9k_destroy_wmi() as their callbacks will +access 'wmi'. + +Found by a modified version of syzkaller. + +================================================================== +BUG: KASAN: use-after-free in ath9k_destroy_wmi+0x38/0x40 +Read of size 8 at addr ffff8881069132a0 by task kworker/0:1/7 + +CPU: 0 PID: 7 Comm: kworker/0:1 Tainted: G O 5.14.0+ #131 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014 +Workqueue: usb_hub_wq hub_event +Call Trace: + dump_stack_lvl+0x8e/0xd1 + print_address_description.constprop.0.cold+0x93/0x334 + ? ath9k_destroy_wmi+0x38/0x40 + ? ath9k_destroy_wmi+0x38/0x40 + kasan_report.cold+0x83/0xdf + ? ath9k_destroy_wmi+0x38/0x40 + ath9k_destroy_wmi+0x38/0x40 + ath9k_hif_usb_disconnect+0x329/0x3f0 + ? ath9k_hif_usb_suspend+0x120/0x120 + ? usb_disable_interface+0xfc/0x180 + usb_unbind_interface+0x19b/0x7e0 + ? usb_autoresume_device+0x50/0x50 + device_release_driver_internal+0x44d/0x520 + bus_remove_device+0x2e5/0x5a0 + device_del+0x5b2/0xe30 + ? __device_link_del+0x370/0x370 + ? usb_remove_ep_devs+0x43/0x80 + ? remove_intf_ep_devs+0x112/0x1a0 + usb_disable_device+0x1e3/0x5a0 + usb_disconnect+0x267/0x870 + hub_event+0x168d/0x3950 + ? rcu_read_lock_sched_held+0xa1/0xd0 + ? hub_port_debounce+0x2e0/0x2e0 + ? check_irq_usage+0x860/0xf20 + ? drain_workqueue+0x281/0x360 + ? lock_release+0x640/0x640 + ? rcu_read_lock_sched_held+0xa1/0xd0 + ? rcu_read_lock_bh_held+0xb0/0xb0 + ? lockdep_hardirqs_on_prepare+0x273/0x3e0 + process_one_work+0x92b/0x1460 + ? pwq_dec_nr_in_flight+0x330/0x330 + ? rwlock_bug.part.0+0x90/0x90 + worker_thread+0x95/0xe00 + ? __kthread_parkme+0x115/0x1e0 + ? process_one_work+0x1460/0x1460 + kthread+0x3a1/0x480 + ? set_kthread_struct+0x120/0x120 + ret_from_fork+0x1f/0x30 + +The buggy address belongs to the page: +page:ffffea00041a44c0 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106913 +flags: 0x200000000000000(node=0|zone=2) +raw: 0200000000000000 0000000000000000 dead000000000122 0000000000000000 +raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 +page dumped because: kasan: bad access detected +page_owner tracks the page as freed +page last allocated via order 3, migratetype Unmovable, gfp_mask 0x40dc0(GFP_KERNEL|__GFP_COMP|__GFP_ZERO), pid 7, ts 38347963444, free_ts 41399957635 + prep_new_page+0x1aa/0x240 + get_page_from_freelist+0x159a/0x27c0 + __alloc_pages+0x2da/0x6a0 + alloc_pages+0xec/0x1e0 + kmalloc_order+0x39/0xf0 + kmalloc_order_trace+0x19/0x120 + __kmalloc+0x308/0x390 + wiphy_new_nm+0x6f5/0x1dd0 + ieee80211_alloc_hw_nm+0x36d/0x2230 + ath9k_htc_probe_device+0x9d/0x1e10 + ath9k_htc_hw_init+0x34/0x50 + ath9k_hif_usb_firmware_cb+0x25f/0x4e0 + request_firmware_work_func+0x131/0x240 + process_one_work+0x92b/0x1460 + worker_thread+0x95/0xe00 + kthread+0x3a1/0x480 +page last free stack trace: + free_pcp_prepare+0x3d3/0x7f0 + free_unref_page+0x1e/0x3d0 + device_release+0xa4/0x240 + kobject_put+0x186/0x4c0 + put_device+0x20/0x30 + ath9k_htc_disconnect_device+0x1cf/0x2c0 + ath9k_htc_hw_deinit+0x26/0x30 + ath9k_hif_usb_disconnect+0x2d9/0x3f0 + usb_unbind_interface+0x19b/0x7e0 + device_release_driver_internal+0x44d/0x520 + bus_remove_device+0x2e5/0x5a0 + device_del+0x5b2/0xe30 + usb_disable_device+0x1e3/0x5a0 + usb_disconnect+0x267/0x870 + hub_event+0x168d/0x3950 + process_one_work+0x92b/0x1460 + +Memory state around the buggy address: + ffff888106913180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff + ffff888106913200: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff +>ffff888106913280: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff + ^ + ffff888106913300: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff + ffff888106913380: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff +================================================================== + +Reported-by: Dokyung Song +Reported-by: Jisoo Jang +Reported-by: Minsuk Kang +Signed-off-by: Minsuk Kang +Acked-by: Toke Høiland-Jørgensen +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20221205014308.1617597-1-linuxlovemin@yonsei.ac.kr +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath9k/hif_usb.c | 2 -- + drivers/net/wireless/ath/ath9k/htc_drv_init.c | 2 ++ + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c +index de6c0824c9cab..f521dfa2f1945 100644 +--- a/drivers/net/wireless/ath/ath9k/hif_usb.c ++++ b/drivers/net/wireless/ath/ath9k/hif_usb.c +@@ -1424,8 +1424,6 @@ static void ath9k_hif_usb_disconnect(struct usb_interface *interface) + + if (hif_dev->flags & HIF_USB_READY) { + ath9k_htc_hw_deinit(hif_dev->htc_handle, unplugged); +- ath9k_hif_usb_dev_deinit(hif_dev); +- ath9k_destroy_wmi(hif_dev->htc_handle->drv_priv); + ath9k_htc_hw_free(hif_dev->htc_handle); + } + +diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c +index 07ac88fb1c577..96a3185a96d75 100644 +--- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c ++++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c +@@ -988,6 +988,8 @@ void ath9k_htc_disconnect_device(struct htc_target *htc_handle, bool hotunplug) + + ath9k_deinit_device(htc_handle->drv_priv); + ath9k_stop_wmi(htc_handle->drv_priv); ++ ath9k_hif_usb_dealloc_urbs((struct hif_device_usb *)htc_handle->hif_dev); ++ ath9k_destroy_wmi(htc_handle->drv_priv); + ieee80211_free_hw(htc_handle->drv_priv->hw); + } + } +-- +2.39.2 + diff --git a/queue-5.15/wifi-ath9k-hif_usb-clean-up-skbs-if-ath9k_hif_usb_rx.patch b/queue-5.15/wifi-ath9k-hif_usb-clean-up-skbs-if-ath9k_hif_usb_rx.patch new file mode 100644 index 00000000000..709194e7d71 --- /dev/null +++ b/queue-5.15/wifi-ath9k-hif_usb-clean-up-skbs-if-ath9k_hif_usb_rx.patch @@ -0,0 +1,125 @@ +From fdf3d0585564d8c7b2a03db1ff2759c896a2d28e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Jan 2023 15:36:15 +0300 +Subject: wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() + fails +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Fedor Pchelkin + +[ Upstream commit 0af54343a76263a12dbae7fafb64eb47c4a6ad38 ] + +Syzkaller detected a memory leak of skbs in ath9k_hif_usb_rx_stream(). +While processing skbs in ath9k_hif_usb_rx_stream(), the already allocated +skbs in skb_pool are not freed if ath9k_hif_usb_rx_stream() fails. If we +have an incorrect pkt_len or pkt_tag, the input skb is considered invalid +and dropped. All the associated packets already in skb_pool should be +dropped and freed. Added a comment describing this issue. + +The patch also makes remain_skb NULL after being processed so that it +cannot be referenced after potential free. The initialization of hif_dev +fields which are associated with remain_skb (rx_remain_len, +rx_transfer_len and rx_pad_len) is moved after a new remain_skb is +allocated. + +Found by Linux Verification Center (linuxtesting.org) with Syzkaller. + +Fixes: 6ce708f54cc8 ("ath9k: Fix out-of-bound memcpy in ath9k_hif_usb_rx_stream") +Fixes: 44b23b488d44 ("ath9k: hif_usb: Reduce indent 1 column") +Reported-by: syzbot+e9632e3eb038d93d6bc6@syzkaller.appspotmail.com +Signed-off-by: Fedor Pchelkin +Signed-off-by: Alexey Khoroshilov +Acked-by: Toke Høiland-Jørgensen +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230104123615.51511-1-pchelkin@ispras.ru +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath9k/hif_usb.c | 31 +++++++++++++++++------- + 1 file changed, 22 insertions(+), 9 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c +index 1a2e0c7eeb023..de6c0824c9cab 100644 +--- a/drivers/net/wireless/ath/ath9k/hif_usb.c ++++ b/drivers/net/wireless/ath/ath9k/hif_usb.c +@@ -561,11 +561,11 @@ static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev, + memcpy(ptr, skb->data, rx_remain_len); + + rx_pkt_len += rx_remain_len; +- hif_dev->rx_remain_len = 0; + skb_put(remain_skb, rx_pkt_len); + + skb_pool[pool_index++] = remain_skb; +- ++ hif_dev->remain_skb = NULL; ++ hif_dev->rx_remain_len = 0; + } else { + index = rx_remain_len; + } +@@ -584,16 +584,21 @@ static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev, + pkt_len = get_unaligned_le16(ptr + index); + pkt_tag = get_unaligned_le16(ptr + index + 2); + ++ /* It is supposed that if we have an invalid pkt_tag or ++ * pkt_len then the whole input SKB is considered invalid ++ * and dropped; the associated packets already in skb_pool ++ * are dropped, too. ++ */ + if (pkt_tag != ATH_USB_RX_STREAM_MODE_TAG) { + RX_STAT_INC(hif_dev, skb_dropped); +- return; ++ goto invalid_pkt; + } + + if (pkt_len > 2 * MAX_RX_BUF_SIZE) { + dev_err(&hif_dev->udev->dev, + "ath9k_htc: invalid pkt_len (%x)\n", pkt_len); + RX_STAT_INC(hif_dev, skb_dropped); +- return; ++ goto invalid_pkt; + } + + pad_len = 4 - (pkt_len & 0x3); +@@ -605,11 +610,6 @@ static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev, + + if (index > MAX_RX_BUF_SIZE) { + spin_lock(&hif_dev->rx_lock); +- hif_dev->rx_remain_len = index - MAX_RX_BUF_SIZE; +- hif_dev->rx_transfer_len = +- MAX_RX_BUF_SIZE - chk_idx - 4; +- hif_dev->rx_pad_len = pad_len; +- + nskb = __dev_alloc_skb(pkt_len + 32, GFP_ATOMIC); + if (!nskb) { + dev_err(&hif_dev->udev->dev, +@@ -617,6 +617,12 @@ static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev, + spin_unlock(&hif_dev->rx_lock); + goto err; + } ++ ++ hif_dev->rx_remain_len = index - MAX_RX_BUF_SIZE; ++ hif_dev->rx_transfer_len = ++ MAX_RX_BUF_SIZE - chk_idx - 4; ++ hif_dev->rx_pad_len = pad_len; ++ + skb_reserve(nskb, 32); + RX_STAT_INC(hif_dev, skb_allocated); + +@@ -654,6 +660,13 @@ static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev, + skb_pool[i]->len, USB_WLAN_RX_PIPE); + RX_STAT_INC(hif_dev, skb_completed); + } ++ return; ++invalid_pkt: ++ for (i = 0; i < pool_index; i++) { ++ dev_kfree_skb_any(skb_pool[i]); ++ RX_STAT_INC(hif_dev, skb_dropped); ++ } ++ return; + } + + static void ath9k_hif_usb_rx_cb(struct urb *urb) +-- +2.39.2 + diff --git a/queue-5.15/wifi-ath9k-htc_hst-free-skb-in-ath9k_htc_rx_msg-if-t.patch b/queue-5.15/wifi-ath9k-htc_hst-free-skb-in-ath9k_htc_rx_msg-if-t.patch new file mode 100644 index 00000000000..c75d733ec25 --- /dev/null +++ b/queue-5.15/wifi-ath9k-htc_hst-free-skb-in-ath9k_htc_rx_msg-if-t.patch @@ -0,0 +1,58 @@ +From 5ba4dd2ec5716119fc49b6a422a9555a8bcc2279 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Jan 2023 15:35:46 +0300 +Subject: wifi: ath9k: htc_hst: free skb in ath9k_htc_rx_msg() if there is no + callback function +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Fedor Pchelkin + +[ Upstream commit 9b25e3985477ac3f02eca5fc1e0cc6850a3f7e69 ] + +It is stated that ath9k_htc_rx_msg() either frees the provided skb or +passes its management to another callback function. However, the skb is +not freed in case there is no another callback function, and Syzkaller was +able to cause a memory leak. Also minor comment fix. + +Found by Linux Verification Center (linuxtesting.org) with Syzkaller. + +Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.") +Reported-by: syzbot+e008dccab31bd3647609@syzkaller.appspotmail.com +Reported-by: syzbot+6692c72009680f7c4eb2@syzkaller.appspotmail.com +Signed-off-by: Fedor Pchelkin +Signed-off-by: Alexey Khoroshilov +Acked-by: Toke Høiland-Jørgensen +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230104123546.51427-1-pchelkin@ispras.ru +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath9k/htc_hst.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c +index ca05b07a45e67..fe62ff668f757 100644 +--- a/drivers/net/wireless/ath/ath9k/htc_hst.c ++++ b/drivers/net/wireless/ath/ath9k/htc_hst.c +@@ -391,7 +391,7 @@ static void ath9k_htc_fw_panic_report(struct htc_target *htc_handle, + * HTC Messages are handled directly here and the obtained SKB + * is freed. + * +- * Service messages (Data, WMI) passed to the corresponding ++ * Service messages (Data, WMI) are passed to the corresponding + * endpoint RX handlers, which have to free the SKB. + */ + void ath9k_htc_rx_msg(struct htc_target *htc_handle, +@@ -478,6 +478,8 @@ void ath9k_htc_rx_msg(struct htc_target *htc_handle, + if (endpoint->ep_callbacks.rx) + endpoint->ep_callbacks.rx(endpoint->ep_callbacks.priv, + skb, epid); ++ else ++ goto invalid; + } + } + +-- +2.39.2 + diff --git a/queue-5.15/wifi-brcmfmac-ensure-clm-version-is-null-terminated-.patch b/queue-5.15/wifi-brcmfmac-ensure-clm-version-is-null-terminated-.patch new file mode 100644 index 00000000000..0ec6e6ae839 --- /dev/null +++ b/queue-5.15/wifi-brcmfmac-ensure-clm-version-is-null-terminated-.patch @@ -0,0 +1,165 @@ +From 7e09e1b01ccb29696fde6d8503ec2c8f8a538d84 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Dec 2022 16:51:39 +0900 +Subject: wifi: brcmfmac: ensure CLM version is null-terminated to prevent + stack-out-of-bounds + +From: Jisoo Jang + +[ Upstream commit 660145d708be52f946a82e5b633c020f58f996de ] + +Fix a stack-out-of-bounds read in brcmfmac that occurs +when 'buf' that is not null-terminated is passed as an argument of +strreplace() in brcmf_c_preinit_dcmds(). This buffer is filled with +a CLM version string by memcpy() in brcmf_fil_iovar_data_get(). +Ensure buf is null-terminated. + +Found by a modified version of syzkaller. + +[ 33.004414][ T1896] brcmfmac: brcmf_c_process_clm_blob: no clm_blob available (err=-2), device may have limited channels available +[ 33.013486][ T1896] brcmfmac: brcmf_c_preinit_dcmds: Firmware: BCM43236/3 wl0: Nov 30 2011 17:33:42 version 5.90.188.22 +[ 33.021554][ T1896] ================================================================== +[ 33.022379][ T1896] BUG: KASAN: stack-out-of-bounds in strreplace+0xf2/0x110 +[ 33.023122][ T1896] Read of size 1 at addr ffffc90001d6efc8 by task kworker/0:2/1896 +[ 33.023852][ T1896] +[ 33.024096][ T1896] CPU: 0 PID: 1896 Comm: kworker/0:2 Tainted: G O 5.14.0+ #132 +[ 33.024927][ T1896] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014 +[ 33.026065][ T1896] Workqueue: usb_hub_wq hub_event +[ 33.026581][ T1896] Call Trace: +[ 33.026896][ T1896] dump_stack_lvl+0x57/0x7d +[ 33.027372][ T1896] print_address_description.constprop.0.cold+0xf/0x334 +[ 33.028037][ T1896] ? strreplace+0xf2/0x110 +[ 33.028403][ T1896] ? strreplace+0xf2/0x110 +[ 33.028807][ T1896] kasan_report.cold+0x83/0xdf +[ 33.029283][ T1896] ? strreplace+0xf2/0x110 +[ 33.029666][ T1896] strreplace+0xf2/0x110 +[ 33.029966][ T1896] brcmf_c_preinit_dcmds+0xab1/0xc40 +[ 33.030351][ T1896] ? brcmf_c_set_joinpref_default+0x100/0x100 +[ 33.030787][ T1896] ? rcu_read_lock_sched_held+0xa1/0xd0 +[ 33.031223][ T1896] ? rcu_read_lock_bh_held+0xb0/0xb0 +[ 33.031661][ T1896] ? lock_acquire+0x19d/0x4e0 +[ 33.032091][ T1896] ? find_held_lock+0x2d/0x110 +[ 33.032605][ T1896] ? brcmf_usb_deq+0x1a7/0x260 +[ 33.033087][ T1896] ? brcmf_usb_rx_fill_all+0x5a/0xf0 +[ 33.033582][ T1896] brcmf_attach+0x246/0xd40 +[ 33.034022][ T1896] ? wiphy_new_nm+0x1476/0x1d50 +[ 33.034383][ T1896] ? kmemdup+0x30/0x40 +[ 33.034722][ T1896] brcmf_usb_probe+0x12de/0x1690 +[ 33.035223][ T1896] ? brcmf_usbdev_qinit.constprop.0+0x470/0x470 +[ 33.035833][ T1896] usb_probe_interface+0x25f/0x710 +[ 33.036315][ T1896] really_probe+0x1be/0xa90 +[ 33.036656][ T1896] __driver_probe_device+0x2ab/0x460 +[ 33.037026][ T1896] ? usb_match_id.part.0+0x88/0xc0 +[ 33.037383][ T1896] driver_probe_device+0x49/0x120 +[ 33.037790][ T1896] __device_attach_driver+0x18a/0x250 +[ 33.038300][ T1896] ? driver_allows_async_probing+0x120/0x120 +[ 33.038986][ T1896] bus_for_each_drv+0x123/0x1a0 +[ 33.039906][ T1896] ? bus_rescan_devices+0x20/0x20 +[ 33.041412][ T1896] ? lockdep_hardirqs_on_prepare+0x273/0x3e0 +[ 33.041861][ T1896] ? trace_hardirqs_on+0x1c/0x120 +[ 33.042330][ T1896] __device_attach+0x207/0x330 +[ 33.042664][ T1896] ? device_bind_driver+0xb0/0xb0 +[ 33.043026][ T1896] ? kobject_uevent_env+0x230/0x12c0 +[ 33.043515][ T1896] bus_probe_device+0x1a2/0x260 +[ 33.043914][ T1896] device_add+0xa61/0x1ce0 +[ 33.044227][ T1896] ? __mutex_unlock_slowpath+0xe7/0x660 +[ 33.044891][ T1896] ? __fw_devlink_link_to_suppliers+0x550/0x550 +[ 33.045531][ T1896] usb_set_configuration+0x984/0x1770 +[ 33.046051][ T1896] ? kernfs_create_link+0x175/0x230 +[ 33.046548][ T1896] usb_generic_driver_probe+0x69/0x90 +[ 33.046931][ T1896] usb_probe_device+0x9c/0x220 +[ 33.047434][ T1896] really_probe+0x1be/0xa90 +[ 33.047760][ T1896] __driver_probe_device+0x2ab/0x460 +[ 33.048134][ T1896] driver_probe_device+0x49/0x120 +[ 33.048516][ T1896] __device_attach_driver+0x18a/0x250 +[ 33.048910][ T1896] ? driver_allows_async_probing+0x120/0x120 +[ 33.049437][ T1896] bus_for_each_drv+0x123/0x1a0 +[ 33.049814][ T1896] ? bus_rescan_devices+0x20/0x20 +[ 33.050164][ T1896] ? lockdep_hardirqs_on_prepare+0x273/0x3e0 +[ 33.050579][ T1896] ? trace_hardirqs_on+0x1c/0x120 +[ 33.050936][ T1896] __device_attach+0x207/0x330 +[ 33.051399][ T1896] ? device_bind_driver+0xb0/0xb0 +[ 33.051888][ T1896] ? kobject_uevent_env+0x230/0x12c0 +[ 33.052314][ T1896] bus_probe_device+0x1a2/0x260 +[ 33.052688][ T1896] device_add+0xa61/0x1ce0 +[ 33.053121][ T1896] ? __fw_devlink_link_to_suppliers+0x550/0x550 +[ 33.053568][ T1896] usb_new_device.cold+0x463/0xf66 +[ 33.053953][ T1896] ? hub_disconnect+0x400/0x400 +[ 33.054313][ T1896] ? rwlock_bug.part.0+0x90/0x90 +[ 33.054661][ T1896] ? lockdep_hardirqs_on_prepare+0x273/0x3e0 +[ 33.055094][ T1896] hub_event+0x10d5/0x3330 +[ 33.055530][ T1896] ? hub_port_debounce+0x280/0x280 +[ 33.055934][ T1896] ? __lock_acquire+0x1671/0x5790 +[ 33.056387][ T1896] ? wq_calc_node_cpumask+0x170/0x2a0 +[ 33.056924][ T1896] ? lock_release+0x640/0x640 +[ 33.057383][ T1896] ? rcu_read_lock_sched_held+0xa1/0xd0 +[ 33.057916][ T1896] ? rcu_read_lock_bh_held+0xb0/0xb0 +[ 33.058402][ T1896] ? lockdep_hardirqs_on_prepare+0x273/0x3e0 +[ 33.059019][ T1896] process_one_work+0x873/0x13e0 +[ 33.059488][ T1896] ? lock_release+0x640/0x640 +[ 33.059932][ T1896] ? pwq_dec_nr_in_flight+0x320/0x320 +[ 33.060446][ T1896] ? rwlock_bug.part.0+0x90/0x90 +[ 33.060898][ T1896] worker_thread+0x8b/0xd10 +[ 33.061348][ T1896] ? __kthread_parkme+0xd9/0x1d0 +[ 33.061810][ T1896] ? process_one_work+0x13e0/0x13e0 +[ 33.062288][ T1896] kthread+0x379/0x450 +[ 33.062660][ T1896] ? _raw_spin_unlock_irq+0x24/0x30 +[ 33.063148][ T1896] ? set_kthread_struct+0x100/0x100 +[ 33.063606][ T1896] ret_from_fork+0x1f/0x30 +[ 33.064070][ T1896] +[ 33.064313][ T1896] +[ 33.064545][ T1896] addr ffffc90001d6efc8 is located in stack of task kworker/0:2/1896 at offset 512 in frame: +[ 33.065478][ T1896] brcmf_c_preinit_dcmds+0x0/0xc40 +[ 33.065973][ T1896] +[ 33.066191][ T1896] this frame has 4 objects: +[ 33.066614][ T1896] [48, 56) 'ptr' +[ 33.066618][ T1896] [80, 148) 'revinfo' +[ 33.066957][ T1896] [192, 210) 'eventmask' +[ 33.067338][ T1896] [256, 512) 'buf' +[ 33.067742][ T1896] +[ 33.068304][ T1896] Memory state around the buggy address: +[ 33.068838][ T1896] ffffc90001d6ee80: f2 00 00 02 f2 f2 f2 f2 f2 00 00 00 00 00 00 00 +[ 33.069545][ T1896] ffffc90001d6ef00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +[ 33.070626][ T1896] >ffffc90001d6ef80: 00 00 00 00 00 00 00 00 00 f3 f3 f3 f3 f3 f3 f3 +[ 33.072052][ T1896] ^ +[ 33.073043][ T1896] ffffc90001d6f000: f3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +[ 33.074230][ T1896] ffffc90001d6f080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +[ 33.074914][ T1896] ================================================================== +[ 33.075713][ T1896] Disabling lock debugging due to kernel taint + +Reviewed-by: Arend van Spriel +Signed-off-by: Jisoo Jang +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20221230075139.56591-1-jisoo.jang@yonsei.ac.kr +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c +index 57bb1fbedaa87..f29de630908d7 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c +@@ -281,15 +281,17 @@ int brcmf_c_preinit_dcmds(struct brcmf_if *ifp) + if (err) { + brcmf_dbg(TRACE, "retrieving clmver failed, %d\n", err); + } else { ++ buf[sizeof(buf) - 1] = '\0'; + clmver = (char *)buf; +- /* store CLM version for adding it to revinfo debugfs file */ +- memcpy(ifp->drvr->clmver, clmver, sizeof(ifp->drvr->clmver)); + + /* Replace all newline/linefeed characters with space + * character + */ + strreplace(clmver, '\n', ' '); + ++ /* store CLM version for adding it to revinfo debugfs file */ ++ memcpy(ifp->drvr->clmver, clmver, sizeof(ifp->drvr->clmver)); ++ + brcmf_dbg(INFO, "CLM version = %s\n", clmver); + } + +-- +2.39.2 + diff --git a/queue-5.15/wifi-brcmfmac-fix-potential-memory-leak-in-brcmf_net.patch b/queue-5.15/wifi-brcmfmac-fix-potential-memory-leak-in-brcmf_net.patch new file mode 100644 index 00000000000..efdc5e01006 --- /dev/null +++ b/queue-5.15/wifi-brcmfmac-fix-potential-memory-leak-in-brcmf_net.patch @@ -0,0 +1,39 @@ +From 8fa9612846f1297daa42508df1ba489746f7e8de Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Nov 2022 19:33:01 +0800 +Subject: wifi: brcmfmac: fix potential memory leak in + brcmf_netdev_start_xmit() + +From: Zhang Changzhong + +[ Upstream commit 212fde3fe76e962598ce1d47b97cc78afdfc71b3 ] + +The brcmf_netdev_start_xmit() returns NETDEV_TX_OK without freeing skb +in case of pskb_expand_head() fails, add dev_kfree_skb() to fix it. +Compile tested only. + +Fixes: 270a6c1f65fe ("brcmfmac: rework headroom check in .start_xmit()") +Signed-off-by: Zhang Changzhong +Reviewed-by: Arend van Spriel +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/1668684782-47422-1-git-send-email-zhangchangzhong@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c +index e5bae62245215..f03fc6f1f8333 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c +@@ -338,6 +338,7 @@ static netdev_tx_t brcmf_netdev_start_xmit(struct sk_buff *skb, + bphy_err(drvr, "%s: failed to expand headroom\n", + brcmf_ifname(ifp)); + atomic_inc(&drvr->bus_if->stats.pktcow_failed); ++ dev_kfree_skb(skb); + goto done; + } + } +-- +2.39.2 + diff --git a/queue-5.15/wifi-brcmfmac-fix-potential-stack-out-of-bounds-in-b.patch b/queue-5.15/wifi-brcmfmac-fix-potential-stack-out-of-bounds-in-b.patch new file mode 100644 index 00000000000..093ad812140 --- /dev/null +++ b/queue-5.15/wifi-brcmfmac-fix-potential-stack-out-of-bounds-in-b.patch @@ -0,0 +1,160 @@ +From 9d4afdf626ab05ed897590c70b9399f3fc306976 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Nov 2022 13:34:58 +0900 +Subject: wifi: brcmfmac: Fix potential stack-out-of-bounds in + brcmf_c_preinit_dcmds() + +From: Jisoo Jang + +[ Upstream commit 0a06cadcc2a0044e4a117cc0e61436fc3a0dad69 ] + +This patch fixes a stack-out-of-bounds read in brcmfmac that occurs +when 'buf' that is not null-terminated is passed as an argument of +strsep() in brcmf_c_preinit_dcmds(). This buffer is filled with a firmware +version string by memcpy() in brcmf_fil_iovar_data_get(). +The patch ensures buf is null-terminated. + +Found by a modified version of syzkaller. + +[ 47.569679][ T1897] brcmfmac: brcmf_fw_alloc_request: using brcm/brcmfmac43236b for chip BCM43236/3 +[ 47.582839][ T1897] brcmfmac: brcmf_c_process_clm_blob: no clm_blob available (err=-2), device may have limited channels available +[ 47.601565][ T1897] ================================================================== +[ 47.602574][ T1897] BUG: KASAN: stack-out-of-bounds in strsep+0x1b2/0x1f0 +[ 47.603447][ T1897] Read of size 1 at addr ffffc90001f6f000 by task kworker/0:2/1897 +[ 47.604336][ T1897] +[ 47.604621][ T1897] CPU: 0 PID: 1897 Comm: kworker/0:2 Tainted: G O 5.14.0+ #131 +[ 47.605617][ T1897] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014 +[ 47.606907][ T1897] Workqueue: usb_hub_wq hub_event +[ 47.607453][ T1897] Call Trace: +[ 47.607801][ T1897] dump_stack_lvl+0x8e/0xd1 +[ 47.608295][ T1897] print_address_description.constprop.0.cold+0xf/0x334 +[ 47.609009][ T1897] ? strsep+0x1b2/0x1f0 +[ 47.609434][ T1897] ? strsep+0x1b2/0x1f0 +[ 47.609863][ T1897] kasan_report.cold+0x83/0xdf +[ 47.610366][ T1897] ? strsep+0x1b2/0x1f0 +[ 47.610882][ T1897] strsep+0x1b2/0x1f0 +[ 47.611300][ T1897] ? brcmf_fil_iovar_data_get+0x3a/0xf0 +[ 47.611883][ T1897] brcmf_c_preinit_dcmds+0x995/0xc40 +[ 47.612434][ T1897] ? brcmf_c_set_joinpref_default+0x100/0x100 +[ 47.613078][ T1897] ? rcu_read_lock_sched_held+0xa1/0xd0 +[ 47.613662][ T1897] ? rcu_read_lock_bh_held+0xb0/0xb0 +[ 47.614208][ T1897] ? lock_acquire+0x19d/0x4e0 +[ 47.614704][ T1897] ? find_held_lock+0x2d/0x110 +[ 47.615236][ T1897] ? brcmf_usb_deq+0x1a7/0x260 +[ 47.615741][ T1897] ? brcmf_usb_rx_fill_all+0x5a/0xf0 +[ 47.616288][ T1897] brcmf_attach+0x246/0xd40 +[ 47.616758][ T1897] ? wiphy_new_nm+0x1703/0x1dd0 +[ 47.617280][ T1897] ? kmemdup+0x43/0x50 +[ 47.617720][ T1897] brcmf_usb_probe+0x12de/0x1690 +[ 47.618244][ T1897] ? brcmf_usbdev_qinit.constprop.0+0x470/0x470 +[ 47.618901][ T1897] usb_probe_interface+0x2aa/0x760 +[ 47.619429][ T1897] ? usb_probe_device+0x250/0x250 +[ 47.619950][ T1897] really_probe+0x205/0xb70 +[ 47.620435][ T1897] ? driver_allows_async_probing+0x130/0x130 +[ 47.621048][ T1897] __driver_probe_device+0x311/0x4b0 +[ 47.621595][ T1897] ? driver_allows_async_probing+0x130/0x130 +[ 47.622209][ T1897] driver_probe_device+0x4e/0x150 +[ 47.622739][ T1897] __device_attach_driver+0x1cc/0x2a0 +[ 47.623287][ T1897] bus_for_each_drv+0x156/0x1d0 +[ 47.623796][ T1897] ? bus_rescan_devices+0x30/0x30 +[ 47.624309][ T1897] ? lockdep_hardirqs_on_prepare+0x273/0x3e0 +[ 47.624907][ T1897] ? trace_hardirqs_on+0x46/0x160 +[ 47.625437][ T1897] __device_attach+0x23f/0x3a0 +[ 47.625924][ T1897] ? device_bind_driver+0xd0/0xd0 +[ 47.626433][ T1897] ? kobject_uevent_env+0x287/0x14b0 +[ 47.627057][ T1897] bus_probe_device+0x1da/0x290 +[ 47.627557][ T1897] device_add+0xb7b/0x1eb0 +[ 47.628027][ T1897] ? wait_for_completion+0x290/0x290 +[ 47.628593][ T1897] ? __fw_devlink_link_to_suppliers+0x5a0/0x5a0 +[ 47.629249][ T1897] usb_set_configuration+0xf59/0x16f0 +[ 47.629829][ T1897] usb_generic_driver_probe+0x82/0xa0 +[ 47.630385][ T1897] usb_probe_device+0xbb/0x250 +[ 47.630927][ T1897] ? usb_suspend+0x590/0x590 +[ 47.631397][ T1897] really_probe+0x205/0xb70 +[ 47.631855][ T1897] ? driver_allows_async_probing+0x130/0x130 +[ 47.632469][ T1897] __driver_probe_device+0x311/0x4b0 +[ 47.633002][ T1897] ? usb_generic_driver_match+0x75/0x90 +[ 47.633573][ T1897] ? driver_allows_async_probing+0x130/0x130 +[ 47.634170][ T1897] driver_probe_device+0x4e/0x150 +[ 47.634703][ T1897] __device_attach_driver+0x1cc/0x2a0 +[ 47.635248][ T1897] bus_for_each_drv+0x156/0x1d0 +[ 47.635748][ T1897] ? bus_rescan_devices+0x30/0x30 +[ 47.636271][ T1897] ? lockdep_hardirqs_on_prepare+0x273/0x3e0 +[ 47.636881][ T1897] ? trace_hardirqs_on+0x46/0x160 +[ 47.637396][ T1897] __device_attach+0x23f/0x3a0 +[ 47.637904][ T1897] ? device_bind_driver+0xd0/0xd0 +[ 47.638426][ T1897] ? kobject_uevent_env+0x287/0x14b0 +[ 47.638985][ T1897] bus_probe_device+0x1da/0x290 +[ 47.639512][ T1897] device_add+0xb7b/0x1eb0 +[ 47.639977][ T1897] ? __fw_devlink_link_to_suppliers+0x5a0/0x5a0 +[ 47.640612][ T1897] ? kfree+0x14a/0x6b0 +[ 47.641055][ T1897] ? __usb_get_extra_descriptor+0x116/0x160 +[ 47.641679][ T1897] usb_new_device.cold+0x49c/0x1029 +[ 47.642245][ T1897] ? hub_disconnect+0x450/0x450 +[ 47.642756][ T1897] ? rwlock_bug.part.0+0x90/0x90 +[ 47.643273][ T1897] ? _raw_spin_unlock_irq+0x24/0x30 +[ 47.643822][ T1897] ? lockdep_hardirqs_on_prepare+0x273/0x3e0 +[ 47.644445][ T1897] hub_event+0x1c98/0x3950 +[ 47.644939][ T1897] ? hub_port_debounce+0x2e0/0x2e0 +[ 47.645467][ T1897] ? check_irq_usage+0x861/0xf20 +[ 47.645975][ T1897] ? drain_workqueue+0x280/0x360 +[ 47.646506][ T1897] ? lock_release+0x640/0x640 +[ 47.646994][ T1897] ? rcu_read_lock_sched_held+0xa1/0xd0 +[ 47.647572][ T1897] ? rcu_read_lock_bh_held+0xb0/0xb0 +[ 47.648111][ T1897] ? lockdep_hardirqs_on_prepare+0x273/0x3e0 +[ 47.648735][ T1897] process_one_work+0x92b/0x1460 +[ 47.649262][ T1897] ? pwq_dec_nr_in_flight+0x330/0x330 +[ 47.649816][ T1897] ? rwlock_bug.part.0+0x90/0x90 +[ 47.650336][ T1897] worker_thread+0x95/0xe00 +[ 47.650830][ T1897] ? __kthread_parkme+0x115/0x1e0 +[ 47.651361][ T1897] ? process_one_work+0x1460/0x1460 +[ 47.651904][ T1897] kthread+0x3a1/0x480 +[ 47.652329][ T1897] ? set_kthread_struct+0x120/0x120 +[ 47.652878][ T1897] ret_from_fork+0x1f/0x30 +[ 47.653370][ T1897] +[ 47.653608][ T1897] +[ 47.653848][ T1897] addr ffffc90001f6f000 is located in stack of task kworker/0:2/1897 at offset 512 in frame: +[ 47.654891][ T1897] brcmf_c_preinit_dcmds+0x0/0xc40 +[ 47.655442][ T1897] +[ 47.655690][ T1897] this frame has 4 objects: +[ 47.656151][ T1897] [48, 56) 'ptr' +[ 47.656159][ T1897] [80, 148) 'revinfo' +[ 47.656534][ T1897] [192, 210) 'eventmask' +[ 47.656953][ T1897] [256, 512) 'buf' +[ 47.657410][ T1897] +[ 47.658035][ T1897] Memory state around the buggy address: +[ 47.658743][ T1897] ffffc90001f6ef00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +[ 47.659577][ T1897] ffffc90001f6ef80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +[ 47.660394][ T1897] >ffffc90001f6f000: f3 f3 f3 f3 f3 f3 f3 f3 00 00 00 00 00 00 00 00 +[ 47.661199][ T1897] ^ +[ 47.661625][ T1897] ffffc90001f6f080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +[ 47.662455][ T1897] ffffc90001f6f100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 +[ 47.663318][ T1897] ================================================================== +[ 47.664147][ T1897] Disabling lock debugging due to kernel taint + +Reported-by: Dokyung Song +Reported-by: Jisoo Jang +Reported-by: Minsuk Kang +Signed-off-by: Jisoo Jang +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20221115043458.37562-1-jisoo.jang@yonsei.ac.kr +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c +index e3758bd86acf0..57bb1fbedaa87 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c +@@ -264,6 +264,7 @@ int brcmf_c_preinit_dcmds(struct brcmf_if *ifp) + err); + goto done; + } ++ buf[sizeof(buf) - 1] = '\0'; + ptr = (char *)buf; + strsep(&ptr, "\n"); + +-- +2.39.2 + diff --git a/queue-5.15/wifi-brcmfmac-unmap-dma-buffer-in-brcmf_msgbuf_alloc.patch b/queue-5.15/wifi-brcmfmac-unmap-dma-buffer-in-brcmf_msgbuf_alloc.patch new file mode 100644 index 00000000000..47c0eab5e42 --- /dev/null +++ b/queue-5.15/wifi-brcmfmac-unmap-dma-buffer-in-brcmf_msgbuf_alloc.patch @@ -0,0 +1,46 @@ +From 9a51839f92072b3a482e4bdf4c67a01a7efeb374 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Dec 2022 09:31:14 +0800 +Subject: wifi: brcmfmac: unmap dma buffer in brcmf_msgbuf_alloc_pktid() + +From: Zhengchao Shao + +[ Upstream commit b9f420032f2ba1e634b22ca7b433e5c40ea663af ] + +After the DMA buffer is mapped to a physical address, address is stored +in pktids in brcmf_msgbuf_alloc_pktid(). Then, pktids is parsed in +brcmf_msgbuf_get_pktid()/brcmf_msgbuf_release_array() to obtain physaddr +and later unmap the DMA buffer. But when count is always equal to +pktids->array_size, physaddr isn't stored in pktids and the DMA buffer +will not be unmapped anyway. + +Fixes: 9a1bb60250d2 ("brcmfmac: Adding msgbuf protocol.") +Signed-off-by: Zhengchao Shao +Reviewed-by: Sebastian Andrzej Siewior +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20221207013114.1748936-1-shaozhengchao@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c +index 7c8e08ee8f0ff..bd3b234b78038 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c +@@ -346,8 +346,11 @@ brcmf_msgbuf_alloc_pktid(struct device *dev, + count++; + } while (count < pktids->array_size); + +- if (count == pktids->array_size) ++ if (count == pktids->array_size) { ++ dma_unmap_single(dev, *physaddr, skb->len - data_offset, ++ pktids->direction); + return -ENOMEM; ++ } + + array[*idx].data_offset = data_offset; + array[*idx].physaddr = *physaddr; +-- +2.39.2 + diff --git a/queue-5.15/wifi-cfg80211-fix-extended-kck-key-length-check-in-n.patch b/queue-5.15/wifi-cfg80211-fix-extended-kck-key-length-check-in-n.patch new file mode 100644 index 00000000000..caafcb6ab87 --- /dev/null +++ b/queue-5.15/wifi-cfg80211-fix-extended-kck-key-length-check-in-n.patch @@ -0,0 +1,42 @@ +From 8c9eb9c73fab69778731dd941ce2d97c783a1539 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Dec 2022 20:07:14 +0530 +Subject: wifi: cfg80211: Fix extended KCK key length check in + nl80211_set_rekey_data() + +From: Shivani Baranwal + +[ Upstream commit df4969ca135b9b3b2c38c07514aaa775112ac835 ] + +The extended KCK key length check wrongly using the KEK key attribute +for validation. Due to this GTK rekey offload is failing when the KCK +key length is 24 bytes even though the driver advertising +WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK flag. Use correct attribute to fix the +same. + +Fixes: 093a48d2aa4b ("cfg80211: support bigger kek/kck key length") +Signed-off-by: Shivani Baranwal +Signed-off-by: Veerendranath Jakkam +Link: https://lore.kernel.org/r/20221206143715.1802987-2-quic_vjakkam@quicinc.com +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/wireless/nl80211.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c +index bb46a6a346146..1b91a9c208969 100644 +--- a/net/wireless/nl80211.c ++++ b/net/wireless/nl80211.c +@@ -12922,7 +12922,7 @@ static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info) + return -ERANGE; + if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN && + !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK && +- nla_len(tb[NL80211_REKEY_DATA_KEK]) == NL80211_KCK_EXT_LEN)) ++ nla_len(tb[NL80211_REKEY_DATA_KCK]) == NL80211_KCK_EXT_LEN)) + return -ERANGE; + + rekey_data.kek = nla_data(tb[NL80211_REKEY_DATA_KEK]); +-- +2.39.2 + diff --git a/queue-5.15/wifi-ipw2200-fix-memory-leak-in-ipw_wdev_init.patch b/queue-5.15/wifi-ipw2200-fix-memory-leak-in-ipw_wdev_init.patch new file mode 100644 index 00000000000..019c2a9f793 --- /dev/null +++ b/queue-5.15/wifi-ipw2200-fix-memory-leak-in-ipw_wdev_init.patch @@ -0,0 +1,47 @@ +From d45ed317d0209bc0babb5f8351c80eb95e386e19 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Dec 2022 09:24:22 +0800 +Subject: wifi: ipw2200: fix memory leak in ipw_wdev_init() + +From: Zhengchao Shao + +[ Upstream commit 9fe21dc626117fb44a8eb393713a86a620128ce3 ] + +In the error path of ipw_wdev_init(), exception value is returned, and +the memory applied for in the function is not released. Also the memory +is not released in ipw_pci_probe(). As a result, memory leakage occurs. +So memory release needs to be added to the error path of ipw_wdev_init(). + +Fixes: a3caa99e6c68 ("libipw: initiate cfg80211 API conversion (v2)") +Signed-off-by: Zhengchao Shao +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20221209012422.182669-1-shaozhengchao@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/ipw2x00/ipw2200.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/intel/ipw2x00/ipw2200.c b/drivers/net/wireless/intel/ipw2x00/ipw2200.c +index df28e4a05e140..bb728fb24b8a4 100644 +--- a/drivers/net/wireless/intel/ipw2x00/ipw2200.c ++++ b/drivers/net/wireless/intel/ipw2x00/ipw2200.c +@@ -11400,9 +11400,14 @@ static int ipw_wdev_init(struct net_device *dev) + set_wiphy_dev(wdev->wiphy, &priv->pci_dev->dev); + + /* With that information in place, we can now register the wiphy... */ +- if (wiphy_register(wdev->wiphy)) +- rc = -EIO; ++ rc = wiphy_register(wdev->wiphy); ++ if (rc) ++ goto out; ++ ++ return 0; + out: ++ kfree(priv->ieee->a_band.channels); ++ kfree(priv->ieee->bg_band.channels); + return rc; + } + +-- +2.39.2 + diff --git a/queue-5.15/wifi-ipw2x00-don-t-call-dev_kfree_skb-under-spin_loc.patch b/queue-5.15/wifi-ipw2x00-don-t-call-dev_kfree_skb-under-spin_loc.patch new file mode 100644 index 00000000000..588e5dcb535 --- /dev/null +++ b/queue-5.15/wifi-ipw2x00-don-t-call-dev_kfree_skb-under-spin_loc.patch @@ -0,0 +1,46 @@ +From 945c61c3cfea2cfd2fca75b0a0ab230b419d262c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Dec 2022 22:38:26 +0800 +Subject: wifi: ipw2x00: don't call dev_kfree_skb() under spin_lock_irqsave() + +From: Yang Yingliang + +[ Upstream commit 45fc6d7461f18df2f238caf0cbc5acc4163203d1 ] + +It is not allowed to call kfree_skb() or consume_skb() from hardware +interrupt context or with hardware interrupts being disabled. + +It should use dev_kfree_skb_irq() or dev_consume_skb_irq() instead. +The difference between them is free reason, dev_kfree_skb_irq() means +the SKB is dropped in error and dev_consume_skb_irq() means the SKB +is consumed in normal. + +In this case, dev_kfree_skb() is called to free and drop the SKB when +it's reset, so replace it with dev_kfree_skb_irq(). Compile tested +only. + +Fixes: 43f66a6ce8da ("Add ipw2200 wireless driver.") +Signed-off-by: Yang Yingliang +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20221208143826.2385218-1-yangyingliang@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/ipw2x00/ipw2200.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/intel/ipw2x00/ipw2200.c b/drivers/net/wireless/intel/ipw2x00/ipw2200.c +index ada6ce32c1f19..df28e4a05e140 100644 +--- a/drivers/net/wireless/intel/ipw2x00/ipw2200.c ++++ b/drivers/net/wireless/intel/ipw2x00/ipw2200.c +@@ -3444,7 +3444,7 @@ static void ipw_rx_queue_reset(struct ipw_priv *priv, + dma_unmap_single(&priv->pci_dev->dev, + rxq->pool[i].dma_addr, + IPW_RX_BUF_SIZE, DMA_FROM_DEVICE); +- dev_kfree_skb(rxq->pool[i].skb); ++ dev_kfree_skb_irq(rxq->pool[i].skb); + rxq->pool[i].skb = NULL; + } + list_add_tail(&rxq->pool[i].list, &rxq->rx_used); +-- +2.39.2 + diff --git a/queue-5.15/wifi-iwl3945-add-missing-check-for-create_singlethre.patch b/queue-5.15/wifi-iwl3945-add-missing-check-for-create_singlethre.patch new file mode 100644 index 00000000000..9f1030326ac --- /dev/null +++ b/queue-5.15/wifi-iwl3945-add-missing-check-for-create_singlethre.patch @@ -0,0 +1,85 @@ +From 58fc02ae9f270cf9562c975f95553b53e199f2dd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Feb 2023 14:30:32 +0800 +Subject: wifi: iwl3945: Add missing check for create_singlethread_workqueue + +From: Jiasheng Jiang + +[ Upstream commit 1fdeb8b9f29dfd64805bb49475ac7566a3cb06cb ] + +Add the check for the return value of the create_singlethread_workqueue +in order to avoid NULL pointer dereference. + +Fixes: b481de9ca074 ("[IWLWIFI]: add iwlwifi wireless drivers") +Signed-off-by: Jiasheng Jiang +Acked-by: Stanislaw Gruszka +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230208063032.42763-2-jiasheng@iscas.ac.cn +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlegacy/3945-mac.c | 16 ++++++++++++---- + 1 file changed, 12 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/wireless/intel/iwlegacy/3945-mac.c b/drivers/net/wireless/intel/iwlegacy/3945-mac.c +index 45abb25b65a9f..04c149ff745e9 100644 +--- a/drivers/net/wireless/intel/iwlegacy/3945-mac.c ++++ b/drivers/net/wireless/intel/iwlegacy/3945-mac.c +@@ -3378,10 +3378,12 @@ static DEVICE_ATTR(dump_errors, 0200, NULL, il3945_dump_error_log); + * + *****************************************************************************/ + +-static void ++static int + il3945_setup_deferred_work(struct il_priv *il) + { + il->workqueue = create_singlethread_workqueue(DRV_NAME); ++ if (!il->workqueue) ++ return -ENOMEM; + + init_waitqueue_head(&il->wait_command_queue); + +@@ -3398,6 +3400,8 @@ il3945_setup_deferred_work(struct il_priv *il) + timer_setup(&il->watchdog, il_bg_watchdog, 0); + + tasklet_setup(&il->irq_tasklet, il3945_irq_tasklet); ++ ++ return 0; + } + + static void +@@ -3717,7 +3721,10 @@ il3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + } + + il_set_rxon_channel(il, &il->bands[NL80211_BAND_2GHZ].channels[5]); +- il3945_setup_deferred_work(il); ++ err = il3945_setup_deferred_work(il); ++ if (err) ++ goto out_remove_sysfs; ++ + il3945_setup_handlers(il); + il_power_initialize(il); + +@@ -3729,7 +3736,7 @@ il3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + + err = il3945_setup_mac(il); + if (err) +- goto out_remove_sysfs; ++ goto out_destroy_workqueue; + + il_dbgfs_register(il, DRV_NAME); + +@@ -3738,9 +3745,10 @@ il3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + + return 0; + +-out_remove_sysfs: ++out_destroy_workqueue: + destroy_workqueue(il->workqueue); + il->workqueue = NULL; ++out_remove_sysfs: + sysfs_remove_group(&pdev->dev.kobj, &il3945_attribute_group); + out_release_irq: + free_irq(il->pci_dev->irq, il); +-- +2.39.2 + diff --git a/queue-5.15/wifi-iwl4965-add-missing-check-for-create_singlethre.patch b/queue-5.15/wifi-iwl4965-add-missing-check-for-create_singlethre.patch new file mode 100644 index 00000000000..5880ed013bf --- /dev/null +++ b/queue-5.15/wifi-iwl4965-add-missing-check-for-create_singlethre.patch @@ -0,0 +1,72 @@ +From db98de134a117fac23d6f268a9deb13f9fe605a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Feb 2023 09:07:48 +0800 +Subject: wifi: iwl4965: Add missing check for create_singlethread_workqueue() + +From: Jiasheng Jiang + +[ Upstream commit 26e6775f75517ad6844fe5b79bc5f3fa8c22ee61 ] + +Add the check for the return value of the create_singlethread_workqueue() +in order to avoid NULL pointer dereference. + +Fixes: b481de9ca074 ("[IWLWIFI]: add iwlwifi wireless drivers") +Signed-off-by: Jiasheng Jiang +Acked-by: Stanislaw Gruszka +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230209010748.45454-1-jiasheng@iscas.ac.cn +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlegacy/4965-mac.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/intel/iwlegacy/4965-mac.c b/drivers/net/wireless/intel/iwlegacy/4965-mac.c +index 0223532fd56a0..ff04282e3db03 100644 +--- a/drivers/net/wireless/intel/iwlegacy/4965-mac.c ++++ b/drivers/net/wireless/intel/iwlegacy/4965-mac.c +@@ -6211,10 +6211,12 @@ il4965_bg_txpower_work(struct work_struct *work) + mutex_unlock(&il->mutex); + } + +-static void ++static int + il4965_setup_deferred_work(struct il_priv *il) + { + il->workqueue = create_singlethread_workqueue(DRV_NAME); ++ if (!il->workqueue) ++ return -ENOMEM; + + init_waitqueue_head(&il->wait_command_queue); + +@@ -6233,6 +6235,8 @@ il4965_setup_deferred_work(struct il_priv *il) + timer_setup(&il->watchdog, il_bg_watchdog, 0); + + tasklet_setup(&il->irq_tasklet, il4965_irq_tasklet); ++ ++ return 0; + } + + static void +@@ -6617,7 +6621,10 @@ il4965_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + goto out_disable_msi; + } + +- il4965_setup_deferred_work(il); ++ err = il4965_setup_deferred_work(il); ++ if (err) ++ goto out_free_irq; ++ + il4965_setup_handlers(il); + + /********************************************* +@@ -6655,6 +6662,7 @@ il4965_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + out_destroy_workqueue: + destroy_workqueue(il->workqueue); + il->workqueue = NULL; ++out_free_irq: + free_irq(il->pci_dev->irq, il); + out_disable_msi: + pci_disable_msi(il->pci_dev); +-- +2.39.2 + diff --git a/queue-5.15/wifi-iwlegacy-common-don-t-call-dev_kfree_skb-under-.patch b/queue-5.15/wifi-iwlegacy-common-don-t-call-dev_kfree_skb-under-.patch new file mode 100644 index 00000000000..a4bcdfeb57c --- /dev/null +++ b/queue-5.15/wifi-iwlegacy-common-don-t-call-dev_kfree_skb-under-.patch @@ -0,0 +1,49 @@ +From 09613243a7f4f4488fe9db50f004a491cec1e1a1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Dec 2022 22:40:13 +0800 +Subject: wifi: iwlegacy: common: don't call dev_kfree_skb() under + spin_lock_irqsave() + +From: Yang Yingliang + +[ Upstream commit 0c1528675d7a9787cb516b64d8f6c0f6f8efcb48 ] + +It is not allowed to call consume_skb() from hardware interrupt context +or with interrupts being disabled. So replace dev_kfree_skb() with +dev_consume_skb_irq() under spin_lock_irqsave(). Compile tested only. + +Fixes: 4bc85c1324aa ("Revert "iwlwifi: split the drivers for agn and legacy devices 3945/4965"") +Signed-off-by: Yang Yingliang +Acked-by: Stanislaw Gruszka +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20221207144013.70210-1-yangyingliang@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlegacy/common.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/intel/iwlegacy/common.c b/drivers/net/wireless/intel/iwlegacy/common.c +index 683b632981ed3..83c1ff0d660f7 100644 +--- a/drivers/net/wireless/intel/iwlegacy/common.c ++++ b/drivers/net/wireless/intel/iwlegacy/common.c +@@ -5173,7 +5173,7 @@ il_mac_reset_tsf(struct ieee80211_hw *hw, struct ieee80211_vif *vif) + memset(&il->current_ht_config, 0, sizeof(struct il_ht_config)); + + /* new association get rid of ibss beacon skb */ +- dev_kfree_skb(il->beacon_skb); ++ dev_consume_skb_irq(il->beacon_skb); + il->beacon_skb = NULL; + il->timestamp = 0; + +@@ -5292,7 +5292,7 @@ il_beacon_update(struct ieee80211_hw *hw, struct ieee80211_vif *vif) + } + + spin_lock_irqsave(&il->lock, flags); +- dev_kfree_skb(il->beacon_skb); ++ dev_consume_skb_irq(il->beacon_skb); + il->beacon_skb = skb; + + timestamp = ((struct ieee80211_mgmt *)skb->data)->u.beacon.timestamp; +-- +2.39.2 + diff --git a/queue-5.15/wifi-libertas-cmdresp-don-t-call-kfree_skb-under-spi.patch b/queue-5.15/wifi-libertas-cmdresp-don-t-call-kfree_skb-under-spi.patch new file mode 100644 index 00000000000..f9c26e6cfca --- /dev/null +++ b/queue-5.15/wifi-libertas-cmdresp-don-t-call-kfree_skb-under-spi.patch @@ -0,0 +1,40 @@ +From 6a176406346b7438a804c7d93fa30d524c2cc62c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Dec 2022 23:00:08 +0800 +Subject: wifi: libertas: cmdresp: don't call kfree_skb() under + spin_lock_irqsave() + +From: Yang Yingliang + +[ Upstream commit 708a49a64237f19bd404852f297aaadbc9e7fee0 ] + +It is not allowed to call kfree_skb() from hardware interrupt +context or with interrupts being disabled. So replace kfree_skb() +with dev_kfree_skb_irq() under spin_lock_irqsave(). Compile +tested only. + +Fixes: f52b041aed77 ("libertas: Add spinlock to avoid race condition") +Signed-off-by: Yang Yingliang +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20221207150008.111743-5-yangyingliang@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/marvell/libertas/cmdresp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/marvell/libertas/cmdresp.c b/drivers/net/wireless/marvell/libertas/cmdresp.c +index cb515c5584c1f..74cb7551f4275 100644 +--- a/drivers/net/wireless/marvell/libertas/cmdresp.c ++++ b/drivers/net/wireless/marvell/libertas/cmdresp.c +@@ -48,7 +48,7 @@ void lbs_mac_event_disconnected(struct lbs_private *priv, + + /* Free Tx and Rx packets */ + spin_lock_irqsave(&priv->driver_lock, flags); +- kfree_skb(priv->currenttxskb); ++ dev_kfree_skb_irq(priv->currenttxskb); + priv->currenttxskb = NULL; + priv->tx_pending_len = 0; + spin_unlock_irqrestore(&priv->driver_lock, flags); +-- +2.39.2 + diff --git a/queue-5.15/wifi-libertas-fix-memory-leak-in-lbs_init_adapter.patch b/queue-5.15/wifi-libertas-fix-memory-leak-in-lbs_init_adapter.patch new file mode 100644 index 00000000000..843a5484550 --- /dev/null +++ b/queue-5.15/wifi-libertas-fix-memory-leak-in-lbs_init_adapter.patch @@ -0,0 +1,37 @@ +From 92bbb1a8a5283bedfe4d71fc684b3048b2ac07d8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Dec 2022 20:14:48 +0800 +Subject: wifi: libertas: fix memory leak in lbs_init_adapter() + +From: Zhengchao Shao + +[ Upstream commit 16a03958618fb91bb1bc7077cf3211055162cc2f ] + +When kfifo_alloc() failed in lbs_init_adapter(), cmd buffer is not +released. Add free memory to processing error path. + +Fixes: 7919b89c8276 ("libertas: convert libertas driver to use an event/cmdresp queue") +Signed-off-by: Zhengchao Shao +Reviewed-by: Jiri Pirko +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20221208121448.2845986-1-shaozhengchao@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/marvell/libertas/main.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/wireless/marvell/libertas/main.c b/drivers/net/wireless/marvell/libertas/main.c +index 64fc5e4108648..b739a490fc20a 100644 +--- a/drivers/net/wireless/marvell/libertas/main.c ++++ b/drivers/net/wireless/marvell/libertas/main.c +@@ -870,6 +870,7 @@ static int lbs_init_adapter(struct lbs_private *priv) + ret = kfifo_alloc(&priv->event_fifo, sizeof(u32) * 16, GFP_KERNEL); + if (ret) { + pr_err("Out of memory allocating event FIFO buffer\n"); ++ lbs_free_cmd_buffer(priv); + goto out; + } + +-- +2.39.2 + diff --git a/queue-5.15/wifi-libertas-if_usb-don-t-call-kfree_skb-under-spin.patch b/queue-5.15/wifi-libertas-if_usb-don-t-call-kfree_skb-under-spin.patch new file mode 100644 index 00000000000..fb5d2b6ad03 --- /dev/null +++ b/queue-5.15/wifi-libertas-if_usb-don-t-call-kfree_skb-under-spin.patch @@ -0,0 +1,40 @@ +From 18eb68856a904a0179fb40f188f7e559fef8e51f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Dec 2022 23:00:06 +0800 +Subject: wifi: libertas: if_usb: don't call kfree_skb() under + spin_lock_irqsave() + +From: Yang Yingliang + +[ Upstream commit 3968e81ba644f10a7d45bae2539560db9edac501 ] + +It is not allowed to call kfree_skb() from hardware interrupt +context or with interrupts being disabled. So replace kfree_skb() +with dev_kfree_skb_irq() under spin_lock_irqsave(). Compile +tested only. + +Fixes: a3128feef6d5 ("libertas: use irqsave() in USB's complete callback") +Signed-off-by: Yang Yingliang +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20221207150008.111743-3-yangyingliang@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/marvell/libertas/if_usb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/marvell/libertas/if_usb.c b/drivers/net/wireless/marvell/libertas/if_usb.c +index 32fdc4150b605..2240b4db8c036 100644 +--- a/drivers/net/wireless/marvell/libertas/if_usb.c ++++ b/drivers/net/wireless/marvell/libertas/if_usb.c +@@ -637,7 +637,7 @@ static inline void process_cmdrequest(int recvlength, uint8_t *recvbuff, + priv->resp_len[i] = (recvlength - MESSAGE_HEADER_LEN); + memcpy(priv->resp_buf[i], recvbuff + MESSAGE_HEADER_LEN, + priv->resp_len[i]); +- kfree_skb(skb); ++ dev_kfree_skb_irq(skb); + lbs_notify_command_response(priv, i); + + spin_unlock_irqrestore(&priv->driver_lock, flags); +-- +2.39.2 + diff --git a/queue-5.15/wifi-libertas-main-don-t-call-kfree_skb-under-spin_l.patch b/queue-5.15/wifi-libertas-main-don-t-call-kfree_skb-under-spin_l.patch new file mode 100644 index 00000000000..d99d032ea7c --- /dev/null +++ b/queue-5.15/wifi-libertas-main-don-t-call-kfree_skb-under-spin_l.patch @@ -0,0 +1,40 @@ +From 088674053d448a5c558629a803b5ed417d5b0507 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Dec 2022 23:00:07 +0800 +Subject: wifi: libertas: main: don't call kfree_skb() under + spin_lock_irqsave() + +From: Yang Yingliang + +[ Upstream commit f393df151540bf858effbd29ff572ab94e76a4c4 ] + +It is not allowed to call kfree_skb() from hardware interrupt +context or with interrupts being disabled. So replace kfree_skb() +with dev_kfree_skb_irq() under spin_lock_irqsave(). Compile +tested only. + +Fixes: d2e7b3425c47 ("libertas: disable functionality when interface is down") +Signed-off-by: Yang Yingliang +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20221207150008.111743-4-yangyingliang@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/marvell/libertas/main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/marvell/libertas/main.c b/drivers/net/wireless/marvell/libertas/main.c +index b739a490fc20a..46877773a36de 100644 +--- a/drivers/net/wireless/marvell/libertas/main.c ++++ b/drivers/net/wireless/marvell/libertas/main.c +@@ -217,7 +217,7 @@ int lbs_stop_iface(struct lbs_private *priv) + + spin_lock_irqsave(&priv->driver_lock, flags); + priv->iface_running = false; +- kfree_skb(priv->currenttxskb); ++ dev_kfree_skb_irq(priv->currenttxskb); + priv->currenttxskb = NULL; + priv->tx_pending_len = 0; + spin_unlock_irqrestore(&priv->driver_lock, flags); +-- +2.39.2 + diff --git a/queue-5.15/wifi-libertas_tf-don-t-call-kfree_skb-under-spin_loc.patch b/queue-5.15/wifi-libertas_tf-don-t-call-kfree_skb-under-spin_loc.patch new file mode 100644 index 00000000000..4ac2c7ef8be --- /dev/null +++ b/queue-5.15/wifi-libertas_tf-don-t-call-kfree_skb-under-spin_loc.patch @@ -0,0 +1,39 @@ +From edfeabba93a13498b3a883d640c440a074eb9d8e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Dec 2022 23:00:05 +0800 +Subject: wifi: libertas_tf: don't call kfree_skb() under spin_lock_irqsave() + +From: Yang Yingliang + +[ Upstream commit 9388ce97b98216833c969191ee6df61a7201d797 ] + +It is not allowed to call kfree_skb() from hardware interrupt +context or with interrupts being disabled. So replace kfree_skb() +with dev_kfree_skb_irq() under spin_lock_irqsave(). Compile +tested only. + +Fixes: fc75122fabb5 ("libertas_tf: use irqsave() in USB's complete callback") +Signed-off-by: Yang Yingliang +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20221207150008.111743-2-yangyingliang@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/marvell/libertas_tf/if_usb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/marvell/libertas_tf/if_usb.c b/drivers/net/wireless/marvell/libertas_tf/if_usb.c +index 75b5319d033f3..1750f5e93de21 100644 +--- a/drivers/net/wireless/marvell/libertas_tf/if_usb.c ++++ b/drivers/net/wireless/marvell/libertas_tf/if_usb.c +@@ -613,7 +613,7 @@ static inline void process_cmdrequest(int recvlength, uint8_t *recvbuff, + spin_lock_irqsave(&priv->driver_lock, flags); + memcpy(priv->cmd_resp_buff, recvbuff + MESSAGE_HEADER_LEN, + recvlength - MESSAGE_HEADER_LEN); +- kfree_skb(skb); ++ dev_kfree_skb_irq(skb); + lbtf_cmd_response_rx(priv); + spin_unlock_irqrestore(&priv->driver_lock, flags); + } +-- +2.39.2 + diff --git a/queue-5.15/wifi-mac80211-make-rate-u32-in-sta_set_rate_info_rx.patch b/queue-5.15/wifi-mac80211-make-rate-u32-in-sta_set_rate_info_rx.patch new file mode 100644 index 00000000000..f044414fec8 --- /dev/null +++ b/queue-5.15/wifi-mac80211-make-rate-u32-in-sta_set_rate_info_rx.patch @@ -0,0 +1,38 @@ +From 38bc57d3614a704b87a546f640e43ada4c77e968 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Feb 2023 19:06:59 +0800 +Subject: wifi: mac80211: make rate u32 in sta_set_rate_info_rx() + +From: Shayne Chen + +[ Upstream commit 59336e07b287d91dc4ec265e07724e8f7e3d0209 ] + +The value of last_rate in ieee80211_sta_rx_stats is degraded from u32 to +u16 after being assigned to rate variable, which causes information loss +in STA_STATS_FIELD_TYPE and later bitfields. + +Signed-off-by: Shayne Chen +Link: https://lore.kernel.org/r/20230209110659.25447-1-shayne.chen@mediatek.com +Fixes: 41cbb0f5a295 ("mac80211: add support for HE") +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/sta_info.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c +index f1e263b2c2957..14db465289c53 100644 +--- a/net/mac80211/sta_info.c ++++ b/net/mac80211/sta_info.c +@@ -2190,7 +2190,7 @@ static void sta_stats_decode_rate(struct ieee80211_local *local, u32 rate, + + static int sta_set_rate_info_rx(struct sta_info *sta, struct rate_info *rinfo) + { +- u16 rate = READ_ONCE(sta_get_last_rx_stats(sta)->last_rate); ++ u32 rate = READ_ONCE(sta_get_last_rx_stats(sta)->last_rate); + + if (rate == STA_STATS_RATE_INVALID) + return -EINVAL; +-- +2.39.2 + diff --git a/queue-5.15/wifi-mt76-dma-free-rx_head-in-mt76_dma_rx_cleanup.patch b/queue-5.15/wifi-mt76-dma-free-rx_head-in-mt76_dma_rx_cleanup.patch new file mode 100644 index 00000000000..bc8192b8056 --- /dev/null +++ b/queue-5.15/wifi-mt76-dma-free-rx_head-in-mt76_dma_rx_cleanup.patch @@ -0,0 +1,60 @@ +From 87ff91eda1aa3bb8272223339d54272a44e92336 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 1 Jan 2023 12:47:57 +0100 +Subject: wifi: mt76: dma: free rx_head in mt76_dma_rx_cleanup + +From: Lorenzo Bianconi + +[ Upstream commit 1b88b47e898edef0e56e3a2f4e49f052a136153d ] + +Free rx_head skb in mt76_dma_rx_cleanup routine in order to avoid +possible memory leak at module unload. + +Signed-off-by: Lorenzo Bianconi +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/dma.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/dma.c b/drivers/net/wireless/mediatek/mt76/dma.c +index 7aecde35cb9a3..1aa0479c5fa4e 100644 +--- a/drivers/net/wireless/mediatek/mt76/dma.c ++++ b/drivers/net/wireless/mediatek/mt76/dma.c +@@ -486,6 +486,7 @@ mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q) + bool more; + + spin_lock_bh(&q->lock); ++ + do { + buf = mt76_dma_dequeue(dev, q, true, NULL, NULL, &more); + if (!buf) +@@ -493,6 +494,12 @@ mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q) + + skb_free_frag(buf); + } while (1); ++ ++ if (q->rx_head) { ++ dev_kfree_skb(q->rx_head); ++ q->rx_head = NULL; ++ } ++ + spin_unlock_bh(&q->lock); + + if (!q->rx_page.va) +@@ -515,12 +522,6 @@ mt76_dma_rx_reset(struct mt76_dev *dev, enum mt76_rxq_id qid) + mt76_dma_rx_cleanup(dev, q); + mt76_dma_sync_idx(dev, q); + mt76_dma_rx_fill(dev, q); +- +- if (!q->rx_head) +- return; +- +- dev_kfree_skb(q->rx_head); +- q->rx_head = NULL; + } + + static void +-- +2.39.2 + diff --git a/queue-5.15/wifi-mt7601u-fix-an-integer-underflow.patch b/queue-5.15/wifi-mt7601u-fix-an-integer-underflow.patch new file mode 100644 index 00000000000..c296e70fd3b --- /dev/null +++ b/queue-5.15/wifi-mt7601u-fix-an-integer-underflow.patch @@ -0,0 +1,102 @@ +From 4eef27a5e6825f89da393462ff5b577bb7e12aa7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Dec 2022 18:29:06 +0900 +Subject: wifi: mt7601u: fix an integer underflow + +From: Jisoo Jang + +[ Upstream commit 803f3176c5df3b5582c27ea690f204abb60b19b9 ] + +Fix an integer underflow that leads to a null pointer dereference in +'mt7601u_rx_skb_from_seg()'. The variable 'dma_len' in the URB packet +could be manipulated, which could trigger an integer underflow of +'seg_len' in 'mt7601u_rx_process_seg()'. This underflow subsequently +causes the 'bad_frame' checks in 'mt7601u_rx_skb_from_seg()' to be +bypassed, eventually leading to a dereference of the pointer 'p', which +is a null pointer. + +Ensure that 'dma_len' is greater than 'min_seg_len'. + +Found by a modified version of syzkaller. + +KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] +CPU: 0 PID: 12 Comm: ksoftirqd/0 Tainted: G W O 5.14.0+ +#139 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS +rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014 +RIP: 0010:skb_add_rx_frag+0x143/0x370 +Code: e2 07 83 c2 03 38 ca 7c 08 84 c9 0f 85 86 01 00 00 4c 8d 7d 08 44 +89 68 08 48 b8 00 00 00 00 00 fc ff df 4c 89 fa 48 c1 ea 03 <80> 3c 02 +00 0f 85 cd 01 00 00 48 8b 45 08 a8 01 0f 85 3d 01 00 00 +RSP: 0018:ffffc900000cfc90 EFLAGS: 00010202 +RAX: dffffc0000000000 RBX: ffff888115520dc0 RCX: 0000000000000000 +RDX: 0000000000000001 RSI: ffff8881118430c0 RDI: ffff8881118430f8 +RBP: 0000000000000000 R08: 0000000000000e09 R09: 0000000000000010 +R10: ffff888111843017 R11: ffffed1022308602 R12: 0000000000000000 +R13: 0000000000000e09 R14: 0000000000000010 R15: 0000000000000008 +FS: 0000000000000000(0000) GS:ffff88811a800000(0000) +knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 000000004035af40 CR3: 00000001157f2000 CR4: 0000000000750ef0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +PKRU: 55555554 +Call Trace: + mt7601u_rx_tasklet+0xc73/0x1270 + ? mt7601u_submit_rx_buf.isra.0+0x510/0x510 + ? tasklet_action_common.isra.0+0x79/0x2f0 + tasklet_action_common.isra.0+0x206/0x2f0 + __do_softirq+0x1b5/0x880 + ? tasklet_unlock+0x30/0x30 + run_ksoftirqd+0x26/0x50 + smpboot_thread_fn+0x34f/0x7d0 + ? smpboot_register_percpu_thread+0x370/0x370 + kthread+0x3a1/0x480 + ? set_kthread_struct+0x120/0x120 + ret_from_fork+0x1f/0x30 +Modules linked in: 88XXau(O) 88x2bu(O) +---[ end trace 57f34f93b4da0f9b ]--- +RIP: 0010:skb_add_rx_frag+0x143/0x370 +Code: e2 07 83 c2 03 38 ca 7c 08 84 c9 0f 85 86 01 00 00 4c 8d 7d 08 44 +89 68 08 48 b8 00 00 00 00 00 fc ff df 4c 89 fa 48 c1 ea 03 <80> 3c 02 +00 0f 85 cd 01 00 00 48 8b 45 08 a8 01 0f 85 3d 01 00 00 +RSP: 0018:ffffc900000cfc90 EFLAGS: 00010202 +RAX: dffffc0000000000 RBX: ffff888115520dc0 RCX: 0000000000000000 +RDX: 0000000000000001 RSI: ffff8881118430c0 RDI: ffff8881118430f8 +RBP: 0000000000000000 R08: 0000000000000e09 R09: 0000000000000010 +R10: ffff888111843017 R11: ffffed1022308602 R12: 0000000000000000 +R13: 0000000000000e09 R14: 0000000000000010 R15: 0000000000000008 +FS: 0000000000000000(0000) GS:ffff88811a800000(0000) +knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 000000004035af40 CR3: 00000001157f2000 CR4: 0000000000750ef0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +PKRU: 55555554 + +Signed-off-by: Jisoo Jang +Acked-by: Jakub Kicinski +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20221229092906.2328282-1-jisoo.jang@yonsei.ac.kr +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt7601u/dma.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/mediatek/mt7601u/dma.c b/drivers/net/wireless/mediatek/mt7601u/dma.c +index ed78d2cb35e3c..fd3b768ca92bd 100644 +--- a/drivers/net/wireless/mediatek/mt7601u/dma.c ++++ b/drivers/net/wireless/mediatek/mt7601u/dma.c +@@ -123,7 +123,8 @@ static u16 mt7601u_rx_next_seg_len(u8 *data, u32 data_len) + if (data_len < min_seg_len || + WARN_ON_ONCE(!dma_len) || + WARN_ON_ONCE(dma_len + MT_DMA_HDRS > data_len) || +- WARN_ON_ONCE(dma_len & 0x3)) ++ WARN_ON_ONCE(dma_len & 0x3) || ++ WARN_ON_ONCE(dma_len < min_seg_len)) + return 0; + + return MT_DMA_HDRS + dma_len; +-- +2.39.2 + diff --git a/queue-5.15/wifi-mwifiex-fix-loop-iterator-in-mwifiex_update_amp.patch b/queue-5.15/wifi-mwifiex-fix-loop-iterator-in-mwifiex_update_amp.patch new file mode 100644 index 00000000000..fa109b6eebd --- /dev/null +++ b/queue-5.15/wifi-mwifiex-fix-loop-iterator-in-mwifiex_update_amp.patch @@ -0,0 +1,48 @@ +From 2cd54f5851261d8f28fd759e4d21846fd5e27b73 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Feb 2023 17:41:33 +0300 +Subject: wifi: mwifiex: fix loop iterator in mwifiex_update_ampdu_txwinsize() + +From: Dan Carpenter + +[ Upstream commit 3cfb7df24cee0f5fdc4cc5d3176cab9aadfcb430 ] + +This code re-uses "i" to be the iterator for both the inside and outside +loops. It means the outside loop will exit earlier than intended. + +Fixes: d219b7eb3792 ("mwifiex: handle BT coex event to adjust Rx BA window size") +Signed-off-by: Dan Carpenter +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/Y+ERnaDaZD7RtLvX@kili +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/marvell/mwifiex/11n.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/marvell/mwifiex/11n.c b/drivers/net/wireless/marvell/mwifiex/11n.c +index cf08a4af84d6d..b99381ebb82a1 100644 +--- a/drivers/net/wireless/marvell/mwifiex/11n.c ++++ b/drivers/net/wireless/marvell/mwifiex/11n.c +@@ -890,7 +890,7 @@ mwifiex_send_delba_txbastream_tbl(struct mwifiex_private *priv, u8 tid) + */ + void mwifiex_update_ampdu_txwinsize(struct mwifiex_adapter *adapter) + { +- u8 i; ++ u8 i, j; + u32 tx_win_size; + struct mwifiex_private *priv; + +@@ -921,8 +921,8 @@ void mwifiex_update_ampdu_txwinsize(struct mwifiex_adapter *adapter) + if (tx_win_size != priv->add_ba_param.tx_win_size) { + if (!priv->media_connected) + continue; +- for (i = 0; i < MAX_NUM_TID; i++) +- mwifiex_send_delba_txbastream_tbl(priv, i); ++ for (j = 0; j < MAX_NUM_TID; j++) ++ mwifiex_send_delba_txbastream_tbl(priv, j); + } + } + } +-- +2.39.2 + diff --git a/queue-5.15/wifi-orinoco-check-return-value-of-hermes_write_word.patch b/queue-5.15/wifi-orinoco-check-return-value-of-hermes_write_word.patch new file mode 100644 index 00000000000..d6bc2bdb9be --- /dev/null +++ b/queue-5.15/wifi-orinoco-check-return-value-of-hermes_write_word.patch @@ -0,0 +1,43 @@ +From 1f40e6f07d45083980cb379015172e613c2094bb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Dec 2022 16:33:06 +0300 +Subject: wifi: orinoco: check return value of hermes_write_wordrec() + +From: Alexey Kodanev + +[ Upstream commit 1e346cbb096a5351a637ec1992beffbf330547f0 ] + +There is currently no return check for writing an authentication +type (HERMES_AUTH_SHARED_KEY or HERMES_AUTH_OPEN). It looks like +it was accidentally skipped. + +This patch adds a return check similar to the other checks in +__orinoco_hw_setup_enc() for hermes_write_wordrec(). + +Detected using the static analysis tool - Svace. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Alexey Kodanev +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20221227133306.201356-1-aleksei.kodanev@bell-sw.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intersil/orinoco/hw.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/wireless/intersil/orinoco/hw.c b/drivers/net/wireless/intersil/orinoco/hw.c +index 0aea35c9c11c7..4fcca08e50de2 100644 +--- a/drivers/net/wireless/intersil/orinoco/hw.c ++++ b/drivers/net/wireless/intersil/orinoco/hw.c +@@ -931,6 +931,8 @@ int __orinoco_hw_setup_enc(struct orinoco_private *priv) + err = hermes_write_wordrec(hw, USER_BAP, + HERMES_RID_CNFAUTHENTICATION_AGERE, + auth_flag); ++ if (err) ++ return err; + } + err = hermes_write_wordrec(hw, USER_BAP, + HERMES_RID_CNFWEPENABLED_AGERE, +-- +2.39.2 + diff --git a/queue-5.15/wifi-rsi-fix-memory-leak-in-rsi_coex_attach.patch b/queue-5.15/wifi-rsi-fix-memory-leak-in-rsi_coex_attach.patch new file mode 100644 index 00000000000..44c224eae01 --- /dev/null +++ b/queue-5.15/wifi-rsi-fix-memory-leak-in-rsi_coex_attach.patch @@ -0,0 +1,37 @@ +From 8cf4390d8fce9b1e4c71d284a83fc973a3cca9e8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Dec 2022 06:14:41 +0000 +Subject: wifi: rsi: Fix memory leak in rsi_coex_attach() + +From: Yuan Can + +[ Upstream commit 956fb851a6e19da5ab491e19c1bc323bb2c2cf6f ] + +The coex_cb needs to be freed when rsi_create_kthread() failed in +rsi_coex_attach(). + +Fixes: 2108df3c4b18 ("rsi: add coex support") +Signed-off-by: Yuan Can +Reviewed-by: Simon Horman +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20221205061441.114632-1-yuancan@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/rsi/rsi_91x_coex.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/wireless/rsi/rsi_91x_coex.c b/drivers/net/wireless/rsi/rsi_91x_coex.c +index a0c5d02ae88cf..7395359b43b77 100644 +--- a/drivers/net/wireless/rsi/rsi_91x_coex.c ++++ b/drivers/net/wireless/rsi/rsi_91x_coex.c +@@ -160,6 +160,7 @@ int rsi_coex_attach(struct rsi_common *common) + rsi_coex_scheduler_thread, + "Coex-Tx-Thread")) { + rsi_dbg(ERR_ZONE, "%s: Unable to init tx thrd\n", __func__); ++ kfree(coex_cb); + return -EINVAL; + } + return 0; +-- +2.39.2 + diff --git a/queue-5.15/wifi-rtl8xxxu-don-t-call-dev_kfree_skb-under-spin_lo.patch b/queue-5.15/wifi-rtl8xxxu-don-t-call-dev_kfree_skb-under-spin_lo.patch new file mode 100644 index 00000000000..3c2be6ac07b --- /dev/null +++ b/queue-5.15/wifi-rtl8xxxu-don-t-call-dev_kfree_skb-under-spin_lo.patch @@ -0,0 +1,47 @@ +From f7049f671db3193b68632705bf6b97066c82c926 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Dec 2022 22:35:17 +0800 +Subject: wifi: rtl8xxxu: don't call dev_kfree_skb() under spin_lock_irqsave() + +From: Yang Yingliang + +[ Upstream commit 4c2005ac87685907b3719b4f40215b578efd27c4 ] + +It is not allowed to call kfree_skb() or consume_skb() from hardware +interrupt context or with hardware interrupts being disabled. + +It should use dev_kfree_skb_irq() or dev_consume_skb_irq() instead. +The difference between them is free reason, dev_kfree_skb_irq() means +the SKB is dropped in error and dev_consume_skb_irq() means the SKB +is consumed in normal. + +In this case, dev_kfree_skb() is called to free and drop the SKB when +it's shutdown, so replace it with dev_kfree_skb_irq(). Compile tested +only. + +Fixes: 26f1fad29ad9 ("New driver: rtl8xxxu (mac80211)") +Signed-off-by: Yang Yingliang +Reviewed-by: Ping-Ke Shih +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20221208143517.2383424-1-yangyingliang@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c +index 3d3fa2b616a86..dc734e8fa0f1c 100644 +--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c ++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c +@@ -5184,7 +5184,7 @@ static void rtl8xxxu_queue_rx_urb(struct rtl8xxxu_priv *priv, + pending = priv->rx_urb_pending_count; + } else { + skb = (struct sk_buff *)rx_urb->urb.context; +- dev_kfree_skb(skb); ++ dev_kfree_skb_irq(skb); + usb_free_urb(&rx_urb->urb); + } + +-- +2.39.2 + diff --git a/queue-5.15/wifi-rtl8xxxu-fix-memory-leaks-with-rtl8723bu-rtl819.patch b/queue-5.15/wifi-rtl8xxxu-fix-memory-leaks-with-rtl8723bu-rtl819.patch new file mode 100644 index 00000000000..482738dc8bd --- /dev/null +++ b/queue-5.15/wifi-rtl8xxxu-fix-memory-leaks-with-rtl8723bu-rtl819.patch @@ -0,0 +1,76 @@ +From 410db70ca55afed3a13b339afda7c7a7809005bd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Dec 2022 13:48:04 +0200 +Subject: wifi: rtl8xxxu: Fix memory leaks with RTL8723BU, RTL8192EU + +From: Bitterblue Smith + +[ Upstream commit b39f662ce1648db0b9de32e6a849b098480793cb ] + +The wifi + bluetooth combo chip RTL8723BU can leak memory (especially?) +when it's connected to a bluetooth audio device. The busy bluetooth +traffic generates lots of C2H (card to host) messages, which are not +freed correctly. + +To fix this, move the dev_kfree_skb() call in rtl8xxxu_c2hcmd_callback() +inside the loop where skb_dequeue() is called. + +The RTL8192EU leaks memory because the C2H messages are added to the +queue and left there forever. (This was fine in the past because it +probably wasn't sending any C2H messages until commit e542e66b7c2e +("wifi: rtl8xxxu: gen2: Turn on the rate control"). Since that commit +it sends a C2H message when the TX rate changes.) + +To fix this, delete the check for rf_paths > 1 and the goto. Let the +function process the C2H messages from RTL8192EU like the ones from +the other chips. + +Theoretically the RTL8188FU could also leak like RTL8723BU, but it +most likely doesn't send C2H messages frequently enough. + +This change was tested with RTL8723BU by Erhard F. I tested it with +RTL8188FU and RTL8192EU. + +Reported-by: Erhard F. +Tested-by: Erhard F. +Link: https://bugzilla.kernel.org/show_bug.cgi?id=215197 +Fixes: e542e66b7c2e ("rtl8xxxu: add bluetooth co-existence support for single antenna") +Signed-off-by: Bitterblue Smith +Reviewed-by: Ping-Ke Shih +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/03b099c1-c671-d252-36f4-57b70d721f9d@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 8 ++------ + 1 file changed, 2 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c +index dc734e8fa0f1c..a404d0344351d 100644 +--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c ++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c +@@ -5490,9 +5490,6 @@ static void rtl8xxxu_c2hcmd_callback(struct work_struct *work) + btcoex = &priv->bt_coex; + rarpt = &priv->ra_report; + +- if (priv->rf_paths > 1) +- goto out; +- + while (!skb_queue_empty(&priv->c2hcmd_queue)) { + skb = skb_dequeue(&priv->c2hcmd_queue); + +@@ -5544,10 +5541,9 @@ static void rtl8xxxu_c2hcmd_callback(struct work_struct *work) + default: + break; + } +- } + +-out: +- dev_kfree_skb(skb); ++ dev_kfree_skb(skb); ++ } + } + + static void rtl8723bu_handle_c2h(struct rtl8xxxu_priv *priv, +-- +2.39.2 + diff --git a/queue-5.15/wifi-rtlwifi-fix-global-out-of-bounds-bug-in-_rtl881.patch b/queue-5.15/wifi-rtlwifi-fix-global-out-of-bounds-bug-in-_rtl881.patch new file mode 100644 index 00000000000..a4bba13e88b --- /dev/null +++ b/queue-5.15/wifi-rtlwifi-fix-global-out-of-bounds-bug-in-_rtl881.patch @@ -0,0 +1,158 @@ +From 3b7a930ed9f36ad7800147506ae968f76d161c12 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Dec 2022 10:58:12 +0800 +Subject: wifi: rtlwifi: Fix global-out-of-bounds bug in + _rtl8812ae_phy_set_txpower_limit() + +From: Li Zetao + +[ Upstream commit 117dbeda22ec5ea0918254d03b540ef8b8a64d53 ] + +There is a global-out-of-bounds reported by KASAN: + + BUG: KASAN: global-out-of-bounds in + _rtl8812ae_eq_n_byte.part.0+0x3d/0x84 [rtl8821ae] + Read of size 1 at addr ffffffffa0773c43 by task NetworkManager/411 + + CPU: 6 PID: 411 Comm: NetworkManager Tainted: G D + 6.1.0-rc8+ #144 e15588508517267d37 + Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), + Call Trace: + + ... + kasan_report+0xbb/0x1c0 + _rtl8812ae_eq_n_byte.part.0+0x3d/0x84 [rtl8821ae] + rtl8821ae_phy_bb_config.cold+0x346/0x641 [rtl8821ae] + rtl8821ae_hw_init+0x1f5e/0x79b0 [rtl8821ae] + ... + + +The root cause of the problem is that the comparison order of +"prate_section" in _rtl8812ae_phy_set_txpower_limit() is wrong. The +_rtl8812ae_eq_n_byte() is used to compare the first n bytes of the two +strings from tail to head, which causes the problem. In the +_rtl8812ae_phy_set_txpower_limit(), it was originally intended to meet +this requirement by carefully designing the comparison order. +For example, "pregulation" and "pbandwidth" are compared in order of +length from small to large, first is 3 and last is 4. However, the +comparison order of "prate_section" dose not obey such order requirement, +therefore when "prate_section" is "HT", when comparing from tail to head, +it will lead to access out of bounds in _rtl8812ae_eq_n_byte(). As +mentioned above, the _rtl8812ae_eq_n_byte() has the same function as +strcmp(), so just strcmp() is enough. + +Fix it by removing _rtl8812ae_eq_n_byte() and use strcmp() barely. +Although it can be fixed by adjusting the comparison order of +"prate_section", this may cause the value of "rate_section" to not be +from 0 to 5. In addition, commit "21e4b0726dc6" not only moved driver +from staging to regular tree, but also added setting txpower limit +function during the driver config phase, so the problem was introduced +by this commit. + +Fixes: 21e4b0726dc6 ("rtlwifi: rtl8821ae: Move driver from staging to regular tree") +Signed-off-by: Li Zetao +Acked-by: Ping-Ke Shih +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20221212025812.1541311-1-lizetao1@huawei.com +Signed-off-by: Sasha Levin +--- + .../wireless/realtek/rtlwifi/rtl8821ae/phy.c | 52 +++++++------------ + 1 file changed, 20 insertions(+), 32 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c +index a29321e2fa72f..5323ead30db03 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c ++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c +@@ -1598,18 +1598,6 @@ static bool _rtl8812ae_get_integer_from_string(const char *str, u8 *pint) + return true; + } + +-static bool _rtl8812ae_eq_n_byte(const char *str1, const char *str2, u32 num) +-{ +- if (num == 0) +- return false; +- while (num > 0) { +- num--; +- if (str1[num] != str2[num]) +- return false; +- } +- return true; +-} +- + static s8 _rtl8812ae_phy_get_chnl_idx_of_txpwr_lmt(struct ieee80211_hw *hw, + u8 band, u8 channel) + { +@@ -1659,42 +1647,42 @@ static void _rtl8812ae_phy_set_txpower_limit(struct ieee80211_hw *hw, + power_limit = power_limit > MAX_POWER_INDEX ? + MAX_POWER_INDEX : power_limit; + +- if (_rtl8812ae_eq_n_byte(pregulation, "FCC", 3)) ++ if (strcmp(pregulation, "FCC") == 0) + regulation = 0; +- else if (_rtl8812ae_eq_n_byte(pregulation, "MKK", 3)) ++ else if (strcmp(pregulation, "MKK") == 0) + regulation = 1; +- else if (_rtl8812ae_eq_n_byte(pregulation, "ETSI", 4)) ++ else if (strcmp(pregulation, "ETSI") == 0) + regulation = 2; +- else if (_rtl8812ae_eq_n_byte(pregulation, "WW13", 4)) ++ else if (strcmp(pregulation, "WW13") == 0) + regulation = 3; + +- if (_rtl8812ae_eq_n_byte(prate_section, "CCK", 3)) ++ if (strcmp(prate_section, "CCK") == 0) + rate_section = 0; +- else if (_rtl8812ae_eq_n_byte(prate_section, "OFDM", 4)) ++ else if (strcmp(prate_section, "OFDM") == 0) + rate_section = 1; +- else if (_rtl8812ae_eq_n_byte(prate_section, "HT", 2) && +- _rtl8812ae_eq_n_byte(prf_path, "1T", 2)) ++ else if (strcmp(prate_section, "HT") == 0 && ++ strcmp(prf_path, "1T") == 0) + rate_section = 2; +- else if (_rtl8812ae_eq_n_byte(prate_section, "HT", 2) && +- _rtl8812ae_eq_n_byte(prf_path, "2T", 2)) ++ else if (strcmp(prate_section, "HT") == 0 && ++ strcmp(prf_path, "2T") == 0) + rate_section = 3; +- else if (_rtl8812ae_eq_n_byte(prate_section, "VHT", 3) && +- _rtl8812ae_eq_n_byte(prf_path, "1T", 2)) ++ else if (strcmp(prate_section, "VHT") == 0 && ++ strcmp(prf_path, "1T") == 0) + rate_section = 4; +- else if (_rtl8812ae_eq_n_byte(prate_section, "VHT", 3) && +- _rtl8812ae_eq_n_byte(prf_path, "2T", 2)) ++ else if (strcmp(prate_section, "VHT") == 0 && ++ strcmp(prf_path, "2T") == 0) + rate_section = 5; + +- if (_rtl8812ae_eq_n_byte(pbandwidth, "20M", 3)) ++ if (strcmp(pbandwidth, "20M") == 0) + bandwidth = 0; +- else if (_rtl8812ae_eq_n_byte(pbandwidth, "40M", 3)) ++ else if (strcmp(pbandwidth, "40M") == 0) + bandwidth = 1; +- else if (_rtl8812ae_eq_n_byte(pbandwidth, "80M", 3)) ++ else if (strcmp(pbandwidth, "80M") == 0) + bandwidth = 2; +- else if (_rtl8812ae_eq_n_byte(pbandwidth, "160M", 4)) ++ else if (strcmp(pbandwidth, "160M") == 0) + bandwidth = 3; + +- if (_rtl8812ae_eq_n_byte(pband, "2.4G", 4)) { ++ if (strcmp(pband, "2.4G") == 0) { + ret = _rtl8812ae_phy_get_chnl_idx_of_txpwr_lmt(hw, + BAND_ON_2_4G, + channel); +@@ -1718,7 +1706,7 @@ static void _rtl8812ae_phy_set_txpower_limit(struct ieee80211_hw *hw, + regulation, bandwidth, rate_section, channel_index, + rtlphy->txpwr_limit_2_4g[regulation][bandwidth] + [rate_section][channel_index][RF90_PATH_A]); +- } else if (_rtl8812ae_eq_n_byte(pband, "5G", 2)) { ++ } else if (strcmp(pband, "5G") == 0) { + ret = _rtl8812ae_phy_get_chnl_idx_of_txpwr_lmt(hw, + BAND_ON_5G, + channel); +-- +2.39.2 + diff --git a/queue-5.15/wifi-rtlwifi-rtl8188ee-don-t-call-kfree_skb-under-sp.patch b/queue-5.15/wifi-rtlwifi-rtl8188ee-don-t-call-kfree_skb-under-sp.patch new file mode 100644 index 00000000000..334ab9860ed --- /dev/null +++ b/queue-5.15/wifi-rtlwifi-rtl8188ee-don-t-call-kfree_skb-under-sp.patch @@ -0,0 +1,58 @@ +From d9b0e34f1ad2dbca16f27be1372ca1e2230fe066 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Dec 2022 22:14:10 +0800 +Subject: wifi: rtlwifi: rtl8188ee: don't call kfree_skb() under + spin_lock_irqsave() + +From: Yang Yingliang + +[ Upstream commit 2611687fa7ffc84190f92292de0b80468de17220 ] + +It is not allowed to call kfree_skb() from hardware interrupt +context or with interrupts being disabled. All the SKBs have +been dequeued from the old queue, so it's safe to enqueue these +SKBs to a free queue, then free them after spin_unlock_irqrestore() +at once. Compile tested only. + +Fixes: 7fe3b3abb5da ("rtlwifi: rtl8188ee: rtl8821ae: Fix a queue locking problem") +Signed-off-by: Yang Yingliang +Acked-by: Ping-Ke Shih +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20221207141411.46098-3-yangyingliang@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtlwifi/rtl8188ee/hw.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/hw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/hw.c +index bf686a916acb8..13e9717a1ce82 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/hw.c ++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/hw.c +@@ -68,8 +68,10 @@ static void _rtl88ee_return_beacon_queue_skb(struct ieee80211_hw *hw) + struct rtl_priv *rtlpriv = rtl_priv(hw); + struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw)); + struct rtl8192_tx_ring *ring = &rtlpci->tx_ring[BEACON_QUEUE]; ++ struct sk_buff_head free_list; + unsigned long flags; + ++ skb_queue_head_init(&free_list); + spin_lock_irqsave(&rtlpriv->locks.irq_th_lock, flags); + while (skb_queue_len(&ring->queue)) { + struct rtl_tx_desc *entry = &ring->desc[ring->idx]; +@@ -79,10 +81,12 @@ static void _rtl88ee_return_beacon_queue_skb(struct ieee80211_hw *hw) + rtlpriv->cfg->ops->get_desc(hw, (u8 *)entry, + true, HW_DESC_TXBUFF_ADDR), + skb->len, DMA_TO_DEVICE); +- kfree_skb(skb); ++ __skb_queue_tail(&free_list, skb); + ring->idx = (ring->idx + 1) % ring->entries; + } + spin_unlock_irqrestore(&rtlpriv->locks.irq_th_lock, flags); ++ ++ __skb_queue_purge(&free_list); + } + + static void _rtl88ee_disable_bcn_sub_func(struct ieee80211_hw *hw) +-- +2.39.2 + diff --git a/queue-5.15/wifi-rtlwifi-rtl8723be-don-t-call-kfree_skb-under-sp.patch b/queue-5.15/wifi-rtlwifi-rtl8723be-don-t-call-kfree_skb-under-sp.patch new file mode 100644 index 00000000000..d359e52e796 --- /dev/null +++ b/queue-5.15/wifi-rtlwifi-rtl8723be-don-t-call-kfree_skb-under-sp.patch @@ -0,0 +1,58 @@ +From b21e679f185fda626235f00f503f1d5b88d5eadf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Dec 2022 22:14:11 +0800 +Subject: wifi: rtlwifi: rtl8723be: don't call kfree_skb() under + spin_lock_irqsave() + +From: Yang Yingliang + +[ Upstream commit 313950c2114e7051c4e3020fd82495fa1fb526a8 ] + +It is not allowed to call kfree_skb() from hardware interrupt +context or with interrupts being disabled. All the SKBs have +been dequeued from the old queue, so it's safe to enqueue these +SKBs to a free queue, then free them after spin_unlock_irqrestore() +at once. Compile tested only. + +Fixes: 5c99f04fec93 ("rtlwifi: rtl8723be: Update driver to match Realtek release of 06/28/14") +Signed-off-by: Yang Yingliang +Acked-by: Ping-Ke Shih +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20221207141411.46098-4-yangyingliang@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c +index 0748aedce2adb..ccbb082d5e928 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c ++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c +@@ -30,8 +30,10 @@ static void _rtl8723be_return_beacon_queue_skb(struct ieee80211_hw *hw) + struct rtl_priv *rtlpriv = rtl_priv(hw); + struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw)); + struct rtl8192_tx_ring *ring = &rtlpci->tx_ring[BEACON_QUEUE]; ++ struct sk_buff_head free_list; + unsigned long flags; + ++ skb_queue_head_init(&free_list); + spin_lock_irqsave(&rtlpriv->locks.irq_th_lock, flags); + while (skb_queue_len(&ring->queue)) { + struct rtl_tx_desc *entry = &ring->desc[ring->idx]; +@@ -41,10 +43,12 @@ static void _rtl8723be_return_beacon_queue_skb(struct ieee80211_hw *hw) + rtlpriv->cfg->ops->get_desc(hw, (u8 *)entry, + true, HW_DESC_TXBUFF_ADDR), + skb->len, DMA_TO_DEVICE); +- kfree_skb(skb); ++ __skb_queue_tail(&free_list, skb); + ring->idx = (ring->idx + 1) % ring->entries; + } + spin_unlock_irqrestore(&rtlpriv->locks.irq_th_lock, flags); ++ ++ __skb_queue_purge(&free_list); + } + + static void _rtl8723be_set_bcn_ctrl_reg(struct ieee80211_hw *hw, +-- +2.39.2 + diff --git a/queue-5.15/wifi-rtlwifi-rtl8821ae-don-t-call-kfree_skb-under-sp.patch b/queue-5.15/wifi-rtlwifi-rtl8821ae-don-t-call-kfree_skb-under-sp.patch new file mode 100644 index 00000000000..8f1582cb131 --- /dev/null +++ b/queue-5.15/wifi-rtlwifi-rtl8821ae-don-t-call-kfree_skb-under-sp.patch @@ -0,0 +1,58 @@ +From 385a51a7a50dd165ad67f87e7e054c0b96530aa3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Dec 2022 22:14:09 +0800 +Subject: wifi: rtlwifi: rtl8821ae: don't call kfree_skb() under + spin_lock_irqsave() + +From: Yang Yingliang + +[ Upstream commit 106031c1f4a850915190d7ec1026696282f9359b ] + +It is not allowed to call kfree_skb() from hardware interrupt +context or with interrupts being disabled. All the SKBs have +been dequeued from the old queue, so it's safe to enqueue these +SKBs to a free queue, then free them after spin_unlock_irqrestore() +at once. Compile tested only. + +Fixes: 5c99f04fec93 ("rtlwifi: rtl8723be: Update driver to match Realtek release of 06/28/14") +Signed-off-by: Yang Yingliang +Acked-by: Ping-Ke Shih +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20221207141411.46098-2-yangyingliang@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c +index 33ffc24d36759..c4ee65cc2d5e6 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c ++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c +@@ -26,8 +26,10 @@ static void _rtl8821ae_return_beacon_queue_skb(struct ieee80211_hw *hw) + struct rtl_priv *rtlpriv = rtl_priv(hw); + struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw)); + struct rtl8192_tx_ring *ring = &rtlpci->tx_ring[BEACON_QUEUE]; ++ struct sk_buff_head free_list; + unsigned long flags; + ++ skb_queue_head_init(&free_list); + spin_lock_irqsave(&rtlpriv->locks.irq_th_lock, flags); + while (skb_queue_len(&ring->queue)) { + struct rtl_tx_desc *entry = &ring->desc[ring->idx]; +@@ -37,10 +39,12 @@ static void _rtl8821ae_return_beacon_queue_skb(struct ieee80211_hw *hw) + rtlpriv->cfg->ops->get_desc(hw, (u8 *)entry, + true, HW_DESC_TXBUFF_ADDR), + skb->len, DMA_TO_DEVICE); +- kfree_skb(skb); ++ __skb_queue_tail(&free_list, skb); + ring->idx = (ring->idx + 1) % ring->entries; + } + spin_unlock_irqrestore(&rtlpriv->locks.irq_th_lock, flags); ++ ++ __skb_queue_purge(&free_list); + } + + static void _rtl8821ae_set_bcn_ctrl_reg(struct ieee80211_hw *hw, +-- +2.39.2 + diff --git a/queue-5.15/wifi-wilc1000-fix-potential-memory-leak-in-wilc_mac_.patch b/queue-5.15/wifi-wilc1000-fix-potential-memory-leak-in-wilc_mac_.patch new file mode 100644 index 00000000000..8516bd2eab4 --- /dev/null +++ b/queue-5.15/wifi-wilc1000-fix-potential-memory-leak-in-wilc_mac_.patch @@ -0,0 +1,36 @@ +From 6c9e5e84a51ece43038adaf9d2b9ce42c79d7b78 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Nov 2022 19:36:03 +0800 +Subject: wifi: wilc1000: fix potential memory leak in wilc_mac_xmit() + +From: Zhang Changzhong + +[ Upstream commit deb962ec9e1c9a81babd3d37542ad4bd6ac3396e ] + +The wilc_mac_xmit() returns NETDEV_TX_OK without freeing skb, add +dev_kfree_skb() to fix it. Compile tested only. + +Fixes: c5c77ba18ea6 ("staging: wilc1000: Add SDIO/SPI 802.11 driver") +Signed-off-by: Zhang Changzhong +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/1668684964-48622-1-git-send-email-zhangchangzhong@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/microchip/wilc1000/netdev.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/wireless/microchip/wilc1000/netdev.c b/drivers/net/wireless/microchip/wilc1000/netdev.c +index 9dfb1a285e6a4..5e3ec20e24dad 100644 +--- a/drivers/net/wireless/microchip/wilc1000/netdev.c ++++ b/drivers/net/wireless/microchip/wilc1000/netdev.c +@@ -724,6 +724,7 @@ netdev_tx_t wilc_mac_xmit(struct sk_buff *skb, struct net_device *ndev) + + if (skb->dev != ndev) { + netdev_err(ndev, "Packet not destined to this device\n"); ++ dev_kfree_skb(skb); + return NETDEV_TX_OK; + } + +-- +2.39.2 + diff --git a/queue-5.15/wifi-wl3501_cs-don-t-call-kfree_skb-under-spin_lock_.patch b/queue-5.15/wifi-wl3501_cs-don-t-call-kfree_skb-under-spin_lock_.patch new file mode 100644 index 00000000000..ceb3858fb32 --- /dev/null +++ b/queue-5.15/wifi-wl3501_cs-don-t-call-kfree_skb-under-spin_lock_.patch @@ -0,0 +1,39 @@ +From bfe4284ad1e56455383b3ac27a0b141eb858ff5c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Dec 2022 23:04:53 +0800 +Subject: wifi: wl3501_cs: don't call kfree_skb() under spin_lock_irqsave() + +From: Yang Yingliang + +[ Upstream commit 44bacbdf9066c590423259dbd6d520baac99c1a8 ] + +It is not allowed to call kfree_skb() from hardware interrupt +context or with interrupts being disabled. So replace kfree_skb() +with dev_kfree_skb_irq() under spin_lock_irqsave(). Compile +tested only. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Yang Yingliang +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20221207150453.114742-1-yangyingliang@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/wl3501_cs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/wl3501_cs.c b/drivers/net/wireless/wl3501_cs.c +index 672f5d5f3f2c7..cb71b73853f4e 100644 +--- a/drivers/net/wireless/wl3501_cs.c ++++ b/drivers/net/wireless/wl3501_cs.c +@@ -1328,7 +1328,7 @@ static netdev_tx_t wl3501_hard_start_xmit(struct sk_buff *skb, + } else { + ++dev->stats.tx_packets; + dev->stats.tx_bytes += skb->len; +- kfree_skb(skb); ++ dev_kfree_skb_irq(skb); + + if (this->tx_buffer_cnt < 2) + netif_stop_queue(dev); +-- +2.39.2 + diff --git a/queue-5.15/x86-bugs-reset-speculation-control-settings-on-init.patch b/queue-5.15/x86-bugs-reset-speculation-control-settings-on-init.patch new file mode 100644 index 00000000000..20dc0d77788 --- /dev/null +++ b/queue-5.15/x86-bugs-reset-speculation-control-settings-on-init.patch @@ -0,0 +1,75 @@ +From 112272d2b7aafc06b4ff3ab3091a2400be527517 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Nov 2022 07:31:48 -0800 +Subject: x86/bugs: Reset speculation control settings on init + +From: Breno Leitao + +[ Upstream commit 0125acda7d76b943ca55811df40ed6ec0ecf670f ] + +Currently, x86_spec_ctrl_base is read at boot time and speculative bits +are set if Kconfig items are enabled. For example, IBRS is enabled if +CONFIG_CPU_IBRS_ENTRY is configured, etc. These MSR bits are not cleared +if the mitigations are disabled. + +This is a problem when kexec-ing a kernel that has the mitigation +disabled from a kernel that has the mitigation enabled. In this case, +the MSR bits are not cleared during the new kernel boot. As a result, +this might have some performance degradation that is hard to pinpoint. + +This problem does not happen if the machine is (hard) rebooted because +the bit will be cleared by default. + + [ bp: Massage. ] + +Suggested-by: Pawan Gupta +Signed-off-by: Breno Leitao +Signed-off-by: Borislav Petkov (AMD) +Link: https://lore.kernel.org/r/20221128153148.1129350-1-leitao@debian.org +Signed-off-by: Sasha Levin +--- + arch/x86/include/asm/msr-index.h | 4 ++++ + arch/x86/kernel/cpu/bugs.c | 10 +++++++++- + 2 files changed, 13 insertions(+), 1 deletion(-) + +diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h +index f069ab09c5fc1..3588b799c63f2 100644 +--- a/arch/x86/include/asm/msr-index.h ++++ b/arch/x86/include/asm/msr-index.h +@@ -54,6 +54,10 @@ + #define SPEC_CTRL_RRSBA_DIS_S_SHIFT 6 /* Disable RRSBA behavior */ + #define SPEC_CTRL_RRSBA_DIS_S BIT(SPEC_CTRL_RRSBA_DIS_S_SHIFT) + ++/* A mask for bits which the kernel toggles when controlling mitigations */ ++#define SPEC_CTRL_MITIGATIONS_MASK (SPEC_CTRL_IBRS | SPEC_CTRL_STIBP | SPEC_CTRL_SSBD \ ++ | SPEC_CTRL_RRSBA_DIS_S) ++ + #define MSR_IA32_PRED_CMD 0x00000049 /* Prediction Command */ + #define PRED_CMD_IBPB BIT(0) /* Indirect Branch Prediction Barrier */ + +diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c +index 544e6c61e17d0..75dd336ac8cda 100644 +--- a/arch/x86/kernel/cpu/bugs.c ++++ b/arch/x86/kernel/cpu/bugs.c +@@ -144,9 +144,17 @@ void __init check_bugs(void) + * have unknown values. AMD64_LS_CFG MSR is cached in the early AMD + * init code as it is not enumerated and depends on the family. + */ +- if (boot_cpu_has(X86_FEATURE_MSR_SPEC_CTRL)) ++ if (cpu_feature_enabled(X86_FEATURE_MSR_SPEC_CTRL)) { + rdmsrl(MSR_IA32_SPEC_CTRL, x86_spec_ctrl_base); + ++ /* ++ * Previously running kernel (kexec), may have some controls ++ * turned ON. Clear them and let the mitigations setup below ++ * rediscover them based on configuration. ++ */ ++ x86_spec_ctrl_base &= ~SPEC_CTRL_MITIGATIONS_MASK; ++ } ++ + /* Select the proper CPU mitigations before patching alternatives: */ + spectre_v1_select_mitigation(); + spectre_v2_select_mitigation(); +-- +2.39.2 + diff --git a/queue-5.15/x86-mark-stop_this_cpu-__noreturn.patch b/queue-5.15/x86-mark-stop_this_cpu-__noreturn.patch new file mode 100644 index 00000000000..fef367937ce --- /dev/null +++ b/queue-5.15/x86-mark-stop_this_cpu-__noreturn.patch @@ -0,0 +1,68 @@ +From 10d2dc52f8603b5fedcfd0730c85dfc2520ba771 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Mar 2022 16:30:47 +0100 +Subject: x86: Mark stop_this_cpu() __noreturn + +From: Peter Zijlstra + +[ Upstream commit f9cdf7ca57cada055f61ef6d0eb4db21c3f200db ] + +vmlinux.o: warning: objtool: smp_stop_nmi_callback()+0x2b: unreachable instruction + +0000 0000000000047cf0 : +... +0026 47d16: e8 00 00 00 00 call 47d1b 47d17: R_X86_64_PLT32 stop_this_cpu-0x4 +002b 47d1b: b8 01 00 00 00 mov $0x1,%eax + +Signed-off-by: Peter Zijlstra (Intel) +Acked-by: Josh Poimboeuf +Link: https://lore.kernel.org/r/20220308154319.290905453@infradead.org +Stable-dep-of: c0dd9245aa9e ("x86/microcode: Check CPU capabilities after late microcode update correctly") +Signed-off-by: Sasha Levin +--- + arch/x86/include/asm/processor.h | 2 +- + arch/x86/kernel/process.c | 2 +- + tools/objtool/check.c | 1 + + 3 files changed, 3 insertions(+), 2 deletions(-) + +diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h +index 577f342dbfb27..5c7904c97a1a7 100644 +--- a/arch/x86/include/asm/processor.h ++++ b/arch/x86/include/asm/processor.h +@@ -834,7 +834,7 @@ bool xen_set_default_idle(void); + #define xen_set_default_idle 0 + #endif + +-void stop_this_cpu(void *dummy); ++void __noreturn stop_this_cpu(void *dummy); + void microcode_check(void); + + enum l1tf_mitigations { +diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c +index bc9b4b93cf9bc..e6b28c689e9a9 100644 +--- a/arch/x86/kernel/process.c ++++ b/arch/x86/kernel/process.c +@@ -731,7 +731,7 @@ bool xen_set_default_idle(void) + } + #endif + +-void stop_this_cpu(void *dummy) ++void __noreturn stop_this_cpu(void *dummy) + { + local_irq_disable(); + /* +diff --git a/tools/objtool/check.c b/tools/objtool/check.c +index 758c0ba8de350..3ef767284b3f0 100644 +--- a/tools/objtool/check.c ++++ b/tools/objtool/check.c +@@ -181,6 +181,7 @@ static bool __dead_end_function(struct objtool_file *file, struct symbol *func, + "kunit_try_catch_throw", + "xen_start_kernel", + "cpu_bringup_and_idle", ++ "stop_this_cpu", + }; + + if (!func) +-- +2.39.2 + diff --git a/queue-5.15/x86-microcode-add-a-parameter-to-microcode_check-to-.patch b/queue-5.15/x86-microcode-add-a-parameter-to-microcode_check-to-.patch new file mode 100644 index 00000000000..489188a5db6 --- /dev/null +++ b/queue-5.15/x86-microcode-add-a-parameter-to-microcode_check-to-.patch @@ -0,0 +1,110 @@ +From f11e82e04de3d6745f1579bbadfef0003d25d052 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Jan 2023 07:35:50 -0800 +Subject: x86/microcode: Add a parameter to microcode_check() to store CPU + capabilities + +From: Ashok Raj + +[ Upstream commit ab31c74455c64e69342ddab21fd9426fcbfefde7 ] + +Add a parameter to store CPU capabilities before performing a microcode +update so that CPU capabilities can be compared before and after update. + + [ bp: Massage. ] + +Signed-off-by: Ashok Raj +Signed-off-by: Borislav Petkov (AMD) +Link: https://lore.kernel.org/r/20230109153555.4986-2-ashok.raj@intel.com +Stable-dep-of: c0dd9245aa9e ("x86/microcode: Check CPU capabilities after late microcode update correctly") +Signed-off-by: Sasha Levin +--- + arch/x86/include/asm/processor.h | 2 +- + arch/x86/kernel/cpu/common.c | 21 +++++++++++++-------- + arch/x86/kernel/cpu/microcode/core.c | 3 ++- + 3 files changed, 16 insertions(+), 10 deletions(-) + +diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h +index 5c7904c97a1a7..eb6d6d1057929 100644 +--- a/arch/x86/include/asm/processor.h ++++ b/arch/x86/include/asm/processor.h +@@ -835,7 +835,7 @@ bool xen_set_default_idle(void); + #endif + + void __noreturn stop_this_cpu(void *dummy); +-void microcode_check(void); ++void microcode_check(struct cpuinfo_x86 *prev_info); + + enum l1tf_mitigations { + L1TF_MITIGATION_OFF, +diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c +index 6b71f40cd52d6..f2cd244d31311 100644 +--- a/arch/x86/kernel/cpu/common.c ++++ b/arch/x86/kernel/cpu/common.c +@@ -2150,30 +2150,35 @@ void cpu_init_secondary(void) + #endif + + #ifdef CONFIG_MICROCODE_LATE_LOADING +-/* ++/** ++ * microcode_check() - Check if any CPU capabilities changed after an update. ++ * @prev_info: CPU capabilities stored before an update. ++ * + * The microcode loader calls this upon late microcode load to recheck features, + * only when microcode has been updated. Caller holds microcode_mutex and CPU + * hotplug lock. ++ * ++ * Return: None + */ +-void microcode_check(void) ++void microcode_check(struct cpuinfo_x86 *prev_info) + { +- struct cpuinfo_x86 info; +- + perf_check_microcode(); + + /* Reload CPUID max function as it might've changed. */ +- info.cpuid_level = cpuid_eax(0); ++ prev_info->cpuid_level = cpuid_eax(0); + + /* + * Copy all capability leafs to pick up the synthetic ones so that + * memcmp() below doesn't fail on that. The ones coming from CPUID will + * get overwritten in get_cpu_cap(). + */ +- memcpy(&info.x86_capability, &boot_cpu_data.x86_capability, sizeof(info.x86_capability)); ++ memcpy(&prev_info->x86_capability, &boot_cpu_data.x86_capability, ++ sizeof(prev_info->x86_capability)); + +- get_cpu_cap(&info); ++ get_cpu_cap(prev_info); + +- if (!memcmp(&info.x86_capability, &boot_cpu_data.x86_capability, sizeof(info.x86_capability))) ++ if (!memcmp(&prev_info->x86_capability, &boot_cpu_data.x86_capability, ++ sizeof(prev_info->x86_capability))) + return; + + pr_warn("x86/CPU: CPU features have changed after loading microcode, but might not take effect.\n"); +diff --git a/arch/x86/kernel/cpu/microcode/core.c b/arch/x86/kernel/cpu/microcode/core.c +index a7fc2d47a4ace..9592dbf628b43 100644 +--- a/arch/x86/kernel/cpu/microcode/core.c ++++ b/arch/x86/kernel/cpu/microcode/core.c +@@ -509,13 +509,14 @@ static int __reload_late(void *info) + static int microcode_reload_late(void) + { + int old = boot_cpu_data.microcode, ret; ++ struct cpuinfo_x86 prev_info; + + atomic_set(&late_cpus_in, 0); + atomic_set(&late_cpus_out, 0); + + ret = stop_machine_cpuslocked(__reload_late, NULL, cpu_online_mask); + if (ret == 0) +- microcode_check(); ++ microcode_check(&prev_info); + + pr_info("Reload completed, microcode revision: 0x%x -> 0x%x\n", + old, boot_cpu_data.microcode); +-- +2.39.2 + diff --git a/queue-5.15/x86-microcode-adjust-late-loading-result-reporting-m.patch b/queue-5.15/x86-microcode-adjust-late-loading-result-reporting-m.patch new file mode 100644 index 00000000000..ef8d355b66c --- /dev/null +++ b/queue-5.15/x86-microcode-adjust-late-loading-result-reporting-m.patch @@ -0,0 +1,53 @@ +From 6be0eaf144b6fa5d53f240a9d2dd4b7609aa3041 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Jan 2023 07:35:52 -0800 +Subject: x86/microcode: Adjust late loading result reporting message + +From: Ashok Raj + +[ Upstream commit 6eab3abac7043226e5375e9ead0c7607ced6767b ] + +During late microcode loading, the "Reload completed" message is issued +unconditionally, regardless of success or failure. + +Adjust the message to report the result of the update. + + [ bp: Massage. ] + +Fixes: 9bd681251b7c ("x86/microcode: Announce reload operation's completion") +Suggested-by: Thomas Gleixner +Signed-off-by: Ashok Raj +Signed-off-by: Borislav Petkov (AMD) +Reviewed-by: Tony Luck +Link: https://lore.kernel.org/lkml/874judpqqd.ffs@tglx/ +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/cpu/microcode/core.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +diff --git a/arch/x86/kernel/cpu/microcode/core.c b/arch/x86/kernel/cpu/microcode/core.c +index 30d1bd36934dd..7efdfc16144e5 100644 +--- a/arch/x86/kernel/cpu/microcode/core.c ++++ b/arch/x86/kernel/cpu/microcode/core.c +@@ -521,11 +521,14 @@ static int microcode_reload_late(void) + store_cpu_caps(&prev_info); + + ret = stop_machine_cpuslocked(__reload_late, NULL, cpu_online_mask); +- if (ret == 0) ++ if (!ret) { ++ pr_info("Reload succeeded, microcode revision: 0x%x -> 0x%x\n", ++ old, boot_cpu_data.microcode); + microcode_check(&prev_info); +- +- pr_info("Reload completed, microcode revision: 0x%x -> 0x%x\n", +- old, boot_cpu_data.microcode); ++ } else { ++ pr_info("Reload failed, current microcode revision: 0x%x\n", ++ boot_cpu_data.microcode); ++ } + + return ret; + } +-- +2.39.2 + diff --git a/queue-5.15/x86-microcode-check-cpu-capabilities-after-late-micr.patch b/queue-5.15/x86-microcode-check-cpu-capabilities-after-late-micr.patch new file mode 100644 index 00000000000..8bc70e732ab --- /dev/null +++ b/queue-5.15/x86-microcode-check-cpu-capabilities-after-late-micr.patch @@ -0,0 +1,151 @@ +From da5caf6c815f31da791da39beeb8d481fb216832 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Jan 2023 07:35:51 -0800 +Subject: x86/microcode: Check CPU capabilities after late microcode update + correctly + +From: Ashok Raj + +[ Upstream commit c0dd9245aa9e25a697181f6085692272c9ec61bc ] + +The kernel caches each CPU's feature bits at boot in an x86_capability[] +structure. However, the capabilities in the BSP's copy can be turned off +as a result of certain command line parameters or configuration +restrictions, for example the SGX bit. This can cause a mismatch when +comparing the values before and after the microcode update. + +Another example is X86_FEATURE_SRBDS_CTRL which gets added only after +microcode update: + + --- cpuid.before 2023-01-21 14:54:15.652000747 +0100 + +++ cpuid.after 2023-01-21 14:54:26.632001024 +0100 + @@ -10,7 +10,7 @@ CPU: + 0x00000004 0x04: eax=0x00000000 ebx=0x00000000 ecx=0x00000000 edx=0x00000000 + 0x00000005 0x00: eax=0x00000040 ebx=0x00000040 ecx=0x00000003 edx=0x11142120 + 0x00000006 0x00: eax=0x000027f7 ebx=0x00000002 ecx=0x00000001 edx=0x00000000 + - 0x00000007 0x00: eax=0x00000000 ebx=0x029c6fbf ecx=0x40000000 edx=0xbc002400 + + 0x00000007 0x00: eax=0x00000000 ebx=0x029c6fbf ecx=0x40000000 edx=0xbc002e00 + ^^^ + +and which proves for a gazillionth time that late loading is a bad bad +idea. + +microcode_check() is called after an update to report any previously +cached CPUID bits which might have changed due to the update. + +Therefore, store the cached CPU caps before the update and compare them +with the CPU caps after the microcode update has succeeded. + +Thus, the comparison is done between the CPUID *hardware* bits before +and after the upgrade instead of using the cached, possibly runtime +modified values in BSP's boot_cpu_data copy. + +As a result, false warnings about CPUID bits changes are avoided. + + [ bp: + - Massage. + - Add SRBDS_CTRL example. + - Add kernel-doc. + - Incorporate forgotten review feedback from dhansen. + ] + +Fixes: 1008c52c09dc ("x86/CPU: Add a microcode loader callback") +Signed-off-by: Ashok Raj +Signed-off-by: Borislav Petkov (AMD) +Link: https://lore.kernel.org/r/20230109153555.4986-3-ashok.raj@intel.com +Signed-off-by: Sasha Levin +--- + arch/x86/include/asm/processor.h | 1 + + arch/x86/kernel/cpu/common.c | 36 ++++++++++++++++++---------- + arch/x86/kernel/cpu/microcode/core.c | 6 +++++ + 3 files changed, 30 insertions(+), 13 deletions(-) + +diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h +index eb6d6d1057929..3e3bd5b7d5dbe 100644 +--- a/arch/x86/include/asm/processor.h ++++ b/arch/x86/include/asm/processor.h +@@ -836,6 +836,7 @@ bool xen_set_default_idle(void); + + void __noreturn stop_this_cpu(void *dummy); + void microcode_check(struct cpuinfo_x86 *prev_info); ++void store_cpu_caps(struct cpuinfo_x86 *info); + + enum l1tf_mitigations { + L1TF_MITIGATION_OFF, +diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c +index f2cd244d31311..f7b4bbe71cdf9 100644 +--- a/arch/x86/kernel/cpu/common.c ++++ b/arch/x86/kernel/cpu/common.c +@@ -2150,6 +2150,25 @@ void cpu_init_secondary(void) + #endif + + #ifdef CONFIG_MICROCODE_LATE_LOADING ++/** ++ * store_cpu_caps() - Store a snapshot of CPU capabilities ++ * @curr_info: Pointer where to store it ++ * ++ * Returns: None ++ */ ++void store_cpu_caps(struct cpuinfo_x86 *curr_info) ++{ ++ /* Reload CPUID max function as it might've changed. */ ++ curr_info->cpuid_level = cpuid_eax(0); ++ ++ /* Copy all capability leafs and pick up the synthetic ones. */ ++ memcpy(&curr_info->x86_capability, &boot_cpu_data.x86_capability, ++ sizeof(curr_info->x86_capability)); ++ ++ /* Get the hardware CPUID leafs */ ++ get_cpu_cap(curr_info); ++} ++ + /** + * microcode_check() - Check if any CPU capabilities changed after an update. + * @prev_info: CPU capabilities stored before an update. +@@ -2162,22 +2181,13 @@ void cpu_init_secondary(void) + */ + void microcode_check(struct cpuinfo_x86 *prev_info) + { +- perf_check_microcode(); +- +- /* Reload CPUID max function as it might've changed. */ +- prev_info->cpuid_level = cpuid_eax(0); ++ struct cpuinfo_x86 curr_info; + +- /* +- * Copy all capability leafs to pick up the synthetic ones so that +- * memcmp() below doesn't fail on that. The ones coming from CPUID will +- * get overwritten in get_cpu_cap(). +- */ +- memcpy(&prev_info->x86_capability, &boot_cpu_data.x86_capability, +- sizeof(prev_info->x86_capability)); ++ perf_check_microcode(); + +- get_cpu_cap(prev_info); ++ store_cpu_caps(&curr_info); + +- if (!memcmp(&prev_info->x86_capability, &boot_cpu_data.x86_capability, ++ if (!memcmp(&prev_info->x86_capability, &curr_info.x86_capability, + sizeof(prev_info->x86_capability))) + return; + +diff --git a/arch/x86/kernel/cpu/microcode/core.c b/arch/x86/kernel/cpu/microcode/core.c +index 9592dbf628b43..30d1bd36934dd 100644 +--- a/arch/x86/kernel/cpu/microcode/core.c ++++ b/arch/x86/kernel/cpu/microcode/core.c +@@ -514,6 +514,12 @@ static int microcode_reload_late(void) + atomic_set(&late_cpus_in, 0); + atomic_set(&late_cpus_out, 0); + ++ /* ++ * Take a snapshot before the microcode update in order to compare and ++ * check whether any bits changed after an update. ++ */ ++ store_cpu_caps(&prev_info); ++ + ret = stop_machine_cpuslocked(__reload_late, NULL, cpu_online_mask); + if (ret == 0) + microcode_check(&prev_info); +-- +2.39.2 + diff --git a/queue-5.15/x86-microcode-default-disable-late-loading.patch b/queue-5.15/x86-microcode-default-disable-late-loading.patch new file mode 100644 index 00000000000..25475642600 --- /dev/null +++ b/queue-5.15/x86-microcode-default-disable-late-loading.patch @@ -0,0 +1,109 @@ +From 589bcef52498f37e2cc3adfe305afe7b66d0e81a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 May 2022 18:12:30 +0200 +Subject: x86/microcode: Default-disable late loading + +From: Borislav Petkov + +[ Upstream commit a77a94f86273ce42a39cb479217dd8d68acfe0ff ] + +It is dangerous and it should not be used anyway - there's a nice early +loading already. + +Requested-by: Peter Zijlstra (Intel) +Signed-off-by: Borislav Petkov +Signed-off-by: Thomas Gleixner +Link: https://lore.kernel.org/r/20220525161232.14924-3-bp@alien8.de +Stable-dep-of: c0dd9245aa9e ("x86/microcode: Check CPU capabilities after late microcode update correctly") +Signed-off-by: Sasha Levin +--- + arch/x86/Kconfig | 11 +++++++++++ + arch/x86/kernel/cpu/common.c | 2 ++ + arch/x86/kernel/cpu/microcode/core.c | 7 ++++++- + 3 files changed, 19 insertions(+), 1 deletion(-) + +diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig +index da87b3bfc9132..a08ce6360382a 100644 +--- a/arch/x86/Kconfig ++++ b/arch/x86/Kconfig +@@ -1320,6 +1320,17 @@ config MICROCODE_AMD + If you select this option, microcode patch loading support for AMD + processors will be enabled. + ++config MICROCODE_LATE_LOADING ++ bool "Late microcode loading (DANGEROUS)" ++ default n ++ depends on MICROCODE ++ help ++ Loading microcode late, when the system is up and executing instructions ++ is a tricky business and should be avoided if possible. Just the sequence ++ of synchronizing all cores and SMT threads is one fragile dance which does ++ not guarantee that cores might not softlock after the loading. Therefore, ++ use this at your own risk. Late loading taints the kernel too. ++ + config X86_MSR + tristate "/dev/cpu/*/msr - Model-specific register support" + help +diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c +index 1698470dbea5f..6b71f40cd52d6 100644 +--- a/arch/x86/kernel/cpu/common.c ++++ b/arch/x86/kernel/cpu/common.c +@@ -2149,6 +2149,7 @@ void cpu_init_secondary(void) + } + #endif + ++#ifdef CONFIG_MICROCODE_LATE_LOADING + /* + * The microcode loader calls this upon late microcode load to recheck features, + * only when microcode has been updated. Caller holds microcode_mutex and CPU +@@ -2178,6 +2179,7 @@ void microcode_check(void) + pr_warn("x86/CPU: CPU features have changed after loading microcode, but might not take effect.\n"); + pr_warn("x86/CPU: Please consider either early loading through initrd/built-in or a potential BIOS update.\n"); + } ++#endif + + /* + * Invoked from core CPU hotplug code after hotplug operations +diff --git a/arch/x86/kernel/cpu/microcode/core.c b/arch/x86/kernel/cpu/microcode/core.c +index 951677121c77d..dc346bbb06777 100644 +--- a/arch/x86/kernel/cpu/microcode/core.c ++++ b/arch/x86/kernel/cpu/microcode/core.c +@@ -393,6 +393,7 @@ static int apply_microcode_on_target(int cpu) + /* fake device for request_firmware */ + static struct platform_device *microcode_pdev; + ++#ifdef CONFIG_MICROCODE_LATE_LOADING + /* + * Late loading dance. Why the heavy-handed stomp_machine effort? + * +@@ -560,6 +561,9 @@ static ssize_t reload_store(struct device *dev, + return ret; + } + ++static DEVICE_ATTR_WO(reload); ++#endif ++ + static ssize_t version_show(struct device *dev, + struct device_attribute *attr, char *buf) + { +@@ -576,7 +580,6 @@ static ssize_t pf_show(struct device *dev, + return sprintf(buf, "0x%x\n", uci->cpu_sig.pf); + } + +-static DEVICE_ATTR_WO(reload); + static DEVICE_ATTR(version, 0444, version_show, NULL); + static DEVICE_ATTR(processor_flags, 0444, pf_show, NULL); + +@@ -729,7 +732,9 @@ static int mc_cpu_down_prep(unsigned int cpu) + } + + static struct attribute *cpu_root_microcode_attrs[] = { ++#ifdef CONFIG_MICROCODE_LATE_LOADING + &dev_attr_reload.attr, ++#endif + NULL + }; + +-- +2.39.2 + diff --git a/queue-5.15/x86-microcode-print-previous-version-of-microcode-af.patch b/queue-5.15/x86-microcode-print-previous-version-of-microcode-af.patch new file mode 100644 index 00000000000..3212ca70872 --- /dev/null +++ b/queue-5.15/x86-microcode-print-previous-version-of-microcode-af.patch @@ -0,0 +1,51 @@ +From b460baf3fca096323297ebf1a36ad2e91923260d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Aug 2022 18:10:30 +0000 +Subject: x86/microcode: Print previous version of microcode after reload + +From: Ashok Raj + +[ Upstream commit 7fce8d6eccbc31a561d07c79f359ad09f0424347 ] + +Print both old and new versions of microcode after a reload is complete +because knowing the previous microcode version is sometimes important +from a debugging perspective. + + [ bp: Massage commit message. ] + +Signed-off-by: Ashok Raj +Signed-off-by: Borislav Petkov +Acked-by: Tony Luck +Link: https://lore.kernel.org/r/20220829181030.722891-1-ashok.raj@intel.com +Stable-dep-of: c0dd9245aa9e ("x86/microcode: Check CPU capabilities after late microcode update correctly") +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/cpu/microcode/core.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/arch/x86/kernel/cpu/microcode/core.c b/arch/x86/kernel/cpu/microcode/core.c +index dc346bbb06777..a7fc2d47a4ace 100644 +--- a/arch/x86/kernel/cpu/microcode/core.c ++++ b/arch/x86/kernel/cpu/microcode/core.c +@@ -508,7 +508,7 @@ static int __reload_late(void *info) + */ + static int microcode_reload_late(void) + { +- int ret; ++ int old = boot_cpu_data.microcode, ret; + + atomic_set(&late_cpus_in, 0); + atomic_set(&late_cpus_out, 0); +@@ -517,7 +517,8 @@ static int microcode_reload_late(void) + if (ret == 0) + microcode_check(); + +- pr_info("Reload completed, microcode revision: 0x%x\n", boot_cpu_data.microcode); ++ pr_info("Reload completed, microcode revision: 0x%x -> 0x%x\n", ++ old, boot_cpu_data.microcode); + + return ret; + } +-- +2.39.2 + diff --git a/queue-5.15/x86-microcode-rip-out-the-old_interface.patch b/queue-5.15/x86-microcode-rip-out-the-old_interface.patch new file mode 100644 index 00000000000..85037a08048 --- /dev/null +++ b/queue-5.15/x86-microcode-rip-out-the-old_interface.patch @@ -0,0 +1,172 @@ +From 6b0b00d1ec902aae5875526ad9a053d80234a1e5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 May 2022 18:12:29 +0200 +Subject: x86/microcode: Rip out the OLD_INTERFACE + +From: Borislav Petkov + +[ Upstream commit 181b6f40e9ea80c76756d4d0cdeed396016c487e ] + +Everything should be using the early initrd loading by now. + +Signed-off-by: Borislav Petkov +Signed-off-by: Thomas Gleixner +Link: https://lore.kernel.org/r/20220525161232.14924-2-bp@alien8.de +Stable-dep-of: c0dd9245aa9e ("x86/microcode: Check CPU capabilities after late microcode update correctly") +Signed-off-by: Sasha Levin +--- + arch/x86/Kconfig | 12 ---- + arch/x86/kernel/cpu/microcode/core.c | 100 --------------------------- + 2 files changed, 112 deletions(-) + +diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig +index 0f2234cd8453c..da87b3bfc9132 100644 +--- a/arch/x86/Kconfig ++++ b/arch/x86/Kconfig +@@ -1320,18 +1320,6 @@ config MICROCODE_AMD + If you select this option, microcode patch loading support for AMD + processors will be enabled. + +-config MICROCODE_OLD_INTERFACE +- bool "Ancient loading interface (DEPRECATED)" +- default n +- depends on MICROCODE +- help +- DO NOT USE THIS! This is the ancient /dev/cpu/microcode interface +- which was used by userspace tools like iucode_tool and microcode.ctl. +- It is inadequate because it runs too late to be able to properly +- load microcode on a machine and it needs special tools. Instead, you +- should've switched to the early loading method with the initrd or +- builtin microcode by now: Documentation/x86/microcode.rst +- + config X86_MSR + tristate "/dev/cpu/*/msr - Model-specific register support" + help +diff --git a/arch/x86/kernel/cpu/microcode/core.c b/arch/x86/kernel/cpu/microcode/core.c +index 150ebfb8c12ed..951677121c77d 100644 +--- a/arch/x86/kernel/cpu/microcode/core.c ++++ b/arch/x86/kernel/cpu/microcode/core.c +@@ -390,98 +390,6 @@ static int apply_microcode_on_target(int cpu) + return ret; + } + +-#ifdef CONFIG_MICROCODE_OLD_INTERFACE +-static int do_microcode_update(const void __user *buf, size_t size) +-{ +- int error = 0; +- int cpu; +- +- for_each_online_cpu(cpu) { +- struct ucode_cpu_info *uci = ucode_cpu_info + cpu; +- enum ucode_state ustate; +- +- if (!uci->valid) +- continue; +- +- ustate = microcode_ops->request_microcode_user(cpu, buf, size); +- if (ustate == UCODE_ERROR) { +- error = -1; +- break; +- } else if (ustate == UCODE_NEW) { +- apply_microcode_on_target(cpu); +- } +- } +- +- return error; +-} +- +-static int microcode_open(struct inode *inode, struct file *file) +-{ +- return capable(CAP_SYS_RAWIO) ? stream_open(inode, file) : -EPERM; +-} +- +-static ssize_t microcode_write(struct file *file, const char __user *buf, +- size_t len, loff_t *ppos) +-{ +- ssize_t ret = -EINVAL; +- unsigned long nr_pages = totalram_pages(); +- +- if ((len >> PAGE_SHIFT) > nr_pages) { +- pr_err("too much data (max %ld pages)\n", nr_pages); +- return ret; +- } +- +- cpus_read_lock(); +- mutex_lock(µcode_mutex); +- +- if (do_microcode_update(buf, len) == 0) +- ret = (ssize_t)len; +- +- if (ret > 0) +- perf_check_microcode(); +- +- mutex_unlock(µcode_mutex); +- cpus_read_unlock(); +- +- return ret; +-} +- +-static const struct file_operations microcode_fops = { +- .owner = THIS_MODULE, +- .write = microcode_write, +- .open = microcode_open, +- .llseek = no_llseek, +-}; +- +-static struct miscdevice microcode_dev = { +- .minor = MICROCODE_MINOR, +- .name = "microcode", +- .nodename = "cpu/microcode", +- .fops = µcode_fops, +-}; +- +-static int __init microcode_dev_init(void) +-{ +- int error; +- +- error = misc_register(µcode_dev); +- if (error) { +- pr_err("can't misc_register on minor=%d\n", MICROCODE_MINOR); +- return error; +- } +- +- return 0; +-} +- +-static void __exit microcode_dev_exit(void) +-{ +- misc_deregister(µcode_dev); +-} +-#else +-#define microcode_dev_init() 0 +-#define microcode_dev_exit() do { } while (0) +-#endif +- + /* fake device for request_firmware */ + static struct platform_device *microcode_pdev; + +@@ -873,10 +781,6 @@ static int __init microcode_init(void) + goto out_driver; + } + +- error = microcode_dev_init(); +- if (error) +- goto out_ucode_group; +- + register_syscore_ops(&mc_syscore_ops); + cpuhp_setup_state_nocalls(CPUHP_AP_MICROCODE_LOADER, "x86/microcode:starting", + mc_cpu_starting, NULL); +@@ -887,10 +791,6 @@ static int __init microcode_init(void) + + return 0; + +- out_ucode_group: +- sysfs_remove_group(&cpu_subsys.dev_root->kobj, +- &cpu_root_microcode_group); +- + out_driver: + cpus_read_lock(); + mutex_lock(µcode_mutex); +-- +2.39.2 + diff --git a/queue-5.15/x86-perf-zhaoxin-add-stepping-check-for-zxc.patch b/queue-5.15/x86-perf-zhaoxin-add-stepping-check-for-zxc.patch new file mode 100644 index 00000000000..94130c9cc1d --- /dev/null +++ b/queue-5.15/x86-perf-zhaoxin-add-stepping-check-for-zxc.patch @@ -0,0 +1,54 @@ +From f2900e1664da6dfc0ace40e8196a9e206e669174 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Feb 2023 16:27:22 +0800 +Subject: x86/perf/zhaoxin: Add stepping check for ZXC + +From: silviazhao + +[ Upstream commit fd636b6a9bc6034f2e5bb869658898a2b472c037 ] + +Some of Nano series processors will lead GP when accessing +PMC fixed counter. Meanwhile, their hardware support for PMC +has not announced externally. So exclude Nano CPUs from ZXC +by checking stepping information. This is an unambiguous way +to differentiate between ZXC and Nano CPUs. + +Following are Nano and ZXC FMS information: +Nano FMS: Family=6, Model=F, Stepping=[0-A][C-D] +ZXC FMS: Family=6, Model=F, Stepping=E-F OR + Family=6, Model=0x19, Stepping=0-3 + +Fixes: 3a4ac121c2ca ("x86/perf: Add hardware performance events support for Zhaoxin CPU.") + +Reported-by: Arjan <8vvbbqzo567a@nospam.xutrox.com> +Reported-by: Kevin Brace +Signed-off-by: silviazhao +Signed-off-by: Peter Zijlstra (Intel) +Link: https://bugzilla.kernel.org/show_bug.cgi?id=212389 +Signed-off-by: Sasha Levin +--- + arch/x86/events/zhaoxin/core.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/arch/x86/events/zhaoxin/core.c b/arch/x86/events/zhaoxin/core.c +index 949d845c922b4..3e9acdaeed1ec 100644 +--- a/arch/x86/events/zhaoxin/core.c ++++ b/arch/x86/events/zhaoxin/core.c +@@ -541,7 +541,13 @@ __init int zhaoxin_pmu_init(void) + + switch (boot_cpu_data.x86) { + case 0x06: +- if (boot_cpu_data.x86_model == 0x0f || boot_cpu_data.x86_model == 0x19) { ++ /* ++ * Support Zhaoxin CPU from ZXC series, exclude Nano series through FMS. ++ * Nano FMS: Family=6, Model=F, Stepping=[0-A][C-D] ++ * ZXC FMS: Family=6, Model=F, Stepping=E-F OR Family=6, Model=0x19, Stepping=0-3 ++ */ ++ if ((boot_cpu_data.x86_model == 0x0f && boot_cpu_data.x86_stepping >= 0x0e) || ++ boot_cpu_data.x86_model == 0x19) { + + x86_pmu.max_period = x86_pmu.cntval_mask >> 1; + +-- +2.39.2 +