From: Sasha Levin Date: Mon, 6 Jun 2022 10:34:06 +0000 (-0400) Subject: Fixes for 5.18 X-Git-Tag: v5.10.121~141 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=c79a1fdabb1b9e1420e91c096e4841b92912abd7;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.18 Signed-off-by: Sasha Levin --- diff --git a/queue-5.18/acpi-agdi-fix-missing-prototype-warning-for-acpi_agd.patch b/queue-5.18/acpi-agdi-fix-missing-prototype-warning-for-acpi_agd.patch new file mode 100644 index 00000000000..9e496061127 --- /dev/null +++ b/queue-5.18/acpi-agdi-fix-missing-prototype-warning-for-acpi_agd.patch @@ -0,0 +1,44 @@ +From 446220ad27ee13f3f157408523e0b20a4fb8eee8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Apr 2022 15:18:02 -0700 +Subject: ACPI: AGDI: Fix missing prototype warning for acpi_agdi_init() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilkka Koskinen + +[ Upstream commit 988d7a14408db4183202f16bb02b8149b9da3727 ] + +When building with W=1, we get the following warning: + +drivers/acpi/arm64/agdi.c:88:13: warning: no previous prototype for ‘acpi_agdi_init’ [-Wmissing-prototypes] + void __init acpi_agdi_init(void) + +Include AGDI driver's header file to pull in the prototype definition +for acpi_agdi_init() to get rid of the compiler warning + +Fixes: a2a591fb76e6 ("ACPI: AGDI: Add driver for Arm Generic Diagnostic Dump and Reset device") +Reported-by: kernel test robot +Signed-off-by: Ilkka Koskinen +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/arm64/agdi.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/acpi/arm64/agdi.c b/drivers/acpi/arm64/agdi.c +index 4df337d545b7..cf31abd0ed1b 100644 +--- a/drivers/acpi/arm64/agdi.c ++++ b/drivers/acpi/arm64/agdi.c +@@ -9,6 +9,7 @@ + #define pr_fmt(fmt) "ACPI: AGDI: " fmt + + #include ++#include + #include + #include + #include +-- +2.35.1 + diff --git a/queue-5.18/acpi-cppc-assume-no-transition-latency-if-no-pcct.patch b/queue-5.18/acpi-cppc-assume-no-transition-latency-if-no-pcct.patch new file mode 100644 index 00000000000..6fc44069ceb --- /dev/null +++ b/queue-5.18/acpi-cppc-assume-no-transition-latency-if-no-pcct.patch @@ -0,0 +1,96 @@ +From 2a65852593775fecb9d1cf48e6bc8e4c7a891c9d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 May 2022 11:08:59 +0200 +Subject: ACPI: CPPC: Assume no transition latency if no PCCT + +From: Pierre Gondois + +[ Upstream commit 6380b7b2b29da9d9c5ab2d4a265901cd93ba3696 ] + +The transition_delay_us (struct cpufreq_policy) is currently defined +as: + Preferred average time interval between consecutive invocations of + the driver to set the frequency for this policy. To be set by the + scaling driver (0, which is the default, means no preference). +The transition_latency represents the amount of time necessary for a +CPU to change its frequency. + +A PCCT table advertises mutliple values: +- pcc_nominal: Expected latency to process a command, in microseconds +- pcc_mpar: The maximum number of periodic requests that the subspace + channel can support, reported in commands per minute. 0 indicates no + limitation. +- pcc_mrtt: The minimum amount of time that OSPM must wait after the + completion of a command before issuing the next command, + in microseconds. +cppc_get_transition_latency() allows to get the max of them. + +commit d4f3388afd48 ("cpufreq / CPPC: Set platform specific +transition_delay_us") allows to select transition_delay_us based on +the platform, and fallbacks to cppc_get_transition_latency() +otherwise. + +If _CPC objects are not using PCC channels (no PPCT table), the +transition_delay_us is set to CPUFREQ_ETERNAL, leading to really long +periods between frequency updates (~4s). + +If the desired_reg, where performance requests are written, is in +SystemMemory or SystemIo ACPI address space, there is no delay +in requests. So return 0 instead of CPUFREQ_ETERNAL, leading to +transition_delay_us being set to LATENCY_MULTIPLIER us (1000 us). + +This patch also adds two macros to check the address spaces. + +Signed-off-by: Pierre Gondois +Reviewed-by: Sudeep Holla +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/cppc_acpi.c | 17 ++++++++++++++++- + 1 file changed, 16 insertions(+), 1 deletion(-) + +diff --git a/drivers/acpi/cppc_acpi.c b/drivers/acpi/cppc_acpi.c +index bc1454789a06..34576ab0e2e1 100644 +--- a/drivers/acpi/cppc_acpi.c ++++ b/drivers/acpi/cppc_acpi.c +@@ -100,6 +100,16 @@ static DEFINE_PER_CPU(struct cpc_desc *, cpc_desc_ptr); + (cpc)->cpc_entry.reg.space_id == \ + ACPI_ADR_SPACE_PLATFORM_COMM) + ++/* Check if a CPC register is in SystemMemory */ ++#define CPC_IN_SYSTEM_MEMORY(cpc) ((cpc)->type == ACPI_TYPE_BUFFER && \ ++ (cpc)->cpc_entry.reg.space_id == \ ++ ACPI_ADR_SPACE_SYSTEM_MEMORY) ++ ++/* Check if a CPC register is in SystemIo */ ++#define CPC_IN_SYSTEM_IO(cpc) ((cpc)->type == ACPI_TYPE_BUFFER && \ ++ (cpc)->cpc_entry.reg.space_id == \ ++ ACPI_ADR_SPACE_SYSTEM_IO) ++ + /* Evaluates to True if reg is a NULL register descriptor */ + #define IS_NULL_REG(reg) ((reg)->space_id == ACPI_ADR_SPACE_SYSTEM_MEMORY && \ + (reg)->address == 0 && \ +@@ -1447,6 +1457,9 @@ EXPORT_SYMBOL_GPL(cppc_set_perf); + * transition latency for performance change requests. The closest we have + * is the timing information from the PCCT tables which provides the info + * on the number and frequency of PCC commands the platform can handle. ++ * ++ * If desired_reg is in the SystemMemory or SystemIo ACPI address space, ++ * then assume there is no latency. + */ + unsigned int cppc_get_transition_latency(int cpu_num) + { +@@ -1472,7 +1485,9 @@ unsigned int cppc_get_transition_latency(int cpu_num) + return CPUFREQ_ETERNAL; + + desired_reg = &cpc_desc->cpc_regs[DESIRED_PERF]; +- if (!CPC_IN_PCC(desired_reg)) ++ if (CPC_IN_SYSTEM_MEMORY(desired_reg) || CPC_IN_SYSTEM_IO(desired_reg)) ++ return 0; ++ else if (!CPC_IN_PCC(desired_reg)) + return CPUFREQ_ETERNAL; + + if (pcc_ss_id < 0) +-- +2.35.1 + diff --git a/queue-5.18/acpi-pm-block-asus-b1400ceae-from-suspend-to-idle-by.patch b/queue-5.18/acpi-pm-block-asus-b1400ceae-from-suspend-to-idle-by.patch new file mode 100644 index 00000000000..23db0837f16 --- /dev/null +++ b/queue-5.18/acpi-pm-block-asus-b1400ceae-from-suspend-to-idle-by.patch @@ -0,0 +1,57 @@ +From 819652b44094e64022c45e6d58b98545ebaddfc4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 May 2022 08:11:36 -0500 +Subject: ACPI: PM: Block ASUS B1400CEAE from suspend to idle by default + +From: Mario Limonciello + +[ Upstream commit d52848620de00cde4a3a5df908e231b8c8868250 ] + +ASUS B1400CEAE fails to resume from suspend to idle by default. This was +bisected back to commit df4f9bc4fb9c ("nvme-pci: add support for ACPI +StorageD3Enable property") but this is a red herring to the problem. + +Before this commit the system wasn't getting into deepest sleep state. +Presumably this commit is allowing entry into deepest sleep state as +advertised by firmware, but there are some other problems related to +the wakeup. + +As it is confirmed the system works properly with S3, set the default for +this system to S3. + +Reported-by: Jian-Hong Pan +Link: https://bugzilla.kernel.org/show_bug.cgi?id=215742 +Signed-off-by: Mario Limonciello +Tested-by: Jian-Hong Pan +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/sleep.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c +index c992e57b2c79..3147702710af 100644 +--- a/drivers/acpi/sleep.c ++++ b/drivers/acpi/sleep.c +@@ -373,6 +373,18 @@ static const struct dmi_system_id acpisleep_dmi_table[] __initconst = { + DMI_MATCH(DMI_PRODUCT_NAME, "20GGA00L00"), + }, + }, ++ /* ++ * ASUS B1400CEAE hangs on resume from suspend (see ++ * https://bugzilla.kernel.org/show_bug.cgi?id=215742). ++ */ ++ { ++ .callback = init_default_s3, ++ .ident = "ASUS B1400CEAE", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "ASUS EXPERTBOOK B1400CEAE"), ++ }, ++ }, + {}, + }; + +-- +2.35.1 + diff --git a/queue-5.18/acpica-avoid-cache-flush-inside-virtual-machines.patch b/queue-5.18/acpica-avoid-cache-flush-inside-virtual-machines.patch new file mode 100644 index 00000000000..3790c0f5e7b --- /dev/null +++ b/queue-5.18/acpica-avoid-cache-flush-inside-virtual-machines.patch @@ -0,0 +1,71 @@ +From e160e3152c7dfa1517c918186e3707a1e06ad241 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Apr 2022 02:29:38 +0300 +Subject: ACPICA: Avoid cache flush inside virtual machines + +From: Kirill A. Shutemov + +[ Upstream commit e2efb6359e620521d1e13f69b2257de8ceaa9475 ] + +While running inside virtual machine, the kernel can bypass cache +flushing. Changing sleep state in a virtual machine doesn't affect the +host system sleep state and cannot lead to data loss. + +Before entering sleep states, the ACPI code flushes caches to prevent +data loss using the WBINVD instruction. This mechanism is required on +bare metal. + +But, any use WBINVD inside of a guest is worthless. Changing sleep +state in a virtual machine doesn't affect the host system sleep state +and cannot lead to data loss, so most hypervisors simply ignore it. +Despite this, the ACPI code calls WBINVD unconditionally anyway. +It's useless, but also normally harmless. + +In TDX guests, though, WBINVD stops being harmless; it triggers a +virtualization exception (#VE). If the ACPI cache-flushing WBINVD +were left in place, TDX guests would need handling to recover from +the exception. + +Avoid using WBINVD whenever running under a hypervisor. This both +removes the useless WBINVDs and saves TDX from implementing WBINVD +handling. + +Signed-off-by: Kirill A. Shutemov +Signed-off-by: Dave Hansen +Reviewed-by: Dave Hansen +Reviewed-by: Dan Williams +Reviewed-by: Thomas Gleixner +Link: https://lkml.kernel.org/r/20220405232939.73860-30-kirill.shutemov@linux.intel.com +Signed-off-by: Sasha Levin +--- + arch/x86/include/asm/acenv.h | 14 +++++++++++++- + 1 file changed, 13 insertions(+), 1 deletion(-) + +diff --git a/arch/x86/include/asm/acenv.h b/arch/x86/include/asm/acenv.h +index 9aff97f0de7f..d937c55e717e 100644 +--- a/arch/x86/include/asm/acenv.h ++++ b/arch/x86/include/asm/acenv.h +@@ -13,7 +13,19 @@ + + /* Asm macros */ + +-#define ACPI_FLUSH_CPU_CACHE() wbinvd() ++/* ++ * ACPI_FLUSH_CPU_CACHE() flushes caches on entering sleep states. ++ * It is required to prevent data loss. ++ * ++ * While running inside virtual machine, the kernel can bypass cache flushing. ++ * Changing sleep state in a virtual machine doesn't affect the host system ++ * sleep state and cannot lead to data loss. ++ */ ++#define ACPI_FLUSH_CPU_CACHE() \ ++do { \ ++ if (!cpu_feature_enabled(X86_FEATURE_HYPERVISOR)) \ ++ wbinvd(); \ ++} while (0) + + int __acpi_acquire_global_lock(unsigned int *lock); + int __acpi_release_global_lock(unsigned int *lock); +-- +2.35.1 + diff --git a/queue-5.18/afs-adjust-ack-interpretation-to-try-and-cope-with-n.patch b/queue-5.18/afs-adjust-ack-interpretation-to-try-and-cope-with-n.patch new file mode 100644 index 00000000000..2ee06683386 --- /dev/null +++ b/queue-5.18/afs-adjust-ack-interpretation-to-try-and-cope-with-n.patch @@ -0,0 +1,155 @@ +From bbb45af12eea691d9354f490d5ef014aef7f3497 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 21 May 2022 08:45:55 +0100 +Subject: afs: Adjust ACK interpretation to try and cope with NAT + +From: David Howells + +[ Upstream commit adc9613ff66c26ebaff9814973181ac178beb90b ] + +If a client's address changes, say if it is NAT'd, this can disrupt an in +progress operation. For most operations, this is not much of a problem, +but StoreData can be different as some servers modify the target file as +the data comes in, so if a store request is disrupted, the file can get +corrupted on the server. + +The problem is that the server doesn't recognise packets that come after +the change of address as belonging to the original client and will bounce +them, either by sending an OUT_OF_SEQUENCE ACK to the apparent new call if +the packet number falls within the initial sequence number window of a call +or by sending an EXCEEDS_WINDOW ACK if it falls outside and then aborting +it. In both cases, firstPacket will be 1 and previousPacket will be 0 in +the ACK information. + +Fix this by the following means: + + (1) If a client call receives an EXCEEDS_WINDOW ACK with firstPacket as 1 + and previousPacket as 0, assume this indicates that the server saw the + incoming packets from a different peer and thus as a different call. + Fail the call with error -ENETRESET. + + (2) Also fail the call if a similar OUT_OF_SEQUENCE ACK occurs if the + first packet has been hard-ACK'd. If it hasn't been hard-ACK'd, the + ACK packet will cause it to get retransmitted, so the call will just + be repeated. + + (3) Make afs_select_fileserver() treat -ENETRESET as a straight fail of + the operation. + + (4) Prioritise the error code over things like -ECONNRESET as the server + did actually respond. + + (5) Make writeback treat -ENETRESET as a retryable error and make it + redirty all the pages involved in a write so that the VM will retry. + +Note that there is still a circumstance that I can't easily deal with: if +the operation is fully received and processed by the server, but the reply +is lost due to address change. There's no way to know if the op happened. +We can examine the server, but a conflicting change could have been made by +a third party - and we can't tell the difference. In such a case, a +message like: + + kAFS: vnode modified {100058:146266} b7->b8 YFS.StoreData64 (op=2646a) + +will be logged to dmesg on the next op to touch the file and the client +will reset the inode state, including invalidating clean parts of the +pagecache. + +Reported-by: Marc Dionne +Signed-off-by: David Howells +cc: linux-afs@lists.infradead.org +Link: http://lists.infradead.org/pipermail/linux-afs/2021-December/004811.html # v1 +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + fs/afs/misc.c | 5 ++++- + fs/afs/rotate.c | 4 ++++ + fs/afs/write.c | 1 + + net/rxrpc/input.c | 27 +++++++++++++++++++++++++++ + 4 files changed, 36 insertions(+), 1 deletion(-) + +diff --git a/fs/afs/misc.c b/fs/afs/misc.c +index 1d1a8debe472..933e67fcdab1 100644 +--- a/fs/afs/misc.c ++++ b/fs/afs/misc.c +@@ -163,8 +163,11 @@ void afs_prioritise_error(struct afs_error *e, int error, u32 abort_code) + return; + + case -ECONNABORTED: ++ error = afs_abort_to_error(abort_code); ++ fallthrough; ++ case -ENETRESET: /* Responded, but we seem to have changed address */ + e->responded = true; +- e->error = afs_abort_to_error(abort_code); ++ e->error = error; + return; + } + } +diff --git a/fs/afs/rotate.c b/fs/afs/rotate.c +index 79e1a5f6701b..a840c3588ebb 100644 +--- a/fs/afs/rotate.c ++++ b/fs/afs/rotate.c +@@ -292,6 +292,10 @@ bool afs_select_fileserver(struct afs_operation *op) + op->error = error; + goto iterate_address; + ++ case -ENETRESET: ++ pr_warn("kAFS: Peer reset %s (op=%x)\n", ++ op->type ? op->type->name : "???", op->debug_id); ++ fallthrough; + case -ECONNRESET: + _debug("call reset"); + op->error = error; +diff --git a/fs/afs/write.c b/fs/afs/write.c +index 4763132ca57e..c1bc52ac7de1 100644 +--- a/fs/afs/write.c ++++ b/fs/afs/write.c +@@ -636,6 +636,7 @@ static ssize_t afs_write_back_from_locked_folio(struct address_space *mapping, + case -EKEYEXPIRED: + case -EKEYREJECTED: + case -EKEYREVOKED: ++ case -ENETRESET: + afs_redirty_pages(wbc, mapping, start, len); + mapping_set_error(mapping, ret); + break; +diff --git a/net/rxrpc/input.c b/net/rxrpc/input.c +index dc201363f2c4..67d3eba60dc7 100644 +--- a/net/rxrpc/input.c ++++ b/net/rxrpc/input.c +@@ -903,6 +903,33 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb) + rxrpc_propose_ack_respond_to_ack); + } + ++ /* If we get an EXCEEDS_WINDOW ACK from the server, it probably ++ * indicates that the client address changed due to NAT. The server ++ * lost the call because it switched to a different peer. ++ */ ++ if (unlikely(buf.ack.reason == RXRPC_ACK_EXCEEDS_WINDOW) && ++ first_soft_ack == 1 && ++ prev_pkt == 0 && ++ rxrpc_is_client_call(call)) { ++ rxrpc_set_call_completion(call, RXRPC_CALL_REMOTELY_ABORTED, ++ 0, -ENETRESET); ++ return; ++ } ++ ++ /* If we get an OUT_OF_SEQUENCE ACK from the server, that can also ++ * indicate a change of address. However, we can retransmit the call ++ * if we still have it buffered to the beginning. ++ */ ++ if (unlikely(buf.ack.reason == RXRPC_ACK_OUT_OF_SEQUENCE) && ++ first_soft_ack == 1 && ++ prev_pkt == 0 && ++ call->tx_hard_ack == 0 && ++ rxrpc_is_client_call(call)) { ++ rxrpc_set_call_completion(call, RXRPC_CALL_REMOTELY_ABORTED, ++ 0, -ENETRESET); ++ return; ++ } ++ + /* Discard any out-of-order or duplicate ACKs (outside lock). */ + if (!rxrpc_is_ack_valid(call, first_soft_ack, prev_pkt)) { + trace_rxrpc_rx_discard_ack(call->debug_id, ack_serial, +-- +2.35.1 + diff --git a/queue-5.18/alpha-fix-alloc_zeroed_user_highpage_movable.patch b/queue-5.18/alpha-fix-alloc_zeroed_user_highpage_movable.patch new file mode 100644 index 00000000000..e6d963c05bb --- /dev/null +++ b/queue-5.18/alpha-fix-alloc_zeroed_user_highpage_movable.patch @@ -0,0 +1,39 @@ +From 59674a971d0191f2f84fa515f6e5fd97ad654cf7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 May 2022 20:23:01 -0700 +Subject: alpha: fix alloc_zeroed_user_highpage_movable() + +From: Matthew Wilcox (Oracle) + +[ Upstream commit f9c668d281aa20e38c9bda3b7b0adeb8891aa15e ] + +Due to a typo, the final argument to alloc_page_vma() didn't refer to a +real variable. This only affected CONFIG_NUMA, which was marked BROKEN in +2006 and removed from alpha in 2021. Found due to a refactoring patch. + +Link: https://lkml.kernel.org/r/20220504182857.4013401-4-willy@infradead.org +Signed-off-by: Matthew Wilcox (Oracle) +Reported-by: kernel test robot +Reviewed-by: Christoph Hellwig +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + arch/alpha/include/asm/page.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/alpha/include/asm/page.h b/arch/alpha/include/asm/page.h +index 18f48a6f2ff6..8f3f5eecba28 100644 +--- a/arch/alpha/include/asm/page.h ++++ b/arch/alpha/include/asm/page.h +@@ -18,7 +18,7 @@ extern void clear_page(void *page); + #define clear_user_page(page, vaddr, pg) clear_page(page) + + #define alloc_zeroed_user_highpage_movable(vma, vaddr) \ +- alloc_page_vma(GFP_HIGHUSER_MOVABLE | __GFP_ZERO, vma, vmaddr) ++ alloc_page_vma(GFP_HIGHUSER_MOVABLE | __GFP_ZERO, vma, vaddr) + #define __HAVE_ARCH_ALLOC_ZEROED_USER_HIGHPAGE_MOVABLE + + extern void copy_page(void * _to, void * _from); +-- +2.35.1 + diff --git a/queue-5.18/alsa-jack-access-input_dev-under-mutex.patch b/queue-5.18/alsa-jack-access-input_dev-under-mutex.patch new file mode 100644 index 00000000000..5d5913f9265 --- /dev/null +++ b/queue-5.18/alsa-jack-access-input_dev-under-mutex.patch @@ -0,0 +1,157 @@ +From 4c8ce11e2c0961ef36662ce9bbd4f84a4eb89300 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Apr 2022 11:16:28 +0200 +Subject: ALSA: jack: Access input_dev under mutex +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Amadeusz Sławiński + +[ Upstream commit 1b6a6fc5280e97559287b61eade2d4b363e836f2 ] + +It is possible when using ASoC that input_dev is unregistered while +calling snd_jack_report, which causes NULL pointer dereference. +In order to prevent this serialize access to input_dev using mutex lock. + +Signed-off-by: Amadeusz Sławiński +Reviewed-by: Cezary Rojewski +Link: https://lore.kernel.org/r/20220412091628.3056922-1-amadeuszx.slawinski@linux.intel.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + include/sound/jack.h | 1 + + sound/core/jack.c | 34 +++++++++++++++++++++++++++------- + 2 files changed, 28 insertions(+), 7 deletions(-) + +diff --git a/include/sound/jack.h b/include/sound/jack.h +index 1181f536557e..1ed90e2109e9 100644 +--- a/include/sound/jack.h ++++ b/include/sound/jack.h +@@ -62,6 +62,7 @@ struct snd_jack { + const char *id; + #ifdef CONFIG_SND_JACK_INPUT_DEV + struct input_dev *input_dev; ++ struct mutex input_dev_lock; + int registered; + int type; + char name[100]; +diff --git a/sound/core/jack.c b/sound/core/jack.c +index d1e3055f2b6a..88493cc31914 100644 +--- a/sound/core/jack.c ++++ b/sound/core/jack.c +@@ -42,8 +42,11 @@ static int snd_jack_dev_disconnect(struct snd_device *device) + #ifdef CONFIG_SND_JACK_INPUT_DEV + struct snd_jack *jack = device->device_data; + +- if (!jack->input_dev) ++ mutex_lock(&jack->input_dev_lock); ++ if (!jack->input_dev) { ++ mutex_unlock(&jack->input_dev_lock); + return 0; ++ } + + /* If the input device is registered with the input subsystem + * then we need to use a different deallocator. */ +@@ -52,6 +55,7 @@ static int snd_jack_dev_disconnect(struct snd_device *device) + else + input_free_device(jack->input_dev); + jack->input_dev = NULL; ++ mutex_unlock(&jack->input_dev_lock); + #endif /* CONFIG_SND_JACK_INPUT_DEV */ + return 0; + } +@@ -90,8 +94,11 @@ static int snd_jack_dev_register(struct snd_device *device) + snprintf(jack->name, sizeof(jack->name), "%s %s", + card->shortname, jack->id); + +- if (!jack->input_dev) ++ mutex_lock(&jack->input_dev_lock); ++ if (!jack->input_dev) { ++ mutex_unlock(&jack->input_dev_lock); + return 0; ++ } + + jack->input_dev->name = jack->name; + +@@ -116,6 +123,7 @@ static int snd_jack_dev_register(struct snd_device *device) + if (err == 0) + jack->registered = 1; + ++ mutex_unlock(&jack->input_dev_lock); + return err; + } + #endif /* CONFIG_SND_JACK_INPUT_DEV */ +@@ -517,9 +525,11 @@ int snd_jack_new(struct snd_card *card, const char *id, int type, + return -ENOMEM; + } + +- /* don't creat input device for phantom jack */ +- if (!phantom_jack) { + #ifdef CONFIG_SND_JACK_INPUT_DEV ++ mutex_init(&jack->input_dev_lock); ++ ++ /* don't create input device for phantom jack */ ++ if (!phantom_jack) { + int i; + + jack->input_dev = input_allocate_device(); +@@ -537,8 +547,8 @@ int snd_jack_new(struct snd_card *card, const char *id, int type, + input_set_capability(jack->input_dev, EV_SW, + jack_switch_types[i]); + +-#endif /* CONFIG_SND_JACK_INPUT_DEV */ + } ++#endif /* CONFIG_SND_JACK_INPUT_DEV */ + + err = snd_device_new(card, SNDRV_DEV_JACK, jack, &ops); + if (err < 0) +@@ -578,10 +588,14 @@ EXPORT_SYMBOL(snd_jack_new); + void snd_jack_set_parent(struct snd_jack *jack, struct device *parent) + { + WARN_ON(jack->registered); +- if (!jack->input_dev) ++ mutex_lock(&jack->input_dev_lock); ++ if (!jack->input_dev) { ++ mutex_unlock(&jack->input_dev_lock); + return; ++ } + + jack->input_dev->dev.parent = parent; ++ mutex_unlock(&jack->input_dev_lock); + } + EXPORT_SYMBOL(snd_jack_set_parent); + +@@ -629,6 +643,8 @@ EXPORT_SYMBOL(snd_jack_set_key); + + /** + * snd_jack_report - Report the current status of a jack ++ * Note: This function uses mutexes and should be called from a ++ * context which can sleep (such as a workqueue). + * + * @jack: The jack to report status for + * @status: The current status of the jack +@@ -654,8 +670,11 @@ void snd_jack_report(struct snd_jack *jack, int status) + status & jack_kctl->mask_bits); + + #ifdef CONFIG_SND_JACK_INPUT_DEV +- if (!jack->input_dev) ++ mutex_lock(&jack->input_dev_lock); ++ if (!jack->input_dev) { ++ mutex_unlock(&jack->input_dev_lock); + return; ++ } + + for (i = 0; i < ARRAY_SIZE(jack->key); i++) { + int testbit = ((SND_JACK_BTN_0 >> i) & ~mask_bits); +@@ -675,6 +694,7 @@ void snd_jack_report(struct snd_jack *jack, int status) + } + + input_sync(jack->input_dev); ++ mutex_unlock(&jack->input_dev_lock); + #endif /* CONFIG_SND_JACK_INPUT_DEV */ + } + EXPORT_SYMBOL(snd_jack_report); +-- +2.35.1 + diff --git a/queue-5.18/alsa-pcm-check-for-null-pointer-of-pointer-substream.patch b/queue-5.18/alsa-pcm-check-for-null-pointer-of-pointer-substream.patch new file mode 100644 index 00000000000..1190af5239d --- /dev/null +++ b/queue-5.18/alsa-pcm-check-for-null-pointer-of-pointer-substream.patch @@ -0,0 +1,48 @@ +From ebefaa1ee8fe85ab7e9423ce2a2a5626d3005303 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 24 Apr 2022 21:59:45 +0100 +Subject: ALSA: pcm: Check for null pointer of pointer substream before + dereferencing it + +From: Colin Ian King + +[ Upstream commit 011b559be832194f992f73d6c0d5485f5925a10b ] + +Pointer substream is being dereferenced on the assignment of pointer card +before substream is being null checked with the macro PCM_RUNTIME_CHECK. +Although PCM_RUNTIME_CHECK calls BUG_ON, it still is useful to perform the +the pointer check before card is assigned. + +Fixes: d4cfb30fce03 ("ALSA: pcm: Set per-card upper limit of PCM buffer allocations") +Signed-off-by: Colin Ian King +Link: https://lore.kernel.org/r/20220424205945.1372247-1-colin.i.king@gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/core/pcm_memory.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/sound/core/pcm_memory.c b/sound/core/pcm_memory.c +index 8848d2f3160d..b8296b6eb2c1 100644 +--- a/sound/core/pcm_memory.c ++++ b/sound/core/pcm_memory.c +@@ -453,7 +453,6 @@ EXPORT_SYMBOL(snd_pcm_lib_malloc_pages); + */ + int snd_pcm_lib_free_pages(struct snd_pcm_substream *substream) + { +- struct snd_card *card = substream->pcm->card; + struct snd_pcm_runtime *runtime; + + if (PCM_RUNTIME_CHECK(substream)) +@@ -462,6 +461,8 @@ int snd_pcm_lib_free_pages(struct snd_pcm_substream *substream) + if (runtime->dma_area == NULL) + return 0; + if (runtime->dma_buffer_p != &substream->dma_buffer) { ++ struct snd_card *card = substream->pcm->card; ++ + /* it's a newly allocated buffer. release it now. */ + do_free_pages(card, runtime->dma_buffer_p); + kfree(runtime->dma_buffer_p); +-- +2.35.1 + diff --git a/queue-5.18/alsa-usb-audio-add-quirk-bits-for-enabling-disabling.patch b/queue-5.18/alsa-usb-audio-add-quirk-bits-for-enabling-disabling.patch new file mode 100644 index 00000000000..fa42831c447 --- /dev/null +++ b/queue-5.18/alsa-usb-audio-add-quirk-bits-for-enabling-disabling.patch @@ -0,0 +1,96 @@ +From f1613563fd6162dd9d221edebc890bf0f4b5f797 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Apr 2022 08:41:00 +0200 +Subject: ALSA: usb-audio: Add quirk bits for enabling/disabling generic + implicit fb + +From: Takashi Iwai + +[ Upstream commit 0f1f7a6661394fe4a53db254c346d6aa2dd64397 ] + +For making easier to test, add the new quirk_flags bits 17 and 18 to +enable and disable the generic implicit feedback mode. The bit 17 is +equivalent with implicit_fb=1 option, applying the generic implicit +feedback sync mode. OTOH, the bit 18 disables the implicit fb mode +forcibly. + +Link: https://lore.kernel.org/r/20220421064101.12456-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + Documentation/sound/alsa-configuration.rst | 4 +++- + sound/usb/implicit.c | 5 ++++- + sound/usb/usbaudio.h | 6 ++++++ + 3 files changed, 13 insertions(+), 2 deletions(-) + +diff --git a/Documentation/sound/alsa-configuration.rst b/Documentation/sound/alsa-configuration.rst +index 34888d4fc4a8..21ab5e6f7062 100644 +--- a/Documentation/sound/alsa-configuration.rst ++++ b/Documentation/sound/alsa-configuration.rst +@@ -2246,7 +2246,7 @@ implicit_fb + Apply the generic implicit feedback sync mode. When this is set + and the playback stream sync mode is ASYNC, the driver tries to + tie an adjacent ASYNC capture stream as the implicit feedback +- source. ++ source. This is equivalent with quirk_flags bit 17. + use_vmalloc + Use vmalloc() for allocations of the PCM buffers (default: yes). + For architectures with non-coherent memory like ARM or MIPS, the +@@ -2288,6 +2288,8 @@ quirk_flags + * bit 14: Ignore errors for mixer access + * bit 15: Support generic DSD raw U32_BE format + * bit 16: Set up the interface at first like UAC1 ++ * bit 17: Apply the generic implicit feedback sync mode ++ * bit 18: Don't apply implicit feedback sync mode + + This module supports multiple devices, autoprobe and hotplugging. + +diff --git a/sound/usb/implicit.c b/sound/usb/implicit.c +index 2d444ec74202..1fd087128538 100644 +--- a/sound/usb/implicit.c ++++ b/sound/usb/implicit.c +@@ -350,7 +350,8 @@ static int audioformat_implicit_fb_quirk(struct snd_usb_audio *chip, + } + + /* Try the generic implicit fb if available */ +- if (chip->generic_implicit_fb) ++ if (chip->generic_implicit_fb || ++ (chip->quirk_flags & QUIRK_FLAG_GENERIC_IMPLICIT_FB)) + return add_generic_implicit_fb(chip, fmt, alts); + + /* No quirk */ +@@ -387,6 +388,8 @@ int snd_usb_parse_implicit_fb_quirk(struct snd_usb_audio *chip, + struct audioformat *fmt, + struct usb_host_interface *alts) + { ++ if (chip->quirk_flags & QUIRK_FLAG_SKIP_IMPLICIT_FB) ++ return 0; + if (fmt->endpoint & USB_DIR_IN) + return audioformat_capture_quirk(chip, fmt, alts); + else +diff --git a/sound/usb/usbaudio.h b/sound/usb/usbaudio.h +index b8359a0aa008..044cd7ab27cb 100644 +--- a/sound/usb/usbaudio.h ++++ b/sound/usb/usbaudio.h +@@ -164,6 +164,10 @@ extern bool snd_usb_skip_validation; + * Support generic DSD raw U32_BE format + * QUIRK_FLAG_SET_IFACE_FIRST: + * Set up the interface at first like UAC1 ++ * QUIRK_FLAG_GENERIC_IMPLICIT_FB ++ * Apply the generic implicit feedback sync mode (same as implicit_fb=1 option) ++ * QUIRK_FLAG_SKIP_IMPLICIT_FB ++ * Don't apply implicit feedback sync mode + */ + + #define QUIRK_FLAG_GET_SAMPLE_RATE (1U << 0) +@@ -183,5 +187,7 @@ extern bool snd_usb_skip_validation; + #define QUIRK_FLAG_IGNORE_CTL_ERROR (1U << 14) + #define QUIRK_FLAG_DSD_RAW (1U << 15) + #define QUIRK_FLAG_SET_IFACE_FIRST (1U << 16) ++#define QUIRK_FLAG_GENERIC_IMPLICIT_FB (1U << 17) ++#define QUIRK_FLAG_SKIP_IMPLICIT_FB (1U << 18) + + #endif /* __USBAUDIO_H */ +-- +2.35.1 + diff --git a/queue-5.18/alsa-usb-audio-move-generic-implicit-fb-quirk-entrie.patch b/queue-5.18/alsa-usb-audio-move-generic-implicit-fb-quirk-entrie.patch new file mode 100644 index 00000000000..bc10a4cd5aa --- /dev/null +++ b/queue-5.18/alsa-usb-audio-move-generic-implicit-fb-quirk-entrie.patch @@ -0,0 +1,63 @@ +From d3687b50cecdeb39ef474cf35c161087ef75bdf5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Apr 2022 08:41:01 +0200 +Subject: ALSA: usb-audio: Move generic implicit fb quirk entries into quirks.c + +From: Takashi Iwai + +[ Upstream commit 67d64069bc0867e52e73a1e255b17462005ca9b4 ] + +Use the new quirk bits to manage the generic implicit fb quirk +entries. This makes easier to compare with other devices. + +Link: https://lore.kernel.org/r/20220421064101.12456-2-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/usb/implicit.c | 5 ----- + sound/usb/quirks.c | 6 ++++++ + 2 files changed, 6 insertions(+), 5 deletions(-) + +diff --git a/sound/usb/implicit.c b/sound/usb/implicit.c +index 1fd087128538..e1bf1b5da423 100644 +--- a/sound/usb/implicit.c ++++ b/sound/usb/implicit.c +@@ -45,11 +45,6 @@ struct snd_usb_implicit_fb_match { + + /* Implicit feedback quirk table for playback */ + static const struct snd_usb_implicit_fb_match playback_implicit_fb_quirks[] = { +- /* Generic matching */ +- IMPLICIT_FB_GENERIC_DEV(0x0499, 0x1509), /* Steinberg UR22 */ +- IMPLICIT_FB_GENERIC_DEV(0x0763, 0x2030), /* M-Audio Fast Track C400 */ +- IMPLICIT_FB_GENERIC_DEV(0x0763, 0x2031), /* M-Audio Fast Track C600 */ +- + /* Fixed EP */ + /* FIXME: check the availability of generic matching */ + IMPLICIT_FB_FIXED_DEV(0x0763, 0x2080, 0x81, 2), /* M-Audio FastTrack Ultra */ +diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c +index fbbe59054c3f..e8468f9b007d 100644 +--- a/sound/usb/quirks.c ++++ b/sound/usb/quirks.c +@@ -1793,6 +1793,8 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = { + QUIRK_FLAG_CTL_MSG_DELAY_1M | QUIRK_FLAG_IGNORE_CTL_ERROR), + DEVICE_FLG(0x046d, 0x09a4, /* Logitech QuickCam E 3500 */ + QUIRK_FLAG_CTL_MSG_DELAY_1M | QUIRK_FLAG_IGNORE_CTL_ERROR), ++ DEVICE_FLG(0x0499, 0x1509, /* Steinberg UR22 */ ++ QUIRK_FLAG_GENERIC_IMPLICIT_FB), + DEVICE_FLG(0x04d8, 0xfeea, /* Benchmark DAC1 Pre */ + QUIRK_FLAG_GET_SAMPLE_RATE), + DEVICE_FLG(0x04e8, 0xa051, /* Samsung USBC Headset (AKG) */ +@@ -1826,6 +1828,10 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = { + QUIRK_FLAG_GET_SAMPLE_RATE), + DEVICE_FLG(0x074d, 0x3553, /* Outlaw RR2150 (Micronas UAC3553B) */ + QUIRK_FLAG_GET_SAMPLE_RATE), ++ DEVICE_FLG(0x0763, 0x2030, /* M-Audio Fast Track C400 */ ++ QUIRK_FLAG_GENERIC_IMPLICIT_FB), ++ DEVICE_FLG(0x0763, 0x2031, /* M-Audio Fast Track C600 */ ++ QUIRK_FLAG_GENERIC_IMPLICIT_FB), + DEVICE_FLG(0x08bb, 0x2702, /* LineX FM Transmitter */ + QUIRK_FLAG_IGNORE_CTL_ERROR), + DEVICE_FLG(0x0951, 0x16ad, /* Kingston HyperX */ +-- +2.35.1 + diff --git a/queue-5.18/amt-fix-gateway-mode-stuck.patch b/queue-5.18/amt-fix-gateway-mode-stuck.patch new file mode 100644 index 00000000000..f7f801729d8 --- /dev/null +++ b/queue-5.18/amt-fix-gateway-mode-stuck.patch @@ -0,0 +1,60 @@ +From 9c1c724d86b942573f4712ddfd94c7652873b918 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 May 2022 03:15:54 +0000 +Subject: amt: fix gateway mode stuck + +From: Taehee Yoo + +[ Upstream commit 937956ba404e70a765ca5aa39d3d7564d86a8872 ] + +If a gateway can not receive any response to requests from a relay, +gateway resets status from SENT_REQUEST to INIT and variable about a +relay as well. And then it should start the full establish step +from sending a discovery message and receiving advertisement message. +But, after failure in amt_req_work() it continues sending a request +message step with flushed(invalid) relay information and sets SENT_REQUEST. +So, a gateway can't be established with a relay. +In order to avoid this situation, it stops sending the request message +step if it fails. + +Fixes: cbc21dc1cfe9 ("amt: add data plane of amt interface") +Signed-off-by: Taehee Yoo +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/amt.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/amt.c b/drivers/net/amt.c +index 10455c9b9da0..2b4ce3869f08 100644 +--- a/drivers/net/amt.c ++++ b/drivers/net/amt.c +@@ -943,7 +943,7 @@ static void amt_req_work(struct work_struct *work) + if (amt->status < AMT_STATUS_RECEIVED_ADVERTISEMENT) + goto out; + +- if (amt->req_cnt++ > AMT_MAX_REQ_COUNT) { ++ if (amt->req_cnt > AMT_MAX_REQ_COUNT) { + netdev_dbg(amt->dev, "Gateway is not ready"); + amt->qi = AMT_INIT_REQ_TIMEOUT; + amt->ready4 = false; +@@ -951,13 +951,15 @@ static void amt_req_work(struct work_struct *work) + amt->remote_ip = 0; + __amt_update_gw_status(amt, AMT_STATUS_INIT, false); + amt->req_cnt = 0; ++ goto out; + } + spin_unlock_bh(&amt->lock); + + amt_send_request(amt, false); + amt_send_request(amt, true); +- amt_update_gw_status(amt, AMT_STATUS_SENT_REQUEST, true); + spin_lock_bh(&amt->lock); ++ __amt_update_gw_status(amt, AMT_STATUS_SENT_REQUEST, true); ++ amt->req_cnt++; + out: + exp = min_t(u32, (1 * (1 << amt->req_cnt)), AMT_MAX_REQ_TIMEOUT); + mod_delayed_work(amt_wq, &amt->req_wq, msecs_to_jiffies(exp * 1000)); +-- +2.35.1 + diff --git a/queue-5.18/amt-fix-memory-leak-for-advertisement-message.patch b/queue-5.18/amt-fix-memory-leak-for-advertisement-message.patch new file mode 100644 index 00000000000..eaac98f9f49 --- /dev/null +++ b/queue-5.18/amt-fix-memory-leak-for-advertisement-message.patch @@ -0,0 +1,41 @@ +From e935a3e29d4c9430889614d2a631400d138f2c87 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 May 2022 03:15:55 +0000 +Subject: amt: fix memory leak for advertisement message + +From: Taehee Yoo + +[ Upstream commit fe29794c3585d039fefebaa2b5a4932a627ad4fd ] + +When a gateway receives an advertisement message, it extracts relay +information and then it should be freed. +But the advertisement handler doesn't free it. +So, memory leak would occur. + +Fixes: cbc21dc1cfe9 ("amt: add data plane of amt interface") +Signed-off-by: Taehee Yoo +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/amt.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/amt.c b/drivers/net/amt.c +index 2b4ce3869f08..de4ea518c793 100644 +--- a/drivers/net/amt.c ++++ b/drivers/net/amt.c +@@ -2698,9 +2698,8 @@ static int amt_rcv(struct sock *sk, struct sk_buff *skb) + err = true; + goto drop; + } +- if (amt_advertisement_handler(amt, skb)) +- amt->dev->stats.rx_dropped++; +- goto out; ++ err = amt_advertisement_handler(amt, skb); ++ break; + case AMT_MSG_MULTICAST_DATA: + if (iph->saddr != amt->remote_ip) { + netdev_dbg(amt->dev, "Invalid Relay IP\n"); +-- +2.35.1 + diff --git a/queue-5.18/arm-dts-at91-sama7g5-remove-interrupt-parent-from-gi.patch b/queue-5.18/arm-dts-at91-sama7g5-remove-interrupt-parent-from-gi.patch new file mode 100644 index 00000000000..9fcb2ac8c24 --- /dev/null +++ b/queue-5.18/arm-dts-at91-sama7g5-remove-interrupt-parent-from-gi.patch @@ -0,0 +1,43 @@ +From f7918f732e3ac5ed899cefd07f62d77e93a79964 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 May 2022 16:31:27 +0300 +Subject: ARM: dts: at91: sama7g5: remove interrupt-parent from gic node + +From: Eugen Hristev + +[ Upstream commit b7e86ef7afd128577ff7bb0db0ae82d27d7ed7ad ] + +interrupt-parent is not to be used as a boolean property. +It is already present in the DT in the proper way it's supposed to be used: +interrupt-parent = <&gic>; + +This is also reported by dtbs_check: +arch/arm/boot/dts/at91-sama7g5ek.dtb: interrupt-controller@e8c11000: interrupt-parent: True is not of type 'array' + From schema: /.local/lib/python3.8/site-packages/dtschema/schemas/interrupts.yaml + +Fixes: 7540629e2fc7 ("ARM: dts: at91: add sama7g5 SoC DT and sama7g5-ek") +Signed-off-by: Eugen Hristev +Reviewed-by: Claudiu Beznea +Signed-off-by: Claudiu Beznea +Link: https://lore.kernel.org/r/20220503133127.64320-1-eugen.hristev@microchip.com +Signed-off-by: Nicolas Ferre +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/sama7g5.dtsi | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/arch/arm/boot/dts/sama7g5.dtsi b/arch/arm/boot/dts/sama7g5.dtsi +index f691c8f08d04..b63263129692 100644 +--- a/arch/arm/boot/dts/sama7g5.dtsi ++++ b/arch/arm/boot/dts/sama7g5.dtsi +@@ -857,7 +857,6 @@ + #interrupt-cells = <3>; + #address-cells = <0>; + interrupt-controller; +- interrupt-parent; + reg = <0xe8c11000 0x1000>, + <0xe8c12000 0x2000>; + }; +-- +2.35.1 + diff --git a/queue-5.18/arm-dts-bcm2835-rpi-b-fix-gpio-line-names.patch b/queue-5.18/arm-dts-bcm2835-rpi-b-fix-gpio-line-names.patch new file mode 100644 index 00000000000..4d84b00030f --- /dev/null +++ b/queue-5.18/arm-dts-bcm2835-rpi-b-fix-gpio-line-names.patch @@ -0,0 +1,52 @@ +From e50976a8e805ea1193bc6ad9366f768a46a7c999 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Apr 2022 22:01:41 +0200 +Subject: ARM: dts: bcm2835-rpi-b: Fix GPIO line names + +From: Stefan Wahren + +[ Upstream commit 97bd8659c1c46c23e4daea7e040befca30939950 ] + +Recently this has been fixed in the vendor tree, so upstream this. + +Fixes: 731b26a6ac17 ("ARM: bcm2835: Add names for the Raspberry Pi GPIO lines") +Signed-off-by: Phil Elwell +Signed-off-by: Stefan Wahren +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/bcm2835-rpi-b.dts | 13 ++++++------- + 1 file changed, 6 insertions(+), 7 deletions(-) + +diff --git a/arch/arm/boot/dts/bcm2835-rpi-b.dts b/arch/arm/boot/dts/bcm2835-rpi-b.dts +index 1b63d6b19750..25d87212cefd 100644 +--- a/arch/arm/boot/dts/bcm2835-rpi-b.dts ++++ b/arch/arm/boot/dts/bcm2835-rpi-b.dts +@@ -53,18 +53,17 @@ + "GPIO18", + "NC", /* GPIO19 */ + "NC", /* GPIO20 */ +- "GPIO21", ++ "CAM_GPIO0", + "GPIO22", + "GPIO23", + "GPIO24", + "GPIO25", + "NC", /* GPIO26 */ +- "CAM_GPIO0", +- /* Binary number representing build/revision */ +- "CONFIG0", +- "CONFIG1", +- "CONFIG2", +- "CONFIG3", ++ "GPIO27", ++ "GPIO28", ++ "GPIO29", ++ "GPIO30", ++ "GPIO31", + "NC", /* GPIO32 */ + "NC", /* GPIO33 */ + "NC", /* GPIO34 */ +-- +2.35.1 + diff --git a/queue-5.18/arm-dts-bcm2835-rpi-zero-w-fix-gpio-line-name-for-wi.patch b/queue-5.18/arm-dts-bcm2835-rpi-zero-w-fix-gpio-line-name-for-wi.patch new file mode 100644 index 00000000000..571bf17c7ec --- /dev/null +++ b/queue-5.18/arm-dts-bcm2835-rpi-zero-w-fix-gpio-line-name-for-wi.patch @@ -0,0 +1,57 @@ +From 32a5f5c89569c09226e381afb1cf634f9a22bd13 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Apr 2022 22:01:38 +0200 +Subject: ARM: dts: bcm2835-rpi-zero-w: Fix GPIO line name for Wifi/BT + +From: Phil Elwell + +[ Upstream commit 2c663e5e5bbf2a5b85e0f76ccb69663f583c3e33 ] + +The GPIOs 30 to 39 are connected to the Cypress CYW43438 (Wifi/BT). +So fix the GPIO line names accordingly. + +Fixes: 2c7c040c73e9 ("ARM: dts: bcm2835: Add Raspberry Pi Zero W") +Signed-off-by: Phil Elwell +Signed-off-by: Stefan Wahren +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/bcm2835-rpi-zero-w.dts | 22 ++++++++++++---------- + 1 file changed, 12 insertions(+), 10 deletions(-) + +diff --git a/arch/arm/boot/dts/bcm2835-rpi-zero-w.dts b/arch/arm/boot/dts/bcm2835-rpi-zero-w.dts +index 243236bc1e00..8b043ab62dc8 100644 +--- a/arch/arm/boot/dts/bcm2835-rpi-zero-w.dts ++++ b/arch/arm/boot/dts/bcm2835-rpi-zero-w.dts +@@ -74,16 +74,18 @@ + "GPIO27", + "SDA0", + "SCL0", +- "NC", /* GPIO30 */ +- "NC", /* GPIO31 */ +- "NC", /* GPIO32 */ +- "NC", /* GPIO33 */ +- "NC", /* GPIO34 */ +- "NC", /* GPIO35 */ +- "NC", /* GPIO36 */ +- "NC", /* GPIO37 */ +- "NC", /* GPIO38 */ +- "NC", /* GPIO39 */ ++ /* Used by BT module */ ++ "CTS0", ++ "RTS0", ++ "TXD0", ++ "RXD0", ++ /* Used by Wifi */ ++ "SD1_CLK", ++ "SD1_CMD", ++ "SD1_DATA0", ++ "SD1_DATA1", ++ "SD1_DATA2", ++ "SD1_DATA3", + "CAM_GPIO1", /* GPIO40 */ + "WL_ON", /* GPIO41 */ + "NC", /* GPIO42 */ +-- +2.35.1 + diff --git a/queue-5.18/arm-dts-bcm2837-rpi-3-b-plus-fix-gpio-line-name-of-p.patch b/queue-5.18/arm-dts-bcm2837-rpi-3-b-plus-fix-gpio-line-name-of-p.patch new file mode 100644 index 00000000000..c3e61bd3dd8 --- /dev/null +++ b/queue-5.18/arm-dts-bcm2837-rpi-3-b-plus-fix-gpio-line-name-of-p.patch @@ -0,0 +1,37 @@ +From 7410630bf05a3c21a7856eeabde259051bd07191 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Apr 2022 22:01:40 +0200 +Subject: ARM: dts: bcm2837-rpi-3-b-plus: Fix GPIO line name of power LED + +From: Phil Elwell + +[ Upstream commit 57f718aa4b93392fb1a8c0a874ab882b9e18136a ] + +The red LED on the Raspberry Pi 3 B Plus is the power LED. +So fix the GPIO line name accordingly. + +Fixes: 71c0cd2283f2 ("ARM: dts: bcm2837: Add Raspberry Pi 3 B+") +Signed-off-by: Phil Elwell +Signed-off-by: Stefan Wahren +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/bcm2837-rpi-3-b-plus.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/bcm2837-rpi-3-b-plus.dts b/arch/arm/boot/dts/bcm2837-rpi-3-b-plus.dts +index e12938baaf12..c263f5b48b96 100644 +--- a/arch/arm/boot/dts/bcm2837-rpi-3-b-plus.dts ++++ b/arch/arm/boot/dts/bcm2837-rpi-3-b-plus.dts +@@ -45,7 +45,7 @@ + #gpio-cells = <2>; + gpio-line-names = "BT_ON", + "WL_ON", +- "STATUS_LED_R", ++ "PWR_LED_R", + "LAN_RUN", + "", + "CAM_GPIO0", +-- +2.35.1 + diff --git a/queue-5.18/arm-dts-bcm2837-rpi-cm3-io3-fix-gpio-line-names-for-.patch b/queue-5.18/arm-dts-bcm2837-rpi-cm3-io3-fix-gpio-line-names-for-.patch new file mode 100644 index 00000000000..01b1b5c23ab --- /dev/null +++ b/queue-5.18/arm-dts-bcm2837-rpi-cm3-io3-fix-gpio-line-names-for-.patch @@ -0,0 +1,39 @@ +From 8642e18761df36709af2b0710124754b15083a22 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Apr 2022 22:01:39 +0200 +Subject: ARM: dts: bcm2837-rpi-cm3-io3: Fix GPIO line names for SMPS I2C + +From: Phil Elwell + +[ Upstream commit 9fd26fd02749ec964eb0d588a3bab9e09bf77927 ] + +The GPIOs 46 & 47 are already used for a I2C interface to a SMPS. +So fix the GPIO line names accordingly. + +Fixes: a54fe8a6cf66 ("ARM: dts: add Raspberry Pi Compute Module 3 and IO board") +Signed-off-by: Phil Elwell +Signed-off-by: Stefan Wahren +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/bcm2837-rpi-cm3-io3.dts | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/bcm2837-rpi-cm3-io3.dts b/arch/arm/boot/dts/bcm2837-rpi-cm3-io3.dts +index 588d9411ceb6..3dfce4312dfc 100644 +--- a/arch/arm/boot/dts/bcm2837-rpi-cm3-io3.dts ++++ b/arch/arm/boot/dts/bcm2837-rpi-cm3-io3.dts +@@ -63,8 +63,8 @@ + "GPIO43", + "GPIO44", + "GPIO45", +- "GPIO46", +- "GPIO47", ++ "SMPS_SCL", ++ "SMPS_SDA", + /* Used by eMMC */ + "SD_CLK_R", + "SD_CMD_R", +-- +2.35.1 + diff --git a/queue-5.18/arm-dts-bcm5301x-update-pin-controller-node-name.patch b/queue-5.18/arm-dts-bcm5301x-update-pin-controller-node-name.patch new file mode 100644 index 00000000000..3192a1c8b2b --- /dev/null +++ b/queue-5.18/arm-dts-bcm5301x-update-pin-controller-node-name.patch @@ -0,0 +1,42 @@ +From 54b57d22f6d4561b26647f6f9a4b53b7d00daf8d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Mar 2022 14:05:27 +0200 +Subject: ARM: dts: BCM5301X: Update pin controller node name +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafał Miłecki + +[ Upstream commit 130b5e32ba9d2d2313e39cf3f6d0729bff02b76a ] + +This fixes: +arch/arm/boot/dts/bcm4708-asus-rt-ac56u.dtb: cru-bus@100: 'pin-controller@1c0' does not match any of the regexes: '^clock-controller@[a-f0-9]+$', '^phy@[a-f0-9]+$', '^pinctrl@[a-f0-9]+$', '^syscon@[a-f0-9]+$', '^thermal@[a-f0-9]+$' + From schema: Documentation/devicetree/bindings/mfd/brcm,cru.yaml +arch/arm/boot/dts/bcm4708-asus-rt-ac56u.dtb: pin-controller@1c0: $nodename:0: 'pin-controller@1c0' does not match '^(pinctrl|pinmux)(@[0-9a-f]+)?$' + From schema: Documentation/devicetree/bindings/pinctrl/brcm,ns-pinmux.yaml + +Ref: e7391b021e3f ("dt-bindings: mfd: brcm,cru: Rename pinctrl node") +Signed-off-by: Rafał Miłecki +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/bcm5301x.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/bcm5301x.dtsi b/arch/arm/boot/dts/bcm5301x.dtsi +index 603c700c706f..65f8a759f1e3 100644 +--- a/arch/arm/boot/dts/bcm5301x.dtsi ++++ b/arch/arm/boot/dts/bcm5301x.dtsi +@@ -455,7 +455,7 @@ + reg = <0x180 0x4>; + }; + +- pinctrl: pin-controller@1c0 { ++ pinctrl: pinctrl@1c0 { + compatible = "brcm,bcm4708-pinmux"; + reg = <0x1c0 0x24>; + reg-names = "cru_gpio_control"; +-- +2.35.1 + diff --git a/queue-5.18/arm-dts-ci4x10-adapt-to-changes-in-imx6qdl.dtsi-rega.patch b/queue-5.18/arm-dts-ci4x10-adapt-to-changes-in-imx6qdl.dtsi-rega.patch new file mode 100644 index 00000000000..f299885d90f --- /dev/null +++ b/queue-5.18/arm-dts-ci4x10-adapt-to-changes-in-imx6qdl.dtsi-rega.patch @@ -0,0 +1,53 @@ +From 1e4dfa5066a88f0d10a4fe0fbf27e48066cab1dd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Apr 2022 06:39:45 +0200 +Subject: ARM: dts: ci4x10: Adapt to changes in imx6qdl.dtsi regarding fec + clocks +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thorsten Scherer + +[ Upstream commit 3d397a1277853498e8b7b305f2610881357c033f ] + +Commit f3e7dae323ab ("ARM: dts: imx6qdl: add enet_out clk +support") added another item to the list of clocks for the fec +device. As imx6dl-eckelmann-ci4x10.dts only overwrites clocks, +but not clock-names this resulted in an inconsistency with +clocks having one item more than clock-names. + +Also overwrite clock-names with the same value as in +imx6qdl.dtsi. This is a no-op today, but prevents similar +inconsistencies if the soc file will be changed in a similar way +in the future. + +Signed-off-by: Thorsten Scherer +Reviewed-by: Uwe Kleine-König +Fixes: f3e7dae323ab ("ARM: dts: imx6qdl: add enet_out clk support") +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/imx6dl-eckelmann-ci4x10.dts | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/imx6dl-eckelmann-ci4x10.dts b/arch/arm/boot/dts/imx6dl-eckelmann-ci4x10.dts +index b4a9523e325b..864dc5018451 100644 +--- a/arch/arm/boot/dts/imx6dl-eckelmann-ci4x10.dts ++++ b/arch/arm/boot/dts/imx6dl-eckelmann-ci4x10.dts +@@ -297,7 +297,11 @@ + phy-mode = "rmii"; + phy-reset-gpios = <&gpio1 18 GPIO_ACTIVE_LOW>; + phy-handle = <&phy>; +- clocks = <&clks IMX6QDL_CLK_ENET>, <&clks IMX6QDL_CLK_ENET>, <&rmii_clk>; ++ clocks = <&clks IMX6QDL_CLK_ENET>, ++ <&clks IMX6QDL_CLK_ENET>, ++ <&rmii_clk>, ++ <&clks IMX6QDL_CLK_ENET_REF>; ++ clock-names = "ipg", "ahb", "ptp", "enet_out"; + status = "okay"; + + mdio { +-- +2.35.1 + diff --git a/queue-5.18/arm-dts-exynos-add-atmel-24c128-fallback-to-samsung-.patch b/queue-5.18/arm-dts-exynos-add-atmel-24c128-fallback-to-samsung-.patch new file mode 100644 index 00000000000..3e8221b6c93 --- /dev/null +++ b/queue-5.18/arm-dts-exynos-add-atmel-24c128-fallback-to-samsung-.patch @@ -0,0 +1,45 @@ +From b2cad8f5a9907118103efe585f70ad61bffb0736 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Apr 2022 20:34:43 +0200 +Subject: ARM: dts: exynos: add atmel,24c128 fallback to Samsung EEPROM + +From: Krzysztof Kozlowski + +[ Upstream commit f038e8186fbc5723d7d38c6fa1d342945107347e ] + +The Samsung s524ad0xd1 EEPROM should use atmel,24c128 fallback, +according to the AT24 EEPROM bindings. + +Reported-by: Rob Herring +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20220426183443.243113-1-krzysztof.kozlowski@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/exynos5250-smdk5250.dts | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/exynos5250-smdk5250.dts b/arch/arm/boot/dts/exynos5250-smdk5250.dts +index 21fbbf3d8684..71293749ac48 100644 +--- a/arch/arm/boot/dts/exynos5250-smdk5250.dts ++++ b/arch/arm/boot/dts/exynos5250-smdk5250.dts +@@ -129,7 +129,7 @@ + samsung,i2c-max-bus-freq = <20000>; + + eeprom@50 { +- compatible = "samsung,s524ad0xd1"; ++ compatible = "samsung,s524ad0xd1", "atmel,24c128"; + reg = <0x50>; + }; + +@@ -289,7 +289,7 @@ + samsung,i2c-max-bus-freq = <20000>; + + eeprom@51 { +- compatible = "samsung,s524ad0xd1"; ++ compatible = "samsung,s524ad0xd1", "atmel,24c128"; + reg = <0x51>; + }; + +-- +2.35.1 + diff --git a/queue-5.18/arm-dts-imx6dl-colibri-fix-i2c-pinmuxing.patch b/queue-5.18/arm-dts-imx6dl-colibri-fix-i2c-pinmuxing.patch new file mode 100644 index 00000000000..3c886f5c419 --- /dev/null +++ b/queue-5.18/arm-dts-imx6dl-colibri-fix-i2c-pinmuxing.patch @@ -0,0 +1,53 @@ +From 3ffea884cba15c6a71689204d665b957eb6ada7d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Apr 2022 17:22:24 +0200 +Subject: ARM: dts: imx6dl-colibri: Fix I2C pinmuxing + +From: Max Krummenacher + +[ Upstream commit 5f5c579a34a87117c20b411df583ae816c1ec84f ] + +Fix names of extra pingroup node and property for gpio bus recovery. +Without the change i2c2 is not functional. + +Fixes: 56f0df6b6b58 ("ARM: dts: imx*(colibri|apalis): add missing recovery modes to i2c") +Signed-off-by: Max Krummenacher +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/imx6qdl-colibri.dtsi | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arm/boot/dts/imx6qdl-colibri.dtsi b/arch/arm/boot/dts/imx6qdl-colibri.dtsi +index 4e2a309c93fa..1e86b3814708 100644 +--- a/arch/arm/boot/dts/imx6qdl-colibri.dtsi ++++ b/arch/arm/boot/dts/imx6qdl-colibri.dtsi +@@ -1,6 +1,6 @@ + // SPDX-License-Identifier: GPL-2.0+ OR MIT + /* +- * Copyright 2014-2020 Toradex ++ * Copyright 2014-2022 Toradex + * Copyright 2012 Freescale Semiconductor, Inc. + * Copyright 2011 Linaro Ltd. + */ +@@ -132,7 +132,7 @@ + clock-frequency = <100000>; + pinctrl-names = "default", "gpio"; + pinctrl-0 = <&pinctrl_i2c2>; +- pinctrl-0 = <&pinctrl_i2c2_gpio>; ++ pinctrl-1 = <&pinctrl_i2c2_gpio>; + scl-gpios = <&gpio2 30 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>; + sda-gpios = <&gpio3 16 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>; + status = "okay"; +@@ -488,7 +488,7 @@ + >; + }; + +- pinctrl_i2c2_gpio: i2c2grp { ++ pinctrl_i2c2_gpio: i2c2gpiogrp { + fsl,pins = < + MX6QDL_PAD_EIM_EB2__GPIO2_IO30 0x4001b8b1 + MX6QDL_PAD_EIM_D16__GPIO3_IO16 0x4001b8b1 +-- +2.35.1 + diff --git a/queue-5.18/arm-dts-lan966x-swap-dma-channels-for-crypto-node.patch b/queue-5.18/arm-dts-lan966x-swap-dma-channels-for-crypto-node.patch new file mode 100644 index 00000000000..706788f6b00 --- /dev/null +++ b/queue-5.18/arm-dts-lan966x-swap-dma-channels-for-crypto-node.patch @@ -0,0 +1,44 @@ +From be9a80edb258a787df066c5e44c509a0a3a9de5c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 May 2022 00:41:15 +0200 +Subject: ARM: dts: lan966x: swap dma channels for crypto node + +From: Michael Walle + +[ Upstream commit 8b4092fd0c1a0aaa985413c43b027f87dd457207 ] + +The YAML binding (crypto/atmel,at91sam9g46-aes.yaml) mandates the order +of the channels. Swap them to pass devicetree validation. + +Fixes: 290deaa10c50 ("ARM: dts: add DT for lan966 SoC and 2-port board pcb8291") +Signed-off-by: Michael Walle +Reviewed-by: Claudiu Beznea +Tested-by: Horatiu Vultur +Signed-off-by: Claudiu Beznea +Link: https://lore.kernel.org/r/20220502224127.2604333-2-michael@walle.cc +Signed-off-by: Nicolas Ferre +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/lan966x.dtsi | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arm/boot/dts/lan966x.dtsi b/arch/arm/boot/dts/lan966x.dtsi +index 7d2869648050..5e9cbc8cdcbc 100644 +--- a/arch/arm/boot/dts/lan966x.dtsi ++++ b/arch/arm/boot/dts/lan966x.dtsi +@@ -114,9 +114,9 @@ + compatible = "atmel,at91sam9g46-aes"; + reg = <0xe004c000 0x100>; + interrupts = ; +- dmas = <&dma0 AT91_XDMAC_DT_PERID(13)>, +- <&dma0 AT91_XDMAC_DT_PERID(12)>; +- dma-names = "rx", "tx"; ++ dmas = <&dma0 AT91_XDMAC_DT_PERID(12)>, ++ <&dma0 AT91_XDMAC_DT_PERID(13)>; ++ dma-names = "tx", "rx"; + clocks = <&nic_clk>; + clock-names = "aes_clk"; + }; +-- +2.35.1 + diff --git a/queue-5.18/arm-dts-ox820-align-interrupt-controller-node-name-w.patch b/queue-5.18/arm-dts-ox820-align-interrupt-controller-node-name-w.patch new file mode 100644 index 00000000000..fc8df7d0c7f --- /dev/null +++ b/queue-5.18/arm-dts-ox820-align-interrupt-controller-node-name-w.patch @@ -0,0 +1,37 @@ +From 6cc502314623cbe150ffa3d6fb3075b30a97a30a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Apr 2022 21:29:59 +0200 +Subject: ARM: dts: ox820: align interrupt controller node name with dtschema + +From: Krzysztof Kozlowski + +[ Upstream commit fbcd5ad7a419ad40644a0bb8b4152bc660172d8a ] + +Fixes dtbs_check warnings like: + + gic@1000: $nodename:0: 'gic@1000' does not match '^interrupt-controller(@[0-9a-f,]+)*$' + +Signed-off-by: Krzysztof Kozlowski +Acked-by: Neil Armstrong +Link: https://lore.kernel.org/r/20220317115705.450427-1-krzysztof.kozlowski@canonical.com +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/ox820.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/ox820.dtsi b/arch/arm/boot/dts/ox820.dtsi +index 90846a7655b4..dde4364892bf 100644 +--- a/arch/arm/boot/dts/ox820.dtsi ++++ b/arch/arm/boot/dts/ox820.dtsi +@@ -287,7 +287,7 @@ + clocks = <&armclk>; + }; + +- gic: gic@1000 { ++ gic: interrupt-controller@1000 { + compatible = "arm,arm11mp-gic"; + interrupt-controller; + #interrupt-cells = <3>; +-- +2.35.1 + diff --git a/queue-5.18/arm-dts-qcom-sdx55-remove-wrong-unit-address-from-rp.patch b/queue-5.18/arm-dts-qcom-sdx55-remove-wrong-unit-address-from-rp.patch new file mode 100644 index 00000000000..9480c68cc0e --- /dev/null +++ b/queue-5.18/arm-dts-qcom-sdx55-remove-wrong-unit-address-from-rp.patch @@ -0,0 +1,37 @@ +From 1473eb9c1421c44859bbf7e1122c8b0873535537 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Apr 2022 10:59:33 +0200 +Subject: ARM: dts: qcom: sdx55: remove wrong unit address from RPMH RSC clocks + +From: Krzysztof Kozlowski + +[ Upstream commit 97c246c825f73a018169834e56ffa9a89dea37a9 ] + +The clock controller of RPMH RSC does not have 'reg' property, so should +not have unit address. + +Fixes: bae2f5979c6e ("ARM: dts: qcom: Add SDX65 platform and MTP board support") +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20220411085935.130072-2-krzysztof.kozlowski@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/qcom-sdx65.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/qcom-sdx65.dtsi b/arch/arm/boot/dts/qcom-sdx65.dtsi +index 796641d30e06..0c3f93603adc 100644 +--- a/arch/arm/boot/dts/qcom-sdx65.dtsi ++++ b/arch/arm/boot/dts/qcom-sdx65.dtsi +@@ -202,7 +202,7 @@ + , + ; + +- rpmhcc: clock-controller@1 { ++ rpmhcc: clock-controller { + compatible = "qcom,sdx65-rpmh-clk"; + #clock-cells = <1>; + clock-names = "xo"; +-- +2.35.1 + diff --git a/queue-5.18/arm-dts-s5pv210-align-dma-channels-with-dtschema.patch b/queue-5.18/arm-dts-s5pv210-align-dma-channels-with-dtschema.patch new file mode 100644 index 00000000000..739c2f72c76 --- /dev/null +++ b/queue-5.18/arm-dts-s5pv210-align-dma-channels-with-dtschema.patch @@ -0,0 +1,79 @@ +From a7170ee6205006e93e01654fd18114d7f138ac08 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 27 Mar 2022 11:08:54 -0700 +Subject: ARM: dts: s5pv210: align DMA channels with dtschema + +From: Krzysztof Kozlowski + +[ Upstream commit 9e916fb9bc3d16066286f19fc9c51d26a6aec6bd ] + +dtschema expects DMA channels in specific order (tx, rx and tx-sec). +The order actually should not matter because dma-names is used however +let's make it aligned with dtschema to suppress warnings like: + + i2s@eee30000: dma-names: ['rx', 'tx', 'tx-sec'] is not valid under any of the given schemas + +Signed-off-by: Krzysztof Kozlowski +Co-developed-by: Jonathan Bakker +Signed-off-by: Jonathan Bakker +Link: https://lore.kernel.org/r/CY4PR04MB056779A9C50DC95987C5272ACB1C9@CY4PR04MB0567.namprd04.prod.outlook.com +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/s5pv210-aries.dtsi | 2 +- + arch/arm/boot/dts/s5pv210.dtsi | 12 ++++++------ + 2 files changed, 7 insertions(+), 7 deletions(-) + +diff --git a/arch/arm/boot/dts/s5pv210-aries.dtsi b/arch/arm/boot/dts/s5pv210-aries.dtsi +index 26f2be2d9faa..c44fdf535795 100644 +--- a/arch/arm/boot/dts/s5pv210-aries.dtsi ++++ b/arch/arm/boot/dts/s5pv210-aries.dtsi +@@ -636,7 +636,7 @@ + }; + + &i2s0 { +- dmas = <&pdma0 9>, <&pdma0 10>, <&pdma0 11>; ++ dmas = <&pdma0 10>, <&pdma0 9>, <&pdma0 11>; + status = "okay"; + }; + +diff --git a/arch/arm/boot/dts/s5pv210.dtsi b/arch/arm/boot/dts/s5pv210.dtsi +index 353ba7b09a0c..c5265f3ae31d 100644 +--- a/arch/arm/boot/dts/s5pv210.dtsi ++++ b/arch/arm/boot/dts/s5pv210.dtsi +@@ -239,8 +239,8 @@ + reg = <0xeee30000 0x1000>; + interrupt-parent = <&vic2>; + interrupts = <16>; +- dma-names = "rx", "tx", "tx-sec"; +- dmas = <&pdma1 9>, <&pdma1 10>, <&pdma1 11>; ++ dma-names = "tx", "rx", "tx-sec"; ++ dmas = <&pdma1 10>, <&pdma1 9>, <&pdma1 11>; + clock-names = "iis", + "i2s_opclk0", + "i2s_opclk1"; +@@ -259,8 +259,8 @@ + reg = <0xe2100000 0x1000>; + interrupt-parent = <&vic2>; + interrupts = <17>; +- dma-names = "rx", "tx"; +- dmas = <&pdma1 12>, <&pdma1 13>; ++ dma-names = "tx", "rx"; ++ dmas = <&pdma1 13>, <&pdma1 12>; + clock-names = "iis", "i2s_opclk0"; + clocks = <&clocks CLK_I2S1>, <&clocks SCLK_AUDIO1>; + pinctrl-names = "default"; +@@ -274,8 +274,8 @@ + reg = <0xe2a00000 0x1000>; + interrupt-parent = <&vic2>; + interrupts = <18>; +- dma-names = "rx", "tx"; +- dmas = <&pdma1 14>, <&pdma1 15>; ++ dma-names = "tx", "rx"; ++ dmas = <&pdma1 15>, <&pdma1 14>; + clock-names = "iis", "i2s_opclk0"; + clocks = <&clocks CLK_I2S2>, <&clocks SCLK_AUDIO2>; + pinctrl-names = "default"; +-- +2.35.1 + diff --git a/queue-5.18/arm-dts-socfpga-align-interrupt-controller-node-name.patch b/queue-5.18/arm-dts-socfpga-align-interrupt-controller-node-name.patch new file mode 100644 index 00000000000..c5258ebc649 --- /dev/null +++ b/queue-5.18/arm-dts-socfpga-align-interrupt-controller-node-name.patch @@ -0,0 +1,51 @@ +From c026b5a51835f4e5a36d519f36138c410b1b51ab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Apr 2022 21:30:22 +0200 +Subject: ARM: dts: socfpga: align interrupt controller node name with dtschema + +From: Krzysztof Kozlowski + +[ Upstream commit c9bdd50d2019f78bf4c1f6a79254c27771901023 ] + +Fixes dtbs_check warnings like: + + $nodename:0: 'intc@fffed000' does not match '^interrupt-controller(@[0-9a-f,]+)*$' + +Signed-off-by: Krzysztof Kozlowski +Acked-by: Dinh Nguyen +Link: https://lore.kernel.org/r/20220317115705.450427-2-krzysztof.kozlowski@canonical.com +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/socfpga.dtsi | 2 +- + arch/arm/boot/dts/socfpga_arria10.dtsi | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/socfpga.dtsi b/arch/arm/boot/dts/socfpga.dtsi +index 7c1d6423d7f8..b8c5dd7860cb 100644 +--- a/arch/arm/boot/dts/socfpga.dtsi ++++ b/arch/arm/boot/dts/socfpga.dtsi +@@ -46,7 +46,7 @@ + <0xff113000 0x1000>; + }; + +- intc: intc@fffed000 { ++ intc: interrupt-controller@fffed000 { + compatible = "arm,cortex-a9-gic"; + #interrupt-cells = <3>; + interrupt-controller; +diff --git a/arch/arm/boot/dts/socfpga_arria10.dtsi b/arch/arm/boot/dts/socfpga_arria10.dtsi +index 3ba431dfa8c9..f1e50d2e623a 100644 +--- a/arch/arm/boot/dts/socfpga_arria10.dtsi ++++ b/arch/arm/boot/dts/socfpga_arria10.dtsi +@@ -38,7 +38,7 @@ + <0xff113000 0x1000>; + }; + +- intc: intc@ffffd000 { ++ intc: interrupt-controller@ffffd000 { + compatible = "arm,cortex-a9-gic"; + #interrupt-cells = <3>; + interrupt-controller; +-- +2.35.1 + diff --git a/queue-5.18/arm-dts-stm32-fix-phy-post-reset-delay-on-avenger96.patch b/queue-5.18/arm-dts-stm32-fix-phy-post-reset-delay-on-avenger96.patch new file mode 100644 index 00000000000..d7397dbfd75 --- /dev/null +++ b/queue-5.18/arm-dts-stm32-fix-phy-post-reset-delay-on-avenger96.patch @@ -0,0 +1,46 @@ +From 1191f3269804b13ceef641db0f1c66e6fc9d77d6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Mar 2022 18:58:51 +0100 +Subject: ARM: dts: stm32: Fix PHY post-reset delay on Avenger96 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Marek Vasut + +[ Upstream commit ef2d90708883f4025a801feb0ba8411a7a4387e1 ] + +Per KSZ9031RNX PHY datasheet FIGURE 7-5: POWER-UP/POWER-DOWN/RESET TIMING +Note 2: After the de-assertion of reset, wait a minimum of 100 μs before +starting programming on the MIIM (MDC/MDIO) interface. + +Add 1ms post-reset delay to guarantee this figure. + +Fixes: 010ca9fe500bf ("ARM: dts: stm32: Add missing ethernet PHY reset on AV96") +Signed-off-by: Marek Vasut +Cc: Alexandre Torgue +Cc: Patrice Chotard +Cc: Patrick Delaunay +Cc: linux-stm32@st-md-mailman.stormreply.com +To: linux-arm-kernel@lists.infradead.org +Signed-off-by: Alexandre Torgue +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi b/arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi +index 61e17f44ce81..76c54b006d87 100644 +--- a/arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi ++++ b/arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi +@@ -141,6 +141,7 @@ + compatible = "snps,dwmac-mdio"; + reset-gpios = <&gpioz 2 GPIO_ACTIVE_LOW>; + reset-delay-us = <1000>; ++ reset-post-delay-us = <1000>; + + phy0: ethernet-phy@7 { + reg = <7>; +-- +2.35.1 + diff --git a/queue-5.18/arm-dts-suniv-f1c100-fix-watchdog-compatible.patch b/queue-5.18/arm-dts-suniv-f1c100-fix-watchdog-compatible.patch new file mode 100644 index 00000000000..bdb09d35888 --- /dev/null +++ b/queue-5.18/arm-dts-suniv-f1c100-fix-watchdog-compatible.patch @@ -0,0 +1,52 @@ +From 5ae217e995bc760d17190f32159271aeff41da79 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Mar 2022 16:23:40 +0000 +Subject: ARM: dts: suniv: F1C100: fix watchdog compatible + +From: Andre Przywara + +[ Upstream commit 01a850ee61cbf0ab77dcbf26bb133fec2dd640d6 ] + +The F1C100 series of SoCs actually have their watchdog IP being +compatible with the newer Allwinner generation, not the older one. + +The currently described sun4i-a10-wdt actually does not work, neither +the watchdog functionality (just never fires), nor the reset part +(reboot hangs). + +Replace the compatible string with the one used by the newer generation. +Verified to work with both the watchdog and reboot functionality on a +LicheePi Nano. + +Also add the missing interrupt line and clock source, to make it binding +compliant. + +Fixes: 4ba16d17efdd ("ARM: dts: suniv: add initial DTSI file for F1C100s") +Signed-off-by: Andre Przywara +Acked-by: Guenter Roeck +Signed-off-by: Jernej Skrabec +Link: https://lore.kernel.org/r/20220317162349.739636-4-andre.przywara@arm.com +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/suniv-f1c100s.dtsi | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/suniv-f1c100s.dtsi b/arch/arm/boot/dts/suniv-f1c100s.dtsi +index 6100d3b75f61..def830101448 100644 +--- a/arch/arm/boot/dts/suniv-f1c100s.dtsi ++++ b/arch/arm/boot/dts/suniv-f1c100s.dtsi +@@ -104,8 +104,10 @@ + + wdt: watchdog@1c20ca0 { + compatible = "allwinner,suniv-f1c100s-wdt", +- "allwinner,sun4i-a10-wdt"; ++ "allwinner,sun6i-a31-wdt"; + reg = <0x01c20ca0 0x20>; ++ interrupts = <16>; ++ clocks = <&osc32k>; + }; + + uart0: serial@1c25000 { +-- +2.35.1 + diff --git a/queue-5.18/arm-hisi-add-missing-of_node_put-after-of_find_compa.patch b/queue-5.18/arm-hisi-add-missing-of_node_put-after-of_find_compa.patch new file mode 100644 index 00000000000..72374c2fa3a --- /dev/null +++ b/queue-5.18/arm-hisi-add-missing-of_node_put-after-of_find_compa.patch @@ -0,0 +1,52 @@ +From bab9499ad4ca2d2e20ed6f3a56074b0d54524d1e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Apr 2022 10:43:06 +0000 +Subject: ARM: hisi: Add missing of_node_put after of_find_compatible_node + +From: Peng Wu + +[ Upstream commit 9bc72e47d4630d58a840a66a869c56b29554cfe4 ] + +of_find_compatible_node will increment the refcount of the returned +device_node. Calling of_node_put() to avoid the refcount leak + +Signed-off-by: Peng Wu +Signed-off-by: Wei Xu +Signed-off-by: Sasha Levin +--- + arch/arm/mach-hisi/platsmp.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/arch/arm/mach-hisi/platsmp.c b/arch/arm/mach-hisi/platsmp.c +index a56cc64deeb8..9ce93e0b6cdc 100644 +--- a/arch/arm/mach-hisi/platsmp.c ++++ b/arch/arm/mach-hisi/platsmp.c +@@ -67,14 +67,17 @@ static void __init hi3xxx_smp_prepare_cpus(unsigned int max_cpus) + } + ctrl_base = of_iomap(np, 0); + if (!ctrl_base) { ++ of_node_put(np); + pr_err("failed to map address\n"); + return; + } + if (of_property_read_u32(np, "smp-offset", &offset) < 0) { ++ of_node_put(np); + pr_err("failed to find smp-offset property\n"); + return; + } + ctrl_base += offset; ++ of_node_put(np); + } + } + +@@ -160,6 +163,7 @@ static int hip01_boot_secondary(unsigned int cpu, struct task_struct *idle) + if (WARN_ON(!node)) + return -1; + ctrl_base = of_iomap(node, 0); ++ of_node_put(node); + + /* set the secondary core boot from DDR */ + remap_reg_value = readl_relaxed(ctrl_base + REG_SC_CTRL); +-- +2.35.1 + diff --git a/queue-5.18/arm-mediatek-select-arch-timer-for-mt7629.patch b/queue-5.18/arm-mediatek-select-arch-timer-for-mt7629.patch new file mode 100644 index 00000000000..5292d16745d --- /dev/null +++ b/queue-5.18/arm-mediatek-select-arch-timer-for-mt7629.patch @@ -0,0 +1,38 @@ +From d95991d2215f31596e3b09fa42d646105193725e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 9 Apr 2022 17:13:47 +0800 +Subject: arm: mediatek: select arch timer for mt7629 + +From: Chuanhong Guo + +[ Upstream commit d66aea197d534e23d4989eb72fca9c0c114b97c9 ] + +This chip has an armv7 arch timer according to the dts. Select it in +Kconfig to enforce the support for it. +Otherwise the system time is just completely wrong if user forget to +enable ARM_ARCH_TIMER in kernel config. + +Fixes: a43379dddf1b ("arm: mediatek: add MT7629 smp bring up code") +Signed-off-by: Chuanhong Guo +Link: https://lore.kernel.org/r/20220409091347.2473449-1-gch981213@gmail.com +Signed-off-by: Matthias Brugger +Signed-off-by: Sasha Levin +--- + arch/arm/mach-mediatek/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm/mach-mediatek/Kconfig b/arch/arm/mach-mediatek/Kconfig +index 9e0f592d87d8..35a3430c7942 100644 +--- a/arch/arm/mach-mediatek/Kconfig ++++ b/arch/arm/mach-mediatek/Kconfig +@@ -30,6 +30,7 @@ config MACH_MT7623 + config MACH_MT7629 + bool "MediaTek MT7629 SoCs support" + default ARCH_MEDIATEK ++ select HAVE_ARM_ARCH_TIMER + + config MACH_MT8127 + bool "MediaTek MT8127 SoCs support" +-- +2.35.1 + diff --git a/queue-5.18/arm-omap1-clock-fix-uart-rate-reporting-algorithm.patch b/queue-5.18/arm-omap1-clock-fix-uart-rate-reporting-algorithm.patch new file mode 100644 index 00000000000..7e7c7d4bccf --- /dev/null +++ b/queue-5.18/arm-omap1-clock-fix-uart-rate-reporting-algorithm.patch @@ -0,0 +1,37 @@ +From dac4abcf878492957ab81f78f0ece72e72ef7d1f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 10 Apr 2022 15:07:54 +0200 +Subject: ARM: OMAP1: clock: Fix UART rate reporting algorithm + +From: Janusz Krzysztofik + +[ Upstream commit 338d5d476cde853dfd97378d20496baabc2ce3c0 ] + +Since its introduction to the mainline kernel, omap1_uart_recalc() helper +makes incorrect use of clk->enable_bit as a ready to use bitmap mask while +it only provides the bit number. Fix it. + +Signed-off-by: Janusz Krzysztofik +Acked-by: Tony Lindgren +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + arch/arm/mach-omap1/clock.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/mach-omap1/clock.c b/arch/arm/mach-omap1/clock.c +index 9d4a0ab50a46..d63d5eb8d8fd 100644 +--- a/arch/arm/mach-omap1/clock.c ++++ b/arch/arm/mach-omap1/clock.c +@@ -41,7 +41,7 @@ static DEFINE_SPINLOCK(clockfw_lock); + unsigned long omap1_uart_recalc(struct clk *clk) + { + unsigned int val = __raw_readl(clk->enable_reg); +- return val & clk->enable_bit ? 48000000 : 12000000; ++ return val & 1 << clk->enable_bit ? 48000000 : 12000000; + } + + unsigned long omap1_sossi_recalc(struct clk *clk) +-- +2.35.1 + diff --git a/queue-5.18/arm-versatile-add-missing-of_node_put-in-dcscb_init.patch b/queue-5.18/arm-versatile-add-missing-of_node_put-in-dcscb_init.patch new file mode 100644 index 00000000000..e00e81131df --- /dev/null +++ b/queue-5.18/arm-versatile-add-missing-of_node_put-in-dcscb_init.patch @@ -0,0 +1,37 @@ +From 966a8e749f9d668dc5d31ad6b03d62d55b55c4b0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Apr 2022 01:03:56 +0200 +Subject: ARM: versatile: Add missing of_node_put in dcscb_init + +From: Peng Wu + +[ Upstream commit 23b44f9c649bbef10b45fa33080cd8b4166800ae ] + +The device_node pointer is returned by of_find_compatible_node +with refcount incremented. We should use of_node_put() to avoid +the refcount leak. + +Signed-off-by: Peng Wu +Signed-off-by: Linus Walleij +Link: https://lore.kernel.org/r/20220428230356.69418-1-linus.walleij@linaro.org' +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + arch/arm/mach-vexpress/dcscb.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm/mach-vexpress/dcscb.c b/arch/arm/mach-vexpress/dcscb.c +index a0554d7d04f7..e1adc098f89a 100644 +--- a/arch/arm/mach-vexpress/dcscb.c ++++ b/arch/arm/mach-vexpress/dcscb.c +@@ -144,6 +144,7 @@ static int __init dcscb_init(void) + if (!node) + return -ENODEV; + dcscb_base = of_iomap(node, 0); ++ of_node_put(node); + if (!dcscb_base) + return -EADDRNOTAVAIL; + cfg = readl_relaxed(dcscb_base + DCS_CFG_R); +-- +2.35.1 + diff --git a/queue-5.18/arm64-compat-do-not-treat-syscall-number-as-esr_elx-.patch b/queue-5.18/arm64-compat-do-not-treat-syscall-number-as-esr_elx-.patch new file mode 100644 index 00000000000..c8376e90b55 --- /dev/null +++ b/queue-5.18/arm64-compat-do-not-treat-syscall-number-as-esr_elx-.patch @@ -0,0 +1,77 @@ +From 757b04b1a2e686be32adc98b1019ad87d2d7da7f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Apr 2022 12:44:41 +0100 +Subject: arm64: compat: Do not treat syscall number as ESR_ELx for a bad + syscall + +From: Alexandru Elisei + +[ Upstream commit 3fed9e551417b84038b15117732ea4505eee386b ] + +If a compat process tries to execute an unknown system call above the +__ARM_NR_COMPAT_END number, the kernel sends a SIGILL signal to the +offending process. Information about the error is printed to dmesg in +compat_arm_syscall() -> arm64_notify_die() -> arm64_force_sig_fault() -> +arm64_show_signal(). + +arm64_show_signal() interprets a non-zero value for +current->thread.fault_code as an exception syndrome and displays the +message associated with the ESR_ELx.EC field (bits 31:26). +current->thread.fault_code is set in compat_arm_syscall() -> +arm64_notify_die() with the bad syscall number instead of a valid ESR_ELx +value. This means that the ESR_ELx.EC field has the value that the user set +for the syscall number and the kernel can end up printing bogus exception +messages*. For example, for the syscall number 0x68000000, which evaluates +to ESR_ELx.EC value of 0x1A (ESR_ELx_EC_FPAC) the kernel prints this error: + +[ 18.349161] syscall[300]: unhandled exception: ERET/ERETAA/ERETAB, ESR 0x68000000, Oops - bad compat syscall(2) in syscall[10000+50000] +[ 18.350639] CPU: 2 PID: 300 Comm: syscall Not tainted 5.18.0-rc1 #79 +[ 18.351249] Hardware name: Pine64 RockPro64 v2.0 (DT) +[..] + +which is misleading, as the bad compat syscall has nothing to do with +pointer authentication. + +Stop arm64_show_signal() from printing exception syndrome information by +having compat_arm_syscall() set the ESR_ELx value to 0, as it has no +meaning for an invalid system call number. The example above now becomes: + +[ 19.935275] syscall[301]: unhandled exception: Oops - bad compat syscall(2) in syscall[10000+50000] +[ 19.936124] CPU: 1 PID: 301 Comm: syscall Not tainted 5.18.0-rc1-00005-g7e08006d4102 #80 +[ 19.936894] Hardware name: Pine64 RockPro64 v2.0 (DT) +[..] + +which although shows less information because the syscall number, +wrongfully advertised as the ESR value, is missing, it is better than +showing plainly wrong information. The syscall number can be easily +obtained with strace. + +*A 32-bit value above or equal to 0x8000_0000 is interpreted as a negative +integer in compat_arm_syscal() and the condition scno < __ARM_NR_COMPAT_END +evaluates to true; the syscall will exit to userspace in this case with the +ENOSYS error code instead of arm64_notify_die() being called. + +Signed-off-by: Alexandru Elisei +Reviewed-by: Marc Zyngier +Link: https://lore.kernel.org/r/20220425114444.368693-3-alexandru.elisei@arm.com +Signed-off-by: Catalin Marinas +Signed-off-by: Sasha Levin +--- + arch/arm64/kernel/sys_compat.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/kernel/sys_compat.c b/arch/arm64/kernel/sys_compat.c +index 12c6864e51e1..df14336c3a29 100644 +--- a/arch/arm64/kernel/sys_compat.c ++++ b/arch/arm64/kernel/sys_compat.c +@@ -113,6 +113,6 @@ long compat_arm_syscall(struct pt_regs *regs, int scno) + addr = instruction_pointer(regs) - (compat_thumb_mode(regs) ? 2 : 4); + + arm64_notify_die("Oops - bad compat syscall(2)", regs, +- SIGILL, ILL_ILLTRP, addr, scno); ++ SIGILL, ILL_ILLTRP, addr, 0); + return 0; + } +-- +2.35.1 + diff --git a/queue-5.18/arm64-defconfig-reenable-sm_dispcc_8250.patch b/queue-5.18/arm64-defconfig-reenable-sm_dispcc_8250.patch new file mode 100644 index 00000000000..0d24123d462 --- /dev/null +++ b/queue-5.18/arm64-defconfig-reenable-sm_dispcc_8250.patch @@ -0,0 +1,39 @@ +From ae1ce1c5e4764ffe8eefe48931226d83b3fada2a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Apr 2022 00:59:13 +0300 +Subject: arm64: defconfig: reenable SM_DISPCC_8250 + +From: Dmitry Baryshkov + +[ Upstream commit e77817b4953dcf59a83bfab18ca5af80d9231d72 ] + +CONFIG_SM_DISPCC_8250 is not enabled by default, but it is still +necessary for the Qualcomm RB5 board. Reenable it (as it was enabled +before the commit dde8cd786e37 ("arm64: defconfig: rebuild default +configuration")). + +Cc: Marcel Ziswiler +Fixes: dde8cd786e37 ("arm64: defconfig: rebuild default configuration") +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20220404215913.1497172-1-dmitry.baryshkov@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm64/configs/defconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/configs/defconfig b/arch/arm64/configs/defconfig +index 50aa3d75ab4f..f30af6e1fe40 100644 +--- a/arch/arm64/configs/defconfig ++++ b/arch/arm64/configs/defconfig +@@ -1029,6 +1029,7 @@ CONFIG_SM_GCC_8350=y + CONFIG_SM_GCC_8450=y + CONFIG_SM_GPUCC_8150=y + CONFIG_SM_GPUCC_8250=y ++CONFIG_SM_DISPCC_8250=y + CONFIG_QCOM_HFPLL=y + CONFIG_CLK_GFM_LPASS_SM8250=m + CONFIG_CLK_RCAR_USB2_CLOCK_SEL=y +-- +2.35.1 + diff --git a/queue-5.18/arm64-dts-juno-fix-scmi-power-domain-ids-for-etf-and.patch b/queue-5.18/arm64-dts-juno-fix-scmi-power-domain-ids-for-etf-and.patch new file mode 100644 index 00000000000..c16a7d9b351 --- /dev/null +++ b/queue-5.18/arm64-dts-juno-fix-scmi-power-domain-ids-for-etf-and.patch @@ -0,0 +1,66 @@ +From e1cb4718a918e5300b8d50e4450f9ca11e6e3e01 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Apr 2022 10:35:47 +0100 +Subject: arm64: dts: juno: Fix SCMI power domain IDs for ETF and CS funnel + +From: Sudeep Holla + +[ Upstream commit 8dd3cdeaf3032728e30a7ec5e79ca780fc86cf7a ] + +The SCMI power domain ID for all the coresight components is 8 while +the previous/older SCPI domain was 0. When adding SCMI variant, couple +of instances retained SCPI domain ID by mistake. + +Fix the same by using the correct SCMI power domain ID of 8. + +Link: https://lore.kernel.org/r/20220413093547.1699535-1-sudeep.holla@arm.com +Fixes: 96bb0954860a ("arm64: dts: juno: Add separate SCMI variants") +Cc: Robin Murphy +Reported-by: Mike Leach +Acked-by: Robin Murphy +Signed-off-by: Sudeep Holla +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/arm/juno-r1-scmi.dts | 4 ++-- + arch/arm64/boot/dts/arm/juno-r2-scmi.dts | 4 ++-- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/arm64/boot/dts/arm/juno-r1-scmi.dts b/arch/arm64/boot/dts/arm/juno-r1-scmi.dts +index 190a0fba4ad6..fd1f0d26d751 100644 +--- a/arch/arm64/boot/dts/arm/juno-r1-scmi.dts ++++ b/arch/arm64/boot/dts/arm/juno-r1-scmi.dts +@@ -7,11 +7,11 @@ + }; + + etf@20140000 { +- power-domains = <&scmi_devpd 0>; ++ power-domains = <&scmi_devpd 8>; + }; + + funnel@20150000 { +- power-domains = <&scmi_devpd 0>; ++ power-domains = <&scmi_devpd 8>; + }; + }; + +diff --git a/arch/arm64/boot/dts/arm/juno-r2-scmi.dts b/arch/arm64/boot/dts/arm/juno-r2-scmi.dts +index dbf13770084f..35e6d4762c46 100644 +--- a/arch/arm64/boot/dts/arm/juno-r2-scmi.dts ++++ b/arch/arm64/boot/dts/arm/juno-r2-scmi.dts +@@ -7,11 +7,11 @@ + }; + + etf@20140000 { +- power-domains = <&scmi_devpd 0>; ++ power-domains = <&scmi_devpd 8>; + }; + + funnel@20150000 { +- power-domains = <&scmi_devpd 0>; ++ power-domains = <&scmi_devpd 8>; + }; + }; + +-- +2.35.1 + diff --git a/queue-5.18/arm64-dts-marvell-espressobin-ultra-enable-front-usb.patch b/queue-5.18/arm64-dts-marvell-espressobin-ultra-enable-front-usb.patch new file mode 100644 index 00000000000..73cb697a2b2 --- /dev/null +++ b/queue-5.18/arm64-dts-marvell-espressobin-ultra-enable-front-usb.patch @@ -0,0 +1,36 @@ +From 020b82eba13c9212520f995ad2ccc8b289fff720 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Sep 2021 19:09:19 +0200 +Subject: arm64: dts: marvell: espressobin-ultra: enable front USB3 port + +From: Robert Marko + +[ Upstream commit eacec7ebc16cf5d2f6a6c7cf5d57156da2c3e98f ] + +Espressobin Ultra has a front panel USB3.0 Type-A port which works +just fine so enable it. +I dont see a reason why it was disabled in the first place anyway. + +Fixes: 3404fe15a60f ("arm64: dts: marvell: add DT for ESPRESSObin-Ultra") +Signed-off-by: Robert Marko +Signed-off-by: Gregory CLEMENT +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/marvell/armada-3720-espressobin-ultra.dts | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/marvell/armada-3720-espressobin-ultra.dts b/arch/arm64/boot/dts/marvell/armada-3720-espressobin-ultra.dts +index 610ff6f385c7..119db6b541b7 100644 +--- a/arch/arm64/boot/dts/marvell/armada-3720-espressobin-ultra.dts ++++ b/arch/arm64/boot/dts/marvell/armada-3720-espressobin-ultra.dts +@@ -108,7 +108,6 @@ + + &usb3 { + usb-phy = <&usb3_phy>; +- status = "disabled"; + }; + + &mdio { +-- +2.35.1 + diff --git a/queue-5.18/arm64-dts-marvell-espressobin-ultra-fix-spi-nor-conf.patch b/queue-5.18/arm64-dts-marvell-espressobin-ultra-fix-spi-nor-conf.patch new file mode 100644 index 00000000000..f8053f1e2ba --- /dev/null +++ b/queue-5.18/arm64-dts-marvell-espressobin-ultra-fix-spi-nor-conf.patch @@ -0,0 +1,43 @@ +From 63fe08ef928a78bceac9452b619f6861398216da Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Sep 2021 19:09:17 +0200 +Subject: arm64: dts: marvell: espressobin-ultra: fix SPI-NOR config + +From: Robert Marko + +[ Upstream commit 5202f4c3816b42e989f9cad49a73c7e88fba89f4 ] + +SPI config for the SPI-NOR is incorrect and completely breaking +reading/writing to the onboard SPI-NOR. + +SPI-NOR is connected in the single(x1) IO mode and not in the quad +(x4) mode. +Also, there is no need to override the max frequency from the DTSI +as the mx25u3235f that is used supports 104Mhz. + +Fixes: 3404fe15a60f ("arm64: dts: marvell: add DT for ESPRESSObin-Ultra") +Signed-off-by: Robert Marko +Signed-off-by: Gregory CLEMENT +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/marvell/armada-3720-espressobin-ultra.dts | 4 ---- + 1 file changed, 4 deletions(-) + +diff --git a/arch/arm64/boot/dts/marvell/armada-3720-espressobin-ultra.dts b/arch/arm64/boot/dts/marvell/armada-3720-espressobin-ultra.dts +index c5eb3604dd5b..610ff6f385c7 100644 +--- a/arch/arm64/boot/dts/marvell/armada-3720-espressobin-ultra.dts ++++ b/arch/arm64/boot/dts/marvell/armada-3720-espressobin-ultra.dts +@@ -71,10 +71,6 @@ + + &spi0 { + flash@0 { +- spi-max-frequency = <108000000>; +- spi-rx-bus-width = <4>; +- spi-tx-bus-width = <4>; +- + partitions { + compatible = "fixed-partitions"; + #address-cells = <1>; +-- +2.35.1 + diff --git a/queue-5.18/arm64-dts-mt8192-fix-nor_flash-status-disable-typo.patch b/queue-5.18/arm64-dts-mt8192-fix-nor_flash-status-disable-typo.patch new file mode 100644 index 00000000000..e1f1b7def90 --- /dev/null +++ b/queue-5.18/arm64-dts-mt8192-fix-nor_flash-status-disable-typo.patch @@ -0,0 +1,43 @@ +From 241d36ca5e36e3f866f1a7800218d2af547981e8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Mar 2022 22:45:22 +0800 +Subject: arm64: dts: mt8192: Fix nor_flash status disable typo +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Allen-KH Cheng + +[ Upstream commit 27f0eb16b0d417c155e96b5d3b89074699944e09 ] + +Correct nor_flash status disable typo of mt8192 SoC. + +Fixes: d0a197a0d064a ("arm64: dts: mt8192: add nor_flash device node") + +Signed-off-by: Allen-KH Cheng +Reviewed-by: AngeloGioacchino Del Regno +Reviewed-by: Miles Chen +Reviewed-by: Nícolas F. R. A. Prado +Link: https://lore.kernel.org/r/20220318144534.17996-11-allen-kh.cheng@mediatek.com +Signed-off-by: Matthias Brugger +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8192.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8192.dtsi b/arch/arm64/boot/dts/mediatek/mt8192.dtsi +index 411feb294613..bcecc7484453 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8192.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8192.dtsi +@@ -679,7 +679,7 @@ + assigned-clock-parents = <&clk26m>; + #address-cells = <1>; + #size-cells = <0>; +- status = "disable"; ++ status = "disabled"; + }; + + audsys: clock-controller@11210000 { +-- +2.35.1 + diff --git a/queue-5.18/arm64-dts-qcom-msm8994-fix-blsp-12-_dma-channels-cou.patch b/queue-5.18/arm64-dts-qcom-msm8994-fix-blsp-12-_dma-channels-cou.patch new file mode 100644 index 00000000000..d6eb47b01d3 --- /dev/null +++ b/queue-5.18/arm64-dts-qcom-msm8994-fix-blsp-12-_dma-channels-cou.patch @@ -0,0 +1,45 @@ +From fc0cadaae77ab310d8f52b83a06ec552231a8703 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 19 Mar 2022 18:46:43 +0100 +Subject: arm64: dts: qcom: msm8994: Fix BLSP[12]_DMA channels count + +From: Konrad Dybcio + +[ Upstream commit 1ae438d26b620979ed004d559c304d31c42173ae ] + +MSM8994 actually features 24 DMA channels for each BLSP, +fix it! + +Signed-off-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20220319174645.340379-14-konrad.dybcio@somainline.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/msm8994.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/msm8994.dtsi b/arch/arm64/boot/dts/qcom/msm8994.dtsi +index c65618b95ce0..b1e595cb4b90 100644 +--- a/arch/arm64/boot/dts/qcom/msm8994.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8994.dtsi +@@ -498,7 +498,7 @@ + #dma-cells = <1>; + qcom,ee = <0>; + qcom,controlled-remotely; +- num-channels = <18>; ++ num-channels = <24>; + qcom,num-ees = <4>; + }; + +@@ -634,7 +634,7 @@ + #dma-cells = <1>; + qcom,ee = <0>; + qcom,controlled-remotely; +- num-channels = <18>; ++ num-channels = <24>; + qcom,num-ees = <4>; + }; + +-- +2.35.1 + diff --git a/queue-5.18/arm64-dts-qcom-msm8994-fix-the-cont_splash_mem-addre.patch b/queue-5.18/arm64-dts-qcom-msm8994-fix-the-cont_splash_mem-addre.patch new file mode 100644 index 00000000000..2af9223750d --- /dev/null +++ b/queue-5.18/arm64-dts-qcom-msm8994-fix-the-cont_splash_mem-addre.patch @@ -0,0 +1,38 @@ +From a6b0e51c384da4fb5bcd9bf1b6d2718987a737f7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 19 Mar 2022 18:46:38 +0100 +Subject: arm64: dts: qcom: msm8994: Fix the cont_splash_mem address + +From: Konrad Dybcio + +[ Upstream commit 049c46f31a726bf8d202ff1681661513447fac84 ] + +The default memory map places cont_splash_mem at 3401000, which was +overlooked.. Fix it! + +Signed-off-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20220319174645.340379-9-konrad.dybcio@somainline.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/msm8994.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/msm8994.dtsi b/arch/arm64/boot/dts/qcom/msm8994.dtsi +index 8c1dc5155b71..c65618b95ce0 100644 +--- a/arch/arm64/boot/dts/qcom/msm8994.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8994.dtsi +@@ -183,8 +183,8 @@ + no-map; + }; + +- cont_splash_mem: memory@3800000 { +- reg = <0 0x03800000 0 0x2400000>; ++ cont_splash_mem: memory@3401000 { ++ reg = <0 0x03401000 0 0x2200000>; + no-map; + }; + +-- +2.35.1 + diff --git a/queue-5.18/arm64-dts-qcom-qrb5165-rb5-fix-can-clock-node-name.patch b/queue-5.18/arm64-dts-qcom-qrb5165-rb5-fix-can-clock-node-name.patch new file mode 100644 index 00000000000..ff4385f3485 --- /dev/null +++ b/queue-5.18/arm64-dts-qcom-qrb5165-rb5-fix-can-clock-node-name.patch @@ -0,0 +1,38 @@ +From bb80736b7c7acb945455563333902ca067441129 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Apr 2022 13:05:02 +0530 +Subject: arm64: dts: qcom: qrb5165-rb5: Fix can-clock node name + +From: Vinod Koul + +[ Upstream commit 1eae95fb1d696968ca72be3ac8e0d62bb4d8da42 ] + +Per DT spec node names should not have underscores (_) in them, so +change can_clock to can-clock. + +Fixes: 5c44c564e449 ("arm64: dts: qcom: qrb5165-rb5: Add support for MCP2518FD") +Signed-off-by: Vinod Koul +Acked-by: Krzysztof Kozlowski +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20220421073502.1824089-1-vkoul@kernel.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/qrb5165-rb5.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/qrb5165-rb5.dts b/arch/arm64/boot/dts/qcom/qrb5165-rb5.dts +index 845eb7a6bf92..0e63f707b911 100644 +--- a/arch/arm64/boot/dts/qcom/qrb5165-rb5.dts ++++ b/arch/arm64/boot/dts/qcom/qrb5165-rb5.dts +@@ -29,7 +29,7 @@ + }; + + /* Fixed crystal oscillator dedicated to MCP2518FD */ +- clk40M: can_clock { ++ clk40M: can-clock { + compatible = "fixed-clock"; + #clock-cells = <0>; + clock-frequency = <40000000>; +-- +2.35.1 + diff --git a/queue-5.18/arm64-dts-qcom-sc7280-fix-sar1_irq_odl-node-name.patch b/queue-5.18/arm64-dts-qcom-sc7280-fix-sar1_irq_odl-node-name.patch new file mode 100644 index 00000000000..8dae5faadbc --- /dev/null +++ b/queue-5.18/arm64-dts-qcom-sc7280-fix-sar1_irq_odl-node-name.patch @@ -0,0 +1,43 @@ +From 49456aea085887c812d3fdef036372cf083c3a28 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Mar 2022 15:33:31 -0700 +Subject: arm64: dts: qcom: sc7280: Fix sar1_irq_odl node name + +From: Stephen Boyd + +[ Upstream commit f31c834d3976652753f39eb319170c8c4ac3ce55 ] + +This node should be named sar1-irq-odl, not sar0-irq-odl. Otherwise +we'll overwrite the settings for sar0 with what is intended for sar1, +leading to probe failures for sar1 that are quite confusing. + +Fixes: 116f7cc43d28 ("arm64: dts: qcom: sc7280: Add herobrine-r1") +Cc: Douglas Anderson +Cc: Matthias Kaehlcke +Signed-off-by: Stephen Boyd +Reviewed-by: Matthias Kaehlcke +Tested-by: Matthias Kaehlcke +Reviewed-by: Douglas Anderson +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20220324223331.876199-1-swboyd@chromium.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sc7280-herobrine.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/sc7280-herobrine.dtsi b/arch/arm64/boot/dts/qcom/sc7280-herobrine.dtsi +index dc17f2079695..7b8fe20afcea 100644 +--- a/arch/arm64/boot/dts/qcom/sc7280-herobrine.dtsi ++++ b/arch/arm64/boot/dts/qcom/sc7280-herobrine.dtsi +@@ -741,7 +741,7 @@ ap_ec_spi: &spi10 { + bias-pull-up; + }; + +- sar1_irq_odl: sar0-irq-odl { ++ sar1_irq_odl: sar1-irq-odl { + pins = "gpio140"; + function = "gpio"; + bias-pull-up; +-- +2.35.1 + diff --git a/queue-5.18/arm64-dts-qcom-sc7280-herobrine-drop-outputs-on-fpmc.patch b/queue-5.18/arm64-dts-qcom-sc7280-herobrine-drop-outputs-on-fpmc.patch new file mode 100644 index 00000000000..d32ae7d8a3a --- /dev/null +++ b/queue-5.18/arm64-dts-qcom-sc7280-herobrine-drop-outputs-on-fpmc.patch @@ -0,0 +1,60 @@ +From 21bbe1db24c109c1e441080d1271ee0d92268b27 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Mar 2022 18:06:39 -0700 +Subject: arm64: dts: qcom: sc7280-herobrine: Drop outputs on fpmcu pins + +From: Stephen Boyd + +[ Upstream commit dbcbeed94f3b6f7f24349a7f335cc603a682e7a7 ] + +Having these pins with outputs is good on a fresh boot because it puts +the boot and reset pins in a known "good" state. Unfortunately, that +conflicts with the fingerprint firmware flashing code. The firmware +flashing process binds and unbinds the cros-ec and spidev drivers and +that reapplies the pin output values after the flashing code has +overridden the gpio values. This causes a problem because we try to put +the device into bootloader mode, bind the spidev driver and that +inadvertently puts it right back into normal boot mode, breaking the +flashing process. + +Fix this by removing the outputs. We'll introduce a binding for +fingerprint cros-ec specifically to set the gpios properly via gpio APIs +during cros-ec driver probe instead. + +Cc: Douglas Anderson +Cc: Matthias Kaehlcke +Cc: Alexandru M Stan +Fixes: 116f7cc43d28 ("arm64: dts: qcom: sc7280: Add herobrine-r1") +Signed-off-by: Stephen Boyd +Reviewed-by: Douglas Anderson +Reviewed-by: Matthias Kaehlcke +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20220317010640.2498502-2-swboyd@chromium.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sc7280-herobrine.dtsi | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sc7280-herobrine.dtsi b/arch/arm64/boot/dts/qcom/sc7280-herobrine.dtsi +index 7b8fe20afcea..488caa48cba3 100644 +--- a/arch/arm64/boot/dts/qcom/sc7280-herobrine.dtsi ++++ b/arch/arm64/boot/dts/qcom/sc7280-herobrine.dtsi +@@ -677,7 +677,6 @@ ap_ec_spi: &spi10 { + function = "gpio"; + bias-disable; + drive-strength = <2>; +- output-high; + }; + + fp_to_ap_irq_l: fp-to-ap-irq-l { +@@ -691,7 +690,6 @@ ap_ec_spi: &spi10 { + pins = "gpio68"; + function = "gpio"; + bias-disable; +- output-low; + }; + + gsc_ap_int_odl: gsc-ap-int-odl { +-- +2.35.1 + diff --git a/queue-5.18/arm64-dts-qcom-sc7280-idp-configure-cts-pin-to-bias-.patch b/queue-5.18/arm64-dts-qcom-sc7280-idp-configure-cts-pin-to-bias-.patch new file mode 100644 index 00000000000..82c0d72c5a2 --- /dev/null +++ b/queue-5.18/arm64-dts-qcom-sc7280-idp-configure-cts-pin-to-bias-.patch @@ -0,0 +1,63 @@ +From 31f76b67f9206e38b52d843403771a9d80a22978 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Apr 2022 21:26:06 +0530 +Subject: arm64: dts: qcom: sc7280-idp: Configure CTS pin to bias-bus-hold for + bluetooth + +From: Vijaya Krishna Nivarthi + +[ Upstream commit 497b272759986af1aa5a25b5e903d082c67bd8f6 ] + +WLAN rail was leaking power during RBSC/sleep even after turning BT off. +Change active and sleep pinctrl configurations to handle same. + +Signed-off-by: Vijaya Krishna Nivarthi +Reviewed-by: Douglas Anderson +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/1650556567-4995-2-git-send-email-quic_vnivarth@quicinc.com +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sc7280-idp.dtsi | 18 ++++++++++++------ + 1 file changed, 12 insertions(+), 6 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sc7280-idp.dtsi b/arch/arm64/boot/dts/qcom/sc7280-idp.dtsi +index ecbf2b89d896..5ab3696af354 100644 +--- a/arch/arm64/boot/dts/qcom/sc7280-idp.dtsi ++++ b/arch/arm64/boot/dts/qcom/sc7280-idp.dtsi +@@ -400,10 +400,13 @@ + + &qup_uart7_cts { + /* +- * Configure a pull-down on CTS to match the pull of +- * the Bluetooth module. ++ * Configure a bias-bus-hold on CTS to lower power ++ * usage when Bluetooth is turned off. Bus hold will ++ * maintain a low power state regardless of whether ++ * the Bluetooth module drives the pin in either ++ * direction or leaves the pin fully unpowered. + */ +- bias-pull-down; ++ bias-bus-hold; + }; + + &qup_uart7_rts { +@@ -495,10 +498,13 @@ + pins = "gpio28"; + function = "gpio"; + /* +- * Configure a pull-down on CTS to match the pull of +- * the Bluetooth module. ++ * Configure a bias-bus-hold on CTS to lower power ++ * usage when Bluetooth is turned off. Bus hold will ++ * maintain a low power state regardless of whether ++ * the Bluetooth module drives the pin in either ++ * direction or leaves the pin fully unpowered. + */ +- bias-pull-down; ++ bias-bus-hold; + }; + + qup_uart7_sleep_rts: qup-uart7-sleep-rts { +-- +2.35.1 + diff --git a/queue-5.18/arm64-dts-qcom-sc7280-qcard-configure-cts-pin-to-bia.patch b/queue-5.18/arm64-dts-qcom-sc7280-qcard-configure-cts-pin-to-bia.patch new file mode 100644 index 00000000000..bce731e4aa6 --- /dev/null +++ b/queue-5.18/arm64-dts-qcom-sc7280-qcard-configure-cts-pin-to-bia.patch @@ -0,0 +1,63 @@ +From 7078bfb50a6698d4c67858606d79c8c6703ea223 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Apr 2022 21:26:07 +0530 +Subject: arm64: dts: qcom: sc7280-qcard: Configure CTS pin to bias-bus-hold + for bluetooth + +From: Vijaya Krishna Nivarthi + +[ Upstream commit 3d0e375bae55c2dfa6dd0762f45ad71f0b192f71 ] + +WLAN rail was leaking power during RBSC/sleep even after turning BT off. +Change active and sleep pinctrl configurations to handle same. + +Signed-off-by: Vijaya Krishna Nivarthi +Reviewed-by: Douglas Anderson +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/1650556567-4995-3-git-send-email-quic_vnivarth@quicinc.com +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sc7280-qcard.dtsi | 19 ++++++++++++++----- + 1 file changed, 14 insertions(+), 5 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sc7280-qcard.dtsi b/arch/arm64/boot/dts/qcom/sc7280-qcard.dtsi +index b833ba1e8f4a..98b5cd70bca5 100644 +--- a/arch/arm64/boot/dts/qcom/sc7280-qcard.dtsi ++++ b/arch/arm64/boot/dts/qcom/sc7280-qcard.dtsi +@@ -398,8 +398,14 @@ mos_bt_uart: &uart7 { + + /* For mos_bt_uart */ + &qup_uart7_cts { +- /* Configure a pull-down on CTS to match the pull of the Bluetooth module. */ +- bias-pull-down; ++ /* ++ * Configure a bias-bus-hold on CTS to lower power ++ * usage when Bluetooth is turned off. Bus hold will ++ * maintain a low power state regardless of whether ++ * the Bluetooth module drives the pin in either ++ * direction or leaves the pin fully unpowered. ++ */ ++ bias-bus-hold; + }; + + /* For mos_bt_uart */ +@@ -490,10 +496,13 @@ mos_bt_uart: &uart7 { + pins = "gpio28"; + function = "gpio"; + /* +- * Configure a pull-down on CTS to match the pull of +- * the Bluetooth module. ++ * Configure a bias-bus-hold on CTS to lower power ++ * usage when Bluetooth is turned off. Bus hold will ++ * maintain a low power state regardless of whether ++ * the Bluetooth module drives the pin in either ++ * direction or leaves the pin fully unpowered. + */ +- bias-pull-down; ++ bias-bus-hold; + }; + + /* For mos_bt_uart */ +-- +2.35.1 + diff --git a/queue-5.18/arm64-dts-qcom-sdm845-xiaomi-beryllium-fix-typo-in-p.patch b/queue-5.18/arm64-dts-qcom-sdm845-xiaomi-beryllium-fix-typo-in-p.patch new file mode 100644 index 00000000000..1b290aeac44 --- /dev/null +++ b/queue-5.18/arm64-dts-qcom-sdm845-xiaomi-beryllium-fix-typo-in-p.patch @@ -0,0 +1,37 @@ +From fb1d538ece70bebaf45ed77bba16fe125263fc6a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Mar 2022 12:15:04 +0530 +Subject: arm64: dts: qcom: sdm845-xiaomi-beryllium: fix typo in panel's + vddio-supply property + +From: Joel Selvaraj + +[ Upstream commit 1f1c494082a1f10d03ce4ee1485ee96d212e22ff ] + +vddio is misspelled with a "0" instead of "o". Fix it. + +Signed-off-by: Joel Selvaraj +Reviewed-by: Caleb Connolly +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/BY5PR02MB7009901651E6A8D5ACB0425ED91F9@BY5PR02MB7009.namprd02.prod.outlook.com +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sdm845-xiaomi-beryllium.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/sdm845-xiaomi-beryllium.dts b/arch/arm64/boot/dts/qcom/sdm845-xiaomi-beryllium.dts +index 367389526b41..a97f5e89e1d0 100644 +--- a/arch/arm64/boot/dts/qcom/sdm845-xiaomi-beryllium.dts ++++ b/arch/arm64/boot/dts/qcom/sdm845-xiaomi-beryllium.dts +@@ -218,7 +218,7 @@ + panel@0 { + compatible = "tianma,fhd-video"; + reg = <0>; +- vddi0-supply = <&vreg_l14a_1p8>; ++ vddio-supply = <&vreg_l14a_1p8>; + vddpos-supply = <&lab>; + vddneg-supply = <&ibb>; + +-- +2.35.1 + diff --git a/queue-5.18/arm64-dts-qcom-sm8450-fix-missing-iommus-for-qup.patch b/queue-5.18/arm64-dts-qcom-sm8450-fix-missing-iommus-for-qup.patch new file mode 100644 index 00000000000..2382aa73ca9 --- /dev/null +++ b/queue-5.18/arm64-dts-qcom-sm8450-fix-missing-iommus-for-qup.patch @@ -0,0 +1,40 @@ +From cff3b39721799f70a1a588ce85e8b99329c12822 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Apr 2022 15:46:25 +0530 +Subject: arm64: dts: qcom: sm8450: Fix missing iommus for qup + +From: Vinod Koul + +[ Upstream commit 488922c1a372579bf2caf40933e7459e3c86276f ] + +qupv3_id_0 was missing iommus property which cause any dma transaction +to fail and board crash. So add the missing iommus. + +While at it also add interconnect nodes for qup + +Fixes: 5188049c9b36 ("arm64: dts: qcom: Add base SM8450 DTSI") +Signed-off-by: Vinod Koul +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20220414101630.1189052-3-vkoul@kernel.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sm8450.dtsi | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/arch/arm64/boot/dts/qcom/sm8450.dtsi b/arch/arm64/boot/dts/qcom/sm8450.dtsi +index 934e29b9e153..5facb4a5bf63 100644 +--- a/arch/arm64/boot/dts/qcom/sm8450.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm8450.dtsi +@@ -693,6 +693,9 @@ + clock-names = "m-ahb", "s-ahb"; + clocks = <&gcc GCC_QUPV3_WRAP_0_M_AHB_CLK>, + <&gcc GCC_QUPV3_WRAP_0_S_AHB_CLK>; ++ iommus = <&apps_smmu 0x5a3 0x0>; ++ interconnects = <&clk_virt MASTER_QUP_CORE_0 0 &clk_virt SLAVE_QUP_CORE_0 0>; ++ interconnect-names = "qup-core"; + #address-cells = <2>; + #size-cells = <2>; + ranges; +-- +2.35.1 + diff --git a/queue-5.18/arm64-dts-qcom-sm8450-fix-missing-iommus-for-qup1.patch b/queue-5.18/arm64-dts-qcom-sm8450-fix-missing-iommus-for-qup1.patch new file mode 100644 index 00000000000..409a0eb01a7 --- /dev/null +++ b/queue-5.18/arm64-dts-qcom-sm8450-fix-missing-iommus-for-qup1.patch @@ -0,0 +1,38 @@ +From f0c40967f98c972f421e4d39aa4c849387d6ad60 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Apr 2022 15:46:29 +0530 +Subject: arm64: dts: qcom: sm8450: Fix missing iommus for qup1 + +From: Vinod Koul + +[ Upstream commit 67ebdc6dd1e2049fd9620f0572bc81a809afbe24 ] + +qupv3_id_1 was missing iommus property which cause any dma transaction +to fail and board crash. So add the missing iommus. + +Fixes: 5188049c9b36 ("arm64: dts: qcom: Add base SM8450 DTSI") +Signed-off-by: Vinod Koul +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20220414101630.1189052-7-vkoul@kernel.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sm8450.dtsi | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/arch/arm64/boot/dts/qcom/sm8450.dtsi b/arch/arm64/boot/dts/qcom/sm8450.dtsi +index 5facb4a5bf63..e63b7b0458cf 100644 +--- a/arch/arm64/boot/dts/qcom/sm8450.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm8450.dtsi +@@ -721,6 +721,9 @@ + clock-names = "m-ahb", "s-ahb"; + clocks = <&gcc GCC_QUPV3_WRAP_1_M_AHB_CLK>, + <&gcc GCC_QUPV3_WRAP_1_S_AHB_CLK>; ++ iommus = <&apps_smmu 0x43 0x0>; ++ interconnects = <&clk_virt MASTER_QUP_CORE_1 0 &clk_virt SLAVE_QUP_CORE_1 0>; ++ interconnect-names = "qup-core"; + #address-cells = <2>; + #size-cells = <2>; + ranges; +-- +2.35.1 + diff --git a/queue-5.18/arm64-dts-rockchip-move-drive-impedance-ohm-to-emmc-.patch b/queue-5.18/arm64-dts-rockchip-move-drive-impedance-ohm-to-emmc-.patch new file mode 100644 index 00000000000..bb35610a36f --- /dev/null +++ b/queue-5.18/arm64-dts-rockchip-move-drive-impedance-ohm-to-emmc-.patch @@ -0,0 +1,43 @@ +From 74afb05f81edc43d10ec17c5ec62fbb56bf88c52 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Mar 2022 17:27:06 +0800 +Subject: arm64: dts: rockchip: Move drive-impedance-ohm to emmc phy on rk3399 + +From: Shawn Lin + +[ Upstream commit 4246d0bab2a8685e3d4aec2cb0ef8c526689ce96 ] + +drive-impedance-ohm is introduced for emmc phy instead of pcie phy. + +Fixes: fb8b7460c995 ("arm64: dts: rockchip: Define drive-impedance-ohm for RK3399's emmc-phy.") +Signed-off-by: Shawn Lin +Link: https://lore.kernel.org/r/1647336426-154797-1-git-send-email-shawn.lin@rock-chips.com +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3399.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3399.dtsi b/arch/arm64/boot/dts/rockchip/rk3399.dtsi +index 080457a68e3c..88f26d89eea1 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3399.dtsi +@@ -1534,6 +1534,7 @@ + reg = <0xf780 0x24>; + clocks = <&sdhci>; + clock-names = "emmcclk"; ++ drive-impedance-ohm = <50>; + #phy-cells = <0>; + status = "disabled"; + }; +@@ -1544,7 +1545,6 @@ + clock-names = "refclk"; + #phy-cells = <1>; + resets = <&cru SRST_PCIEPHY>; +- drive-impedance-ohm = <50>; + reset-names = "phy"; + status = "disabled"; + }; +-- +2.35.1 + diff --git a/queue-5.18/arm64-dts-ti-k3-am64-mcu-remove-incorrect-uart-base-.patch b/queue-5.18/arm64-dts-ti-k3-am64-mcu-remove-incorrect-uart-base-.patch new file mode 100644 index 00000000000..225ee64d0b0 --- /dev/null +++ b/queue-5.18/arm64-dts-ti-k3-am64-mcu-remove-incorrect-uart-base-.patch @@ -0,0 +1,50 @@ +From 95078f5d6b0b4e4d88c806b50fe599b0f661410f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Apr 2022 09:51:57 +0200 +Subject: arm64: dts: ti: k3-am64-mcu: remove incorrect UART base clock rates + +From: Matthias Schiffer + +[ Upstream commit 439677d416b17dd39964d5f7d64b742a2e51da5b ] + +We found that (at least some versions of) the sci-fw set the base clock +rate for UARTs in the MCU domain to 96 MHz instead of the expected 48 MHz, +leading to incorrect baud rates when used from Linux. + +As the 8250_omap driver will query the actual clock rate from the clk +driver when clock-frequency is unset, removing the incorrect property is +sufficient to fix the baud rate. + +Fixes: 8abae9389bdb ("arm64: dts: ti: Add support for AM642 SoC") +Signed-off-by: Matthias Schiffer +Signed-off-by: Vignesh Raghavendra +Reviewed-by: Vignesh Raghavendra +Link: https://lore.kernel.org/r/20220419075157.189347-1-matthias.schiffer@ew.tq-group.com +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/ti/k3-am64-mcu.dtsi | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/ti/k3-am64-mcu.dtsi b/arch/arm64/boot/dts/ti/k3-am64-mcu.dtsi +index 2bb5c9ff172c..02d4285acbb8 100644 +--- a/arch/arm64/boot/dts/ti/k3-am64-mcu.dtsi ++++ b/arch/arm64/boot/dts/ti/k3-am64-mcu.dtsi +@@ -10,7 +10,6 @@ + compatible = "ti,am64-uart", "ti,am654-uart"; + reg = <0x00 0x04a00000 0x00 0x100>; + interrupts = ; +- clock-frequency = <48000000>; + current-speed = <115200>; + power-domains = <&k3_pds 149 TI_SCI_PD_EXCLUSIVE>; + clocks = <&k3_clks 149 0>; +@@ -21,7 +20,6 @@ + compatible = "ti,am64-uart", "ti,am654-uart"; + reg = <0x00 0x04a10000 0x00 0x100>; + interrupts = ; +- clock-frequency = <48000000>; + current-speed = <115200>; + power-domains = <&k3_pds 160 TI_SCI_PD_EXCLUSIVE>; + clocks = <&k3_clks 160 0>; +-- +2.35.1 + diff --git a/queue-5.18/arm64-fix-types-in-copy_highpage.patch b/queue-5.18/arm64-fix-types-in-copy_highpage.patch new file mode 100644 index 00000000000..2d38bbac782 --- /dev/null +++ b/queue-5.18/arm64-fix-types-in-copy_highpage.patch @@ -0,0 +1,50 @@ +From 57b350d8966f66c32a755966c39c8db7ad74ad0f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Apr 2022 03:04:13 +0000 +Subject: arm64: fix types in copy_highpage() + +From: Tong Tiangen + +[ Upstream commit 921d161f15d6b090599f6a8c23f131969edbd1fa ] + +In copy_highpage() the `kto` and `kfrom` local variables are pointers to +struct page, but these are used to hold arbitrary pointers to kernel memory +. Each call to page_address() returns a void pointer to memory associated +with the relevant page, and copy_page() expects void pointers to this +memory. + +This inconsistency was introduced in commit 2563776b41c3 ("arm64: mte: +Tags-aware copy_{user_,}highpage() implementations") and while this +doesn't appear to be harmful in practice it is clearly wrong. + +Correct this by making `kto` and `kfrom` void pointers. + +Fixes: 2563776b41c3 ("arm64: mte: Tags-aware copy_{user_,}highpage() implementations") +Signed-off-by: Tong Tiangen +Acked-by: Mark Rutland +Reviewed-by: Kefeng Wang +Link: https://lore.kernel.org/r/20220420030418.3189040-3-tongtiangen@huawei.com +Signed-off-by: Catalin Marinas +Signed-off-by: Sasha Levin +--- + arch/arm64/mm/copypage.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/mm/copypage.c b/arch/arm64/mm/copypage.c +index b5447e53cd73..0dea80bf6de4 100644 +--- a/arch/arm64/mm/copypage.c ++++ b/arch/arm64/mm/copypage.c +@@ -16,8 +16,8 @@ + + void copy_highpage(struct page *to, struct page *from) + { +- struct page *kto = page_address(to); +- struct page *kfrom = page_address(from); ++ void *kto = page_address(to); ++ void *kfrom = page_address(from); + + copy_page(kto, kfrom); + +-- +2.35.1 + diff --git a/queue-5.18/arm64-stackleak-fix-current_top_of_stack.patch b/queue-5.18/arm64-stackleak-fix-current_top_of_stack.patch new file mode 100644 index 00000000000..b78017f4ce0 --- /dev/null +++ b/queue-5.18/arm64-stackleak-fix-current_top_of_stack.patch @@ -0,0 +1,106 @@ +From 01ec6c49c65340c2924302aee5fa22572b86942c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Apr 2022 18:31:16 +0100 +Subject: arm64: stackleak: fix current_top_of_stack() + +From: Mark Rutland + +[ Upstream commit e85094c31ddb794ac41c299a5a7a68243148f829 ] + +Due to some historical confusion, arm64's current_top_of_stack() isn't +what the stackleak code expects. This could in theory result in a number +of problems, and practically results in an unnecessary performance hit. +We can avoid this by aligning the arm64 implementation with the x86 +implementation. + +The arm64 implementation of current_top_of_stack() was added +specifically for stackleak in commit: + + 0b3e336601b82c6a ("arm64: Add support for STACKLEAK gcc plugin") + +This was intended to be equivalent to the x86 implementation, but the +implementation, semantics, and performance characteristics differ +wildly: + +* On x86, current_top_of_stack() returns the top of the current task's + task stack, regardless of which stack is in active use. + + The implementation accesses a percpu variable which the x86 entry code + maintains, and returns the location immediately above the pt_regs on + the task stack (above which x86 has some padding). + +* On arm64 current_top_of_stack() returns the top of the stack in active + use (i.e. the one which is currently being used). + + The implementation checks the SP against a number of + potentially-accessible stacks, and will BUG() if no stack is found. + +The core stackleak_erase() code determines the upper bound of stack to +erase with: + +| if (on_thread_stack()) +| boundary = current_stack_pointer; +| else +| boundary = current_top_of_stack(); + +On arm64 stackleak_erase() is always called on a task stack, and +on_thread_stack() should always be true. On x86, stackleak_erase() is +mostly called on a trampoline stack, and is sometimes called on a task +stack. + +Currently, this results in a lot of unnecessary code being generated for +arm64 for the impossible !on_thread_stack() case. Some of this is +inlined, bloating stackleak_erase(), while portions of this are left +out-of-line and permitted to be instrumented (which would be a +functional problem if that code were reachable). + +As a first step towards improving this, this patch aligns arm64's +implementation of current_top_of_stack() with x86's, always returning +the top of the current task's stack. With GCC 11.1.0 this results in the +bulk of the unnecessary code being removed, including all of the +out-of-line instrumentable code. + +While I don't believe there's a functional problem in practice I've +marked this as a fix since the semantic was clearly wrong, the fix +itself is simple, and other code might rely upon this in future. + +Fixes: 0b3e336601b82c6a ("arm64: Add support for STACKLEAK gcc plugin") +Signed-off-by: Mark Rutland +Cc: Alexander Popov +Cc: Andrew Morton +Cc: Andy Lutomirski +Cc: Catalin Marinas +Cc: Kees Cook +Cc: Will Deacon +Acked-by: Catalin Marinas +Signed-off-by: Kees Cook +Link: https://lore.kernel.org/r/20220427173128.2603085-2-mark.rutland@arm.com +Signed-off-by: Sasha Levin +--- + arch/arm64/include/asm/processor.h | 10 ++++------ + 1 file changed, 4 insertions(+), 6 deletions(-) + +diff --git a/arch/arm64/include/asm/processor.h b/arch/arm64/include/asm/processor.h +index 73e38d9a540c..6b1a12c23fe7 100644 +--- a/arch/arm64/include/asm/processor.h ++++ b/arch/arm64/include/asm/processor.h +@@ -381,12 +381,10 @@ long get_tagged_addr_ctrl(struct task_struct *task); + * of header definitions for the use of task_stack_page. + */ + +-#define current_top_of_stack() \ +-({ \ +- struct stack_info _info; \ +- BUG_ON(!on_accessible_stack(current, current_stack_pointer, 1, &_info)); \ +- _info.high; \ +-}) ++/* ++ * The top of the current task's task stack ++ */ ++#define current_top_of_stack() ((unsigned long)current->stack + THREAD_SIZE) + #define on_thread_stack() (on_task_stack(current, current_stack_pointer, 1, NULL)) + + #endif /* __ASSEMBLY__ */ +-- +2.35.1 + diff --git a/queue-5.18/asoc-amd-add-driver-data-to-acp6x-machine-driver.patch b/queue-5.18/asoc-amd-add-driver-data-to-acp6x-machine-driver.patch new file mode 100644 index 00000000000..926778fcdfc --- /dev/null +++ b/queue-5.18/asoc-amd-add-driver-data-to-acp6x-machine-driver.patch @@ -0,0 +1,184 @@ +From 7685fac9a0be3ba0cffb075a5c0ec9ad3092ed64 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Apr 2022 08:45:31 -0500 +Subject: ASoC: amd: Add driver data to acp6x machine driver + +From: Mario Limonciello + +[ Upstream commit e521f087780d07731e8c950f2f34d08358c86bc9 ] + +Currently all of the quirked systems use the same card and so the +DMI quirk list doesn't contain driver data. + +Add driver data to these quirks and then check the data was present +or not. This will allow potentially setting quirks for systems with +faulty firmware that claims to have a DMIC but doesn't really. + +Signed-off-by: Mario Limonciello +Link: https://lore.kernel.org/r/20220411134532.13538-2-mario.limonciello@amd.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/amd/yc/acp6x-mach.c | 29 +++++++++++++++++++++++++---- + 1 file changed, 25 insertions(+), 4 deletions(-) + +diff --git a/sound/soc/amd/yc/acp6x-mach.c b/sound/soc/amd/yc/acp6x-mach.c +index 9a767f47b89f..959b70e8baf2 100644 +--- a/sound/soc/amd/yc/acp6x-mach.c ++++ b/sound/soc/amd/yc/acp6x-mach.c +@@ -45,108 +45,126 @@ static struct snd_soc_card acp6x_card = { + + static const struct dmi_system_id yc_acp_quirk_table[] = { + { ++ .driver_data = &acp6x_card, + .matches = { + DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), + DMI_MATCH(DMI_PRODUCT_NAME, "21D2"), + } + }, + { ++ .driver_data = &acp6x_card, + .matches = { + DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), + DMI_MATCH(DMI_PRODUCT_NAME, "21D3"), + } + }, + { ++ .driver_data = &acp6x_card, + .matches = { + DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), + DMI_MATCH(DMI_PRODUCT_NAME, "21D4"), + } + }, + { ++ .driver_data = &acp6x_card, + .matches = { + DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), + DMI_MATCH(DMI_PRODUCT_NAME, "21D5"), + } + }, + { ++ .driver_data = &acp6x_card, + .matches = { + DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), + DMI_MATCH(DMI_PRODUCT_NAME, "21CF"), + } + }, + { ++ .driver_data = &acp6x_card, + .matches = { + DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), + DMI_MATCH(DMI_PRODUCT_NAME, "21CG"), + } + }, + { ++ .driver_data = &acp6x_card, + .matches = { + DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), + DMI_MATCH(DMI_PRODUCT_NAME, "21CQ"), + } + }, + { ++ .driver_data = &acp6x_card, + .matches = { + DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), + DMI_MATCH(DMI_PRODUCT_NAME, "21CR"), + } + }, + { ++ .driver_data = &acp6x_card, + .matches = { + DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), + DMI_MATCH(DMI_PRODUCT_NAME, "21AW"), + } + }, + { ++ .driver_data = &acp6x_card, + .matches = { + DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), + DMI_MATCH(DMI_PRODUCT_NAME, "21AX"), + } + }, + { ++ .driver_data = &acp6x_card, + .matches = { + DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), + DMI_MATCH(DMI_PRODUCT_NAME, "21BN"), + } + }, + { ++ .driver_data = &acp6x_card, + .matches = { + DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), + DMI_MATCH(DMI_PRODUCT_NAME, "21BQ"), + } + }, + { ++ .driver_data = &acp6x_card, + .matches = { + DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), + DMI_MATCH(DMI_PRODUCT_NAME, "21CH"), + } + }, + { ++ .driver_data = &acp6x_card, + .matches = { + DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), + DMI_MATCH(DMI_PRODUCT_NAME, "21CJ"), + } + }, + { ++ .driver_data = &acp6x_card, + .matches = { + DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), + DMI_MATCH(DMI_PRODUCT_NAME, "21CK"), + } + }, + { ++ .driver_data = &acp6x_card, + .matches = { + DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), + DMI_MATCH(DMI_PRODUCT_NAME, "21CL"), + } + }, + { ++ .driver_data = &acp6x_card, + .matches = { + DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), + DMI_MATCH(DMI_PRODUCT_NAME, "21D8"), + } + }, + { ++ .driver_data = &acp6x_card, + .matches = { + DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), + DMI_MATCH(DMI_PRODUCT_NAME, "21D9"), +@@ -157,18 +175,21 @@ static const struct dmi_system_id yc_acp_quirk_table[] = { + + static int acp6x_probe(struct platform_device *pdev) + { ++ const struct dmi_system_id *dmi_id; + struct acp6x_pdm *machine = NULL; + struct snd_soc_card *card; + int ret; +- const struct dmi_system_id *dmi_id; + ++ /* check for any DMI overrides */ + dmi_id = dmi_first_match(yc_acp_quirk_table); +- if (!dmi_id) ++ if (dmi_id) ++ platform_set_drvdata(pdev, dmi_id->driver_data); ++ ++ card = platform_get_drvdata(pdev); ++ if (!card) + return -ENODEV; +- card = &acp6x_card; + acp6x_card.dev = &pdev->dev; + +- platform_set_drvdata(pdev, card); + snd_soc_card_set_drvdata(card, machine); + ret = devm_snd_soc_register_card(&pdev->dev, card); + if (ret) { +-- +2.35.1 + diff --git a/queue-5.18/asoc-atmel-classd-remove-endianness-flag-on-class-d-.patch b/queue-5.18/asoc-atmel-classd-remove-endianness-flag-on-class-d-.patch new file mode 100644 index 00000000000..b4c7334194d --- /dev/null +++ b/queue-5.18/asoc-atmel-classd-remove-endianness-flag-on-class-d-.patch @@ -0,0 +1,44 @@ +From b928b60cf0b90c758af68a59a809ce66f08bd463 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 May 2022 18:08:30 +0100 +Subject: ASoC: atmel-classd: Remove endianness flag on class d component + +From: Charles Keepax + +[ Upstream commit 0104d52a6a69b06b0e8167f7c1247e8c76aca070 ] + +The endianness flag should have been removed when the driver was +ported across from having both a CODEC and CPU side component, to +just having a CPU component and using the dummy for the CODEC. The +endianness flag is used to indicate that the device is completely +ambivalent to the endianness of the data, typically due to the +endianness being lost over the hardware link (ie. the link defines +bit ordering). It's usage didn't have any effect when the driver +had both a CPU and CODEC component, since the union of those equals +the CPU side settings, but now causes the driver to falsely report +it supports big endian. Correct this by removing the flag. + +Fixes: 1dfdbe73ccf9 ("ASoC: atmel-classd: remove codec component") +Signed-off-by: Charles Keepax +Link: https://lore.kernel.org/r/20220504170905.332415-4-ckeepax@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/atmel/atmel-classd.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/sound/soc/atmel/atmel-classd.c b/sound/soc/atmel/atmel-classd.c +index a9f9f449c48c..74b7b2611aa7 100644 +--- a/sound/soc/atmel/atmel-classd.c ++++ b/sound/soc/atmel/atmel-classd.c +@@ -458,7 +458,6 @@ static const struct snd_soc_component_driver atmel_classd_cpu_dai_component = { + .num_controls = ARRAY_SIZE(atmel_classd_snd_controls), + .idle_bias_on = 1, + .use_pmdown_time = 1, +- .endianness = 1, + }; + + /* ASoC sound card */ +-- +2.35.1 + diff --git a/queue-5.18/asoc-atmel-pdmic-remove-endianness-flag-on-pdmic-com.patch b/queue-5.18/asoc-atmel-pdmic-remove-endianness-flag-on-pdmic-com.patch new file mode 100644 index 00000000000..1fbae9a447b --- /dev/null +++ b/queue-5.18/asoc-atmel-pdmic-remove-endianness-flag-on-pdmic-com.patch @@ -0,0 +1,44 @@ +From be8e958d41bc028d12a807c43f06317a15daf3df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 May 2022 18:08:29 +0100 +Subject: ASoC: atmel-pdmic: Remove endianness flag on pdmic component + +From: Charles Keepax + +[ Upstream commit 52857c3baa0e5ddeba7b2c84e56bb71c9674e048 ] + +The endianness flag should have been removed when the driver was +ported across from having both a CODEC and CPU side component, to +just having a CPU component and using the dummy for the CODEC. The +endianness flag is used to indicate that the device is completely +ambivalent to the endianness of the data, typically due to the +endianness being lost over the hardware link (ie. the link defines +bit ordering). It's usage didn't have any effect when the driver +had both a CPU and CODEC component, since the union of those equals +the CPU side settings, but now causes the driver to falsely report +it supports big endian. Correct this by removing the flag. + +Fixes: f3c668074a04 ("ASoC: atmel-pdmic: remove codec component") +Signed-off-by: Charles Keepax +Link: https://lore.kernel.org/r/20220504170905.332415-3-ckeepax@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/atmel/atmel-pdmic.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/sound/soc/atmel/atmel-pdmic.c b/sound/soc/atmel/atmel-pdmic.c +index 42117de299e7..ea34efac2fff 100644 +--- a/sound/soc/atmel/atmel-pdmic.c ++++ b/sound/soc/atmel/atmel-pdmic.c +@@ -481,7 +481,6 @@ static const struct snd_soc_component_driver atmel_pdmic_cpu_dai_component = { + .num_controls = ARRAY_SIZE(atmel_pdmic_snd_controls), + .idle_bias_on = 1, + .use_pmdown_time = 1, +- .endianness = 1, + }; + + /* ASoC sound card */ +-- +2.35.1 + diff --git a/queue-5.18/asoc-codecs-fix-error-handling-in-power-domain-init-.patch b/queue-5.18/asoc-codecs-fix-error-handling-in-power-domain-init-.patch new file mode 100644 index 00000000000..b4b1b8522e7 --- /dev/null +++ b/queue-5.18/asoc-codecs-fix-error-handling-in-power-domain-init-.patch @@ -0,0 +1,97 @@ +From 9527091e251e236a7903ca372a83db5bef589aeb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Mar 2022 21:48:57 +0530 +Subject: ASoC: codecs: Fix error handling in power domain init and exit + handlers + +From: Srinivasa Rao Mandadapu + +[ Upstream commit 1a8ee4cf84187bce17c76886eb6dd9389c3b99a8 ] + +Update error handling in power domain init and exit handlers, as existing handling +may cause issues in device remove function. +Use appropriate pm core api for power domain get and sync to avoid redundant code. + +Fixes: 9e3d83c52844 ("ASoC: codecs: Add power domains support in digital macro codecs") + +Signed-off-by: Srinivasa Rao Mandadapu +Co-developed-by: Venkata Prasad Potturu +Signed-off-by: Venkata Prasad Potturu +Reported-by: kernel test robot +Reported-by: Dan Carpenter +Link: https://lore.kernel.org/r/1647965937-32203-1-git-send-email-quic_srivasam@quicinc.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/lpass-macro-common.c | 35 +++++++++++++++------------ + 1 file changed, 19 insertions(+), 16 deletions(-) + +diff --git a/sound/soc/codecs/lpass-macro-common.c b/sound/soc/codecs/lpass-macro-common.c +index 6cede75ed3b5..3c661fd61173 100644 +--- a/sound/soc/codecs/lpass-macro-common.c ++++ b/sound/soc/codecs/lpass-macro-common.c +@@ -24,42 +24,45 @@ struct lpass_macro *lpass_macro_pds_init(struct device *dev) + return ERR_PTR(-ENOMEM); + + l_pds->macro_pd = dev_pm_domain_attach_by_name(dev, "macro"); +- if (IS_ERR_OR_NULL(l_pds->macro_pd)) +- return NULL; +- +- ret = pm_runtime_get_sync(l_pds->macro_pd); +- if (ret < 0) { +- pm_runtime_put_noidle(l_pds->macro_pd); ++ if (IS_ERR_OR_NULL(l_pds->macro_pd)) { ++ ret = PTR_ERR(l_pds->macro_pd); + goto macro_err; + } + ++ ret = pm_runtime_resume_and_get(l_pds->macro_pd); ++ if (ret < 0) ++ goto macro_sync_err; ++ + l_pds->dcodec_pd = dev_pm_domain_attach_by_name(dev, "dcodec"); +- if (IS_ERR_OR_NULL(l_pds->dcodec_pd)) ++ if (IS_ERR_OR_NULL(l_pds->dcodec_pd)) { ++ ret = PTR_ERR(l_pds->dcodec_pd); + goto dcodec_err; ++ } + +- ret = pm_runtime_get_sync(l_pds->dcodec_pd); +- if (ret < 0) { +- pm_runtime_put_noidle(l_pds->dcodec_pd); ++ ret = pm_runtime_resume_and_get(l_pds->dcodec_pd); ++ if (ret < 0) + goto dcodec_sync_err; +- } + return l_pds; + + dcodec_sync_err: + dev_pm_domain_detach(l_pds->dcodec_pd, false); + dcodec_err: + pm_runtime_put(l_pds->macro_pd); +-macro_err: ++macro_sync_err: + dev_pm_domain_detach(l_pds->macro_pd, false); ++macro_err: + return ERR_PTR(ret); + } + EXPORT_SYMBOL_GPL(lpass_macro_pds_init); + + void lpass_macro_pds_exit(struct lpass_macro *pds) + { +- pm_runtime_put(pds->macro_pd); +- dev_pm_domain_detach(pds->macro_pd, false); +- pm_runtime_put(pds->dcodec_pd); +- dev_pm_domain_detach(pds->dcodec_pd, false); ++ if (pds) { ++ pm_runtime_put(pds->macro_pd); ++ dev_pm_domain_detach(pds->macro_pd, false); ++ pm_runtime_put(pds->dcodec_pd); ++ dev_pm_domain_detach(pds->dcodec_pd, false); ++ } + } + EXPORT_SYMBOL_GPL(lpass_macro_pds_exit); + +-- +2.35.1 + diff --git a/queue-5.18/asoc-codecs-lpass-fix-passing-zero-to-ptr_err.patch b/queue-5.18/asoc-codecs-lpass-fix-passing-zero-to-ptr_err.patch new file mode 100644 index 00000000000..5114de91d80 --- /dev/null +++ b/queue-5.18/asoc-codecs-lpass-fix-passing-zero-to-ptr_err.patch @@ -0,0 +1,50 @@ +From 8eb07099d98c06e4e9c2b7632d0f45dccd762ebd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 May 2022 20:09:09 +0800 +Subject: ASoC: codecs: lpass: Fix passing zero to 'PTR_ERR' + +From: YueHaibing + +[ Upstream commit 81e7b165c45e94188ae8f1134b57f27d1f35452f ] + +sound/soc/codecs/lpass-macro-common.c:28 lpass_macro_pds_init() warn: passing zero to 'PTR_ERR' +sound/soc/codecs/lpass-macro-common.c:38 lpass_macro_pds_init() warn: passing zero to 'PTR_ERR' +sound/soc/codecs/lpass-macro-common.c:54 lpass_macro_pds_init() warn: passing zero to 'ERR_PTR' + +dev_pm_domain_attach_by_name() may return NULL, set 'ret' as +-ENODATA to fix this warning. + +Fixes: 1a8ee4cf8418 ("ASoC: codecs: Fix error handling in power domain init and exit handlers") +Signed-off-by: YueHaibing +Link: https://lore.kernel.org/r/20220516120909.36356-1-yuehaibing@huawei.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/lpass-macro-common.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/lpass-macro-common.c b/sound/soc/codecs/lpass-macro-common.c +index 3c661fd61173..1b9082d237c1 100644 +--- a/sound/soc/codecs/lpass-macro-common.c ++++ b/sound/soc/codecs/lpass-macro-common.c +@@ -25,7 +25,7 @@ struct lpass_macro *lpass_macro_pds_init(struct device *dev) + + l_pds->macro_pd = dev_pm_domain_attach_by_name(dev, "macro"); + if (IS_ERR_OR_NULL(l_pds->macro_pd)) { +- ret = PTR_ERR(l_pds->macro_pd); ++ ret = l_pds->macro_pd ? PTR_ERR(l_pds->macro_pd) : -ENODATA; + goto macro_err; + } + +@@ -35,7 +35,7 @@ struct lpass_macro *lpass_macro_pds_init(struct device *dev) + + l_pds->dcodec_pd = dev_pm_domain_attach_by_name(dev, "dcodec"); + if (IS_ERR_OR_NULL(l_pds->dcodec_pd)) { +- ret = PTR_ERR(l_pds->dcodec_pd); ++ ret = l_pds->dcodec_pd ? PTR_ERR(l_pds->dcodec_pd) : -ENODATA; + goto dcodec_err; + } + +-- +2.35.1 + diff --git a/queue-5.18/asoc-cs35l41-fix-an-out-of-bounds-access-in-otp_pack.patch b/queue-5.18/asoc-cs35l41-fix-an-out-of-bounds-access-in-otp_pack.patch new file mode 100644 index 00000000000..d7617b7ca9f --- /dev/null +++ b/queue-5.18/asoc-cs35l41-fix-an-out-of-bounds-access-in-otp_pack.patch @@ -0,0 +1,123 @@ +From 862a8b32f2cfc8d9bd001e43d9d7561b99e785d9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Mar 2022 20:35:35 +0800 +Subject: ASoC: cs35l41: Fix an out-of-bounds access in otp_packed_element_t + +From: Hui Wang + +[ Upstream commit 9f342904216f378e88008bb0ce1ae200a4b99fe8 ] + +The CS35L41_NUM_OTP_ELEM is 100, but only 99 entries are defined in +the array otp_map_1/2[CS35L41_NUM_OTP_ELEM], this will trigger UBSAN +to report a shift-out-of-bounds warning in the cs35l41_otp_unpack() +since the last entry in the array will result in GENMASK(-1, 0). + +UBSAN reports this problem: + UBSAN: shift-out-of-bounds in /home/hwang4/build/jammy/jammy/sound/soc/codecs/cs35l41-lib.c:836:8 + shift exponent 64 is too large for 64-bit type 'long unsigned int' + CPU: 10 PID: 595 Comm: systemd-udevd Not tainted 5.15.0-23-generic #23 + Hardware name: LENOVO \x02MFG_IN_GO/\x02MFG_IN_GO, BIOS N3GET19W (1.00 ) 03/11/2022 + Call Trace: + + show_stack+0x52/0x58 + dump_stack_lvl+0x4a/0x5f + dump_stack+0x10/0x12 + ubsan_epilogue+0x9/0x45 + __ubsan_handle_shift_out_of_bounds.cold+0x61/0xef + ? regmap_unlock_mutex+0xe/0x10 + cs35l41_otp_unpack.cold+0x1c6/0x2b2 [snd_soc_cs35l41_lib] + cs35l41_hda_probe+0x24f/0x33a [snd_hda_scodec_cs35l41] + cs35l41_hda_i2c_probe+0x65/0x90 [snd_hda_scodec_cs35l41_i2c] + ? cs35l41_hda_i2c_remove+0x20/0x20 [snd_hda_scodec_cs35l41_i2c] + i2c_device_probe+0x252/0x2b0 + +Fixes: 6450ef559056 ("ASoC: cs35l41: CS35L41 Boosted Smart Amplifier") +Reviewed-by: Lucas Tanure +Acked-by: Charles Keepax +Signed-off-by: Hui Wang +Link: https://lore.kernel.org/r/20220328123535.50000-2-hui.wang@canonical.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + include/sound/cs35l41.h | 1 - + sound/soc/codecs/cs35l41-lib.c | 14 +++++++------- + 2 files changed, 7 insertions(+), 8 deletions(-) + +diff --git a/include/sound/cs35l41.h b/include/sound/cs35l41.h +index bf7f9a9aeba0..9341130257ea 100644 +--- a/include/sound/cs35l41.h ++++ b/include/sound/cs35l41.h +@@ -536,7 +536,6 @@ + + #define CS35L41_MAX_CACHE_REG 36 + #define CS35L41_OTP_SIZE_WORDS 32 +-#define CS35L41_NUM_OTP_ELEM 100 + + #define CS35L41_VALID_PDATA 0x80000000 + #define CS35L41_NUM_SUPPLIES 2 +diff --git a/sound/soc/codecs/cs35l41-lib.c b/sound/soc/codecs/cs35l41-lib.c +index aa6823fbd1a4..17cf782f39af 100644 +--- a/sound/soc/codecs/cs35l41-lib.c ++++ b/sound/soc/codecs/cs35l41-lib.c +@@ -422,7 +422,7 @@ static bool cs35l41_volatile_reg(struct device *dev, unsigned int reg) + } + } + +-static const struct cs35l41_otp_packed_element_t otp_map_1[CS35L41_NUM_OTP_ELEM] = { ++static const struct cs35l41_otp_packed_element_t otp_map_1[] = { + /* addr shift size */ + { 0x00002030, 0, 4 }, /*TRIM_OSC_FREQ_TRIM*/ + { 0x00002030, 7, 1 }, /*TRIM_OSC_TRIM_DONE*/ +@@ -525,7 +525,7 @@ static const struct cs35l41_otp_packed_element_t otp_map_1[CS35L41_NUM_OTP_ELEM] + { 0x00017044, 0, 24 }, /*LOT_NUMBER*/ + }; + +-static const struct cs35l41_otp_packed_element_t otp_map_2[CS35L41_NUM_OTP_ELEM] = { ++static const struct cs35l41_otp_packed_element_t otp_map_2[] = { + /* addr shift size */ + { 0x00002030, 0, 4 }, /*TRIM_OSC_FREQ_TRIM*/ + { 0x00002030, 7, 1 }, /*TRIM_OSC_TRIM_DONE*/ +@@ -671,35 +671,35 @@ static const struct cs35l41_otp_map_element_t cs35l41_otp_map_map[] = { + { + .id = 0x01, + .map = otp_map_1, +- .num_elements = CS35L41_NUM_OTP_ELEM, ++ .num_elements = ARRAY_SIZE(otp_map_1), + .bit_offset = 16, + .word_offset = 2, + }, + { + .id = 0x02, + .map = otp_map_2, +- .num_elements = CS35L41_NUM_OTP_ELEM, ++ .num_elements = ARRAY_SIZE(otp_map_2), + .bit_offset = 16, + .word_offset = 2, + }, + { + .id = 0x03, + .map = otp_map_2, +- .num_elements = CS35L41_NUM_OTP_ELEM, ++ .num_elements = ARRAY_SIZE(otp_map_2), + .bit_offset = 16, + .word_offset = 2, + }, + { + .id = 0x06, + .map = otp_map_2, +- .num_elements = CS35L41_NUM_OTP_ELEM, ++ .num_elements = ARRAY_SIZE(otp_map_2), + .bit_offset = 16, + .word_offset = 2, + }, + { + .id = 0x08, + .map = otp_map_1, +- .num_elements = CS35L41_NUM_OTP_ELEM, ++ .num_elements = ARRAY_SIZE(otp_map_1), + .bit_offset = 16, + .word_offset = 2, + }, +-- +2.35.1 + diff --git a/queue-5.18/asoc-dapm-don-t-fold-register-value-changes-into-not.patch b/queue-5.18/asoc-dapm-don-t-fold-register-value-changes-into-not.patch new file mode 100644 index 00000000000..f1dcf14b755 --- /dev/null +++ b/queue-5.18/asoc-dapm-don-t-fold-register-value-changes-into-not.patch @@ -0,0 +1,51 @@ +From 6b4ae0b747f0a4565f3ffca341df2d3daca90944 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Apr 2022 17:18:32 +0100 +Subject: ASoC: dapm: Don't fold register value changes into notifications + +From: Mark Brown + +[ Upstream commit ad685980469b9f9b99d4d6ea05f4cb8f57cb2234 ] + +DAPM tracks and reports the value presented to the user from DAPM controls +separately to the register value, these may diverge during initialisation +or when an autodisable control is in use. + +When writing DAPM controls we currently report that a change has occurred +if either the DAPM value or the value stored in the register has changed, +meaning that if the two are out of sync we may appear to report a spurious +event to userspace. Since we use this folded in value for nothing other +than the value reported to userspace simply drop the folding in of the +register change. + +Signed-off-by: Mark Brown +Link: https://lore.kernel.org/r/20220428161833.3690050-1-broonie@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/soc-dapm.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c +index ca917a849c42..869c76506b66 100644 +--- a/sound/soc/soc-dapm.c ++++ b/sound/soc/soc-dapm.c +@@ -3437,7 +3437,6 @@ int snd_soc_dapm_put_volsw(struct snd_kcontrol *kcontrol, + update.val = val; + card->update = &update; + } +- change |= reg_change; + + ret = soc_dapm_mixer_update_power(card, kcontrol, connect, + rconnect); +@@ -3539,7 +3538,6 @@ int snd_soc_dapm_put_enum_double(struct snd_kcontrol *kcontrol, + update.val = val; + card->update = &update; + } +- change |= reg_change; + + ret = soc_dapm_mux_update_power(card, kcontrol, item[0], e); + +-- +2.35.1 + diff --git a/queue-5.18/asoc-fsl-fix-refcount-leak-in-imx_sgtl5000_probe.patch b/queue-5.18/asoc-fsl-fix-refcount-leak-in-imx_sgtl5000_probe.patch new file mode 100644 index 00000000000..be1cd8e9d19 --- /dev/null +++ b/queue-5.18/asoc-fsl-fix-refcount-leak-in-imx_sgtl5000_probe.patch @@ -0,0 +1,84 @@ +From 1ebf91165c9e48c3c3ab773657ec86185253fc46 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 May 2022 10:58:03 +0400 +Subject: ASoC: fsl: Fix refcount leak in imx_sgtl5000_probe + +From: Miaoqian Lin + +[ Upstream commit 41cd312dfe980af869c3503b4d38e62ed20dd3b7 ] + +of_find_i2c_device_by_node() takes a reference, +In error paths, we should call put_device() to drop +the reference to aviod refount leak. + +Fixes: 81e8e4926167 ("ASoC: fsl: add sgtl5000 clock support for imx-sgtl5000") +Signed-off-by: Miaoqian Lin +Reviewed-by: Fabio Estevam +Link: https://lore.kernel.org/r/20220511065803.3957-1-linmq006@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/fsl/imx-sgtl5000.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +diff --git a/sound/soc/fsl/imx-sgtl5000.c b/sound/soc/fsl/imx-sgtl5000.c +index 8daced42d55e..580a0d963f0e 100644 +--- a/sound/soc/fsl/imx-sgtl5000.c ++++ b/sound/soc/fsl/imx-sgtl5000.c +@@ -120,19 +120,19 @@ static int imx_sgtl5000_probe(struct platform_device *pdev) + data = devm_kzalloc(&pdev->dev, sizeof(*data), GFP_KERNEL); + if (!data) { + ret = -ENOMEM; +- goto fail; ++ goto put_device; + } + + comp = devm_kzalloc(&pdev->dev, 3 * sizeof(*comp), GFP_KERNEL); + if (!comp) { + ret = -ENOMEM; +- goto fail; ++ goto put_device; + } + + data->codec_clk = clk_get(&codec_dev->dev, NULL); + if (IS_ERR(data->codec_clk)) { + ret = PTR_ERR(data->codec_clk); +- goto fail; ++ goto put_device; + } + + data->clk_frequency = clk_get_rate(data->codec_clk); +@@ -158,10 +158,10 @@ static int imx_sgtl5000_probe(struct platform_device *pdev) + data->card.dev = &pdev->dev; + ret = snd_soc_of_parse_card_name(&data->card, "model"); + if (ret) +- goto fail; ++ goto put_device; + ret = snd_soc_of_parse_audio_routing(&data->card, "audio-routing"); + if (ret) +- goto fail; ++ goto put_device; + data->card.num_links = 1; + data->card.owner = THIS_MODULE; + data->card.dai_link = &data->dai; +@@ -174,7 +174,7 @@ static int imx_sgtl5000_probe(struct platform_device *pdev) + ret = devm_snd_soc_register_card(&pdev->dev, &data->card); + if (ret) { + dev_err_probe(&pdev->dev, ret, "snd_soc_register_card failed\n"); +- goto fail; ++ goto put_device; + } + + of_node_put(ssi_np); +@@ -182,6 +182,8 @@ static int imx_sgtl5000_probe(struct platform_device *pdev) + + return 0; + ++put_device: ++ put_device(&codec_dev->dev); + fail: + if (data && !IS_ERR(data->codec_clk)) + clk_put(data->codec_clk); +-- +2.35.1 + diff --git a/queue-5.18/asoc-imx-hdmi-fix-refcount-leak-in-imx_hdmi_probe.patch b/queue-5.18/asoc-imx-hdmi-fix-refcount-leak-in-imx_hdmi_probe.patch new file mode 100644 index 00000000000..da56e9ed7e8 --- /dev/null +++ b/queue-5.18/asoc-imx-hdmi-fix-refcount-leak-in-imx_hdmi_probe.patch @@ -0,0 +1,39 @@ +From df96a7b7e456cedc236cbf7e9c2c0857852109f4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 May 2022 09:27:40 +0400 +Subject: ASoC: imx-hdmi: Fix refcount leak in imx_hdmi_probe + +From: Miaoqian Lin + +[ Upstream commit ed46731d8e86c8d65f5fc717671e1f1f6c3146d2 ] + +of_find_device_by_node() takes reference, we should use put_device() +to release it. when devm_kzalloc() fails, it doesn't have a +put_device(), it will cause refcount leak. +Add missing put_device() to fix this. + +Fixes: 6a5f850aa83a ("ASoC: fsl: Add imx-hdmi machine driver") +Fixes: f670b274f7f6 ("ASoC: imx-hdmi: add put_device() after of_find_device_by_node()") +Signed-off-by: Miaoqian Lin +Link: https://lore.kernel.org/r/20220511052740.46903-1-linmq006@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/fsl/imx-hdmi.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/soc/fsl/imx-hdmi.c b/sound/soc/fsl/imx-hdmi.c +index 929f69b758af..ec149dc73938 100644 +--- a/sound/soc/fsl/imx-hdmi.c ++++ b/sound/soc/fsl/imx-hdmi.c +@@ -126,6 +126,7 @@ static int imx_hdmi_probe(struct platform_device *pdev) + data = devm_kzalloc(&pdev->dev, sizeof(*data), GFP_KERNEL); + if (!data) { + ret = -ENOMEM; ++ put_device(&cpu_pdev->dev); + goto fail; + } + +-- +2.35.1 + diff --git a/queue-5.18/asoc-intel-bytcr_rt5640-add-quirk-for-the-hp-pro-tab.patch b/queue-5.18/asoc-intel-bytcr_rt5640-add-quirk-for-the-hp-pro-tab.patch new file mode 100644 index 00000000000..c5210f88d41 --- /dev/null +++ b/queue-5.18/asoc-intel-bytcr_rt5640-add-quirk-for-the-hp-pro-tab.patch @@ -0,0 +1,52 @@ +From 378227ee84aed9959515a5a46df81fc607120be8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Apr 2022 15:49:18 +0200 +Subject: ASoC: Intel: bytcr_rt5640: Add quirk for the HP Pro Tablet 408 + +From: Hans de Goede + +[ Upstream commit ce216cfa84a4e1c23b105e652c550bdeaac9e922 ] + +Add a quirk for the HP Pro Tablet 408, this BYTCR tablet has no CHAN +package in its ACPI tables and uses SSP0-AIF1 rather then SSP0-AIF2 which +is the default for BYTCR devices. + +It also uses DMIC1 for the internal mic rather then the default IN3 +and it uses JD2 rather then the default JD1 for jack-detect. + +BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=211485 +Signed-off-by: Hans de Goede +Acked-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20220427134918.527381-1-hdegoede@redhat.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/bytcr_rt5640.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c +index d76a505052fb..f81ae742faa7 100644 +--- a/sound/soc/intel/boards/bytcr_rt5640.c ++++ b/sound/soc/intel/boards/bytcr_rt5640.c +@@ -773,6 +773,18 @@ static const struct dmi_system_id byt_rt5640_quirk_table[] = { + BYT_RT5640_OVCD_SF_0P75 | + BYT_RT5640_MCLK_EN), + }, ++ { /* HP Pro Tablet 408 */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "HP Pro Tablet 408"), ++ }, ++ .driver_data = (void *)(BYT_RT5640_DMIC1_MAP | ++ BYT_RT5640_JD_SRC_JD2_IN4N | ++ BYT_RT5640_OVCD_TH_1500UA | ++ BYT_RT5640_OVCD_SF_0P75 | ++ BYT_RT5640_SSP0_AIF1 | ++ BYT_RT5640_MCLK_EN), ++ }, + { /* HP Stream 7 */ + .matches = { + DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"), +-- +2.35.1 + diff --git a/queue-5.18/asoc-intel-sof_ssp_amp-fix-no-dmic-be-link-on-chrome.patch b/queue-5.18/asoc-intel-sof_ssp_amp-fix-no-dmic-be-link-on-chrome.patch new file mode 100644 index 00000000000..67a9671f2ee --- /dev/null +++ b/queue-5.18/asoc-intel-sof_ssp_amp-fix-no-dmic-be-link-on-chrome.patch @@ -0,0 +1,76 @@ +From ae179f0b59fde2975137489c67e8e2295615a285 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 May 2022 12:09:21 -0500 +Subject: ASoC: Intel: sof_ssp_amp: fix no DMIC BE Link on Chromebooks + +From: Brent Lu + +[ Upstream commit d1c808765deb2bcd35d827402ed4d75d068aae18 ] + +The SOF topology supports 2 BE Links(dmic01 and dmic16k) and each +link supports up to four DMICs. However, Chromebook does not implement +ACPI NHLT table so the mach->mach_params.dmic_num is always zero. We +add a quirk so machine driver knows it's running on a Chromebook and +need to create BE Links for DMIC. + +Reviewed-by: Bard Liao +Signed-off-by: Brent Lu +Signed-off-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20220509170922.54868-3-pierre-louis.bossart@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/sof_ssp_amp.c | 16 ++++++++++++++-- + 1 file changed, 14 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/intel/boards/sof_ssp_amp.c b/sound/soc/intel/boards/sof_ssp_amp.c +index 88530e9de543..ef70c6f27fe1 100644 +--- a/sound/soc/intel/boards/sof_ssp_amp.c ++++ b/sound/soc/intel/boards/sof_ssp_amp.c +@@ -9,6 +9,7 @@ + + #include + #include ++#include + #include + #include + #include +@@ -78,6 +79,16 @@ struct sof_card_private { + bool idisp_codec; + }; + ++static const struct dmi_system_id chromebook_platforms[] = { ++ { ++ .ident = "Google Chromebooks", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Google"), ++ } ++ }, ++ {}, ++}; ++ + static const struct snd_soc_dapm_widget sof_ssp_amp_dapm_widgets[] = { + SND_SOC_DAPM_MIC("SoC DMIC", NULL), + }; +@@ -371,7 +382,7 @@ static int sof_ssp_amp_probe(struct platform_device *pdev) + struct snd_soc_dai_link *dai_links; + struct snd_soc_acpi_mach *mach; + struct sof_card_private *ctx; +- int dmic_be_num, hdmi_num = 0; ++ int dmic_be_num = 0, hdmi_num = 0; + int ret, ssp_codec; + + ctx = devm_kzalloc(&pdev->dev, sizeof(*ctx), GFP_KERNEL); +@@ -383,7 +394,8 @@ static int sof_ssp_amp_probe(struct platform_device *pdev) + + mach = pdev->dev.platform_data; + +- dmic_be_num = mach->mach_params.dmic_num; ++ if (dmi_check_system(chromebook_platforms) || mach->mach_params.dmic_num > 0) ++ dmic_be_num = 2; + + ssp_codec = sof_ssp_amp_quirk & SOF_AMPLIFIER_SSP_MASK; + +-- +2.35.1 + diff --git a/queue-5.18/asoc-max98090-move-check-for-invalid-values-before-c.patch b/queue-5.18/asoc-max98090-move-check-for-invalid-values-before-c.patch new file mode 100644 index 00000000000..f0e8c9c6eef --- /dev/null +++ b/queue-5.18/asoc-max98090-move-check-for-invalid-values-before-c.patch @@ -0,0 +1,52 @@ +From e3559a5cbdc84e50b72962913b6139c68f925db4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 May 2022 01:31:26 +0300 +Subject: ASoC: max98090: Move check for invalid values before casting in + max98090_put_enab_tlv() + +From: Alexey Khoroshilov + +[ Upstream commit f7a344468105ef8c54086dfdc800e6f5a8417d3e ] + +Validation of signed input should be done before casting to unsigned int. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Signed-off-by: Alexey Khoroshilov +Suggested-by: Mark Brown +Fixes: 2fbe467bcbfc ("ASoC: max98090: Reject invalid values in custom control put()") +Link: https://lore.kernel.org/r/1652999486-29653-1-git-send-email-khoroshilov@ispras.ru +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/max98090.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/max98090.c b/sound/soc/codecs/max98090.c +index 62b41ca050a2..5513acd360b8 100644 +--- a/sound/soc/codecs/max98090.c ++++ b/sound/soc/codecs/max98090.c +@@ -393,7 +393,8 @@ static int max98090_put_enab_tlv(struct snd_kcontrol *kcontrol, + struct soc_mixer_control *mc = + (struct soc_mixer_control *)kcontrol->private_value; + unsigned int mask = (1 << fls(mc->max)) - 1; +- unsigned int sel = ucontrol->value.integer.value[0]; ++ int sel_unchecked = ucontrol->value.integer.value[0]; ++ unsigned int sel; + unsigned int val = snd_soc_component_read(component, mc->reg); + unsigned int *select; + +@@ -413,8 +414,9 @@ static int max98090_put_enab_tlv(struct snd_kcontrol *kcontrol, + + val = (val >> mc->shift) & mask; + +- if (sel < 0 || sel > mc->max) ++ if (sel_unchecked < 0 || sel_unchecked > mc->max) + return -EINVAL; ++ sel = sel_unchecked; + + *select = sel; + +-- +2.35.1 + diff --git a/queue-5.18/asoc-max98357a-remove-dependency-on-gpiolib.patch b/queue-5.18/asoc-max98357a-remove-dependency-on-gpiolib.patch new file mode 100644 index 00000000000..272f885e9bf --- /dev/null +++ b/queue-5.18/asoc-max98357a-remove-dependency-on-gpiolib.patch @@ -0,0 +1,54 @@ +From 328c404bd7646bcfc266407994054d627993b182 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 May 2022 12:26:46 -0500 +Subject: ASoC: max98357a: remove dependency on GPIOLIB +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pierre-Louis Bossart + +[ Upstream commit 21ca3274333f5c1cbbf9d91e5b33f4f2463859b2 ] + +commit dcc2c012c7691 ("ASoC: Fix gpiolib dependencies") removed a +series of unnecessary dependencies on GPIOLIB when the gpio was +optional. + +A similar simplification seems valid for max98357a, so remove the +dependency as well. This will avoid the following warning + + WARNING: unmet direct dependencies detected for SND_SOC_MAX98357A + Depends on [n]: SOUND [=y] && !UML && SND [=y] && SND_SOC [=y] && GPIOLIB [=n] + Selected by [y]: + - SND_SOC_INTEL_SOF_CS42L42_MACH [=y] && SOUND [=y] && !UML && + SND [=y] && SND_SOC [=y] && SND_SOC_INTEL_MACH [=y] && + (SND_SOC_SOF_HDA_LINK [=y] || SND_SOC_SOF_BAYTRAIL [=n]) && I2C + [=y] && ACPI [=y] && SND_HDA_CODEC_HDMI [=y] && + SND_SOC_SOF_HDA_AUDIO_CODEC [=y] && (MFD_INTEL_LPSS [=y] || + COMPILE_TEST [=n]) + +Reported-by: kernel test robot +Signed-off-by: Pierre-Louis Bossart +Reviewed-by: Péter Ujfalusi +Link: https://lore.kernel.org/r/20220517172647.468244-2-pierre-louis.bossart@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/Kconfig | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/sound/soc/codecs/Kconfig b/sound/soc/codecs/Kconfig +index f46a22660103..156f2519459d 100644 +--- a/sound/soc/codecs/Kconfig ++++ b/sound/soc/codecs/Kconfig +@@ -953,7 +953,6 @@ config SND_SOC_MAX98095 + + config SND_SOC_MAX98357A + tristate "Maxim MAX98357A CODEC" +- depends on GPIOLIB + + config SND_SOC_MAX98371 + tristate +-- +2.35.1 + diff --git a/queue-5.18/asoc-mediatek-fix-error-handling-in-mt8173_max98090_.patch b/queue-5.18/asoc-mediatek-fix-error-handling-in-mt8173_max98090_.patch new file mode 100644 index 00000000000..9e5e825435d --- /dev/null +++ b/queue-5.18/asoc-mediatek-fix-error-handling-in-mt8173_max98090_.patch @@ -0,0 +1,49 @@ +From ee2698b88ae5b30c3c6507f00f8355c763b840fa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Apr 2022 09:29:01 +0000 +Subject: ASoC: mediatek: Fix error handling in mt8173_max98090_dev_probe + +From: Miaoqian Lin + +[ Upstream commit 4f4e0454e226de3bf4efd7e7924d1edc571c52d5 ] + +Call of_node_put(platform_node) to avoid refcount leak in +the error path. + +Fixes: 94319ba10eca ("ASoC: mediatek: Use platform_of_node for machine drivers") +Fixes: 493433785df0 ("ASoC: mediatek: mt8173: fix device_node leak") +Signed-off-by: Miaoqian Lin +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20220404092903.26725-1-linmq006@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/mediatek/mt8173/mt8173-max98090.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/mediatek/mt8173/mt8173-max98090.c b/sound/soc/mediatek/mt8173/mt8173-max98090.c +index 4cb90da89262..58778cd2e61b 100644 +--- a/sound/soc/mediatek/mt8173/mt8173-max98090.c ++++ b/sound/soc/mediatek/mt8173/mt8173-max98090.c +@@ -167,7 +167,8 @@ static int mt8173_max98090_dev_probe(struct platform_device *pdev) + if (!codec_node) { + dev_err(&pdev->dev, + "Property 'audio-codec' missing or invalid\n"); +- return -EINVAL; ++ ret = -EINVAL; ++ goto put_platform_node; + } + for_each_card_prelinks(card, i, dai_link) { + if (dai_link->codecs->name) +@@ -179,6 +180,8 @@ static int mt8173_max98090_dev_probe(struct platform_device *pdev) + ret = devm_snd_soc_register_card(&pdev->dev, card); + + of_node_put(codec_node); ++ ++put_platform_node: + of_node_put(platform_node); + return ret; + } +-- +2.35.1 + diff --git a/queue-5.18/asoc-mediatek-fix-missing-of_node_put-in-mt2701_wm89.patch b/queue-5.18/asoc-mediatek-fix-missing-of_node_put-in-mt2701_wm89.patch new file mode 100644 index 00000000000..10cc82ffc96 --- /dev/null +++ b/queue-5.18/asoc-mediatek-fix-missing-of_node_put-in-mt2701_wm89.patch @@ -0,0 +1,60 @@ +From 14f043334014d2cdee557b795daffb0c43693274 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Apr 2022 09:35:25 +0000 +Subject: ASoC: mediatek: Fix missing of_node_put in + mt2701_wm8960_machine_probe + +From: Miaoqian Lin + +[ Upstream commit 05654431a18fe24e5e46a375d98904134628a102 ] + +This node pointer is returned by of_parse_phandle() with +refcount incremented in this function. +Calling of_node_put() to avoid the refcount leak. + +Fixes: 8625c1dbd876 ("ASoC: mediatek: Add mt2701-wm8960 machine driver") +Signed-off-by: Miaoqian Lin +Link: https://lore.kernel.org/r/20220404093526.30004-1-linmq006@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/mediatek/mt2701/mt2701-wm8960.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/mediatek/mt2701/mt2701-wm8960.c b/sound/soc/mediatek/mt2701/mt2701-wm8960.c +index f56de1b918bf..0cdf2ae36243 100644 +--- a/sound/soc/mediatek/mt2701/mt2701-wm8960.c ++++ b/sound/soc/mediatek/mt2701/mt2701-wm8960.c +@@ -129,7 +129,8 @@ static int mt2701_wm8960_machine_probe(struct platform_device *pdev) + if (!codec_node) { + dev_err(&pdev->dev, + "Property 'audio-codec' missing or invalid\n"); +- return -EINVAL; ++ ret = -EINVAL; ++ goto put_platform_node; + } + for_each_card_prelinks(card, i, dai_link) { + if (dai_link->codecs->name) +@@ -140,7 +141,7 @@ static int mt2701_wm8960_machine_probe(struct platform_device *pdev) + ret = snd_soc_of_parse_audio_routing(card, "audio-routing"); + if (ret) { + dev_err(&pdev->dev, "failed to parse audio-routing: %d\n", ret); +- return ret; ++ goto put_codec_node; + } + + ret = devm_snd_soc_register_card(&pdev->dev, card); +@@ -148,6 +149,10 @@ static int mt2701_wm8960_machine_probe(struct platform_device *pdev) + dev_err(&pdev->dev, "%s snd_soc_register_card fail %d\n", + __func__, ret); + ++put_codec_node: ++ of_node_put(codec_node); ++put_platform_node: ++ of_node_put(platform_node); + return ret; + } + +-- +2.35.1 + diff --git a/queue-5.18/asoc-mxs-saif-fix-refcount-leak-in-mxs_saif_probe.patch b/queue-5.18/asoc-mxs-saif-fix-refcount-leak-in-mxs_saif_probe.patch new file mode 100644 index 00000000000..8fa2e034b2f --- /dev/null +++ b/queue-5.18/asoc-mxs-saif-fix-refcount-leak-in-mxs_saif_probe.patch @@ -0,0 +1,36 @@ +From e1c816c55619d78ada4d83e658facbb06efe4237 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 May 2022 17:37:22 +0400 +Subject: ASoC: mxs-saif: Fix refcount leak in mxs_saif_probe + +From: Miaoqian Lin + +[ Upstream commit 2be84f73785fa9ed6443e3c5b158730266f1c2ee ] + +of_parse_phandle() returns a node pointer with refcount +incremented, we should use of_node_put() on it when done. + +Fixes: 08641c7c74dd ("ASoC: mxs: add device tree support for mxs-saif") +Signed-off-by: Miaoqian Lin +Link: https://lore.kernel.org/r/20220511133725.39039-1-linmq006@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/mxs/mxs-saif.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/soc/mxs/mxs-saif.c b/sound/soc/mxs/mxs-saif.c +index 879c1221a809..7afe1a1acc56 100644 +--- a/sound/soc/mxs/mxs-saif.c ++++ b/sound/soc/mxs/mxs-saif.c +@@ -754,6 +754,7 @@ static int mxs_saif_probe(struct platform_device *pdev) + saif->master_id = saif->id; + } else { + ret = of_alias_get_id(master, "saif"); ++ of_node_put(master); + if (ret < 0) + return ret; + else +-- +2.35.1 + diff --git a/queue-5.18/asoc-rk3328-fix-disabling-mclk-on-pclk-probe-failure.patch b/queue-5.18/asoc-rk3328-fix-disabling-mclk-on-pclk-probe-failure.patch new file mode 100644 index 00000000000..f0590f6b238 --- /dev/null +++ b/queue-5.18/asoc-rk3328-fix-disabling-mclk-on-pclk-probe-failure.patch @@ -0,0 +1,39 @@ +From 0d1af92200d91556a7c50bbec277db2f98a9fdf9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Apr 2022 19:23:11 +0200 +Subject: ASoC: rk3328: fix disabling mclk on pclk probe failure + +From: Nicolas Frattaroli + +[ Upstream commit dd508e324cdde1c06ace08a8143fa50333a90703 ] + +If preparing/enabling the pclk fails, the probe function should +unprepare and disable the previously prepared and enabled mclk, +which it doesn't do. This commit rectifies this. + +Fixes: c32759035ad2 ("ASoC: rockchip: support ACODEC for rk3328") +Signed-off-by: Nicolas Frattaroli +Reviewed-by: Katsuhiro Suzuki +Link: https://lore.kernel.org/r/20220427172310.138638-1-frattaroli.nicolas@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/rk3328_codec.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/rk3328_codec.c b/sound/soc/codecs/rk3328_codec.c +index 758d439e8c7a..86b679cf7aef 100644 +--- a/sound/soc/codecs/rk3328_codec.c ++++ b/sound/soc/codecs/rk3328_codec.c +@@ -481,7 +481,7 @@ static int rk3328_platform_probe(struct platform_device *pdev) + ret = clk_prepare_enable(rk3328->pclk); + if (ret < 0) { + dev_err(&pdev->dev, "failed to enable acodec pclk\n"); +- return ret; ++ goto err_unprepare_mclk; + } + + base = devm_platform_ioremap_resource(pdev, 0); +-- +2.35.1 + diff --git a/queue-5.18/asoc-rsnd-care-default-case-on-rsnd_ssiu_busif_err_s.patch b/queue-5.18/asoc-rsnd-care-default-case-on-rsnd_ssiu_busif_err_s.patch new file mode 100644 index 00000000000..be817c55e72 --- /dev/null +++ b/queue-5.18/asoc-rsnd-care-default-case-on-rsnd_ssiu_busif_err_s.patch @@ -0,0 +1,56 @@ +From 0974d33c51b56f7af0ac98b64acb74bd21f7ff47 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Apr 2022 02:55:27 +0000 +Subject: ASoC: rsnd: care default case on rsnd_ssiu_busif_err_status_clear() + +From: Kuninori Morimoto + +[ Upstream commit b1384d4c95088d01f4266237faabf165d3d605fc ] + +commit cfb7b8bf1e2d66 ("ASoC: rsnd: tidyup +rsnd_ssiu_busif_err_status_clear()") merged duplicate code, but it didn't +care about default case, and causes smatch warnings. + +smatch warnings: +sound/soc/sh/rcar/ssiu.c:112 rsnd_ssiu_busif_err_status_clear() \ + error: uninitialized symbol 'offset'. +sound/soc/sh/rcar/ssiu.c:114 rsnd_ssiu_busif_err_status_clear() \ + error: uninitialized symbol 'shift'. + +This patch cares it. + +Reported-by: kernel test robot +Reported-by: Dan Carpenter +Signed-off-by: Kuninori Morimoto +Link: https://lore.kernel.org/r/87r15rgn6p.wl-kuninori.morimoto.gx@renesas.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sh/rcar/ssiu.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/sh/rcar/ssiu.c b/sound/soc/sh/rcar/ssiu.c +index 0d8f97633dd2..138f95dd9f4a 100644 +--- a/sound/soc/sh/rcar/ssiu.c ++++ b/sound/soc/sh/rcar/ssiu.c +@@ -102,6 +102,8 @@ bool rsnd_ssiu_busif_err_status_clear(struct rsnd_mod *mod) + shift = 1; + offset = 1; + break; ++ default: ++ goto out; + } + + for (i = 0; i < 4; i++) { +@@ -120,7 +122,7 @@ bool rsnd_ssiu_busif_err_status_clear(struct rsnd_mod *mod) + } + rsnd_mod_write(mod, reg, val); + } +- ++out: + return error; + } + +-- +2.35.1 + diff --git a/queue-5.18/asoc-rsnd-care-return-value-from-rsnd_node_fixed_ind.patch b/queue-5.18/asoc-rsnd-care-return-value-from-rsnd_node_fixed_ind.patch new file mode 100644 index 00000000000..95dcb65c26b --- /dev/null +++ b/queue-5.18/asoc-rsnd-care-return-value-from-rsnd_node_fixed_ind.patch @@ -0,0 +1,211 @@ +From ce6309382fb50991c1fb69980c3f3342cae9756f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Apr 2022 02:55:58 +0000 +Subject: ASoC: rsnd: care return value from rsnd_node_fixed_index() + +From: Kuninori Morimoto + +[ Upstream commit d09a7db431c65aaa8303eb456439d1831ca2e6b4 ] + +Renesas Sound is very complex, and thus it needs to use +rsnd_node_fixed_index() to know enabled pin index. + +It returns error if strange pin was selected, +but some codes didn't check it. + +This patch 1) indicates error message, 2) check return +value. + +Reported-by: kernel test robot +Reported-by: Dan Carpenter +Signed-off-by: Kuninori Morimoto +Link: https://lore.kernel.org/r/87pmlbgn5t.wl-kuninori.morimoto.gx@renesas.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sh/rcar/core.c | 15 ++++++++++----- + sound/soc/sh/rcar/dma.c | 9 ++++++++- + sound/soc/sh/rcar/rsnd.h | 2 +- + sound/soc/sh/rcar/src.c | 7 ++++++- + sound/soc/sh/rcar/ssi.c | 14 ++++++++++++-- + sound/soc/sh/rcar/ssiu.c | 7 ++++++- + 6 files changed, 43 insertions(+), 11 deletions(-) + +diff --git a/sound/soc/sh/rcar/core.c b/sound/soc/sh/rcar/core.c +index 6a8fe0da7670..af8ef2a27d34 100644 +--- a/sound/soc/sh/rcar/core.c ++++ b/sound/soc/sh/rcar/core.c +@@ -1159,6 +1159,7 @@ void rsnd_parse_connect_common(struct rsnd_dai *rdai, char *name, + struct device_node *capture) + { + struct rsnd_priv *priv = rsnd_rdai_to_priv(rdai); ++ struct device *dev = rsnd_priv_to_dev(priv); + struct device_node *np; + int i; + +@@ -1169,7 +1170,11 @@ void rsnd_parse_connect_common(struct rsnd_dai *rdai, char *name, + for_each_child_of_node(node, np) { + struct rsnd_mod *mod; + +- i = rsnd_node_fixed_index(np, name, i); ++ i = rsnd_node_fixed_index(dev, np, name, i); ++ if (i < 0) { ++ of_node_put(np); ++ break; ++ } + + mod = mod_get(priv, i); + +@@ -1183,7 +1188,7 @@ void rsnd_parse_connect_common(struct rsnd_dai *rdai, char *name, + of_node_put(node); + } + +-int rsnd_node_fixed_index(struct device_node *node, char *name, int idx) ++int rsnd_node_fixed_index(struct device *dev, struct device_node *node, char *name, int idx) + { + char node_name[16]; + +@@ -1210,6 +1215,8 @@ int rsnd_node_fixed_index(struct device_node *node, char *name, int idx) + return idx; + } + ++ dev_err(dev, "strange node numbering (%s)", ++ of_node_full_name(node)); + return -EINVAL; + } + +@@ -1221,10 +1228,8 @@ int rsnd_node_count(struct rsnd_priv *priv, struct device_node *node, char *name + + i = 0; + for_each_child_of_node(node, np) { +- i = rsnd_node_fixed_index(np, name, i); ++ i = rsnd_node_fixed_index(dev, np, name, i); + if (i < 0) { +- dev_err(dev, "strange node numbering (%s)", +- of_node_full_name(node)); + of_node_put(np); + return 0; + } +diff --git a/sound/soc/sh/rcar/dma.c b/sound/soc/sh/rcar/dma.c +index 03e0d4eca781..463ab237d7bd 100644 +--- a/sound/soc/sh/rcar/dma.c ++++ b/sound/soc/sh/rcar/dma.c +@@ -240,12 +240,19 @@ static int rsnd_dmaen_start(struct rsnd_mod *mod, + struct dma_chan *rsnd_dma_request_channel(struct device_node *of_node, char *name, + struct rsnd_mod *mod, char *x) + { ++ struct rsnd_priv *priv = rsnd_mod_to_priv(mod); ++ struct device *dev = rsnd_priv_to_dev(priv); + struct dma_chan *chan = NULL; + struct device_node *np; + int i = 0; + + for_each_child_of_node(of_node, np) { +- i = rsnd_node_fixed_index(np, name, i); ++ i = rsnd_node_fixed_index(dev, np, name, i); ++ if (i < 0) { ++ chan = NULL; ++ of_node_put(np); ++ break; ++ } + + if (i == rsnd_mod_id_raw(mod) && (!chan)) + chan = of_dma_request_slave_channel(np, x); +diff --git a/sound/soc/sh/rcar/rsnd.h b/sound/soc/sh/rcar/rsnd.h +index 6580bab0e229..d9cd190d7e19 100644 +--- a/sound/soc/sh/rcar/rsnd.h ++++ b/sound/soc/sh/rcar/rsnd.h +@@ -460,7 +460,7 @@ void rsnd_parse_connect_common(struct rsnd_dai *rdai, char *name, + struct device_node *playback, + struct device_node *capture); + int rsnd_node_count(struct rsnd_priv *priv, struct device_node *node, char *name); +-int rsnd_node_fixed_index(struct device_node *node, char *name, int idx); ++int rsnd_node_fixed_index(struct device *dev, struct device_node *node, char *name, int idx); + + int rsnd_channel_normalization(int chan); + #define rsnd_runtime_channel_original(io) \ +diff --git a/sound/soc/sh/rcar/src.c b/sound/soc/sh/rcar/src.c +index 42a100c6303d..0ea84ae57c6a 100644 +--- a/sound/soc/sh/rcar/src.c ++++ b/sound/soc/sh/rcar/src.c +@@ -676,7 +676,12 @@ int rsnd_src_probe(struct rsnd_priv *priv) + if (!of_device_is_available(np)) + goto skip; + +- i = rsnd_node_fixed_index(np, SRC_NAME, i); ++ i = rsnd_node_fixed_index(dev, np, SRC_NAME, i); ++ if (i < 0) { ++ ret = -EINVAL; ++ of_node_put(np); ++ goto rsnd_src_probe_done; ++ } + + src = rsnd_src_get(priv, i); + +diff --git a/sound/soc/sh/rcar/ssi.c b/sound/soc/sh/rcar/ssi.c +index 87e606f688d3..43c5e27dc5c8 100644 +--- a/sound/soc/sh/rcar/ssi.c ++++ b/sound/soc/sh/rcar/ssi.c +@@ -1105,6 +1105,7 @@ void rsnd_parse_connect_ssi(struct rsnd_dai *rdai, + struct device_node *capture) + { + struct rsnd_priv *priv = rsnd_rdai_to_priv(rdai); ++ struct device *dev = rsnd_priv_to_dev(priv); + struct device_node *node; + struct device_node *np; + int i; +@@ -1117,7 +1118,11 @@ void rsnd_parse_connect_ssi(struct rsnd_dai *rdai, + for_each_child_of_node(node, np) { + struct rsnd_mod *mod; + +- i = rsnd_node_fixed_index(np, SSI_NAME, i); ++ i = rsnd_node_fixed_index(dev, np, SSI_NAME, i); ++ if (i < 0) { ++ of_node_put(np); ++ break; ++ } + + mod = rsnd_ssi_mod_get(priv, i); + +@@ -1182,7 +1187,12 @@ int rsnd_ssi_probe(struct rsnd_priv *priv) + if (!of_device_is_available(np)) + goto skip; + +- i = rsnd_node_fixed_index(np, SSI_NAME, i); ++ i = rsnd_node_fixed_index(dev, np, SSI_NAME, i); ++ if (i < 0) { ++ ret = -EINVAL; ++ of_node_put(np); ++ goto rsnd_ssi_probe_done; ++ } + + ssi = rsnd_ssi_get(priv, i); + +diff --git a/sound/soc/sh/rcar/ssiu.c b/sound/soc/sh/rcar/ssiu.c +index 138f95dd9f4a..4b8a63e336c7 100644 +--- a/sound/soc/sh/rcar/ssiu.c ++++ b/sound/soc/sh/rcar/ssiu.c +@@ -462,6 +462,7 @@ void rsnd_parse_connect_ssiu(struct rsnd_dai *rdai, + struct device_node *capture) + { + struct rsnd_priv *priv = rsnd_rdai_to_priv(rdai); ++ struct device *dev = rsnd_priv_to_dev(priv); + struct device_node *node = rsnd_ssiu_of_node(priv); + struct rsnd_dai_stream *io_p = &rdai->playback; + struct rsnd_dai_stream *io_c = &rdai->capture; +@@ -474,7 +475,11 @@ void rsnd_parse_connect_ssiu(struct rsnd_dai *rdai, + for_each_child_of_node(node, np) { + struct rsnd_mod *mod; + +- i = rsnd_node_fixed_index(np, SSIU_NAME, i); ++ i = rsnd_node_fixed_index(dev, np, SSIU_NAME, i); ++ if (i < 0) { ++ of_node_put(np); ++ break; ++ } + + mod = rsnd_ssiu_mod_get(priv, i); + +-- +2.35.1 + diff --git a/queue-5.18/asoc-rt1015p-remove-dependency-on-gpiolib.patch b/queue-5.18/asoc-rt1015p-remove-dependency-on-gpiolib.patch new file mode 100644 index 00000000000..dbda2961708 --- /dev/null +++ b/queue-5.18/asoc-rt1015p-remove-dependency-on-gpiolib.patch @@ -0,0 +1,59 @@ +From f27df5a512bd11c5ff3fc453681f294a2f949113 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 May 2022 12:26:47 -0500 +Subject: ASoC: rt1015p: remove dependency on GPIOLIB +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pierre-Louis Bossart + +[ Upstream commit b390c25c6757b9d56cecdfbf6d55f15fc89a6386 ] + +commit dcc2c012c7691 ("ASoC: Fix gpiolib dependencies") removed a +series of unnecessary dependencies on GPIOLIB when the gpio was +optional. + +A similar simplification seems valid for rt1015p, so remove the +dependency as well. This will avoid the following warning + + WARNING: unmet direct dependencies detected for SND_SOC_RT1015P + + Depends on [n]: SOUND [=y] && !UML && SND [=y] && SND_SOC [=y] && + GPIOLIB [=n] + + Selected by [y]: + + - SND_SOC_INTEL_SOF_RT5682_MACH [=y] && SOUND [=y] && !UML && SND + [=y] && SND_SOC [=y] && SND_SOC_INTEL_MACH [=y] && + (SND_SOC_SOF_HDA_LINK [=y] || SND_SOC_SOF_BAYTRAIL [=n]) && I2C + [=y] && ACPI [=y] && (SND_HDA_CODEC_HDMI [=y] && + SND_SOC_SOF_HDA_AUDIO_CODEC [=y] && (MFD_INTEL_LPSS [=y] || + COMPILE_TEST [=y]) || SND_SOC_SOF_BAYTRAIL [=n] && + (X86_INTEL_LPSS [=n] || COMPILE_TEST [=y])) + +Reported-by: kernel test robot +Signed-off-by: Pierre-Louis Bossart +Reviewed-by: Péter Ujfalusi +Link: https://lore.kernel.org/r/20220517172647.468244-3-pierre-louis.bossart@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/Kconfig | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/sound/soc/codecs/Kconfig b/sound/soc/codecs/Kconfig +index 156f2519459d..3dea20b2c405 100644 +--- a/sound/soc/codecs/Kconfig ++++ b/sound/soc/codecs/Kconfig +@@ -1212,7 +1212,6 @@ config SND_SOC_RT1015 + + config SND_SOC_RT1015P + tristate +- depends on GPIOLIB + + config SND_SOC_RT1019 + tristate +-- +2.35.1 + diff --git a/queue-5.18/asoc-rt5645-fix-errorenous-cleanup-order.patch b/queue-5.18/asoc-rt5645-fix-errorenous-cleanup-order.patch new file mode 100644 index 00000000000..8cd9ab49cbf --- /dev/null +++ b/queue-5.18/asoc-rt5645-fix-errorenous-cleanup-order.patch @@ -0,0 +1,53 @@ +From 40b17b85c6e999e259e3318647cee8ebb3ef917e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 May 2022 17:20:35 +0800 +Subject: ASoC: rt5645: Fix errorenous cleanup order + +From: Lin Ma + +[ Upstream commit 2def44d3aec59e38d2701c568d65540783f90f2f ] + +There is a logic error when removing rt5645 device as the function +rt5645_i2c_remove() first cancel the &rt5645->jack_detect_work and +delete the &rt5645->btn_check_timer latter. However, since the timer +handler rt5645_btn_check_callback() will re-queue the jack_detect_work, +this cleanup order is buggy. + +That is, once the del_timer_sync in rt5645_i2c_remove is concurrently +run with the rt5645_btn_check_callback, the canceled jack_detect_work +will be rescheduled again, leading to possible use-after-free. + +This patch fix the issue by placing the del_timer_sync function before +the cancel_delayed_work_sync. + +Signed-off-by: Lin Ma +Link: https://lore.kernel.org/r/20220516092035.28283-1-linma@zju.edu.cn +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/rt5645.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/rt5645.c b/sound/soc/codecs/rt5645.c +index 197c56047947..4b2e027c1033 100644 +--- a/sound/soc/codecs/rt5645.c ++++ b/sound/soc/codecs/rt5645.c +@@ -4154,9 +4154,14 @@ static int rt5645_i2c_remove(struct i2c_client *i2c) + if (i2c->irq) + free_irq(i2c->irq, rt5645); + ++ /* ++ * Since the rt5645_btn_check_callback() can queue jack_detect_work, ++ * the timer need to be delted first ++ */ ++ del_timer_sync(&rt5645->btn_check_timer); ++ + cancel_delayed_work_sync(&rt5645->jack_detect_work); + cancel_delayed_work_sync(&rt5645->rcclock_work); +- del_timer_sync(&rt5645->btn_check_timer); + + regulator_bulk_disable(ARRAY_SIZE(rt5645->supplies), rt5645->supplies); + +-- +2.35.1 + diff --git a/queue-5.18/asoc-samsung-fix-refcount-leak-in-aries_audio_probe.patch b/queue-5.18/asoc-samsung-fix-refcount-leak-in-aries_audio_probe.patch new file mode 100644 index 00000000000..765063153bd --- /dev/null +++ b/queue-5.18/asoc-samsung-fix-refcount-leak-in-aries_audio_probe.patch @@ -0,0 +1,43 @@ +From 5c2a26f40806d9080966fcd5fc213b321b6f0c2b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 May 2022 08:38:28 +0400 +Subject: ASoC: samsung: Fix refcount leak in aries_audio_probe + +From: Miaoqian Lin + +[ Upstream commit bf4a9b2467b775717d0e9034ad916888e19713a3 ] + +of_parse_phandle() returns a node pointer with refcount +incremented, we should use of_node_put() on it when done. +If extcon_find_edev_by_node() fails, it doesn't call of_node_put() +Calling of_node_put() after extcon_find_edev_by_node() to fix this. + +Fixes: 7a3a7671fa6c ("ASoC: samsung: Add driver for Aries boards") +Signed-off-by: Miaoqian Lin +Reviewed-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20220512043828.496-1-linmq006@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/samsung/aries_wm8994.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/samsung/aries_wm8994.c b/sound/soc/samsung/aries_wm8994.c +index 5265e546b124..83acbe57b248 100644 +--- a/sound/soc/samsung/aries_wm8994.c ++++ b/sound/soc/samsung/aries_wm8994.c +@@ -585,10 +585,10 @@ static int aries_audio_probe(struct platform_device *pdev) + + extcon_np = of_parse_phandle(np, "extcon", 0); + priv->usb_extcon = extcon_find_edev_by_node(extcon_np); ++ of_node_put(extcon_np); + if (IS_ERR(priv->usb_extcon)) + return dev_err_probe(dev, PTR_ERR(priv->usb_extcon), + "Failed to get extcon device"); +- of_node_put(extcon_np); + + priv->adc = devm_iio_channel_get(dev, "headset-detect"); + if (IS_ERR(priv->adc)) +-- +2.35.1 + diff --git a/queue-5.18/asoc-sh-rz-ssi-propagate-error-codes-returned-from-p.patch b/queue-5.18/asoc-sh-rz-ssi-propagate-error-codes-returned-from-p.patch new file mode 100644 index 00000000000..575b11a10ca --- /dev/null +++ b/queue-5.18/asoc-sh-rz-ssi-propagate-error-codes-returned-from-p.patch @@ -0,0 +1,62 @@ +From cc8c98917290f29207b3153f1616dfa82fbc6308 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Apr 2022 08:49:21 +0100 +Subject: ASoC: sh: rz-ssi: Propagate error codes returned from + platform_get_irq_byname() + +From: Lad Prabhakar + +[ Upstream commit 91686a3984f34df0ab844cdbaa7e4d9621129f5d ] + +Propagate error codes returned from platform_get_irq_byname() instead of +returning -ENODEV. platform_get_irq_byname() may return -EPROBE_DEFER, to +handle such cases propagate the error codes. + +While at it drop the dev_err_probe() messages as platform_get_irq_byname() +already does this for us in case of error. + +Signed-off-by: Lad Prabhakar +Link: https://lore.kernel.org/r/20220426074922.13319-3-prabhakar.mahadev-lad.rj@bp.renesas.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sh/rz-ssi.c | 9 +++------ + 1 file changed, 3 insertions(+), 6 deletions(-) + +diff --git a/sound/soc/sh/rz-ssi.c b/sound/soc/sh/rz-ssi.c +index e8edaed05d4c..8bbcebbe7e73 100644 +--- a/sound/soc/sh/rz-ssi.c ++++ b/sound/soc/sh/rz-ssi.c +@@ -979,8 +979,7 @@ static int rz_ssi_probe(struct platform_device *pdev) + /* Error Interrupt */ + ssi->irq_int = platform_get_irq_byname(pdev, "int_req"); + if (ssi->irq_int < 0) +- return dev_err_probe(&pdev->dev, -ENODEV, +- "Unable to get SSI int_req IRQ\n"); ++ return ssi->irq_int; + + ret = devm_request_irq(&pdev->dev, ssi->irq_int, &rz_ssi_interrupt, + 0, dev_name(&pdev->dev), ssi); +@@ -992,8 +991,7 @@ static int rz_ssi_probe(struct platform_device *pdev) + /* Tx and Rx interrupts (pio only) */ + ssi->irq_tx = platform_get_irq_byname(pdev, "dma_tx"); + if (ssi->irq_tx < 0) +- return dev_err_probe(&pdev->dev, -ENODEV, +- "Unable to get SSI dma_tx IRQ\n"); ++ return ssi->irq_tx; + + ret = devm_request_irq(&pdev->dev, ssi->irq_tx, + &rz_ssi_interrupt, 0, +@@ -1004,8 +1002,7 @@ static int rz_ssi_probe(struct platform_device *pdev) + + ssi->irq_rx = platform_get_irq_byname(pdev, "dma_rx"); + if (ssi->irq_rx < 0) +- return dev_err_probe(&pdev->dev, -ENODEV, +- "Unable to get SSI dma_rx IRQ\n"); ++ return ssi->irq_rx; + + ret = devm_request_irq(&pdev->dev, ssi->irq_rx, + &rz_ssi_interrupt, 0, +-- +2.35.1 + diff --git a/queue-5.18/asoc-sh-rz-ssi-release-the-dma-channels-in-rz_ssi_pr.patch b/queue-5.18/asoc-sh-rz-ssi-release-the-dma-channels-in-rz_ssi_pr.patch new file mode 100644 index 00000000000..020bb578707 --- /dev/null +++ b/queue-5.18/asoc-sh-rz-ssi-release-the-dma-channels-in-rz_ssi_pr.patch @@ -0,0 +1,70 @@ +From d1140fc512df9e3cbff1d447734e15e0f1a63568 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Apr 2022 08:49:22 +0100 +Subject: ASoC: sh: rz-ssi: Release the DMA channels in rz_ssi_probe() error + path + +From: Lad Prabhakar + +[ Upstream commit 767e6f26204d3f5406630e86b720d01818b8616d ] + +DMA channels requested by rz_ssi_dma_request() in rz_ssi_probe() were +never released in the error path apart from one place. This patch fixes +this issue by calling rz_ssi_release_dma_channels() in the error path. + +Fixes: 26ac471c5354 ("ASoC: sh: rz-ssi: Add SSI DMAC support") +Reported-by: Pavel Machek +Signed-off-by: Lad Prabhakar +Link: https://lore.kernel.org/r/20220426074922.13319-4-prabhakar.mahadev-lad.rj@bp.renesas.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sh/rz-ssi.c | 13 ++++++++++--- + 1 file changed, 10 insertions(+), 3 deletions(-) + +diff --git a/sound/soc/sh/rz-ssi.c b/sound/soc/sh/rz-ssi.c +index 8bbcebbe7e73..8a0c01ca06be 100644 +--- a/sound/soc/sh/rz-ssi.c ++++ b/sound/soc/sh/rz-ssi.c +@@ -978,14 +978,18 @@ static int rz_ssi_probe(struct platform_device *pdev) + + /* Error Interrupt */ + ssi->irq_int = platform_get_irq_byname(pdev, "int_req"); +- if (ssi->irq_int < 0) ++ if (ssi->irq_int < 0) { ++ rz_ssi_release_dma_channels(ssi); + return ssi->irq_int; ++ } + + ret = devm_request_irq(&pdev->dev, ssi->irq_int, &rz_ssi_interrupt, + 0, dev_name(&pdev->dev), ssi); +- if (ret < 0) ++ if (ret < 0) { ++ rz_ssi_release_dma_channels(ssi); + return dev_err_probe(&pdev->dev, ret, + "irq request error (int_req)\n"); ++ } + + if (!rz_ssi_is_dma_enabled(ssi)) { + /* Tx and Rx interrupts (pio only) */ +@@ -1013,13 +1017,16 @@ static int rz_ssi_probe(struct platform_device *pdev) + } + + ssi->rstc = devm_reset_control_get_exclusive(&pdev->dev, NULL); +- if (IS_ERR(ssi->rstc)) ++ if (IS_ERR(ssi->rstc)) { ++ rz_ssi_release_dma_channels(ssi); + return PTR_ERR(ssi->rstc); ++ } + + reset_control_deassert(ssi->rstc); + pm_runtime_enable(&pdev->dev); + ret = pm_runtime_resume_and_get(&pdev->dev); + if (ret < 0) { ++ rz_ssi_release_dma_channels(ssi); + pm_runtime_disable(ssi->dev); + reset_control_assert(ssi->rstc); + return dev_err_probe(ssi->dev, ret, "pm_runtime_resume_and_get failed\n"); +-- +2.35.1 + diff --git a/queue-5.18/asoc-sof-amd-add-missing-platform_device_unregister-.patch b/queue-5.18/asoc-sof-amd-add-missing-platform_device_unregister-.patch new file mode 100644 index 00000000000..30b33967b2e --- /dev/null +++ b/queue-5.18/asoc-sof-amd-add-missing-platform_device_unregister-.patch @@ -0,0 +1,36 @@ +From c454008896e53315aec635bbe1eb2b43fe023109 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 May 2022 09:37:28 +0800 +Subject: ASoC: SOF: amd: add missing platform_device_unregister in + acp_pci_rn_probe + +From: Zheng Bin + +[ Upstream commit cbcab8cd737c74c20195c31d647e19f7cb49c9b8 ] + +acp_pci_rn_probe misses a call platform_device_unregister in error path, +this patch fixes that. + +Signed-off-by: Zheng Bin +Link: https://lore.kernel.org/r/20220512013728.4128903-1-zhengbin13@huawei.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/amd/pci-rn.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/soc/sof/amd/pci-rn.c b/sound/soc/sof/amd/pci-rn.c +index 392ffbdf6417..d809d151a38c 100644 +--- a/sound/soc/sof/amd/pci-rn.c ++++ b/sound/soc/sof/amd/pci-rn.c +@@ -93,6 +93,7 @@ static int acp_pci_rn_probe(struct pci_dev *pci, const struct pci_device_id *pci + res = devm_kzalloc(&pci->dev, sizeof(struct resource) * ARRAY_SIZE(renoir_res), GFP_KERNEL); + if (!res) { + sof_pci_remove(pci); ++ platform_device_unregister(dmic_dev); + return -ENOMEM; + } + +-- +2.35.1 + diff --git a/queue-5.18/asoc-sof-ipc3-topology-correct-get_control_data-for-.patch b/queue-5.18/asoc-sof-ipc3-topology-correct-get_control_data-for-.patch new file mode 100644 index 00000000000..ac49109204b --- /dev/null +++ b/queue-5.18/asoc-sof-ipc3-topology-correct-get_control_data-for-.patch @@ -0,0 +1,109 @@ +From 141ca713bf304cc83f8028b74d3da442331c2cdd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Apr 2022 21:52:21 +0300 +Subject: ASoC: SOF: ipc3-topology: Correct get_control_data for non bytes + payload + +From: Peter Ujfalusi + +[ Upstream commit a962890a5a3cce903ff7c7a19fadee63ed9efdc7 ] + +It is possible to craft a topology where sof_get_control_data() would do +out of bounds access because it expects that it is only called when the +payload is bytes type. +Confusingly it also handles other types of controls, but the payload +parsing implementation is only valid for bytes. + +Fix the code to count the non bytes controls and instead of storing a +pointer to sof_abi_hdr in sof_widget_data (which is only valid for bytes), +store the pointer to the data itself and add a new member to save the size +of the data. + +In case of non bytes controls we store the pointer to the chanv itself, +which is just an array of values at the end. + +In case of bytes control, drop the wrong cdata->data (wdata[i].pdata) check +against NULL since it is incorrect and invalid in this context. +The data is pointing to the end of cdata struct, so it should never be +null. + +Reported-by: Sergey Senozhatsky +Signed-off-by: Peter Ujfalusi +Reviewed-by: Sergey Senozhatsky +Tested-by: Sergey Senozhatsky +Link: https://lore.kernel.org/r/20220427185221.28928-1-peter.ujfalusi@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/ipc3-topology.c | 39 +++++++++++++++++++++++------------ + 1 file changed, 26 insertions(+), 13 deletions(-) + +diff --git a/sound/soc/sof/ipc3-topology.c b/sound/soc/sof/ipc3-topology.c +index 2f8450a8c0a1..af1bbd34213c 100644 +--- a/sound/soc/sof/ipc3-topology.c ++++ b/sound/soc/sof/ipc3-topology.c +@@ -20,7 +20,8 @@ + struct sof_widget_data { + int ctrl_type; + int ipc_cmd; +- struct sof_abi_hdr *pdata; ++ void *pdata; ++ size_t pdata_size; + struct snd_sof_control *control; + }; + +@@ -784,16 +785,26 @@ static int sof_get_control_data(struct snd_soc_component *scomp, + } + + cdata = wdata[i].control->ipc_control_data; +- wdata[i].pdata = cdata->data; +- if (!wdata[i].pdata) +- return -EINVAL; + +- /* make sure data is valid - data can be updated at runtime */ +- if (widget->dobj.widget.kcontrol_type[i] == SND_SOC_TPLG_TYPE_BYTES && +- wdata[i].pdata->magic != SOF_ABI_MAGIC) +- return -EINVAL; ++ if (widget->dobj.widget.kcontrol_type[i] == SND_SOC_TPLG_TYPE_BYTES) { ++ /* make sure data is valid - data can be updated at runtime */ ++ if (cdata->data->magic != SOF_ABI_MAGIC) ++ return -EINVAL; ++ ++ wdata[i].pdata = cdata->data->data; ++ wdata[i].pdata_size = cdata->data->size; ++ } else { ++ /* points to the control data union */ ++ wdata[i].pdata = cdata->chanv; ++ /* ++ * wdata[i].control->size is calculated with struct_size ++ * and includes the size of struct sof_ipc_ctrl_data ++ */ ++ wdata[i].pdata_size = wdata[i].control->size - ++ sizeof(struct sof_ipc_ctrl_data); ++ } + +- *size += wdata[i].pdata->size; ++ *size += wdata[i].pdata_size; + + /* get data type */ + switch (cdata->cmd) { +@@ -876,10 +887,12 @@ static int sof_process_load(struct snd_soc_component *scomp, + */ + if (ipc_data_size) { + for (i = 0; i < widget->num_kcontrols; i++) { +- memcpy(&process->data[offset], +- wdata[i].pdata->data, +- wdata[i].pdata->size); +- offset += wdata[i].pdata->size; ++ if (!wdata[i].pdata_size) ++ continue; ++ ++ memcpy(&process->data[offset], wdata[i].pdata, ++ wdata[i].pdata_size); ++ offset += wdata[i].pdata_size; + } + } + +-- +2.35.1 + diff --git a/queue-5.18/asoc-sof-ipc3-topology-set-scontrol-priv-to-null-aft.patch b/queue-5.18/asoc-sof-ipc3-topology-set-scontrol-priv-to-null-aft.patch new file mode 100644 index 00000000000..1ea2f75d0a3 --- /dev/null +++ b/queue-5.18/asoc-sof-ipc3-topology-set-scontrol-priv-to-null-aft.patch @@ -0,0 +1,38 @@ +From 6b22d790f4d3ce4b86630e9bf5ae13f7655d3d42 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 31 Mar 2022 14:47:57 +0300 +Subject: ASoC: SOF: ipc3-topology: Set scontrol->priv to NULL after freeing it + +From: Peter Ujfalusi + +[ Upstream commit a403993ce98fb401f696da7c4f374739a7609cff ] + +Since the scontrol->priv is freed up during load operation it should be set +to NULL to be safe against double freeing attempt. + +Fixes: b5cee8feb1d48 ("ASoC: SOF: topology: Make control parsing IPC agnostic") +Signed-off-by: Peter Ujfalusi +Reviewed-by: Ranjani Sridharan +Reviewed-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20220331114757.32551-1-peter.ujfalusi@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/ipc3-topology.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/soc/sof/ipc3-topology.c b/sound/soc/sof/ipc3-topology.c +index af1bbd34213c..cdff48c4195f 100644 +--- a/sound/soc/sof/ipc3-topology.c ++++ b/sound/soc/sof/ipc3-topology.c +@@ -1605,6 +1605,7 @@ static int sof_ipc3_control_load_bytes(struct snd_sof_dev *sdev, struct snd_sof_ + if (scontrol->priv_size > 0) { + memcpy(cdata->data, scontrol->priv, scontrol->priv_size); + kfree(scontrol->priv); ++ scontrol->priv = NULL; + + if (cdata->data->magic != SOF_ABI_MAGIC) { + dev_err(sdev->dev, "Wrong ABI magic 0x%08x.\n", cdata->data->magic); +-- +2.35.1 + diff --git a/queue-5.18/asoc-ti-j721e-evm-fix-refcount-leak-in-j721e_soc_pro.patch b/queue-5.18/asoc-ti-j721e-evm-fix-refcount-leak-in-j721e_soc_pro.patch new file mode 100644 index 00000000000..d15bec0ccec --- /dev/null +++ b/queue-5.18/asoc-ti-j721e-evm-fix-refcount-leak-in-j721e_soc_pro.patch @@ -0,0 +1,136 @@ +From 812f91e4050f226a2efb61c1f8cf7a9b6c6a5f46 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 May 2022 15:13:30 +0400 +Subject: ASoC: ti: j721e-evm: Fix refcount leak in j721e_soc_probe_* + +From: Miaoqian Lin + +[ Upstream commit a34840c4eb3278a7c29c9c57a65ce7541c66f9f2 ] + +of_parse_phandle() returns a node pointer with refcount +incremented, we should use of_node_put() on it when not needed anymore. +Add missing of_node_put() to avoid refcount leak. + +Fixes: 6748d0559059 ("ASoC: ti: Add custom machine driver for j721e EVM (CPB and IVI)") +Signed-off-by: Miaoqian Lin +Link: https://lore.kernel.org/r/20220512111331.44774-1-linmq006@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/ti/j721e-evm.c | 44 ++++++++++++++++++++++++++++++---------- + 1 file changed, 33 insertions(+), 11 deletions(-) + +diff --git a/sound/soc/ti/j721e-evm.c b/sound/soc/ti/j721e-evm.c +index 4077e15ec48b..6a969874c927 100644 +--- a/sound/soc/ti/j721e-evm.c ++++ b/sound/soc/ti/j721e-evm.c +@@ -630,17 +630,18 @@ static int j721e_soc_probe_cpb(struct j721e_priv *priv, int *link_idx, + codec_node = of_parse_phandle(node, "ti,cpb-codec", 0); + if (!codec_node) { + dev_err(priv->dev, "CPB codec node is not provided\n"); +- return -EINVAL; ++ ret = -EINVAL; ++ goto put_dai_node; + } + + domain = &priv->audio_domains[J721E_AUDIO_DOMAIN_CPB]; + ret = j721e_get_clocks(priv->dev, &domain->codec, "cpb-codec-scki"); + if (ret) +- return ret; ++ goto put_codec_node; + + ret = j721e_get_clocks(priv->dev, &domain->mcasp, "cpb-mcasp-auxclk"); + if (ret) +- return ret; ++ goto put_codec_node; + + /* + * Common Processor Board, two links +@@ -650,8 +651,10 @@ static int j721e_soc_probe_cpb(struct j721e_priv *priv, int *link_idx, + comp_count = 6; + compnent = devm_kzalloc(priv->dev, comp_count * sizeof(*compnent), + GFP_KERNEL); +- if (!compnent) +- return -ENOMEM; ++ if (!compnent) { ++ ret = -ENOMEM; ++ goto put_codec_node; ++ } + + comp_idx = 0; + priv->dai_links[*link_idx].cpus = &compnent[comp_idx++]; +@@ -702,6 +705,12 @@ static int j721e_soc_probe_cpb(struct j721e_priv *priv, int *link_idx, + (*conf_idx)++; + + return 0; ++ ++put_codec_node: ++ of_node_put(codec_node); ++put_dai_node: ++ of_node_put(dai_node); ++ return ret; + } + + static int j721e_soc_probe_ivi(struct j721e_priv *priv, int *link_idx, +@@ -726,23 +735,25 @@ static int j721e_soc_probe_ivi(struct j721e_priv *priv, int *link_idx, + codeca_node = of_parse_phandle(node, "ti,ivi-codec-a", 0); + if (!codeca_node) { + dev_err(priv->dev, "IVI codec-a node is not provided\n"); +- return -EINVAL; ++ ret = -EINVAL; ++ goto put_dai_node; + } + + codecb_node = of_parse_phandle(node, "ti,ivi-codec-b", 0); + if (!codecb_node) { + dev_warn(priv->dev, "IVI codec-b node is not provided\n"); +- return 0; ++ ret = 0; ++ goto put_codeca_node; + } + + domain = &priv->audio_domains[J721E_AUDIO_DOMAIN_IVI]; + ret = j721e_get_clocks(priv->dev, &domain->codec, "ivi-codec-scki"); + if (ret) +- return ret; ++ goto put_codecb_node; + + ret = j721e_get_clocks(priv->dev, &domain->mcasp, "ivi-mcasp-auxclk"); + if (ret) +- return ret; ++ goto put_codecb_node; + + /* + * IVI extension, two links +@@ -754,8 +765,10 @@ static int j721e_soc_probe_ivi(struct j721e_priv *priv, int *link_idx, + comp_count = 8; + compnent = devm_kzalloc(priv->dev, comp_count * sizeof(*compnent), + GFP_KERNEL); +- if (!compnent) +- return -ENOMEM; ++ if (!compnent) { ++ ret = -ENOMEM; ++ goto put_codecb_node; ++ } + + comp_idx = 0; + priv->dai_links[*link_idx].cpus = &compnent[comp_idx++]; +@@ -816,6 +829,15 @@ static int j721e_soc_probe_ivi(struct j721e_priv *priv, int *link_idx, + (*conf_idx)++; + + return 0; ++ ++ ++put_codecb_node: ++ of_node_put(codecb_node); ++put_codeca_node: ++ of_node_put(codeca_node); ++put_dai_node: ++ of_node_put(dai_node); ++ return ret; + } + + static int j721e_soc_probe(struct platform_device *pdev) +-- +2.35.1 + diff --git a/queue-5.18/asoc-tscs454-add-endianness-flag-in-snd_soc_componen.patch b/queue-5.18/asoc-tscs454-add-endianness-flag-in-snd_soc_componen.patch new file mode 100644 index 00000000000..3ed3476099a --- /dev/null +++ b/queue-5.18/asoc-tscs454-add-endianness-flag-in-snd_soc_componen.patch @@ -0,0 +1,68 @@ +From 3dcc06e4213132307be3f1ad43bb893c5011e1dc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 May 2022 18:08:52 +0100 +Subject: ASoC: tscs454: Add endianness flag in snd_soc_component_driver + +From: Charles Keepax + +[ Upstream commit ff69ec96b87dccb3a29edef8cec5d4fefbbc2055 ] + +The endianness flag is used on the CODEC side to specify an +ambivalence to endian, typically because it is lost over the hardware +link. This device receives audio over an I2S DAI and as such should +have endianness applied. + +A fixup is also required to use the width directly rather than relying +on the format in hw_params, now both little and big endian would be +supported. It is worth noting this changes the behaviour of S24_LE to +use a word length of 24 rather than 32. This would appear to be a +correction since the fact S24_LE is stored as 32 bits should not be +presented over the bus. + +Signed-off-by: Charles Keepax +Link: https://lore.kernel.org/r/20220504170905.332415-26-ckeepax@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/tscs454.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/sound/soc/codecs/tscs454.c b/sound/soc/codecs/tscs454.c +index 7e1826d6f06f..32e6fa7b0a06 100644 +--- a/sound/soc/codecs/tscs454.c ++++ b/sound/soc/codecs/tscs454.c +@@ -3120,18 +3120,17 @@ static int set_aif_sample_format(struct snd_soc_component *component, + unsigned int width; + int ret; + +- switch (format) { +- case SNDRV_PCM_FORMAT_S16_LE: ++ switch (snd_pcm_format_width(format)) { ++ case 16: + width = FV_WL_16; + break; +- case SNDRV_PCM_FORMAT_S20_3LE: ++ case 20: + width = FV_WL_20; + break; +- case SNDRV_PCM_FORMAT_S24_3LE: ++ case 24: + width = FV_WL_24; + break; +- case SNDRV_PCM_FORMAT_S24_LE: +- case SNDRV_PCM_FORMAT_S32_LE: ++ case 32: + width = FV_WL_32; + break; + default: +@@ -3326,6 +3325,7 @@ static const struct snd_soc_component_driver soc_component_dev_tscs454 = { + .num_dapm_routes = ARRAY_SIZE(tscs454_intercon), + .controls = tscs454_snd_controls, + .num_controls = ARRAY_SIZE(tscs454_snd_controls), ++ .endianness = 1, + }; + + #define TSCS454_RATES SNDRV_PCM_RATE_8000_96000 +-- +2.35.1 + diff --git a/queue-5.18/asoc-wm2000-fix-missing-clk_disable_unprepare-on-err.patch b/queue-5.18/asoc-wm2000-fix-missing-clk_disable_unprepare-on-err.patch new file mode 100644 index 00000000000..3637d088c35 --- /dev/null +++ b/queue-5.18/asoc-wm2000-fix-missing-clk_disable_unprepare-on-err.patch @@ -0,0 +1,55 @@ +From 399800cbc7477229fd3354a712caf949e341c23c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 14 May 2022 17:10:53 +0800 +Subject: ASoC: wm2000: fix missing clk_disable_unprepare() on error in + wm2000_anc_transition() + +From: Yang Yingliang + +[ Upstream commit be2af740e2a9c7134f2d8ab4f104006e110b13de ] + +Fix the missing clk_disable_unprepare() before return +from wm2000_anc_transition() in the error handling case. + +Fixes: 514cfd6dd725 ("ASoC: wm2000: Integrate with clock API") +Signed-off-by: Yang Yingliang +Acked-by: Charles Keepax +Link: https://lore.kernel.org/r/20220514091053.686416-1-yangyingliang@huawei.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wm2000.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/sound/soc/codecs/wm2000.c b/sound/soc/codecs/wm2000.c +index 72e165cc6443..97ece3114b3d 100644 +--- a/sound/soc/codecs/wm2000.c ++++ b/sound/soc/codecs/wm2000.c +@@ -536,7 +536,7 @@ static int wm2000_anc_transition(struct wm2000_priv *wm2000, + { + struct i2c_client *i2c = wm2000->i2c; + int i, j; +- int ret; ++ int ret = 0; + + if (wm2000->anc_mode == mode) + return 0; +@@ -566,13 +566,13 @@ static int wm2000_anc_transition(struct wm2000_priv *wm2000, + ret = anc_transitions[i].step[j](i2c, + anc_transitions[i].analogue); + if (ret != 0) +- return ret; ++ break; + } + + if (anc_transitions[i].dest == ANC_OFF) + clk_disable_unprepare(wm2000->mclk); + +- return 0; ++ return ret; + } + + static int wm2000_anc_set_mode(struct wm2000_priv *wm2000) +-- +2.35.1 + diff --git a/queue-5.18/ath10k-skip-ath10k_halt-during-suspend-for-driver-st.patch b/queue-5.18/ath10k-skip-ath10k_halt-during-suspend-for-driver-st.patch new file mode 100644 index 00000000000..9bae9dfa5b1 --- /dev/null +++ b/queue-5.18/ath10k-skip-ath10k_halt-during-suspend-for-driver-st.patch @@ -0,0 +1,114 @@ +From ac45196d1e5008f6d9a492f5558467ecc5f680ed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Apr 2022 10:37:33 +0300 +Subject: ath10k: skip ath10k_halt during suspend for driver state RESTARTING + +From: Abhishek Kumar + +[ Upstream commit b72a4aff947ba807177bdabb43debaf2c66bee05 ] + +Double free crash is observed when FW recovery(caused by wmi +timeout/crash) is followed by immediate suspend event. The FW recovery +is triggered by ath10k_core_restart() which calls driver clean up via +ath10k_halt(). When the suspend event occurs between the FW recovery, +the restart worker thread is put into frozen state until suspend completes. +The suspend event triggers ath10k_stop() which again triggers ath10k_halt() +The double invocation of ath10k_halt() causes ath10k_htt_rx_free() to be +called twice(Note: ath10k_htt_rx_alloc was not called by restart worker +thread because of its frozen state), causing the crash. + +To fix this, during the suspend flow, skip call to ath10k_halt() in +ath10k_stop() when the current driver state is ATH10K_STATE_RESTARTING. +Also, for driver state ATH10K_STATE_RESTARTING, call +ath10k_wait_for_suspend() in ath10k_stop(). This is because call to +ath10k_wait_for_suspend() is skipped later in +[ath10k_halt() > ath10k_core_stop()] for the driver state +ATH10K_STATE_RESTARTING. + +The frozen restart worker thread will be cancelled during resume when the +device comes out of suspend. + +Below is the crash stack for reference: + +[ 428.469167] ------------[ cut here ]------------ +[ 428.469180] kernel BUG at mm/slub.c:4150! +[ 428.469193] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI +[ 428.469219] Workqueue: events_unbound async_run_entry_fn +[ 428.469230] RIP: 0010:kfree+0x319/0x31b +[ 428.469241] RSP: 0018:ffffa1fac015fc30 EFLAGS: 00010246 +[ 428.469247] RAX: ffffedb10419d108 RBX: ffff8c05262b0000 +[ 428.469252] RDX: ffff8c04a8c07000 RSI: 0000000000000000 +[ 428.469256] RBP: ffffa1fac015fc78 R08: 0000000000000000 +[ 428.469276] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 428.469285] Call Trace: +[ 428.469295] ? dma_free_attrs+0x5f/0x7d +[ 428.469320] ath10k_core_stop+0x5b/0x6f +[ 428.469336] ath10k_halt+0x126/0x177 +[ 428.469352] ath10k_stop+0x41/0x7e +[ 428.469387] drv_stop+0x88/0x10e +[ 428.469410] __ieee80211_suspend+0x297/0x411 +[ 428.469441] rdev_suspend+0x6e/0xd0 +[ 428.469462] wiphy_suspend+0xb1/0x105 +[ 428.469483] ? name_show+0x2d/0x2d +[ 428.469490] dpm_run_callback+0x8c/0x126 +[ 428.469511] ? name_show+0x2d/0x2d +[ 428.469517] __device_suspend+0x2e7/0x41b +[ 428.469523] async_suspend+0x1f/0x93 +[ 428.469529] async_run_entry_fn+0x3d/0xd1 +[ 428.469535] process_one_work+0x1b1/0x329 +[ 428.469541] worker_thread+0x213/0x372 +[ 428.469547] kthread+0x150/0x15f +[ 428.469552] ? pr_cont_work+0x58/0x58 +[ 428.469558] ? kthread_blkcg+0x31/0x31 + +Tested-on: QCA6174 hw3.2 PCI WLAN.RM.4.4.1-00288-QCARMSWPZ-1 +Co-developed-by: Wen Gong +Signed-off-by: Wen Gong +Signed-off-by: Abhishek Kumar +Reviewed-by: Brian Norris +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20220426221859.v2.1.I650b809482e1af8d0156ed88b5dc2677a0711d46@changeid +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath10k/mac.c | 20 ++++++++++++++++++-- + 1 file changed, 18 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c +index b11aaee8b8c0..a11b31191d5a 100644 +--- a/drivers/net/wireless/ath/ath10k/mac.c ++++ b/drivers/net/wireless/ath/ath10k/mac.c +@@ -5339,13 +5339,29 @@ static int ath10k_start(struct ieee80211_hw *hw) + static void ath10k_stop(struct ieee80211_hw *hw) + { + struct ath10k *ar = hw->priv; ++ u32 opt; + + ath10k_drain_tx(ar); + + mutex_lock(&ar->conf_mutex); + if (ar->state != ATH10K_STATE_OFF) { +- if (!ar->hw_rfkill_on) +- ath10k_halt(ar); ++ if (!ar->hw_rfkill_on) { ++ /* If the current driver state is RESTARTING but not yet ++ * fully RESTARTED because of incoming suspend event, ++ * then ath10k_halt() is already called via ++ * ath10k_core_restart() and should not be called here. ++ */ ++ if (ar->state != ATH10K_STATE_RESTARTING) { ++ ath10k_halt(ar); ++ } else { ++ /* Suspending here, because when in RESTARTING ++ * state, ath10k_core_stop() skips ++ * ath10k_wait_for_suspend(). ++ */ ++ opt = WMI_PDEV_SUSPEND_AND_DISABLE_INTR; ++ ath10k_wait_for_suspend(ar, opt); ++ } ++ } + ar->state = ATH10K_STATE_OFF; + } + mutex_unlock(&ar->conf_mutex); +-- +2.35.1 + diff --git a/queue-5.18/ath11k-acquire-ab-base_lock-in-unassign-when-finding.patch b/queue-5.18/ath11k-acquire-ab-base_lock-in-unassign-when-finding.patch new file mode 100644 index 00000000000..dd01a007924 --- /dev/null +++ b/queue-5.18/ath11k-acquire-ab-base_lock-in-unassign-when-finding.patch @@ -0,0 +1,64 @@ +From 34df339d3a85f7bf0741994446dce6d2be20aefa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Mar 2022 12:58:23 +0200 +Subject: ath11k: acquire ab->base_lock in unassign when finding the peer by + addr + +From: Niels Dossche + +[ Upstream commit 2db80f93869d491be57cbc2b36f30d0d3a0e5bde ] + +ath11k_peer_find_by_addr states via lockdep that ab->base_lock must be +held when calling that function in order to protect the list. All +callers except ath11k_mac_op_unassign_vif_chanctx have that lock +acquired when calling ath11k_peer_find_by_addr. That lock is also not +transitively held by a path towards ath11k_mac_op_unassign_vif_chanctx. +The solution is to acquire the lock when calling +ath11k_peer_find_by_addr inside ath11k_mac_op_unassign_vif_chanctx. + +I am currently working on a static analyser to detect missing locks and +this was a reported case. I manually verified the report by looking at +the code, but I do not have real hardware so this is compile tested +only. + +Fixes: 701e48a43e15 ("ath11k: add packet log support for QCA6390") +Signed-off-by: Niels Dossche +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20220314215253.92658-1-dossche.niels@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath11k/mac.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c +index 58ff761393db..2c8d5f2a0517 100644 +--- a/drivers/net/wireless/ath/ath11k/mac.c ++++ b/drivers/net/wireless/ath/ath11k/mac.c +@@ -7114,6 +7114,7 @@ ath11k_mac_op_unassign_vif_chanctx(struct ieee80211_hw *hw, + struct ath11k *ar = hw->priv; + struct ath11k_base *ab = ar->ab; + struct ath11k_vif *arvif = (void *)vif->drv_priv; ++ struct ath11k_peer *peer; + int ret; + + mutex_lock(&ar->conf_mutex); +@@ -7125,9 +7126,13 @@ ath11k_mac_op_unassign_vif_chanctx(struct ieee80211_hw *hw, + WARN_ON(!arvif->is_started); + + if (ab->hw_params.vdev_start_delay && +- arvif->vdev_type == WMI_VDEV_TYPE_MONITOR && +- ath11k_peer_find_by_addr(ab, ar->mac_addr)) +- ath11k_peer_delete(ar, arvif->vdev_id, ar->mac_addr); ++ arvif->vdev_type == WMI_VDEV_TYPE_MONITOR) { ++ spin_lock_bh(&ab->base_lock); ++ peer = ath11k_peer_find_by_addr(ab, ar->mac_addr); ++ spin_unlock_bh(&ab->base_lock); ++ if (peer) ++ ath11k_peer_delete(ar, arvif->vdev_id, ar->mac_addr); ++ } + + if (arvif->vdev_type == WMI_VDEV_TYPE_MONITOR) { + ret = ath11k_mac_monitor_stop(ar); +-- +2.35.1 + diff --git a/queue-5.18/ath11k-change-max-no-of-active-probe-ssid-and-bssid-.patch b/queue-5.18/ath11k-change-max-no-of-active-probe-ssid-and-bssid-.patch new file mode 100644 index 00000000000..42d9f810ea5 --- /dev/null +++ b/queue-5.18/ath11k-change-max-no-of-active-probe-ssid-and-bssid-.patch @@ -0,0 +1,79 @@ +From 899d1ce1d61d675a3ea83f14e9c5236e2d2711c9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Apr 2022 14:53:09 +0300 +Subject: ath11k: Change max no of active probe SSID and BSSID to fw capability + +From: Karthikeyan Kathirvel + +[ Upstream commit 50dc9ce9f80554a88e33b73c30851acf2be36ed3 ] + +The maximum number of SSIDs in a for active probe requests is currently +reported as 16 (WLAN_SCAN_PARAMS_MAX_SSID) when registering the driver. +The scan_req_params structure only has the capacity to hold 10 SSIDs. +This leads to a buffer overflow which can be triggered from +wpa_supplicant in userspace. When copying the SSIDs into the +scan_req_params structure in the ath11k_mac_op_hw_scan route, it can +overwrite the extraie pointer. + +Firmware supports 16 ssid * 4 bssid, for each ssid 4 bssid combo probe +request will be sent, so totally 64 probe requests supported. So +set both max ssid and bssid to 16 and 4 respectively. Remove the +redundant macros of ssid and bssid. + +Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01300-QCAHKSWPL_SILICONZ-1 + +Signed-off-by: Karthikeyan Kathirvel +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20220329150221.21907-1-quic_kathirve@quicinc.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath11k/wmi.h | 12 ++---------- + 1 file changed, 2 insertions(+), 10 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath11k/wmi.h b/drivers/net/wireless/ath/ath11k/wmi.h +index 587f42307250..b5b72483477d 100644 +--- a/drivers/net/wireless/ath/ath11k/wmi.h ++++ b/drivers/net/wireless/ath/ath11k/wmi.h +@@ -3088,9 +3088,6 @@ enum scan_dwelltime_adaptive_mode { + SCAN_DWELL_MODE_STATIC = 4 + }; + +-#define WLAN_SCAN_MAX_NUM_SSID 10 +-#define WLAN_SCAN_MAX_NUM_BSSID 10 +- + #define WLAN_SSID_MAX_LEN 32 + + struct element_info { +@@ -3105,7 +3102,6 @@ struct wlan_ssid { + + #define WMI_IE_BITMAP_SIZE 8 + +-#define WMI_SCAN_MAX_NUM_SSID 0x0A + /* prefix used by scan requestor ids on the host */ + #define WMI_HOST_SCAN_REQUESTOR_ID_PREFIX 0xA000 + +@@ -3113,10 +3109,6 @@ struct wlan_ssid { + /* host cycles through the lower 12 bits to generate ids */ + #define WMI_HOST_SCAN_REQ_ID_PREFIX 0xA000 + +-#define WLAN_SCAN_PARAMS_MAX_SSID 16 +-#define WLAN_SCAN_PARAMS_MAX_BSSID 4 +-#define WLAN_SCAN_PARAMS_MAX_IE_LEN 256 +- + /* Values lower than this may be refused by some firmware revisions with a scan + * completion with a timedout reason. + */ +@@ -3312,8 +3304,8 @@ struct scan_req_params { + u32 n_probes; + u32 *chan_list; + u32 notify_scan_events; +- struct wlan_ssid ssid[WLAN_SCAN_MAX_NUM_SSID]; +- struct wmi_mac_addr bssid_list[WLAN_SCAN_MAX_NUM_BSSID]; ++ struct wlan_ssid ssid[WLAN_SCAN_PARAMS_MAX_SSID]; ++ struct wmi_mac_addr bssid_list[WLAN_SCAN_PARAMS_MAX_BSSID]; + struct element_info extraie; + struct element_info htcap; + struct element_info vhtcap; +-- +2.35.1 + diff --git a/queue-5.18/ath11k-disable-spectral-scan-during-spectral-deinit.patch b/queue-5.18/ath11k-disable-spectral-scan-during-spectral-deinit.patch new file mode 100644 index 00000000000..d8c7a4a0ffd --- /dev/null +++ b/queue-5.18/ath11k-disable-spectral-scan-during-spectral-deinit.patch @@ -0,0 +1,104 @@ +From 159d3b53b3a7f94c1d389afefef6f88610a9701b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 23 Apr 2022 12:36:47 +0300 +Subject: ath11k: disable spectral scan during spectral deinit + +From: Hari Chandrakanthan + +[ Upstream commit 161c64de239c7018e0295e7e0520a19f00aa32dc ] + +When ath11k modules are removed using rmmod with spectral scan enabled, +crash is observed. Different crash trace is observed for each crash. + +Send spectral scan disable WMI command to firmware before cleaning +the spectral dbring in the spectral_deinit API to avoid this crash. + +call trace from one of the crash observed: +[ 1252.880802] Unable to handle kernel NULL pointer dereference at virtual address 00000008 +[ 1252.882722] pgd = 0f42e886 +[ 1252.890955] [00000008] *pgd=00000000 +[ 1252.893478] Internal error: Oops: 5 [#1] PREEMPT SMP ARM +[ 1253.093035] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.4.89 #0 +[ 1253.115261] Hardware name: Generic DT based system +[ 1253.121149] PC is at ath11k_spectral_process_data+0x434/0x574 [ath11k] +[ 1253.125940] LR is at 0x88e31017 +[ 1253.132448] pc : [<7f9387b8>] lr : [<88e31017>] psr: a0000193 +[ 1253.135488] sp : 80d01bc8 ip : 00000001 fp : 970e0000 +[ 1253.141737] r10: 88e31000 r9 : 970ec000 r8 : 00000080 +[ 1253.146946] r7 : 94734040 r6 : a0000113 r5 : 00000057 r4 : 00000000 +[ 1253.152159] r3 : e18cb694 r2 : 00000217 r1 : 1df1f000 r0 : 00000001 +[ 1253.158755] Flags: NzCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment user +[ 1253.165266] Control: 10c0383d Table: 5e71006a DAC: 00000055 +[ 1253.172472] Process swapper/0 (pid: 0, stack limit = 0x60870141) +[ 1253.458055] [<7f9387b8>] (ath11k_spectral_process_data [ath11k]) from [<7f917fdc>] (ath11k_dbring_buffer_release_event+0x214/0x2e4 [ath11k]) +[ 1253.466139] [<7f917fdc>] (ath11k_dbring_buffer_release_event [ath11k]) from [<7f8ea3c4>] (ath11k_wmi_tlv_op_rx+0x1840/0x29cc [ath11k]) +[ 1253.478807] [<7f8ea3c4>] (ath11k_wmi_tlv_op_rx [ath11k]) from [<7f8fe868>] (ath11k_htc_rx_completion_handler+0x180/0x4e0 [ath11k]) +[ 1253.490699] [<7f8fe868>] (ath11k_htc_rx_completion_handler [ath11k]) from [<7f91308c>] (ath11k_ce_per_engine_service+0x2c4/0x3b4 [ath11k]) +[ 1253.502386] [<7f91308c>] (ath11k_ce_per_engine_service [ath11k]) from [<7f9a4198>] (ath11k_pci_ce_tasklet+0x28/0x80 [ath11k_pci]) +[ 1253.514811] [<7f9a4198>] (ath11k_pci_ce_tasklet [ath11k_pci]) from [<8032227c>] (tasklet_action_common.constprop.2+0x64/0xe8) +[ 1253.526476] [<8032227c>] (tasklet_action_common.constprop.2) from [<803021e8>] (__do_softirq+0x130/0x2d0) +[ 1253.537756] [<803021e8>] (__do_softirq) from [<80322610>] (irq_exit+0xcc/0xe8) +[ 1253.547304] [<80322610>] (irq_exit) from [<8036a4a4>] (__handle_domain_irq+0x60/0xb4) +[ 1253.554428] [<8036a4a4>] (__handle_domain_irq) from [<805eb348>] (gic_handle_irq+0x4c/0x90) +[ 1253.562321] [<805eb348>] (gic_handle_irq) from [<80301a78>] (__irq_svc+0x58/0x8c) + +Tested-on: QCN6122 hw1.0 AHB WLAN.HK.2.6.0.1-00851-QCAHKSWPL_SILICONZ-1 + +Signed-off-by: Hari Chandrakanthan +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/1649396345-349-1-git-send-email-quic_haric@quicinc.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath11k/spectral.c | 17 +++++++++-------- + 1 file changed, 9 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath11k/spectral.c b/drivers/net/wireless/ath/ath11k/spectral.c +index 2b18871d5f7c..516a7b4cd180 100644 +--- a/drivers/net/wireless/ath/ath11k/spectral.c ++++ b/drivers/net/wireless/ath/ath11k/spectral.c +@@ -212,7 +212,10 @@ static int ath11k_spectral_scan_config(struct ath11k *ar, + return -ENODEV; + + arvif->spectral_enabled = (mode != ATH11K_SPECTRAL_DISABLED); ++ ++ spin_lock_bh(&ar->spectral.lock); + ar->spectral.mode = mode; ++ spin_unlock_bh(&ar->spectral.lock); + + ret = ath11k_wmi_vdev_spectral_enable(ar, arvif->vdev_id, + ATH11K_WMI_SPECTRAL_TRIGGER_CMD_CLEAR, +@@ -843,9 +846,6 @@ static inline void ath11k_spectral_ring_free(struct ath11k *ar) + { + struct ath11k_spectral *sp = &ar->spectral; + +- if (!sp->enabled) +- return; +- + ath11k_dbring_srng_cleanup(ar, &sp->rx_ring); + ath11k_dbring_buf_cleanup(ar, &sp->rx_ring); + } +@@ -897,15 +897,16 @@ void ath11k_spectral_deinit(struct ath11k_base *ab) + if (!sp->enabled) + continue; + +- ath11k_spectral_debug_unregister(ar); +- ath11k_spectral_ring_free(ar); ++ mutex_lock(&ar->conf_mutex); ++ ath11k_spectral_scan_config(ar, ATH11K_SPECTRAL_DISABLED); ++ mutex_unlock(&ar->conf_mutex); + + spin_lock_bh(&sp->lock); +- +- sp->mode = ATH11K_SPECTRAL_DISABLED; + sp->enabled = false; +- + spin_unlock_bh(&sp->lock); ++ ++ ath11k_spectral_debug_unregister(ar); ++ ath11k_spectral_ring_free(ar); + } + } + +-- +2.35.1 + diff --git a/queue-5.18/ath11k-don-t-check-arvif-is_started-before-sending-m.patch b/queue-5.18/ath11k-don-t-check-arvif-is_started-before-sending-m.patch new file mode 100644 index 00000000000..48e3bc6f8f9 --- /dev/null +++ b/queue-5.18/ath11k-don-t-check-arvif-is_started-before-sending-m.patch @@ -0,0 +1,64 @@ +From d423c8c22cb6261f25a79041a7ec851f1ea27e32 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 May 2022 14:57:31 +0300 +Subject: ath11k: Don't check arvif->is_started before sending management + frames + +From: Baochen Qiang + +[ Upstream commit 355333a217541916576351446b5832fec7930566 ] + +Commit 66307ca04057 ("ath11k: fix mgmt_tx_wmi cmd sent to FW for +deleted vdev") wants both of below two conditions are true before +sending management frames: + +1: ar->allocated_vdev_map & (1LL << arvif->vdev_id) +2: arvif->is_started + +Actually the second one is not necessary because with the first one +we can make sure the vdev is present. + +Also use ar->conf_mutex to synchronize vdev delete and mgmt. TX. + +This issue is found in case of Passpoint scenario where ath11k +needs to send action frames before vdev is started. + +Fix it by removing the second condition. + +Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-01720.1-QCAHSPSWPL_V1_V2_SILICONZ_LITE-1 + +Fixes: 66307ca04057 ("ath11k: fix mgmt_tx_wmi cmd sent to FW for deleted vdev") +Signed-off-by: Baochen Qiang +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20220506013614.1580274-3-quic_bqiang@quicinc.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath11k/mac.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c +index 2c8d5f2a0517..54d738bdee0e 100644 +--- a/drivers/net/wireless/ath/ath11k/mac.c ++++ b/drivers/net/wireless/ath/ath11k/mac.c +@@ -5520,8 +5520,8 @@ static void ath11k_mgmt_over_wmi_tx_work(struct work_struct *work) + } + + arvif = ath11k_vif_to_arvif(skb_cb->vif); +- if (ar->allocated_vdev_map & (1LL << arvif->vdev_id) && +- arvif->is_started) { ++ mutex_lock(&ar->conf_mutex); ++ if (ar->allocated_vdev_map & (1LL << arvif->vdev_id)) { + ret = ath11k_mac_mgmt_tx_wmi(ar, arvif, skb); + if (ret) { + ath11k_warn(ar->ab, "failed to tx mgmt frame, vdev_id %d :%d\n", +@@ -5539,6 +5539,7 @@ static void ath11k_mgmt_over_wmi_tx_work(struct work_struct *work) + arvif->is_started); + ath11k_mgmt_over_wmi_tx_drop(ar, skb); + } ++ mutex_unlock(&ar->conf_mutex); + } + } + +-- +2.35.1 + diff --git a/queue-5.18/ath11k-fix-the-warning-of-dev_wake-in-mhi_pm_disable.patch b/queue-5.18/ath11k-fix-the-warning-of-dev_wake-in-mhi_pm_disable.patch new file mode 100644 index 00000000000..d6b2052eaf8 --- /dev/null +++ b/queue-5.18/ath11k-fix-the-warning-of-dev_wake-in-mhi_pm_disable.patch @@ -0,0 +1,133 @@ +From f65741b17774772d76df57e57c18d5adaa2c0cb8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Mar 2022 13:17:08 +0200 +Subject: ath11k: fix the warning of dev_wake in mhi_pm_disable_transition() + +From: Wen Gong + +[ Upstream commit 0d7a8a6204ea9271f1d0a8c66a9fd2f54d2e3cbc ] + +When test device recovery with below command, it has warning in message +as below. +echo assert > /sys/kernel/debug/ath11k/wcn6855\ hw2.0/simulate_fw_crash +echo assert > /sys/kernel/debug/ath11k/qca6390\ hw2.0/simulate_fw_crash + +warning message: +[ 1965.642121] ath11k_pci 0000:06:00.0: simulating firmware assert crash +[ 1968.471364] ieee80211 phy0: Hardware restart was requested +[ 1968.511305] ------------[ cut here ]------------ +[ 1968.511368] WARNING: CPU: 3 PID: 1546 at drivers/bus/mhi/core/pm.c:505 mhi_pm_disable_transition+0xb37/0xda0 [mhi] +[ 1968.511443] Modules linked in: ath11k_pci ath11k mac80211 libarc4 cfg80211 qmi_helpers qrtr_mhi mhi qrtr nvme nvme_core +[ 1968.511563] CPU: 3 PID: 1546 Comm: kworker/u17:0 Kdump: loaded Tainted: G W 5.17.0-rc3-wt-ath+ #579 +[ 1968.511629] Hardware name: Intel(R) Client Systems NUC8i7HVK/NUC8i7HVB, BIOS HNKBLi70.86A.0067.2021.0528.1339 05/28/2021 +[ 1968.511704] Workqueue: mhi_hiprio_wq mhi_pm_st_worker [mhi] +[ 1968.511787] RIP: 0010:mhi_pm_disable_transition+0xb37/0xda0 [mhi] +[ 1968.511870] Code: a9 fe ff ff 4c 89 ff 44 89 04 24 e8 03 46 f6 e5 44 8b 04 24 41 83 f8 01 0f 84 21 fe ff ff e9 4c fd ff ff 0f 0b e9 af f8 ff ff <0f> 0b e9 5c f8 ff ff 48 89 df e8 da 9e ee e3 e9 12 fd ff ff 4c 89 +[ 1968.511923] RSP: 0018:ffffc900024efbf0 EFLAGS: 00010286 +[ 1968.511969] RAX: 00000000ffffffff RBX: ffff88811d241250 RCX: ffffffffc0176922 +[ 1968.512014] RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffff888118a90a24 +[ 1968.512059] RBP: ffff888118a90800 R08: 0000000000000000 R09: ffff888118a90a27 +[ 1968.512102] R10: ffffed1023152144 R11: 0000000000000001 R12: ffff888118a908ac +[ 1968.512229] R13: ffff888118a90928 R14: dffffc0000000000 R15: ffff888118a90a24 +[ 1968.512310] FS: 0000000000000000(0000) GS:ffff888234200000(0000) knlGS:0000000000000000 +[ 1968.512405] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 1968.512493] CR2: 00007f5538f443a8 CR3: 000000016dc28001 CR4: 00000000003706e0 +[ 1968.512587] Call Trace: +[ 1968.512672] +[ 1968.512751] ? _raw_spin_unlock_irq+0x1f/0x40 +[ 1968.512859] mhi_pm_st_worker+0x3ac/0x790 [mhi] +[ 1968.512959] ? mhi_pm_mission_mode_transition.isra.0+0x7d0/0x7d0 [mhi] +[ 1968.513063] process_one_work+0x86a/0x1400 +[ 1968.513184] ? pwq_dec_nr_in_flight+0x230/0x230 +[ 1968.513312] ? move_linked_works+0x125/0x290 +[ 1968.513416] worker_thread+0x6db/0xf60 +[ 1968.513536] ? process_one_work+0x1400/0x1400 +[ 1968.513627] kthread+0x241/0x2d0 +[ 1968.513733] ? kthread_complete_and_exit+0x20/0x20 +[ 1968.513821] ret_from_fork+0x22/0x30 +[ 1968.513924] + +Reason is mhi_deassert_dev_wake() from mhi_device_put() is called +but mhi_assert_dev_wake() from __mhi_device_get_sync() is not called +in progress of recovery. Commit 8e0559921f9a ("bus: mhi: core: +Skip device wake in error or shutdown state") add check for the +pm_state of mhi in __mhi_device_get_sync(), and the pm_state is not +the normal state untill recovery is completed, so it leads the +dev_wake is not 0 and above warning print in mhi_pm_disable_transition() +while checking mhi_cntrl->dev_wake. + +Add check in ath11k_pci_write32()/ath11k_pci_read32() to skip call +mhi_device_put() if mhi_device_get_sync() does not really do wake, +then the warning gone. + +Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03003-QCAHSPSWPL_V1_V2_SILICONZ_LITE-2 + +Signed-off-by: Wen Gong +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20220228064606.8981-5-quic_wgong@quicinc.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath11k/pci.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath11k/pci.c b/drivers/net/wireless/ath/ath11k/pci.c +index 903758751c99..8a3ff12057e8 100644 +--- a/drivers/net/wireless/ath/ath11k/pci.c ++++ b/drivers/net/wireless/ath/ath11k/pci.c +@@ -191,6 +191,7 @@ void ath11k_pci_write32(struct ath11k_base *ab, u32 offset, u32 value) + { + struct ath11k_pci *ab_pci = ath11k_pci_priv(ab); + u32 window_start; ++ int ret = 0; + + /* for offset beyond BAR + 4K - 32, may + * need to wakeup MHI to access. +@@ -198,7 +199,7 @@ void ath11k_pci_write32(struct ath11k_base *ab, u32 offset, u32 value) + if (ab->hw_params.wakeup_mhi && + test_bit(ATH11K_PCI_FLAG_INIT_DONE, &ab_pci->flags) && + offset >= ACCESS_ALWAYS_OFF) +- mhi_device_get_sync(ab_pci->mhi_ctrl->mhi_dev); ++ ret = mhi_device_get_sync(ab_pci->mhi_ctrl->mhi_dev); + + if (offset < WINDOW_START) { + iowrite32(value, ab->mem + offset); +@@ -222,7 +223,8 @@ void ath11k_pci_write32(struct ath11k_base *ab, u32 offset, u32 value) + + if (ab->hw_params.wakeup_mhi && + test_bit(ATH11K_PCI_FLAG_INIT_DONE, &ab_pci->flags) && +- offset >= ACCESS_ALWAYS_OFF) ++ offset >= ACCESS_ALWAYS_OFF && ++ !ret) + mhi_device_put(ab_pci->mhi_ctrl->mhi_dev); + } + +@@ -230,6 +232,7 @@ u32 ath11k_pci_read32(struct ath11k_base *ab, u32 offset) + { + struct ath11k_pci *ab_pci = ath11k_pci_priv(ab); + u32 val, window_start; ++ int ret = 0; + + /* for offset beyond BAR + 4K - 32, may + * need to wakeup MHI to access. +@@ -237,7 +240,7 @@ u32 ath11k_pci_read32(struct ath11k_base *ab, u32 offset) + if (ab->hw_params.wakeup_mhi && + test_bit(ATH11K_PCI_FLAG_INIT_DONE, &ab_pci->flags) && + offset >= ACCESS_ALWAYS_OFF) +- mhi_device_get_sync(ab_pci->mhi_ctrl->mhi_dev); ++ ret = mhi_device_get_sync(ab_pci->mhi_ctrl->mhi_dev); + + if (offset < WINDOW_START) { + val = ioread32(ab->mem + offset); +@@ -261,7 +264,8 @@ u32 ath11k_pci_read32(struct ath11k_base *ab, u32 offset) + + if (ab->hw_params.wakeup_mhi && + test_bit(ATH11K_PCI_FLAG_INIT_DONE, &ab_pci->flags) && +- offset >= ACCESS_ALWAYS_OFF) ++ offset >= ACCESS_ALWAYS_OFF && ++ !ret) + mhi_device_put(ab_pci->mhi_ctrl->mhi_dev); + + return val; +-- +2.35.1 + diff --git a/queue-5.18/ath11k-fix-warning-of-not-found-station-for-bssid-in.patch b/queue-5.18/ath11k-fix-warning-of-not-found-station-for-bssid-in.patch new file mode 100644 index 00000000000..594f596d84c --- /dev/null +++ b/queue-5.18/ath11k-fix-warning-of-not-found-station-for-bssid-in.patch @@ -0,0 +1,100 @@ +From 9b3d838f9f063fc34af007671b109f7b6b99d928 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Apr 2022 16:15:02 +0300 +Subject: ath11k: fix warning of not found station for bssid in message + +From: Wen Gong + +[ Upstream commit 7330e1ec9748948177830c6e1a13379835d577f9 ] + +When test connect/disconnect to an AP frequently with WCN6855, sometimes +it show below log. + +[ 277.040121] wls1: deauthenticating from 8c:21:0a:b3:5a:64 by local choice (Reason: 3=DEAUTH_LEAVING) +[ 277.050906] ath11k_pci 0000:05:00.0: wmi stats vdev id 0 mac 00:03:7f:29:61:11 +[ 277.050944] ath11k_pci 0000:05:00.0: wmi stats bssid 8c:21:0a:b3:5a:64 vif pK-error +[ 277.050954] ath11k_pci 0000:05:00.0: not found station for bssid 8c:21:0a:b3:5a:64 +[ 277.050961] ath11k_pci 0000:05:00.0: failed to parse rssi chain -71 +[ 277.050967] ath11k_pci 0000:05:00.0: failed to pull fw stats: -71 +[ 277.050976] ath11k_pci 0000:05:00.0: wmi stats vdev id 0 mac 00:03:7f:29:61:11 +[ 277.050983] ath11k_pci 0000:05:00.0: wmi stats bssid 8c:21:0a:b3:5a:64 vif pK-error +[ 277.050989] ath11k_pci 0000:05:00.0: not found station for bssid 8c:21:0a:b3:5a:64 +[ 277.050995] ath11k_pci 0000:05:00.0: failed to parse rssi chain -71 +[ 277.051000] ath11k_pci 0000:05:00.0: failed to pull fw stats: -71 +[ 278.064050] ath11k_pci 0000:05:00.0: failed to request fw stats: -110 + +Reason is: +When running disconnect operation, sta_info removed from local->sta_hash +by __sta_info_destroy_part1() from __sta_info_flush(), after this, +ieee80211_find_sta_by_ifaddr() which called by +ath11k_wmi_tlv_fw_stats_data_parse() and ath11k_wmi_tlv_rssi_chain_parse() +cannot find this station, then failed log printed. + +steps are like this: +1. when disconnect from AP, __sta_info_destroy() called __sta_info_destroy_part1() +and __sta_info_destroy_part2(). + +2. in __sta_info_destroy_part1(), it has "sta_info_hash_del(local, sta)" +and "list_del_rcu(&sta->list)", it will remove the ieee80211_sta from the +list of ieee80211_hw. + +3. in __sta_info_destroy_part2(), it called drv_sta_state()->ath11k_mac_op_sta_state(), +then peer->sta is clear at this moment. + +4. in __sta_info_destroy_part2(), it then called sta_set_sinfo()->drv_sta_statistics() +->ath11k_mac_op_sta_statistics(), then WMI_REQUEST_STATS_CMDID sent to firmware. + +5. WMI_UPDATE_STATS_EVENTID reported from firmware, at this moment, the +ieee80211_sta can not be found again because it has remove from list in +step2 and also peer->sta is clear in step3. + +6. in __sta_info_destroy_part2(), it then called cleanup_single_sta()-> +sta_info_free()->kfree(sta), at this moment, the ieee80211_sta is freed +in memory, then the failed log will not happen because function +ath11k_mac_op_sta_state() will not be called. + +Actually this print log is not a real error, it is only to skip parse the +info, so change to skip print by default debug setting. + +Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3 + +Signed-off-by: Wen Gong +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20220428022426.2927-1-quic_wgong@quicinc.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath11k/wmi.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath11k/wmi.c b/drivers/net/wireless/ath/ath11k/wmi.c +index 2751fe8814df..0900f75eef20 100644 +--- a/drivers/net/wireless/ath/ath11k/wmi.c ++++ b/drivers/net/wireless/ath/ath11k/wmi.c +@@ -5789,9 +5789,9 @@ static int ath11k_wmi_tlv_rssi_chain_parse(struct ath11k_base *ab, + arvif->bssid, + NULL); + if (!sta) { +- ath11k_warn(ab, "not found station for bssid %pM\n", +- arvif->bssid); +- ret = -EPROTO; ++ ath11k_dbg(ab, ATH11K_DBG_WMI, ++ "not found station of bssid %pM for rssi chain\n", ++ arvif->bssid); + goto exit; + } + +@@ -5889,8 +5889,9 @@ static int ath11k_wmi_tlv_fw_stats_data_parse(struct ath11k_base *ab, + "wmi stats vdev id %d snr %d\n", + src->vdev_id, src->beacon_snr); + } else { +- ath11k_warn(ab, "not found station for bssid %pM\n", +- arvif->bssid); ++ ath11k_dbg(ab, ATH11K_DBG_WMI, ++ "not found station of bssid %pM for vdev stat\n", ++ arvif->bssid); + } + } + +-- +2.35.1 + diff --git a/queue-5.18/ath9k-fix-ar9003_get_eepmisc.patch b/queue-5.18/ath9k-fix-ar9003_get_eepmisc.patch new file mode 100644 index 00000000000..445122f7336 --- /dev/null +++ b/queue-5.18/ath9k-fix-ar9003_get_eepmisc.patch @@ -0,0 +1,40 @@ +From baadc18f6858f4bf28f9b1c587165de1fdd6999f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 20 Mar 2022 17:30:08 -0600 +Subject: ath9k: fix ar9003_get_eepmisc +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Wenli Looi + +[ Upstream commit 9aaff3864b603408c02c629957ae8d8ff5d5a4f2 ] + +The current implementation is reading the wrong eeprom type. + +Fixes: d8ec2e2a63e8 ("ath9k: Add an eeprom_ops callback for retrieving the eepmisc value") +Signed-off-by: Wenli Looi +Acked-by: Toke Høiland-Jørgensen +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20220320233010.123106-5-wlooi@ucalgary.ca +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath9k/ar9003_eeprom.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c +index b0a4ca3559fd..abed1effd95c 100644 +--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c ++++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c +@@ -5615,7 +5615,7 @@ unsigned int ar9003_get_paprd_scale_factor(struct ath_hw *ah, + + static u8 ar9003_get_eepmisc(struct ath_hw *ah) + { +- return ah->eeprom.map4k.baseEepHeader.eepMisc; ++ return ah->eeprom.ar9300_eep.baseEepHeader.opCapFlags.eepMisc; + } + + const struct eeprom_ops eep_ar9300_ops = { +-- +2.35.1 + diff --git a/queue-5.18/ath9k-fix-qca9561-pa-bias-level.patch b/queue-5.18/ath9k-fix-qca9561-pa-bias-level.patch new file mode 100644 index 00000000000..63067013dff --- /dev/null +++ b/queue-5.18/ath9k-fix-qca9561-pa-bias-level.patch @@ -0,0 +1,54 @@ +From 836cb6c0f1373a939d6725f79be28cf825d385d7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 17 Apr 2022 16:51:45 +0200 +Subject: ath9k: fix QCA9561 PA bias level +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thibaut VARÈNE + +[ Upstream commit e999a5da28a0e0f7de242d841ef7d5e48f4646ae ] + +This patch fixes an invalid TX PA DC bias level on QCA9561, which +results in a very low output power and very low throughput as devices +are further away from the AP (compared to other 2.4GHz APs). + +This patch was suggested by Felix Fietkau, who noted[1]: +"The value written to that register is wrong, because while the mask +definition AR_CH0_TOP2_XPABIASLVL uses a different value for 9561, the +shift definition AR_CH0_TOP2_XPABIASLVL_S is hardcoded to 12, which is +wrong for 9561." + +In real life testing, without this patch the 2.4GHz throughput on +Yuncore XD3200 is around 10Mbps sitting next to the AP, and closer to +practical maximum with the patch applied. + +[1] https://lore.kernel.org/all/91c58969-c60e-2f41-00ac-737786d435ae@nbd.name + +Signed-off-by: Thibaut VARÈNE +Acked-by: Felix Fietkau +Acked-by: Toke Høiland-Jørgensen +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20220417145145.1847-1-hacks+kernel@slashdirt.org +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath9k/ar9003_phy.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.h b/drivers/net/wireless/ath/ath9k/ar9003_phy.h +index a171dbb29fbb..ad949eb02f3d 100644 +--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.h ++++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.h +@@ -720,7 +720,7 @@ + #define AR_CH0_TOP2 (AR_SREV_9300(ah) ? 0x1628c : \ + (AR_SREV_9462(ah) ? 0x16290 : 0x16284)) + #define AR_CH0_TOP2_XPABIASLVL (AR_SREV_9561(ah) ? 0x1e00 : 0xf000) +-#define AR_CH0_TOP2_XPABIASLVL_S 12 ++#define AR_CH0_TOP2_XPABIASLVL_S (AR_SREV_9561(ah) ? 9 : 12) + + #define AR_CH0_XTAL (AR_SREV_9300(ah) ? 0x16294 : \ + ((AR_SREV_9462(ah) || AR_SREV_9565(ah)) ? 0x16298 : \ +-- +2.35.1 + diff --git a/queue-5.18/ath9k_htc-fix-potential-out-of-bounds-access-with-in.patch b/queue-5.18/ath9k_htc-fix-potential-out-of-bounds-access-with-in.patch new file mode 100644 index 00000000000..ba4dbfb2e35 --- /dev/null +++ b/queue-5.18/ath9k_htc-fix-potential-out-of-bounds-access-with-in.patch @@ -0,0 +1,51 @@ +From 6f1c5cff04bfd8d0c58f9e0565210d6870b292aa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 9 Apr 2022 09:12:25 +0300 +Subject: ath9k_htc: fix potential out of bounds access with invalid + rxstatus->rs_keyix +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Dan Carpenter + +[ Upstream commit 2dc509305cf956381532792cb8dceef2b1504765 ] + +The "rxstatus->rs_keyix" eventually gets passed to test_bit() so we need to +ensure that it is within the bitmap. + +drivers/net/wireless/ath/ath9k/common.c:46 ath9k_cmn_rx_accept() +error: passing untrusted data 'rx_stats->rs_keyix' to 'test_bit()' + +Fixes: 4ed1a8d4a257 ("ath9k_htc: use ath9k_cmn_rx_accept") +Signed-off-by: Dan Carpenter +Acked-by: Toke Høiland-Jørgensen +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20220409061225.GA5447@kili +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath9k/htc_drv_txrx.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c +index 6a850a0bfa8a..a23eaca0326d 100644 +--- a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c ++++ b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c +@@ -1016,6 +1016,14 @@ static bool ath9k_rx_prepare(struct ath9k_htc_priv *priv, + goto rx_next; + } + ++ if (rxstatus->rs_keyix >= ATH_KEYMAX && ++ rxstatus->rs_keyix != ATH9K_RXKEYIX_INVALID) { ++ ath_dbg(common, ANY, ++ "Invalid keyix, dropping (keyix: %d)\n", ++ rxstatus->rs_keyix); ++ goto rx_next; ++ } ++ + /* Get the RX status information */ + + memset(rx_status, 0, sizeof(struct ieee80211_rx_status)); +-- +2.35.1 + diff --git a/queue-5.18/b43-fix-assigning-negative-value-to-unsigned-variabl.patch b/queue-5.18/b43-fix-assigning-negative-value-to-unsigned-variabl.patch new file mode 100644 index 00000000000..ff3dd88c386 --- /dev/null +++ b/queue-5.18/b43-fix-assigning-negative-value-to-unsigned-variabl.patch @@ -0,0 +1,37 @@ +From 3c1addea434577e6d8e0f53b3e9b6128ba15a68e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Mar 2022 18:15:15 +0800 +Subject: b43: Fix assigning negative value to unsigned variable + +From: Haowen Bai + +[ Upstream commit 11800d893b38e0e12d636c170c1abc19c43c730c ] + +fix warning reported by smatch: +drivers/net/wireless/broadcom/b43/phy_n.c:585 b43_nphy_adjust_lna_gain_table() +warn: assigning (-2) to unsigned variable '*(lna_gain[0])' + +Signed-off-by: Haowen Bai +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/1648203315-28093-1-git-send-email-baihaowen@meizu.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/broadcom/b43/phy_n.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/broadcom/b43/phy_n.c b/drivers/net/wireless/broadcom/b43/phy_n.c +index cf3ccf4ddfe7..aa5c99465674 100644 +--- a/drivers/net/wireless/broadcom/b43/phy_n.c ++++ b/drivers/net/wireless/broadcom/b43/phy_n.c +@@ -582,7 +582,7 @@ static void b43_nphy_adjust_lna_gain_table(struct b43_wldev *dev) + u16 data[4]; + s16 gain[2]; + u16 minmax[2]; +- static const u16 lna_gain[4] = { -2, 10, 19, 25 }; ++ static const s16 lna_gain[4] = { -2, 10, 19, 25 }; + + if (nphy->hang_avoid) + b43_nphy_stay_in_carrier_search(dev, 1); +-- +2.35.1 + diff --git a/queue-5.18/b43legacy-fix-assigning-negative-value-to-unsigned-v.patch b/queue-5.18/b43legacy-fix-assigning-negative-value-to-unsigned-v.patch new file mode 100644 index 00000000000..00330535c9f --- /dev/null +++ b/queue-5.18/b43legacy-fix-assigning-negative-value-to-unsigned-v.patch @@ -0,0 +1,37 @@ +From 2c1172c2e0ce93ac971b6dd5b967a1e0cc85d43e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Mar 2022 18:17:13 +0800 +Subject: b43legacy: Fix assigning negative value to unsigned variable + +From: Haowen Bai + +[ Upstream commit 3f6b867559b3d43a7ce1b4799b755e812fc0d503 ] + +fix warning reported by smatch: +drivers/net/wireless/broadcom/b43legacy/phy.c:1181 b43legacy_phy_lo_b_measure() +warn: assigning (-772) to unsigned variable 'fval' + +Signed-off-by: Haowen Bai +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/1648203433-8736-1-git-send-email-baihaowen@meizu.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/broadcom/b43legacy/phy.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/broadcom/b43legacy/phy.c b/drivers/net/wireless/broadcom/b43legacy/phy.c +index 05404fbd1e70..c1395e622759 100644 +--- a/drivers/net/wireless/broadcom/b43legacy/phy.c ++++ b/drivers/net/wireless/broadcom/b43legacy/phy.c +@@ -1123,7 +1123,7 @@ void b43legacy_phy_lo_b_measure(struct b43legacy_wldev *dev) + struct b43legacy_phy *phy = &dev->phy; + u16 regstack[12] = { 0 }; + u16 mls; +- u16 fval; ++ s16 fval; + int i; + int j; + +-- +2.35.1 + diff --git a/queue-5.18/bfq-allow-current-waker-to-defend-against-a-tentativ.patch b/queue-5.18/bfq-allow-current-waker-to-defend-against-a-tentativ.patch new file mode 100644 index 00000000000..ad8586dea88 --- /dev/null +++ b/queue-5.18/bfq-allow-current-waker-to-defend-against-a-tentativ.patch @@ -0,0 +1,41 @@ +From 218f03acf0c8a414a29bd135b020d753d91a5a4c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 May 2022 12:52:30 +0200 +Subject: bfq: Allow current waker to defend against a tentative one + +From: Jan Kara + +[ Upstream commit c5ac56bb6110e42e79d3106866658376b2e48ab9 ] + +The code in bfq_check_waker() ignores wake up events from the current +waker. This makes it more likely we select a new tentative waker +although the current one is generating more wake up events. Treat +current waker the same way as any other process and allow it to reset +the waker detection logic. + +Fixes: 71217df39dc6 ("block, bfq: make waker-queue detection more robust") +Signed-off-by: Jan Kara +Link: https://lore.kernel.org/r/20220519105235.31397-2-jack@suse.cz +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/bfq-iosched.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c +index e1c86f66400e..269ff82091cc 100644 +--- a/block/bfq-iosched.c ++++ b/block/bfq-iosched.c +@@ -2133,8 +2133,7 @@ static void bfq_check_waker(struct bfq_data *bfqd, struct bfq_queue *bfqq, + if (!bfqd->last_completed_rq_bfqq || + bfqd->last_completed_rq_bfqq == bfqq || + bfq_bfqq_has_short_ttime(bfqq) || +- now_ns - bfqd->last_completion >= 4 * NSEC_PER_MSEC || +- bfqd->last_completed_rq_bfqq == bfqq->waker_bfqq) ++ now_ns - bfqd->last_completion >= 4 * NSEC_PER_MSEC) + return; + + /* +-- +2.35.1 + diff --git a/queue-5.18/bfq-relax-waker-detection-for-shared-queues.patch b/queue-5.18/bfq-relax-waker-detection-for-shared-queues.patch new file mode 100644 index 00000000000..4d05f23837a --- /dev/null +++ b/queue-5.18/bfq-relax-waker-detection-for-shared-queues.patch @@ -0,0 +1,93 @@ +From a3c2728fa8067e3e3386b0b5f42322ad84455829 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 May 2022 12:52:29 +0200 +Subject: bfq: Relax waker detection for shared queues + +From: Jan Kara + +[ Upstream commit f950667356ce90a41b446b726d4595a10cb65415 ] + +Currently we look for waker only if current queue has no requests. This +makes sense for bfq queues with a single process however for shared +queues when there is a larger number of processes the condition that +queue has no requests is difficult to meet because often at least one +process has some request in flight although all the others are waiting +for the waker to do the work and this harms throughput. Relax the "no +queued request for bfq queue" condition to "the current task has no +queued requests yet". For this, we also need to start tracking number of +requests in flight for each task. + +This patch (together with the following one) restores the performance +for dbench with 128 clients that regressed with commit c65e6fd460b4 +("bfq: Do not let waker requests skip proper accounting") because +this commit makes requests of wakers properly enter BFQ queues and thus +these queues become ineligible for the old waker detection logic. +Dbench results: + + Vanilla 5.18-rc3 5.18-rc3 + revert 5.18-rc3 patched +Mean 1237.36 ( 0.00%) 950.16 * 23.21%* 988.35 * 20.12%* + +Numbers are time to complete workload so lower is better. + +Fixes: c65e6fd460b4 ("bfq: Do not let waker requests skip proper accounting") +Signed-off-by: Jan Kara +Link: https://lore.kernel.org/r/20220519105235.31397-1-jack@suse.cz +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/bfq-iosched.c | 5 +++-- + block/bfq-iosched.h | 1 + + 2 files changed, 4 insertions(+), 2 deletions(-) + +diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c +index 1f62dbdc521f..e1c86f66400e 100644 +--- a/block/bfq-iosched.c ++++ b/block/bfq-iosched.c +@@ -2133,7 +2133,6 @@ static void bfq_check_waker(struct bfq_data *bfqd, struct bfq_queue *bfqq, + if (!bfqd->last_completed_rq_bfqq || + bfqd->last_completed_rq_bfqq == bfqq || + bfq_bfqq_has_short_ttime(bfqq) || +- bfqq->dispatched > 0 || + now_ns - bfqd->last_completion >= 4 * NSEC_PER_MSEC || + bfqd->last_completed_rq_bfqq == bfqq->waker_bfqq) + return; +@@ -2210,7 +2209,7 @@ static void bfq_add_request(struct request *rq) + bfqq->queued[rq_is_sync(rq)]++; + bfqd->queued++; + +- if (RB_EMPTY_ROOT(&bfqq->sort_list) && bfq_bfqq_sync(bfqq)) { ++ if (bfq_bfqq_sync(bfqq) && RQ_BIC(rq)->requests <= 1) { + bfq_check_waker(bfqd, bfqq, now_ns); + + /* +@@ -6563,6 +6562,7 @@ static void bfq_finish_requeue_request(struct request *rq) + bfq_completed_request(bfqq, bfqd); + } + bfq_finish_requeue_request_body(bfqq); ++ RQ_BIC(rq)->requests--; + spin_unlock_irqrestore(&bfqd->lock, flags); + + /* +@@ -6796,6 +6796,7 @@ static struct bfq_queue *bfq_init_rq(struct request *rq) + + bfqq_request_allocated(bfqq); + bfqq->ref++; ++ bic->requests++; + bfq_log_bfqq(bfqd, bfqq, "get_request %p: bfqq %p, %d", + rq, bfqq, bfqq->ref); + +diff --git a/block/bfq-iosched.h b/block/bfq-iosched.h +index 3b83e3d1c2e5..25fada961bc9 100644 +--- a/block/bfq-iosched.h ++++ b/block/bfq-iosched.h +@@ -468,6 +468,7 @@ struct bfq_io_cq { + struct bfq_queue *stable_merge_bfqq; + + bool stably_merged; /* non splittable if true */ ++ unsigned int requests; /* Number of requests this process has in flight */ + }; + + /** +-- +2.35.1 + diff --git a/queue-5.18/blk-cgroup-always-terminate-io.stat-lines.patch b/queue-5.18/blk-cgroup-always-terminate-io.stat-lines.patch new file mode 100644 index 00000000000..8b19afdc43d --- /dev/null +++ b/queue-5.18/blk-cgroup-always-terminate-io.stat-lines.patch @@ -0,0 +1,157 @@ +From c5b9c5ddc0454fb8a824af5c5b6fa1e8849570c9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Jan 2022 09:31:59 +0100 +Subject: blk-cgroup: always terminate io.stat lines + +From: Wolfgang Bumiller + +[ Upstream commit 3607849df47822151b05df440759e2dc70160755 ] + +With the removal of seq_get_buf in blkcg_print_one_stat, we +cannot make adding the newline conditional on there being +relevant stats because the name was already written out +unconditionally. +Otherwise we may end up with multiple device names in one +line which is confusing and doesn't follow the nested-keyed +file format. + +Signed-off-by: Wolfgang Bumiller +Fixes: 252c651a4c85 ("blk-cgroup: stop using seq_get_buf") +Acked-by: Tejun Heo +Link: https://lore.kernel.org/r/20220111083159.42340-1-w.bumiller@proxmox.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-cgroup.c | 9 ++------- + block/blk-cgroup.h | 2 +- + block/blk-iocost.c | 5 ++--- + block/blk-iolatency.c | 8 +++----- + 4 files changed, 8 insertions(+), 16 deletions(-) + +diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c +index 8dfe62786cd5..6f9aeb6a337d 100644 +--- a/block/blk-cgroup.c ++++ b/block/blk-cgroup.c +@@ -905,7 +905,6 @@ static void blkcg_print_one_stat(struct blkcg_gq *blkg, struct seq_file *s) + { + struct blkg_iostat_set *bis = &blkg->iostat; + u64 rbytes, wbytes, rios, wios, dbytes, dios; +- bool has_stats = false; + const char *dname; + unsigned seq; + int i; +@@ -931,14 +930,12 @@ static void blkcg_print_one_stat(struct blkcg_gq *blkg, struct seq_file *s) + } while (u64_stats_fetch_retry(&bis->sync, seq)); + + if (rbytes || wbytes || rios || wios) { +- has_stats = true; + seq_printf(s, "rbytes=%llu wbytes=%llu rios=%llu wios=%llu dbytes=%llu dios=%llu", + rbytes, wbytes, rios, wios, + dbytes, dios); + } + + if (blkcg_debug_stats && atomic_read(&blkg->use_delay)) { +- has_stats = true; + seq_printf(s, " use_delay=%d delay_nsec=%llu", + atomic_read(&blkg->use_delay), + atomic64_read(&blkg->delay_nsec)); +@@ -950,12 +947,10 @@ static void blkcg_print_one_stat(struct blkcg_gq *blkg, struct seq_file *s) + if (!blkg->pd[i] || !pol->pd_stat_fn) + continue; + +- if (pol->pd_stat_fn(blkg->pd[i], s)) +- has_stats = true; ++ pol->pd_stat_fn(blkg->pd[i], s); + } + +- if (has_stats) +- seq_printf(s, "\n"); ++ seq_puts(s, "\n"); + } + + static int blkcg_print_stat(struct seq_file *sf, void *v) +diff --git a/block/blk-cgroup.h b/block/blk-cgroup.h +index 47e1e38390c9..b56ba16fb6c5 100644 +--- a/block/blk-cgroup.h ++++ b/block/blk-cgroup.h +@@ -63,7 +63,7 @@ typedef void (blkcg_pol_online_pd_fn)(struct blkg_policy_data *pd); + typedef void (blkcg_pol_offline_pd_fn)(struct blkg_policy_data *pd); + typedef void (blkcg_pol_free_pd_fn)(struct blkg_policy_data *pd); + typedef void (blkcg_pol_reset_pd_stats_fn)(struct blkg_policy_data *pd); +-typedef bool (blkcg_pol_stat_pd_fn)(struct blkg_policy_data *pd, ++typedef void (blkcg_pol_stat_pd_fn)(struct blkg_policy_data *pd, + struct seq_file *s); + + struct blkcg_policy { +diff --git a/block/blk-iocost.c b/block/blk-iocost.c +index 9bd670999d0a..16705fbd0699 100644 +--- a/block/blk-iocost.c ++++ b/block/blk-iocost.c +@@ -3005,13 +3005,13 @@ static void ioc_pd_free(struct blkg_policy_data *pd) + kfree(iocg); + } + +-static bool ioc_pd_stat(struct blkg_policy_data *pd, struct seq_file *s) ++static void ioc_pd_stat(struct blkg_policy_data *pd, struct seq_file *s) + { + struct ioc_gq *iocg = pd_to_iocg(pd); + struct ioc *ioc = iocg->ioc; + + if (!ioc->enabled) +- return false; ++ return; + + if (iocg->level == 0) { + unsigned vp10k = DIV64_U64_ROUND_CLOSEST( +@@ -3027,7 +3027,6 @@ static bool ioc_pd_stat(struct blkg_policy_data *pd, struct seq_file *s) + iocg->last_stat.wait_us, + iocg->last_stat.indebt_us, + iocg->last_stat.indelay_us); +- return true; + } + + static u64 ioc_weight_prfill(struct seq_file *sf, struct blkg_policy_data *pd, +diff --git a/block/blk-iolatency.c b/block/blk-iolatency.c +index 2f33932e72e3..5b676c7cf2b6 100644 +--- a/block/blk-iolatency.c ++++ b/block/blk-iolatency.c +@@ -891,7 +891,7 @@ static int iolatency_print_limit(struct seq_file *sf, void *v) + return 0; + } + +-static bool iolatency_ssd_stat(struct iolatency_grp *iolat, struct seq_file *s) ++static void iolatency_ssd_stat(struct iolatency_grp *iolat, struct seq_file *s) + { + struct latency_stat stat; + int cpu; +@@ -914,17 +914,16 @@ static bool iolatency_ssd_stat(struct iolatency_grp *iolat, struct seq_file *s) + (unsigned long long)stat.ps.missed, + (unsigned long long)stat.ps.total, + iolat->rq_depth.max_depth); +- return true; + } + +-static bool iolatency_pd_stat(struct blkg_policy_data *pd, struct seq_file *s) ++static void iolatency_pd_stat(struct blkg_policy_data *pd, struct seq_file *s) + { + struct iolatency_grp *iolat = pd_to_lat(pd); + unsigned long long avg_lat; + unsigned long long cur_win; + + if (!blkcg_debug_stats) +- return false; ++ return; + + if (iolat->ssd) + return iolatency_ssd_stat(iolat, s); +@@ -937,7 +936,6 @@ static bool iolatency_pd_stat(struct blkg_policy_data *pd, struct seq_file *s) + else + seq_printf(s, " depth=%u avg_lat=%llu win=%llu", + iolat->rq_depth.max_depth, avg_lat, cur_win); +- return true; + } + + static struct blkg_policy_data *iolatency_pd_alloc(gfp_t gfp, +-- +2.35.1 + diff --git a/queue-5.18/blk-throttle-set-bio_throttled-when-bio-has-been-thr.patch b/queue-5.18/blk-throttle-set-bio_throttled-when-bio-has-been-thr.patch new file mode 100644 index 00000000000..3e0609d202c --- /dev/null +++ b/queue-5.18/blk-throttle-set-bio_throttled-when-bio-has-been-thr.patch @@ -0,0 +1,126 @@ +From 5d56cb9c7c06d0987af2f73650ef6f8d8ebbd875 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Mar 2022 20:39:19 +0800 +Subject: blk-throttle: Set BIO_THROTTLED when bio has been throttled + +From: Laibin Qiu + +[ Upstream commit 5a011f889b4832aa80c2a872a5aade5c48d2756f ] + +1.In current process, all bio will set the BIO_THROTTLED flag +after __blk_throtl_bio(). + +2.If bio needs to be throttled, it will start the timer and +stop submit bio directly. Bio will submit in +blk_throtl_dispatch_work_fn() when the timer expires.But in +the current process, if bio is throttled. The BIO_THROTTLED +will be set to bio after timer start. If the bio has been +completed, it may cause use-after-free blow. + +BUG: KASAN: use-after-free in blk_throtl_bio+0x12f0/0x2c70 +Read of size 2 at addr ffff88801b8902d4 by task fio/26380 + + dump_stack+0x9b/0xce + print_address_description.constprop.6+0x3e/0x60 + kasan_report.cold.9+0x22/0x3a + blk_throtl_bio+0x12f0/0x2c70 + submit_bio_checks+0x701/0x1550 + submit_bio_noacct+0x83/0xc80 + submit_bio+0xa7/0x330 + mpage_readahead+0x380/0x500 + read_pages+0x1c1/0xbf0 + page_cache_ra_unbounded+0x471/0x6f0 + do_page_cache_ra+0xda/0x110 + ondemand_readahead+0x442/0xae0 + page_cache_async_ra+0x210/0x300 + generic_file_buffered_read+0x4d9/0x2130 + generic_file_read_iter+0x315/0x490 + blkdev_read_iter+0x113/0x1b0 + aio_read+0x2ad/0x450 + io_submit_one+0xc8e/0x1d60 + __se_sys_io_submit+0x125/0x350 + do_syscall_64+0x2d/0x40 + entry_SYSCALL_64_after_hwframe+0x44/0xa9 + +Allocated by task 26380: + kasan_save_stack+0x19/0x40 + __kasan_kmalloc.constprop.2+0xc1/0xd0 + kmem_cache_alloc+0x146/0x440 + mempool_alloc+0x125/0x2f0 + bio_alloc_bioset+0x353/0x590 + mpage_alloc+0x3b/0x240 + do_mpage_readpage+0xddf/0x1ef0 + mpage_readahead+0x264/0x500 + read_pages+0x1c1/0xbf0 + page_cache_ra_unbounded+0x471/0x6f0 + do_page_cache_ra+0xda/0x110 + ondemand_readahead+0x442/0xae0 + page_cache_async_ra+0x210/0x300 + generic_file_buffered_read+0x4d9/0x2130 + generic_file_read_iter+0x315/0x490 + blkdev_read_iter+0x113/0x1b0 + aio_read+0x2ad/0x450 + io_submit_one+0xc8e/0x1d60 + __se_sys_io_submit+0x125/0x350 + do_syscall_64+0x2d/0x40 + entry_SYSCALL_64_after_hwframe+0x44/0xa9 + +Freed by task 0: + kasan_save_stack+0x19/0x40 + kasan_set_track+0x1c/0x30 + kasan_set_free_info+0x1b/0x30 + __kasan_slab_free+0x111/0x160 + kmem_cache_free+0x94/0x460 + mempool_free+0xd6/0x320 + bio_free+0xe0/0x130 + bio_put+0xab/0xe0 + bio_endio+0x3a6/0x5d0 + blk_update_request+0x590/0x1370 + scsi_end_request+0x7d/0x400 + scsi_io_completion+0x1aa/0xe50 + scsi_softirq_done+0x11b/0x240 + blk_mq_complete_request+0xd4/0x120 + scsi_mq_done+0xf0/0x200 + virtscsi_vq_done+0xbc/0x150 + vring_interrupt+0x179/0x390 + __handle_irq_event_percpu+0xf7/0x490 + handle_irq_event_percpu+0x7b/0x160 + handle_irq_event+0xcc/0x170 + handle_edge_irq+0x215/0xb20 + common_interrupt+0x60/0x120 + asm_common_interrupt+0x1e/0x40 + +Fix this by move BIO_THROTTLED set into the queue_lock. + +Signed-off-by: Laibin Qiu +Reviewed-by: Ming Lei +Link: https://lore.kernel.org/r/20220301123919.2381579-1-qiulaibin@huawei.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-throttle.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/block/blk-throttle.c b/block/blk-throttle.c +index 469c483719be..5c5f2741a95f 100644 +--- a/block/blk-throttle.c ++++ b/block/blk-throttle.c +@@ -2189,13 +2189,14 @@ bool __blk_throtl_bio(struct bio *bio) + } + + out_unlock: +- spin_unlock_irq(&q->queue_lock); + bio_set_flag(bio, BIO_THROTTLED); + + #ifdef CONFIG_BLK_DEV_THROTTLING_LOW + if (throttled || !td->track_bio_latency) + bio->bi_issue.value |= BIO_ISSUE_THROTL_SKIP_LATENCY; + #endif ++ spin_unlock_irq(&q->queue_lock); ++ + rcu_read_unlock(); + return throttled; + } +-- +2.35.1 + diff --git a/queue-5.18/block-fix-the-bio.bi_opf-comment.patch b/queue-5.18/block-fix-the-bio.bi_opf-comment.patch new file mode 100644 index 00000000000..d20812ef9be --- /dev/null +++ b/queue-5.18/block-fix-the-bio.bi_opf-comment.patch @@ -0,0 +1,48 @@ +From c0a4403a8186ca71fdd7f8d2e48e75835f2f4861 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 May 2022 16:51:52 -0700 +Subject: block: Fix the bio.bi_opf comment + +From: Bart Van Assche + +[ Upstream commit 5d2ae14276e698c76fa0c8ce870103f343b38263 ] + +Commit ef295ecf090d modified the Linux kernel such that the bottom bits +of the bi_opf member contain the operation instead of the topmost bits. +That commit did not update the comment next to bi_opf. Hence this patch. + +From commit ef295ecf090d: +-#define bio_op(bio) ((bio)->bi_opf >> BIO_OP_SHIFT) ++#define bio_op(bio) ((bio)->bi_opf & REQ_OP_MASK) + +Cc: Christoph Hellwig +Cc: Ming Lei +Fixes: ef295ecf090d ("block: better op and flags encoding") +Signed-off-by: Bart Van Assche +Reviewed-by: Christoph Hellwig +Link: https://lore.kernel.org/r/20220511235152.1082246-1-bvanassche@acm.org +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + include/linux/blk_types.h | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/include/linux/blk_types.h b/include/linux/blk_types.h +index 1973ef9bd40f..4fa359c2c01f 100644 +--- a/include/linux/blk_types.h ++++ b/include/linux/blk_types.h +@@ -246,9 +246,8 @@ typedef unsigned int blk_qc_t; + struct bio { + struct bio *bi_next; /* request queue link */ + struct block_device *bi_bdev; +- unsigned int bi_opf; /* bottom bits req flags, +- * top bits REQ_OP. Use +- * accessors. ++ unsigned int bi_opf; /* bottom bits REQ_OP, top bits ++ * req_flags. + */ + unsigned short bi_flags; /* BIO_* below */ + unsigned short bi_ioprio; +-- +2.35.1 + diff --git a/queue-5.18/bluetooth-btmtksdio-fix-possible-fw-initialization-f.patch b/queue-5.18/bluetooth-btmtksdio-fix-possible-fw-initialization-f.patch new file mode 100644 index 00000000000..65d9cb3f9f0 --- /dev/null +++ b/queue-5.18/bluetooth-btmtksdio-fix-possible-fw-initialization-f.patch @@ -0,0 +1,61 @@ +From 7c68d83156700949c1060628f354d035c7cbdc27 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 May 2022 05:38:12 +0800 +Subject: Bluetooth: btmtksdio: fix possible FW initialization failure + +From: Sean Wang + +[ Upstream commit 7469720563e01f479ec5afe06bd6f440f965d523 ] + +According to FW advised sequence, mt7921s need to re-acquire privilege +immediately after the firmware download is complete before normal running. +Otherwise, it is still possible the bus may be stuck in an abnormal status +that causes FW initialization failure in the current driver. + +Fixes: 752aea58489f ("Bluetooth: mt7921s: fix bus hang with wrong privilege") +Co-developed-by: Yake Yang +Signed-off-by: Yake Yang +Signed-off-by: Sean Wang +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/btmtksdio.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/drivers/bluetooth/btmtksdio.c b/drivers/bluetooth/btmtksdio.c +index 4ae6631a7c29..5d13c1f61bd3 100644 +--- a/drivers/bluetooth/btmtksdio.c ++++ b/drivers/bluetooth/btmtksdio.c +@@ -864,6 +864,14 @@ static int mt79xx_setup(struct hci_dev *hdev, const char *fwname) + return err; + } + ++ err = btmtksdio_fw_pmctrl(bdev); ++ if (err < 0) ++ return err; ++ ++ err = btmtksdio_drv_pmctrl(bdev); ++ if (err < 0) ++ return err; ++ + /* Enable Bluetooth protocol */ + wmt_params.op = BTMTK_WMT_FUNC_CTRL; + wmt_params.flag = 0; +@@ -1109,14 +1117,6 @@ static int btmtksdio_setup(struct hci_dev *hdev) + if (err < 0) + return err; + +- err = btmtksdio_fw_pmctrl(bdev); +- if (err < 0) +- return err; +- +- err = btmtksdio_drv_pmctrl(bdev); +- if (err < 0) +- return err; +- + /* Enable SCO over I2S/PCM */ + err = btmtksdio_sco_setting(hdev); + if (err < 0) { +-- +2.35.1 + diff --git a/queue-5.18/bluetooth-btmtksdio-fix-the-reset-takes-too-long.patch b/queue-5.18/bluetooth-btmtksdio-fix-the-reset-takes-too-long.patch new file mode 100644 index 00000000000..b1122473909 --- /dev/null +++ b/queue-5.18/bluetooth-btmtksdio-fix-the-reset-takes-too-long.patch @@ -0,0 +1,50 @@ +From ee2e1a335b14ba843367dba19c58292b7ef10559 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 May 2022 05:38:11 +0800 +Subject: Bluetooth: btmtksdio: fix the reset takes too long + +From: Sean Wang + +[ Upstream commit baabb7f530e8a3f0085d12f4ea0bada4115515d3 ] + +Sending WMT command during the reset in progress is invalid and would get +no response from firmware until the reset is complete, so we ignore the WMT +command here to resolve the issue which causes the whole reset process +taking too long. + +Fixes: 8fafe702253d ("Bluetooth: mt7921s: support bluetooth reset mechanism") +Co-developed-by: Yake Yang +Signed-off-by: Yake Yang +Signed-off-by: Sean Wang +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/btmtksdio.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/bluetooth/btmtksdio.c b/drivers/bluetooth/btmtksdio.c +index 5d13c1f61bd3..d6700efcfe8c 100644 +--- a/drivers/bluetooth/btmtksdio.c ++++ b/drivers/bluetooth/btmtksdio.c +@@ -1189,6 +1189,10 @@ static int btmtksdio_shutdown(struct hci_dev *hdev) + */ + pm_runtime_get_sync(bdev->dev); + ++ /* wmt command only works until the reset is complete */ ++ if (test_bit(BTMTKSDIO_HW_RESET_ACTIVE, &bdev->tx_state)) ++ goto ignore_wmt_cmd; ++ + /* Disable the device */ + wmt_params.op = BTMTK_WMT_FUNC_CTRL; + wmt_params.flag = 0; +@@ -1202,6 +1206,7 @@ static int btmtksdio_shutdown(struct hci_dev *hdev) + return err; + } + ++ignore_wmt_cmd: + pm_runtime_put_noidle(bdev->dev); + pm_runtime_disable(bdev->dev); + +-- +2.35.1 + diff --git a/queue-5.18/bluetooth-btmtksdio-fix-use-after-free-at-btmtksdio_.patch b/queue-5.18/bluetooth-btmtksdio-fix-use-after-free-at-btmtksdio_.patch new file mode 100644 index 00000000000..9a95b9d98a7 --- /dev/null +++ b/queue-5.18/bluetooth-btmtksdio-fix-use-after-free-at-btmtksdio_.patch @@ -0,0 +1,86 @@ +From 5a39a8c43e8689a8b08e0ac33b898fca8aee3dfb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 May 2022 06:22:15 +0800 +Subject: Bluetooth: btmtksdio: fix use-after-free at btmtksdio_recv_event + +From: Sean Wang + +[ Upstream commit 0fab6361c4ba17d1b43a991bef4238a3c1754d35 ] + +We should not access skb buffer data anymore after hci_recv_frame was +called. + +[ 39.634809] BUG: KASAN: use-after-free in btmtksdio_recv_event+0x1b0 +[ 39.634855] Read of size 1 at addr ffffff80cf28a60d by task kworker +[ 39.634962] Call trace: +[ 39.634974] dump_backtrace+0x0/0x3b8 +[ 39.634999] show_stack+0x20/0x2c +[ 39.635016] dump_stack_lvl+0x60/0x78 +[ 39.635040] print_address_description+0x70/0x2f0 +[ 39.635062] kasan_report+0x154/0x194 +[ 39.635079] __asan_report_load1_noabort+0x44/0x50 +[ 39.635099] btmtksdio_recv_event+0x1b0/0x1c4 +[ 39.635129] btmtksdio_txrx_work+0x6cc/0xac4 +[ 39.635157] process_one_work+0x560/0xc5c +[ 39.635177] worker_thread+0x7ec/0xcc0 +[ 39.635195] kthread+0x2d0/0x3d0 +[ 39.635215] ret_from_fork+0x10/0x20 +[ 39.635247] Allocated by task 0: +[ 39.635260] (stack is not available) +[ 39.635281] Freed by task 2392: +[ 39.635295] kasan_save_stack+0x38/0x68 +[ 39.635319] kasan_set_track+0x28/0x3c +[ 39.635338] kasan_set_free_info+0x28/0x4c +[ 39.635357] ____kasan_slab_free+0x104/0x150 +[ 39.635374] __kasan_slab_free+0x18/0x28 +[ 39.635391] slab_free_freelist_hook+0x114/0x248 +[ 39.635410] kfree+0xf8/0x2b4 +[ 39.635427] skb_free_head+0x58/0x98 +[ 39.635447] skb_release_data+0x2f4/0x410 +[ 39.635464] skb_release_all+0x50/0x60 +[ 39.635481] kfree_skb+0xc8/0x25c +[ 39.635498] hci_event_packet+0x894/0xca4 [bluetooth] +[ 39.635721] hci_rx_work+0x1c8/0x68c [bluetooth] +[ 39.635925] process_one_work+0x560/0xc5c +[ 39.635951] worker_thread+0x7ec/0xcc0 +[ 39.635970] kthread+0x2d0/0x3d0 +[ 39.635990] ret_from_fork+0x10/0x20 +[ 39.636021] The buggy address belongs to the object at ffffff80cf28a600 + which belongs to the cache kmalloc-512 of size 512 +[ 39.636039] The buggy address is located 13 bytes inside of + 512-byte region [ffffff80cf28a600, ffffff80cf28a800) + +Fixes: 9aebfd4a2200 ("Bluetooth: mediatek: add support for MediaTek MT7663S and MT7668S SDIO devices") +Co-developed-by: Yake Yang +Signed-off-by: Yake Yang +Signed-off-by: Sean Wang +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/btmtksdio.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/bluetooth/btmtksdio.c b/drivers/bluetooth/btmtksdio.c +index b6d77e04240c..4ae6631a7c29 100644 +--- a/drivers/bluetooth/btmtksdio.c ++++ b/drivers/bluetooth/btmtksdio.c +@@ -379,6 +379,7 @@ static int btmtksdio_recv_event(struct hci_dev *hdev, struct sk_buff *skb) + { + struct btmtksdio_dev *bdev = hci_get_drvdata(hdev); + struct hci_event_hdr *hdr = (void *)skb->data; ++ u8 evt = hdr->evt; + int err; + + /* When someone waits for the WMT event, the skb is being cloned +@@ -396,7 +397,7 @@ static int btmtksdio_recv_event(struct hci_dev *hdev, struct sk_buff *skb) + if (err < 0) + goto err_free_skb; + +- if (hdr->evt == HCI_EV_WMT) { ++ if (evt == HCI_EV_WMT) { + if (test_and_clear_bit(BTMTKSDIO_TX_WAIT_VND_EVT, + &bdev->tx_state)) { + /* Barrier to sync with other CPUs */ +-- +2.35.1 + diff --git a/queue-5.18/bluetooth-btusb-set-hci_quirk_broken_enhanced_setup_.patch b/queue-5.18/bluetooth-btusb-set-hci_quirk_broken_enhanced_setup_.patch new file mode 100644 index 00000000000..c26e5833b04 --- /dev/null +++ b/queue-5.18/bluetooth-btusb-set-hci_quirk_broken_enhanced_setup_.patch @@ -0,0 +1,40 @@ +From ae2320cef0ea3fef7ed486b97349b724d71b15d3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Apr 2022 16:38:25 -0700 +Subject: Bluetooth: btusb: Set HCI_QUIRK_BROKEN_ENHANCED_SETUP_SYNC_CONN for + QCA + +From: Luiz Augusto von Dentz + +[ Upstream commit d44e1dbda36fff5d7c2586683c4adc0963aef908 ] + +This sets HCI_QUIRK_BROKEN_ENHANCED_SETUP_SYNC_CONN for QCA controllers +since SCO appear to not work when using HCI_OP_ENHANCED_SETUP_SYNC_CONN. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=215576 +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/btusb.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index 50df417207af..06a854a2507e 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -3335,6 +3335,11 @@ static int btusb_setup_qca(struct hci_dev *hdev) + msleep(QCA_BT_RESET_WAIT_MS); + } + ++ /* Mark HCI_OP_ENHANCED_SETUP_SYNC_CONN as broken as it doesn't seem to ++ * work with the likes of HSP/HFP mSBC. ++ */ ++ set_bit(HCI_QUIRK_BROKEN_ENHANCED_SETUP_SYNC_CONN, &hdev->quirks); ++ + return 0; + } + +-- +2.35.1 + diff --git a/queue-5.18/bluetooth-btusb-set-hci_quirk_broken_err_data_report.patch b/queue-5.18/bluetooth-btusb-set-hci_quirk_broken_err_data_report.patch new file mode 100644 index 00000000000..7283c89c05f --- /dev/null +++ b/queue-5.18/bluetooth-btusb-set-hci_quirk_broken_err_data_report.patch @@ -0,0 +1,49 @@ +From b3469b3dbed0e2d39ba4ebddb78568a33827d6d0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Apr 2022 10:16:51 +0800 +Subject: Bluetooth: btusb: Set HCI_QUIRK_BROKEN_ERR_DATA_REPORTING for QCA + +From: Zijun Hu + +[ Upstream commit 247f226adadfb7be09dd537f177429f4415aef8e ] + +Set HCI_QUIRK_BROKEN_ERR_DATA_REPORTING for QCA controllers since +they answer HCI_OP_READ_DEF_ERR_DATA_REPORTING with error code +"UNKNOWN HCI COMMAND" as shown below: + +[ 580.517552] Bluetooth: hci0: unexpected cc 0x0c5a length: 1 < 2 +[ 580.517660] Bluetooth: hci0: Opcode 0x c5a failed: -38 + +hcitool -i hci0 cmd 0x03 0x5a +< HCI Command: ogf 0x03, ocf 0x005a, plen 0 +> HCI Event: 0x0e plen 4 + 01 5A 0C 01 + +btmon log: +< HCI Command: Read Default Erroneous Data Reporting (0x03|0x005a) plen 0 +> HCI Event: Command Complete (0x0e) plen 4 + Read Default Erroneous Data Reporting (0x03|0x005a) ncmd 1 + Status: Unknown HCI Command (0x01) + +Signed-off-by: Zijun Hu +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/btusb.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index 06a854a2507e..e48c3ad069bb 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -3339,6 +3339,7 @@ static int btusb_setup_qca(struct hci_dev *hdev) + * work with the likes of HSP/HFP mSBC. + */ + set_bit(HCI_QUIRK_BROKEN_ENHANCED_SETUP_SYNC_CONN, &hdev->quirks); ++ set_bit(HCI_QUIRK_BROKEN_ERR_DATA_REPORTING, &hdev->quirks); + + return 0; + } +-- +2.35.1 + diff --git a/queue-5.18/bluetooth-fix-dangling-sco_conn-and-use-after-free-i.patch b/queue-5.18/bluetooth-fix-dangling-sco_conn-and-use-after-free-i.patch new file mode 100644 index 00000000000..fc26e06405c --- /dev/null +++ b/queue-5.18/bluetooth-fix-dangling-sco_conn-and-use-after-free-i.patch @@ -0,0 +1,88 @@ +From 8205437961cbdb9c0cddc4219aa750f9ef3d9a8e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 26 Mar 2022 07:09:28 +0000 +Subject: Bluetooth: fix dangling sco_conn and use-after-free in + sco_sock_timeout + +From: Ying Hsu + +[ Upstream commit 7aa1e7d15f8a5b65f67bacb100d8fc033b21efa2 ] + +Connecting the same socket twice consecutively in sco_sock_connect() +could lead to a race condition where two sco_conn objects are created +but only one is associated with the socket. If the socket is closed +before the SCO connection is established, the timer associated with the +dangling sco_conn object won't be canceled. As the sock object is being +freed, the use-after-free problem happens when the timer callback +function sco_sock_timeout() accesses the socket. Here's the call trace: + +dump_stack+0x107/0x163 +? refcount_inc+0x1c/ +print_address_description.constprop.0+0x1c/0x47e +? refcount_inc+0x1c/0x7b +kasan_report+0x13a/0x173 +? refcount_inc+0x1c/0x7b +check_memory_region+0x132/0x139 +refcount_inc+0x1c/0x7b +sco_sock_timeout+0xb2/0x1ba +process_one_work+0x739/0xbd1 +? cancel_delayed_work+0x13f/0x13f +? __raw_spin_lock_init+0xf0/0xf0 +? to_kthread+0x59/0x85 +worker_thread+0x593/0x70e +kthread+0x346/0x35a +? drain_workqueue+0x31a/0x31a +? kthread_bind+0x4b/0x4b +ret_from_fork+0x1f/0x30 + +Link: https://syzkaller.appspot.com/bug?extid=2bef95d3ab4daa10155b +Reported-by: syzbot+2bef95d3ab4daa10155b@syzkaller.appspotmail.com +Fixes: e1dee2c1de2b ("Bluetooth: fix repeated calls to sco_sock_kill") +Signed-off-by: Ying Hsu +Reviewed-by: Joseph Hwang +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +--- + net/bluetooth/sco.c | 21 +++++++++++++-------- + 1 file changed, 13 insertions(+), 8 deletions(-) + +diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c +index 2a58c7d88433..1111da4e2f2b 100644 +--- a/net/bluetooth/sco.c ++++ b/net/bluetooth/sco.c +@@ -574,19 +574,24 @@ static int sco_sock_connect(struct socket *sock, struct sockaddr *addr, int alen + addr->sa_family != AF_BLUETOOTH) + return -EINVAL; + +- if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND) +- return -EBADFD; ++ lock_sock(sk); ++ if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND) { ++ err = -EBADFD; ++ goto done; ++ } + +- if (sk->sk_type != SOCK_SEQPACKET) +- return -EINVAL; ++ if (sk->sk_type != SOCK_SEQPACKET) { ++ err = -EINVAL; ++ goto done; ++ } + + hdev = hci_get_route(&sa->sco_bdaddr, &sco_pi(sk)->src, BDADDR_BREDR); +- if (!hdev) +- return -EHOSTUNREACH; ++ if (!hdev) { ++ err = -EHOSTUNREACH; ++ goto done; ++ } + hci_dev_lock(hdev); + +- lock_sock(sk); +- + /* Set destination address and psm */ + bacpy(&sco_pi(sk)->dst, &sa->sco_bdaddr); + +-- +2.35.1 + diff --git a/queue-5.18/bluetooth-hci-add-hci_quirk_broken_enhanced_setup_sy.patch b/queue-5.18/bluetooth-hci-add-hci_quirk_broken_enhanced_setup_sy.patch new file mode 100644 index 00000000000..22e5c8ff235 --- /dev/null +++ b/queue-5.18/bluetooth-hci-add-hci_quirk_broken_enhanced_setup_sy.patch @@ -0,0 +1,93 @@ +From ec9a198db947fb9c3e2e232887e539e0799166c0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Apr 2022 16:38:23 -0700 +Subject: Bluetooth: HCI: Add HCI_QUIRK_BROKEN_ENHANCED_SETUP_SYNC_CONN quirk + +From: Luiz Augusto von Dentz + +[ Upstream commit 05abad857277dda198063017b00ba5b9fed2c0cb ] + +This adds HCI_QUIRK_BROKEN_ENHANCED_SETUP_SYNC_CONN quirk which can be +used to mark HCI_Enhanced_Setup_Synchronous_Connection as broken even +if its support command bit are set since some controller report it as +supported but the command don't work properly with some configurations +(e.g. BT_VOICE_TRANSPARENT/mSBC). + +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +--- + include/net/bluetooth/hci.h | 9 +++++++++ + include/net/bluetooth/hci_core.h | 8 ++++++-- + net/bluetooth/hci_conn.c | 2 +- + net/bluetooth/sco.c | 2 +- + 4 files changed, 17 insertions(+), 4 deletions(-) + +diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h +index 69ef31cea582..62a9bb022aed 100644 +--- a/include/net/bluetooth/hci.h ++++ b/include/net/bluetooth/hci.h +@@ -265,6 +265,15 @@ enum { + * runtime suspend, because event filtering takes place there. + */ + HCI_QUIRK_BROKEN_FILTER_CLEAR_ALL, ++ ++ /* ++ * When this quirk is set, disables the use of ++ * HCI_OP_ENHANCED_SETUP_SYNC_CONN command to setup SCO connections. ++ * ++ * This quirk can be set before hci_register_dev is called or ++ * during the hdev->setup vendor callback. ++ */ ++ HCI_QUIRK_BROKEN_ENHANCED_SETUP_SYNC_CONN, + }; + + /* HCI device flags */ +diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h +index 62d7b81b1cb7..5a52a2018b56 100644 +--- a/include/net/bluetooth/hci_core.h ++++ b/include/net/bluetooth/hci_core.h +@@ -1495,8 +1495,12 @@ void hci_conn_del_sysfs(struct hci_conn *conn); + #define privacy_mode_capable(dev) (use_ll_privacy(dev) && \ + (hdev->commands[39] & 0x04)) + +-/* Use enhanced synchronous connection if command is supported */ +-#define enhanced_sco_capable(dev) ((dev)->commands[29] & 0x08) ++/* Use enhanced synchronous connection if command is supported and its quirk ++ * has not been set. ++ */ ++#define enhanced_sync_conn_capable(dev) \ ++ (((dev)->commands[29] & 0x08) && \ ++ !test_bit(HCI_QUIRK_BROKEN_ENHANCED_SETUP_SYNC_CONN, &(dev)->quirks)) + + /* Use ext scanning if set ext scan param and ext scan enable is supported */ + #define use_ext_scan(dev) (((dev)->commands[37] & 0x20) && \ +diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c +index fe803bee419a..882a7df13005 100644 +--- a/net/bluetooth/hci_conn.c ++++ b/net/bluetooth/hci_conn.c +@@ -481,7 +481,7 @@ static bool hci_setup_sync_conn(struct hci_conn *conn, __u16 handle) + + bool hci_setup_sync(struct hci_conn *conn, __u16 handle) + { +- if (enhanced_sco_capable(conn->hdev)) ++ if (enhanced_sync_conn_capable(conn->hdev)) + return hci_enhanced_setup_sync_conn(conn, handle); + + return hci_setup_sync_conn(conn, handle); +diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c +index 8eabf41b2993..2a58c7d88433 100644 +--- a/net/bluetooth/sco.c ++++ b/net/bluetooth/sco.c +@@ -885,7 +885,7 @@ static int sco_sock_setsockopt(struct socket *sock, int level, int optname, + err = -EBADFD; + break; + } +- if (enhanced_sco_capable(hdev) && ++ if (enhanced_sync_conn_capable(hdev) && + voice.setting == BT_VOICE_TRANSPARENT) + sco_pi(sk)->codec.id = BT_CODEC_TRANSPARENT; + hci_dev_put(hdev); +-- +2.35.1 + diff --git a/queue-5.18/bluetooth-hci_conn-fix-hci_connect_le_sync.patch b/queue-5.18/bluetooth-hci_conn-fix-hci_connect_le_sync.patch new file mode 100644 index 00000000000..21df2ea62b2 --- /dev/null +++ b/queue-5.18/bluetooth-hci_conn-fix-hci_connect_le_sync.patch @@ -0,0 +1,65 @@ +From 23593c91551f46ddc9a9390bad01feb7b7eb3981 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 May 2022 11:37:13 -0700 +Subject: Bluetooth: hci_conn: Fix hci_connect_le_sync + +From: Luiz Augusto von Dentz + +[ Upstream commit c9f73a2178c12fb24d2807634209559d6a836e08 ] + +The handling of connection failures shall be handled by the request +completion callback as already done by hci_cs_le_create_conn, also make +sure to use hci_conn_failed instead of hci_le_conn_failed as the later +don't actually call hci_conn_del to cleanup. + +Link: https://github.com/bluez/bluez/issues/340 +Fixes: 8e8b92ee60de5 ("Bluetooth: hci_sync: Add hci_le_create_conn_sync") +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +--- + net/bluetooth/hci_conn.c | 5 +++-- + net/bluetooth/hci_event.c | 8 +++++--- + 2 files changed, 8 insertions(+), 5 deletions(-) + +diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c +index 882a7df13005..ac06c9724c7f 100644 +--- a/net/bluetooth/hci_conn.c ++++ b/net/bluetooth/hci_conn.c +@@ -943,10 +943,11 @@ static void create_le_conn_complete(struct hci_dev *hdev, void *data, int err) + + bt_dev_err(hdev, "request failed to create LE connection: err %d", err); + +- if (!conn) ++ /* Check if connection is still pending */ ++ if (conn != hci_lookup_le_connect(hdev)) + goto done; + +- hci_le_conn_failed(conn, err); ++ hci_conn_failed(conn, err); + + done: + hci_dev_unlock(hdev); +diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c +index 0270e597c285..af17dfb20e01 100644 +--- a/net/bluetooth/hci_event.c ++++ b/net/bluetooth/hci_event.c +@@ -5632,10 +5632,12 @@ static void le_conn_complete_evt(struct hci_dev *hdev, u8 status, + status = HCI_ERROR_INVALID_PARAMETERS; + } + +- if (status) { +- hci_conn_failed(conn, status); ++ /* All connection failure handling is taken care of by the ++ * hci_conn_failed function which is triggered by the HCI ++ * request completion callbacks used for connecting. ++ */ ++ if (status) + goto unlock; +- } + + if (conn->dst_type == ADDR_LE_DEV_PUBLIC) + addr_type = BDADDR_LE_PUBLIC; +-- +2.35.1 + diff --git a/queue-5.18/bluetooth-mt7921s-fix-the-incorrect-pointer-check.patch b/queue-5.18/bluetooth-mt7921s-fix-the-incorrect-pointer-check.patch new file mode 100644 index 00000000000..a4778d16ce6 --- /dev/null +++ b/queue-5.18/bluetooth-mt7921s-fix-the-incorrect-pointer-check.patch @@ -0,0 +1,37 @@ +From 411cf5356b8d352003fb32364e53ab65d9cc7563 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Mar 2022 07:30:40 +0800 +Subject: Bluetooth: mt7921s: Fix the incorrect pointer check + +From: Sean Wang + +[ Upstream commit 789f6b8ac3b15bca09b69d5699cad0bf6e2103aa ] + +Fix the incorrect pointer check on ven_data. + +Fixes: f41b91fa1783 ("Bluetooth: mt7921s: Add .btmtk_get_codec_config_data") +Co-developed-by: Yake Yang +Signed-off-by: Yake Yang +Signed-off-by: Sean Wang +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/btmtksdio.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/bluetooth/btmtksdio.c b/drivers/bluetooth/btmtksdio.c +index f3dc5881fff7..b6d77e04240c 100644 +--- a/drivers/bluetooth/btmtksdio.c ++++ b/drivers/bluetooth/btmtksdio.c +@@ -961,7 +961,7 @@ static int btmtksdio_get_codec_config_data(struct hci_dev *hdev, + } + + *ven_data = kmalloc(sizeof(__u8), GFP_KERNEL); +- if (!ven_data) { ++ if (!*ven_data) { + err = -ENOMEM; + goto error; + } +-- +2.35.1 + diff --git a/queue-5.18/bluetooth-protect-le-accept-and-resolv-lists-with-hd.patch b/queue-5.18/bluetooth-protect-le-accept-and-resolv-lists-with-hd.patch new file mode 100644 index 00000000000..b14bc63e937 --- /dev/null +++ b/queue-5.18/bluetooth-protect-le-accept-and-resolv-lists-with-hd.patch @@ -0,0 +1,96 @@ +From 49a1a867fc194540fd75f004b7df8013ee9d1851 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 23 Apr 2022 00:31:17 +0200 +Subject: Bluetooth: protect le accept and resolv lists with hdev->lock + +From: Niels Dossche + +[ Upstream commit 5e2b6064cbc5fd582396768c5f9583f65085e368 ] + +Concurrent operations from events on le_{accept,resolv}_list are +currently unprotected by hdev->lock. +Most existing code do already protect the lists with that lock. +This can be observed in hci_debugfs and hci_sync. +Add the protection for these events too. + +Fixes: b950aa88638c ("Bluetooth: Add definitions and track LE resolve list modification") +Fixes: 0f36b589e4ee ("Bluetooth: Track LE white list modification via HCI commands") +Signed-off-by: Niels Dossche +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +--- + net/bluetooth/hci_event.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c +index a835ce6f8430..0270e597c285 100644 +--- a/net/bluetooth/hci_event.c ++++ b/net/bluetooth/hci_event.c +@@ -1835,7 +1835,9 @@ static u8 hci_cc_le_clear_accept_list(struct hci_dev *hdev, void *data, + if (rp->status) + return rp->status; + ++ hci_dev_lock(hdev); + hci_bdaddr_list_clear(&hdev->le_accept_list); ++ hci_dev_unlock(hdev); + + return rp->status; + } +@@ -1855,8 +1857,10 @@ static u8 hci_cc_le_add_to_accept_list(struct hci_dev *hdev, void *data, + if (!sent) + return rp->status; + ++ hci_dev_lock(hdev); + hci_bdaddr_list_add(&hdev->le_accept_list, &sent->bdaddr, + sent->bdaddr_type); ++ hci_dev_unlock(hdev); + + return rp->status; + } +@@ -1876,8 +1880,10 @@ static u8 hci_cc_le_del_from_accept_list(struct hci_dev *hdev, void *data, + if (!sent) + return rp->status; + ++ hci_dev_lock(hdev); + hci_bdaddr_list_del(&hdev->le_accept_list, &sent->bdaddr, + sent->bdaddr_type); ++ hci_dev_unlock(hdev); + + return rp->status; + } +@@ -1949,9 +1955,11 @@ static u8 hci_cc_le_add_to_resolv_list(struct hci_dev *hdev, void *data, + if (!sent) + return rp->status; + ++ hci_dev_lock(hdev); + hci_bdaddr_list_add_with_irk(&hdev->le_resolv_list, &sent->bdaddr, + sent->bdaddr_type, sent->peer_irk, + sent->local_irk); ++ hci_dev_unlock(hdev); + + return rp->status; + } +@@ -1971,8 +1979,10 @@ static u8 hci_cc_le_del_from_resolv_list(struct hci_dev *hdev, void *data, + if (!sent) + return rp->status; + ++ hci_dev_lock(hdev); + hci_bdaddr_list_del_with_irk(&hdev->le_resolv_list, &sent->bdaddr, + sent->bdaddr_type); ++ hci_dev_unlock(hdev); + + return rp->status; + } +@@ -1987,7 +1997,9 @@ static u8 hci_cc_le_clear_resolv_list(struct hci_dev *hdev, void *data, + if (rp->status) + return rp->status; + ++ hci_dev_lock(hdev); + hci_bdaddr_list_clear(&hdev->le_resolv_list); ++ hci_dev_unlock(hdev); + + return rp->status; + } +-- +2.35.1 + diff --git a/queue-5.18/bluetooth-use-hdev-lock-for-accept_list-and-reject_l.patch b/queue-5.18/bluetooth-use-hdev-lock-for-accept_list-and-reject_l.patch new file mode 100644 index 00000000000..fc7d83058d7 --- /dev/null +++ b/queue-5.18/bluetooth-use-hdev-lock-for-accept_list-and-reject_l.patch @@ -0,0 +1,83 @@ +From fb77b6041577e2d4d1c14135adc1a28081bd340c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Apr 2022 19:37:52 +0200 +Subject: Bluetooth: use hdev lock for accept_list and reject_list in conn req + +From: Niels Dossche + +[ Upstream commit fb048cae51bacdfbbda2954af3c213fdb1d484f4 ] + +All accesses (both reads and modifications) to +hdev->{accept,reject}_list are protected by hdev lock, +except the ones in hci_conn_request_evt. This can cause a race +condition in the form of a list corruption. +The solution is to protect these lists in hci_conn_request_evt as well. + +I was unable to find the exact commit that introduced the issue for the +reject list, I was only able to find it for the accept list. + +Fixes: a55bd29d5227 ("Bluetooth: Add white list lookup for incoming connection requests") +Signed-off-by: Niels Dossche +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +--- + net/bluetooth/hci_event.c | 15 +++++++++------ + 1 file changed, 9 insertions(+), 6 deletions(-) + +diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c +index 66451661283c..a835ce6f8430 100644 +--- a/net/bluetooth/hci_event.c ++++ b/net/bluetooth/hci_event.c +@@ -3225,10 +3225,12 @@ static void hci_conn_request_evt(struct hci_dev *hdev, void *data, + return; + } + ++ hci_dev_lock(hdev); ++ + if (hci_bdaddr_list_lookup(&hdev->reject_list, &ev->bdaddr, + BDADDR_BREDR)) { + hci_reject_conn(hdev, &ev->bdaddr); +- return; ++ goto unlock; + } + + /* Require HCI_CONNECTABLE or an accept list entry to accept the +@@ -3240,13 +3242,11 @@ static void hci_conn_request_evt(struct hci_dev *hdev, void *data, + !hci_bdaddr_list_lookup_with_flags(&hdev->accept_list, &ev->bdaddr, + BDADDR_BREDR)) { + hci_reject_conn(hdev, &ev->bdaddr); +- return; ++ goto unlock; + } + + /* Connection accepted */ + +- hci_dev_lock(hdev); +- + ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr); + if (ie) + memcpy(ie->data.dev_class, ev->dev_class, 3); +@@ -3258,8 +3258,7 @@ static void hci_conn_request_evt(struct hci_dev *hdev, void *data, + HCI_ROLE_SLAVE); + if (!conn) { + bt_dev_err(hdev, "no memory for new connection"); +- hci_dev_unlock(hdev); +- return; ++ goto unlock; + } + } + +@@ -3299,6 +3298,10 @@ static void hci_conn_request_evt(struct hci_dev *hdev, void *data, + conn->state = BT_CONNECT2; + hci_connect_cfm(conn, 0); + } ++ ++ return; ++unlock: ++ hci_dev_unlock(hdev); + } + + static u8 hci_to_mgmt_reason(u8 err) +-- +2.35.1 + diff --git a/queue-5.18/bluetooth-use-hdev-lock-in-activate_scan-for-hci_is_.patch b/queue-5.18/bluetooth-use-hdev-lock-in-activate_scan-for-hci_is_.patch new file mode 100644 index 00000000000..259dab4dc7b --- /dev/null +++ b/queue-5.18/bluetooth-use-hdev-lock-in-activate_scan-for-hci_is_.patch @@ -0,0 +1,48 @@ +From 5f22d62a116417a644bd8b4c3f6315eeadb035ad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Apr 2022 20:06:52 +0200 +Subject: Bluetooth: use hdev lock in activate_scan for hci_is_adv_monitoring + +From: Niels Dossche + +[ Upstream commit 50a3633ae5e98cf1b80ef5b73c9e341aee9ad896 ] + +hci_is_adv_monitoring's function documentation states that it must be +called under the hdev lock. Paths that leads to an unlocked call are: +discov_update => start_discovery => interleaved_discov => active_scan +and: discov_update => start_discovery => active_scan + +The solution is to take the lock in active_scan during the duration of +the call to hci_is_adv_monitoring. + +Fixes: c32d624640fd ("Bluetooth: disable filter dup when scan for adv monitor") +Signed-off-by: Niels Dossche +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +--- + net/bluetooth/hci_request.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/bluetooth/hci_request.c b/net/bluetooth/hci_request.c +index 42c8047a9897..f4afe482e300 100644 +--- a/net/bluetooth/hci_request.c ++++ b/net/bluetooth/hci_request.c +@@ -2260,6 +2260,7 @@ static int active_scan(struct hci_request *req, unsigned long opt) + if (err < 0) + own_addr_type = ADDR_LE_DEV_PUBLIC; + ++ hci_dev_lock(hdev); + if (hci_is_adv_monitoring(hdev)) { + /* Duplicate filter should be disabled when some advertisement + * monitor is activated, otherwise AdvMon can only receive one +@@ -2276,6 +2277,7 @@ static int active_scan(struct hci_request *req, unsigned long opt) + */ + filter_dup = LE_SCAN_FILTER_DUP_DISABLE; + } ++ hci_dev_unlock(hdev); + + hci_req_start_scan(req, LE_SCAN_ACTIVE, interval, + hdev->le_scan_window_discovery, own_addr_type, +-- +2.35.1 + diff --git a/queue-5.18/bnxt_en-configure-ptp-filters-during-bnxt-open.patch b/queue-5.18/bnxt_en-configure-ptp-filters-during-bnxt-open.patch new file mode 100644 index 00000000000..eecfeba833e --- /dev/null +++ b/queue-5.18/bnxt_en-configure-ptp-filters-during-bnxt-open.patch @@ -0,0 +1,145 @@ +From ab2025af8efdf87f33522c1d55deca903fe0db1e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 May 2022 22:40:22 -0400 +Subject: bnxt_en: Configure ptp filters during bnxt open + +From: Pavan Chebbi + +[ Upstream commit 11862689e8f117e4702f55000790d7bce6859e84 ] + +For correctness, we need to configure the packet filters for timestamping +during bnxt_open. This way they are always configured after firmware +reset or chip reset. We should not assume that the filters will always +be retained across resets. + +This patch modifies the ioctl handler and always configures the PTP +filters in the bnxt_open() path. + +Cc: Richard Cochran +Signed-off-by: Pavan Chebbi +Signed-off-by: Michael Chan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 1 + + drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c | 56 ++++++++++++++----- + drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.h | 2 + + 3 files changed, 46 insertions(+), 13 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index 1d69fe0737a1..d5149478a351 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -10363,6 +10363,7 @@ static int __bnxt_open_nic(struct bnxt *bp, bool irq_re_init, bool link_re_init) + if (BNXT_PF(bp)) + bnxt_vf_reps_open(bp); + bnxt_ptp_init_rtc(bp, true); ++ bnxt_ptp_cfg_tstamp_filters(bp); + return 0; + + open_err_irq: +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c +index 00f2f80c0073..f9c94e5fe718 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c +@@ -295,6 +295,27 @@ static int bnxt_ptp_cfg_event(struct bnxt *bp, u8 event) + return hwrm_req_send(bp, req); + } + ++void bnxt_ptp_cfg_tstamp_filters(struct bnxt *bp) ++{ ++ struct bnxt_ptp_cfg *ptp = bp->ptp_cfg; ++ struct hwrm_port_mac_cfg_input *req; ++ ++ if (!ptp || !ptp->tstamp_filters) ++ return; ++ ++ if (hwrm_req_init(bp, req, HWRM_PORT_MAC_CFG)) ++ goto out; ++ req->flags = cpu_to_le32(ptp->tstamp_filters); ++ req->enables = cpu_to_le32(PORT_MAC_CFG_REQ_ENABLES_RX_TS_CAPTURE_PTP_MSG_TYPE); ++ req->rx_ts_capture_ptp_msg_type = cpu_to_le16(ptp->rxctl); ++ ++ if (!hwrm_req_send(bp, req)) ++ return; ++ ptp->tstamp_filters = 0; ++out: ++ netdev_warn(bp->dev, "Failed to configure HW packet timestamp filters\n"); ++} ++ + void bnxt_ptp_reapply_pps(struct bnxt *bp) + { + struct bnxt_ptp_cfg *ptp = bp->ptp_cfg; +@@ -435,27 +456,36 @@ static int bnxt_ptp_enable(struct ptp_clock_info *ptp_info, + static int bnxt_hwrm_ptp_cfg(struct bnxt *bp) + { + struct bnxt_ptp_cfg *ptp = bp->ptp_cfg; +- struct hwrm_port_mac_cfg_input *req; + u32 flags = 0; +- int rc; ++ int rc = 0; + +- rc = hwrm_req_init(bp, req, HWRM_PORT_MAC_CFG); +- if (rc) +- return rc; ++ switch (ptp->rx_filter) { ++ case HWTSTAMP_FILTER_NONE: ++ flags = PORT_MAC_CFG_REQ_FLAGS_PTP_RX_TS_CAPTURE_DISABLE; ++ break; ++ case HWTSTAMP_FILTER_PTP_V2_EVENT: ++ case HWTSTAMP_FILTER_PTP_V2_SYNC: ++ case HWTSTAMP_FILTER_PTP_V2_DELAY_REQ: ++ flags = PORT_MAC_CFG_REQ_FLAGS_PTP_RX_TS_CAPTURE_ENABLE; ++ break; ++ } + +- if (ptp->rx_filter) +- flags |= PORT_MAC_CFG_REQ_FLAGS_PTP_RX_TS_CAPTURE_ENABLE; +- else +- flags |= PORT_MAC_CFG_REQ_FLAGS_PTP_RX_TS_CAPTURE_DISABLE; + if (ptp->tx_tstamp_en) + flags |= PORT_MAC_CFG_REQ_FLAGS_PTP_TX_TS_CAPTURE_ENABLE; + else + flags |= PORT_MAC_CFG_REQ_FLAGS_PTP_TX_TS_CAPTURE_DISABLE; +- req->flags = cpu_to_le32(flags); +- req->enables = cpu_to_le32(PORT_MAC_CFG_REQ_ENABLES_RX_TS_CAPTURE_PTP_MSG_TYPE); +- req->rx_ts_capture_ptp_msg_type = cpu_to_le16(ptp->rxctl); + +- return hwrm_req_send(bp, req); ++ ptp->tstamp_filters = flags; ++ ++ if (netif_running(bp->dev)) { ++ rc = bnxt_close_nic(bp, false, false); ++ if (!rc) ++ rc = bnxt_open_nic(bp, false, false); ++ if (!rc && !ptp->tstamp_filters) ++ rc = -EIO; ++ } ++ ++ return rc; + } + + int bnxt_hwtstamp_set(struct net_device *dev, struct ifreq *ifr) +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.h b/drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.h +index 530b9922608c..4ce0a14c1e23 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.h ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.h +@@ -113,6 +113,7 @@ struct bnxt_ptp_cfg { + BNXT_PTP_MSG_PDELAY_RESP) + u8 tx_tstamp_en:1; + int rx_filter; ++ u32 tstamp_filters; + + u32 refclk_regs[2]; + u32 refclk_mapped_regs[2]; +@@ -133,6 +134,7 @@ do { \ + int bnxt_ptp_parse(struct sk_buff *skb, u16 *seq_id, u16 *hdr_off); + void bnxt_ptp_update_current_time(struct bnxt *bp); + void bnxt_ptp_pps_event(struct bnxt *bp, u32 data1, u32 data2); ++void bnxt_ptp_cfg_tstamp_filters(struct bnxt *bp); + void bnxt_ptp_reapply_pps(struct bnxt *bp); + int bnxt_hwtstamp_set(struct net_device *dev, struct ifreq *ifr); + int bnxt_hwtstamp_get(struct net_device *dev, struct ifreq *ifr); +-- +2.35.1 + diff --git a/queue-5.18/bonding-fix-missed-rcu-protection.patch b/queue-5.18/bonding-fix-missed-rcu-protection.patch new file mode 100644 index 00000000000..e2c1c68a9f2 --- /dev/null +++ b/queue-5.18/bonding-fix-missed-rcu-protection.patch @@ -0,0 +1,99 @@ +From 92743cdb6539baed6a9ede70b8a64b1fee96f354 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 May 2022 10:01:48 +0800 +Subject: bonding: fix missed rcu protection + +From: Hangbin Liu + +[ Upstream commit 9b80ccda233fa6c59de411bf889cc4d0e028f2c7 ] + +When removing the rcu_read_lock in bond_ethtool_get_ts_info() as +discussed [1], I didn't notice it could be called via setsockopt, +which doesn't hold rcu lock, as syzbot pointed: + + stack backtrace: + CPU: 0 PID: 3599 Comm: syz-executor317 Not tainted 5.18.0-rc5-syzkaller-01392-g01f4685797a5 #0 + Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 + Call Trace: + + __dump_stack lib/dump_stack.c:88 [inline] + dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 + bond_option_active_slave_get_rcu include/net/bonding.h:353 [inline] + bond_ethtool_get_ts_info+0x32c/0x3a0 drivers/net/bonding/bond_main.c:5595 + __ethtool_get_ts_info+0x173/0x240 net/ethtool/common.c:554 + ethtool_get_phc_vclocks+0x99/0x110 net/ethtool/common.c:568 + sock_timestamping_bind_phc net/core/sock.c:869 [inline] + sock_set_timestamping+0x3a3/0x7e0 net/core/sock.c:916 + sock_setsockopt+0x543/0x2ec0 net/core/sock.c:1221 + __sys_setsockopt+0x55e/0x6a0 net/socket.c:2223 + __do_sys_setsockopt net/socket.c:2238 [inline] + __se_sys_setsockopt net/socket.c:2235 [inline] + __x64_sys_setsockopt+0xba/0x150 net/socket.c:2235 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x44/0xae + RIP: 0033:0x7f8902c8eb39 + +Fix it by adding rcu_read_lock and take a ref on the real_dev. +Since dev_hold() and dev_put() can take NULL these days, we can +skip checking if real_dev exist. + +[1] https://lore.kernel.org/netdev/27565.1642742439@famine/ + +Reported-by: syzbot+92beb3d46aab498710fa@syzkaller.appspotmail.com +Fixes: aa6034678e87 ("bonding: use rcu_dereference_rtnl when get bonding active slave") +Suggested-by: Vladimir Oltean +Suggested-by: Jakub Kicinski +Signed-off-by: Hangbin Liu +Reviewed-by: Vladimir Oltean +Link: https://lore.kernel.org/r/20220519020148.1058344-1-liuhangbin@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/bonding/bond_main.c | 15 ++++++++++++--- + 1 file changed, 12 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c +index 38e152548126..b5c5196e03ee 100644 +--- a/drivers/net/bonding/bond_main.c ++++ b/drivers/net/bonding/bond_main.c +@@ -5591,16 +5591,23 @@ static int bond_ethtool_get_ts_info(struct net_device *bond_dev, + const struct ethtool_ops *ops; + struct net_device *real_dev; + struct phy_device *phydev; ++ int ret = 0; + ++ rcu_read_lock(); + real_dev = bond_option_active_slave_get_rcu(bond); ++ dev_hold(real_dev); ++ rcu_read_unlock(); ++ + if (real_dev) { + ops = real_dev->ethtool_ops; + phydev = real_dev->phydev; + + if (phy_has_tsinfo(phydev)) { +- return phy_ts_info(phydev, info); ++ ret = phy_ts_info(phydev, info); ++ goto out; + } else if (ops->get_ts_info) { +- return ops->get_ts_info(real_dev, info); ++ ret = ops->get_ts_info(real_dev, info); ++ goto out; + } + } + +@@ -5608,7 +5615,9 @@ static int bond_ethtool_get_ts_info(struct net_device *bond_dev, + SOF_TIMESTAMPING_SOFTWARE; + info->phc_index = -1; + +- return 0; ++out: ++ dev_put(real_dev); ++ return ret; + } + + static const struct ethtool_ops bond_ethtool_ops = { +-- +2.35.1 + diff --git a/queue-5.18/bpf-move-rcu-lock-management-out-of-bpf_prog_run-rou.patch b/queue-5.18/bpf-move-rcu-lock-management-out-of-bpf_prog_run-rou.patch new file mode 100644 index 00000000000..99f4aeb5647 --- /dev/null +++ b/queue-5.18/bpf-move-rcu-lock-management-out-of-bpf_prog_run-rou.patch @@ -0,0 +1,441 @@ +From a3d6af401f0680bebba6b14f5c6bcda598655281 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Apr 2022 09:12:33 -0700 +Subject: bpf: Move rcu lock management out of BPF_PROG_RUN routines + +From: Stanislav Fomichev + +[ Upstream commit 055eb95533273bc334794dbc598400d10800528f ] + +Commit 7d08c2c91171 ("bpf: Refactor BPF_PROG_RUN_ARRAY family of macros +into functions") switched a bunch of BPF_PROG_RUN macros to inline +routines. This changed the semantic a bit. Due to arguments expansion +of macros, it used to be: + + rcu_read_lock(); + array = rcu_dereference(cgrp->bpf.effective[atype]); + ... + +Now, with with inline routines, we have: + array_rcu = rcu_dereference(cgrp->bpf.effective[atype]); + /* array_rcu can be kfree'd here */ + rcu_read_lock(); + array = rcu_dereference(array_rcu); + +I'm assuming in practice rcu subsystem isn't fast enough to trigger +this but let's use rcu API properly. + +Also, rename to lower caps to not confuse with macros. Additionally, +drop and expand BPF_PROG_CGROUP_INET_EGRESS_RUN_ARRAY. + +See [1] for more context. + + [1] https://lore.kernel.org/bpf/CAKH8qBs60fOinFdxiiQikK_q0EcVxGvNTQoWvHLEUGbgcj1UYg@mail.gmail.com/T/#u + +v2 +- keep rcu locks inside by passing cgroup_bpf + +Fixes: 7d08c2c91171 ("bpf: Refactor BPF_PROG_RUN_ARRAY family of macros into functions") +Signed-off-by: Stanislav Fomichev +Signed-off-by: Alexei Starovoitov +Acked-by: Martin KaFai Lau +Link: https://lore.kernel.org/bpf/20220414161233.170780-1-sdf@google.com +Signed-off-by: Sasha Levin +--- + drivers/media/rc/bpf-lirc.c | 8 ++- + include/linux/bpf.h | 115 ++------------------------------- + kernel/bpf/cgroup.c | 124 +++++++++++++++++++++++++++++++----- + kernel/trace/bpf_trace.c | 5 +- + 4 files changed, 124 insertions(+), 128 deletions(-) + +diff --git a/drivers/media/rc/bpf-lirc.c b/drivers/media/rc/bpf-lirc.c +index 3eff08d7b8e5..fe17c7f98e81 100644 +--- a/drivers/media/rc/bpf-lirc.c ++++ b/drivers/media/rc/bpf-lirc.c +@@ -216,8 +216,12 @@ void lirc_bpf_run(struct rc_dev *rcdev, u32 sample) + + raw->bpf_sample = sample; + +- if (raw->progs) +- BPF_PROG_RUN_ARRAY(raw->progs, &raw->bpf_sample, bpf_prog_run); ++ if (raw->progs) { ++ rcu_read_lock(); ++ bpf_prog_run_array(rcu_dereference(raw->progs), ++ &raw->bpf_sample, bpf_prog_run); ++ rcu_read_unlock(); ++ } + } + + /* +diff --git a/include/linux/bpf.h b/include/linux/bpf.h +index f084b251fce7..67efaa38c33f 100644 +--- a/include/linux/bpf.h ++++ b/include/linux/bpf.h +@@ -1221,7 +1221,7 @@ u64 bpf_event_output(struct bpf_map *map, u64 flags, void *meta, u64 meta_size, + /* an array of programs to be executed under rcu_lock. + * + * Typical usage: +- * ret = BPF_PROG_RUN_ARRAY(&bpf_prog_array, ctx, bpf_prog_run); ++ * ret = bpf_prog_run_array(rcu_dereference(&bpf_prog_array), ctx, bpf_prog_run); + * + * the structure returned by bpf_prog_array_alloc() should be populated + * with program pointers and the last pointer must be NULL. +@@ -1315,83 +1315,22 @@ static inline void bpf_reset_run_ctx(struct bpf_run_ctx *old_ctx) + + typedef u32 (*bpf_prog_run_fn)(const struct bpf_prog *prog, const void *ctx); + +-static __always_inline int +-BPF_PROG_RUN_ARRAY_CG_FLAGS(const struct bpf_prog_array __rcu *array_rcu, +- const void *ctx, bpf_prog_run_fn run_prog, +- int retval, u32 *ret_flags) +-{ +- const struct bpf_prog_array_item *item; +- const struct bpf_prog *prog; +- const struct bpf_prog_array *array; +- struct bpf_run_ctx *old_run_ctx; +- struct bpf_cg_run_ctx run_ctx; +- u32 func_ret; +- +- run_ctx.retval = retval; +- migrate_disable(); +- rcu_read_lock(); +- array = rcu_dereference(array_rcu); +- item = &array->items[0]; +- old_run_ctx = bpf_set_run_ctx(&run_ctx.run_ctx); +- while ((prog = READ_ONCE(item->prog))) { +- run_ctx.prog_item = item; +- func_ret = run_prog(prog, ctx); +- if (!(func_ret & 1) && !IS_ERR_VALUE((long)run_ctx.retval)) +- run_ctx.retval = -EPERM; +- *(ret_flags) |= (func_ret >> 1); +- item++; +- } +- bpf_reset_run_ctx(old_run_ctx); +- rcu_read_unlock(); +- migrate_enable(); +- return run_ctx.retval; +-} +- +-static __always_inline int +-BPF_PROG_RUN_ARRAY_CG(const struct bpf_prog_array __rcu *array_rcu, +- const void *ctx, bpf_prog_run_fn run_prog, +- int retval) +-{ +- const struct bpf_prog_array_item *item; +- const struct bpf_prog *prog; +- const struct bpf_prog_array *array; +- struct bpf_run_ctx *old_run_ctx; +- struct bpf_cg_run_ctx run_ctx; +- +- run_ctx.retval = retval; +- migrate_disable(); +- rcu_read_lock(); +- array = rcu_dereference(array_rcu); +- item = &array->items[0]; +- old_run_ctx = bpf_set_run_ctx(&run_ctx.run_ctx); +- while ((prog = READ_ONCE(item->prog))) { +- run_ctx.prog_item = item; +- if (!run_prog(prog, ctx) && !IS_ERR_VALUE((long)run_ctx.retval)) +- run_ctx.retval = -EPERM; +- item++; +- } +- bpf_reset_run_ctx(old_run_ctx); +- rcu_read_unlock(); +- migrate_enable(); +- return run_ctx.retval; +-} +- + static __always_inline u32 +-BPF_PROG_RUN_ARRAY(const struct bpf_prog_array __rcu *array_rcu, ++bpf_prog_run_array(const struct bpf_prog_array *array, + const void *ctx, bpf_prog_run_fn run_prog) + { + const struct bpf_prog_array_item *item; + const struct bpf_prog *prog; +- const struct bpf_prog_array *array; + struct bpf_run_ctx *old_run_ctx; + struct bpf_trace_run_ctx run_ctx; + u32 ret = 1; + +- migrate_disable(); +- rcu_read_lock(); +- array = rcu_dereference(array_rcu); ++ RCU_LOCKDEP_WARN(!rcu_read_lock_held(), "no rcu lock held"); ++ + if (unlikely(!array)) +- goto out; ++ return ret; ++ ++ migrate_disable(); + old_run_ctx = bpf_set_run_ctx(&run_ctx.run_ctx); + item = &array->items[0]; + while ((prog = READ_ONCE(item->prog))) { +@@ -1400,50 +1339,10 @@ BPF_PROG_RUN_ARRAY(const struct bpf_prog_array __rcu *array_rcu, + item++; + } + bpf_reset_run_ctx(old_run_ctx); +-out: +- rcu_read_unlock(); + migrate_enable(); + return ret; + } + +-/* To be used by __cgroup_bpf_run_filter_skb for EGRESS BPF progs +- * so BPF programs can request cwr for TCP packets. +- * +- * Current cgroup skb programs can only return 0 or 1 (0 to drop the +- * packet. This macro changes the behavior so the low order bit +- * indicates whether the packet should be dropped (0) or not (1) +- * and the next bit is a congestion notification bit. This could be +- * used by TCP to call tcp_enter_cwr() +- * +- * Hence, new allowed return values of CGROUP EGRESS BPF programs are: +- * 0: drop packet +- * 1: keep packet +- * 2: drop packet and cn +- * 3: keep packet and cn +- * +- * This macro then converts it to one of the NET_XMIT or an error +- * code that is then interpreted as drop packet (and no cn): +- * 0: NET_XMIT_SUCCESS skb should be transmitted +- * 1: NET_XMIT_DROP skb should be dropped and cn +- * 2: NET_XMIT_CN skb should be transmitted and cn +- * 3: -err skb should be dropped +- */ +-#define BPF_PROG_CGROUP_INET_EGRESS_RUN_ARRAY(array, ctx, func) \ +- ({ \ +- u32 _flags = 0; \ +- bool _cn; \ +- u32 _ret; \ +- _ret = BPF_PROG_RUN_ARRAY_CG_FLAGS(array, ctx, func, 0, &_flags); \ +- _cn = _flags & BPF_RET_SET_CN; \ +- if (_ret && !IS_ERR_VALUE((long)_ret)) \ +- _ret = -EFAULT; \ +- if (!_ret) \ +- _ret = (_cn ? NET_XMIT_CN : NET_XMIT_SUCCESS); \ +- else \ +- _ret = (_cn ? NET_XMIT_DROP : _ret); \ +- _ret; \ +- }) +- + #ifdef CONFIG_BPF_SYSCALL + DECLARE_PER_CPU(int, bpf_prog_active); + extern struct mutex bpf_stats_enabled_mutex; +diff --git a/kernel/bpf/cgroup.c b/kernel/bpf/cgroup.c +index 128028efda64..0cb6211fcb58 100644 +--- a/kernel/bpf/cgroup.c ++++ b/kernel/bpf/cgroup.c +@@ -22,6 +22,72 @@ + DEFINE_STATIC_KEY_ARRAY_FALSE(cgroup_bpf_enabled_key, MAX_CGROUP_BPF_ATTACH_TYPE); + EXPORT_SYMBOL(cgroup_bpf_enabled_key); + ++/* __always_inline is necessary to prevent indirect call through run_prog ++ * function pointer. ++ */ ++static __always_inline int ++bpf_prog_run_array_cg_flags(const struct cgroup_bpf *cgrp, ++ enum cgroup_bpf_attach_type atype, ++ const void *ctx, bpf_prog_run_fn run_prog, ++ int retval, u32 *ret_flags) ++{ ++ const struct bpf_prog_array_item *item; ++ const struct bpf_prog *prog; ++ const struct bpf_prog_array *array; ++ struct bpf_run_ctx *old_run_ctx; ++ struct bpf_cg_run_ctx run_ctx; ++ u32 func_ret; ++ ++ run_ctx.retval = retval; ++ migrate_disable(); ++ rcu_read_lock(); ++ array = rcu_dereference(cgrp->effective[atype]); ++ item = &array->items[0]; ++ old_run_ctx = bpf_set_run_ctx(&run_ctx.run_ctx); ++ while ((prog = READ_ONCE(item->prog))) { ++ run_ctx.prog_item = item; ++ func_ret = run_prog(prog, ctx); ++ if (!(func_ret & 1) && !IS_ERR_VALUE((long)run_ctx.retval)) ++ run_ctx.retval = -EPERM; ++ *(ret_flags) |= (func_ret >> 1); ++ item++; ++ } ++ bpf_reset_run_ctx(old_run_ctx); ++ rcu_read_unlock(); ++ migrate_enable(); ++ return run_ctx.retval; ++} ++ ++static __always_inline int ++bpf_prog_run_array_cg(const struct cgroup_bpf *cgrp, ++ enum cgroup_bpf_attach_type atype, ++ const void *ctx, bpf_prog_run_fn run_prog, ++ int retval) ++{ ++ const struct bpf_prog_array_item *item; ++ const struct bpf_prog *prog; ++ const struct bpf_prog_array *array; ++ struct bpf_run_ctx *old_run_ctx; ++ struct bpf_cg_run_ctx run_ctx; ++ ++ run_ctx.retval = retval; ++ migrate_disable(); ++ rcu_read_lock(); ++ array = rcu_dereference(cgrp->effective[atype]); ++ item = &array->items[0]; ++ old_run_ctx = bpf_set_run_ctx(&run_ctx.run_ctx); ++ while ((prog = READ_ONCE(item->prog))) { ++ run_ctx.prog_item = item; ++ if (!run_prog(prog, ctx) && !IS_ERR_VALUE((long)run_ctx.retval)) ++ run_ctx.retval = -EPERM; ++ item++; ++ } ++ bpf_reset_run_ctx(old_run_ctx); ++ rcu_read_unlock(); ++ migrate_enable(); ++ return run_ctx.retval; ++} ++ + void cgroup_bpf_offline(struct cgroup *cgrp) + { + cgroup_get(cgrp); +@@ -1075,11 +1141,38 @@ int __cgroup_bpf_run_filter_skb(struct sock *sk, + bpf_compute_and_save_data_end(skb, &saved_data_end); + + if (atype == CGROUP_INET_EGRESS) { +- ret = BPF_PROG_CGROUP_INET_EGRESS_RUN_ARRAY( +- cgrp->bpf.effective[atype], skb, __bpf_prog_run_save_cb); ++ u32 flags = 0; ++ bool cn; ++ ++ ret = bpf_prog_run_array_cg_flags( ++ &cgrp->bpf, atype, ++ skb, __bpf_prog_run_save_cb, 0, &flags); ++ ++ /* Return values of CGROUP EGRESS BPF programs are: ++ * 0: drop packet ++ * 1: keep packet ++ * 2: drop packet and cn ++ * 3: keep packet and cn ++ * ++ * The returned value is then converted to one of the NET_XMIT ++ * or an error code that is then interpreted as drop packet ++ * (and no cn): ++ * 0: NET_XMIT_SUCCESS skb should be transmitted ++ * 1: NET_XMIT_DROP skb should be dropped and cn ++ * 2: NET_XMIT_CN skb should be transmitted and cn ++ * 3: -err skb should be dropped ++ */ ++ ++ cn = flags & BPF_RET_SET_CN; ++ if (ret && !IS_ERR_VALUE((long)ret)) ++ ret = -EFAULT; ++ if (!ret) ++ ret = (cn ? NET_XMIT_CN : NET_XMIT_SUCCESS); ++ else ++ ret = (cn ? NET_XMIT_DROP : ret); + } else { +- ret = BPF_PROG_RUN_ARRAY_CG(cgrp->bpf.effective[atype], skb, +- __bpf_prog_run_save_cb, 0); ++ ret = bpf_prog_run_array_cg(&cgrp->bpf, atype, ++ skb, __bpf_prog_run_save_cb, 0); + if (ret && !IS_ERR_VALUE((long)ret)) + ret = -EFAULT; + } +@@ -1109,8 +1202,7 @@ int __cgroup_bpf_run_filter_sk(struct sock *sk, + { + struct cgroup *cgrp = sock_cgroup_ptr(&sk->sk_cgrp_data); + +- return BPF_PROG_RUN_ARRAY_CG(cgrp->bpf.effective[atype], sk, +- bpf_prog_run, 0); ++ return bpf_prog_run_array_cg(&cgrp->bpf, atype, sk, bpf_prog_run, 0); + } + EXPORT_SYMBOL(__cgroup_bpf_run_filter_sk); + +@@ -1155,8 +1247,8 @@ int __cgroup_bpf_run_filter_sock_addr(struct sock *sk, + } + + cgrp = sock_cgroup_ptr(&sk->sk_cgrp_data); +- return BPF_PROG_RUN_ARRAY_CG_FLAGS(cgrp->bpf.effective[atype], &ctx, +- bpf_prog_run, 0, flags); ++ return bpf_prog_run_array_cg_flags(&cgrp->bpf, atype, ++ &ctx, bpf_prog_run, 0, flags); + } + EXPORT_SYMBOL(__cgroup_bpf_run_filter_sock_addr); + +@@ -1182,8 +1274,8 @@ int __cgroup_bpf_run_filter_sock_ops(struct sock *sk, + { + struct cgroup *cgrp = sock_cgroup_ptr(&sk->sk_cgrp_data); + +- return BPF_PROG_RUN_ARRAY_CG(cgrp->bpf.effective[atype], sock_ops, +- bpf_prog_run, 0); ++ return bpf_prog_run_array_cg(&cgrp->bpf, atype, sock_ops, bpf_prog_run, ++ 0); + } + EXPORT_SYMBOL(__cgroup_bpf_run_filter_sock_ops); + +@@ -1200,8 +1292,7 @@ int __cgroup_bpf_check_dev_permission(short dev_type, u32 major, u32 minor, + + rcu_read_lock(); + cgrp = task_dfl_cgroup(current); +- ret = BPF_PROG_RUN_ARRAY_CG(cgrp->bpf.effective[atype], &ctx, +- bpf_prog_run, 0); ++ ret = bpf_prog_run_array_cg(&cgrp->bpf, atype, &ctx, bpf_prog_run, 0); + rcu_read_unlock(); + + return ret; +@@ -1366,8 +1457,7 @@ int __cgroup_bpf_run_filter_sysctl(struct ctl_table_header *head, + + rcu_read_lock(); + cgrp = task_dfl_cgroup(current); +- ret = BPF_PROG_RUN_ARRAY_CG(cgrp->bpf.effective[atype], &ctx, +- bpf_prog_run, 0); ++ ret = bpf_prog_run_array_cg(&cgrp->bpf, atype, &ctx, bpf_prog_run, 0); + rcu_read_unlock(); + + kfree(ctx.cur_val); +@@ -1459,7 +1549,7 @@ int __cgroup_bpf_run_filter_setsockopt(struct sock *sk, int *level, + } + + lock_sock(sk); +- ret = BPF_PROG_RUN_ARRAY_CG(cgrp->bpf.effective[CGROUP_SETSOCKOPT], ++ ret = bpf_prog_run_array_cg(&cgrp->bpf, CGROUP_SETSOCKOPT, + &ctx, bpf_prog_run, 0); + release_sock(sk); + +@@ -1559,7 +1649,7 @@ int __cgroup_bpf_run_filter_getsockopt(struct sock *sk, int level, + } + + lock_sock(sk); +- ret = BPF_PROG_RUN_ARRAY_CG(cgrp->bpf.effective[CGROUP_GETSOCKOPT], ++ ret = bpf_prog_run_array_cg(&cgrp->bpf, CGROUP_GETSOCKOPT, + &ctx, bpf_prog_run, retval); + release_sock(sk); + +@@ -1608,7 +1698,7 @@ int __cgroup_bpf_run_filter_getsockopt_kern(struct sock *sk, int level, + * be called if that data shouldn't be "exported". + */ + +- ret = BPF_PROG_RUN_ARRAY_CG(cgrp->bpf.effective[CGROUP_GETSOCKOPT], ++ ret = bpf_prog_run_array_cg(&cgrp->bpf, CGROUP_GETSOCKOPT, + &ctx, bpf_prog_run, retval); + if (ret < 0) + return ret; +diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c +index d8553f46caa2..6b58fc6813df 100644 +--- a/kernel/trace/bpf_trace.c ++++ b/kernel/trace/bpf_trace.c +@@ -129,7 +129,10 @@ unsigned int trace_call_bpf(struct trace_event_call *call, void *ctx) + * out of events when it was updated in between this and the + * rcu_dereference() which is accepted risk. + */ +- ret = BPF_PROG_RUN_ARRAY(call->prog_array, ctx, bpf_prog_run); ++ rcu_read_lock(); ++ ret = bpf_prog_run_array(rcu_dereference(call->prog_array), ++ ctx, bpf_prog_run); ++ rcu_read_unlock(); + + out: + __this_cpu_dec(bpf_prog_active); +-- +2.35.1 + diff --git a/queue-5.18/btrfs-fix-anon_dev-leak-in-create_subvol.patch b/queue-5.18/btrfs-fix-anon_dev-leak-in-create_subvol.patch new file mode 100644 index 00000000000..8a8527981b9 --- /dev/null +++ b/queue-5.18/btrfs-fix-anon_dev-leak-in-create_subvol.patch @@ -0,0 +1,195 @@ +From 6e8cefba0c122f9257e5ec7d1a8d072c729b357d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Mar 2022 17:31:33 -0800 +Subject: btrfs: fix anon_dev leak in create_subvol() + +From: Omar Sandoval + +[ Upstream commit 2256e901f5bddc56e24089c96f27b77da932dfcc ] + +When btrfs_qgroup_inherit(), btrfs_alloc_tree_block, or +btrfs_insert_root() fail in create_subvol(), we return without freeing +anon_dev. Reorganize the error handling in create_subvol() to fix this. + +Reviewed-by: Sweet Tea Dorminy +Signed-off-by: Omar Sandoval +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/ioctl.c | 49 +++++++++++++++++++++++------------------------- + 1 file changed, 23 insertions(+), 26 deletions(-) + +diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c +index be6c24577dbe..777801902511 100644 +--- a/fs/btrfs/ioctl.c ++++ b/fs/btrfs/ioctl.c +@@ -561,7 +561,7 @@ static noinline int create_subvol(struct user_namespace *mnt_userns, + struct timespec64 cur_time = current_time(dir); + struct inode *inode; + int ret; +- dev_t anon_dev = 0; ++ dev_t anon_dev; + u64 objectid; + u64 index = 0; + +@@ -571,11 +571,7 @@ static noinline int create_subvol(struct user_namespace *mnt_userns, + + ret = btrfs_get_free_objectid(fs_info->tree_root, &objectid); + if (ret) +- goto fail_free; +- +- ret = get_anon_bdev(&anon_dev); +- if (ret < 0) +- goto fail_free; ++ goto out_root_item; + + /* + * Don't create subvolume whose level is not zero. Or qgroup will be +@@ -583,9 +579,13 @@ static noinline int create_subvol(struct user_namespace *mnt_userns, + */ + if (btrfs_qgroup_level(objectid)) { + ret = -ENOSPC; +- goto fail_free; ++ goto out_root_item; + } + ++ ret = get_anon_bdev(&anon_dev); ++ if (ret < 0) ++ goto out_root_item; ++ + btrfs_init_block_rsv(&block_rsv, BTRFS_BLOCK_RSV_TEMP); + /* + * The same as the snapshot creation, please see the comment +@@ -593,26 +593,26 @@ static noinline int create_subvol(struct user_namespace *mnt_userns, + */ + ret = btrfs_subvolume_reserve_metadata(root, &block_rsv, 8, false); + if (ret) +- goto fail_free; ++ goto out_anon_dev; + + trans = btrfs_start_transaction(root, 0); + if (IS_ERR(trans)) { + ret = PTR_ERR(trans); + btrfs_subvolume_release_metadata(root, &block_rsv); +- goto fail_free; ++ goto out_anon_dev; + } + trans->block_rsv = &block_rsv; + trans->bytes_reserved = block_rsv.size; + + ret = btrfs_qgroup_inherit(trans, 0, objectid, inherit); + if (ret) +- goto fail; ++ goto out; + + leaf = btrfs_alloc_tree_block(trans, root, 0, objectid, NULL, 0, 0, 0, + BTRFS_NESTING_NORMAL); + if (IS_ERR(leaf)) { + ret = PTR_ERR(leaf); +- goto fail; ++ goto out; + } + + btrfs_mark_buffer_dirty(leaf); +@@ -667,7 +667,7 @@ static noinline int create_subvol(struct user_namespace *mnt_userns, + btrfs_tree_unlock(leaf); + btrfs_free_tree_block(trans, objectid, leaf, 0, 1); + free_extent_buffer(leaf); +- goto fail; ++ goto out; + } + + free_extent_buffer(leaf); +@@ -676,19 +676,18 @@ static noinline int create_subvol(struct user_namespace *mnt_userns, + key.offset = (u64)-1; + new_root = btrfs_get_new_fs_root(fs_info, objectid, anon_dev); + if (IS_ERR(new_root)) { +- free_anon_bdev(anon_dev); + ret = PTR_ERR(new_root); + btrfs_abort_transaction(trans, ret); +- goto fail; ++ goto out; + } +- /* Freeing will be done in btrfs_put_root() of new_root */ ++ /* anon_dev is owned by new_root now. */ + anon_dev = 0; + + ret = btrfs_record_root_in_trans(trans, new_root); + if (ret) { + btrfs_put_root(new_root); + btrfs_abort_transaction(trans, ret); +- goto fail; ++ goto out; + } + + ret = btrfs_create_subvol_root(trans, new_root, root, mnt_userns); +@@ -696,7 +695,7 @@ static noinline int create_subvol(struct user_namespace *mnt_userns, + if (ret) { + /* We potentially lose an unused inode item here */ + btrfs_abort_transaction(trans, ret); +- goto fail; ++ goto out; + } + + /* +@@ -705,28 +704,28 @@ static noinline int create_subvol(struct user_namespace *mnt_userns, + ret = btrfs_set_inode_index(BTRFS_I(dir), &index); + if (ret) { + btrfs_abort_transaction(trans, ret); +- goto fail; ++ goto out; + } + + ret = btrfs_insert_dir_item(trans, name, namelen, BTRFS_I(dir), &key, + BTRFS_FT_DIR, index); + if (ret) { + btrfs_abort_transaction(trans, ret); +- goto fail; ++ goto out; + } + + btrfs_i_size_write(BTRFS_I(dir), dir->i_size + namelen * 2); + ret = btrfs_update_inode(trans, root, BTRFS_I(dir)); + if (ret) { + btrfs_abort_transaction(trans, ret); +- goto fail; ++ goto out; + } + + ret = btrfs_add_root_ref(trans, objectid, root->root_key.objectid, + btrfs_ino(BTRFS_I(dir)), index, name, namelen); + if (ret) { + btrfs_abort_transaction(trans, ret); +- goto fail; ++ goto out; + } + + ret = btrfs_uuid_tree_add(trans, root_item->uuid, +@@ -734,8 +733,7 @@ static noinline int create_subvol(struct user_namespace *mnt_userns, + if (ret) + btrfs_abort_transaction(trans, ret); + +-fail: +- kfree(root_item); ++out: + trans->block_rsv = NULL; + trans->bytes_reserved = 0; + btrfs_subvolume_release_metadata(root, &block_rsv); +@@ -751,11 +749,10 @@ static noinline int create_subvol(struct user_namespace *mnt_userns, + return PTR_ERR(inode); + d_instantiate(dentry, inode); + } +- return ret; +- +-fail_free: ++out_anon_dev: + if (anon_dev) + free_anon_bdev(anon_dev); ++out_root_item: + kfree(root_item); + return ret; + } +-- +2.35.1 + diff --git a/queue-5.18/can-mcp251xfd-silence-clang-s-wunaligned-access-warn.patch b/queue-5.18/can-mcp251xfd-silence-clang-s-wunaligned-access-warn.patch new file mode 100644 index 00000000000..a23c0ae9632 --- /dev/null +++ b/queue-5.18/can-mcp251xfd-silence-clang-s-wunaligned-access-warn.patch @@ -0,0 +1,64 @@ +From 2f59759711877576e910bc8a0017957255b8a764 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 May 2022 20:43:57 +0900 +Subject: can: mcp251xfd: silence clang's -Wunaligned-access warning + +From: Vincent Mailhol + +[ Upstream commit 1a6dd9996699889313327be03981716a8337656b ] + +clang emits a -Wunaligned-access warning on union +mcp251xfd_tx_ojb_load_buf. + +The reason is that field hw_tx_obj (not declared as packed) is being +packed right after a 16 bits field inside a packed struct: + +| union mcp251xfd_tx_obj_load_buf { +| struct __packed { +| struct mcp251xfd_buf_cmd cmd; +| /* ^ 16 bits fields */ +| struct mcp251xfd_hw_tx_obj_raw hw_tx_obj; +| /* ^ not declared as packed */ +| } nocrc; +| struct __packed { +| struct mcp251xfd_buf_cmd_crc cmd; +| struct mcp251xfd_hw_tx_obj_raw hw_tx_obj; +| __be16 crc; +| } crc; +| } ____cacheline_aligned; + +Starting from LLVM 14, having an unpacked struct nested in a packed +struct triggers a warning. c.f. [1]. + +This is a false positive because the field is always being accessed +with the relevant put_unaligned_*() function. Adding __packed to the +structure declaration silences the warning. + +[1] https://github.com/llvm/llvm-project/issues/55520 + +Link: https://lore.kernel.org/all/20220518114357.55452-1-mailhol.vincent@wanadoo.fr +Signed-off-by: Vincent Mailhol +Reported-by: kernel test robot +Tested-by: Nathan Chancellor # build +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/spi/mcp251xfd/mcp251xfd.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/can/spi/mcp251xfd/mcp251xfd.h b/drivers/net/can/spi/mcp251xfd/mcp251xfd.h +index 9cb6b5ad8dda..60e56fa4601d 100644 +--- a/drivers/net/can/spi/mcp251xfd/mcp251xfd.h ++++ b/drivers/net/can/spi/mcp251xfd/mcp251xfd.h +@@ -441,7 +441,7 @@ struct mcp251xfd_hw_tef_obj { + /* The tx_obj_raw version is used in spi async, i.e. without + * regmap. We have to take care of endianness ourselves. + */ +-struct mcp251xfd_hw_tx_obj_raw { ++struct __packed mcp251xfd_hw_tx_obj_raw { + __le32 id; + __le32 flags; + u8 data[sizeof_field(struct canfd_frame, data)]; +-- +2.35.1 + diff --git a/queue-5.18/can-xilinx_can-mark-bit-timing-constants-as-const.patch b/queue-5.18/can-xilinx_can-mark-bit-timing-constants-as-const.patch new file mode 100644 index 00000000000..7764c701335 --- /dev/null +++ b/queue-5.18/can-xilinx_can-mark-bit-timing-constants-as-const.patch @@ -0,0 +1,46 @@ +From ecf8a2008693ae355fb89beafc54f6504f3eac80 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Mar 2022 21:29:07 +0100 +Subject: can: xilinx_can: mark bit timing constants as const + +From: Marc Kleine-Budde + +[ Upstream commit ae38fda02996d43d9fb09f16e81e0008704dd524 ] + +This patch marks the bit timing constants as const. + +Fixes: c223da689324 ("can: xilinx_can: Add support for CANFD FD frames") +Link: https://lore.kernel.org/all/20220317203119.792552-1-mkl@pengutronix.de +Cc: Appana Durga Kedareswara rao +Cc: Naga Sureshkumar Relli +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/xilinx_can.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/can/xilinx_can.c b/drivers/net/can/xilinx_can.c +index e562c5ab1149..43f0c6a064ba 100644 +--- a/drivers/net/can/xilinx_can.c ++++ b/drivers/net/can/xilinx_can.c +@@ -239,7 +239,7 @@ static const struct can_bittiming_const xcan_bittiming_const_canfd = { + }; + + /* AXI CANFD Data Bittiming constants as per AXI CANFD 1.0 specs */ +-static struct can_bittiming_const xcan_data_bittiming_const_canfd = { ++static const struct can_bittiming_const xcan_data_bittiming_const_canfd = { + .name = DRIVER_NAME, + .tseg1_min = 1, + .tseg1_max = 16, +@@ -265,7 +265,7 @@ static const struct can_bittiming_const xcan_bittiming_const_canfd2 = { + }; + + /* AXI CANFD 2.0 Data Bittiming constants as per AXI CANFD 2.0 spec */ +-static struct can_bittiming_const xcan_data_bittiming_const_canfd2 = { ++static const struct can_bittiming_const xcan_data_bittiming_const_canfd2 = { + .name = DRIVER_NAME, + .tseg1_min = 1, + .tseg1_max = 32, +-- +2.35.1 + diff --git a/queue-5.18/char-tpm-cr50_i2c-suppress-duplicated-error-message-.patch b/queue-5.18/char-tpm-cr50_i2c-suppress-duplicated-error-message-.patch new file mode 100644 index 00000000000..1b83b428f27 --- /dev/null +++ b/queue-5.18/char-tpm-cr50_i2c-suppress-duplicated-error-message-.patch @@ -0,0 +1,56 @@ +From b575a85d07987d360aa35f5e43c5494db3fe0398 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Apr 2022 10:06:02 +0200 +Subject: char: tpm: cr50_i2c: Suppress duplicated error message in .remove() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit e0687fe958f763f1790f22ed5483025b7624e744 ] + +Returning an error value in an i2c remove callback results in an error +message being emitted by the i2c core, but otherwise it doesn't make a +difference. The device goes away anyhow and the devm cleanups are +called. + +As tpm_cr50_i2c_remove() emits an error message already and the +additional error message by the i2c core doesn't add any useful +information, change the return value to zero to suppress this error +message. + +Note that if i2c_clientdata is NULL, there is something really fishy. +Assuming no memory corruption happened (then all bets are lost anyhow), +tpm_cr50_i2c_remove() is only called after tpm_cr50_i2c_probe() returned +successfully. So there was a tpm chip registered before and after +tpm_cr50_i2c_remove() its privdata is freed but the associated character +device isn't removed. If after that happened userspace accesses the +character device it's likely that the freed memory is accessed. For that +reason the warning message is made a bit more frightening. + +Signed-off-by: Uwe Kleine-König +Signed-off-by: Jarkko Sakkinen +Signed-off-by: Sasha Levin +--- + drivers/char/tpm/tpm_tis_i2c_cr50.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/char/tpm/tpm_tis_i2c_cr50.c b/drivers/char/tpm/tpm_tis_i2c_cr50.c +index f6c0affbb456..bf608b6af339 100644 +--- a/drivers/char/tpm/tpm_tis_i2c_cr50.c ++++ b/drivers/char/tpm/tpm_tis_i2c_cr50.c +@@ -768,8 +768,8 @@ static int tpm_cr50_i2c_remove(struct i2c_client *client) + struct device *dev = &client->dev; + + if (!chip) { +- dev_err(dev, "Could not get client data at remove\n"); +- return -ENODEV; ++ dev_crit(dev, "Could not get client data at remove, memory corruption ahead\n"); ++ return 0; + } + + tpm_chip_unregister(chip); +-- +2.35.1 + diff --git a/queue-5.18/cifs-do-not-use-tcpstatus-after-negotiate-completes.patch b/queue-5.18/cifs-do-not-use-tcpstatus-after-negotiate-completes.patch new file mode 100644 index 00000000000..a1b566fc99f --- /dev/null +++ b/queue-5.18/cifs-do-not-use-tcpstatus-after-negotiate-completes.patch @@ -0,0 +1,116 @@ +From bafce987010469cea098ccae0989d4ab4fd67f95 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Mar 2022 09:22:20 +0000 +Subject: cifs: do not use tcpStatus after negotiate completes + +From: Shyam Prasad N + +[ Upstream commit 1a6a41d4cedd9b302e2200e6f0e3c44dbbe13689 ] + +Recent changes to multichannel to allow channel reconnects to +work in parallel and independent of each other did so by +making use of tcpStatus for the connection, and status for the +session. However, this did not take into account the multiuser +scenario, where same connection is used by multiple connections. + +However, tcpStatus should be tracked only till the end of +negotiate exchange, and not used for session setup. This change +fixes this. + +Signed-off-by: Shyam Prasad N +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/cifs/connect.c | 23 +++++++++++------------ + fs/cifs/smb2pdu.c | 3 ++- + fs/cifs/smb2transport.c | 3 ++- + 3 files changed, 15 insertions(+), 14 deletions(-) + +diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c +index b28b1ff39fed..aa2d4c49e2a5 100644 +--- a/fs/cifs/connect.c ++++ b/fs/cifs/connect.c +@@ -3956,7 +3956,7 @@ cifs_negotiate_protocol(const unsigned int xid, struct cifs_ses *ses, + if (rc == 0) { + spin_lock(&cifs_tcp_ses_lock); + if (server->tcpStatus == CifsInNegotiate) +- server->tcpStatus = CifsNeedSessSetup; ++ server->tcpStatus = CifsGood; + else + rc = -EHOSTDOWN; + spin_unlock(&cifs_tcp_ses_lock); +@@ -3979,19 +3979,18 @@ cifs_setup_session(const unsigned int xid, struct cifs_ses *ses, + bool is_binding = false; + + /* only send once per connect */ ++ spin_lock(&ses->chan_lock); ++ is_binding = !CIFS_ALL_CHANS_NEED_RECONNECT(ses); ++ spin_unlock(&ses->chan_lock); ++ + spin_lock(&cifs_tcp_ses_lock); +- if ((server->tcpStatus != CifsNeedSessSetup) && +- (ses->status == CifsGood)) { ++ if (ses->status == CifsExiting) { + spin_unlock(&cifs_tcp_ses_lock); + return 0; + } +- server->tcpStatus = CifsInSessSetup; ++ ses->status = CifsInSessSetup; + spin_unlock(&cifs_tcp_ses_lock); + +- spin_lock(&ses->chan_lock); +- is_binding = !CIFS_ALL_CHANS_NEED_RECONNECT(ses); +- spin_unlock(&ses->chan_lock); +- + if (!is_binding) { + ses->capabilities = server->capabilities; + if (!linuxExtEnabled) +@@ -4015,13 +4014,13 @@ cifs_setup_session(const unsigned int xid, struct cifs_ses *ses, + if (rc) { + cifs_server_dbg(VFS, "Send error in SessSetup = %d\n", rc); + spin_lock(&cifs_tcp_ses_lock); +- if (server->tcpStatus == CifsInSessSetup) +- server->tcpStatus = CifsNeedSessSetup; ++ if (ses->status == CifsInSessSetup) ++ ses->status = CifsNeedSessSetup; + spin_unlock(&cifs_tcp_ses_lock); + } else { + spin_lock(&cifs_tcp_ses_lock); +- if (server->tcpStatus == CifsInSessSetup) +- server->tcpStatus = CifsGood; ++ if (ses->status == CifsInSessSetup) ++ ses->status = CifsGood; + /* Even if one channel is active, session is in good state */ + ses->status = CifsGood; + spin_unlock(&cifs_tcp_ses_lock); +diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c +index 1b7ad0c09566..f5321a3500f3 100644 +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -3899,7 +3899,8 @@ SMB2_echo(struct TCP_Server_Info *server) + cifs_dbg(FYI, "In echo request for conn_id %lld\n", server->conn_id); + + spin_lock(&cifs_tcp_ses_lock); +- if (server->tcpStatus == CifsNeedNegotiate) { ++ if (server->ops->need_neg && ++ server->ops->need_neg(server)) { + spin_unlock(&cifs_tcp_ses_lock); + /* No need to send echo on newly established connections */ + mod_delayed_work(cifsiod_wq, &server->reconnect, 0); +diff --git a/fs/cifs/smb2transport.c b/fs/cifs/smb2transport.c +index 2af79093b78b..01b732641edb 100644 +--- a/fs/cifs/smb2transport.c ++++ b/fs/cifs/smb2transport.c +@@ -641,7 +641,8 @@ smb2_sign_rqst(struct smb_rqst *rqst, struct TCP_Server_Info *server) + if (!is_signed) + return 0; + spin_lock(&cifs_tcp_ses_lock); +- if (server->tcpStatus == CifsNeedNegotiate) { ++ if (server->ops->need_neg && ++ server->ops->need_neg(server)) { + spin_unlock(&cifs_tcp_ses_lock); + return 0; + } +-- +2.35.1 + diff --git a/queue-5.18/cifs-return-enoent-for-dfs-lookup_cache_entry.patch b/queue-5.18/cifs-return-enoent-for-dfs-lookup_cache_entry.patch new file mode 100644 index 00000000000..5e9bf0d62d8 --- /dev/null +++ b/queue-5.18/cifs-return-enoent-for-dfs-lookup_cache_entry.patch @@ -0,0 +1,107 @@ +From 8376f3247f396fd1c4e7ea3a534dcce98c929bda Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 May 2022 11:41:05 -0300 +Subject: cifs: return ENOENT for DFS lookup_cache_entry() + +From: Enzo Matsumiya + +[ Upstream commit 337b8b0e4343567221ef8d88aac5e418208d4ac1 ] + +EEXIST didn't make sense to use when dfs_cache_find() couldn't find a +cache entry nor retrieve a referral target. + +It also doesn't make sense cifs_dfs_query_info_nonascii_quirk() to +emulate ENOENT anymore. + +Signed-off-by: Enzo Matsumiya +Reviewed-by: Paulo Alcantara (SUSE) +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/cifs/connect.c | 6 ++++-- + fs/cifs/dfs_cache.c | 6 +++--- + fs/cifs/misc.c | 6 +----- + 3 files changed, 8 insertions(+), 10 deletions(-) + +diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c +index 2a639fc79c30..b28b1ff39fed 100644 +--- a/fs/cifs/connect.c ++++ b/fs/cifs/connect.c +@@ -3406,8 +3406,9 @@ cifs_are_all_path_components_accessible(struct TCP_Server_Info *server, + } + + /* +- * Check if path is remote (e.g. a DFS share). Return -EREMOTE if it is, +- * otherwise 0. ++ * Check if path is remote (i.e. a DFS share). ++ * ++ * Return -EREMOTE if it is, otherwise 0 or -errno. + */ + static int is_path_remote(struct mount_ctx *mnt_ctx) + { +@@ -3697,6 +3698,7 @@ int cifs_mount(struct cifs_sb_info *cifs_sb, struct smb3_fs_context *ctx) + if (!isdfs) + goto out; + ++ /* proceed as DFS mount */ + uuid_gen(&mnt_ctx.mount_id); + rc = connect_dfs_root(&mnt_ctx, &tl); + dfs_cache_free_tgts(&tl); +diff --git a/fs/cifs/dfs_cache.c b/fs/cifs/dfs_cache.c +index 956f8e5cf3e7..c5dd6f7305bd 100644 +--- a/fs/cifs/dfs_cache.c ++++ b/fs/cifs/dfs_cache.c +@@ -654,7 +654,7 @@ static struct cache_entry *__lookup_cache_entry(const char *path, unsigned int h + return ce; + } + } +- return ERR_PTR(-EEXIST); ++ return ERR_PTR(-ENOENT); + } + + /* +@@ -662,7 +662,7 @@ static struct cache_entry *__lookup_cache_entry(const char *path, unsigned int h + * + * Use whole path components in the match. Must be called with htable_rw_lock held. + * +- * Return ERR_PTR(-EEXIST) if the entry is not found. ++ * Return ERR_PTR(-ENOENT) if the entry is not found. + */ + static struct cache_entry *lookup_cache_entry(const char *path) + { +@@ -710,7 +710,7 @@ static struct cache_entry *lookup_cache_entry(const char *path) + while (e > s && *e != sep) + e--; + } +- return ERR_PTR(-EEXIST); ++ return ERR_PTR(-ENOENT); + } + + /** +diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c +index 114810e563a9..5a803d686146 100644 +--- a/fs/cifs/misc.c ++++ b/fs/cifs/misc.c +@@ -1308,7 +1308,7 @@ int cifs_update_super_prepath(struct cifs_sb_info *cifs_sb, char *prefix) + * for "\\\" DFS reference, + * where contains non-ASCII unicode symbols. + * +- * Check such DFS reference and emulate -ENOENT if it is actual. ++ * Check such DFS reference. + */ + int cifs_dfs_query_info_nonascii_quirk(const unsigned int xid, + struct cifs_tcon *tcon, +@@ -1340,10 +1340,6 @@ int cifs_dfs_query_info_nonascii_quirk(const unsigned int xid, + cifs_dbg(FYI, "DFS ref '%s' is found, emulate -EREMOTE\n", + dfspath); + rc = -EREMOTE; +- } else if (rc == -EEXIST) { +- cifs_dbg(FYI, "DFS ref '%s' is not found, emulate -ENOENT\n", +- dfspath); +- rc = -ENOENT; + } else { + cifs_dbg(FYI, "%s: dfs_cache_find returned %d\n", __func__, rc); + } +-- +2.35.1 + diff --git a/queue-5.18/cpufreq-avoid-unnecessary-frequency-updates-due-to-m.patch b/queue-5.18/cpufreq-avoid-unnecessary-frequency-updates-due-to-m.patch new file mode 100644 index 00000000000..5266b16cdad --- /dev/null +++ b/queue-5.18/cpufreq-avoid-unnecessary-frequency-updates-due-to-m.patch @@ -0,0 +1,62 @@ +From 785ad955639329e8ee9f0b80d7257fe24b706d77 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 May 2022 13:51:35 +0530 +Subject: cpufreq: Avoid unnecessary frequency updates due to mismatch + +From: Viresh Kumar + +[ Upstream commit f55ae08c89873e140c7cac2a7fa161d31a0d60cf ] + +For some platforms, the frequency returned by hardware may be slightly +different from what is provided in the frequency table. For example, +hardware may return 499 MHz instead of 500 MHz. In such cases it is +better to avoid getting into unnecessary frequency updates, as we may +end up switching policy->cur between the two and sending unnecessary +pre/post update notifications, etc. + +This patch has chosen allows the hardware frequency and table frequency +to deviate by 1 MHz for now, we may want to increase it a bit later on +if someone still complains. + +Reported-by: Rex-BC Chen +Signed-off-by: Viresh Kumar +Tested-by: Jia-wei Chang +Reviewed-by: Matthias Brugger +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/cpufreq.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c +index 80f535cc8a75..fbaa8e6c7d23 100644 +--- a/drivers/cpufreq/cpufreq.c ++++ b/drivers/cpufreq/cpufreq.c +@@ -28,6 +28,7 @@ + #include + #include + #include ++#include + #include + + static LIST_HEAD(cpufreq_policy_list); +@@ -1707,6 +1708,16 @@ static unsigned int cpufreq_verify_current_freq(struct cpufreq_policy *policy, b + return new_freq; + + if (policy->cur != new_freq) { ++ /* ++ * For some platforms, the frequency returned by hardware may be ++ * slightly different from what is provided in the frequency ++ * table, for example hardware may return 499 MHz instead of 500 ++ * MHz. In such cases it is better to avoid getting into ++ * unnecessary frequency updates. ++ */ ++ if (abs(policy->cur - new_freq) < HZ_PER_MHZ) ++ return policy->cur; ++ + cpufreq_out_of_sync(policy, new_freq); + if (update) + schedule_work(&policy->update); +-- +2.35.1 + diff --git a/queue-5.18/cpufreq-fix-possible-race-in-cpufreq-online-error-pa.patch b/queue-5.18/cpufreq-fix-possible-race-in-cpufreq-online-error-pa.patch new file mode 100644 index 00000000000..a2caf9889ac --- /dev/null +++ b/queue-5.18/cpufreq-fix-possible-race-in-cpufreq-online-error-pa.patch @@ -0,0 +1,91 @@ +From 55a8eb9c22e8d383825ea77458a69b5cdf884006 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Apr 2022 03:15:41 +0800 +Subject: cpufreq: Fix possible race in cpufreq online error path + +From: Schspa Shi + +[ Upstream commit f346e96267cd76175d6c201b40f770c0116a8a04 ] + +When cpufreq online fails, the policy->cpus mask is not cleared and +policy->rwsem is released too early, so the driver can be invoked +via the cpuinfo_cur_freq sysfs attribute while its ->offline() or +->exit() callbacks are being run. + +Take policy->clk as an example: + +static int cpufreq_online(unsigned int cpu) +{ + ... + // policy->cpus != 0 at this time + down_write(&policy->rwsem); + ret = cpufreq_add_dev_interface(policy); + up_write(&policy->rwsem); + + return 0; + +out_destroy_policy: + for_each_cpu(j, policy->real_cpus) + remove_cpu_dev_symlink(policy, get_cpu_device(j)); + up_write(&policy->rwsem); +... +out_exit_policy: + if (cpufreq_driver->exit) + cpufreq_driver->exit(policy); + clk_put(policy->clk); + // policy->clk is a wild pointer +... + ^ + | + Another process access + __cpufreq_get + cpufreq_verify_current_freq + cpufreq_generic_get + // acces wild pointer of policy->clk; + | + | +out_offline_policy: | + cpufreq_policy_free(policy); | + // deleted here, and will wait for no body reference + cpufreq_policy_put_kobj(policy); +} + +Address this by modifying cpufreq_online() to release policy->rwsem +in the error path after the driver callbacks have run and to clear +policy->cpus before releasing the semaphore. + +Fixes: 7106e02baed4 ("cpufreq: release policy->rwsem on error") +Signed-off-by: Schspa Shi +[ rjw: Subject and changelog edits ] +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/cpufreq.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c +index fbaa8e6c7d23..233e8af48848 100644 +--- a/drivers/cpufreq/cpufreq.c ++++ b/drivers/cpufreq/cpufreq.c +@@ -1534,8 +1534,6 @@ static int cpufreq_online(unsigned int cpu) + for_each_cpu(j, policy->real_cpus) + remove_cpu_dev_symlink(policy, get_cpu_device(j)); + +- up_write(&policy->rwsem); +- + out_offline_policy: + if (cpufreq_driver->offline) + cpufreq_driver->offline(policy); +@@ -1544,6 +1542,9 @@ static int cpufreq_online(unsigned int cpu) + if (cpufreq_driver->exit) + cpufreq_driver->exit(policy); + ++ cpumask_clear(policy->cpus); ++ up_write(&policy->rwsem); ++ + out_free_policy: + cpufreq_policy_free(policy); + return ret; +-- +2.35.1 + diff --git a/queue-5.18/cpufreq-governor-use-kobject-release-method-to-free-.patch b/queue-5.18/cpufreq-governor-use-kobject-release-method-to-free-.patch new file mode 100644 index 00000000000..b9fe324f16c --- /dev/null +++ b/queue-5.18/cpufreq-governor-use-kobject-release-method-to-free-.patch @@ -0,0 +1,142 @@ +From ad37da4890c8bdfc0a1eece96f322c94831d4727 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 23 Jan 2022 20:45:08 +0800 +Subject: cpufreq: governor: Use kobject release() method to free dbs_data + +From: Kevin Hao + +[ Upstream commit a85ee6401a47ae3fc64ba506cacb3e7873823c65 ] + +The struct dbs_data embeds a struct gov_attr_set and +the struct gov_attr_set embeds a kobject. Since every kobject must have +a release() method and we can't use kfree() to free it directly, +so introduce cpufreq_dbs_data_release() to release the dbs_data via +the kobject::release() method. This fixes the calltrace like below: + + ODEBUG: free active (active state 0) object type: timer_list hint: delayed_work_timer_fn+0x0/0x34 + WARNING: CPU: 12 PID: 810 at lib/debugobjects.c:505 debug_print_object+0xb8/0x100 + Modules linked in: + CPU: 12 PID: 810 Comm: sh Not tainted 5.16.0-next-20220120-yocto-standard+ #536 + Hardware name: Marvell OcteonTX CN96XX board (DT) + pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) + pc : debug_print_object+0xb8/0x100 + lr : debug_print_object+0xb8/0x100 + sp : ffff80001dfcf9a0 + x29: ffff80001dfcf9a0 x28: 0000000000000001 x27: ffff0001464f0000 + x26: 0000000000000000 x25: ffff8000090e3f00 x24: ffff80000af60210 + x23: ffff8000094dfb78 x22: ffff8000090e3f00 x21: ffff0001080b7118 + x20: ffff80000aeb2430 x19: ffff800009e8f5e0 x18: 0000000000000000 + x17: 0000000000000002 x16: 00004d62e58be040 x15: 013590470523aff8 + x14: ffff8000090e1828 x13: 0000000001359047 x12: 00000000f5257d14 + x11: 0000000000040591 x10: 0000000066c1ffea x9 : ffff8000080d15e0 + x8 : ffff80000a1765a8 x7 : 0000000000000000 x6 : 0000000000000001 + x5 : ffff800009e8c000 x4 : ffff800009e8c760 x3 : 0000000000000000 + x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff0001474ed040 + Call trace: + debug_print_object+0xb8/0x100 + __debug_check_no_obj_freed+0x1d0/0x25c + debug_check_no_obj_freed+0x24/0xa0 + kfree+0x11c/0x440 + cpufreq_dbs_governor_exit+0xa8/0xac + cpufreq_exit_governor+0x44/0x90 + cpufreq_set_policy+0x29c/0x570 + store_scaling_governor+0x110/0x154 + store+0xb0/0xe0 + sysfs_kf_write+0x58/0x84 + kernfs_fop_write_iter+0x12c/0x1c0 + new_sync_write+0xf0/0x18c + vfs_write+0x1cc/0x220 + ksys_write+0x74/0x100 + __arm64_sys_write+0x28/0x3c + invoke_syscall.constprop.0+0x58/0xf0 + do_el0_svc+0x70/0x170 + el0_svc+0x54/0x190 + el0t_64_sync_handler+0xa4/0x130 + el0t_64_sync+0x1a0/0x1a4 + irq event stamp: 189006 + hardirqs last enabled at (189005): [] finish_task_switch.isra.0+0xe0/0x2c0 + hardirqs last disabled at (189006): [] el1_dbg+0x24/0xa0 + softirqs last enabled at (188966): [] __do_softirq+0x4b0/0x6a0 + softirqs last disabled at (188957): [] __irq_exit_rcu+0x108/0x1a4 + +[ rjw: Because can be freed by the gov_attr_set_put() in + cpufreq_dbs_governor_exit() now, it is also necessary to put the + invocation of the governor ->exit() callback into the new + cpufreq_dbs_data_release() function. ] + +Fixes: c4435630361d ("cpufreq: governor: New sysfs show/store callbacks for governor tunables") +Signed-off-by: Kevin Hao +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/cpufreq_governor.c | 20 +++++++++++++------- + drivers/cpufreq/cpufreq_governor.h | 1 + + 2 files changed, 14 insertions(+), 7 deletions(-) + +diff --git a/drivers/cpufreq/cpufreq_governor.c b/drivers/cpufreq/cpufreq_governor.c +index 0d42cf8b88d8..85da677c43d6 100644 +--- a/drivers/cpufreq/cpufreq_governor.c ++++ b/drivers/cpufreq/cpufreq_governor.c +@@ -388,6 +388,15 @@ static void free_policy_dbs_info(struct policy_dbs_info *policy_dbs, + gov->free(policy_dbs); + } + ++static void cpufreq_dbs_data_release(struct kobject *kobj) ++{ ++ struct dbs_data *dbs_data = to_dbs_data(to_gov_attr_set(kobj)); ++ struct dbs_governor *gov = dbs_data->gov; ++ ++ gov->exit(dbs_data); ++ kfree(dbs_data); ++} ++ + int cpufreq_dbs_governor_init(struct cpufreq_policy *policy) + { + struct dbs_governor *gov = dbs_governor_of(policy); +@@ -425,6 +434,7 @@ int cpufreq_dbs_governor_init(struct cpufreq_policy *policy) + goto free_policy_dbs_info; + } + ++ dbs_data->gov = gov; + gov_attr_set_init(&dbs_data->attr_set, &policy_dbs->list); + + ret = gov->init(dbs_data); +@@ -447,6 +457,7 @@ int cpufreq_dbs_governor_init(struct cpufreq_policy *policy) + policy->governor_data = policy_dbs; + + gov->kobj_type.sysfs_ops = &governor_sysfs_ops; ++ gov->kobj_type.release = cpufreq_dbs_data_release; + ret = kobject_init_and_add(&dbs_data->attr_set.kobj, &gov->kobj_type, + get_governor_parent_kobj(policy), + "%s", gov->gov.name); +@@ -488,13 +499,8 @@ void cpufreq_dbs_governor_exit(struct cpufreq_policy *policy) + + policy->governor_data = NULL; + +- if (!count) { +- if (!have_governor_per_policy()) +- gov->gdbs_data = NULL; +- +- gov->exit(dbs_data); +- kfree(dbs_data); +- } ++ if (!count && !have_governor_per_policy()) ++ gov->gdbs_data = NULL; + + free_policy_dbs_info(policy_dbs, gov); + +diff --git a/drivers/cpufreq/cpufreq_governor.h b/drivers/cpufreq/cpufreq_governor.h +index a5a0bc3cc23e..168c23fd7fca 100644 +--- a/drivers/cpufreq/cpufreq_governor.h ++++ b/drivers/cpufreq/cpufreq_governor.h +@@ -37,6 +37,7 @@ enum {OD_NORMAL_SAMPLE, OD_SUB_SAMPLE}; + /* Governor demand based switching data (per-policy or global). */ + struct dbs_data { + struct gov_attr_set attr_set; ++ struct dbs_governor *gov; + void *tuners; + unsigned int ignore_nice_load; + unsigned int sampling_rate; +-- +2.35.1 + diff --git a/queue-5.18/cpufreq-mediatek-unregister-platform-device-on-exit.patch b/queue-5.18/cpufreq-mediatek-unregister-platform-device-on-exit.patch new file mode 100644 index 00000000000..775a330a74a --- /dev/null +++ b/queue-5.18/cpufreq-mediatek-unregister-platform-device-on-exit.patch @@ -0,0 +1,72 @@ +From 1ef83bcb0a1f629d9163999f5c9c37dd67e014fa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 May 2022 19:52:18 +0800 +Subject: cpufreq: mediatek: Unregister platform device on exit + +From: Rex-BC Chen + +[ Upstream commit f126fbadce92b92c3a7be41e4abc1fbae93ae2ef ] + +We register the platform device when driver inits. However, we do not +unregister it when driver exits. + +To resolve this, we declare the platform data to be a global static +variable and rename it to be "cpufreq_pdev". With this global variable, +we can do platform_device_unregister() when driver exits. + +Fixes: 501c574f4e3a ("cpufreq: mediatek: Add support of cpufreq to MT2701/MT7623 SoC") +Signed-off-by: Rex-BC Chen +[ Viresh: Commit log and Subject ] +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/mediatek-cpufreq.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/drivers/cpufreq/mediatek-cpufreq.c b/drivers/cpufreq/mediatek-cpufreq.c +index 9d7d9c8dc184..bfe240c726e3 100644 +--- a/drivers/cpufreq/mediatek-cpufreq.c ++++ b/drivers/cpufreq/mediatek-cpufreq.c +@@ -44,6 +44,8 @@ struct mtk_cpu_dvfs_info { + bool need_voltage_tracking; + }; + ++static struct platform_device *cpufreq_pdev; ++ + static LIST_HEAD(dvfs_info_list); + + static struct mtk_cpu_dvfs_info *mtk_cpu_dvfs_info_lookup(int cpu) +@@ -547,7 +549,6 @@ static int __init mtk_cpufreq_driver_init(void) + { + struct device_node *np; + const struct of_device_id *match; +- struct platform_device *pdev; + int err; + + np = of_find_node_by_path("/"); +@@ -571,11 +572,11 @@ static int __init mtk_cpufreq_driver_init(void) + * and the device registration codes are put here to handle defer + * probing. + */ +- pdev = platform_device_register_simple("mtk-cpufreq", -1, NULL, 0); +- if (IS_ERR(pdev)) { ++ cpufreq_pdev = platform_device_register_simple("mtk-cpufreq", -1, NULL, 0); ++ if (IS_ERR(cpufreq_pdev)) { + pr_err("failed to register mtk-cpufreq platform device\n"); + platform_driver_unregister(&mtk_cpufreq_platdrv); +- return PTR_ERR(pdev); ++ return PTR_ERR(cpufreq_pdev); + } + + return 0; +@@ -584,6 +585,7 @@ module_init(mtk_cpufreq_driver_init) + + static void __exit mtk_cpufreq_driver_exit(void) + { ++ platform_device_unregister(cpufreq_pdev); + platform_driver_unregister(&mtk_cpufreq_platdrv); + } + module_exit(mtk_cpufreq_driver_exit) +-- +2.35.1 + diff --git a/queue-5.18/cpufreq-mediatek-use-module_init-and-add-module_exit.patch b/queue-5.18/cpufreq-mediatek-use-module_init-and-add-module_exit.patch new file mode 100644 index 00000000000..38747fab8dd --- /dev/null +++ b/queue-5.18/cpufreq-mediatek-use-module_init-and-add-module_exit.patch @@ -0,0 +1,42 @@ +From ce3eef1084370c7f07f481d0392dd567172e5149 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Apr 2022 12:58:55 +0800 +Subject: cpufreq: mediatek: Use module_init and add module_exit + +From: Jia-Wei Chang + +[ Upstream commit b7070187c81cb90549d7561c0e750d7c7eb751f4 ] + +- Use module_init instead of device_initcall. +- Add a function for module_exit to unregister driver. + +Signed-off-by: Jia-Wei Chang +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/mediatek-cpufreq.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/cpufreq/mediatek-cpufreq.c b/drivers/cpufreq/mediatek-cpufreq.c +index 866163883b48..9d7d9c8dc184 100644 +--- a/drivers/cpufreq/mediatek-cpufreq.c ++++ b/drivers/cpufreq/mediatek-cpufreq.c +@@ -580,7 +580,13 @@ static int __init mtk_cpufreq_driver_init(void) + + return 0; + } +-device_initcall(mtk_cpufreq_driver_init); ++module_init(mtk_cpufreq_driver_init) ++ ++static void __exit mtk_cpufreq_driver_exit(void) ++{ ++ platform_driver_unregister(&mtk_cpufreq_platdrv); ++} ++module_exit(mtk_cpufreq_driver_exit) + + MODULE_DESCRIPTION("MediaTek CPUFreq driver"); + MODULE_AUTHOR("Pi-Cheng Chen "); +-- +2.35.1 + diff --git a/queue-5.18/cpuidle-psci-fix-regression-leading-to-no-genpd-gove.patch b/queue-5.18/cpuidle-psci-fix-regression-leading-to-no-genpd-gove.patch new file mode 100644 index 00000000000..9ad1d8c108d --- /dev/null +++ b/queue-5.18/cpuidle-psci-fix-regression-leading-to-no-genpd-gove.patch @@ -0,0 +1,48 @@ +From d5e0a04ee60d88f62291f84fbf86e665247183fe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 14 May 2022 17:20:32 +0200 +Subject: cpuidle: psci: Fix regression leading to no genpd governor + +From: Ulf Hansson + +[ Upstream commit 34be27517cb763ea367da21e3cdee5d1bc40f47f ] + +While factoring out the PM domain related code from PSCI domain driver into +a set of library functions, a regression when initializing the genpds got +introduced. More precisely, we fail to assign a genpd governor, so let's +fix this. + +Fixes: 9d976d6721df ("cpuidle: Factor-out power domain related code from PSCI domain driver") +Signed-off-by: Ulf Hansson +Reviewed-by: Anup Patel +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/cpuidle/cpuidle-psci-domain.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/cpuidle/cpuidle-psci-domain.c b/drivers/cpuidle/cpuidle-psci-domain.c +index 755bbdfc5b82..3db4fca1172b 100644 +--- a/drivers/cpuidle/cpuidle-psci-domain.c ++++ b/drivers/cpuidle/cpuidle-psci-domain.c +@@ -52,7 +52,7 @@ static int psci_pd_init(struct device_node *np, bool use_osi) + struct generic_pm_domain *pd; + struct psci_pd_provider *pd_provider; + struct dev_power_governor *pd_gov; +- int ret = -ENOMEM, state_count = 0; ++ int ret = -ENOMEM; + + pd = dt_idle_pd_alloc(np, psci_dt_parse_state_node); + if (!pd) +@@ -71,7 +71,7 @@ static int psci_pd_init(struct device_node *np, bool use_osi) + pd->flags |= GENPD_FLAG_ALWAYS_ON; + + /* Use governor for CPU PM domains if it has some states to manage. */ +- pd_gov = state_count > 0 ? &pm_domain_cpu_gov : NULL; ++ pd_gov = pd->states ? &pm_domain_cpu_gov : NULL; + + ret = pm_genpd_init(pd, pd_gov, false); + if (ret) +-- +2.35.1 + diff --git a/queue-5.18/cpuidle-psci-improve-support-for-suspend-to-ram-for-.patch b/queue-5.18/cpuidle-psci-improve-support-for-suspend-to-ram-for-.patch new file mode 100644 index 00000000000..e23db4dc715 --- /dev/null +++ b/queue-5.18/cpuidle-psci-improve-support-for-suspend-to-ram-for-.patch @@ -0,0 +1,110 @@ +From 73d0f539771705a8da4a2d9fde6fc53647f18b94 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Apr 2022 16:11:24 +0200 +Subject: cpuidle: PSCI: Improve support for suspend-to-RAM for PSCI OSI mode + +From: Ulf Hansson + +[ Upstream commit 171b66e2e2e9d80b93c8cff799e6175074b22297 ] + +When PSCI OSI mode is supported the syscore flag is set for the CPU devices +that becomes attached to their PM domains (genpds). In the suspend-to-idle +case, we call dev_pm_genpd_suspend|resume() to allow genpd to properly +manage the power-off/on operations (pick an idlestate and manage the on/off +notifications). + +For suspend-to-ram, dev_pm_genpd_suspend|resume() is currently not being +called, which causes a problem that the genpd on/off notifiers do not get +sent as expected. This prevents the platform-specific operations from being +executed, typically needed just before/after the boot CPU is being turned +off/on. + +To deal with this problem, let's register a syscore ops for cpuidle-psci +when PSCI OSI mode is being used and call dev_pm_genpd_suspend|resume() +from them. In this way, genpd regains control of the PM domain topology and +then sends the on/off notifications when it's appropriate. + +Reported-by: Maulik Shah +Suggested-by: Maulik Shah +Signed-off-by: Ulf Hansson +Tested-by: Maulik Shah +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/cpuidle/cpuidle-psci.c | 46 ++++++++++++++++++++++++++++++++++ + 1 file changed, 46 insertions(+) + +diff --git a/drivers/cpuidle/cpuidle-psci.c b/drivers/cpuidle/cpuidle-psci.c +index b51b5df08450..540105ca0781 100644 +--- a/drivers/cpuidle/cpuidle-psci.c ++++ b/drivers/cpuidle/cpuidle-psci.c +@@ -23,6 +23,7 @@ + #include + #include + #include ++#include + + #include + +@@ -131,6 +132,49 @@ static int psci_idle_cpuhp_down(unsigned int cpu) + return 0; + } + ++static void psci_idle_syscore_switch(bool suspend) ++{ ++ bool cleared = false; ++ struct device *dev; ++ int cpu; ++ ++ for_each_possible_cpu(cpu) { ++ dev = per_cpu_ptr(&psci_cpuidle_data, cpu)->dev; ++ ++ if (dev && suspend) { ++ dev_pm_genpd_suspend(dev); ++ } else if (dev) { ++ dev_pm_genpd_resume(dev); ++ ++ /* Account for userspace having offlined a CPU. */ ++ if (pm_runtime_status_suspended(dev)) ++ pm_runtime_set_active(dev); ++ ++ /* Clear domain state to re-start fresh. */ ++ if (!cleared) { ++ psci_set_domain_state(0); ++ cleared = true; ++ } ++ } ++ } ++} ++ ++static int psci_idle_syscore_suspend(void) ++{ ++ psci_idle_syscore_switch(true); ++ return 0; ++} ++ ++static void psci_idle_syscore_resume(void) ++{ ++ psci_idle_syscore_switch(false); ++} ++ ++static struct syscore_ops psci_idle_syscore_ops = { ++ .suspend = psci_idle_syscore_suspend, ++ .resume = psci_idle_syscore_resume, ++}; ++ + static void psci_idle_init_cpuhp(void) + { + int err; +@@ -138,6 +182,8 @@ static void psci_idle_init_cpuhp(void) + if (!psci_cpuidle_use_cpuhp) + return; + ++ register_syscore_ops(&psci_idle_syscore_ops); ++ + err = cpuhp_setup_state_nocalls(CPUHP_AP_CPU_PM_STARTING, + "cpuidle/psci:online", + psci_idle_cpuhp_up, +-- +2.35.1 + diff --git a/queue-5.18/cpuidle-riscv-sbi-fix-code-to-allow-a-genpd-governor.patch b/queue-5.18/cpuidle-riscv-sbi-fix-code-to-allow-a-genpd-governor.patch new file mode 100644 index 00000000000..ebfefc83eab --- /dev/null +++ b/queue-5.18/cpuidle-riscv-sbi-fix-code-to-allow-a-genpd-governor.patch @@ -0,0 +1,48 @@ +From 2bdf8665d3c05b06955b1635215a157928b5e20b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 14 May 2022 17:20:44 +0200 +Subject: cpuidle: riscv-sbi: Fix code to allow a genpd governor to be used + +From: Ulf Hansson + +[ Upstream commit a6653fb584b5f6ac60ddd5d86ddd49a1f3945a04 ] + +The intent is to use a genpd governor when there are some states that needs +to be managed. Although, the current code ends up to never assign a +governor, let's fix this. + +Fixes: 6abf32f1d9c50 ("cpuidle: Add RISC-V SBI CPU idle driver") +Signed-off-by: Ulf Hansson +Reviewed-by: Anup Patel +Tested-by: Anup Patel +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/cpuidle/cpuidle-riscv-sbi.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/cpuidle/cpuidle-riscv-sbi.c b/drivers/cpuidle/cpuidle-riscv-sbi.c +index 5c852e671992..1151e5e2ba82 100644 +--- a/drivers/cpuidle/cpuidle-riscv-sbi.c ++++ b/drivers/cpuidle/cpuidle-riscv-sbi.c +@@ -414,7 +414,7 @@ static int sbi_pd_init(struct device_node *np) + struct generic_pm_domain *pd; + struct sbi_pd_provider *pd_provider; + struct dev_power_governor *pd_gov; +- int ret = -ENOMEM, state_count = 0; ++ int ret = -ENOMEM; + + pd = dt_idle_pd_alloc(np, sbi_dt_parse_state_node); + if (!pd) +@@ -433,7 +433,7 @@ static int sbi_pd_init(struct device_node *np) + pd->flags |= GENPD_FLAG_ALWAYS_ON; + + /* Use governor for CPU PM domains if it has some states to manage. */ +- pd_gov = state_count > 0 ? &pm_domain_cpu_gov : NULL; ++ pd_gov = pd->states ? &pm_domain_cpu_gov : NULL; + + ret = pm_genpd_init(pd, pd_gov, false); + if (ret) +-- +2.35.1 + diff --git a/queue-5.18/crypto-ccp-fix-the-init_ex-data-file-open-failure.patch b/queue-5.18/crypto-ccp-fix-the-init_ex-data-file-open-failure.patch new file mode 100644 index 00000000000..22eded676cf --- /dev/null +++ b/queue-5.18/crypto-ccp-fix-the-init_ex-data-file-open-failure.patch @@ -0,0 +1,97 @@ +From b2de3c76986cd82202ac794c5d94c3323dabae1e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Apr 2022 16:23:25 +0000 +Subject: crypto: ccp - Fix the INIT_EX data file open failure + +From: Jacky Li + +[ Upstream commit 05def5cacfa0bd5ba380116046747da07ff5bd78 ] + +There are 2 common cases when INIT_EX data file might not be +opened successfully and fail the sev initialization: + +1. In user namespaces, normal user tasks (e.g. VMM) can change their + current->fs->root to point to arbitrary directories. While + init_ex_path is provided as a module param related to root file + system. Solution: use the root directory of init_task to avoid + accessing the wrong file. + +2. Normal user tasks (e.g. VMM) don't have the privilege to access + the INIT_EX data file. Solution: open the file as root and + restore permissions immediately. + +Fixes: 3d725965f836 ("crypto: ccp - Add SEV_INIT_EX support") +Signed-off-by: Jacky Li +Reviewed-by: Peter Gonda +Acked-by: Tom Lendacky +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/ccp/sev-dev.c | 30 ++++++++++++++++++++++++++++-- + 1 file changed, 28 insertions(+), 2 deletions(-) + +diff --git a/drivers/crypto/ccp/sev-dev.c b/drivers/crypto/ccp/sev-dev.c +index 6ab93dfd478a..3aefb177715e 100644 +--- a/drivers/crypto/ccp/sev-dev.c ++++ b/drivers/crypto/ccp/sev-dev.c +@@ -23,6 +23,7 @@ + #include + #include + #include ++#include + + #include + +@@ -170,6 +171,31 @@ static void *sev_fw_alloc(unsigned long len) + return page_address(page); + } + ++static struct file *open_file_as_root(const char *filename, int flags, umode_t mode) ++{ ++ struct file *fp; ++ struct path root; ++ struct cred *cred; ++ const struct cred *old_cred; ++ ++ task_lock(&init_task); ++ get_fs_root(init_task.fs, &root); ++ task_unlock(&init_task); ++ ++ cred = prepare_creds(); ++ if (!cred) ++ return ERR_PTR(-ENOMEM); ++ cred->fsuid = GLOBAL_ROOT_UID; ++ old_cred = override_creds(cred); ++ ++ fp = file_open_root(&root, filename, flags, mode); ++ path_put(&root); ++ ++ revert_creds(old_cred); ++ ++ return fp; ++} ++ + static int sev_read_init_ex_file(void) + { + struct sev_device *sev = psp_master->sev_data; +@@ -181,7 +207,7 @@ static int sev_read_init_ex_file(void) + if (!sev_init_ex_buffer) + return -EOPNOTSUPP; + +- fp = filp_open(init_ex_path, O_RDONLY, 0); ++ fp = open_file_as_root(init_ex_path, O_RDONLY, 0); + if (IS_ERR(fp)) { + int ret = PTR_ERR(fp); + +@@ -217,7 +243,7 @@ static void sev_write_init_ex_file(void) + if (!sev_init_ex_buffer) + return; + +- fp = filp_open(init_ex_path, O_CREAT | O_WRONLY, 0600); ++ fp = open_file_as_root(init_ex_path, O_CREAT | O_WRONLY, 0600); + if (IS_ERR(fp)) { + dev_err(sev->dev, + "SEV: could not open file for write, error %ld\n", +-- +2.35.1 + diff --git a/queue-5.18/crypto-ccree-use-fine-grained-dma-mapping-dir.patch b/queue-5.18/crypto-ccree-use-fine-grained-dma-mapping-dir.patch new file mode 100644 index 00000000000..061d25994f9 --- /dev/null +++ b/queue-5.18/crypto-ccree-use-fine-grained-dma-mapping-dir.patch @@ -0,0 +1,117 @@ +From 02a2c0a80999c296bfad83b9e79232667e50a8fa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Apr 2022 11:11:39 +0300 +Subject: crypto: ccree - use fine grained DMA mapping dir + +From: Gilad Ben-Yossef + +[ Upstream commit a260436c98171cd825955a84a7f6e62bc8f4f00d ] + +Use a fine grained specification of DMA mapping directions +in certain cases, allowing both a more optimized operation +as well as shushing out a harmless, though persky +dma-debug warning. + +Signed-off-by: Gilad Ben-Yossef +Reported-by: Corentin Labbe +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/ccree/cc_buffer_mgr.c | 27 +++++++++++++++------------ + 1 file changed, 15 insertions(+), 12 deletions(-) + +diff --git a/drivers/crypto/ccree/cc_buffer_mgr.c b/drivers/crypto/ccree/cc_buffer_mgr.c +index 11e0278c8631..6140e4927322 100644 +--- a/drivers/crypto/ccree/cc_buffer_mgr.c ++++ b/drivers/crypto/ccree/cc_buffer_mgr.c +@@ -356,12 +356,14 @@ void cc_unmap_cipher_request(struct device *dev, void *ctx, + req_ctx->mlli_params.mlli_dma_addr); + } + +- dma_unmap_sg(dev, src, req_ctx->in_nents, DMA_BIDIRECTIONAL); +- dev_dbg(dev, "Unmapped req->src=%pK\n", sg_virt(src)); +- + if (src != dst) { +- dma_unmap_sg(dev, dst, req_ctx->out_nents, DMA_BIDIRECTIONAL); ++ dma_unmap_sg(dev, src, req_ctx->in_nents, DMA_TO_DEVICE); ++ dma_unmap_sg(dev, dst, req_ctx->out_nents, DMA_FROM_DEVICE); + dev_dbg(dev, "Unmapped req->dst=%pK\n", sg_virt(dst)); ++ dev_dbg(dev, "Unmapped req->src=%pK\n", sg_virt(src)); ++ } else { ++ dma_unmap_sg(dev, src, req_ctx->in_nents, DMA_BIDIRECTIONAL); ++ dev_dbg(dev, "Unmapped req->src=%pK\n", sg_virt(src)); + } + } + +@@ -377,6 +379,7 @@ int cc_map_cipher_request(struct cc_drvdata *drvdata, void *ctx, + u32 dummy = 0; + int rc = 0; + u32 mapped_nents = 0; ++ int src_direction = (src != dst ? DMA_TO_DEVICE : DMA_BIDIRECTIONAL); + + req_ctx->dma_buf_type = CC_DMA_BUF_DLLI; + mlli_params->curr_pool = NULL; +@@ -399,7 +402,7 @@ int cc_map_cipher_request(struct cc_drvdata *drvdata, void *ctx, + } + + /* Map the src SGL */ +- rc = cc_map_sg(dev, src, nbytes, DMA_BIDIRECTIONAL, &req_ctx->in_nents, ++ rc = cc_map_sg(dev, src, nbytes, src_direction, &req_ctx->in_nents, + LLI_MAX_NUM_OF_DATA_ENTRIES, &dummy, &mapped_nents); + if (rc) + goto cipher_exit; +@@ -416,7 +419,7 @@ int cc_map_cipher_request(struct cc_drvdata *drvdata, void *ctx, + } + } else { + /* Map the dst sg */ +- rc = cc_map_sg(dev, dst, nbytes, DMA_BIDIRECTIONAL, ++ rc = cc_map_sg(dev, dst, nbytes, DMA_FROM_DEVICE, + &req_ctx->out_nents, LLI_MAX_NUM_OF_DATA_ENTRIES, + &dummy, &mapped_nents); + if (rc) +@@ -456,6 +459,7 @@ void cc_unmap_aead_request(struct device *dev, struct aead_request *req) + struct aead_req_ctx *areq_ctx = aead_request_ctx(req); + unsigned int hw_iv_size = areq_ctx->hw_iv_size; + struct cc_drvdata *drvdata = dev_get_drvdata(dev); ++ int src_direction = (req->src != req->dst ? DMA_TO_DEVICE : DMA_BIDIRECTIONAL); + + if (areq_ctx->mac_buf_dma_addr) { + dma_unmap_single(dev, areq_ctx->mac_buf_dma_addr, +@@ -514,13 +518,11 @@ void cc_unmap_aead_request(struct device *dev, struct aead_request *req) + sg_virt(req->src), areq_ctx->src.nents, areq_ctx->assoc.nents, + areq_ctx->assoclen, req->cryptlen); + +- dma_unmap_sg(dev, req->src, areq_ctx->src.mapped_nents, +- DMA_BIDIRECTIONAL); ++ dma_unmap_sg(dev, req->src, areq_ctx->src.mapped_nents, src_direction); + if (req->src != req->dst) { + dev_dbg(dev, "Unmapping dst sgl: req->dst=%pK\n", + sg_virt(req->dst)); +- dma_unmap_sg(dev, req->dst, areq_ctx->dst.mapped_nents, +- DMA_BIDIRECTIONAL); ++ dma_unmap_sg(dev, req->dst, areq_ctx->dst.mapped_nents, DMA_FROM_DEVICE); + } + if (drvdata->coherent && + areq_ctx->gen_ctx.op_type == DRV_CRYPTO_DIRECTION_DECRYPT && +@@ -843,7 +845,7 @@ static int cc_aead_chain_data(struct cc_drvdata *drvdata, + else + size_for_map -= authsize; + +- rc = cc_map_sg(dev, req->dst, size_for_map, DMA_BIDIRECTIONAL, ++ rc = cc_map_sg(dev, req->dst, size_for_map, DMA_FROM_DEVICE, + &areq_ctx->dst.mapped_nents, + LLI_MAX_NUM_OF_DATA_ENTRIES, &dst_last_bytes, + &dst_mapped_nents); +@@ -1056,7 +1058,8 @@ int cc_map_aead_request(struct cc_drvdata *drvdata, struct aead_request *req) + size_to_map += authsize; + } + +- rc = cc_map_sg(dev, req->src, size_to_map, DMA_BIDIRECTIONAL, ++ rc = cc_map_sg(dev, req->src, size_to_map, ++ (req->src != req->dst ? DMA_TO_DEVICE : DMA_BIDIRECTIONAL), + &areq_ctx->src.mapped_nents, + (LLI_MAX_NUM_OF_ASSOC_DATA_ENTRIES + + LLI_MAX_NUM_OF_DATA_ENTRIES), +-- +2.35.1 + diff --git a/queue-5.18/crypto-cryptd-protect-per-cpu-resource-by-disabling-.patch b/queue-5.18/crypto-cryptd-protect-per-cpu-resource-by-disabling-.patch new file mode 100644 index 00000000000..7d082d57796 --- /dev/null +++ b/queue-5.18/crypto-cryptd-protect-per-cpu-resource-by-disabling-.patch @@ -0,0 +1,101 @@ +From cc848b6dc7fa1179d50b07270a5c0ab035995b8d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 May 2022 17:07:36 +0200 +Subject: crypto: cryptd - Protect per-CPU resource by disabling BH. + +From: Sebastian Andrzej Siewior + +[ Upstream commit 91e8bcd7b4da182e09ea19a2c73167345fe14c98 ] + +The access to cryptd_queue::cpu_queue is synchronized by disabling +preemption in cryptd_enqueue_request() and disabling BH in +cryptd_queue_worker(). This implies that access is allowed from BH. + +If cryptd_enqueue_request() is invoked from preemptible context _and_ +soft interrupt then this can lead to list corruption since +cryptd_enqueue_request() is not protected against access from +soft interrupt. + +Replace get_cpu() in cryptd_enqueue_request() with local_bh_disable() +to ensure BH is always disabled. +Remove preempt_disable() from cryptd_queue_worker() since it is not +needed because local_bh_disable() ensures synchronisation. + +Fixes: 254eff771441 ("crypto: cryptd - Per-CPU thread implementation...") +Signed-off-by: Sebastian Andrzej Siewior +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + crypto/cryptd.c | 23 +++++++++++------------ + 1 file changed, 11 insertions(+), 12 deletions(-) + +diff --git a/crypto/cryptd.c b/crypto/cryptd.c +index a1bea0f4baa8..668095eca0fa 100644 +--- a/crypto/cryptd.c ++++ b/crypto/cryptd.c +@@ -39,6 +39,10 @@ struct cryptd_cpu_queue { + }; + + struct cryptd_queue { ++ /* ++ * Protected by disabling BH to allow enqueueing from softinterrupt and ++ * dequeuing from kworker (cryptd_queue_worker()). ++ */ + struct cryptd_cpu_queue __percpu *cpu_queue; + }; + +@@ -125,28 +129,28 @@ static void cryptd_fini_queue(struct cryptd_queue *queue) + static int cryptd_enqueue_request(struct cryptd_queue *queue, + struct crypto_async_request *request) + { +- int cpu, err; ++ int err; + struct cryptd_cpu_queue *cpu_queue; + refcount_t *refcnt; + +- cpu = get_cpu(); ++ local_bh_disable(); + cpu_queue = this_cpu_ptr(queue->cpu_queue); + err = crypto_enqueue_request(&cpu_queue->queue, request); + + refcnt = crypto_tfm_ctx(request->tfm); + + if (err == -ENOSPC) +- goto out_put_cpu; ++ goto out; + +- queue_work_on(cpu, cryptd_wq, &cpu_queue->work); ++ queue_work_on(smp_processor_id(), cryptd_wq, &cpu_queue->work); + + if (!refcount_read(refcnt)) +- goto out_put_cpu; ++ goto out; + + refcount_inc(refcnt); + +-out_put_cpu: +- put_cpu(); ++out: ++ local_bh_enable(); + + return err; + } +@@ -162,15 +166,10 @@ static void cryptd_queue_worker(struct work_struct *work) + cpu_queue = container_of(work, struct cryptd_cpu_queue, work); + /* + * Only handle one request at a time to avoid hogging crypto workqueue. +- * preempt_disable/enable is used to prevent being preempted by +- * cryptd_enqueue_request(). local_bh_disable/enable is used to prevent +- * cryptd_enqueue_request() being accessed from software interrupts. + */ + local_bh_disable(); +- preempt_disable(); + backlog = crypto_get_backlog(&cpu_queue->queue); + req = crypto_dequeue_request(&cpu_queue->queue); +- preempt_enable(); + local_bh_enable(); + + if (!req) +-- +2.35.1 + diff --git a/queue-5.18/crypto-marvell-cesa-ecb-does-not-iv.patch b/queue-5.18/crypto-marvell-cesa-ecb-does-not-iv.patch new file mode 100644 index 00000000000..666ea1a9acf --- /dev/null +++ b/queue-5.18/crypto-marvell-cesa-ecb-does-not-iv.patch @@ -0,0 +1,34 @@ +From 441bc07f1899dff38f5ad922199418e57c2875c1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Apr 2022 19:11:54 +0000 +Subject: crypto: marvell/cesa - ECB does not IV + +From: Corentin Labbe + +[ Upstream commit 4ffa1763622ae5752961499588f3f8874315f974 ] + +The DES3 ECB has an IV size set but ECB does not need one. + +Fixes: 4ada483978237 ("crypto: marvell/cesa - add Triple-DES support") +Signed-off-by: Corentin Labbe +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/marvell/cesa/cipher.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/crypto/marvell/cesa/cipher.c b/drivers/crypto/marvell/cesa/cipher.c +index b739d3b873dc..c6f2fa753b7c 100644 +--- a/drivers/crypto/marvell/cesa/cipher.c ++++ b/drivers/crypto/marvell/cesa/cipher.c +@@ -624,7 +624,6 @@ struct skcipher_alg mv_cesa_ecb_des3_ede_alg = { + .decrypt = mv_cesa_ecb_des3_ede_decrypt, + .min_keysize = DES3_EDE_KEY_SIZE, + .max_keysize = DES3_EDE_KEY_SIZE, +- .ivsize = DES3_EDE_BLOCK_SIZE, + .base = { + .cra_name = "ecb(des3_ede)", + .cra_driver_name = "mv-ecb-des3-ede", +-- +2.35.1 + diff --git a/queue-5.18/crypto-qat-fix-off-by-one-error-in-pfvf-debug-print.patch b/queue-5.18/crypto-qat-fix-off-by-one-error-in-pfvf-debug-print.patch new file mode 100644 index 00000000000..b7a6658d069 --- /dev/null +++ b/queue-5.18/crypto-qat-fix-off-by-one-error-in-pfvf-debug-print.patch @@ -0,0 +1,39 @@ +From 756d776594e2fe93398e245cf82cc28c89c0d229 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Apr 2022 17:54:50 +0100 +Subject: crypto: qat - fix off-by-one error in PFVF debug print + +From: Marco Chiappero + +[ Upstream commit dd3d081b7ea6754913222ed0313fcf644edcc7e6 ] + +PFVF Block Message requests for CRC use 0-based values to indicate +amounts, which have to be remapped to 1-based values on the receiving +side. + +This patch fixes one debug print which was however using the wire value. + +Signed-off-by: Marco Chiappero +Reviewed-by: Giovanni Cabiddu +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/qat/qat_common/adf_pfvf_pf_proto.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/crypto/qat/qat_common/adf_pfvf_pf_proto.c b/drivers/crypto/qat/qat_common/adf_pfvf_pf_proto.c +index 588352de1ef0..d17318d3f63a 100644 +--- a/drivers/crypto/qat/qat_common/adf_pfvf_pf_proto.c ++++ b/drivers/crypto/qat/qat_common/adf_pfvf_pf_proto.c +@@ -154,7 +154,7 @@ static struct pfvf_message handle_blkmsg_req(struct adf_accel_vf_info *vf_info, + if (FIELD_GET(ADF_VF2PF_BLOCK_CRC_REQ_MASK, req.data)) { + dev_dbg(&GET_DEV(vf_info->accel_dev), + "BlockMsg of type %d for CRC over %d bytes received from VF%d\n", +- blk_type, blk_byte, vf_info->vf_nr); ++ blk_type, blk_byte + 1, vf_info->vf_nr); + + if (!adf_pf2vf_blkmsg_get_data(vf_info, blk_type, blk_byte, + byte_max, &resp_data, +-- +2.35.1 + diff --git a/queue-5.18/crypto-qat-set-cipher-capability-for-dh895xcc.patch b/queue-5.18/crypto-qat-set-cipher-capability-for-dh895xcc.patch new file mode 100644 index 00000000000..3c7c4a6454e --- /dev/null +++ b/queue-5.18/crypto-qat-set-cipher-capability-for-dh895xcc.patch @@ -0,0 +1,57 @@ +From dabdcf7131605adae2d84eb8775a4b03cef686ec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Apr 2022 17:54:40 +0100 +Subject: crypto: qat - set CIPHER capability for DH895XCC + +From: Giovanni Cabiddu + +[ Upstream commit 6a23804cb8bcb85c6998bf193d94d4036db26f51 ] + +Set the CIPHER capability for QAT DH895XCC devices if the hardware supports +it. This is done if both the CIPHER and the AUTHENTICATION engines are +available on the device. + +Fixes: ad1332aa67ec ("crypto: qat - add support for capability detection") +Signed-off-by: Giovanni Cabiddu +Signed-off-by: Marco Chiappero +Reviewed-by: Marco Chiappero +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + .../crypto/qat/qat_dh895xcc/adf_dh895xcc_hw_data.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/drivers/crypto/qat/qat_dh895xcc/adf_dh895xcc_hw_data.c b/drivers/crypto/qat/qat_dh895xcc/adf_dh895xcc_hw_data.c +index 1e7bed8b011f..8a526badf5bf 100644 +--- a/drivers/crypto/qat/qat_dh895xcc/adf_dh895xcc_hw_data.c ++++ b/drivers/crypto/qat/qat_dh895xcc/adf_dh895xcc_hw_data.c +@@ -60,17 +60,23 @@ static u32 get_accel_cap(struct adf_accel_dev *accel_dev) + + capabilities = ICP_ACCEL_CAPABILITIES_CRYPTO_SYMMETRIC | + ICP_ACCEL_CAPABILITIES_CRYPTO_ASYMMETRIC | +- ICP_ACCEL_CAPABILITIES_AUTHENTICATION; ++ ICP_ACCEL_CAPABILITIES_AUTHENTICATION | ++ ICP_ACCEL_CAPABILITIES_CIPHER; + + /* Read accelerator capabilities mask */ + pci_read_config_dword(pdev, ADF_DEVICE_LEGFUSE_OFFSET, &legfuses); + +- if (legfuses & ICP_ACCEL_MASK_CIPHER_SLICE) ++ /* A set bit in legfuses means the feature is OFF in this SKU */ ++ if (legfuses & ICP_ACCEL_MASK_CIPHER_SLICE) { + capabilities &= ~ICP_ACCEL_CAPABILITIES_CRYPTO_SYMMETRIC; ++ capabilities &= ~ICP_ACCEL_CAPABILITIES_CIPHER; ++ } + if (legfuses & ICP_ACCEL_MASK_PKE_SLICE) + capabilities &= ~ICP_ACCEL_CAPABILITIES_CRYPTO_ASYMMETRIC; +- if (legfuses & ICP_ACCEL_MASK_AUTH_SLICE) ++ if (legfuses & ICP_ACCEL_MASK_AUTH_SLICE) { + capabilities &= ~ICP_ACCEL_CAPABILITIES_AUTHENTICATION; ++ capabilities &= ~ICP_ACCEL_CAPABILITIES_CIPHER; ++ } + if (legfuses & ICP_ACCEL_MASK_COMPRESS_SLICE) + capabilities &= ~ICP_ACCEL_CAPABILITIES_COMPRESSION; + +-- +2.35.1 + diff --git a/queue-5.18/crypto-qat-set-compression-capability-for-dh895xcc.patch b/queue-5.18/crypto-qat-set-compression-capability-for-dh895xcc.patch new file mode 100644 index 00000000000..4d41e26f49d --- /dev/null +++ b/queue-5.18/crypto-qat-set-compression-capability-for-dh895xcc.patch @@ -0,0 +1,43 @@ +From a9ceacbb46f7b02c652c55eb8e76bfe3aff3ebd8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Apr 2022 17:54:41 +0100 +Subject: crypto: qat - set COMPRESSION capability for DH895XCC + +From: Giovanni Cabiddu + +[ Upstream commit 0eaa51543273fd0f4ba9bea83638f7033436e5eb ] + +The capability detection logic clears bits for the features that are +disabled in a certain SKU. For example, if the bit associate to +compression is not present in the LEGFUSE register, the correspondent +bit is cleared in the capability mask. +This change adds the compression capability to the mask as this was +missing in the commit that enhanced the capability detection logic. + +Fixes: cfe4894eccdc ("crypto: qat - set COMPRESSION capability for QAT GEN2") +Signed-off-by: Giovanni Cabiddu +Signed-off-by: Marco Chiappero +Reviewed-by: Marco Chiappero +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/qat/qat_dh895xcc/adf_dh895xcc_hw_data.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/crypto/qat/qat_dh895xcc/adf_dh895xcc_hw_data.c b/drivers/crypto/qat/qat_dh895xcc/adf_dh895xcc_hw_data.c +index 8a526badf5bf..91095ad479dc 100644 +--- a/drivers/crypto/qat/qat_dh895xcc/adf_dh895xcc_hw_data.c ++++ b/drivers/crypto/qat/qat_dh895xcc/adf_dh895xcc_hw_data.c +@@ -61,7 +61,8 @@ static u32 get_accel_cap(struct adf_accel_dev *accel_dev) + capabilities = ICP_ACCEL_CAPABILITIES_CRYPTO_SYMMETRIC | + ICP_ACCEL_CAPABILITIES_CRYPTO_ASYMMETRIC | + ICP_ACCEL_CAPABILITIES_AUTHENTICATION | +- ICP_ACCEL_CAPABILITIES_CIPHER; ++ ICP_ACCEL_CAPABILITIES_CIPHER | ++ ICP_ACCEL_CAPABILITIES_COMPRESSION; + + /* Read accelerator capabilities mask */ + pci_read_config_dword(pdev, ADF_DEVICE_LEGFUSE_OFFSET, &legfuses); +-- +2.35.1 + diff --git a/queue-5.18/crypto-sun8i-ss-handle-zero-sized-sg.patch b/queue-5.18/crypto-sun8i-ss-handle-zero-sized-sg.patch new file mode 100644 index 00000000000..967dfdf2949 --- /dev/null +++ b/queue-5.18/crypto-sun8i-ss-handle-zero-sized-sg.patch @@ -0,0 +1,49 @@ +From dc2b266805d46cb343f5c74928850a4e22014f16 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 May 2022 20:19:15 +0000 +Subject: crypto: sun8i-ss - handle zero sized sg + +From: Corentin Labbe + +[ Upstream commit c149e4763d28bb4c0e5daae8a59f2c74e889f407 ] + +sun8i-ss does not handle well the possible zero sized sg. + +Fixes: d9b45418a917 ("crypto: sun8i-ss - support hash algorithms") +Signed-off-by: Corentin Labbe +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/allwinner/sun8i-ss/sun8i-ss-hash.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-hash.c b/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-hash.c +index 1a71ed49d233..ca4f280af35d 100644 +--- a/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-hash.c ++++ b/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-hash.c +@@ -380,13 +380,21 @@ int sun8i_ss_hash_run(struct crypto_engine *engine, void *breq) + } + + len = areq->nbytes; +- for_each_sg(areq->src, sg, nr_sgs, i) { ++ sg = areq->src; ++ i = 0; ++ while (len > 0 && sg) { ++ if (sg_dma_len(sg) == 0) { ++ sg = sg_next(sg); ++ continue; ++ } + rctx->t_src[i].addr = sg_dma_address(sg); + todo = min(len, sg_dma_len(sg)); + rctx->t_src[i].len = todo / 4; + len -= todo; + rctx->t_dst[i].addr = addr_res; + rctx->t_dst[i].len = digestsize / 4; ++ sg = sg_next(sg); ++ i++; + } + if (len > 0) { + dev_err(ss->dev, "remaining len %d\n", len); +-- +2.35.1 + diff --git a/queue-5.18/crypto-sun8i-ss-rework-handling-of-iv.patch b/queue-5.18/crypto-sun8i-ss-rework-handling-of-iv.patch new file mode 100644 index 00000000000..4e49dd2eab3 --- /dev/null +++ b/queue-5.18/crypto-sun8i-ss-rework-handling-of-iv.patch @@ -0,0 +1,296 @@ +From 22c38ec68ed076d8c4e12448bec80aa83b1812a5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 May 2022 20:19:14 +0000 +Subject: crypto: sun8i-ss - rework handling of IV + +From: Corentin Labbe + +[ Upstream commit 359e893e8af456be2fefabe851716237df289cbf ] + +sun8i-ss fail handling IVs when doing decryption of multiple SGs in-place. +It should backup the last block of each SG source for using it later as +IVs. +In the same time remove allocation on requests path for storing all +IVs. + +Fixes: f08fcced6d00 ("crypto: allwinner - Add sun8i-ss cryptographic offloader") +Signed-off-by: Corentin Labbe +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + .../allwinner/sun8i-ss/sun8i-ss-cipher.c | 115 ++++++++++++------ + .../crypto/allwinner/sun8i-ss/sun8i-ss-core.c | 30 +++-- + drivers/crypto/allwinner/sun8i-ss/sun8i-ss.h | 14 ++- + 3 files changed, 107 insertions(+), 52 deletions(-) + +diff --git a/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-cipher.c b/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-cipher.c +index 554e400d41ca..70e2e6e37389 100644 +--- a/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-cipher.c ++++ b/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-cipher.c +@@ -93,6 +93,68 @@ static int sun8i_ss_cipher_fallback(struct skcipher_request *areq) + return err; + } + ++static int sun8i_ss_setup_ivs(struct skcipher_request *areq) ++{ ++ struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(areq); ++ struct sun8i_cipher_tfm_ctx *op = crypto_skcipher_ctx(tfm); ++ struct sun8i_ss_dev *ss = op->ss; ++ struct sun8i_cipher_req_ctx *rctx = skcipher_request_ctx(areq); ++ struct scatterlist *sg = areq->src; ++ unsigned int todo, offset; ++ unsigned int len = areq->cryptlen; ++ unsigned int ivsize = crypto_skcipher_ivsize(tfm); ++ struct sun8i_ss_flow *sf = &ss->flows[rctx->flow]; ++ int i = 0; ++ u32 a; ++ int err; ++ ++ rctx->ivlen = ivsize; ++ if (rctx->op_dir & SS_DECRYPTION) { ++ offset = areq->cryptlen - ivsize; ++ scatterwalk_map_and_copy(sf->biv, areq->src, offset, ++ ivsize, 0); ++ } ++ ++ /* we need to copy all IVs from source in case DMA is bi-directionnal */ ++ while (sg && len) { ++ if (sg_dma_len(sg) == 0) { ++ sg = sg_next(sg); ++ continue; ++ } ++ if (i == 0) ++ memcpy(sf->iv[0], areq->iv, ivsize); ++ a = dma_map_single(ss->dev, sf->iv[i], ivsize, DMA_TO_DEVICE); ++ if (dma_mapping_error(ss->dev, a)) { ++ memzero_explicit(sf->iv[i], ivsize); ++ dev_err(ss->dev, "Cannot DMA MAP IV\n"); ++ err = -EFAULT; ++ goto dma_iv_error; ++ } ++ rctx->p_iv[i] = a; ++ /* we need to setup all others IVs only in the decrypt way */ ++ if (rctx->op_dir & SS_ENCRYPTION) ++ return 0; ++ todo = min(len, sg_dma_len(sg)); ++ len -= todo; ++ i++; ++ if (i < MAX_SG) { ++ offset = sg->length - ivsize; ++ scatterwalk_map_and_copy(sf->iv[i], sg, offset, ivsize, 0); ++ } ++ rctx->niv = i; ++ sg = sg_next(sg); ++ } ++ ++ return 0; ++dma_iv_error: ++ i--; ++ while (i >= 0) { ++ dma_unmap_single(ss->dev, rctx->p_iv[i], ivsize, DMA_TO_DEVICE); ++ memzero_explicit(sf->iv[i], ivsize); ++ } ++ return err; ++} ++ + static int sun8i_ss_cipher(struct skcipher_request *areq) + { + struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(areq); +@@ -101,9 +163,9 @@ static int sun8i_ss_cipher(struct skcipher_request *areq) + struct sun8i_cipher_req_ctx *rctx = skcipher_request_ctx(areq); + struct skcipher_alg *alg = crypto_skcipher_alg(tfm); + struct sun8i_ss_alg_template *algt; ++ struct sun8i_ss_flow *sf = &ss->flows[rctx->flow]; + struct scatterlist *sg; + unsigned int todo, len, offset, ivsize; +- void *backup_iv = NULL; + int nr_sgs = 0; + int nr_sgd = 0; + int err = 0; +@@ -134,30 +196,9 @@ static int sun8i_ss_cipher(struct skcipher_request *areq) + + ivsize = crypto_skcipher_ivsize(tfm); + if (areq->iv && crypto_skcipher_ivsize(tfm) > 0) { +- rctx->ivlen = ivsize; +- rctx->biv = kzalloc(ivsize, GFP_KERNEL | GFP_DMA); +- if (!rctx->biv) { +- err = -ENOMEM; ++ err = sun8i_ss_setup_ivs(areq); ++ if (err) + goto theend_key; +- } +- if (rctx->op_dir & SS_DECRYPTION) { +- backup_iv = kzalloc(ivsize, GFP_KERNEL); +- if (!backup_iv) { +- err = -ENOMEM; +- goto theend_key; +- } +- offset = areq->cryptlen - ivsize; +- scatterwalk_map_and_copy(backup_iv, areq->src, offset, +- ivsize, 0); +- } +- memcpy(rctx->biv, areq->iv, ivsize); +- rctx->p_iv = dma_map_single(ss->dev, rctx->biv, rctx->ivlen, +- DMA_TO_DEVICE); +- if (dma_mapping_error(ss->dev, rctx->p_iv)) { +- dev_err(ss->dev, "Cannot DMA MAP IV\n"); +- err = -ENOMEM; +- goto theend_iv; +- } + } + if (areq->src == areq->dst) { + nr_sgs = dma_map_sg(ss->dev, areq->src, sg_nents(areq->src), +@@ -243,21 +284,19 @@ static int sun8i_ss_cipher(struct skcipher_request *areq) + } + + theend_iv: +- if (rctx->p_iv) +- dma_unmap_single(ss->dev, rctx->p_iv, rctx->ivlen, +- DMA_TO_DEVICE); +- + if (areq->iv && ivsize > 0) { +- if (rctx->biv) { +- offset = areq->cryptlen - ivsize; +- if (rctx->op_dir & SS_DECRYPTION) { +- memcpy(areq->iv, backup_iv, ivsize); +- kfree_sensitive(backup_iv); +- } else { +- scatterwalk_map_and_copy(areq->iv, areq->dst, offset, +- ivsize, 0); +- } +- kfree(rctx->biv); ++ for (i = 0; i < rctx->niv; i++) { ++ dma_unmap_single(ss->dev, rctx->p_iv[i], ivsize, DMA_TO_DEVICE); ++ memzero_explicit(sf->iv[i], ivsize); ++ } ++ ++ offset = areq->cryptlen - ivsize; ++ if (rctx->op_dir & SS_DECRYPTION) { ++ memcpy(areq->iv, sf->biv, ivsize); ++ memzero_explicit(sf->biv, ivsize); ++ } else { ++ scatterwalk_map_and_copy(areq->iv, areq->dst, offset, ++ ivsize, 0); + } + } + +diff --git a/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-core.c b/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-core.c +index 319fe3279a71..657530578643 100644 +--- a/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-core.c ++++ b/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-core.c +@@ -66,6 +66,7 @@ int sun8i_ss_run_task(struct sun8i_ss_dev *ss, struct sun8i_cipher_req_ctx *rctx + const char *name) + { + int flow = rctx->flow; ++ unsigned int ivlen = rctx->ivlen; + u32 v = SS_START; + int i; + +@@ -104,15 +105,14 @@ int sun8i_ss_run_task(struct sun8i_ss_dev *ss, struct sun8i_cipher_req_ctx *rctx + mutex_lock(&ss->mlock); + writel(rctx->p_key, ss->base + SS_KEY_ADR_REG); + +- if (i == 0) { +- if (rctx->p_iv) +- writel(rctx->p_iv, ss->base + SS_IV_ADR_REG); +- } else { +- if (rctx->biv) { +- if (rctx->op_dir == SS_ENCRYPTION) +- writel(rctx->t_dst[i - 1].addr + rctx->t_dst[i - 1].len * 4 - rctx->ivlen, ss->base + SS_IV_ADR_REG); ++ if (ivlen) { ++ if (rctx->op_dir == SS_ENCRYPTION) { ++ if (i == 0) ++ writel(rctx->p_iv[0], ss->base + SS_IV_ADR_REG); + else +- writel(rctx->t_src[i - 1].addr + rctx->t_src[i - 1].len * 4 - rctx->ivlen, ss->base + SS_IV_ADR_REG); ++ writel(rctx->t_dst[i - 1].addr + rctx->t_dst[i - 1].len * 4 - ivlen, ss->base + SS_IV_ADR_REG); ++ } else { ++ writel(rctx->p_iv[i], ss->base + SS_IV_ADR_REG); + } + } + +@@ -464,7 +464,7 @@ static void sun8i_ss_free_flows(struct sun8i_ss_dev *ss, int i) + */ + static int allocate_flows(struct sun8i_ss_dev *ss) + { +- int i, err; ++ int i, j, err; + + ss->flows = devm_kcalloc(ss->dev, MAXFLOW, sizeof(struct sun8i_ss_flow), + GFP_KERNEL); +@@ -474,6 +474,18 @@ static int allocate_flows(struct sun8i_ss_dev *ss) + for (i = 0; i < MAXFLOW; i++) { + init_completion(&ss->flows[i].complete); + ++ ss->flows[i].biv = devm_kmalloc(ss->dev, AES_BLOCK_SIZE, ++ GFP_KERNEL | GFP_DMA); ++ if (!ss->flows[i].biv) ++ goto error_engine; ++ ++ for (j = 0; j < MAX_SG; j++) { ++ ss->flows[i].iv[j] = devm_kmalloc(ss->dev, AES_BLOCK_SIZE, ++ GFP_KERNEL | GFP_DMA); ++ if (!ss->flows[i].iv[j]) ++ goto error_engine; ++ } ++ + ss->flows[i].engine = crypto_engine_alloc_init(ss->dev, true); + if (!ss->flows[i].engine) { + dev_err(ss->dev, "Cannot allocate engine\n"); +diff --git a/drivers/crypto/allwinner/sun8i-ss/sun8i-ss.h b/drivers/crypto/allwinner/sun8i-ss/sun8i-ss.h +index 28188685b910..57ada8653855 100644 +--- a/drivers/crypto/allwinner/sun8i-ss/sun8i-ss.h ++++ b/drivers/crypto/allwinner/sun8i-ss/sun8i-ss.h +@@ -121,11 +121,15 @@ struct sginfo { + * @complete: completion for the current task on this flow + * @status: set to 1 by interrupt if task is done + * @stat_req: number of request done by this flow ++ * @iv: list of IV to use for each step ++ * @biv: buffer which contain the backuped IV + */ + struct sun8i_ss_flow { + struct crypto_engine *engine; + struct completion complete; + int status; ++ u8 *iv[MAX_SG]; ++ u8 *biv; + #ifdef CONFIG_CRYPTO_DEV_SUN8I_SS_DEBUG + unsigned long stat_req; + #endif +@@ -164,28 +168,28 @@ struct sun8i_ss_dev { + * @t_src: list of mapped SGs with their size + * @t_dst: list of mapped SGs with their size + * @p_key: DMA address of the key +- * @p_iv: DMA address of the IV ++ * @p_iv: DMA address of the IVs ++ * @niv: Number of IVs DMA mapped + * @method: current algorithm for this request + * @op_mode: op_mode for this request + * @op_dir: direction (encrypt vs decrypt) for this request + * @flow: the flow to use for this request +- * @ivlen: size of biv ++ * @ivlen: size of IVs + * @keylen: keylen for this request +- * @biv: buffer which contain the IV + * @fallback_req: request struct for invoking the fallback skcipher TFM + */ + struct sun8i_cipher_req_ctx { + struct sginfo t_src[MAX_SG]; + struct sginfo t_dst[MAX_SG]; + u32 p_key; +- u32 p_iv; ++ u32 p_iv[MAX_SG]; ++ int niv; + u32 method; + u32 op_mode; + u32 op_dir; + int flow; + unsigned int ivlen; + unsigned int keylen; +- void *biv; + struct skcipher_request fallback_req; // keep at the end + }; + +-- +2.35.1 + diff --git a/queue-5.18/cxl-mem-drop-mem_enabled-check-from-wait_for_media.patch b/queue-5.18/cxl-mem-drop-mem_enabled-check-from-wait_for_media.patch new file mode 100644 index 00000000000..ee57a1d9d6a --- /dev/null +++ b/queue-5.18/cxl-mem-drop-mem_enabled-check-from-wait_for_media.patch @@ -0,0 +1,43 @@ +From 65132bbbe585b08cceb1f242cfc7888d47185722 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 May 2022 16:34:15 -0700 +Subject: cxl/mem: Drop mem_enabled check from wait_for_media() + +From: Dan Williams + +[ Upstream commit 2bcf3bbd348fc10260aa6243ff6a22a1882b5b35 ] + +Media ready is asserted by the device independent of whether mem_enabled +was ever set. Drop this check to allow for dropping wait_for_media() in +favor of ->wait_media_ready(). + +Fixes: 8dd2bc0f8e02 ("cxl/mem: Add the cxl_mem driver") +Reviewed-by: Ira Weiny +Reviewed-by: Jonathan Cameron +Link: https://lore.kernel.org/r/165291685501.1426646.10372821863672431074.stgit@dwillia2-xfh +Signed-off-by: Dan Williams +Signed-off-by: Sasha Levin +--- + drivers/cxl/mem.c | 4 ---- + 1 file changed, 4 deletions(-) + +diff --git a/drivers/cxl/mem.c b/drivers/cxl/mem.c +index 49a4b1c47299..44e899f06094 100644 +--- a/drivers/cxl/mem.c ++++ b/drivers/cxl/mem.c +@@ -27,12 +27,8 @@ + static int wait_for_media(struct cxl_memdev *cxlmd) + { + struct cxl_dev_state *cxlds = cxlmd->cxlds; +- struct cxl_endpoint_dvsec_info *info = &cxlds->info; + int rc; + +- if (!info->mem_enabled) +- return -EBUSY; +- + rc = cxlds->wait_media_ready(cxlds); + if (rc) + return rc; +-- +2.35.1 + diff --git a/queue-5.18/cxl-pci-add-debug-for-dvsec-range-init-failures.patch b/queue-5.18/cxl-pci-add-debug-for-dvsec-range-init-failures.patch new file mode 100644 index 00000000000..16480f59e60 --- /dev/null +++ b/queue-5.18/cxl-pci-add-debug-for-dvsec-range-init-failures.patch @@ -0,0 +1,75 @@ +From e734abaee8a1a784200618c9eaf958b7afe4464e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Mar 2022 18:22:28 -0700 +Subject: cxl/pci: Add debug for DVSEC range init failures + +From: Dan Williams + +[ Upstream commit e39f9be08d9dfe685c8a325ac1755c04f383effc ] + +In preparation for not treating DVSEC range initialization failures as +fatal to cxl_pci_probe() add individual dev_dbg() statements for each of +the major failure reasons in cxl_dvsec_ranges(). + +The rationale for cxl_dvsec_ranges() failure not being fatal is that +there is still value for cxl_pci to enable mailbox operations even if +CXL.mem operation is disabled. + +Reviewed-by: Jonathan Cameron +Reviewed-by: Ben Widawsky +Reviewed-by: Davidlohr Bueso +Link: https://lore.kernel.org/r/164730734812.3806189.2726330688692684104.stgit@dwillia2-desk3.amr.corp.intel.com +Signed-off-by: Dan Williams +Signed-off-by: Sasha Levin +--- + drivers/cxl/pci.c | 13 ++++++++++--- + 1 file changed, 10 insertions(+), 3 deletions(-) + +diff --git a/drivers/cxl/pci.c b/drivers/cxl/pci.c +index 3f2182d66829..c4941a3ca6a8 100644 +--- a/drivers/cxl/pci.c ++++ b/drivers/cxl/pci.c +@@ -466,12 +466,15 @@ static int cxl_dvsec_ranges(struct cxl_dev_state *cxlds) + { + struct cxl_endpoint_dvsec_info *info = &cxlds->info; + struct pci_dev *pdev = to_pci_dev(cxlds->dev); ++ struct device *dev = &pdev->dev; + int d = cxlds->cxl_dvsec; + int hdm_count, rc, i; + u16 cap, ctrl; + +- if (!d) ++ if (!d) { ++ dev_dbg(dev, "No DVSEC Capability\n"); + return -ENXIO; ++ } + + rc = pci_read_config_word(pdev, d + CXL_DVSEC_CAP_OFFSET, &cap); + if (rc) +@@ -481,8 +484,10 @@ static int cxl_dvsec_ranges(struct cxl_dev_state *cxlds) + if (rc) + return rc; + +- if (!(cap & CXL_DVSEC_MEM_CAPABLE)) ++ if (!(cap & CXL_DVSEC_MEM_CAPABLE)) { ++ dev_dbg(dev, "Not MEM Capable\n"); + return -ENXIO; ++ } + + /* + * It is not allowed by spec for MEM.capable to be set and have 0 legacy +@@ -495,8 +500,10 @@ static int cxl_dvsec_ranges(struct cxl_dev_state *cxlds) + return -EINVAL; + + rc = wait_for_valid(cxlds); +- if (rc) ++ if (rc) { ++ dev_dbg(dev, "Failure awaiting MEM_INFO_VALID (%d)\n", rc); + return rc; ++ } + + info->mem_enabled = FIELD_GET(CXL_DVSEC_MEM_ENABLE, ctrl); + +-- +2.35.1 + diff --git a/queue-5.18/cxl-pci-make-cxl_dvsec_ranges-failure-not-fatal-to-c.patch b/queue-5.18/cxl-pci-make-cxl_dvsec_ranges-failure-not-fatal-to-c.patch new file mode 100644 index 00000000000..7ec16b18e5a --- /dev/null +++ b/queue-5.18/cxl-pci-make-cxl_dvsec_ranges-failure-not-fatal-to-c.patch @@ -0,0 +1,94 @@ +From f788d480b43f0ed17139324d7a0b8c2032272cce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Mar 2022 18:22:38 -0700 +Subject: cxl/pci: Make cxl_dvsec_ranges() failure not fatal to cxl_pci + +From: Dan Williams + +[ Upstream commit 36bfc6ad508af38f212cf5a38147d867fb3f80a8 ] + +cxl_dvsec_ranges(), the helper for enumerating the presence of an active +legacy CXL.mem configuration on a CXL 2.0 Memory Expander, is not fatal +for cxl_pci because there is still value to enable mailbox operations +even if CXL.mem operation is disabled. Recall that the reason cxl_pci +does this initialization and not cxl_mem is to preserve the useful +property (for unit testing) that cxl_mem is cxl_memdev + mmio generic, +and does not require access to a 'struct pci_dev' to issue config +cycles. + +Update 'struct cxl_endpoint_dvsec_info' to carry either a positive +number of non-zero size legacy CXL DVSEC ranges, or the negative error +code from __cxl_dvsec_ranges() in its @ranges member. + +Reported-by: Krzysztof Zach +Fixes: 560f78559006 ("cxl/pci: Retrieve CXL DVSEC memory info") +Reviewed-by: Jonathan Cameron +Reviewed-by: Davidlohr Bueso +Link: https://lore.kernel.org/r/164730735869.3806189.4032428192652531946.stgit@dwillia2-desk3.amr.corp.intel.com +Signed-off-by: Dan Williams +Signed-off-by: Sasha Levin +--- + drivers/cxl/pci.c | 27 ++++++++++++++++++--------- + 1 file changed, 18 insertions(+), 9 deletions(-) + +diff --git a/drivers/cxl/pci.c b/drivers/cxl/pci.c +index c4941a3ca6a8..bb92853c3b93 100644 +--- a/drivers/cxl/pci.c ++++ b/drivers/cxl/pci.c +@@ -462,13 +462,18 @@ static int wait_for_media_ready(struct cxl_dev_state *cxlds) + return 0; + } + +-static int cxl_dvsec_ranges(struct cxl_dev_state *cxlds) ++/* ++ * Return positive number of non-zero ranges on success and a negative ++ * error code on failure. The cxl_mem driver depends on ranges == 0 to ++ * init HDM operation. ++ */ ++static int __cxl_dvsec_ranges(struct cxl_dev_state *cxlds, ++ struct cxl_endpoint_dvsec_info *info) + { +- struct cxl_endpoint_dvsec_info *info = &cxlds->info; + struct pci_dev *pdev = to_pci_dev(cxlds->dev); ++ int hdm_count, rc, i, ranges = 0; + struct device *dev = &pdev->dev; + int d = cxlds->cxl_dvsec; +- int hdm_count, rc, i; + u16 cap, ctrl; + + if (!d) { +@@ -545,10 +550,17 @@ static int cxl_dvsec_ranges(struct cxl_dev_state *cxlds) + }; + + if (size) +- info->ranges++; ++ ranges++; + } + +- return 0; ++ return ranges; ++} ++ ++static void cxl_dvsec_ranges(struct cxl_dev_state *cxlds) ++{ ++ struct cxl_endpoint_dvsec_info *info = &cxlds->info; ++ ++ info->ranges = __cxl_dvsec_ranges(cxlds, info); + } + + static int cxl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) +@@ -617,10 +629,7 @@ static int cxl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) + if (rc) + return rc; + +- rc = cxl_dvsec_ranges(cxlds); +- if (rc) +- dev_warn(&pdev->dev, +- "Failed to get DVSEC range information (%d)\n", rc); ++ cxl_dvsec_ranges(cxlds); + + cxlmd = devm_cxl_add_memdev(cxlds); + if (IS_ERR(cxlmd)) +-- +2.35.1 + diff --git a/queue-5.18/dax-fix-cache-flush-on-pmd-mapped-pages.patch b/queue-5.18/dax-fix-cache-flush-on-pmd-mapped-pages.patch new file mode 100644 index 00000000000..e7d9d86d84f --- /dev/null +++ b/queue-5.18/dax-fix-cache-flush-on-pmd-mapped-pages.patch @@ -0,0 +1,58 @@ +From 86f4afadb70c0f6f5741a54265103f0cb6fc5ee2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Apr 2022 23:16:09 -0700 +Subject: dax: fix cache flush on PMD-mapped pages + +From: Muchun Song + +[ Upstream commit e583b5c472bd23d450e06f148dc1f37be74f7666 ] + +The flush_cache_page() only remove a PAGE_SIZE sized range from the cache. +However, it does not cover the full pages in a THP except a head page. +Replace it with flush_cache_range() to fix this issue. This is just a +documentation issue with the respect to properly documenting the expected +usage of cache flushing before modifying the pmd. However, in practice +this is not a problem due to the fact that DAX is not available on +architectures with virtually indexed caches per: + + commit d92576f1167c ("dax: does not work correctly with virtual aliasing caches") + +Link: https://lkml.kernel.org/r/20220403053957.10770-3-songmuchun@bytedance.com +Fixes: f729c8c9b24f ("dax: wrprotect pmd_t in dax_mapping_entry_mkclean") +Signed-off-by: Muchun Song +Reviewed-by: Dan Williams +Reviewed-by: Christoph Hellwig +Cc: Alistair Popple +Cc: Al Viro +Cc: Hugh Dickins +Cc: Jan Kara +Cc: "Kirill A. Shutemov" +Cc: Matthew Wilcox +Cc: Ralph Campbell +Cc: Ross Zwisler +Cc: Xiongchun Duan +Cc: Xiyu Yang +Cc: Yang Shi +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + fs/dax.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/fs/dax.c b/fs/dax.c +index 67a08a32fccb..a372304c9695 100644 +--- a/fs/dax.c ++++ b/fs/dax.c +@@ -845,7 +845,8 @@ static void dax_entry_mkclean(struct address_space *mapping, pgoff_t index, + if (!pmd_dirty(*pmdp) && !pmd_write(*pmdp)) + goto unlock_pmd; + +- flush_cache_page(vma, address, pfn); ++ flush_cache_range(vma, address, ++ address + HPAGE_PMD_SIZE); + pmd = pmdp_invalidate(vma, address, pmdp); + pmd = pmd_wrprotect(pmd); + pmd = pmd_mkclean(pmd); +-- +2.35.1 + diff --git a/queue-5.18/device-property-allow-error-pointer-to-be-passed-to-.patch b/queue-5.18/device-property-allow-error-pointer-to-be-passed-to-.patch new file mode 100644 index 00000000000..e03650ac4be --- /dev/null +++ b/queue-5.18/device-property-allow-error-pointer-to-be-passed-to-.patch @@ -0,0 +1,261 @@ +From 869ff1f4464a02811eb915e026e5956b4c16e47a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Apr 2022 21:48:40 +0300 +Subject: device property: Allow error pointer to be passed to fwnode APIs +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Andy Shevchenko + +[ Upstream commit 002752af7b89b74c64fe6bec8c5fde3d3a7810d8 ] + +Some of the fwnode APIs might return an error pointer instead of NULL +or valid fwnode handle. The result of such API call may be considered +optional and hence the test for it is usually done in a form of + + fwnode = fwnode_find_reference(...); + if (IS_ERR(fwnode)) + ...error handling... + +Nevertheless the resulting fwnode may have bumped the reference count +and hence caller of the above API is obliged to call fwnode_handle_put(). +Since fwnode may be not valid either as NULL or error pointer the check +has to be performed there. This approach uglifies the code and adds +a point of making a mistake, i.e. forgetting about error point case. + +To prevent this, allow an error pointer to be passed to the fwnode APIs. + +Fixes: 83b34afb6b79 ("device property: Introduce fwnode_find_reference()") +Reported-by: Nuno Sá +Tested-by: Nuno Sá +Acked-by: Nuno Sá +Reviewed-by: Sakari Ailus +Reviewed-by: Heikki Krogerus +Signed-off-by: Andy Shevchenko +Tested-by: Michael Walle +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/base/property.c | 89 +++++++++++++++++++++++------------------ + include/linux/fwnode.h | 10 ++--- + 2 files changed, 56 insertions(+), 43 deletions(-) + +diff --git a/drivers/base/property.c b/drivers/base/property.c +index c0e94cce9c29..2f6843c9612b 100644 +--- a/drivers/base/property.c ++++ b/drivers/base/property.c +@@ -47,12 +47,14 @@ bool fwnode_property_present(const struct fwnode_handle *fwnode, + { + bool ret; + ++ if (IS_ERR_OR_NULL(fwnode)) ++ return false; ++ + ret = fwnode_call_bool_op(fwnode, property_present, propname); +- if (ret == false && !IS_ERR_OR_NULL(fwnode) && +- !IS_ERR_OR_NULL(fwnode->secondary)) +- ret = fwnode_call_bool_op(fwnode->secondary, property_present, +- propname); +- return ret; ++ if (ret) ++ return ret; ++ ++ return fwnode_call_bool_op(fwnode->secondary, property_present, propname); + } + EXPORT_SYMBOL_GPL(fwnode_property_present); + +@@ -232,15 +234,16 @@ static int fwnode_property_read_int_array(const struct fwnode_handle *fwnode, + { + int ret; + ++ if (IS_ERR_OR_NULL(fwnode)) ++ return -EINVAL; ++ + ret = fwnode_call_int_op(fwnode, property_read_int_array, propname, + elem_size, val, nval); +- if (ret == -EINVAL && !IS_ERR_OR_NULL(fwnode) && +- !IS_ERR_OR_NULL(fwnode->secondary)) +- ret = fwnode_call_int_op( +- fwnode->secondary, property_read_int_array, propname, +- elem_size, val, nval); ++ if (ret != -EINVAL) ++ return ret; + +- return ret; ++ return fwnode_call_int_op(fwnode->secondary, property_read_int_array, propname, ++ elem_size, val, nval); + } + + /** +@@ -371,14 +374,16 @@ int fwnode_property_read_string_array(const struct fwnode_handle *fwnode, + { + int ret; + ++ if (IS_ERR_OR_NULL(fwnode)) ++ return -EINVAL; ++ + ret = fwnode_call_int_op(fwnode, property_read_string_array, propname, + val, nval); +- if (ret == -EINVAL && !IS_ERR_OR_NULL(fwnode) && +- !IS_ERR_OR_NULL(fwnode->secondary)) +- ret = fwnode_call_int_op(fwnode->secondary, +- property_read_string_array, propname, +- val, nval); +- return ret; ++ if (ret != -EINVAL) ++ return ret; ++ ++ return fwnode_call_int_op(fwnode->secondary, property_read_string_array, propname, ++ val, nval); + } + EXPORT_SYMBOL_GPL(fwnode_property_read_string_array); + +@@ -480,15 +485,19 @@ int fwnode_property_get_reference_args(const struct fwnode_handle *fwnode, + { + int ret; + ++ if (IS_ERR_OR_NULL(fwnode)) ++ return -ENOENT; ++ + ret = fwnode_call_int_op(fwnode, get_reference_args, prop, nargs_prop, + nargs, index, args); ++ if (ret == 0) ++ return ret; + +- if (ret < 0 && !IS_ERR_OR_NULL(fwnode) && +- !IS_ERR_OR_NULL(fwnode->secondary)) +- ret = fwnode_call_int_op(fwnode->secondary, get_reference_args, +- prop, nargs_prop, nargs, index, args); ++ if (IS_ERR_OR_NULL(fwnode->secondary)) ++ return ret; + +- return ret; ++ return fwnode_call_int_op(fwnode->secondary, get_reference_args, prop, nargs_prop, ++ nargs, index, args); + } + EXPORT_SYMBOL_GPL(fwnode_property_get_reference_args); + +@@ -635,12 +644,13 @@ EXPORT_SYMBOL_GPL(fwnode_count_parents); + struct fwnode_handle *fwnode_get_nth_parent(struct fwnode_handle *fwnode, + unsigned int depth) + { +- unsigned int i; +- + fwnode_handle_get(fwnode); + +- for (i = 0; i < depth && fwnode; i++) ++ do { ++ if (depth-- == 0) ++ break; + fwnode = fwnode_get_next_parent(fwnode); ++ } while (fwnode); + + return fwnode; + } +@@ -659,17 +669,17 @@ EXPORT_SYMBOL_GPL(fwnode_get_nth_parent); + bool fwnode_is_ancestor_of(struct fwnode_handle *test_ancestor, + struct fwnode_handle *test_child) + { +- if (!test_ancestor) ++ if (IS_ERR_OR_NULL(test_ancestor)) + return false; + + fwnode_handle_get(test_child); +- while (test_child) { ++ do { + if (test_child == test_ancestor) { + fwnode_handle_put(test_child); + return true; + } + test_child = fwnode_get_next_parent(test_child); +- } ++ } while (test_child); + return false; + } + +@@ -698,7 +708,7 @@ fwnode_get_next_available_child_node(const struct fwnode_handle *fwnode, + { + struct fwnode_handle *next_child = child; + +- if (!fwnode) ++ if (IS_ERR_OR_NULL(fwnode)) + return NULL; + + do { +@@ -722,16 +732,16 @@ struct fwnode_handle *device_get_next_child_node(struct device *dev, + const struct fwnode_handle *fwnode = dev_fwnode(dev); + struct fwnode_handle *next; + ++ if (IS_ERR_OR_NULL(fwnode)) ++ return NULL; ++ + /* Try to find a child in primary fwnode */ + next = fwnode_get_next_child_node(fwnode, child); + if (next) + return next; + + /* When no more children in primary, continue with secondary */ +- if (fwnode && !IS_ERR_OR_NULL(fwnode->secondary)) +- next = fwnode_get_next_child_node(fwnode->secondary, child); +- +- return next; ++ return fwnode_get_next_child_node(fwnode->secondary, child); + } + EXPORT_SYMBOL_GPL(device_get_next_child_node); + +@@ -798,6 +808,9 @@ EXPORT_SYMBOL_GPL(fwnode_handle_put); + */ + bool fwnode_device_is_available(const struct fwnode_handle *fwnode) + { ++ if (IS_ERR_OR_NULL(fwnode)) ++ return false; ++ + if (!fwnode_has_op(fwnode, device_is_available)) + return true; + +@@ -988,14 +1001,14 @@ fwnode_graph_get_next_endpoint(const struct fwnode_handle *fwnode, + parent = fwnode_graph_get_port_parent(prev); + else + parent = fwnode; ++ if (IS_ERR_OR_NULL(parent)) ++ return NULL; + + ep = fwnode_call_ptr_op(parent, graph_get_next_endpoint, prev); ++ if (ep) ++ return ep; + +- if (IS_ERR_OR_NULL(ep) && +- !IS_ERR_OR_NULL(parent) && !IS_ERR_OR_NULL(parent->secondary)) +- ep = fwnode_graph_get_next_endpoint(parent->secondary, NULL); +- +- return ep; ++ return fwnode_graph_get_next_endpoint(parent->secondary, NULL); + } + EXPORT_SYMBOL_GPL(fwnode_graph_get_next_endpoint); + +diff --git a/include/linux/fwnode.h b/include/linux/fwnode.h +index 3a532ba66f6c..7defac04f9a3 100644 +--- a/include/linux/fwnode.h ++++ b/include/linux/fwnode.h +@@ -148,12 +148,12 @@ struct fwnode_operations { + int (*add_links)(struct fwnode_handle *fwnode); + }; + +-#define fwnode_has_op(fwnode, op) \ +- ((fwnode) && (fwnode)->ops && (fwnode)->ops->op) ++#define fwnode_has_op(fwnode, op) \ ++ (!IS_ERR_OR_NULL(fwnode) && (fwnode)->ops && (fwnode)->ops->op) ++ + #define fwnode_call_int_op(fwnode, op, ...) \ +- (fwnode ? (fwnode_has_op(fwnode, op) ? \ +- (fwnode)->ops->op(fwnode, ## __VA_ARGS__) : -ENXIO) : \ +- -EINVAL) ++ (fwnode_has_op(fwnode, op) ? \ ++ (fwnode)->ops->op(fwnode, ## __VA_ARGS__) : (IS_ERR_OR_NULL(fwnode) ? -EINVAL : -ENXIO)) + + #define fwnode_call_bool_op(fwnode, op, ...) \ + (fwnode_has_op(fwnode, op) ? \ +-- +2.35.1 + diff --git a/queue-5.18/dma-debug-change-allocation-mode-from-gfp_nowait-to-.patch b/queue-5.18/dma-debug-change-allocation-mode-from-gfp_nowait-to-.patch new file mode 100644 index 00000000000..0dd144210d0 --- /dev/null +++ b/queue-5.18/dma-debug-change-allocation-mode-from-gfp_nowait-to-.patch @@ -0,0 +1,41 @@ +From 42c659e4688ec7f226fc9a1b1acc6bb2f916e5dc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 May 2022 13:17:32 -0400 +Subject: dma-debug: change allocation mode from GFP_NOWAIT to GFP_ATIOMIC + +From: Mikulas Patocka + +[ Upstream commit 84bc4f1dbbbb5f8aa68706a96711dccb28b518e5 ] + +We observed the error "cacheline tracking ENOMEM, dma-debug disabled" +during a light system load (copying some files). The reason for this error +is that the dma_active_cacheline radix tree uses GFP_NOWAIT allocation - +so it can't access the emergency memory reserves and it fails as soon as +anybody reaches the watermark. + +This patch changes GFP_NOWAIT to GFP_ATOMIC, so that it can access the +emergency memory reserves. + +Signed-off-by: Mikulas Patocka +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + kernel/dma/debug.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/dma/debug.c b/kernel/dma/debug.c +index f8ff598596b8..ac740630c79c 100644 +--- a/kernel/dma/debug.c ++++ b/kernel/dma/debug.c +@@ -448,7 +448,7 @@ void debug_dma_dump_mappings(struct device *dev) + * other hand, consumes a single dma_debug_entry, but inserts 'nents' + * entries into the tree. + */ +-static RADIX_TREE(dma_active_cacheline, GFP_NOWAIT); ++static RADIX_TREE(dma_active_cacheline, GFP_ATOMIC); + static DEFINE_SPINLOCK(radix_lock); + #define ACTIVE_CACHELINE_MAX_OVERLAP ((1 << RADIX_TREE_MAX_TAGS) - 1) + #define CACHELINE_PER_PAGE_SHIFT (PAGE_SHIFT - L1_CACHE_SHIFT) +-- +2.35.1 + diff --git a/queue-5.18/dma-direct-don-t-fail-on-highmem-cma-pages-in-dma_di.patch b/queue-5.18/dma-direct-don-t-fail-on-highmem-cma-pages-in-dma_di.patch new file mode 100644 index 00000000000..3e3c6af6370 --- /dev/null +++ b/queue-5.18/dma-direct-don-t-fail-on-highmem-cma-pages-in-dma_di.patch @@ -0,0 +1,93 @@ +From e345cc2ffc6fbca47c6a3afcd66eeb36af531563 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 23 Apr 2022 19:20:24 +0200 +Subject: dma-direct: don't fail on highmem CMA pages in dma_direct_alloc_pages + +From: Christoph Hellwig + +[ Upstream commit 92826e967535db2eb117db227b1191aaf98e4bb3 ] + +When dma_direct_alloc_pages encounters a highmem page it just gives up +currently. But what we really should do is to try memory using the +page allocator instead - without this platforms with a global highmem +CMA pool will fail all dma_alloc_pages allocations. + +Fixes: efa70f2fdc84 ("dma-mapping: add a new dma_alloc_pages API") +Reported-by: Mark O'Neill +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + kernel/dma/direct.c | 27 ++++++++++----------------- + 1 file changed, 10 insertions(+), 17 deletions(-) + +diff --git a/kernel/dma/direct.c b/kernel/dma/direct.c +index 9743c6ccce1a..3e7f4aab740e 100644 +--- a/kernel/dma/direct.c ++++ b/kernel/dma/direct.c +@@ -115,7 +115,7 @@ static struct page *dma_direct_alloc_swiotlb(struct device *dev, size_t size) + } + + static struct page *__dma_direct_alloc_pages(struct device *dev, size_t size, +- gfp_t gfp) ++ gfp_t gfp, bool allow_highmem) + { + int node = dev_to_node(dev); + struct page *page = NULL; +@@ -129,9 +129,12 @@ static struct page *__dma_direct_alloc_pages(struct device *dev, size_t size, + gfp |= dma_direct_optimal_gfp_mask(dev, dev->coherent_dma_mask, + &phys_limit); + page = dma_alloc_contiguous(dev, size, gfp); +- if (page && !dma_coherent_ok(dev, page_to_phys(page), size)) { +- dma_free_contiguous(dev, page, size); +- page = NULL; ++ if (page) { ++ if (!dma_coherent_ok(dev, page_to_phys(page), size) || ++ (!allow_highmem && PageHighMem(page))) { ++ dma_free_contiguous(dev, page, size); ++ page = NULL; ++ } + } + again: + if (!page) +@@ -189,7 +192,7 @@ static void *dma_direct_alloc_no_mapping(struct device *dev, size_t size, + { + struct page *page; + +- page = __dma_direct_alloc_pages(dev, size, gfp & ~__GFP_ZERO); ++ page = __dma_direct_alloc_pages(dev, size, gfp & ~__GFP_ZERO, true); + if (!page) + return NULL; + +@@ -262,7 +265,7 @@ void *dma_direct_alloc(struct device *dev, size_t size, + return dma_direct_alloc_from_pool(dev, size, dma_handle, gfp); + + /* we always manually zero the memory once we are done */ +- page = __dma_direct_alloc_pages(dev, size, gfp & ~__GFP_ZERO); ++ page = __dma_direct_alloc_pages(dev, size, gfp & ~__GFP_ZERO, true); + if (!page) + return NULL; + +@@ -370,19 +373,9 @@ struct page *dma_direct_alloc_pages(struct device *dev, size_t size, + if (force_dma_unencrypted(dev) && dma_direct_use_pool(dev, gfp)) + return dma_direct_alloc_from_pool(dev, size, dma_handle, gfp); + +- page = __dma_direct_alloc_pages(dev, size, gfp); ++ page = __dma_direct_alloc_pages(dev, size, gfp, false); + if (!page) + return NULL; +- if (PageHighMem(page)) { +- /* +- * Depending on the cma= arguments and per-arch setup +- * dma_alloc_contiguous could return highmem pages. +- * Without remapping there is no way to return them here, +- * so log an error and fail. +- */ +- dev_info(dev, "Rejecting highmem page from CMA.\n"); +- goto out_free_pages; +- } + + ret = page_address(page); + if (dma_set_decrypted(dev, ret, size)) +-- +2.35.1 + diff --git a/queue-5.18/dma-direct-don-t-over-decrypt-memory.patch b/queue-5.18/dma-direct-don-t-over-decrypt-memory.patch new file mode 100644 index 00000000000..6cee07ac610 --- /dev/null +++ b/queue-5.18/dma-direct-don-t-over-decrypt-memory.patch @@ -0,0 +1,56 @@ +From 9c9f86a0512322af381e2180f5a81a1ec4ea9127 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 May 2022 18:10:13 +0100 +Subject: dma-direct: don't over-decrypt memory + +From: Robin Murphy + +[ Upstream commit 4a37f3dd9a83186cb88d44808ab35b78375082c9 ] + +The original x86 sev_alloc() only called set_memory_decrypted() on +memory returned by alloc_pages_node(), so the page order calculation +fell out of that logic. However, the common dma-direct code has several +potential allocators, not all of which are guaranteed to round up the +underlying allocation to a power-of-two size, so carrying over that +calculation for the encryption/decryption size was a mistake. Fix it by +rounding to a *number* of pages, rather than an order. + +Until recently there was an even worse interaction with DMA_DIRECT_REMAP +where we could have ended up decrypting part of the next adjacent +vmalloc area, only averted by no architecture actually supporting both +configs at once. Don't ask how I found that one out... + +Fixes: c10f07aa27da ("dma/direct: Handle force decryption for DMA coherent buffers in common code") +Signed-off-by: Robin Murphy +Signed-off-by: Christoph Hellwig +Acked-by: David Rientjes +Signed-off-by: Sasha Levin +--- + kernel/dma/direct.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/kernel/dma/direct.c b/kernel/dma/direct.c +index 3e7f4aab740e..e978f36e6be8 100644 +--- a/kernel/dma/direct.c ++++ b/kernel/dma/direct.c +@@ -79,7 +79,7 @@ static int dma_set_decrypted(struct device *dev, void *vaddr, size_t size) + { + if (!force_dma_unencrypted(dev)) + return 0; +- return set_memory_decrypted((unsigned long)vaddr, 1 << get_order(size)); ++ return set_memory_decrypted((unsigned long)vaddr, PFN_UP(size)); + } + + static int dma_set_encrypted(struct device *dev, void *vaddr, size_t size) +@@ -88,7 +88,7 @@ static int dma_set_encrypted(struct device *dev, void *vaddr, size_t size) + + if (!force_dma_unencrypted(dev)) + return 0; +- ret = set_memory_encrypted((unsigned long)vaddr, 1 << get_order(size)); ++ ret = set_memory_encrypted((unsigned long)vaddr, PFN_UP(size)); + if (ret) + pr_warn_ratelimited("leaking DMA memory that can't be re-encrypted\n"); + return ret; +-- +2.35.1 + diff --git a/queue-5.18/dmaengine-idxd-fix-the-error-handling-path-in-idxd_c.patch b/queue-5.18/dmaengine-idxd-fix-the-error-handling-path-in-idxd_c.patch new file mode 100644 index 00000000000..bb28c2c74e0 --- /dev/null +++ b/queue-5.18/dmaengine-idxd-fix-the-error-handling-path-in-idxd_c.patch @@ -0,0 +1,49 @@ +From ba5a03890e8d1c3c5518a2d25ea8f299bc59a4e5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Apr 2022 08:13:38 +0200 +Subject: dmaengine: idxd: Fix the error handling path in idxd_cdev_register() + +From: Christophe JAILLET + +[ Upstream commit aab08c1aac01097815fbcf10fce7021d2396a31f ] + +If a call to alloc_chrdev_region() fails, the already allocated resources +are leaking. + +Add the needed error handling path to fix the leak. + +Fixes: 42d279f9137a ("dmaengine: idxd: add char driver to expose submission portal to userland") +Signed-off-by: Christophe JAILLET +Acked-by: Dave Jiang +Link: https://lore.kernel.org/r/1b5033dcc87b5f2a953c413f0306e883e6114542.1650521591.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/idxd/cdev.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/dma/idxd/cdev.c b/drivers/dma/idxd/cdev.c +index b9b2b4a4124e..033df43db0ce 100644 +--- a/drivers/dma/idxd/cdev.c ++++ b/drivers/dma/idxd/cdev.c +@@ -369,10 +369,16 @@ int idxd_cdev_register(void) + rc = alloc_chrdev_region(&ictx[i].devt, 0, MINORMASK, + ictx[i].name); + if (rc) +- return rc; ++ goto err_free_chrdev_region; + } + + return 0; ++ ++err_free_chrdev_region: ++ for (i--; i >= 0; i--) ++ unregister_chrdev_region(ictx[i].devt, MINORMASK); ++ ++ return rc; + } + + void idxd_cdev_remove(void) +-- +2.35.1 + diff --git a/queue-5.18/dmaengine-stm32-mdma-fix-chan-initialization-in-stm3.patch b/queue-5.18/dmaengine-stm32-mdma-fix-chan-initialization-in-stm3.patch new file mode 100644 index 00000000000..de876754e5f --- /dev/null +++ b/queue-5.18/dmaengine-stm32-mdma-fix-chan-initialization-in-stm3.patch @@ -0,0 +1,41 @@ +From 69e487b59142b5fdb3d94747e1710b56650c7c2b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 May 2022 17:53:21 +0200 +Subject: dmaengine: stm32-mdma: fix chan initialization in + stm32_mdma_irq_handler() + +From: Amelie Delaunay + +[ Upstream commit da3b8ddb464bd49b6248d00ca888ad751c9e44fd ] + +The parameter to pass back to the handler function when irq has been +requested is a struct stm32_mdma_device pointer, not a struct +stm32_mdma_chan pointer. +Even if chan is reinit later in the function, remove this wrong +initialization. + +Fixes: a4ffb13c8946 ("dmaengine: Add STM32 MDMA driver") +Signed-off-by: Amelie Delaunay +Link: https://lore.kernel.org/r/20220504155322.121431-3-amelie.delaunay@foss.st.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/stm32-mdma.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/dma/stm32-mdma.c b/drivers/dma/stm32-mdma.c +index 1e6bc22ddae9..f8c8b9d76aad 100644 +--- a/drivers/dma/stm32-mdma.c ++++ b/drivers/dma/stm32-mdma.c +@@ -1316,7 +1316,7 @@ static void stm32_mdma_xfer_end(struct stm32_mdma_chan *chan) + static irqreturn_t stm32_mdma_irq_handler(int irq, void *devid) + { + struct stm32_mdma_device *dmadev = devid; +- struct stm32_mdma_chan *chan = devid; ++ struct stm32_mdma_chan *chan; + u32 reg, id, ccr, ien, status; + + /* Find out which channel generates the interrupt */ +-- +2.35.1 + diff --git a/queue-5.18/dmaengine-stm32-mdma-remove-gisr1-register.patch b/queue-5.18/dmaengine-stm32-mdma-remove-gisr1-register.patch new file mode 100644 index 00000000000..05ac5558631 --- /dev/null +++ b/queue-5.18/dmaengine-stm32-mdma-remove-gisr1-register.patch @@ -0,0 +1,73 @@ +From cf871718cfa742e909f7f526fb5859f54b9aa2d5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 May 2022 17:53:20 +0200 +Subject: dmaengine: stm32-mdma: remove GISR1 register + +From: Amelie Delaunay + +[ Upstream commit 9d6a2d92e450926c483e45eaf426080a19219f4e ] + +GISR1 was described in a not up-to-date documentation when the stm32-mdma +driver has been developed. This register has not been added in reference +manual of STM32 SoC with MDMA, which have only 32 MDMA channels. +So remove it from stm32-mdma driver. + +Fixes: a4ffb13c8946 ("dmaengine: Add STM32 MDMA driver") +Signed-off-by: Amelie Delaunay +Link: https://lore.kernel.org/r/20220504155322.121431-2-amelie.delaunay@foss.st.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/stm32-mdma.c | 21 +++++---------------- + 1 file changed, 5 insertions(+), 16 deletions(-) + +diff --git a/drivers/dma/stm32-mdma.c b/drivers/dma/stm32-mdma.c +index 6f57ff0e7b37..1e6bc22ddae9 100644 +--- a/drivers/dma/stm32-mdma.c ++++ b/drivers/dma/stm32-mdma.c +@@ -34,7 +34,6 @@ + #include "virt-dma.h" + + #define STM32_MDMA_GISR0 0x0000 /* MDMA Int Status Reg 1 */ +-#define STM32_MDMA_GISR1 0x0004 /* MDMA Int Status Reg 2 */ + + /* MDMA Channel x interrupt/status register */ + #define STM32_MDMA_CISR(x) (0x40 + 0x40 * (x)) /* x = 0..62 */ +@@ -168,7 +167,7 @@ + + #define STM32_MDMA_MAX_BUF_LEN 128 + #define STM32_MDMA_MAX_BLOCK_LEN 65536 +-#define STM32_MDMA_MAX_CHANNELS 63 ++#define STM32_MDMA_MAX_CHANNELS 32 + #define STM32_MDMA_MAX_REQUESTS 256 + #define STM32_MDMA_MAX_BURST 128 + #define STM32_MDMA_VERY_HIGH_PRIORITY 0x3 +@@ -1322,21 +1321,11 @@ static irqreturn_t stm32_mdma_irq_handler(int irq, void *devid) + + /* Find out which channel generates the interrupt */ + status = readl_relaxed(dmadev->base + STM32_MDMA_GISR0); +- if (status) { +- id = __ffs(status); +- } else { +- status = readl_relaxed(dmadev->base + STM32_MDMA_GISR1); +- if (!status) { +- dev_dbg(mdma2dev(dmadev), "spurious it\n"); +- return IRQ_NONE; +- } +- id = __ffs(status); +- /* +- * As GISR0 provides status for channel id from 0 to 31, +- * so GISR1 provides status for channel id from 32 to 62 +- */ +- id += 32; ++ if (!status) { ++ dev_dbg(mdma2dev(dmadev), "spurious it\n"); ++ return IRQ_NONE; + } ++ id = __ffs(status); + + chan = &dmadev->chan[id]; + if (!chan) { +-- +2.35.1 + diff --git a/queue-5.18/dmaengine-ti-k3-psil-am62-update-psil-thread-for-sau.patch b/queue-5.18/dmaengine-ti-k3-psil-am62-update-psil-thread-for-sau.patch new file mode 100644 index 00000000000..5601f40f628 --- /dev/null +++ b/queue-5.18/dmaengine-ti-k3-psil-am62-update-psil-thread-for-sau.patch @@ -0,0 +1,42 @@ +From fbe446f4d2d5956919e15cd5d5deec9eab0b930b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Apr 2022 12:23:23 +0530 +Subject: dmaengine: ti: k3-psil-am62: Update PSIL thread for saul. + +From: Jayesh Choudhary + +[ Upstream commit b21fe492a3a9831c315eb456cf5480c9490eaeef ] + +Correct the RX PSIL thread for sa3ul. + +Signed-off-by: Jayesh Choudhary +Fixes: 5ac6bfb587772 ("dmaengine: ti: k3-psil: Add AM62x PSIL and PDMA data") +Link: https://lore.kernel.org/r/20220421065323.16378-1-j-choudhary@ti.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/ti/k3-psil-am62.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/dma/ti/k3-psil-am62.c b/drivers/dma/ti/k3-psil-am62.c +index d431e2033237..2b6fd6e37c61 100644 +--- a/drivers/dma/ti/k3-psil-am62.c ++++ b/drivers/dma/ti/k3-psil-am62.c +@@ -70,10 +70,10 @@ + /* PSI-L source thread IDs, used for RX (DMA_DEV_TO_MEM) */ + static struct psil_ep am62_src_ep_map[] = { + /* SAUL */ +- PSIL_SAUL(0x7500, 20, 35, 8, 35, 0), +- PSIL_SAUL(0x7501, 21, 35, 8, 36, 0), +- PSIL_SAUL(0x7502, 22, 43, 8, 43, 0), +- PSIL_SAUL(0x7503, 23, 43, 8, 44, 0), ++ PSIL_SAUL(0x7504, 20, 35, 8, 35, 0), ++ PSIL_SAUL(0x7505, 21, 35, 8, 36, 0), ++ PSIL_SAUL(0x7506, 22, 43, 8, 43, 0), ++ PSIL_SAUL(0x7507, 23, 43, 8, 44, 0), + /* PDMA_MAIN0 - SPI0-3 */ + PSIL_PDMA_XY_PKT(0x4302), + PSIL_PDMA_XY_PKT(0x4303), +-- +2.35.1 + diff --git a/queue-5.18/docs-driver-api-thermal-intel_dptf-use-copyright-sym.patch b/queue-5.18/docs-driver-api-thermal-intel_dptf-use-copyright-sym.patch new file mode 100644 index 00000000000..a7a2f0e7c63 --- /dev/null +++ b/queue-5.18/docs-driver-api-thermal-intel_dptf-use-copyright-sym.patch @@ -0,0 +1,51 @@ +From d4fdeccc538a9339c9ea2e5ac12789e45e3cf048 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 2 Apr 2022 08:19:05 +0900 +Subject: docs: driver-api/thermal/intel_dptf: Use copyright symbol +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Akira Yokosawa + +[ Upstream commit 2c2de6f2e2bc444eed65eaa949b4fdadab93f6b3 ] + +Using a substitution pattern of "|copy|" without including +isonum.txt causes a doc build warning. + +Using the symbol "©" itself is a better choice for those +who read .rst sources. + +Reported by: Randy Dunlap + +Fixes: 16c02447f3e1 ("Documentation: thermal: DPTF Documentation") +Suggested-by: Jonathan Corbet +Signed-off-by: Akira Yokosawa +Cc: "Rafael J. Wysocki" +Cc: Srinivas Pandruvada +Cc: linux-pm@vger.kernel.org +Cc: linux-doc@vger.kernel.org +Acked-by: Randy Dunlap +Tested-by: Randy Dunlap +Signed-off-by: Jonathan Corbet +Signed-off-by: Sasha Levin +--- + Documentation/driver-api/thermal/intel_dptf.rst | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/Documentation/driver-api/thermal/intel_dptf.rst b/Documentation/driver-api/thermal/intel_dptf.rst +index 96668dca753a..372bdb4d04c6 100644 +--- a/Documentation/driver-api/thermal/intel_dptf.rst ++++ b/Documentation/driver-api/thermal/intel_dptf.rst +@@ -4,7 +4,7 @@ + Intel(R) Dynamic Platform and Thermal Framework Sysfs Interface + =============================================================== + +-:Copyright: |copy| 2022 Intel Corporation ++:Copyright: © 2022 Intel Corporation + + :Author: Srinivas Pandruvada + +-- +2.35.1 + diff --git a/queue-5.18/dpaa2-eth-retrieve-the-virtual-address-before-dma_un.patch b/queue-5.18/dpaa2-eth-retrieve-the-virtual-address-before-dma_un.patch new file mode 100644 index 00000000000..2ea4c632a22 --- /dev/null +++ b/queue-5.18/dpaa2-eth-retrieve-the-virtual-address-before-dma_un.patch @@ -0,0 +1,78 @@ +From 8364bd8adfc94e598be16588749a97d4cd05f395 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 22 May 2022 15:52:49 +0300 +Subject: dpaa2-eth: retrieve the virtual address before dma_unmap + +From: Ioana Ciornei + +[ Upstream commit 06d129946a71f3159b3b40ee95549183edf2c79d ] + +The TSO header was DMA unmapped before the virtual address was retrieved +and then used to free the buffer. This meant that we were actually +removing the DMA map and then trying to search for it to help in +retrieving the virtual address. This lead to a invalid virtual address +being used in the kfree call. + +Fix this by calling dpaa2_iova_to_virt() prior to the dma_unmap call. + +[ 487.231819] Unable to handle kernel paging request at virtual address fffffd9807000008 + +(...) + +[ 487.354061] Hardware name: SolidRun LX2160A Honeycomb (DT) +[ 487.359535] pstate: a0400005 (NzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) +[ 487.366485] pc : kfree+0xac/0x304 +[ 487.369799] lr : kfree+0x204/0x304 +[ 487.373191] sp : ffff80000c4eb120 +[ 487.376493] x29: ffff80000c4eb120 x28: ffff662240c46400 x27: 0000000000000001 +[ 487.383621] x26: 0000000000000001 x25: ffff662246da0cc0 x24: ffff66224af78000 +[ 487.390748] x23: ffffad184f4ce008 x22: ffffad1850185000 x21: ffffad1838d13cec +[ 487.397874] x20: ffff6601c0000000 x19: fffffd9807000000 x18: 0000000000000000 +[ 487.405000] x17: ffffb910cdc49000 x16: ffffad184d7d9080 x15: 0000000000004000 +[ 487.412126] x14: 0000000000000008 x13: 000000000000ffff x12: 0000000000000000 +[ 487.419252] x11: 0000000000000004 x10: 0000000000000001 x9 : ffffad184d7d927c +[ 487.426379] x8 : 0000000000000000 x7 : 0000000ffffffd1d x6 : ffff662240a94900 +[ 487.433505] x5 : 0000000000000003 x4 : 0000000000000009 x3 : ffffad184f4ce008 +[ 487.440632] x2 : ffff662243eec000 x1 : 0000000100000100 x0 : fffffc0000000000 +[ 487.447758] Call trace: +[ 487.450194] kfree+0xac/0x304 +[ 487.453151] dpaa2_eth_free_tx_fd.isra.0+0x33c/0x3e0 [fsl_dpaa2_eth] +[ 487.459507] dpaa2_eth_tx_conf+0x100/0x2e0 [fsl_dpaa2_eth] +[ 487.464989] dpaa2_eth_poll+0xdc/0x380 [fsl_dpaa2_eth] + +Fixes: 3dc709e0cd47 ("dpaa2-eth: add support for software TSO") +Link: https://bugzilla.kernel.org/show_bug.cgi?id=215886 +Signed-off-by: Ioana Ciornei +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c +index 4b047255d928..766391310d1b 100644 +--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c ++++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c +@@ -1097,6 +1097,7 @@ static void dpaa2_eth_free_tx_fd(struct dpaa2_eth_priv *priv, + u32 fd_len = dpaa2_fd_get_len(fd); + struct dpaa2_sg_entry *sgt; + int should_free_skb = 1; ++ void *tso_hdr; + int i; + + fd_addr = dpaa2_fd_get_addr(fd); +@@ -1136,9 +1137,10 @@ static void dpaa2_eth_free_tx_fd(struct dpaa2_eth_priv *priv, + priv->tx_data_offset); + + /* Unmap and free the header */ ++ tso_hdr = dpaa2_iova_to_virt(priv->iommu_domain, dpaa2_sg_get_addr(sgt)); + dma_unmap_single(dev, dpaa2_sg_get_addr(sgt), TSO_HEADER_SIZE, + DMA_TO_DEVICE); +- kfree(dpaa2_iova_to_virt(priv->iommu_domain, dpaa2_sg_get_addr(sgt))); ++ kfree(tso_hdr); + + /* Unmap the other SG entries for the data */ + for (i = 1; i < swa->tso.num_sg; i++) +-- +2.35.1 + diff --git a/queue-5.18/dpaa2-eth-unmap-the-sgt-buffer-before-accessing-its-.patch b/queue-5.18/dpaa2-eth-unmap-the-sgt-buffer-before-accessing-its-.patch new file mode 100644 index 00000000000..5e4726b97dc --- /dev/null +++ b/queue-5.18/dpaa2-eth-unmap-the-sgt-buffer-before-accessing-its-.patch @@ -0,0 +1,50 @@ +From 715047a158248ea7409e69b4607ec187416de832 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 22 May 2022 15:52:51 +0300 +Subject: dpaa2-eth: unmap the SGT buffer before accessing its contents + +From: Ioana Ciornei + +[ Upstream commit 0a09c5b8cb8f75344da7d90c771b84f7cdeaea04 ] + +DMA unmap the Scatter/Gather table before going through the array to +unmap and free each of the header and data chunks. This is so we do not +touch the data between the dma_map and dma_unmap calls. + +Fixes: 3dc709e0cd47 ("dpaa2-eth: add support for software TSO") +Signed-off-by: Ioana Ciornei +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c +index f1f140277184..cd9ec80522e7 100644 +--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c ++++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c +@@ -1136,6 +1136,10 @@ static void dpaa2_eth_free_tx_fd(struct dpaa2_eth_priv *priv, + sgt = (struct dpaa2_sg_entry *)(buffer_start + + priv->tx_data_offset); + ++ /* Unmap the SGT buffer */ ++ dma_unmap_single(dev, fd_addr, swa->tso.sgt_size, ++ DMA_BIDIRECTIONAL); ++ + /* Unmap and free the header */ + tso_hdr = dpaa2_iova_to_virt(priv->iommu_domain, dpaa2_sg_get_addr(sgt)); + dma_unmap_single(dev, dpaa2_sg_get_addr(sgt), TSO_HEADER_SIZE, +@@ -1147,10 +1151,6 @@ static void dpaa2_eth_free_tx_fd(struct dpaa2_eth_priv *priv, + dma_unmap_single(dev, dpaa2_sg_get_addr(&sgt[i]), + dpaa2_sg_get_len(&sgt[i]), DMA_TO_DEVICE); + +- /* Unmap the SGT buffer */ +- dma_unmap_single(dev, fd_addr, swa->tso.sgt_size, +- DMA_BIDIRECTIONAL); +- + if (!swa->tso.is_last_fd) + should_free_skb = 0; + } else { +-- +2.35.1 + diff --git a/queue-5.18/dpaa2-eth-use-the-correct-software-annotation-field.patch b/queue-5.18/dpaa2-eth-use-the-correct-software-annotation-field.patch new file mode 100644 index 00000000000..6a6552be615 --- /dev/null +++ b/queue-5.18/dpaa2-eth-use-the-correct-software-annotation-field.patch @@ -0,0 +1,45 @@ +From c05312af0ce4ed817c818bf97e55ffb84576454c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 22 May 2022 15:52:50 +0300 +Subject: dpaa2-eth: use the correct software annotation field + +From: Ioana Ciornei + +[ Upstream commit d5f4e19a85670b4e5697654f4a4e086e064f8a47 ] + +The incorrect software annotation field was being used, swa->sg.sgt_size +instead of swa->tso.sgt_size, which meant that the SGT buffer was +unmapped with a wrong size. +This is also confirmed by the DMA API debug prints which showed the +following: + +[ 38.962434] DMA-API: fsl_dpaa2_eth dpni.2: device driver frees DMA memory with different size [device address=0x0000fffffafba740] [map size=224 bytes] [unmap size=0 bytes] +[ 38.980496] WARNING: CPU: 11 PID: 1131 at kernel/dma/debug.c:973 check_unmap+0x58c/0x9b0 +[ 38.988586] Modules linked in: +[ 38.991631] CPU: 11 PID: 1131 Comm: iperf3 Not tainted 5.18.0-rc7-00117-g59130eeb2b8f #1972 +[ 38.999970] Hardware name: NXP Layerscape LX2160ARDB (DT) + +Fixes: 3dc709e0cd47 ("dpaa2-eth: add support for software TSO") +Signed-off-by: Ioana Ciornei +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c +index 766391310d1b..f1f140277184 100644 +--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c ++++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c +@@ -1148,7 +1148,7 @@ static void dpaa2_eth_free_tx_fd(struct dpaa2_eth_priv *priv, + dpaa2_sg_get_len(&sgt[i]), DMA_TO_DEVICE); + + /* Unmap the SGT buffer */ +- dma_unmap_single(dev, fd_addr, swa->sg.sgt_size, ++ dma_unmap_single(dev, fd_addr, swa->tso.sgt_size, + DMA_BIDIRECTIONAL); + + if (!swa->tso.is_last_fd) +-- +2.35.1 + diff --git a/queue-5.18/drbd-fix-duplicate-array-initializer.patch b/queue-5.18/drbd-fix-duplicate-array-initializer.patch new file mode 100644 index 00000000000..14c05044235 --- /dev/null +++ b/queue-5.18/drbd-fix-duplicate-array-initializer.patch @@ -0,0 +1,93 @@ +From 16515c4eaa1f5ba322edbfe0bec963bb66b3f3ba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Apr 2022 21:07:09 +0200 +Subject: drbd: fix duplicate array initializer +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Arnd Bergmann + +[ Upstream commit 33cb0917bbe241dd17a2b87ead63514c1b7e5615 ] + +There are two initializers for P_RETRY_WRITE: + +drivers/block/drbd/drbd_main.c:3676:22: warning: initialized field overwritten [-Woverride-init] + +Remove the first one since it was already ignored by the compiler +and reorder the list to match the enum definition. As P_ZEROES had +no entry, add that one instead. + +Fixes: 036b17eaab93 ("drbd: Receiving part for the PROTOCOL_UPDATE packet") +Fixes: f31e583aa2c2 ("drbd: introduce P_ZEROES (REQ_OP_WRITE_ZEROES on the "wire")") +Signed-off-by: Arnd Bergmann +Reviewed-by: Christoph Böhmwalder +Link: https://lore.kernel.org/r/20220406190715.1938174-2-christoph.boehmwalder@linbit.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/drbd/drbd_main.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c +index 7b501c8d5992..57b23e49ee91 100644 +--- a/drivers/block/drbd/drbd_main.c ++++ b/drivers/block/drbd/drbd_main.c +@@ -3581,9 +3581,8 @@ const char *cmdname(enum drbd_packet cmd) + * when we want to support more than + * one PRO_VERSION */ + static const char *cmdnames[] = { ++ + [P_DATA] = "Data", +- [P_WSAME] = "WriteSame", +- [P_TRIM] = "Trim", + [P_DATA_REPLY] = "DataReply", + [P_RS_DATA_REPLY] = "RSDataReply", + [P_BARRIER] = "Barrier", +@@ -3594,7 +3593,6 @@ const char *cmdname(enum drbd_packet cmd) + [P_DATA_REQUEST] = "DataRequest", + [P_RS_DATA_REQUEST] = "RSDataRequest", + [P_SYNC_PARAM] = "SyncParam", +- [P_SYNC_PARAM89] = "SyncParam89", + [P_PROTOCOL] = "ReportProtocol", + [P_UUIDS] = "ReportUUIDs", + [P_SIZES] = "ReportSizes", +@@ -3602,6 +3600,7 @@ const char *cmdname(enum drbd_packet cmd) + [P_SYNC_UUID] = "ReportSyncUUID", + [P_AUTH_CHALLENGE] = "AuthChallenge", + [P_AUTH_RESPONSE] = "AuthResponse", ++ [P_STATE_CHG_REQ] = "StateChgRequest", + [P_PING] = "Ping", + [P_PING_ACK] = "PingAck", + [P_RECV_ACK] = "RecvAck", +@@ -3612,23 +3611,25 @@ const char *cmdname(enum drbd_packet cmd) + [P_NEG_DREPLY] = "NegDReply", + [P_NEG_RS_DREPLY] = "NegRSDReply", + [P_BARRIER_ACK] = "BarrierAck", +- [P_STATE_CHG_REQ] = "StateChgRequest", + [P_STATE_CHG_REPLY] = "StateChgReply", + [P_OV_REQUEST] = "OVRequest", + [P_OV_REPLY] = "OVReply", + [P_OV_RESULT] = "OVResult", + [P_CSUM_RS_REQUEST] = "CsumRSRequest", + [P_RS_IS_IN_SYNC] = "CsumRSIsInSync", ++ [P_SYNC_PARAM89] = "SyncParam89", + [P_COMPRESSED_BITMAP] = "CBitmap", + [P_DELAY_PROBE] = "DelayProbe", + [P_OUT_OF_SYNC] = "OutOfSync", +- [P_RETRY_WRITE] = "RetryWrite", + [P_RS_CANCEL] = "RSCancel", + [P_CONN_ST_CHG_REQ] = "conn_st_chg_req", + [P_CONN_ST_CHG_REPLY] = "conn_st_chg_reply", + [P_PROTOCOL_UPDATE] = "protocol_update", ++ [P_TRIM] = "Trim", + [P_RS_THIN_REQ] = "rs_thin_req", + [P_RS_DEALLOCATED] = "rs_deallocated", ++ [P_WSAME] = "WriteSame", ++ [P_ZEROES] = "Zeroes", + + /* enum drbd_packet, but not commands - obsoleted flags: + * P_MAY_IGNORE +-- +2.35.1 + diff --git a/queue-5.18/drbd-remove-assign_p_sizes_qlim.patch b/queue-5.18/drbd-remove-assign_p_sizes_qlim.patch new file mode 100644 index 00000000000..a15e83041af --- /dev/null +++ b/queue-5.18/drbd-remove-assign_p_sizes_qlim.patch @@ -0,0 +1,97 @@ +From e47c008fea0c7374190b79a58fadf94a15757c29 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Apr 2022 06:52:35 +0200 +Subject: drbd: remove assign_p_sizes_qlim +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Christoph Hellwig + +[ Upstream commit 40349d0e16cedd0de561f59752c3249780fb749b ] + +Fold each branch into its only caller. + +Signed-off-by: Christoph Hellwig +Acked-by: Christoph Böhmwalder +Link: https://lore.kernel.org/r/20220415045258.199825-5-hch@lst.de +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/drbd/drbd_main.c | 47 +++++++++++++++------------------- + 1 file changed, 20 insertions(+), 27 deletions(-) + +diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c +index 4b0b25cc916e..367715205c86 100644 +--- a/drivers/block/drbd/drbd_main.c ++++ b/drivers/block/drbd/drbd_main.c +@@ -903,31 +903,6 @@ void drbd_gen_and_send_sync_uuid(struct drbd_peer_device *peer_device) + } + } + +-/* communicated if (agreed_features & DRBD_FF_WSAME) */ +-static void +-assign_p_sizes_qlim(struct drbd_device *device, struct p_sizes *p, +- struct request_queue *q) +-{ +- if (q) { +- p->qlim->physical_block_size = cpu_to_be32(queue_physical_block_size(q)); +- p->qlim->logical_block_size = cpu_to_be32(queue_logical_block_size(q)); +- p->qlim->alignment_offset = cpu_to_be32(queue_alignment_offset(q)); +- p->qlim->io_min = cpu_to_be32(queue_io_min(q)); +- p->qlim->io_opt = cpu_to_be32(queue_io_opt(q)); +- p->qlim->discard_enabled = blk_queue_discard(q); +- p->qlim->write_same_capable = 0; +- } else { +- q = device->rq_queue; +- p->qlim->physical_block_size = cpu_to_be32(queue_physical_block_size(q)); +- p->qlim->logical_block_size = cpu_to_be32(queue_logical_block_size(q)); +- p->qlim->alignment_offset = 0; +- p->qlim->io_min = cpu_to_be32(queue_io_min(q)); +- p->qlim->io_opt = cpu_to_be32(queue_io_opt(q)); +- p->qlim->discard_enabled = 0; +- p->qlim->write_same_capable = 0; +- } +-} +- + int drbd_send_sizes(struct drbd_peer_device *peer_device, int trigger_reply, enum dds_flags flags) + { + struct drbd_device *device = peer_device->device; +@@ -957,14 +932,32 @@ int drbd_send_sizes(struct drbd_peer_device *peer_device, int trigger_reply, enu + q_order_type = drbd_queue_order_type(device); + max_bio_size = queue_max_hw_sectors(q) << 9; + max_bio_size = min(max_bio_size, DRBD_MAX_BIO_SIZE); +- assign_p_sizes_qlim(device, p, q); ++ p->qlim->physical_block_size = ++ cpu_to_be32(queue_physical_block_size(q)); ++ p->qlim->logical_block_size = ++ cpu_to_be32(queue_logical_block_size(q)); ++ p->qlim->alignment_offset = ++ cpu_to_be32(queue_alignment_offset(q)); ++ p->qlim->io_min = cpu_to_be32(queue_io_min(q)); ++ p->qlim->io_opt = cpu_to_be32(queue_io_opt(q)); ++ p->qlim->discard_enabled = blk_queue_discard(q); + put_ldev(device); + } else { ++ struct request_queue *q = device->rq_queue; ++ ++ p->qlim->physical_block_size = ++ cpu_to_be32(queue_physical_block_size(q)); ++ p->qlim->logical_block_size = ++ cpu_to_be32(queue_logical_block_size(q)); ++ p->qlim->alignment_offset = 0; ++ p->qlim->io_min = cpu_to_be32(queue_io_min(q)); ++ p->qlim->io_opt = cpu_to_be32(queue_io_opt(q)); ++ p->qlim->discard_enabled = 0; ++ + d_size = 0; + u_size = 0; + q_order_type = QUEUE_ORDERED_NONE; + max_bio_size = DRBD_MAX_BIO_SIZE; /* ... multiple BIOs per peer_request */ +- assign_p_sizes_qlim(device, p, NULL); + } + + if (peer_device->connection->agreed_pro_version <= 94) +-- +2.35.1 + diff --git a/queue-5.18/drbd-use-bdev-based-limit-helpers-in-drbd_send_sizes.patch b/queue-5.18/drbd-use-bdev-based-limit-helpers-in-drbd_send_sizes.patch new file mode 100644 index 00000000000..428ba41dac2 --- /dev/null +++ b/queue-5.18/drbd-use-bdev-based-limit-helpers-in-drbd_send_sizes.patch @@ -0,0 +1,59 @@ +From 36ba52f837cbfe9d93a1083b62ee0d6530af64f8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Apr 2022 06:52:36 +0200 +Subject: drbd: use bdev based limit helpers in drbd_send_sizes +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Christoph Hellwig + +[ Upstream commit 7a38acce229685968b770d1d9e64e01396b93643 ] + +Use the bdev based limits helpers where they exist. + +Signed-off-by: Christoph Hellwig +Acked-by: Christoph Böhmwalder +Link: https://lore.kernel.org/r/20220415045258.199825-6-hch@lst.de +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/drbd/drbd_main.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c +index 367715205c86..c39b04bda261 100644 +--- a/drivers/block/drbd/drbd_main.c ++++ b/drivers/block/drbd/drbd_main.c +@@ -924,7 +924,9 @@ int drbd_send_sizes(struct drbd_peer_device *peer_device, int trigger_reply, enu + + memset(p, 0, packet_size); + if (get_ldev_if_state(device, D_NEGOTIATING)) { +- struct request_queue *q = bdev_get_queue(device->ldev->backing_bdev); ++ struct block_device *bdev = device->ldev->backing_bdev; ++ struct request_queue *q = bdev_get_queue(bdev); ++ + d_size = drbd_get_max_capacity(device->ldev); + rcu_read_lock(); + u_size = rcu_dereference(device->ldev->disk_conf)->disk_size; +@@ -933,13 +935,13 @@ int drbd_send_sizes(struct drbd_peer_device *peer_device, int trigger_reply, enu + max_bio_size = queue_max_hw_sectors(q) << 9; + max_bio_size = min(max_bio_size, DRBD_MAX_BIO_SIZE); + p->qlim->physical_block_size = +- cpu_to_be32(queue_physical_block_size(q)); ++ cpu_to_be32(bdev_physical_block_size(bdev)); + p->qlim->logical_block_size = +- cpu_to_be32(queue_logical_block_size(q)); ++ cpu_to_be32(bdev_logical_block_size(bdev)); + p->qlim->alignment_offset = + cpu_to_be32(queue_alignment_offset(q)); +- p->qlim->io_min = cpu_to_be32(queue_io_min(q)); +- p->qlim->io_opt = cpu_to_be32(queue_io_opt(q)); ++ p->qlim->io_min = cpu_to_be32(bdev_io_min(bdev)); ++ p->qlim->io_opt = cpu_to_be32(bdev_io_opt(bdev)); + p->qlim->discard_enabled = blk_queue_discard(q); + put_ldev(device); + } else { +-- +2.35.1 + diff --git a/queue-5.18/drbd-use-bdev_alignment_offset-instead-of-queue_alig.patch b/queue-5.18/drbd-use-bdev_alignment_offset-instead-of-queue_alig.patch new file mode 100644 index 00000000000..2594ecbcd02 --- /dev/null +++ b/queue-5.18/drbd-use-bdev_alignment_offset-instead-of-queue_alig.patch @@ -0,0 +1,40 @@ +From f3952c0ae784e2cb6560173c1546fe6f3a13cbd4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Apr 2022 06:52:37 +0200 +Subject: drbd: use bdev_alignment_offset instead of queue_alignment_offset +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Christoph Hellwig + +[ Upstream commit c6f23b1a05441a26f765e59dd95e8ba7354f9388 ] + +The bdev version does the right thing for partitions, so use that. + +Fixes: 9104d31a759f ("drbd: introduce WRITE_SAME support") +Signed-off-by: Christoph Hellwig +Acked-by: Christoph Böhmwalder +Link: https://lore.kernel.org/r/20220415045258.199825-7-hch@lst.de +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/drbd/drbd_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c +index c39b04bda261..7b501c8d5992 100644 +--- a/drivers/block/drbd/drbd_main.c ++++ b/drivers/block/drbd/drbd_main.c +@@ -939,7 +939,7 @@ int drbd_send_sizes(struct drbd_peer_device *peer_device, int trigger_reply, enu + p->qlim->logical_block_size = + cpu_to_be32(bdev_logical_block_size(bdev)); + p->qlim->alignment_offset = +- cpu_to_be32(queue_alignment_offset(q)); ++ cpu_to_be32(bdev_alignment_offset(bdev)); + p->qlim->io_min = cpu_to_be32(bdev_io_min(bdev)); + p->qlim->io_opt = cpu_to_be32(bdev_io_opt(bdev)); + p->qlim->discard_enabled = blk_queue_discard(q); +-- +2.35.1 + diff --git a/queue-5.18/drivers-base-memory-fix-an-unlikely-reference-counti.patch b/queue-5.18/drivers-base-memory-fix-an-unlikely-reference-counti.patch new file mode 100644 index 00000000000..bd9a8c0836b --- /dev/null +++ b/queue-5.18/drivers-base-memory-fix-an-unlikely-reference-counti.patch @@ -0,0 +1,53 @@ +From 934833c4c985505c13922c192b73315e8065d2cb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Apr 2022 23:16:19 -0700 +Subject: drivers/base/memory: fix an unlikely reference counting issue in + __add_memory_block() + +From: Christophe JAILLET + +[ Upstream commit f47f758cff59c68015d6b9b9c077110df7c2c828 ] + +__add_memory_block() calls both put_device() and device_unregister() when +storing the memory block into the xarray. This is incorrect because +xarray doesn't take an additional reference and device_unregister() +already calls put_device(). + +Triggering the issue looks really unlikely and its only effect should be +to log a spurious warning about a ref counted issue. + +Link: https://lkml.kernel.org/r/d44c63d78affe844f020dc02ad6af29abc448fc4.1650611702.git.christophe.jaillet@wanadoo.fr +Fixes: 4fb6eabf1037 ("drivers/base/memory.c: cache memory blocks in xarray to accelerate lookup") +Signed-off-by: Christophe JAILLET +Acked-by: Michal Hocko +Reviewed-by: David Hildenbrand +Cc: Greg Kroah-Hartman +Cc: "Rafael J. Wysocki" +Cc: Scott Cheloha +Cc: Nathan Lynch +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + drivers/base/memory.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/base/memory.c b/drivers/base/memory.c +index 7222ff9b5e05..084d67fd55cc 100644 +--- a/drivers/base/memory.c ++++ b/drivers/base/memory.c +@@ -636,10 +636,9 @@ static int __add_memory_block(struct memory_block *memory) + } + ret = xa_err(xa_store(&memory_blocks, memory->dev.id, memory, + GFP_KERNEL)); +- if (ret) { +- put_device(&memory->dev); ++ if (ret) + device_unregister(&memory->dev); +- } ++ + return ret; + } + +-- +2.35.1 + diff --git a/queue-5.18/drivers-base-node.c-fix-compaction-sysfs-file-leak.patch b/queue-5.18/drivers-base-node.c-fix-compaction-sysfs-file-leak.patch new file mode 100644 index 00000000000..2f2dcc0de3d --- /dev/null +++ b/queue-5.18/drivers-base-node.c-fix-compaction-sysfs-file-leak.patch @@ -0,0 +1,44 @@ +From c98e0e6389bc2295923cd120d9c4504dd9b46ac2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Apr 2022 23:16:06 -0700 +Subject: drivers/base/node.c: fix compaction sysfs file leak + +From: Miaohe Lin + +[ Upstream commit da63dc84befaa9e6079a0bc363ff0eaa975f9073 ] + +Compaction sysfs file is created via compaction_register_node in +register_node. But we forgot to remove it in unregister_node. Thus +compaction sysfs file is leaked. Using compaction_unregister_node to fix +this issue. + +Link: https://lkml.kernel.org/r/20220401070905.43679-1-linmiaohe@huawei.com +Fixes: ed4a6d7f0676 ("mm: compaction: add /sys trigger for per-node memory compaction") +Signed-off-by: Miaohe Lin +Cc: Greg Kroah-Hartman +Cc: Rafael J. Wysocki +Cc: Mel Gorman +Cc: Minchan Kim +Cc: KAMEZAWA Hiroyuki +Cc: KOSAKI Motohiro +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + drivers/base/node.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/base/node.c b/drivers/base/node.c +index ec8bb24a5a22..0ac6376ef7a1 100644 +--- a/drivers/base/node.c ++++ b/drivers/base/node.c +@@ -682,6 +682,7 @@ static int register_node(struct node *node, int num) + */ + void unregister_node(struct node *node) + { ++ compaction_unregister_node(node); + hugetlb_unregister_node(node); /* no-op, if memoryless node */ + node_remove_accesses(node); + node_remove_caches(node); +-- +2.35.1 + diff --git a/queue-5.18/drivers-hv-vmbus-fix-handling-of-messages-with-trans.patch b/queue-5.18/drivers-hv-vmbus-fix-handling-of-messages-with-trans.patch new file mode 100644 index 00000000000..0c68aa768ad --- /dev/null +++ b/queue-5.18/drivers-hv-vmbus-fix-handling-of-messages-with-trans.patch @@ -0,0 +1,71 @@ +From d91a8e2ec450a10e8ac82faf3a0d931d8a32ccbc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Apr 2022 14:23:20 +0200 +Subject: Drivers: hv: vmbus: Fix handling of messages with transaction ID of + zero + +From: Andrea Parri (Microsoft) + +[ Upstream commit 82cd4bacff88a11e36f143e2cb950174b09c86c3 ] + +vmbus_request_addr() returns 0 (zero) if the transaction ID passed +to as argument is 0. This is unfortunate for two reasons: first, +netvsc_send_completion() does not check for a NULL cmd_rqst (before +dereferencing the corresponding NVSP message); second, 0 is a *valid* +value of cmd_rqst in netvsc_send_tx_complete(), cf. the call of +vmbus_sendpacket() in netvsc_send_pkt(). + +vmbus_request_addr() has included the code in question since its +introduction with commit e8b7db38449ac ("Drivers: hv: vmbus: Add +vmbus_requestor data structure for VMBus hardening"); such code was +motivated by the early use of vmbus_requestor by hv_storvsc. Since +hv_storvsc moved to a tag-based mechanism to generate and retrieve +transaction IDs with commit bf5fd8cae3c8f ("scsi: storvsc: Use +blk_mq_unique_tag() to generate requestIDs"), vmbus_request_addr() +can be modified to return VMBUS_RQST_ERROR if the ID is 0. This +change solves the issues in hv_netvsc (and makes the handling of +messages with transaction ID of 0 consistent with the semantics +"the ID is not contained in the requestor/invalid ID"). + +vmbus_next_request_id(), vmbus_request_addr() should still reserve +the ID of 0 for Hyper-V, because Hyper-V will "ignore" (not respond +to) VMBUS_DATA_PACKET_FLAG_COMPLETION_REQUESTED packets/requests with +transaction ID of 0 from the guest. + +Fixes: bf5fd8cae3c8f ("scsi: storvsc: Use blk_mq_unique_tag() to generate requestIDs") +Signed-off-by: Andrea Parri (Microsoft) +Reviewed-by: Michael Kelley +Link: https://lore.kernel.org/r/20220419122325.10078-2-parri.andrea@gmail.com +Signed-off-by: Wei Liu +Signed-off-by: Sasha Levin +--- + drivers/hv/channel.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c +index dc5c35210c16..20fc8d50a039 100644 +--- a/drivers/hv/channel.c ++++ b/drivers/hv/channel.c +@@ -1245,7 +1245,9 @@ u64 vmbus_next_request_id(struct vmbus_channel *channel, u64 rqst_addr) + + /* + * Cannot return an ID of 0, which is reserved for an unsolicited +- * message from Hyper-V. ++ * message from Hyper-V; Hyper-V does not acknowledge (respond to) ++ * VMBUS_DATA_PACKET_FLAG_COMPLETION_REQUESTED requests with ID of ++ * 0 sent by the guest. + */ + return current_id + 1; + } +@@ -1270,7 +1272,7 @@ u64 vmbus_request_addr(struct vmbus_channel *channel, u64 trans_id) + + /* Hyper-V can send an unsolicited message with ID of 0 */ + if (!trans_id) +- return trans_id; ++ return VMBUS_RQST_ERROR; + + spin_lock_irqsave(&rqstor->req_lock, flags); + +-- +2.35.1 + diff --git a/queue-5.18/drivers-mmc-sdhci_am654-add-the-quirk-to-set-testcd-.patch b/queue-5.18/drivers-mmc-sdhci_am654-add-the-quirk-to-set-testcd-.patch new file mode 100644 index 00000000000..f87abbec630 --- /dev/null +++ b/queue-5.18/drivers-mmc-sdhci_am654-add-the-quirk-to-set-testcd-.patch @@ -0,0 +1,85 @@ +From 562d8f91d9dd6e2248ac20de796a57c0ab8b7eea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Apr 2022 12:01:20 +0530 +Subject: drivers: mmc: sdhci_am654: Add the quirk to set TESTCD bit + +From: Vignesh Raghavendra + +[ Upstream commit c7666240ec76422cb7546bd07cc8ae80dc0ccdd2 ] + +The ARASAN MMC controller on Keystone 3 class of devices need the SDCD +line to be connected for proper functioning. Similar to the issue pointed +out in sdhci-of-arasan.c driver, commit 3794c542641f ("mmc: +sdhci-of-arasan: Set controller to test mode when no CD bit"). + +In cases where this can't be connected, add a quirk to force the +controller into test mode and set the TESTCD bit. Use the flag +"ti,fails-without-test-cd", to implement this above quirk when required. + +Signed-off-by: Vignesh Raghavendra +Signed-off-by: Aswath Govindraju +Link: https://lore.kernel.org/r/20220425063120.10135-3-a-govindraju@ti.com +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/sdhci_am654.c | 23 ++++++++++++++++++++++- + 1 file changed, 22 insertions(+), 1 deletion(-) + +diff --git a/drivers/mmc/host/sdhci_am654.c b/drivers/mmc/host/sdhci_am654.c +index e54fe24d47e7..e7ced1496a07 100644 +--- a/drivers/mmc/host/sdhci_am654.c ++++ b/drivers/mmc/host/sdhci_am654.c +@@ -147,6 +147,9 @@ struct sdhci_am654_data { + int drv_strength; + int strb_sel; + u32 flags; ++ u32 quirks; ++ ++#define SDHCI_AM654_QUIRK_FORCE_CDTEST BIT(0) + }; + + struct sdhci_am654_driver_data { +@@ -369,6 +372,21 @@ static void sdhci_am654_write_b(struct sdhci_host *host, u8 val, int reg) + } + } + ++static void sdhci_am654_reset(struct sdhci_host *host, u8 mask) ++{ ++ u8 ctrl; ++ struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host); ++ struct sdhci_am654_data *sdhci_am654 = sdhci_pltfm_priv(pltfm_host); ++ ++ sdhci_reset(host, mask); ++ ++ if (sdhci_am654->quirks & SDHCI_AM654_QUIRK_FORCE_CDTEST) { ++ ctrl = sdhci_readb(host, SDHCI_HOST_CONTROL); ++ ctrl |= SDHCI_CTRL_CDTEST_INS | SDHCI_CTRL_CDTEST_EN; ++ sdhci_writeb(host, ctrl, SDHCI_HOST_CONTROL); ++ } ++} ++ + static int sdhci_am654_execute_tuning(struct mmc_host *mmc, u32 opcode) + { + struct sdhci_host *host = mmc_priv(mmc); +@@ -500,7 +518,7 @@ static struct sdhci_ops sdhci_j721e_4bit_ops = { + .set_clock = sdhci_j721e_4bit_set_clock, + .write_b = sdhci_am654_write_b, + .irq = sdhci_am654_cqhci_irq, +- .reset = sdhci_reset, ++ .reset = sdhci_am654_reset, + }; + + static const struct sdhci_pltfm_data sdhci_j721e_4bit_pdata = { +@@ -719,6 +737,9 @@ static int sdhci_am654_get_of_property(struct platform_device *pdev, + device_property_read_u32(dev, "ti,clkbuf-sel", + &sdhci_am654->clkbuf_sel); + ++ if (device_property_read_bool(dev, "ti,fails-without-test-cd")) ++ sdhci_am654->quirks |= SDHCI_AM654_QUIRK_FORCE_CDTEST; ++ + sdhci_get_of_property(pdev); + + return 0; +-- +2.35.1 + diff --git a/queue-5.18/drm-amd-amdgpu-fix-asm-hypervisor.h-build-error.patch b/queue-5.18/drm-amd-amdgpu-fix-asm-hypervisor.h-build-error.patch new file mode 100644 index 00000000000..8ac6b947b74 --- /dev/null +++ b/queue-5.18/drm-amd-amdgpu-fix-asm-hypervisor.h-build-error.patch @@ -0,0 +1,51 @@ +From 0ff6258571a8e9a75cc2c9a4c910ff0d9a7db0a2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Apr 2022 09:26:14 -0400 +Subject: drm/amd/amdgpu: Fix asm/hypervisor.h build error. + +From: Yongqiang Sun + +[ Upstream commit d9e50239a9611b9a1759e007e9a810c8d178da28 ] + +Add CONFIG_X86 check to fix the build error. + +Fixes: 49aa98ca30cd18 ("drm/amd/amdgpu: Only reserve vram for firmware with vega9 MS_HYPERV host.") +Reported-by: kernel test robot +Signed-off-by: Yongqiang Sun +Acked-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c +index 3e9582c245bb..88b852b3a2cb 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c +@@ -25,7 +25,9 @@ + */ + + #include ++#ifdef CONFIG_X86 + #include ++#endif + + #include "amdgpu.h" + #include "amdgpu_gmc.h" +@@ -650,10 +652,12 @@ void amdgpu_gmc_get_vbios_allocations(struct amdgpu_device *adev) + /* + * VEGA10 SRIOV VF with MS_HYPERV host needs some firmware reserved area. + */ ++#ifdef CONFIG_X86 + if (amdgpu_sriov_vf(adev) && hypervisor_is_type(X86_HYPER_MS_HYPERV)) { + adev->mman.stolen_reserved_offset = 0x500000; + adev->mman.stolen_reserved_size = 0x200000; + } ++#endif + break; + case CHIP_RAVEN: + case CHIP_RENOIR: +-- +2.35.1 + diff --git a/queue-5.18/drm-amd-amdgpu-only-reserve-vram-for-firmware-with-v.patch b/queue-5.18/drm-amd-amdgpu-only-reserve-vram-for-firmware-with-v.patch new file mode 100644 index 00000000000..027f4804252 --- /dev/null +++ b/queue-5.18/drm-amd-amdgpu-only-reserve-vram-for-firmware-with-v.patch @@ -0,0 +1,57 @@ +From bed0c9bb9a9b873af065d326c91984c3eac5f7a9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Mar 2022 10:48:19 -0400 +Subject: drm/amd/amdgpu: Only reserve vram for firmware with vega9 MS_HYPERV + host. + +From: Yongqiang Sun + +[ Upstream commit 49aa98ca30cd186ab33fc5802066e2024d3bfa39 ] + +driver loading failed on VEGA10 SRIOV VF with linux host due to a wide +range of stolen reserved vram. +Since VEGA10 SRIOV VF need to reserve vram for firmware with windows +Hyper_V host specifically, check hypervisor type to only reserve +memory for it, and the range of the reserved vram can be limited +to between 5M-7M area. + +Fixes: faad5ccac1eaae ("drm/amdgpu: Add stolen reserved memory for MI25 SRIOV.") +Signed-off-by: Yongqiang Sun +Acked-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c +index a66a0881a934..3e9582c245bb 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c +@@ -25,6 +25,7 @@ + */ + + #include ++#include + + #include "amdgpu.h" + #include "amdgpu_gmc.h" +@@ -647,11 +648,11 @@ void amdgpu_gmc_get_vbios_allocations(struct amdgpu_device *adev) + case CHIP_VEGA10: + adev->mman.keep_stolen_vga_memory = true; + /* +- * VEGA10 SRIOV VF needs some firmware reserved area. ++ * VEGA10 SRIOV VF with MS_HYPERV host needs some firmware reserved area. + */ +- if (amdgpu_sriov_vf(adev)) { +- adev->mman.stolen_reserved_offset = 0x100000; +- adev->mman.stolen_reserved_size = 0x600000; ++ if (amdgpu_sriov_vf(adev) && hypervisor_is_type(X86_HYPER_MS_HYPERV)) { ++ adev->mman.stolen_reserved_offset = 0x500000; ++ adev->mman.stolen_reserved_size = 0x200000; + } + break; + case CHIP_RAVEN: +-- +2.35.1 + diff --git a/queue-5.18/drm-amd-amdgpu-remove-static-from-variable-in-rlcg-r.patch b/queue-5.18/drm-amd-amdgpu-remove-static-from-variable-in-rlcg-r.patch new file mode 100644 index 00000000000..be3da13008f --- /dev/null +++ b/queue-5.18/drm-amd-amdgpu-remove-static-from-variable-in-rlcg-r.patch @@ -0,0 +1,53 @@ +From 365aba09b16de5a605a47a4f66bc3945e18f2629 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Apr 2022 11:09:22 -0400 +Subject: drm/amd/amdgpu: Remove static from variable in RLCG Reg RW + +From: Gavin Wan + +[ Upstream commit d68cf992ded575928cf4ddf7c64faff0d8dcce14 ] + +[why] +These static variables save the RLC Scratch registers address. +When we install multiple GPUs (for example: XGMI setting) and +multiple GPUs call the function at same time. The RLC Scratch +registers address are changed each other. Then it caused +reading/writing from/to wrong GPU. + +[how] +Removed the static from the variables. The variables are +on the stack. + +Fixes: 5d447e29670148 ("drm/amdgpu: add helper for rlcg indirect reg access") +Reviewed-by: Alex Deucher +Signed-off-by: Gavin Wan +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c +index 5e3756643da3..1d55b2bae37e 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c +@@ -864,11 +864,11 @@ static u32 amdgpu_virt_rlcg_reg_rw(struct amdgpu_device *adev, u32 offset, u32 v + uint32_t timeout = 50000; + uint32_t i, tmp; + uint32_t ret = 0; +- static void *scratch_reg0; +- static void *scratch_reg1; +- static void *scratch_reg2; +- static void *scratch_reg3; +- static void *spare_int; ++ void *scratch_reg0; ++ void *scratch_reg1; ++ void *scratch_reg2; ++ void *scratch_reg3; ++ void *spare_int; + + if (!adev->gfx.rlc.rlcg_reg_access_supported) { + dev_err(adev->dev, +-- +2.35.1 + diff --git a/queue-5.18/drm-amd-display-disabling-z10-on-dcn31.patch b/queue-5.18/drm-amd-display-disabling-z10-on-dcn31.patch new file mode 100644 index 00000000000..cdf0202de88 --- /dev/null +++ b/queue-5.18/drm-amd-display-disabling-z10-on-dcn31.patch @@ -0,0 +1,39 @@ +From ada09db5991415a4c8d1bde9ef7af9fb01c2f02e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Mar 2022 14:25:16 -0400 +Subject: drm/amd/display: Disabling Z10 on DCN31 + +From: Saaem Rizvi + +[ Upstream commit 5d5af34072c8b11f60960c3bea57ff9de5877791 ] + +[WHY] +Z10 is should not be enabled by default on DCN31. + +[HOW] +Using DC debug flags to disable Z10 by default on DCN31. + +Reviewed-by: Eric Yang +Acked-by: Pavle Kotarac +Signed-off-by: Saaem Rizvi +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dcn31/dcn31_resource.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_resource.c b/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_resource.c +index 63934ecf6be8..d71e625cc476 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_resource.c +@@ -1030,6 +1030,7 @@ static const struct dc_debug_options debug_defaults_drv = { + .afmt = true, + } + }, ++ .disable_z10 = true, + .optimize_edp_link_rate = true, + .enable_sw_cntl_psr = true, + .apply_vendor_specific_lttpr_wa = true, +-- +2.35.1 + diff --git a/queue-5.18/drm-amd-pm-fix-double-free-in-si_parse_power_table.patch b/queue-5.18/drm-amd-pm-fix-double-free-in-si_parse_power_table.patch new file mode 100644 index 00000000000..64eb432aa01 --- /dev/null +++ b/queue-5.18/drm-amd-pm-fix-double-free-in-si_parse_power_table.patch @@ -0,0 +1,70 @@ +From c1efdf0bba9a2a5ca54e8a986952865b13874b3c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Apr 2022 10:37:19 +0000 +Subject: drm/amd/pm: fix double free in si_parse_power_table() + +From: Keita Suzuki + +[ Upstream commit f3fa2becf2fc25b6ac7cf8d8b1a2e4a86b3b72bd ] + +In function si_parse_power_table(), array adev->pm.dpm.ps and its member +is allocated. If the allocation of each member fails, the array itself +is freed and returned with an error code. However, the array is later +freed again in si_dpm_fini() function which is called when the function +returns an error. + +This leads to potential double free of the array adev->pm.dpm.ps, as +well as leak of its array members, since the members are not freed in +the allocation function and the array is not nulled when freed. +In addition adev->pm.dpm.num_ps, which keeps track of the allocated +array member, is not updated until the member allocation is +successfully finished, this could also lead to either use after free, +or uninitialized variable access in si_dpm_fini(). + +Fix this by postponing the free of the array until si_dpm_fini() and +increment adev->pm.dpm.num_ps everytime the array member is allocated. + +Signed-off-by: Keita Suzuki +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 8 +++----- + 1 file changed, 3 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c +index 633dab14f51c..49c398ec0aaf 100644 +--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c ++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c +@@ -7297,17 +7297,15 @@ static int si_parse_power_table(struct amdgpu_device *adev) + if (!adev->pm.dpm.ps) + return -ENOMEM; + power_state_offset = (u8 *)state_array->states; +- for (i = 0; i < state_array->ucNumEntries; i++) { ++ for (adev->pm.dpm.num_ps = 0, i = 0; i < state_array->ucNumEntries; i++) { + u8 *idx; + power_state = (union pplib_power_state *)power_state_offset; + non_clock_array_index = power_state->v2.nonClockInfoIndex; + non_clock_info = (struct _ATOM_PPLIB_NONCLOCK_INFO *) + &non_clock_info_array->nonClockInfo[non_clock_array_index]; + ps = kzalloc(sizeof(struct si_ps), GFP_KERNEL); +- if (ps == NULL) { +- kfree(adev->pm.dpm.ps); ++ if (ps == NULL) + return -ENOMEM; +- } + adev->pm.dpm.ps[i].ps_priv = ps; + si_parse_pplib_non_clock_info(adev, &adev->pm.dpm.ps[i], + non_clock_info, +@@ -7329,8 +7327,8 @@ static int si_parse_power_table(struct amdgpu_device *adev) + k++; + } + power_state_offset += 2 + power_state->v2.ucNumDPMLevels; ++ adev->pm.dpm.num_ps++; + } +- adev->pm.dpm.num_ps = state_array->ucNumEntries; + + /* fill in the vce power states */ + for (i = 0; i < adev->pm.dpm.num_of_vce_states; i++) { +-- +2.35.1 + diff --git a/queue-5.18/drm-amd-pm-fix-the-compile-warning.patch b/queue-5.18/drm-amd-pm-fix-the-compile-warning.patch new file mode 100644 index 00000000000..b127c7142c3 --- /dev/null +++ b/queue-5.18/drm-amd-pm-fix-the-compile-warning.patch @@ -0,0 +1,51 @@ +From 6bfeab86235696310dafd77b398a4552af6984fd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Apr 2022 10:16:46 +0800 +Subject: drm/amd/pm: fix the compile warning + +From: Evan Quan + +[ Upstream commit 555238d92ac32dbad2d77ad2bafc48d17391990c ] + +Fix the compile warning below: +drivers/gpu/drm/amd/amdgpu/../pm/legacy-dpm/kv_dpm.c:1641 +kv_get_acp_boot_level() warn: always true condition '(table->entries[i]->clk >= 0) => (0-u32max >= 0)' + +Reported-by: kernel test robot +CC: Alex Deucher +Signed-off-by: Evan Quan +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c | 14 +------------- + 1 file changed, 1 insertion(+), 13 deletions(-) + +diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c +index 8b23cc9f098a..8fd0782a2b20 100644 +--- a/drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c ++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c +@@ -1623,19 +1623,7 @@ static int kv_update_samu_dpm(struct amdgpu_device *adev, bool gate) + + static u8 kv_get_acp_boot_level(struct amdgpu_device *adev) + { +- u8 i; +- struct amdgpu_clock_voltage_dependency_table *table = +- &adev->pm.dpm.dyn_state.acp_clock_voltage_dependency_table; +- +- for (i = 0; i < table->count; i++) { +- if (table->entries[i].clk >= 0) /* XXX */ +- break; +- } +- +- if (i >= table->count) +- i = table->count - 1; +- +- return i; ++ return 0; + } + + static void kv_update_acp_boot_level(struct amdgpu_device *adev) +-- +2.35.1 + diff --git a/queue-5.18/drm-amd-pm-update-smartshift-powerboost-calc-for-smu.patch b/queue-5.18/drm-amd-pm-update-smartshift-powerboost-calc-for-smu.patch new file mode 100644 index 00000000000..4ea373965e9 --- /dev/null +++ b/queue-5.18/drm-amd-pm-update-smartshift-powerboost-calc-for-smu.patch @@ -0,0 +1,113 @@ +From 3d4d27890b961b84a7139c77960fbee1cca06f67 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 May 2022 16:06:12 +0530 +Subject: drm/amd/pm: update smartshift powerboost calc for smu12 + +From: Sathishkumar S + +[ Upstream commit 138292f1dc00e7e0724f44769f9da39cf2f3bf0b ] + +smartshift apu and dgpu power boost are reported as percentage with +respect to their power limits. This value[0-100] reflects the boost +for the respective device. + +Signed-off-by: Sathishkumar S +Reviewed-by: Lijo Lazar +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../gpu/drm/amd/pm/swsmu/smu12/renoir_ppt.c | 60 ++++++++++++++----- + 1 file changed, 44 insertions(+), 16 deletions(-) + +diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu12/renoir_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu12/renoir_ppt.c +index fd6c44ece168..012e3bd99cc2 100644 +--- a/drivers/gpu/drm/amd/pm/swsmu/smu12/renoir_ppt.c ++++ b/drivers/gpu/drm/amd/pm/swsmu/smu12/renoir_ppt.c +@@ -1119,6 +1119,39 @@ static int renoir_get_power_profile_mode(struct smu_context *smu, + return size; + } + ++static void renoir_get_ss_power_percent(SmuMetrics_t *metrics, ++ uint32_t *apu_percent, uint32_t *dgpu_percent) ++{ ++ uint32_t apu_boost = 0; ++ uint32_t dgpu_boost = 0; ++ uint16_t apu_limit = 0; ++ uint16_t dgpu_limit = 0; ++ uint16_t apu_power = 0; ++ uint16_t dgpu_power = 0; ++ ++ apu_power = metrics->ApuPower; ++ apu_limit = metrics->StapmOriginalLimit; ++ if (apu_power > apu_limit && apu_limit != 0) ++ apu_boost = ((apu_power - apu_limit) * 100) / apu_limit; ++ apu_boost = (apu_boost > 100) ? 100 : apu_boost; ++ ++ dgpu_power = metrics->dGpuPower; ++ if (metrics->StapmCurrentLimit > metrics->StapmOriginalLimit) ++ dgpu_limit = metrics->StapmCurrentLimit - metrics->StapmOriginalLimit; ++ if (dgpu_power > dgpu_limit && dgpu_limit != 0) ++ dgpu_boost = ((dgpu_power - dgpu_limit) * 100) / dgpu_limit; ++ dgpu_boost = (dgpu_boost > 100) ? 100 : dgpu_boost; ++ ++ if (dgpu_boost >= apu_boost) ++ apu_boost = 0; ++ else ++ dgpu_boost = 0; ++ ++ *apu_percent = apu_boost; ++ *dgpu_percent = dgpu_boost; ++} ++ ++ + static int renoir_get_smu_metrics_data(struct smu_context *smu, + MetricsMember_t member, + uint32_t *value) +@@ -1127,6 +1160,9 @@ static int renoir_get_smu_metrics_data(struct smu_context *smu, + + SmuMetrics_t *metrics = (SmuMetrics_t *)smu_table->metrics_table; + int ret = 0; ++ uint32_t apu_percent = 0; ++ uint32_t dgpu_percent = 0; ++ + + ret = smu_cmn_get_metrics_table(smu, + NULL, +@@ -1171,26 +1207,18 @@ static int renoir_get_smu_metrics_data(struct smu_context *smu, + *value = metrics->Voltage[1]; + break; + case METRICS_SS_APU_SHARE: +- /* return the percentage of APU power with respect to APU's power limit. +- * percentage is reported, this isn't boost value. Smartshift power +- * boost/shift is only when the percentage is more than 100. ++ /* return the percentage of APU power boost ++ * with respect to APU's power limit. + */ +- if (metrics->StapmOriginalLimit > 0) +- *value = (metrics->ApuPower * 100) / metrics->StapmOriginalLimit; +- else +- *value = 0; ++ renoir_get_ss_power_percent(metrics, &apu_percent, &dgpu_percent); ++ *value = apu_percent; + break; + case METRICS_SS_DGPU_SHARE: +- /* return the percentage of dGPU power with respect to dGPU's power limit. +- * percentage is reported, this isn't boost value. Smartshift power +- * boost/shift is only when the percentage is more than 100. ++ /* return the percentage of dGPU power boost ++ * with respect to dGPU's power limit. + */ +- if ((metrics->dGpuPower > 0) && +- (metrics->StapmCurrentLimit > metrics->StapmOriginalLimit)) +- *value = (metrics->dGpuPower * 100) / +- (metrics->StapmCurrentLimit - metrics->StapmOriginalLimit); +- else +- *value = 0; ++ renoir_get_ss_power_percent(metrics, &apu_percent, &dgpu_percent); ++ *value = dgpu_percent; + break; + default: + *value = UINT_MAX; +-- +2.35.1 + diff --git a/queue-5.18/drm-amd-pm-update-smartshift-powerboost-calc-for-smu.patch-446 b/queue-5.18/drm-amd-pm-update-smartshift-powerboost-calc-for-smu.patch-446 new file mode 100644 index 00000000000..10f6f69edbc --- /dev/null +++ b/queue-5.18/drm-amd-pm-update-smartshift-powerboost-calc-for-smu.patch-446 @@ -0,0 +1,115 @@ +From 36aa78f6610927ba1e35a7c808cd468eb8f02d80 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 May 2022 16:35:59 +0530 +Subject: drm/amd/pm: update smartshift powerboost calc for smu13 + +From: Sathishkumar S + +[ Upstream commit cdf4c8ec39872a61a58d62f19b4db80f0f7bc586 ] + +smartshift apu and dgpu power boost are reported as percentage +with respect to their power limits. adjust the units of power before +calculating the percentage of boost. + +Signed-off-by: Sathishkumar S +Reviewed-by: Lijo Lazar +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../drm/amd/pm/swsmu/smu13/yellow_carp_ppt.c | 62 ++++++++++++++----- + 1 file changed, 46 insertions(+), 16 deletions(-) + +diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/yellow_carp_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu13/yellow_carp_ppt.c +index e2d099409123..87257b1b028f 100644 +--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/yellow_carp_ppt.c ++++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/yellow_carp_ppt.c +@@ -276,6 +276,42 @@ static int yellow_carp_mode2_reset(struct smu_context *smu) + return yellow_carp_mode_reset(smu, SMU_RESET_MODE_2); + } + ++ ++static void yellow_carp_get_ss_power_percent(SmuMetrics_t *metrics, ++ uint32_t *apu_percent, uint32_t *dgpu_percent) ++{ ++ uint32_t apu_boost = 0; ++ uint32_t dgpu_boost = 0; ++ uint16_t apu_limit = 0; ++ uint16_t dgpu_limit = 0; ++ uint16_t apu_power = 0; ++ uint16_t dgpu_power = 0; ++ ++ /* APU and dGPU power values are reported in milli Watts ++ * and STAPM power limits are in Watts */ ++ apu_power = metrics->ApuPower/1000; ++ apu_limit = metrics->StapmOpnLimit; ++ if (apu_power > apu_limit && apu_limit != 0) ++ apu_boost = ((apu_power - apu_limit) * 100) / apu_limit; ++ apu_boost = (apu_boost > 100) ? 100 : apu_boost; ++ ++ dgpu_power = metrics->dGpuPower/1000; ++ if (metrics->StapmCurrentLimit > metrics->StapmOpnLimit) ++ dgpu_limit = metrics->StapmCurrentLimit - metrics->StapmOpnLimit; ++ if (dgpu_power > dgpu_limit && dgpu_limit != 0) ++ dgpu_boost = ((dgpu_power - dgpu_limit) * 100) / dgpu_limit; ++ dgpu_boost = (dgpu_boost > 100) ? 100 : dgpu_boost; ++ ++ if (dgpu_boost >= apu_boost) ++ apu_boost = 0; ++ else ++ dgpu_boost = 0; ++ ++ *apu_percent = apu_boost; ++ *dgpu_percent = dgpu_boost; ++ ++} ++ + static int yellow_carp_get_smu_metrics_data(struct smu_context *smu, + MetricsMember_t member, + uint32_t *value) +@@ -284,6 +320,8 @@ static int yellow_carp_get_smu_metrics_data(struct smu_context *smu, + + SmuMetrics_t *metrics = (SmuMetrics_t *)smu_table->metrics_table; + int ret = 0; ++ uint32_t apu_percent = 0; ++ uint32_t dgpu_percent = 0; + + ret = smu_cmn_get_metrics_table(smu, NULL, false); + if (ret) +@@ -332,26 +370,18 @@ static int yellow_carp_get_smu_metrics_data(struct smu_context *smu, + *value = metrics->Voltage[1]; + break; + case METRICS_SS_APU_SHARE: +- /* return the percentage of APU power with respect to APU's power limit. +- * percentage is reported, this isn't boost value. Smartshift power +- * boost/shift is only when the percentage is more than 100. ++ /* return the percentage of APU power boost ++ * with respect to APU's power limit. + */ +- if (metrics->StapmOpnLimit > 0) +- *value = (metrics->ApuPower * 100) / metrics->StapmOpnLimit; +- else +- *value = 0; ++ yellow_carp_get_ss_power_percent(metrics, &apu_percent, &dgpu_percent); ++ *value = apu_percent; + break; + case METRICS_SS_DGPU_SHARE: +- /* return the percentage of dGPU power with respect to dGPU's power limit. +- * percentage is reported, this isn't boost value. Smartshift power +- * boost/shift is only when the percentage is more than 100. ++ /* return the percentage of dGPU power boost ++ * with respect to dGPU's power limit. + */ +- if ((metrics->dGpuPower > 0) && +- (metrics->StapmCurrentLimit > metrics->StapmOpnLimit)) +- *value = (metrics->dGpuPower * 100) / +- (metrics->StapmCurrentLimit - metrics->StapmOpnLimit); +- else +- *value = 0; ++ yellow_carp_get_ss_power_percent(metrics, &apu_percent, &dgpu_percent); ++ *value = dgpu_percent; + break; + default: + *value = UINT_MAX; +-- +2.35.1 + diff --git a/queue-5.18/drm-amdgpu-move-mutex_init-smu-message_lock-to-smu_e.patch b/queue-5.18/drm-amdgpu-move-mutex_init-smu-message_lock-to-smu_e.patch new file mode 100644 index 00000000000..837084dca4f --- /dev/null +++ b/queue-5.18/drm-amdgpu-move-mutex_init-smu-message_lock-to-smu_e.patch @@ -0,0 +1,130 @@ +From f9e4956a31115b26efbc6a4981c40b61eb7990d8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 May 2022 22:45:33 +0200 +Subject: drm/amdgpu: Move mutex_init(&smu->message_lock) to smu_early_init() + +From: Hans de Goede + +[ Upstream commit 4b9caaa0281972ca5ea4e1cdac2e12b9df1ae00b ] + +Lockdep complains about the smu->message_lock mutex being used before +it is initialized through the following call path: + +amdgpu_device_init() + amdgpu_dpm_mode2_reset() + smu_mode2_reset() + smu_v12_0_mode2_reset() + smu_cmn_send_smc_msg_with_param() + +Move the mutex_init() call to smu_early_init() to fix the mutex being +used before it is initialized. + +This fixes the following lockdep splat: + +[ 3.867331] ------------[ cut here ]------------ +[ 3.867335] fbcon: Taking over console +[ 3.867338] DEBUG_LOCKS_WARN_ON(lock->magic != lock) +[ 3.867340] WARNING: CPU: 14 PID: 491 at kernel/locking/mutex.c:579 __mutex_lock+0x44c/0x830 +[ 3.867349] Modules linked in: amdgpu(+) crct10dif_pclmul drm_ttm_helper crc32_pclmul ttm crc32c_intel ghash_clmulni_intel hid_lg_g15 iommu_v2 sp5100_tco nvme gpu_sched drm_dp_helper nvme_core ccp wmi video hid_logitech_dj ip6_tables ip_tables ipmi_devintf ipmi_msghandler fuse i2c_dev +[ 3.867363] CPU: 14 PID: 491 Comm: systemd-udevd Tainted: G I 5.18.0-rc5+ #33 +[ 3.867366] Hardware name: Micro-Star International Co., Ltd. MS-7C95/B550M PRO-VDH WIFI (MS-7C95), BIOS 2.90 12/23/2021 +[ 3.867369] RIP: 0010:__mutex_lock+0x44c/0x830 +[ 3.867372] Code: ff 85 c0 0f 84 33 fc ff ff 8b 0d b7 50 25 01 85 c9 0f 85 25 fc ff ff 48 c7 c6 fb 41 82 99 48 c7 c7 6b 63 80 99 e8 88 2a f8 ff <0f> 0b e9 0b fc ff ff f6 83 b9 0c 00 00 01 0f 85 64 ff ff ff 4c 89 +[ 3.867377] RSP: 0018:ffffaef8c0fc79f0 EFLAGS: 00010286 +[ 3.867380] RAX: 0000000000000028 RBX: 0000000000000000 RCX: 0000000000000027 +[ 3.867382] RDX: ffff9ccc0dda0928 RSI: 0000000000000001 RDI: ffff9ccc0dda0920 +[ 3.867384] RBP: ffffaef8c0fc7a80 R08: 0000000000000000 R09: ffffaef8c0fc7820 +[ 3.867386] R10: 0000000000000003 R11: ffff9ccc2a2fffe8 R12: 0000000000000002 +[ 3.867388] R13: ffff9cc990808058 R14: 0000000000000000 R15: ffff9cc98bfc0000 +[ 3.867390] FS: 00007fc4d830f580(0000) GS:ffff9ccc0dd80000(0000) knlGS:0000000000000000 +[ 3.867394] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 3.867396] CR2: 0000560a77031410 CR3: 000000010f522000 CR4: 0000000000750ee0 +[ 3.867398] PKRU: 55555554 +[ 3.867399] Call Trace: +[ 3.867401] +[ 3.867403] ? smu_cmn_send_smc_msg_with_param+0x98/0x240 [amdgpu] +[ 3.867533] ? __mutex_lock+0x90/0x830 +[ 3.867535] ? amdgpu_dpm_mode2_reset+0x37/0x60 [amdgpu] +[ 3.867653] ? smu_cmn_send_smc_msg_with_param+0x98/0x240 [amdgpu] +[ 3.867758] smu_cmn_send_smc_msg_with_param+0x98/0x240 [amdgpu] +[ 3.867857] smu_mode2_reset+0x2b/0x50 [amdgpu] +[ 3.867953] amdgpu_dpm_mode2_reset+0x46/0x60 [amdgpu] +[ 3.868096] amdgpu_device_init.cold+0x1069/0x1e78 [amdgpu] +[ 3.868219] ? _raw_spin_unlock_irqrestore+0x30/0x50 +[ 3.868222] ? pci_conf1_read+0x9b/0xf0 +[ 3.868226] amdgpu_driver_load_kms+0x15/0x110 [amdgpu] +[ 3.868314] amdgpu_pci_probe+0x1a9/0x3c0 [amdgpu] +[ 3.868398] local_pci_probe+0x41/0x80 +[ 3.868401] pci_device_probe+0xab/0x200 +[ 3.868404] really_probe+0x1a1/0x370 +[ 3.868407] __driver_probe_device+0xfc/0x170 +[ 3.868410] driver_probe_device+0x1f/0x90 +[ 3.868412] __driver_attach+0xbf/0x1a0 +[ 3.868414] ? __device_attach_driver+0xe0/0xe0 +[ 3.868416] bus_for_each_dev+0x65/0x90 +[ 3.868419] bus_add_driver+0x151/0x1f0 +[ 3.868421] driver_register+0x89/0xd0 +[ 3.868423] ? 0xffffffffc0bd4000 +[ 3.868425] do_one_initcall+0x5d/0x300 +[ 3.868428] ? do_init_module+0x22/0x240 +[ 3.868431] ? rcu_read_lock_sched_held+0x3c/0x70 +[ 3.868434] ? trace_kmalloc+0x30/0xe0 +[ 3.868437] ? kmem_cache_alloc_trace+0x1e6/0x3a0 +[ 3.868440] do_init_module+0x4a/0x240 +[ 3.868442] __do_sys_finit_module+0x93/0xf0 +[ 3.868446] do_syscall_64+0x5b/0x80 +[ 3.868449] ? rcu_read_lock_sched_held+0x3c/0x70 +[ 3.868451] ? lockdep_hardirqs_on_prepare+0xd9/0x180 +[ 3.868454] ? do_syscall_64+0x67/0x80 +[ 3.868456] ? do_syscall_64+0x67/0x80 +[ 3.868458] ? do_syscall_64+0x67/0x80 +[ 3.868460] ? do_syscall_64+0x67/0x80 +[ 3.868462] entry_SYSCALL_64_after_hwframe+0x44/0xae +[ 3.868465] RIP: 0033:0x7fc4d8ec1ced +[ 3.868467] Code: 5d c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d fb 70 0e 00 f7 d8 64 89 01 48 +[ 3.868472] RSP: 002b:00007fff687ae6b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 +[ 3.868475] RAX: ffffffffffffffda RBX: 0000560a76fbca60 RCX: 00007fc4d8ec1ced +[ 3.868477] RDX: 0000000000000000 RSI: 00007fc4d902343c RDI: 0000000000000011 +[ 3.868479] RBP: 00007fc4d902343c R08: 0000000000000000 R09: 0000560a76fb59c0 +[ 3.868481] R10: 0000000000000011 R11: 0000000000000246 R12: 0000000000020000 +[ 3.868484] R13: 0000560a76f8bfd0 R14: 0000000000000000 R15: 0000560a76fc2d10 +[ 3.868487] +[ 3.868489] irq event stamp: 120617 +[ 3.868490] hardirqs last enabled at (120617): [] __up_console_sem+0x5e/0x70 +[ 3.868494] hardirqs last disabled at (120616): [] __up_console_sem+0x43/0x70 +[ 3.868497] softirqs last enabled at (119684): [] __irq_exit_rcu+0xca/0x100 +[ 3.868501] softirqs last disabled at (119679): [] __irq_exit_rcu+0xca/0x100 +[ 3.868504] ---[ end trace 0000000000000000 ]--- + +Signed-off-by: Hans de Goede +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c b/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c +index f10a0256413e..32cff21f261c 100644 +--- a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c ++++ b/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c +@@ -576,6 +576,8 @@ static int smu_early_init(void *handle) + smu->smu_baco.platform_support = false; + smu->user_dpm_profile.fan_mode = -1; + ++ mutex_init(&smu->message_lock); ++ + adev->powerplay.pp_handle = smu; + adev->powerplay.pp_funcs = &swsmu_pm_funcs; + +@@ -975,8 +977,6 @@ static int smu_sw_init(void *handle) + bitmap_zero(smu->smu_feature.supported, SMU_FEATURE_MAX); + bitmap_zero(smu->smu_feature.allowed, SMU_FEATURE_MAX); + +- mutex_init(&smu->message_lock); +- + INIT_WORK(&smu->throttling_logging_work, smu_throttling_logging_work_fn); + INIT_WORK(&smu->interrupt_work, smu_interrupt_work_fn); + atomic64_set(&smu->throttle_int_counter, 0); +-- +2.35.1 + diff --git a/queue-5.18/drm-amdgpu-pm-fix-the-null-pointer-while-the-smu-is-.patch b/queue-5.18/drm-amdgpu-pm-fix-the-null-pointer-while-the-smu-is-.patch new file mode 100644 index 00000000000..e3af5948361 --- /dev/null +++ b/queue-5.18/drm-amdgpu-pm-fix-the-null-pointer-while-the-smu-is-.patch @@ -0,0 +1,67 @@ +From 862a67539bf9792749f8002ca49ddc6b06fbcbfe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Apr 2022 21:04:59 +0800 +Subject: drm/amdgpu/pm: fix the null pointer while the smu is disabled + +From: Huang Rui + +[ Upstream commit eea5c7b3390c6e006ba4cbd906447dd8cea8cfbf ] + +It needs to check if the pp_funcs is initialized while release the +context, otherwise it will trigger null pointer panic while the software +smu is not enabled. + +[ 1109.404555] BUG: kernel NULL pointer dereference, address: 0000000000000078 +[ 1109.404609] #PF: supervisor read access in kernel mode +[ 1109.404638] #PF: error_code(0x0000) - not-present page +[ 1109.404657] PGD 0 P4D 0 +[ 1109.404672] Oops: 0000 [#1] PREEMPT SMP NOPTI +[ 1109.404701] CPU: 7 PID: 9150 Comm: amdgpu_test Tainted: G OEL 5.16.0-custom #1 +[ 1109.404732] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 +[ 1109.404765] RIP: 0010:amdgpu_dpm_force_performance_level+0x1d/0x170 [amdgpu] +[ 1109.405109] Code: 5d c3 44 8b a3 f0 80 00 00 eb e5 66 90 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 41 55 41 54 53 48 83 ec 08 4c 8b b7 f0 7d 00 00 <49> 83 7e 78 00 0f 84 f2 00 00 00 80 bf 87 80 00 00 00 48 89 fb 0f +[ 1109.405176] RSP: 0018:ffffaf3083ad7c20 EFLAGS: 00010282 +[ 1109.405203] RAX: 0000000000000000 RBX: ffff9796b1c14600 RCX: 0000000002862007 +[ 1109.405229] RDX: ffff97968591c8c0 RSI: 0000000000000001 RDI: ffff9796a3700000 +[ 1109.405260] RBP: ffffaf3083ad7c50 R08: ffffffff9897de00 R09: ffff979688d9db60 +[ 1109.405286] R10: 0000000000000000 R11: ffff979688d9db90 R12: 0000000000000001 +[ 1109.405316] R13: ffff9796a3700000 R14: 0000000000000000 R15: ffff9796a3708fc0 +[ 1109.405345] FS: 00007ff055cff180(0000) GS:ffff9796bfdc0000(0000) knlGS:0000000000000000 +[ 1109.405378] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 1109.405400] CR2: 0000000000000078 CR3: 000000000a394000 CR4: 00000000000506e0 +[ 1109.405434] Call Trace: +[ 1109.405445] +[ 1109.405456] ? delete_object_full+0x1d/0x20 +[ 1109.405480] amdgpu_ctx_set_stable_pstate+0x7c/0xa0 [amdgpu] +[ 1109.405698] amdgpu_ctx_fini.part.0+0xcb/0x100 [amdgpu] +[ 1109.405911] amdgpu_ctx_do_release+0x71/0x80 [amdgpu] +[ 1109.406121] amdgpu_ctx_ioctl+0x52d/0x550 [amdgpu] +[ 1109.406327] ? _raw_spin_unlock+0x1a/0x30 +[ 1109.406354] ? drm_gem_handle_delete+0x81/0xb0 [drm] +[ 1109.406400] ? amdgpu_ctx_get_entity+0x2c0/0x2c0 [amdgpu] +[ 1109.406609] drm_ioctl_kernel+0xb6/0x140 [drm] + +Signed-off-by: Huang Rui +Reviewed-by: Aaron Liu +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/amdgpu_dpm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/pm/amdgpu_dpm.c b/drivers/gpu/drm/amd/pm/amdgpu_dpm.c +index 72e7b5d40af6..5472f9936feb 100644 +--- a/drivers/gpu/drm/amd/pm/amdgpu_dpm.c ++++ b/drivers/gpu/drm/amd/pm/amdgpu_dpm.c +@@ -790,7 +790,7 @@ int amdgpu_dpm_force_performance_level(struct amdgpu_device *adev, + AMD_DPM_FORCED_LEVEL_PROFILE_MIN_MCLK | + AMD_DPM_FORCED_LEVEL_PROFILE_PEAK; + +- if (!pp_funcs->force_performance_level) ++ if (!pp_funcs || !pp_funcs->force_performance_level) + return 0; + + if (adev->pm.dpm.thermal_active) +-- +2.35.1 + diff --git a/queue-5.18/drm-amdgpu-psp-move-psp-memory-alloc-from-hw_init-to.patch b/queue-5.18/drm-amdgpu-psp-move-psp-memory-alloc-from-hw_init-to.patch new file mode 100644 index 00000000000..07f992a707b --- /dev/null +++ b/queue-5.18/drm-amdgpu-psp-move-psp-memory-alloc-from-hw_init-to.patch @@ -0,0 +1,158 @@ +From 6d0d669baf77b651f24043529e36ecdd3f5c75d9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Apr 2022 01:21:52 -0400 +Subject: drm/amdgpu/psp: move PSP memory alloc from hw_init to sw_init + +From: Alex Deucher + +[ Upstream commit b95b5391684b39695887afb4a13cccee7820f5d6 ] + +Memory allocations should be done in sw_init. hw_init should +just be hardware programming needed to initialize the IP block. +This is how most other IP blocks work. Move the GPU memory +allocations from psp hw_init to psp sw_init and move the memory +free to sw_fini. This also fixes a potential GPU memory leak +if psp hw_init fails. + +Reviewed-by: Hawking Zhang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 95 ++++++++++++------------- + 1 file changed, 47 insertions(+), 48 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +index a6acec1a6155..21aa556a6bef 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +@@ -357,7 +357,39 @@ static int psp_sw_init(void *handle) + } + } + ++ ret = amdgpu_bo_create_kernel(adev, PSP_1_MEG, PSP_1_MEG, ++ amdgpu_sriov_vf(adev) ? ++ AMDGPU_GEM_DOMAIN_VRAM : AMDGPU_GEM_DOMAIN_GTT, ++ &psp->fw_pri_bo, ++ &psp->fw_pri_mc_addr, ++ &psp->fw_pri_buf); ++ if (ret) ++ return ret; ++ ++ ret = amdgpu_bo_create_kernel(adev, PSP_FENCE_BUFFER_SIZE, PAGE_SIZE, ++ AMDGPU_GEM_DOMAIN_VRAM, ++ &psp->fence_buf_bo, ++ &psp->fence_buf_mc_addr, ++ &psp->fence_buf); ++ if (ret) ++ goto failed1; ++ ++ ret = amdgpu_bo_create_kernel(adev, PSP_CMD_BUFFER_SIZE, PAGE_SIZE, ++ AMDGPU_GEM_DOMAIN_VRAM, ++ &psp->cmd_buf_bo, &psp->cmd_buf_mc_addr, ++ (void **)&psp->cmd_buf_mem); ++ if (ret) ++ goto failed2; ++ + return 0; ++ ++failed2: ++ amdgpu_bo_free_kernel(&psp->fw_pri_bo, ++ &psp->fw_pri_mc_addr, &psp->fw_pri_buf); ++failed1: ++ amdgpu_bo_free_kernel(&psp->fence_buf_bo, ++ &psp->fence_buf_mc_addr, &psp->fence_buf); ++ return ret; + } + + static int psp_sw_fini(void *handle) +@@ -391,6 +423,13 @@ static int psp_sw_fini(void *handle) + kfree(cmd); + cmd = NULL; + ++ amdgpu_bo_free_kernel(&psp->fw_pri_bo, ++ &psp->fw_pri_mc_addr, &psp->fw_pri_buf); ++ amdgpu_bo_free_kernel(&psp->fence_buf_bo, ++ &psp->fence_buf_mc_addr, &psp->fence_buf); ++ amdgpu_bo_free_kernel(&psp->cmd_buf_bo, &psp->cmd_buf_mc_addr, ++ (void **)&psp->cmd_buf_mem); ++ + return 0; + } + +@@ -2430,51 +2469,18 @@ static int psp_load_fw(struct amdgpu_device *adev) + struct psp_context *psp = &adev->psp; + + if (amdgpu_sriov_vf(adev) && amdgpu_in_reset(adev)) { +- psp_ring_stop(psp, PSP_RING_TYPE__KM); /* should not destroy ring, only stop */ +- goto skip_memalloc; +- } +- +- if (amdgpu_sriov_vf(adev)) { +- ret = amdgpu_bo_create_kernel(adev, PSP_1_MEG, PSP_1_MEG, +- AMDGPU_GEM_DOMAIN_VRAM, +- &psp->fw_pri_bo, +- &psp->fw_pri_mc_addr, +- &psp->fw_pri_buf); ++ /* should not destroy ring, only stop */ ++ psp_ring_stop(psp, PSP_RING_TYPE__KM); + } else { +- ret = amdgpu_bo_create_kernel(adev, PSP_1_MEG, PSP_1_MEG, +- AMDGPU_GEM_DOMAIN_GTT, +- &psp->fw_pri_bo, +- &psp->fw_pri_mc_addr, +- &psp->fw_pri_buf); +- } +- +- if (ret) +- goto failed; +- +- ret = amdgpu_bo_create_kernel(adev, PSP_FENCE_BUFFER_SIZE, PAGE_SIZE, +- AMDGPU_GEM_DOMAIN_VRAM, +- &psp->fence_buf_bo, +- &psp->fence_buf_mc_addr, +- &psp->fence_buf); +- if (ret) +- goto failed; +- +- ret = amdgpu_bo_create_kernel(adev, PSP_CMD_BUFFER_SIZE, PAGE_SIZE, +- AMDGPU_GEM_DOMAIN_VRAM, +- &psp->cmd_buf_bo, &psp->cmd_buf_mc_addr, +- (void **)&psp->cmd_buf_mem); +- if (ret) +- goto failed; ++ memset(psp->fence_buf, 0, PSP_FENCE_BUFFER_SIZE); + +- memset(psp->fence_buf, 0, PSP_FENCE_BUFFER_SIZE); +- +- ret = psp_ring_init(psp, PSP_RING_TYPE__KM); +- if (ret) { +- DRM_ERROR("PSP ring init failed!\n"); +- goto failed; ++ ret = psp_ring_init(psp, PSP_RING_TYPE__KM); ++ if (ret) { ++ DRM_ERROR("PSP ring init failed!\n"); ++ goto failed; ++ } + } + +-skip_memalloc: + ret = psp_hw_start(psp); + if (ret) + goto failed; +@@ -2592,13 +2598,6 @@ static int psp_hw_fini(void *handle) + psp_tmr_terminate(psp); + psp_ring_destroy(psp, PSP_RING_TYPE__KM); + +- amdgpu_bo_free_kernel(&psp->fw_pri_bo, +- &psp->fw_pri_mc_addr, &psp->fw_pri_buf); +- amdgpu_bo_free_kernel(&psp->fence_buf_bo, +- &psp->fence_buf_mc_addr, &psp->fence_buf); +- amdgpu_bo_free_kernel(&psp->cmd_buf_bo, &psp->cmd_buf_mc_addr, +- (void **)&psp->cmd_buf_mem); +- + return 0; + } + +-- +2.35.1 + diff --git a/queue-5.18/drm-amdgpu-sdma-fix-incorrect-calculations-of-the-wp.patch b/queue-5.18/drm-amdgpu-sdma-fix-incorrect-calculations-of-the-wp.patch new file mode 100644 index 00000000000..1c36ecd005b --- /dev/null +++ b/queue-5.18/drm-amdgpu-sdma-fix-incorrect-calculations-of-the-wp.patch @@ -0,0 +1,103 @@ +From a12822f660b9277c743388ddf2b8e1f129c30678 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Apr 2022 20:41:38 +0800 +Subject: drm/amdgpu/sdma: Fix incorrect calculations of the wptr of the + doorbells +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Haohui Mai + +[ Upstream commit 7dba6e838e741caadcf27ef717b6dcb561e77f89 ] + +This patch fixes the issue where the driver miscomputes the 64-bit +values of the wptr of the SDMA doorbell when initializing the +hardware. SDMA engines v4 and later on have full 64-bit registers for +wptr thus they should be set properly. + +Older generation hardwares like CIK / SI have only 16 / 20 / 24bits +for the WPTR, where the calls of lower_32_bits() will be removed in a +following patch. + +Reviewed-by: Christian König +Signed-off-by: Haohui Mai +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c | 4 ++-- + drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c | 8 ++++---- + drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c | 8 ++++---- + 3 files changed, 10 insertions(+), 10 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c b/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c +index d7e8f7232364..ff86c43b63d1 100644 +--- a/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c +@@ -772,8 +772,8 @@ static void sdma_v4_0_ring_set_wptr(struct amdgpu_ring *ring) + + DRM_DEBUG("Using doorbell -- " + "wptr_offs == 0x%08x " +- "lower_32_bits(ring->wptr) << 2 == 0x%08x " +- "upper_32_bits(ring->wptr) << 2 == 0x%08x\n", ++ "lower_32_bits(ring->wptr << 2) == 0x%08x " ++ "upper_32_bits(ring->wptr << 2) == 0x%08x\n", + ring->wptr_offs, + lower_32_bits(ring->wptr << 2), + upper_32_bits(ring->wptr << 2)); +diff --git a/drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c b/drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c +index a8d49c005f73..627eb1f147c2 100644 +--- a/drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c +@@ -394,8 +394,8 @@ static void sdma_v5_0_ring_set_wptr(struct amdgpu_ring *ring) + if (ring->use_doorbell) { + DRM_DEBUG("Using doorbell -- " + "wptr_offs == 0x%08x " +- "lower_32_bits(ring->wptr) << 2 == 0x%08x " +- "upper_32_bits(ring->wptr) << 2 == 0x%08x\n", ++ "lower_32_bits(ring->wptr << 2) == 0x%08x " ++ "upper_32_bits(ring->wptr << 2) == 0x%08x\n", + ring->wptr_offs, + lower_32_bits(ring->wptr << 2), + upper_32_bits(ring->wptr << 2)); +@@ -774,9 +774,9 @@ static int sdma_v5_0_gfx_resume(struct amdgpu_device *adev) + + if (!amdgpu_sriov_vf(adev)) { /* only bare-metal use register write for wptr */ + WREG32(sdma_v5_0_get_reg_offset(adev, i, mmSDMA0_GFX_RB_WPTR), +- lower_32_bits(ring->wptr) << 2); ++ lower_32_bits(ring->wptr << 2)); + WREG32(sdma_v5_0_get_reg_offset(adev, i, mmSDMA0_GFX_RB_WPTR_HI), +- upper_32_bits(ring->wptr) << 2); ++ upper_32_bits(ring->wptr << 2)); + } + + doorbell = RREG32_SOC15_IP(GC, sdma_v5_0_get_reg_offset(adev, i, mmSDMA0_GFX_DOORBELL)); +diff --git a/drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c b/drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c +index 824eace69884..a5eb82bfeaa8 100644 +--- a/drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c ++++ b/drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c +@@ -295,8 +295,8 @@ static void sdma_v5_2_ring_set_wptr(struct amdgpu_ring *ring) + if (ring->use_doorbell) { + DRM_DEBUG("Using doorbell -- " + "wptr_offs == 0x%08x " +- "lower_32_bits(ring->wptr) << 2 == 0x%08x " +- "upper_32_bits(ring->wptr) << 2 == 0x%08x\n", ++ "lower_32_bits(ring->wptr << 2) == 0x%08x " ++ "upper_32_bits(ring->wptr << 2) == 0x%08x\n", + ring->wptr_offs, + lower_32_bits(ring->wptr << 2), + upper_32_bits(ring->wptr << 2)); +@@ -672,8 +672,8 @@ static int sdma_v5_2_gfx_resume(struct amdgpu_device *adev) + WREG32_SOC15_IP(GC, sdma_v5_2_get_reg_offset(adev, i, mmSDMA0_GFX_MINOR_PTR_UPDATE), 1); + + if (!amdgpu_sriov_vf(adev)) { /* only bare-metal use register write for wptr */ +- WREG32(sdma_v5_2_get_reg_offset(adev, i, mmSDMA0_GFX_RB_WPTR), lower_32_bits(ring->wptr) << 2); +- WREG32(sdma_v5_2_get_reg_offset(adev, i, mmSDMA0_GFX_RB_WPTR_HI), upper_32_bits(ring->wptr) << 2); ++ WREG32(sdma_v5_2_get_reg_offset(adev, i, mmSDMA0_GFX_RB_WPTR), lower_32_bits(ring->wptr << 2)); ++ WREG32(sdma_v5_2_get_reg_offset(adev, i, mmSDMA0_GFX_RB_WPTR_HI), upper_32_bits(ring->wptr << 2)); + } + + doorbell = RREG32_SOC15_IP(GC, sdma_v5_2_get_reg_offset(adev, i, mmSDMA0_GFX_DOORBELL)); +-- +2.35.1 + diff --git a/queue-5.18/drm-amdgpu-ucode-remove-firmware-load-type-check-in-.patch b/queue-5.18/drm-amdgpu-ucode-remove-firmware-load-type-check-in-.patch new file mode 100644 index 00000000000..3c3948af873 --- /dev/null +++ b/queue-5.18/drm-amdgpu-ucode-remove-firmware-load-type-check-in-.patch @@ -0,0 +1,40 @@ +From 0275eb1038814b502e3fb2763cab4895bcf23eaa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 May 2022 11:40:18 -0400 +Subject: drm/amdgpu/ucode: Remove firmware load type check in + amdgpu_ucode_free_bo + +From: Alice Wong + +[ Upstream commit ab0cd4a9ae5b4679b714d8dbfedc0901fecdce9f ] + +When psp_hw_init failed, it will set the load_type to AMDGPU_FW_LOAD_DIRECT. +During amdgpu_device_ip_fini, amdgpu_ucode_free_bo checks that load_type is +AMDGPU_FW_LOAD_DIRECT and skips deallocating fw_buf causing memory leak. +Remove load_type check in amdgpu_ucode_free_bo. + +Signed-off-by: Alice Wong +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c +index ca3350502618..aebafbc327fb 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c +@@ -714,8 +714,7 @@ int amdgpu_ucode_create_bo(struct amdgpu_device *adev) + + void amdgpu_ucode_free_bo(struct amdgpu_device *adev) + { +- if (adev->firmware.load_type != AMDGPU_FW_LOAD_DIRECT) +- amdgpu_bo_free_kernel(&adev->firmware.fw_buf, ++ amdgpu_bo_free_kernel(&adev->firmware.fw_buf, + &adev->firmware.fw_buf_mc, + &adev->firmware.fw_buf_ptr); + } +-- +2.35.1 + diff --git a/queue-5.18/drm-amdkfd-fix-circular-lock-dependency-warning.patch b/queue-5.18/drm-amdkfd-fix-circular-lock-dependency-warning.patch new file mode 100644 index 00000000000..d6ca32cc265 --- /dev/null +++ b/queue-5.18/drm-amdkfd-fix-circular-lock-dependency-warning.patch @@ -0,0 +1,220 @@ +From e0b7f1ba70682a96072835b323fa7d57134483ae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Apr 2022 11:39:20 -0400 +Subject: drm/amdkfd: Fix circular lock dependency warning + +From: Mukul Joshi + +[ Upstream commit b179fc28d521379ba7e0a38eec1a4c722e7ea634 ] + +[ 168.544078] ====================================================== +[ 168.550309] WARNING: possible circular locking dependency detected +[ 168.556523] 5.16.0-kfd-fkuehlin #148 Tainted: G E +[ 168.562558] ------------------------------------------------------ +[ 168.568764] kfdtest/3479 is trying to acquire lock: +[ 168.573672] ffffffffc0927a70 (&topology_lock){++++}-{3:3}, at: + kfd_topology_device_by_id+0x16/0x60 [amdgpu] [ 168.583663] + but task is already holding lock: +[ 168.589529] ffff97d303dee668 (&mm->mmap_lock#2){++++}-{3:3}, at: + vm_mmap_pgoff+0xa9/0x180 [ 168.597755] + which lock already depends on the new lock. + +[ 168.605970] + the existing dependency chain (in reverse order) is: +[ 168.613487] + -> #3 (&mm->mmap_lock#2){++++}-{3:3}: +[ 168.619700] lock_acquire+0xca/0x2e0 +[ 168.623814] down_read+0x3e/0x140 +[ 168.627676] do_user_addr_fault+0x40d/0x690 +[ 168.632399] exc_page_fault+0x6f/0x270 +[ 168.636692] asm_exc_page_fault+0x1e/0x30 +[ 168.641249] filldir64+0xc8/0x1e0 +[ 168.645115] call_filldir+0x7c/0x110 +[ 168.649238] ext4_readdir+0x58e/0x940 +[ 168.653442] iterate_dir+0x16a/0x1b0 +[ 168.657558] __x64_sys_getdents64+0x83/0x140 +[ 168.662375] do_syscall_64+0x35/0x80 +[ 168.666492] entry_SYSCALL_64_after_hwframe+0x44/0xae +[ 168.672095] + -> #2 (&type->i_mutex_dir_key#6){++++}-{3:3}: +[ 168.679008] lock_acquire+0xca/0x2e0 +[ 168.683122] down_read+0x3e/0x140 +[ 168.686982] path_openat+0x5b2/0xa50 +[ 168.691095] do_file_open_root+0xfc/0x190 +[ 168.695652] file_open_root+0xd8/0x1b0 +[ 168.702010] kernel_read_file_from_path_initns+0xc4/0x140 +[ 168.709542] _request_firmware+0x2e9/0x5e0 +[ 168.715741] request_firmware+0x32/0x50 +[ 168.721667] amdgpu_cgs_get_firmware_info+0x370/0xdd0 [amdgpu] +[ 168.730060] smu7_upload_smu_firmware_image+0x53/0x190 [amdgpu] +[ 168.738414] fiji_start_smu+0xcf/0x4e0 [amdgpu] +[ 168.745539] pp_dpm_load_fw+0x21/0x30 [amdgpu] +[ 168.752503] amdgpu_pm_load_smu_firmware+0x4b/0x80 [amdgpu] +[ 168.760698] amdgpu_device_fw_loading+0xb8/0x140 [amdgpu] +[ 168.768412] amdgpu_device_init.cold+0xdf6/0x1716 [amdgpu] +[ 168.776285] amdgpu_driver_load_kms+0x15/0x120 [amdgpu] +[ 168.784034] amdgpu_pci_probe+0x19b/0x3a0 [amdgpu] +[ 168.791161] local_pci_probe+0x40/0x80 +[ 168.797027] work_for_cpu_fn+0x10/0x20 +[ 168.802839] process_one_work+0x273/0x5b0 +[ 168.808903] worker_thread+0x20f/0x3d0 +[ 168.814700] kthread+0x176/0x1a0 +[ 168.819968] ret_from_fork+0x1f/0x30 +[ 168.825563] + -> #1 (&adev->pm.mutex){+.+.}-{3:3}: +[ 168.834721] lock_acquire+0xca/0x2e0 +[ 168.840364] __mutex_lock+0xa2/0x930 +[ 168.846020] amdgpu_dpm_get_mclk+0x37/0x60 [amdgpu] +[ 168.853257] amdgpu_amdkfd_get_local_mem_info+0xba/0xe0 [amdgpu] +[ 168.861547] kfd_create_vcrat_image_gpu+0x1b1/0xbb0 [amdgpu] +[ 168.869478] kfd_create_crat_image_virtual+0x447/0x510 [amdgpu] +[ 168.877884] kfd_topology_add_device+0x5c8/0x6f0 [amdgpu] +[ 168.885556] kgd2kfd_device_init.cold+0x385/0x4c5 [amdgpu] +[ 168.893347] amdgpu_amdkfd_device_init+0x138/0x180 [amdgpu] +[ 168.901177] amdgpu_device_init.cold+0x141b/0x1716 [amdgpu] +[ 168.909025] amdgpu_driver_load_kms+0x15/0x120 [amdgpu] +[ 168.916458] amdgpu_pci_probe+0x19b/0x3a0 [amdgpu] +[ 168.923442] local_pci_probe+0x40/0x80 +[ 168.929249] work_for_cpu_fn+0x10/0x20 +[ 168.935008] process_one_work+0x273/0x5b0 +[ 168.940944] worker_thread+0x20f/0x3d0 +[ 168.946623] kthread+0x176/0x1a0 +[ 168.951765] ret_from_fork+0x1f/0x30 +[ 168.957277] + -> #0 (&topology_lock){++++}-{3:3}: +[ 168.965993] check_prev_add+0x8f/0xbf0 +[ 168.971613] __lock_acquire+0x1299/0x1ca0 +[ 168.977485] lock_acquire+0xca/0x2e0 +[ 168.982877] down_read+0x3e/0x140 +[ 168.987975] kfd_topology_device_by_id+0x16/0x60 [amdgpu] +[ 168.995583] kfd_device_by_id+0xa/0x20 [amdgpu] +[ 169.002180] kfd_mmap+0x95/0x200 [amdgpu] +[ 169.008293] mmap_region+0x337/0x5a0 +[ 169.013679] do_mmap+0x3aa/0x540 +[ 169.018678] vm_mmap_pgoff+0xdc/0x180 +[ 169.024095] ksys_mmap_pgoff+0x186/0x1f0 +[ 169.029734] do_syscall_64+0x35/0x80 +[ 169.035005] entry_SYSCALL_64_after_hwframe+0x44/0xae +[ 169.041754] + other info that might help us debug this: + +[ 169.053276] Chain exists of: + &topology_lock --> &type->i_mutex_dir_key#6 --> &mm->mmap_lock#2 + +[ 169.068389] Possible unsafe locking scenario: + +[ 169.076661] CPU0 CPU1 +[ 169.082383] ---- ---- +[ 169.088087] lock(&mm->mmap_lock#2); +[ 169.092922] lock(&type->i_mutex_dir_key#6); +[ 169.100975] lock(&mm->mmap_lock#2); +[ 169.108320] lock(&topology_lock); +[ 169.112957] + *** DEADLOCK *** + +This commit fixes the deadlock warning by ensuring pm.mutex is not +held while holding the topology lock. For this, kfd_local_mem_info +is moved into the KFD dev struct and filled during device init. +This cached value can then be used instead of querying the value +again and again. + +Signed-off-by: Mukul Joshi +Reviewed-by: Felix Kuehling +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 7 ++----- + drivers/gpu/drm/amd/amdkfd/kfd_crat.c | 2 +- + drivers/gpu/drm/amd/amdkfd/kfd_device.c | 2 ++ + drivers/gpu/drm/amd/amdkfd/kfd_priv.h | 1 + + drivers/gpu/drm/amd/amdkfd/kfd_topology.c | 7 ++----- + 5 files changed, 8 insertions(+), 11 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c +index 607f65ab39ac..10cc834a5ac3 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c +@@ -944,8 +944,6 @@ static int kfd_ioctl_acquire_vm(struct file *filep, struct kfd_process *p, + + bool kfd_dev_is_large_bar(struct kfd_dev *dev) + { +- struct kfd_local_mem_info mem_info; +- + if (debug_largebar) { + pr_debug("Simulate large-bar allocation on non large-bar machine\n"); + return true; +@@ -954,9 +952,8 @@ bool kfd_dev_is_large_bar(struct kfd_dev *dev) + if (dev->use_iommu_v2) + return false; + +- amdgpu_amdkfd_get_local_mem_info(dev->adev, &mem_info); +- if (mem_info.local_mem_size_private == 0 && +- mem_info.local_mem_size_public > 0) ++ if (dev->local_mem_info.local_mem_size_private == 0 && ++ dev->local_mem_info.local_mem_size_public > 0) + return true; + return false; + } +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_crat.c b/drivers/gpu/drm/amd/amdkfd/kfd_crat.c +index 1eaabd2cb41b..59b349a4c04a 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_crat.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_crat.c +@@ -2152,7 +2152,7 @@ static int kfd_create_vcrat_image_gpu(void *pcrat_image, + * report the total FB size (public+private) as a single + * private heap. + */ +- amdgpu_amdkfd_get_local_mem_info(kdev->adev, &local_mem_info); ++ local_mem_info = kdev->local_mem_info; + sub_type_hdr = (typeof(sub_type_hdr))((char *)sub_type_hdr + + sub_type_hdr->length); + +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device.c b/drivers/gpu/drm/amd/amdkfd/kfd_device.c +index 62aa6c9d5123..c96d521447fc 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_device.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_device.c +@@ -575,6 +575,8 @@ bool kgd2kfd_device_init(struct kfd_dev *kfd, + if (kfd_resume(kfd)) + goto kfd_resume_error; + ++ amdgpu_amdkfd_get_local_mem_info(kfd->adev, &kfd->local_mem_info); ++ + if (kfd_topology_add_device(kfd)) { + dev_err(kfd_device, "Error adding device to topology\n"); + goto kfd_topology_add_device_error; +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_priv.h b/drivers/gpu/drm/amd/amdkfd/kfd_priv.h +index 8f58fc491b28..49a29a60b71e 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_priv.h ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_priv.h +@@ -272,6 +272,7 @@ struct kfd_dev { + + struct kgd2kfd_shared_resources shared_resources; + struct kfd_vmid_info vm_info; ++ struct kfd_local_mem_info local_mem_info; + + const struct kfd2kgd_calls *kfd2kgd; + struct mutex doorbell_mutex; +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c +index 3bdcae239bc0..9fc24f6823df 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c +@@ -1102,15 +1102,12 @@ static uint32_t kfd_generate_gpu_id(struct kfd_dev *gpu) + uint32_t buf[7]; + uint64_t local_mem_size; + int i; +- struct kfd_local_mem_info local_mem_info; + + if (!gpu) + return 0; + +- amdgpu_amdkfd_get_local_mem_info(gpu->adev, &local_mem_info); +- +- local_mem_size = local_mem_info.local_mem_size_private + +- local_mem_info.local_mem_size_public; ++ local_mem_size = gpu->local_mem_info.local_mem_size_private + ++ gpu->local_mem_info.local_mem_size_public; + + buf[0] = gpu->pdev->devfn; + buf[1] = gpu->pdev->subsystem_vendor | +-- +2.35.1 + diff --git a/queue-5.18/drm-bridge-adv7511-clean-up-cec-adapter-when-probe-f.patch b/queue-5.18/drm-bridge-adv7511-clean-up-cec-adapter-when-probe-f.patch new file mode 100644 index 00000000000..09dfa1e6d00 --- /dev/null +++ b/queue-5.18/drm-bridge-adv7511-clean-up-cec-adapter-when-probe-f.patch @@ -0,0 +1,37 @@ +From 843c4c3c4f9501c5ba42429e3ade94cb0d9e3a3b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Mar 2022 11:47:05 +0100 +Subject: drm/bridge: adv7511: clean up CEC adapter when probe fails + +From: Lucas Stach + +[ Upstream commit 7ed2b0dabf7a22874cb30f8878df239ef638eb53 ] + +When the probe routine fails we also need to clean up the +CEC adapter registered in adv7511_cec_init(). + +Fixes: 3b1b975003e4 ("drm: adv7511/33: add HDMI CEC support") +Signed-off-by: Lucas Stach +Reviewed-by: Robert Foss +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20220321104705.2804423-1-l.stach@pengutronix.de +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/adv7511/adv7511_drv.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c +index 005bf18682ff..668dcefbae17 100644 +--- a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c ++++ b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c +@@ -1313,6 +1313,7 @@ static int adv7511_probe(struct i2c_client *i2c, const struct i2c_device_id *id) + adv7511_audio_exit(adv7511); + drm_bridge_remove(&adv7511->bridge); + err_unregister_cec: ++ cec_unregister_adapter(adv7511->cec_adap); + i2c_unregister_device(adv7511->i2c_cec); + clk_disable_unprepare(adv7511->cec_clk); + err_i2c_unregister_packet: +-- +2.35.1 + diff --git a/queue-5.18/drm-bridge-anx7625-add-missing-destroy_workqueue-in-.patch b/queue-5.18/drm-bridge-anx7625-add-missing-destroy_workqueue-in-.patch new file mode 100644 index 00000000000..3781c7bc5ac --- /dev/null +++ b/queue-5.18/drm-bridge-anx7625-add-missing-destroy_workqueue-in-.patch @@ -0,0 +1,48 @@ +From 6a7de783b717b6cd5f67c3e67ff5ccafced3ec1e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 26 Mar 2022 15:33:26 +0800 +Subject: drm/bridge: anx7625: add missing destroy_workqueue() in + anx7625_i2c_probe() + +From: Yang Yingliang + +[ Upstream commit 6f5efd118efafa22139e8670a4e4b506ba757dfd ] + +Add the missing destroy_workqueue() before return from +anx7625_i2c_probe() in the error handling case. + +Fixes: adca62ec370c ("drm/bridge: anx7625: Support reading edid through aux channel") +Signed-off-by: Yang Yingliang +Reviewed-by: Hsin-Yi Wang +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20220326073326.3389347-1-yangyingliang@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/analogix/anx7625.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/analogix/anx7625.c b/drivers/gpu/drm/bridge/analogix/anx7625.c +index 8e1851a57638..a23e13c29a1d 100644 +--- a/drivers/gpu/drm/bridge/analogix/anx7625.c ++++ b/drivers/gpu/drm/bridge/analogix/anx7625.c +@@ -2657,7 +2657,7 @@ static int anx7625_i2c_probe(struct i2c_client *client, + if (ret) { + if (ret != -EPROBE_DEFER) + DRM_DEV_ERROR(dev, "fail to parse DT : %d\n", ret); +- return ret; ++ goto free_wq; + } + + if (anx7625_register_i2c_dummy_clients(platform, client) != 0) { +@@ -2672,7 +2672,7 @@ static int anx7625_i2c_probe(struct i2c_client *client, + pm_suspend_ignore_children(dev, true); + ret = devm_add_action_or_reset(dev, anx7625_runtime_disable, dev); + if (ret) +- return ret; ++ goto free_wq; + + if (!platform->pdata.low_power_mode) { + anx7625_disable_pd_protocol(platform); +-- +2.35.1 + diff --git a/queue-5.18/drm-bridge-anx7625-check-the-return-on-anx7625_aux_t.patch b/queue-5.18/drm-bridge-anx7625-check-the-return-on-anx7625_aux_t.patch new file mode 100644 index 00000000000..94679c54333 --- /dev/null +++ b/queue-5.18/drm-bridge-anx7625-check-the-return-on-anx7625_aux_t.patch @@ -0,0 +1,48 @@ +From 19429ba4a4c63cf24e91991b0981910fee7c0edd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Mar 2022 12:19:43 -0800 +Subject: drm/bridge: anx7625: check the return on anx7625_aux_trans + +From: Tom Rix + +[ Upstream commit d583e752732421b26fef0d65020565f3bef12248 ] + +Clang static analysis reports this issue +anx7625.c:876:13: warning: The left operand of '&' is + a garbage value + if (!(bcap & 0xOA01)) { + ~~~~ ^ + +bcap is only set by a successful call to +anx7625_aux_trans(). So check. + +Fixes: cd1637c7e480 ("drm/bridge: anx7625: add HDCP support") +Signed-off-by: Tom Rix +Fixes: adca62ec370c ("drm/bridge: anx7625: Support reading edid through aux channel") +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20220303201943.501746-1-trix@redhat.com +Reviewed-by: Robert Foss +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/analogix/anx7625.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/bridge/analogix/anx7625.c b/drivers/gpu/drm/bridge/analogix/anx7625.c +index 31ecf5626f1d..8e1851a57638 100644 +--- a/drivers/gpu/drm/bridge/analogix/anx7625.c ++++ b/drivers/gpu/drm/bridge/analogix/anx7625.c +@@ -874,7 +874,10 @@ static int anx7625_hdcp_enable(struct anx7625_data *ctx) + } + + /* Read downstream capability */ +- anx7625_aux_trans(ctx, DP_AUX_NATIVE_READ, 0x68028, 1, &bcap); ++ ret = anx7625_aux_trans(ctx, DP_AUX_NATIVE_READ, 0x68028, 1, &bcap); ++ if (ret < 0) ++ return ret; ++ + if (!(bcap & 0x01)) { + pr_warn("downstream not support HDCP 1.4, cap(%x).\n", bcap); + return 0; +-- +2.35.1 + diff --git a/queue-5.18/drm-bridge-anx7625-use-uint8-for-lane-swing-arrays.patch b/queue-5.18/drm-bridge-anx7625-use-uint8-for-lane-swing-arrays.patch new file mode 100644 index 00000000000..9304894eab1 --- /dev/null +++ b/queue-5.18/drm-bridge-anx7625-use-uint8-for-lane-swing-arrays.patch @@ -0,0 +1,93 @@ +From f5257a0a90f810b95cb8781c8bd648f1250cb6f1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Apr 2022 21:30:34 -0400 +Subject: drm/bridge: anx7625: Use uint8 for lane-swing arrays +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Nícolas F. R. A. Prado + +[ Upstream commit fb8da7f3111ab500606960bef1bb32450c664750 ] + +As defined in the anx7625 dt-binding, the analogix,lane0-swing and +analogix,lane1-swing properties are uint8 arrays. Yet, the driver was +reading the array as if it were of uint32 and masking to 8-bit before +writing to the registers. This means that a devicetree written in +accordance to the dt-binding would have its values incorrectly parsed. + +Fix the issue by reading the array as uint8 and storing them as uint8 +internally, so that we can also drop the masking when writing the +registers. + +Fixes: fd0310b6fe7d ("drm/bridge: anx7625: add MIPI DPI input feature") +Signed-off-by: Nícolas F. R. A. Prado +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20220408013034.673418-1-nfraprado@collabora.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/analogix/anx7625.c | 12 ++++++------ + drivers/gpu/drm/bridge/analogix/anx7625.h | 4 ++-- + 2 files changed, 8 insertions(+), 8 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/analogix/anx7625.c b/drivers/gpu/drm/bridge/analogix/anx7625.c +index a23e13c29a1d..060849f8ad8b 100644 +--- a/drivers/gpu/drm/bridge/analogix/anx7625.c ++++ b/drivers/gpu/drm/bridge/analogix/anx7625.c +@@ -1478,12 +1478,12 @@ static void anx7625_dp_adjust_swing(struct anx7625_data *ctx) + for (i = 0; i < ctx->pdata.dp_lane0_swing_reg_cnt; i++) + anx7625_reg_write(ctx, ctx->i2c.tx_p1_client, + DP_TX_LANE0_SWING_REG0 + i, +- ctx->pdata.lane0_reg_data[i] & 0xFF); ++ ctx->pdata.lane0_reg_data[i]); + + for (i = 0; i < ctx->pdata.dp_lane1_swing_reg_cnt; i++) + anx7625_reg_write(ctx, ctx->i2c.tx_p1_client, + DP_TX_LANE1_SWING_REG0 + i, +- ctx->pdata.lane1_reg_data[i] & 0xFF); ++ ctx->pdata.lane1_reg_data[i]); + } + + static void dp_hpd_change_handler(struct anx7625_data *ctx, bool on) +@@ -1590,8 +1590,8 @@ static int anx7625_get_swing_setting(struct device *dev, + num_regs = DP_TX_SWING_REG_CNT; + + pdata->dp_lane0_swing_reg_cnt = num_regs; +- of_property_read_u32_array(dev->of_node, "analogix,lane0-swing", +- pdata->lane0_reg_data, num_regs); ++ of_property_read_u8_array(dev->of_node, "analogix,lane0-swing", ++ pdata->lane0_reg_data, num_regs); + } + + if (of_get_property(dev->of_node, +@@ -1600,8 +1600,8 @@ static int anx7625_get_swing_setting(struct device *dev, + num_regs = DP_TX_SWING_REG_CNT; + + pdata->dp_lane1_swing_reg_cnt = num_regs; +- of_property_read_u32_array(dev->of_node, "analogix,lane1-swing", +- pdata->lane1_reg_data, num_regs); ++ of_property_read_u8_array(dev->of_node, "analogix,lane1-swing", ++ pdata->lane1_reg_data, num_regs); + } + + return 0; +diff --git a/drivers/gpu/drm/bridge/analogix/anx7625.h b/drivers/gpu/drm/bridge/analogix/anx7625.h +index edbbfe410a56..e257a84db962 100644 +--- a/drivers/gpu/drm/bridge/analogix/anx7625.h ++++ b/drivers/gpu/drm/bridge/analogix/anx7625.h +@@ -426,9 +426,9 @@ struct anx7625_platform_data { + int mipi_lanes; + int audio_en; + int dp_lane0_swing_reg_cnt; +- int lane0_reg_data[DP_TX_SWING_REG_CNT]; ++ u8 lane0_reg_data[DP_TX_SWING_REG_CNT]; + int dp_lane1_swing_reg_cnt; +- int lane1_reg_data[DP_TX_SWING_REG_CNT]; ++ u8 lane1_reg_data[DP_TX_SWING_REG_CNT]; + u32 low_power_mode; + struct device_node *mipi_host_node; + }; +-- +2.35.1 + diff --git a/queue-5.18/drm-bridge-fix-error-handling-in-analogix_dp_probe.patch b/queue-5.18/drm-bridge-fix-error-handling-in-analogix_dp_probe.patch new file mode 100644 index 00000000000..7b2e1c3b9c7 --- /dev/null +++ b/queue-5.18/drm-bridge-fix-error-handling-in-analogix_dp_probe.patch @@ -0,0 +1,80 @@ +From 01ad619b0337b967d198bd67c783769baab661c4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Apr 2022 01:16:40 +0000 +Subject: drm/bridge: Fix error handling in analogix_dp_probe + +From: Miaoqian Lin + +[ Upstream commit 9f15930bb2ef9f031d62ffc49629cbae89137733 ] + +In the error handling path, the clk_prepare_enable() function +call should be balanced by a corresponding 'clk_disable_unprepare()' +call, as already done in the remove function. + +Fixes: 3424e3a4f844 ("drm: bridge: analogix/dp: split exynos dp driver to bridge directory") +Signed-off-by: Miaoqian Lin +Reviewed-by: Robert Foss +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20220420011644.25730-1-linmq006@gmail.com +Signed-off-by: Sasha Levin +--- + .../gpu/drm/bridge/analogix/analogix_dp_core.c | 18 +++++++++++++----- + 1 file changed, 13 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c b/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c +index eb590fb8e8d0..474ef88015ae 100644 +--- a/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c ++++ b/drivers/gpu/drm/bridge/analogix/analogix_dp_core.c +@@ -1698,8 +1698,10 @@ analogix_dp_probe(struct device *dev, struct analogix_dp_plat_data *plat_data) + res = platform_get_resource(pdev, IORESOURCE_MEM, 0); + + dp->reg_base = devm_ioremap_resource(&pdev->dev, res); +- if (IS_ERR(dp->reg_base)) +- return ERR_CAST(dp->reg_base); ++ if (IS_ERR(dp->reg_base)) { ++ ret = PTR_ERR(dp->reg_base); ++ goto err_disable_clk; ++ } + + dp->force_hpd = of_property_read_bool(dev->of_node, "force-hpd"); + +@@ -1711,7 +1713,8 @@ analogix_dp_probe(struct device *dev, struct analogix_dp_plat_data *plat_data) + if (IS_ERR(dp->hpd_gpiod)) { + dev_err(dev, "error getting HDP GPIO: %ld\n", + PTR_ERR(dp->hpd_gpiod)); +- return ERR_CAST(dp->hpd_gpiod); ++ ret = PTR_ERR(dp->hpd_gpiod); ++ goto err_disable_clk; + } + + if (dp->hpd_gpiod) { +@@ -1731,7 +1734,8 @@ analogix_dp_probe(struct device *dev, struct analogix_dp_plat_data *plat_data) + + if (dp->irq == -ENXIO) { + dev_err(&pdev->dev, "failed to get irq\n"); +- return ERR_PTR(-ENODEV); ++ ret = -ENODEV; ++ goto err_disable_clk; + } + + ret = devm_request_threaded_irq(&pdev->dev, dp->irq, +@@ -1740,11 +1744,15 @@ analogix_dp_probe(struct device *dev, struct analogix_dp_plat_data *plat_data) + irq_flags, "analogix-dp", dp); + if (ret) { + dev_err(&pdev->dev, "failed to request irq\n"); +- return ERR_PTR(ret); ++ goto err_disable_clk; + } + disable_irq(dp->irq); + + return dp; ++ ++err_disable_clk: ++ clk_disable_unprepare(dp->clock); ++ return ERR_PTR(ret); + } + EXPORT_SYMBOL_GPL(analogix_dp_probe); + +-- +2.35.1 + diff --git a/queue-5.18/drm-bridge-fix-it6505-kconfig-drm_dp_aux_bus-depende.patch b/queue-5.18/drm-bridge-fix-it6505-kconfig-drm_dp_aux_bus-depende.patch new file mode 100644 index 00000000000..399fb5faef1 --- /dev/null +++ b/queue-5.18/drm-bridge-fix-it6505-kconfig-drm_dp_aux_bus-depende.patch @@ -0,0 +1,38 @@ +From 63f5545f7f2d38c76e105ca09778d1e724c089bd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Apr 2022 15:14:15 +0200 +Subject: drm/bridge: Fix it6505 Kconfig DRM_DP_AUX_BUS dependency + +From: Robert Foss + +[ Upstream commit c5060b09f460fc83846d361018a124fcade1b9e9 ] + +it6505 depends on DRM_DP_AUX_BUS, the kconfig for it6505 should +reflect this dependency using 'select'. + +Fixes: b5c84a9edcd4 ("drm/bridge: add it6505 driver") +Reported-by: kernel test robot +Suggested-by: Randy Dunlap +Signed-off-by: Robert Foss +Reviewed-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/20220421131415.1289469-1-robert.foss@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/bridge/Kconfig b/drivers/gpu/drm/bridge/Kconfig +index becd9867f3a0..be2fc4791c1d 100644 +--- a/drivers/gpu/drm/bridge/Kconfig ++++ b/drivers/gpu/drm/bridge/Kconfig +@@ -77,6 +77,7 @@ config DRM_DISPLAY_CONNECTOR + config DRM_ITE_IT6505 + tristate "ITE IT6505 DisplayPort bridge" + depends on OF ++ select DRM_DP_AUX_BUS + select DRM_DP_HELPER + select DRM_KMS_HELPER + select DRM_DP_HELPER +-- +2.35.1 + diff --git a/queue-5.18/drm-bridge-icn6211-fix-hfp_hsw_hbp_hi-and-hfp_min-ha.patch b/queue-5.18/drm-bridge-icn6211-fix-hfp_hsw_hbp_hi-and-hfp_min-ha.patch new file mode 100644 index 00000000000..e1d148f735e --- /dev/null +++ b/queue-5.18/drm-bridge-icn6211-fix-hfp_hsw_hbp_hi-and-hfp_min-ha.patch @@ -0,0 +1,94 @@ +From fb3379f6e72291a890f150a99fd71d13ed5e4a6a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 31 Mar 2022 17:05:00 +0200 +Subject: drm: bridge: icn6211: Fix HFP_HSW_HBP_HI and HFP_MIN handling + +From: Marek Vasut + +[ Upstream commit c0ff7a649d62105a9308cc3ac36e52a4669d9cb4 ] + +The HFP_HSW_HBP_HI register must be programmed with 2 LSbits of each +Horizontal Front Porch/Sync/Back Porch. Currently the driver programs +this register to 0, which breaks displays with either value above 255. + +The HFP_MIN register must be set to the same value as HFP_LI, otherwise +there is visible image distortion, usually in the form of missing lines +at the bottom of the panel. + +Fix this by correctly programming the HFP_HSW_HBP_HI and HFP_MIN registers. + +Acked-by: Maxime Ripard +Fixes: ce517f18944e3 ("drm: bridge: Add Chipone ICN6211 MIPI-DSI to RGB bridge") +Signed-off-by: Marek Vasut +Cc: Jagan Teki +Cc: Maxime Ripard +Cc: Robert Foss +Cc: Sam Ravnborg +Cc: Thomas Zimmermann +To: dri-devel@lists.freedesktop.org +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20220331150509.9838-3-marex@denx.de +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/chipone-icn6211.c | 23 ++++++++++++++++------- + 1 file changed, 16 insertions(+), 7 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/chipone-icn6211.c b/drivers/gpu/drm/bridge/chipone-icn6211.c +index 376e0f80da5c..c871a90c0b8f 100644 +--- a/drivers/gpu/drm/bridge/chipone-icn6211.c ++++ b/drivers/gpu/drm/bridge/chipone-icn6211.c +@@ -35,6 +35,9 @@ + #define HSYNC_LI 0x24 + #define HBP_LI 0x25 + #define HFP_HSW_HBP_HI 0x26 ++#define HFP_HSW_HBP_HI_HFP(n) (((n) & 0x300) >> 4) ++#define HFP_HSW_HBP_HI_HS(n) (((n) & 0x300) >> 6) ++#define HFP_HSW_HBP_HI_HBP(n) (((n) & 0x300) >> 8) + #define VFP 0x27 + #define VSYNC 0x28 + #define VBP 0x29 +@@ -163,6 +166,7 @@ static void chipone_atomic_enable(struct drm_bridge *bridge, + { + struct chipone *icn = bridge_to_chipone(bridge); + struct drm_display_mode *mode = &icn->mode; ++ u16 hfp, hbp, hsync; + + ICN6211_DSI(icn, MIPI_CFG_PW, MIPI_CFG_PW_CONFIG_DSI); + +@@ -178,13 +182,18 @@ static void chipone_atomic_enable(struct drm_bridge *bridge, + ((mode->hdisplay >> 8) & 0xf) | + (((mode->vdisplay >> 8) & 0xf) << 4)); + +- ICN6211_DSI(icn, HFP_LI, mode->hsync_start - mode->hdisplay); ++ hfp = mode->hsync_start - mode->hdisplay; ++ hsync = mode->hsync_end - mode->hsync_start; ++ hbp = mode->htotal - mode->hsync_end; + +- ICN6211_DSI(icn, HSYNC_LI, mode->hsync_end - mode->hsync_start); +- +- ICN6211_DSI(icn, HBP_LI, mode->htotal - mode->hsync_end); +- +- ICN6211_DSI(icn, HFP_HSW_HBP_HI, 0x00); ++ ICN6211_DSI(icn, HFP_LI, hfp & 0xff); ++ ICN6211_DSI(icn, HSYNC_LI, hsync & 0xff); ++ ICN6211_DSI(icn, HBP_LI, hbp & 0xff); ++ /* Top two bits of Horizontal Front porch/Sync/Back porch */ ++ ICN6211_DSI(icn, HFP_HSW_HBP_HI, ++ HFP_HSW_HBP_HI_HFP(hfp) | ++ HFP_HSW_HBP_HI_HS(hsync) | ++ HFP_HSW_HBP_HI_HBP(hbp)); + + ICN6211_DSI(icn, VFP, mode->vsync_start - mode->vdisplay); + +@@ -194,7 +203,7 @@ static void chipone_atomic_enable(struct drm_bridge *bridge, + + /* dsi specific sequence */ + ICN6211_DSI(icn, SYNC_EVENT_DLY, 0x80); +- ICN6211_DSI(icn, HFP_MIN, 0x28); ++ ICN6211_DSI(icn, HFP_MIN, hfp & 0xff); + ICN6211_DSI(icn, MIPI_PD_CK_LANE, 0xa0); + ICN6211_DSI(icn, PLL_CTRL(12), 0xff); + ICN6211_DSI(icn, BIST_POL, BIST_POL_DE_POL); +-- +2.35.1 + diff --git a/queue-5.18/drm-bridge-icn6211-fix-register-layout.patch b/queue-5.18/drm-bridge-icn6211-fix-register-layout.patch new file mode 100644 index 00000000000..deb4ea28a94 --- /dev/null +++ b/queue-5.18/drm-bridge-icn6211-fix-register-layout.patch @@ -0,0 +1,212 @@ +From 4a32b54c0c02e20a0fa7dc91105b5c54cc736ea3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 31 Mar 2022 17:04:59 +0200 +Subject: drm: bridge: icn6211: Fix register layout + +From: Marek Vasut + +[ Upstream commit 2dcec57b3734029cc1adc5cb872f61e21609eed4 ] + +The chip register layout has nothing to do with MIPI DCS, the registers +incorrectly marked as MIPI DCS in the driver are regular chip registers +often with completely different function. + +Fill in the actual register names and bits from [1] and [2] and add the +entire register layout, since the documentation for this chip is hard to +come by. + +[1] https://github.com/rockchip-linux/kernel/blob/develop-4.19/drivers/gpu/drm/bridge/icn6211.c +[2] https://github.com/tdjastrzebski/ICN6211-Configurator + +Acked-by: Maxime Ripard +Fixes: ce517f18944e3 ("drm: bridge: Add Chipone ICN6211 MIPI-DSI to RGB bridge") +Signed-off-by: Marek Vasut +Cc: Jagan Teki +Cc: Maxime Ripard +Cc: Robert Foss +Cc: Sam Ravnborg +Cc: Thomas Zimmermann +To: dri-devel@lists.freedesktop.org +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20220331150509.9838-2-marex@denx.de +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/chipone-icn6211.c | 134 ++++++++++++++++++++--- + 1 file changed, 117 insertions(+), 17 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/chipone-icn6211.c b/drivers/gpu/drm/bridge/chipone-icn6211.c +index d9b7f48b99fb..376e0f80da5c 100644 +--- a/drivers/gpu/drm/bridge/chipone-icn6211.c ++++ b/drivers/gpu/drm/bridge/chipone-icn6211.c +@@ -15,8 +15,19 @@ + #include + #include + +-#include