From: Sasha Levin Date: Mon, 2 May 2022 04:06:23 +0000 (-0400) Subject: Fixes for 5.17 X-Git-Tag: v5.4.192~50 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=d133585a502ec96d7be2f4757c159e2667b52dda;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.17 Signed-off-by: Sasha Levin --- diff --git a/queue-5.17/alsa-hda-intel-dsp-config-add-raptorlake-pci-ids.patch b/queue-5.17/alsa-hda-intel-dsp-config-add-raptorlake-pci-ids.patch new file mode 100644 index 00000000000..42faaacd60f --- /dev/null +++ b/queue-5.17/alsa-hda-intel-dsp-config-add-raptorlake-pci-ids.patch @@ -0,0 +1,44 @@ +From f01870884a81aae930b0c794f62d7ce53593c714 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Apr 2022 11:35:46 -0500 +Subject: ALSA: hda: intel-dsp-config: Add RaptorLake PCI IDs + +From: Gongjun Song + +[ Upstream commit b07908ab26ceab51165c13714277c19252e62594 ] + +Add RaptorLake-P PCI IDs + +Reviewed-by: Kai Vehmanen +Signed-off-by: Gongjun Song +Signed-off-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20220421163546.319604-1-pierre-louis.bossart@linux.intel.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/hda/intel-dsp-config.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/sound/hda/intel-dsp-config.c b/sound/hda/intel-dsp-config.c +index 8b0a16ba27d3..a8fe01764b25 100644 +--- a/sound/hda/intel-dsp-config.c ++++ b/sound/hda/intel-dsp-config.c +@@ -424,6 +424,15 @@ static const struct config_entry config_table[] = { + .flags = FLAG_SOF | FLAG_SOF_ONLY_IF_DMIC_OR_SOUNDWIRE, + .device = 0x54c8, + }, ++ /* RaptorLake-P */ ++ { ++ .flags = FLAG_SOF | FLAG_SOF_ONLY_IF_DMIC_OR_SOUNDWIRE, ++ .device = 0x51ca, ++ }, ++ { ++ .flags = FLAG_SOF | FLAG_SOF_ONLY_IF_DMIC_OR_SOUNDWIRE, ++ .device = 0x51cb, ++ }, + #endif + + }; +-- +2.35.1 + diff --git a/queue-5.17/arch-xtensa-platforms-fix-deadlock-in-rs_close.patch b/queue-5.17/arch-xtensa-platforms-fix-deadlock-in-rs_close.patch new file mode 100644 index 00000000000..69a2fa6dab7 --- /dev/null +++ b/queue-5.17/arch-xtensa-platforms-fix-deadlock-in-rs_close.patch @@ -0,0 +1,86 @@ +From b01e2924f413e12889884ce9602450dca044e32f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Apr 2022 23:44:30 +0800 +Subject: arch: xtensa: platforms: Fix deadlock in rs_close() + +From: Duoming Zhou + +[ Upstream commit eb5adc70754d26a260f8b42d39db42da0d0af500 ] + +There is a deadlock in rs_close(), which is shown +below: + + (Thread 1) | (Thread 2) + | rs_open() +rs_close() | mod_timer() + spin_lock_bh() //(1) | (wait a time) + ... | rs_poll() + del_timer_sync() | spin_lock() //(2) + (wait timer to stop) | ... + +We hold timer_lock in position (1) of thread 1 and +use del_timer_sync() to wait timer to stop, but timer handler +also need timer_lock in position (2) of thread 2. +As a result, rs_close() will block forever. + +This patch deletes the redundant timer_lock in order to +prevent the deadlock. Because there is no race condition +between rs_close, rs_open and rs_poll. + +Signed-off-by: Duoming Zhou +Message-Id: <20220407154430.22387-1-duoming@zju.edu.cn> +Signed-off-by: Max Filippov +Signed-off-by: Sasha Levin +--- + arch/xtensa/platforms/iss/console.c | 8 -------- + 1 file changed, 8 deletions(-) + +diff --git a/arch/xtensa/platforms/iss/console.c b/arch/xtensa/platforms/iss/console.c +index 81d7c7e8f7e9..10b79d3c74e0 100644 +--- a/arch/xtensa/platforms/iss/console.c ++++ b/arch/xtensa/platforms/iss/console.c +@@ -36,24 +36,19 @@ static void rs_poll(struct timer_list *); + static struct tty_driver *serial_driver; + static struct tty_port serial_port; + static DEFINE_TIMER(serial_timer, rs_poll); +-static DEFINE_SPINLOCK(timer_lock); + + static int rs_open(struct tty_struct *tty, struct file * filp) + { +- spin_lock_bh(&timer_lock); + if (tty->count == 1) + mod_timer(&serial_timer, jiffies + SERIAL_TIMER_VALUE); +- spin_unlock_bh(&timer_lock); + + return 0; + } + + static void rs_close(struct tty_struct *tty, struct file * filp) + { +- spin_lock_bh(&timer_lock); + if (tty->count == 1) + del_timer_sync(&serial_timer); +- spin_unlock_bh(&timer_lock); + } + + +@@ -73,8 +68,6 @@ static void rs_poll(struct timer_list *unused) + int rd = 1; + unsigned char c; + +- spin_lock(&timer_lock); +- + while (simc_poll(0)) { + rd = simc_read(0, &c, 1); + if (rd <= 0) +@@ -87,7 +80,6 @@ static void rs_poll(struct timer_list *unused) + tty_flip_buffer_push(port); + if (rd) + mod_timer(&serial_timer, jiffies + SERIAL_TIMER_VALUE); +- spin_unlock(&timer_lock); + } + + +-- +2.35.1 + diff --git a/queue-5.17/arm-dts-am33xx-l4-add-missing-touchscreen-clock-prop.patch b/queue-5.17/arm-dts-am33xx-l4-add-missing-touchscreen-clock-prop.patch new file mode 100644 index 00000000000..2c778243a13 --- /dev/null +++ b/queue-5.17/arm-dts-am33xx-l4-add-missing-touchscreen-clock-prop.patch @@ -0,0 +1,58 @@ +From 540f12d2c20ffc7839d7c1fa89e8ee51d910b602 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Mar 2022 17:34:45 +0100 +Subject: ARM: dts: am33xx-l4: Add missing touchscreen clock properties + +From: Miquel Raynal + +[ Upstream commit c21a7434d6cc216a910dd35632617850f1751f4c ] + +When adding support for TI magadc (Magnetic Stripe Reader and ADC), the +MFD driver common to the touchscreen and the ADC got updated to ease the +insertion of a new DT node for the ADC, with its own compatible, clocks, +etc. Commit 235a96e92c16 ("mfd: ti_am335x_tscadc: Don't search the tree +for our clock") removed one compatible specific information which was +the clock name, because the clock was looked up from scratch in the DT +while this hardware block was only fed by a single clock, already +defined and properly filled in the DT. + +Problem is, this change was only validated with an am437x-based board, +where the clocks are effectively correctly defined and referenced. But +on am33xx, the ADC clock is also correctly defined but is not referenced +with a clock phandle as it ought to be. + +The touchscreen bindings clearly state that the clocks/clock-names +properties are mandatory, but they have been forgotten in one DTSI. This +was probably not noticed in the first place because of the clock +actually existing and the clk_get() call going through all the tree +anyway. + +Add the missing clock phandles in the am33xx touchscreen description. + +Reported-by: H. Nikolaus Schaller +Fixes: 235a96e92c16 ("mfd: ti_am335x_tscadc: Don't search the tree for our clock") +Signed-off-by: Miquel Raynal +Tested-by: H. Nikolaus Schaller +Message-Id: <20220314163445.79807-1-miquel.raynal@bootlin.com> +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/am33xx-l4.dtsi | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/arm/boot/dts/am33xx-l4.dtsi b/arch/arm/boot/dts/am33xx-l4.dtsi +index c9629cb5ccd1..7da42a5b959c 100644 +--- a/arch/arm/boot/dts/am33xx-l4.dtsi ++++ b/arch/arm/boot/dts/am33xx-l4.dtsi +@@ -263,6 +263,8 @@ tscadc: tscadc@0 { + compatible = "ti,am3359-tscadc"; + reg = <0x0 0x1000>; + interrupts = <16>; ++ clocks = <&adc_tsc_fck>; ++ clock-names = "fck"; + status = "disabled"; + dmas = <&edma 53 0>, <&edma 57 0>; + dma-names = "fifo0", "fifo1"; +-- +2.35.1 + diff --git a/queue-5.17/arm-dts-am3517-evm-fix-misc-pinmuxing.patch b/queue-5.17/arm-dts-am3517-evm-fix-misc-pinmuxing.patch new file mode 100644 index 00000000000..184e89c2081 --- /dev/null +++ b/queue-5.17/arm-dts-am3517-evm-fix-misc-pinmuxing.patch @@ -0,0 +1,153 @@ +From c8ddf9e4cec2b18a6766a79d1737494f3a334789 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 26 Feb 2022 15:48:19 -0600 +Subject: ARM: dts: am3517-evm: Fix misc pinmuxing + +From: Adam Ford + +[ Upstream commit 942da3af32b2288e674736eb159d1fc676261691 ] + +The bootloader for the AM3517 has previously done much of the pin +muxing, but as the bootloader is moving more and more to a model +based on the device tree, it may no longer automatically mux the +pins, so it is necessary to add the pinmuxing to the Linux device +trees so the respective peripherals can remain functional. + +Fixes: 6ed1d7997561 ("ARM: dts: am3517-evm: Add support for UI board and Audio") +Signed-off-by: Adam Ford +Message-Id: <20220226214820.747847-1-aford173@gmail.com> +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/am3517-evm.dts | 45 +++++++++++++++++++++++++++---- + arch/arm/boot/dts/am3517-som.dtsi | 9 +++++++ + 2 files changed, 49 insertions(+), 5 deletions(-) + +diff --git a/arch/arm/boot/dts/am3517-evm.dts b/arch/arm/boot/dts/am3517-evm.dts +index 0d2fac98ce7d..c8b80f156ec9 100644 +--- a/arch/arm/boot/dts/am3517-evm.dts ++++ b/arch/arm/boot/dts/am3517-evm.dts +@@ -161,6 +161,8 @@ pwm11: dmtimer-pwm@11 { + + /* HS USB Host PHY on PORT 1 */ + hsusb1_phy: hsusb1_phy { ++ pinctrl-names = "default"; ++ pinctrl-0 = <&hsusb1_rst_pins>; + compatible = "usb-nop-xceiv"; + reset-gpios = <&gpio2 25 GPIO_ACTIVE_LOW>; /* gpio_57 */ + #phy-cells = <0>; +@@ -168,7 +170,9 @@ hsusb1_phy: hsusb1_phy { + }; + + &davinci_emac { +- status = "okay"; ++ pinctrl-names = "default"; ++ pinctrl-0 = <ðernet_pins>; ++ status = "okay"; + }; + + &davinci_mdio { +@@ -193,6 +197,8 @@ dpi_out: endpoint { + }; + + &i2c2 { ++ pinctrl-names = "default"; ++ pinctrl-0 = <&i2c2_pins>; + clock-frequency = <400000>; + /* User DIP swithes [1:8] / User LEDS [1:2] */ + tca6416: gpio@21 { +@@ -205,6 +211,8 @@ tca6416: gpio@21 { + }; + + &i2c3 { ++ pinctrl-names = "default"; ++ pinctrl-0 = <&i2c3_pins>; + clock-frequency = <400000>; + }; + +@@ -223,6 +231,8 @@ &mmc3 { + }; + + &usbhshost { ++ pinctrl-names = "default"; ++ pinctrl-0 = <&hsusb1_pins>; + port1-mode = "ehci-phy"; + }; + +@@ -231,8 +241,35 @@ &usbhsehci { + }; + + &omap3_pmx_core { +- pinctrl-names = "default"; +- pinctrl-0 = <&hsusb1_rst_pins>; ++ ++ ethernet_pins: pinmux_ethernet_pins { ++ pinctrl-single,pins = < ++ OMAP3_CORE1_IOPAD(0x21fe, PIN_INPUT | MUX_MODE0) /* rmii_mdio_data */ ++ OMAP3_CORE1_IOPAD(0x2200, MUX_MODE0) /* rmii_mdio_clk */ ++ OMAP3_CORE1_IOPAD(0x2202, PIN_INPUT_PULLDOWN | MUX_MODE0) /* rmii_rxd0 */ ++ OMAP3_CORE1_IOPAD(0x2204, PIN_INPUT_PULLDOWN | MUX_MODE0) /* rmii_rxd1 */ ++ OMAP3_CORE1_IOPAD(0x2206, PIN_INPUT_PULLDOWN | MUX_MODE0) /* rmii_crs_dv */ ++ OMAP3_CORE1_IOPAD(0x2208, PIN_OUTPUT_PULLDOWN | MUX_MODE0) /* rmii_rxer */ ++ OMAP3_CORE1_IOPAD(0x220a, PIN_OUTPUT_PULLDOWN | MUX_MODE0) /* rmii_txd0 */ ++ OMAP3_CORE1_IOPAD(0x220c, PIN_OUTPUT_PULLDOWN | MUX_MODE0) /* rmii_txd1 */ ++ OMAP3_CORE1_IOPAD(0x220e, PIN_OUTPUT_PULLDOWN |MUX_MODE0) /* rmii_txen */ ++ OMAP3_CORE1_IOPAD(0x2210, PIN_INPUT_PULLDOWN | MUX_MODE0) /* rmii_50mhz_clk */ ++ >; ++ }; ++ ++ i2c2_pins: pinmux_i2c2_pins { ++ pinctrl-single,pins = < ++ OMAP3_CORE1_IOPAD(0x21be, PIN_INPUT_PULLUP | MUX_MODE0) /* i2c2_scl */ ++ OMAP3_CORE1_IOPAD(0x21c0, PIN_INPUT_PULLUP | MUX_MODE0) /* i2c2_sda */ ++ >; ++ }; ++ ++ i2c3_pins: pinmux_i2c3_pins { ++ pinctrl-single,pins = < ++ OMAP3_CORE1_IOPAD(0x21c2, PIN_INPUT_PULLUP | MUX_MODE0) /* i2c3_scl */ ++ OMAP3_CORE1_IOPAD(0x21c4, PIN_INPUT_PULLUP | MUX_MODE0) /* i2c3_sda */ ++ >; ++ }; + + leds_pins: pinmux_leds_pins { + pinctrl-single,pins = < +@@ -300,8 +337,6 @@ OMAP3_CORE1_IOPAD(0x20ba, PIN_OUTPUT | MUX_MODE4) /* gpmc_ncs6.gpio_57 */ + }; + + &omap3_pmx_core2 { +- pinctrl-names = "default"; +- pinctrl-0 = <&hsusb1_pins>; + + hsusb1_pins: pinmux_hsusb1_pins { + pinctrl-single,pins = < +diff --git a/arch/arm/boot/dts/am3517-som.dtsi b/arch/arm/boot/dts/am3517-som.dtsi +index 8b669e2eafec..f7b680f6c48a 100644 +--- a/arch/arm/boot/dts/am3517-som.dtsi ++++ b/arch/arm/boot/dts/am3517-som.dtsi +@@ -69,6 +69,8 @@ nand@0,0 { + }; + + &i2c1 { ++ pinctrl-names = "default"; ++ pinctrl-0 = <&i2c1_pins>; + clock-frequency = <400000>; + + s35390a: s35390a@30 { +@@ -179,6 +181,13 @@ bluetooth { + + &omap3_pmx_core { + ++ i2c1_pins: pinmux_i2c1_pins { ++ pinctrl-single,pins = < ++ OMAP3_CORE1_IOPAD(0x21ba, PIN_INPUT_PULLUP | MUX_MODE0) /* i2c1_scl */ ++ OMAP3_CORE1_IOPAD(0x21bc, PIN_INPUT_PULLUP | MUX_MODE0) /* i2c1_sda */ ++ >; ++ }; ++ + wl12xx_buffer_pins: pinmux_wl12xx_buffer_pins { + pinctrl-single,pins = < + OMAP3_CORE1_IOPAD(0x2156, PIN_OUTPUT | MUX_MODE4) /* mmc1_dat7.gpio_129 */ +-- +2.35.1 + diff --git a/queue-5.17/arm-dts-at91-fix-pinctrl-phandles.patch b/queue-5.17/arm-dts-at91-fix-pinctrl-phandles.patch new file mode 100644 index 00000000000..a63f2725257 --- /dev/null +++ b/queue-5.17/arm-dts-at91-fix-pinctrl-phandles.patch @@ -0,0 +1,78 @@ +From b2c6bf5be4d2e1520170f929e68e3deb2040ab17 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 31 Mar 2022 17:13:23 +0300 +Subject: ARM: dts: at91: fix pinctrl phandles + +From: Claudiu Beznea + +[ Upstream commit 0c640d9544d0109da3889d71ae77301e556db977 ] + +Commit bf781869e5cf ("ARM: dts: at91: add pinctrl-{names, 0} for all +gpios") introduces pinctrl phandles for pins used by individual +controllers to avoid failures due to commit 2ab73c6d8323 ("gpio: +Support GPIO controllers without pin-ranges"). For SPI controllers +available on SAMA5D4 and SAMA5D3 some of the pins are defined in +SoC specific dtsi on behalf of pinctrl-0. Adding extra pinctrl phandles +on board specific dts also on behalf of pinctrl-0 overwrite the pinctrl-0 +phandle specified in SoC specific dtsi. Thus add the board specific +pinctrl to pinctrl-1. + +Fixes: bf781869e5cf ("ARM: dts: at91: add pinctrl-{names, 0} for all gpios") +Depends-on: 5c8b49852910 ("ARM: dts: at91: sama5d4_xplained: fix pinctrl phandle name") +Reported-by: Ajay Kathat +Co-developed-by: Ajay Kathat +Signed-off-by: Ajay Kathat +Tested-by: Ajay Kathat +Signed-off-by: Claudiu Beznea +Signed-off-by: Nicolas Ferre +Link: https://lore.kernel.org/r/20220331141323.194355-2-claudiu.beznea@microchip.com +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/at91-sama5d3_xplained.dts | 8 ++++---- + arch/arm/boot/dts/at91-sama5d4_xplained.dts | 4 ++-- + 2 files changed, 6 insertions(+), 6 deletions(-) + +diff --git a/arch/arm/boot/dts/at91-sama5d3_xplained.dts b/arch/arm/boot/dts/at91-sama5d3_xplained.dts +index d72c042f2850..a49c2966b41e 100644 +--- a/arch/arm/boot/dts/at91-sama5d3_xplained.dts ++++ b/arch/arm/boot/dts/at91-sama5d3_xplained.dts +@@ -57,8 +57,8 @@ slot@0 { + }; + + spi0: spi@f0004000 { +- pinctrl-names = "default"; +- pinctrl-0 = <&pinctrl_spi0_cs>; ++ pinctrl-names = "default", "cs"; ++ pinctrl-1 = <&pinctrl_spi0_cs>; + cs-gpios = <&pioD 13 0>, <0>, <0>, <&pioD 16 0>; + status = "okay"; + }; +@@ -171,8 +171,8 @@ slot@0 { + }; + + spi1: spi@f8008000 { +- pinctrl-names = "default"; +- pinctrl-0 = <&pinctrl_spi1_cs>; ++ pinctrl-names = "default", "cs"; ++ pinctrl-1 = <&pinctrl_spi1_cs>; + cs-gpios = <&pioC 25 0>; + status = "okay"; + }; +diff --git a/arch/arm/boot/dts/at91-sama5d4_xplained.dts b/arch/arm/boot/dts/at91-sama5d4_xplained.dts +index accb92cfac44..e519d2747936 100644 +--- a/arch/arm/boot/dts/at91-sama5d4_xplained.dts ++++ b/arch/arm/boot/dts/at91-sama5d4_xplained.dts +@@ -81,8 +81,8 @@ usart4: serial@fc010000 { + }; + + spi1: spi@fc018000 { +- pinctrl-names = "default"; +- pinctrl-0 = <&pinctrl_spi1_cs>; ++ pinctrl-names = "default", "cs"; ++ pinctrl-1 = <&pinctrl_spi1_cs>; + cs-gpios = <&pioB 21 0>; + status = "okay"; + }; +-- +2.35.1 + diff --git a/queue-5.17/arm-dts-at91-map-mclk-for-wm8731-on-at91sam9g20ek.patch b/queue-5.17/arm-dts-at91-map-mclk-for-wm8731-on-at91sam9g20ek.patch new file mode 100644 index 00000000000..4572005a695 --- /dev/null +++ b/queue-5.17/arm-dts-at91-map-mclk-for-wm8731-on-at91sam9g20ek.patch @@ -0,0 +1,45 @@ +From 94d77e78f834cc865250100d851858aa58126178 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Apr 2022 11:28:05 +0100 +Subject: ARM: dts: at91: Map MCLK for wm8731 on at91sam9g20ek + +From: Mark Brown + +[ Upstream commit 0e486fe341fabd8e583f3d601a874cd394979c45 ] + +The MCLK of the WM8731 on the AT91SAM9G20-EK board is connected to the +PCK0 output of the SoC and is expected to be set to 12MHz. Previously +this was mapped using pre-common clock API calls in the audio machine +driver but the conversion to the common clock framework broke that so +describe things in the DT instead. + +Fixes: ff78a189b0ae55f ("ARM: at91: remove old at91-specific clock driver") +Signed-off-by: Mark Brown +Reviewed-by: Claudiu Beznea +Signed-off-by: Nicolas Ferre +Link: https://lore.kernel.org/r/20220404102806.581374-2-broonie@kernel.org +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/at91sam9g20ek_common.dtsi | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/arch/arm/boot/dts/at91sam9g20ek_common.dtsi b/arch/arm/boot/dts/at91sam9g20ek_common.dtsi +index 87bb39060e8b..ca03685f0f08 100644 +--- a/arch/arm/boot/dts/at91sam9g20ek_common.dtsi ++++ b/arch/arm/boot/dts/at91sam9g20ek_common.dtsi +@@ -219,6 +219,12 @@ i2c-gpio-0 { + wm8731: wm8731@1b { + compatible = "wm8731"; + reg = <0x1b>; ++ ++ /* PCK0 at 12MHz */ ++ clocks = <&pmc PMC_TYPE_SYSTEM 8>; ++ clock-names = "mclk"; ++ assigned-clocks = <&pmc PMC_TYPE_SYSTEM 8>; ++ assigned-clock-rates = <12000000>; + }; + }; + +-- +2.35.1 + diff --git a/queue-5.17/arm-dts-at91-sama5d4_xplained-fix-pinctrl-phandle-na.patch b/queue-5.17/arm-dts-at91-sama5d4_xplained-fix-pinctrl-phandle-na.patch new file mode 100644 index 00000000000..cf70f982c8a --- /dev/null +++ b/queue-5.17/arm-dts-at91-sama5d4_xplained-fix-pinctrl-phandle-na.patch @@ -0,0 +1,44 @@ +From 681d751918e29ff1d4815f48070a630cdc23703e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 31 Mar 2022 17:13:22 +0300 +Subject: ARM: dts: at91: sama5d4_xplained: fix pinctrl phandle name + +From: Claudiu Beznea + +[ Upstream commit 5c8b49852910caffeebb1ce541fdd264ffc691b8 ] + +Pinctrl phandle is for spi1 so rename it to reflect this. + +Signed-off-by: Claudiu Beznea +Signed-off-by: Nicolas Ferre +Link: https://lore.kernel.org/r/20220331141323.194355-1-claudiu.beznea@microchip.com +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/at91-sama5d4_xplained.dts | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/at91-sama5d4_xplained.dts b/arch/arm/boot/dts/at91-sama5d4_xplained.dts +index d241c24f0d83..accb92cfac44 100644 +--- a/arch/arm/boot/dts/at91-sama5d4_xplained.dts ++++ b/arch/arm/boot/dts/at91-sama5d4_xplained.dts +@@ -82,7 +82,7 @@ usart4: serial@fc010000 { + + spi1: spi@fc018000 { + pinctrl-names = "default"; +- pinctrl-0 = <&pinctrl_spi0_cs>; ++ pinctrl-0 = <&pinctrl_spi1_cs>; + cs-gpios = <&pioB 21 0>; + status = "okay"; + }; +@@ -140,7 +140,7 @@ pinctrl_macb0_phy_irq: macb0_phy_irq_0 { + atmel,pins = + ; + }; +- pinctrl_spi0_cs: spi0_cs_default { ++ pinctrl_spi1_cs: spi1_cs_default { + atmel,pins = + ; + }; +-- +2.35.1 + diff --git a/queue-5.17/arm-dts-dra7-fix-suspend-warning-for-vpe-powerdomain.patch b/queue-5.17/arm-dts-dra7-fix-suspend-warning-for-vpe-powerdomain.patch new file mode 100644 index 00000000000..bd7ee96c1c0 --- /dev/null +++ b/queue-5.17/arm-dts-dra7-fix-suspend-warning-for-vpe-powerdomain.patch @@ -0,0 +1,54 @@ +From 700bf52d638b847a5f8d2765cc0058675beca240 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Apr 2022 12:26:51 +0300 +Subject: ARM: dts: dra7: Fix suspend warning for vpe powerdomain + +From: Tony Lindgren + +[ Upstream commit 8d2453d9a307c2eafd21242dd73f35f05fb7ce74 ] + +We currently are getting the following warning after a system suspend: + +Powerdomain (vpe_pwrdm) didn't enter target state 0 + +Looks like this is because the STANDBYMODE bit for SMART_IDLE should +not be used. The TRM "Table 12-348. VPE_SYSCONFIG" says that the value +for SMART_IDLE is "0x2: Same behavior as bit-field value of 0x1". But +if the SMART_IDLE value is used, PM_VPE_PWRSTST LASTPOWERSTATEENTERED +bits always show value of 3. + +Let's fix the issue by dropping SMART_IDLE for vpe. And let's also add +the missing the powerdomain for vpe. + +Fixes: 1a2095160594 ("ARM: dts: dra7: Add ti-sysc node for VPE") +Cc: Benoit Parrot +Reported-by: Kevin Hilman +Reviewed-by: Kevin Hilman +Tested-by: Kevin Hilman +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/dra7-l4.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/dra7-l4.dtsi b/arch/arm/boot/dts/dra7-l4.dtsi +index 0a11bacffc1f..5733e3a4ea8e 100644 +--- a/arch/arm/boot/dts/dra7-l4.dtsi ++++ b/arch/arm/boot/dts/dra7-l4.dtsi +@@ -4188,11 +4188,11 @@ target-module@1d0010 { /* 0x489d0000, ap 27 30.0 */ + reg = <0x1d0010 0x4>; + reg-names = "sysc"; + ti,sysc-midle = , +- , +- ; ++ ; + ti,sysc-sidle = , + , + ; ++ power-domains = <&prm_vpe>; + clocks = <&vpe_clkctrl DRA7_VPE_VPE_CLKCTRL 0>; + clock-names = "fck"; + #address-cells = <1>; +-- +2.35.1 + diff --git a/queue-5.17/arm-dts-fix-mmc-order-for-omap3-gta04.patch b/queue-5.17/arm-dts-fix-mmc-order-for-omap3-gta04.patch new file mode 100644 index 00000000000..b93e9cbc05a --- /dev/null +++ b/queue-5.17/arm-dts-fix-mmc-order-for-omap3-gta04.patch @@ -0,0 +1,38 @@ +From 3f3410008ea1676c8c5186e2735f24dc408a248a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Mar 2022 14:00:20 +0100 +Subject: ARM: dts: Fix mmc order for omap3-gta04 + +From: H. Nikolaus Schaller + +[ Upstream commit 09269dd050094593fc747f2a5853d189fefcb6b5 ] + +Commit a1ebdb374199 ("ARM: dts: Fix swapped mmc order for omap3") +introduces general mmc aliases. Let's tailor them to the need +of the GTA04 board which does not make use of mmc2 and mmc3 interfaces. + +Fixes: a1ebdb374199 ("ARM: dts: Fix swapped mmc order for omap3") +Signed-off-by: H. Nikolaus Schaller +Message-Id: +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/omap3-gta04.dtsi | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/arm/boot/dts/omap3-gta04.dtsi b/arch/arm/boot/dts/omap3-gta04.dtsi +index 7e3d8147e2c1..0365f06165e9 100644 +--- a/arch/arm/boot/dts/omap3-gta04.dtsi ++++ b/arch/arm/boot/dts/omap3-gta04.dtsi +@@ -31,6 +31,8 @@ chosen { + aliases { + display0 = &lcd; + display1 = &tv0; ++ /delete-property/ mmc2; ++ /delete-property/ mmc3; + }; + + ldo_3v3: fixedregulator { +-- +2.35.1 + diff --git a/queue-5.17/arm-dts-imx6qdl-apalis-fix-sgtl5000-detection-issue.patch b/queue-5.17/arm-dts-imx6qdl-apalis-fix-sgtl5000-detection-issue.patch new file mode 100644 index 00000000000..557dfabdb27 --- /dev/null +++ b/queue-5.17/arm-dts-imx6qdl-apalis-fix-sgtl5000-detection-issue.patch @@ -0,0 +1,71 @@ +From c47abaeb3f8a38892117746c37113b038cf063b0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 26 Mar 2022 12:14:55 -0300 +Subject: ARM: dts: imx6qdl-apalis: Fix sgtl5000 detection issue + +From: Fabio Estevam + +[ Upstream commit fa51e1dc4b91375bc18349663a52395ad585bd3c ] + +On a custom carrier board with a i.MX6Q Apalis SoM, the sgtl5000 codec +on the SoM is often not detected and the following error message is +seen when the sgtl5000 driver tries to read the ID register: + +sgtl5000 1-000a: Error reading chip id -6 + +The reason for the error is that the MCLK clock is not provided +early enough. + +Fix the problem by describing the MCLK pinctrl inside the codec +node instead of placing it inside the audmux pinctrl group. + +With this change applied the sgtl5000 is always detected on every boot. + +Fixes: 693e3ffaae5a ("ARM: dts: imx6: Add support for Toradex Apalis iMX6Q/D SoM") +Signed-off-by: Fabio Estevam +Reviewed-by: Tim Harvey +Acked-by: Max Krummenacher +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/imx6qdl-apalis.dtsi | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/imx6qdl-apalis.dtsi b/arch/arm/boot/dts/imx6qdl-apalis.dtsi +index ed2739e39085..bd763bae596b 100644 +--- a/arch/arm/boot/dts/imx6qdl-apalis.dtsi ++++ b/arch/arm/boot/dts/imx6qdl-apalis.dtsi +@@ -286,6 +286,8 @@ vgen6_reg: vgen6 { + codec: sgtl5000@a { + compatible = "fsl,sgtl5000"; + reg = <0x0a>; ++ pinctrl-names = "default"; ++ pinctrl-0 = <&pinctrl_sgtl5000>; + clocks = <&clks IMX6QDL_CLK_CKO>; + VDDA-supply = <®_module_3v3_audio>; + VDDIO-supply = <®_module_3v3>; +@@ -517,8 +519,6 @@ MX6QDL_PAD_DISP0_DAT20__AUD4_TXC 0x130b0 + MX6QDL_PAD_DISP0_DAT21__AUD4_TXD 0x130b0 + MX6QDL_PAD_DISP0_DAT22__AUD4_TXFS 0x130b0 + MX6QDL_PAD_DISP0_DAT23__AUD4_RXD 0x130b0 +- /* SGTL5000 sys_mclk */ +- MX6QDL_PAD_GPIO_5__CCM_CLKO1 0x130b0 + >; + }; + +@@ -811,6 +811,12 @@ MX6QDL_PAD_NANDF_CS1__GPIO6_IO14 0x000b0 + >; + }; + ++ pinctrl_sgtl5000: sgtl5000grp { ++ fsl,pins = < ++ MX6QDL_PAD_GPIO_5__CCM_CLKO1 0x130b0 ++ >; ++ }; ++ + pinctrl_spdif: spdifgrp { + fsl,pins = < + MX6QDL_PAD_GPIO_16__SPDIF_IN 0x1b0b0 +-- +2.35.1 + diff --git a/queue-5.17/arm-dts-imx6ull-colibri-fix-vqmmc-regulator.patch b/queue-5.17/arm-dts-imx6ull-colibri-fix-vqmmc-regulator.patch new file mode 100644 index 00000000000..31f7722ca60 --- /dev/null +++ b/queue-5.17/arm-dts-imx6ull-colibri-fix-vqmmc-regulator.patch @@ -0,0 +1,39 @@ +From 48ed1c9e25fa4ca03469aa171902f06f78c876c0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Apr 2022 10:50:54 +0200 +Subject: ARM: dts: imx6ull-colibri: fix vqmmc regulator + +From: Max Krummenacher + +[ Upstream commit 45974e4276a8d6653394f66666fc57d8ffa6de9a ] + +The correct spelling for the property is gpios. Otherwise, the regulator +will neither reserve nor control any GPIOs. Thus, any SD/MMC card which +can use UHS-I modes will fail. + +Fixes: c2e4987e0e02 ("ARM: dts: imx6ull: add Toradex Colibri iMX6ULL support") +Signed-off-by: Max Krummenacher +Signed-off-by: Denys Drozdov +Signed-off-by: Marcel Ziswiler +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/imx6ull-colibri.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/imx6ull-colibri.dtsi b/arch/arm/boot/dts/imx6ull-colibri.dtsi +index 7f35a06dff95..951a2a6c5a65 100644 +--- a/arch/arm/boot/dts/imx6ull-colibri.dtsi ++++ b/arch/arm/boot/dts/imx6ull-colibri.dtsi +@@ -37,7 +37,7 @@ reg_module_3v3_avdd: regulator-module-3v3-avdd { + + reg_sd1_vmmc: regulator-sd1-vmmc { + compatible = "regulator-gpio"; +- gpio = <&gpio5 9 GPIO_ACTIVE_HIGH>; ++ gpios = <&gpio5 9 GPIO_ACTIVE_HIGH>; + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_snvs_reg_sd>; + regulator-always-on; +-- +2.35.1 + diff --git a/queue-5.17/arm-dts-logicpd-som-lv-fix-wrong-pinmuxing-on-omap35.patch b/queue-5.17/arm-dts-logicpd-som-lv-fix-wrong-pinmuxing-on-omap35.patch new file mode 100644 index 00000000000..f92bfc9d502 --- /dev/null +++ b/queue-5.17/arm-dts-logicpd-som-lv-fix-wrong-pinmuxing-on-omap35.patch @@ -0,0 +1,104 @@ +From 91dda074bd89d19acf14ae65ce1563dd3a7497cb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Mar 2022 11:18:17 -0600 +Subject: ARM: dts: logicpd-som-lv: Fix wrong pinmuxing on OMAP35 + +From: Adam Ford + +[ Upstream commit 46ff3df87215ff42c0cd2c4bdb7d74540384a69c ] + +The pinout of the OMAP35 and DM37 variants of the SOM-LV are the +same, but the macros which define the pinmuxing are different +between OMAP3530 and DM3730. The pinmuxing was correct for +for the DM3730, but wrong for the OMAP3530. Since the boot loader +was correctly pin-muxing the pins, this was not obvious. As the +bootloader not guaranteed to pinmux all the pins any more, this +causes an issue, so the pinmux needs to be moved from a common +file to their respective board files. + +Fixes: f8a2e3ff7103 ("ARM: dts: Add minimal support for LogicPD OMAP35xx SOM-LV devkit") +Signed-off-by: Adam Ford +Message-Id: <20220303171818.11060-1-aford173@gmail.com> +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/logicpd-som-lv-35xx-devkit.dts | 15 +++++++++++++++ + arch/arm/boot/dts/logicpd-som-lv-37xx-devkit.dts | 15 +++++++++++++++ + arch/arm/boot/dts/logicpd-som-lv.dtsi | 15 --------------- + 3 files changed, 30 insertions(+), 15 deletions(-) + +diff --git a/arch/arm/boot/dts/logicpd-som-lv-35xx-devkit.dts b/arch/arm/boot/dts/logicpd-som-lv-35xx-devkit.dts +index 2a0a98fe67f0..3240c67e0c39 100644 +--- a/arch/arm/boot/dts/logicpd-som-lv-35xx-devkit.dts ++++ b/arch/arm/boot/dts/logicpd-som-lv-35xx-devkit.dts +@@ -11,3 +11,18 @@ / { + model = "LogicPD Zoom OMAP35xx SOM-LV Development Kit"; + compatible = "logicpd,dm3730-som-lv-devkit", "ti,omap3430", "ti,omap3"; + }; ++ ++&omap3_pmx_core2 { ++ pinctrl-names = "default"; ++ pinctrl-0 = <&hsusb2_2_pins>; ++ hsusb2_2_pins: pinmux_hsusb2_2_pins { ++ pinctrl-single,pins = < ++ OMAP3430_CORE2_IOPAD(0x25f0, PIN_OUTPUT | MUX_MODE3) /* etk_d10.hsusb2_clk */ ++ OMAP3430_CORE2_IOPAD(0x25f2, PIN_OUTPUT | MUX_MODE3) /* etk_d11.hsusb2_stp */ ++ OMAP3430_CORE2_IOPAD(0x25f4, PIN_INPUT_PULLDOWN | MUX_MODE3) /* etk_d12.hsusb2_dir */ ++ OMAP3430_CORE2_IOPAD(0x25f6, PIN_INPUT_PULLDOWN | MUX_MODE3) /* etk_d13.hsusb2_nxt */ ++ OMAP3430_CORE2_IOPAD(0x25f8, PIN_INPUT_PULLDOWN | MUX_MODE3) /* etk_d14.hsusb2_data0 */ ++ OMAP3430_CORE2_IOPAD(0x25fa, PIN_INPUT_PULLDOWN | MUX_MODE3) /* etk_d15.hsusb2_data1 */ ++ >; ++ }; ++}; +diff --git a/arch/arm/boot/dts/logicpd-som-lv-37xx-devkit.dts b/arch/arm/boot/dts/logicpd-som-lv-37xx-devkit.dts +index a604d92221a4..c757f0d7781c 100644 +--- a/arch/arm/boot/dts/logicpd-som-lv-37xx-devkit.dts ++++ b/arch/arm/boot/dts/logicpd-som-lv-37xx-devkit.dts +@@ -11,3 +11,18 @@ / { + model = "LogicPD Zoom DM3730 SOM-LV Development Kit"; + compatible = "logicpd,dm3730-som-lv-devkit", "ti,omap3630", "ti,omap3"; + }; ++ ++&omap3_pmx_core2 { ++ pinctrl-names = "default"; ++ pinctrl-0 = <&hsusb2_2_pins>; ++ hsusb2_2_pins: pinmux_hsusb2_2_pins { ++ pinctrl-single,pins = < ++ OMAP3630_CORE2_IOPAD(0x25f0, PIN_OUTPUT | MUX_MODE3) /* etk_d10.hsusb2_clk */ ++ OMAP3630_CORE2_IOPAD(0x25f2, PIN_OUTPUT | MUX_MODE3) /* etk_d11.hsusb2_stp */ ++ OMAP3630_CORE2_IOPAD(0x25f4, PIN_INPUT_PULLDOWN | MUX_MODE3) /* etk_d12.hsusb2_dir */ ++ OMAP3630_CORE2_IOPAD(0x25f6, PIN_INPUT_PULLDOWN | MUX_MODE3) /* etk_d13.hsusb2_nxt */ ++ OMAP3630_CORE2_IOPAD(0x25f8, PIN_INPUT_PULLDOWN | MUX_MODE3) /* etk_d14.hsusb2_data0 */ ++ OMAP3630_CORE2_IOPAD(0x25fa, PIN_INPUT_PULLDOWN | MUX_MODE3) /* etk_d15.hsusb2_data1 */ ++ >; ++ }; ++}; +diff --git a/arch/arm/boot/dts/logicpd-som-lv.dtsi b/arch/arm/boot/dts/logicpd-som-lv.dtsi +index b56524cc7fe2..55b619c99e24 100644 +--- a/arch/arm/boot/dts/logicpd-som-lv.dtsi ++++ b/arch/arm/boot/dts/logicpd-som-lv.dtsi +@@ -265,21 +265,6 @@ OMAP3_WKUP_IOPAD(0x2a0c, PIN_OUTPUT | MUX_MODE4) /* sys_boot1.gpio_3 */ + }; + }; + +-&omap3_pmx_core2 { +- pinctrl-names = "default"; +- pinctrl-0 = <&hsusb2_2_pins>; +- hsusb2_2_pins: pinmux_hsusb2_2_pins { +- pinctrl-single,pins = < +- OMAP3630_CORE2_IOPAD(0x25f0, PIN_OUTPUT | MUX_MODE3) /* etk_d10.hsusb2_clk */ +- OMAP3630_CORE2_IOPAD(0x25f2, PIN_OUTPUT | MUX_MODE3) /* etk_d11.hsusb2_stp */ +- OMAP3630_CORE2_IOPAD(0x25f4, PIN_INPUT_PULLDOWN | MUX_MODE3) /* etk_d12.hsusb2_dir */ +- OMAP3630_CORE2_IOPAD(0x25f6, PIN_INPUT_PULLDOWN | MUX_MODE3) /* etk_d13.hsusb2_nxt */ +- OMAP3630_CORE2_IOPAD(0x25f8, PIN_INPUT_PULLDOWN | MUX_MODE3) /* etk_d14.hsusb2_data0 */ +- OMAP3630_CORE2_IOPAD(0x25fa, PIN_INPUT_PULLDOWN | MUX_MODE3) /* etk_d15.hsusb2_data1 */ +- >; +- }; +-}; +- + &uart2 { + interrupts-extended = <&intc 73 &omap3_pmx_core OMAP3_UART2_RX>; + pinctrl-names = "default"; +-- +2.35.1 + diff --git a/queue-5.17/arm-omap2-fix-refcount-leak-in-omap_gic_of_init.patch b/queue-5.17/arm-omap2-fix-refcount-leak-in-omap_gic_of_init.patch new file mode 100644 index 00000000000..00189ac6e97 --- /dev/null +++ b/queue-5.17/arm-omap2-fix-refcount-leak-in-omap_gic_of_init.patch @@ -0,0 +1,42 @@ +From 70a463bd323680706f2d45aa531b312ec5ed8178 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Mar 2022 10:43:01 +0000 +Subject: ARM: OMAP2+: Fix refcount leak in omap_gic_of_init + +From: Miaoqian Lin + +[ Upstream commit 0f83e6b4161617014017a694888dd8743f46f071 ] + +The of_find_compatible_node() function returns a node pointer with +refcount incremented, We should use of_node_put() on it when done +Add the missing of_node_put() to release the refcount. + +Fixes: fd1c07861491 ("ARM: OMAP4: Fix the init code to have OMAP4460 errata available in DT build") +Signed-off-by: Miaoqian Lin +Message-Id: <20220309104302.18398-1-linmq006@gmail.com> +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/mach-omap2/omap4-common.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/arm/mach-omap2/omap4-common.c b/arch/arm/mach-omap2/omap4-common.c +index 5c3845730dbf..0b80f8bcd304 100644 +--- a/arch/arm/mach-omap2/omap4-common.c ++++ b/arch/arm/mach-omap2/omap4-common.c +@@ -314,10 +314,12 @@ void __init omap_gic_of_init(void) + + np = of_find_compatible_node(NULL, NULL, "arm,cortex-a9-gic"); + gic_dist_base_addr = of_iomap(np, 0); ++ of_node_put(np); + WARN_ON(!gic_dist_base_addr); + + np = of_find_compatible_node(NULL, NULL, "arm,cortex-a9-twd-timer"); + twd_base = of_iomap(np, 0); ++ of_node_put(np); + WARN_ON(!twd_base); + + skip_errata_init: +-- +2.35.1 + diff --git a/queue-5.17/arm64-dts-imx8mn-ddr4-evk-describe-the-32.768-khz-pm.patch b/queue-5.17/arm64-dts-imx8mn-ddr4-evk-describe-the-32.768-khz-pm.patch new file mode 100644 index 00000000000..a29a7f0c220 --- /dev/null +++ b/queue-5.17/arm64-dts-imx8mn-ddr4-evk-describe-the-32.768-khz-pm.patch @@ -0,0 +1,45 @@ +From 7f3ede96a3bfbfe39751aba8d83b1946fe1b66d5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Apr 2022 14:47:31 -0300 +Subject: arm64: dts: imx8mn-ddr4-evk: Describe the 32.768 kHz PMIC clock + +From: Fabio Estevam + +[ Upstream commit 0310b5aa0656a94102344f1e9ae2892e342a665d ] + +The ROHM BD71847 PMIC has a 32.768 kHz clock. + +Describe the PMIC clock to fix the following boot errors: + +bd718xx-clk bd71847-clk.1.auto: No parent clk found +bd718xx-clk: probe of bd71847-clk.1.auto failed with error -22 + +Based on the same fix done for imx8mm-evk as per commit +a6a355ede574 ("arm64: dts: imx8mm-evk: Add 32.768 kHz clock to PMIC") + +Fixes: 3e44dd09736d ("arm64: dts: imx8mn-ddr4-evk: Add rohm,bd71847 PMIC support") +Signed-off-by: Fabio Estevam +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8mn-ddr4-evk.dts | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mn-ddr4-evk.dts b/arch/arm64/boot/dts/freescale/imx8mn-ddr4-evk.dts +index 7dfee715a2c4..d8ce217c6016 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mn-ddr4-evk.dts ++++ b/arch/arm64/boot/dts/freescale/imx8mn-ddr4-evk.dts +@@ -59,6 +59,10 @@ pmic@4b { + interrupts = <3 IRQ_TYPE_LEVEL_LOW>; + rohm,reset-snvs-powered; + ++ #clock-cells = <0>; ++ clocks = <&osc_32k 0>; ++ clock-output-names = "clk-32k-out"; ++ + regulators { + buck1_reg: BUCK1 { + regulator-name = "buck1"; +-- +2.35.1 + diff --git a/queue-5.17/arm64-dts-imx8mn-fix-sai-nodes.patch b/queue-5.17/arm64-dts-imx8mn-fix-sai-nodes.patch new file mode 100644 index 00000000000..3bb74aee96d --- /dev/null +++ b/queue-5.17/arm64-dts-imx8mn-fix-sai-nodes.patch @@ -0,0 +1,80 @@ +From 81ed7ec63eebcf811b9a8846243d7f08cc02e69f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Apr 2022 01:42:05 +0200 +Subject: arm64: dts: imx8mn: Fix SAI nodes + +From: Marek Vasut + +[ Upstream commit 574518b7ccbaef74cb89eb1a1a0da88afa1e0113 ] + +The most specific compatible string element should be "fsl,imx8mn-sai" +on i.MX8M Nano, fix it from current "fsl,imx8mm-sai" (two Ms, likely +due to copy-paste error from i.MX8M Mini). + +Fixes: 9e9860069725f ("arm64: dts: imx8mn: Add SAI nodes") +Signed-off-by: Marek Vasut +Cc: Adam Ford +Cc: Fabio Estevam +Cc: Peng Fan +Cc: Shawn Guo +Cc: NXP Linux Team +To: linux-arm-kernel@lists.infradead.org +Reviewed-by: Adam Ford +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8mn.dtsi | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mn.dtsi b/arch/arm64/boot/dts/freescale/imx8mn.dtsi +index b8d49d5f2668..98bfb53491fc 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mn.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mn.dtsi +@@ -291,7 +291,7 @@ spba2: spba-bus@30000000 { + ranges; + + sai2: sai@30020000 { +- compatible = "fsl,imx8mm-sai", "fsl,imx8mq-sai"; ++ compatible = "fsl,imx8mn-sai", "fsl,imx8mq-sai"; + reg = <0x30020000 0x10000>; + interrupts = ; + clocks = <&clk IMX8MN_CLK_SAI2_IPG>, +@@ -305,7 +305,7 @@ sai2: sai@30020000 { + }; + + sai3: sai@30030000 { +- compatible = "fsl,imx8mm-sai", "fsl,imx8mq-sai"; ++ compatible = "fsl,imx8mn-sai", "fsl,imx8mq-sai"; + reg = <0x30030000 0x10000>; + interrupts = ; + clocks = <&clk IMX8MN_CLK_SAI3_IPG>, +@@ -319,7 +319,7 @@ sai3: sai@30030000 { + }; + + sai5: sai@30050000 { +- compatible = "fsl,imx8mm-sai", "fsl,imx8mq-sai"; ++ compatible = "fsl,imx8mn-sai", "fsl,imx8mq-sai"; + reg = <0x30050000 0x10000>; + interrupts = ; + clocks = <&clk IMX8MN_CLK_SAI5_IPG>, +@@ -335,7 +335,7 @@ sai5: sai@30050000 { + }; + + sai6: sai@30060000 { +- compatible = "fsl,imx8mm-sai", "fsl,imx8mq-sai"; ++ compatible = "fsl,imx8mn-sai", "fsl,imx8mq-sai"; + reg = <0x30060000 0x10000>; + interrupts = ; + clocks = <&clk IMX8MN_CLK_SAI6_IPG>, +@@ -392,7 +392,7 @@ spdif1: spdif@30090000 { + }; + + sai7: sai@300b0000 { +- compatible = "fsl,imx8mm-sai", "fsl,imx8mq-sai"; ++ compatible = "fsl,imx8mn-sai", "fsl,imx8mq-sai"; + reg = <0x300b0000 0x10000>; + interrupts = ; + clocks = <&clk IMX8MN_CLK_SAI7_IPG>, +-- +2.35.1 + diff --git a/queue-5.17/arm64-dts-imx8mq-tqma8mq-change-the-spi-nor-tx.patch b/queue-5.17/arm64-dts-imx8mq-tqma8mq-change-the-spi-nor-tx.patch new file mode 100644 index 00000000000..bad61e4478a --- /dev/null +++ b/queue-5.17/arm64-dts-imx8mq-tqma8mq-change-the-spi-nor-tx.patch @@ -0,0 +1,36 @@ +From c3243920faf2c27a5ba2e724b980bd79ffb9b343 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 31 Mar 2022 15:02:06 +0200 +Subject: arm64: dts: imx8mq-tqma8mq: change the spi-nor tx + +From: Alexander Stein + +[ Upstream commit c7b45c79fb279e539346919a5c196e417925719e ] + +This fixes the qspi read command by importing the changes from commit +04aa946d57b2 ("arm64: dts: imx8: change the spi-nor tx"). + +Fixes: b186b8b6e770 ("arm64: dts: freescale: add initial device tree for TQMa8Mx with i.MX8M") +Signed-off-by: Alexander Stein +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8mq-tqma8mq.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mq-tqma8mq.dtsi b/arch/arm64/boot/dts/freescale/imx8mq-tqma8mq.dtsi +index 8aedcddfeab8..2c63b01e93e0 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mq-tqma8mq.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mq-tqma8mq.dtsi +@@ -253,7 +253,7 @@ flash0: flash@0 { + #address-cells = <1>; + #size-cells = <1>; + spi-max-frequency = <84000000>; +- spi-tx-bus-width = <4>; ++ spi-tx-bus-width = <1>; + spi-rx-bus-width = <4>; + }; + }; +-- +2.35.1 + diff --git a/queue-5.17/arm64-dts-imx8qm-correct-scu-clock-controller-s-comp.patch b/queue-5.17/arm64-dts-imx8qm-correct-scu-clock-controller-s-comp.patch new file mode 100644 index 00000000000..5080074a6aa --- /dev/null +++ b/queue-5.17/arm64-dts-imx8qm-correct-scu-clock-controller-s-comp.patch @@ -0,0 +1,51 @@ +From b2bde388c91ad7379d306264eaf42bb7b49ad137 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Mar 2022 16:04:43 +0800 +Subject: arm64: dts: imx8qm: Correct SCU clock controller's compatible + property + +From: Liu Ying + +[ Upstream commit dd2737fab4a6ce9ba4eb84842bedbd87d55241a6 ] + +The fsl,scu.txt dt-binding documentation explicitly mentions +that the compatible string should be either "fsl,imx8qm-clock" +or "fsl,imx8qxp-clock", followed by "fsl,scu-clk". Also, i.MX8qm +SCU clocks and i.MX8qxp SCU clocks are really not the same, so +we have to set the compatible property according to SoC name. +Let's correct the i.MX8qm clock controller's compatible property +from +"fsl,imx8qxp-clk", "fsl,scu-clk" +to +"fsl,imx8qm-clk", "fsl,scu-clk" . + +Fixes: f2180be18a63 ("arm64: dts: imx: add imx8qm common dts file") +Cc: Rob Herring +Cc: Shawn Guo +Cc: Sascha Hauer +Cc: Pengutronix Kernel Team +Cc: Fabio Estevam +Cc: NXP Linux Team +Signed-off-by: Liu Ying +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8qm.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx8qm.dtsi b/arch/arm64/boot/dts/freescale/imx8qm.dtsi +index 4a7c017b5f31..8fecd54198fb 100644 +--- a/arch/arm64/boot/dts/freescale/imx8qm.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8qm.dtsi +@@ -193,7 +193,7 @@ pd: imx8qx-pd { + }; + + clk: clock-controller { +- compatible = "fsl,imx8qxp-clk", "fsl,scu-clk"; ++ compatible = "fsl,imx8qm-clk", "fsl,scu-clk"; + #clock-cells = <2>; + }; + +-- +2.35.1 + diff --git a/queue-5.17/arm64-dts-meson-remove-cpu-opps-below-1ghz-for-g12b-.patch b/queue-5.17/arm64-dts-meson-remove-cpu-opps-below-1ghz-for-g12b-.patch new file mode 100644 index 00000000000..dbcb662a35e --- /dev/null +++ b/queue-5.17/arm64-dts-meson-remove-cpu-opps-below-1ghz-for-g12b-.patch @@ -0,0 +1,146 @@ +From 6b79ecd3c681600dd26ad43e3cd06ec11168eb37 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Feb 2022 10:06:37 +0000 +Subject: arm64: dts: meson: remove CPU opps below 1GHz for G12B boards + +From: Christian Hewitt + +[ Upstream commit 6c4d636bc00dc17c63ffb2a73a0da850240e26e3 ] + +Amlogic G12B devices experience CPU stalls and random board wedges when +the system idles and CPU cores clock down to lower opp points. Recent +vendor kernels include a change to remove 100-250MHz and other distro +sources also remove the 500/667MHz points. Unless all 100-667Mhz opps +are removed or the CPU governor forced to performance stalls are still +observed, so let's remove them to improve stability and uptime. + +Fixes: b96d4e92709b ("arm64: dts: meson-g12b: support a311d and s922x cpu operating points") +Signed-off-by: Christian Hewitt +Reviewed-by: Neil Armstrong +Signed-off-by: Neil Armstrong +Link: https://lore.kernel.org/r/20220210100638.19130-2-christianshewitt@gmail.com +Signed-off-by: Sasha Levin +--- + .../boot/dts/amlogic/meson-g12b-a311d.dtsi | 40 ------------------- + .../boot/dts/amlogic/meson-g12b-s922x.dtsi | 40 ------------------- + 2 files changed, 80 deletions(-) + +diff --git a/arch/arm64/boot/dts/amlogic/meson-g12b-a311d.dtsi b/arch/arm64/boot/dts/amlogic/meson-g12b-a311d.dtsi +index d61f43052a34..8e9ad1e51d66 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-g12b-a311d.dtsi ++++ b/arch/arm64/boot/dts/amlogic/meson-g12b-a311d.dtsi +@@ -11,26 +11,6 @@ cpu_opp_table_0: opp-table-0 { + compatible = "operating-points-v2"; + opp-shared; + +- opp-100000000 { +- opp-hz = /bits/ 64 <100000000>; +- opp-microvolt = <731000>; +- }; +- +- opp-250000000 { +- opp-hz = /bits/ 64 <250000000>; +- opp-microvolt = <731000>; +- }; +- +- opp-500000000 { +- opp-hz = /bits/ 64 <500000000>; +- opp-microvolt = <731000>; +- }; +- +- opp-667000000 { +- opp-hz = /bits/ 64 <667000000>; +- opp-microvolt = <731000>; +- }; +- + opp-1000000000 { + opp-hz = /bits/ 64 <1000000000>; + opp-microvolt = <761000>; +@@ -71,26 +51,6 @@ cpub_opp_table_1: opp-table-1 { + compatible = "operating-points-v2"; + opp-shared; + +- opp-100000000 { +- opp-hz = /bits/ 64 <100000000>; +- opp-microvolt = <731000>; +- }; +- +- opp-250000000 { +- opp-hz = /bits/ 64 <250000000>; +- opp-microvolt = <731000>; +- }; +- +- opp-500000000 { +- opp-hz = /bits/ 64 <500000000>; +- opp-microvolt = <731000>; +- }; +- +- opp-667000000 { +- opp-hz = /bits/ 64 <667000000>; +- opp-microvolt = <731000>; +- }; +- + opp-1000000000 { + opp-hz = /bits/ 64 <1000000000>; + opp-microvolt = <731000>; +diff --git a/arch/arm64/boot/dts/amlogic/meson-g12b-s922x.dtsi b/arch/arm64/boot/dts/amlogic/meson-g12b-s922x.dtsi +index 1e5d0ee5d541..44c23c984034 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-g12b-s922x.dtsi ++++ b/arch/arm64/boot/dts/amlogic/meson-g12b-s922x.dtsi +@@ -11,26 +11,6 @@ cpu_opp_table_0: opp-table-0 { + compatible = "operating-points-v2"; + opp-shared; + +- opp-100000000 { +- opp-hz = /bits/ 64 <100000000>; +- opp-microvolt = <731000>; +- }; +- +- opp-250000000 { +- opp-hz = /bits/ 64 <250000000>; +- opp-microvolt = <731000>; +- }; +- +- opp-500000000 { +- opp-hz = /bits/ 64 <500000000>; +- opp-microvolt = <731000>; +- }; +- +- opp-667000000 { +- opp-hz = /bits/ 64 <667000000>; +- opp-microvolt = <731000>; +- }; +- + opp-1000000000 { + opp-hz = /bits/ 64 <1000000000>; + opp-microvolt = <731000>; +@@ -76,26 +56,6 @@ cpub_opp_table_1: opp-table-1 { + compatible = "operating-points-v2"; + opp-shared; + +- opp-100000000 { +- opp-hz = /bits/ 64 <100000000>; +- opp-microvolt = <751000>; +- }; +- +- opp-250000000 { +- opp-hz = /bits/ 64 <250000000>; +- opp-microvolt = <751000>; +- }; +- +- opp-500000000 { +- opp-hz = /bits/ 64 <500000000>; +- opp-microvolt = <751000>; +- }; +- +- opp-667000000 { +- opp-hz = /bits/ 64 <667000000>; +- opp-microvolt = <751000>; +- }; +- + opp-1000000000 { + opp-hz = /bits/ 64 <1000000000>; + opp-microvolt = <771000>; +-- +2.35.1 + diff --git a/queue-5.17/arm64-dts-meson-remove-cpu-opps-below-1ghz-for-sm1-b.patch b/queue-5.17/arm64-dts-meson-remove-cpu-opps-below-1ghz-for-sm1-b.patch new file mode 100644 index 00000000000..e06b72a3b83 --- /dev/null +++ b/queue-5.17/arm64-dts-meson-remove-cpu-opps-below-1ghz-for-sm1-b.patch @@ -0,0 +1,60 @@ +From 28c4a5335031ee51b8552d89f110ef0eab8dfc3e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Feb 2022 10:06:38 +0000 +Subject: arm64: dts: meson: remove CPU opps below 1GHz for SM1 boards + +From: Christian Hewitt + +[ Upstream commit fd86d85401c2049f652293877c0f7e6e5afc3bbc ] + +Amlogic SM1 devices experience CPU stalls and random board wedges when +the system idles and CPU cores clock down to lower opp points. Recent +vendor kernels include a change to remove 100-250MHz and other distro +sources also remove the 500/667MHz points. Unless all 100-667Mhz opps +are removed or the CPU governor forced to performance stalls are still +observed, so let's remove them to improve stability and uptime. + +Fixes: 3d9e76483049 ("arm64: dts: meson-sm1-sei610: enable DVFS") +Signed-off-by: Christian Hewitt +Reviewed-by: Neil Armstrong +Signed-off-by: Neil Armstrong +Link: https://lore.kernel.org/r/20220210100638.19130-3-christianshewitt@gmail.com +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/amlogic/meson-sm1.dtsi | 20 -------------------- + 1 file changed, 20 deletions(-) + +diff --git a/arch/arm64/boot/dts/amlogic/meson-sm1.dtsi b/arch/arm64/boot/dts/amlogic/meson-sm1.dtsi +index 3d8b1f4f2001..78bdbd2ccc9d 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-sm1.dtsi ++++ b/arch/arm64/boot/dts/amlogic/meson-sm1.dtsi +@@ -95,26 +95,6 @@ cpu_opp_table: opp-table { + compatible = "operating-points-v2"; + opp-shared; + +- opp-100000000 { +- opp-hz = /bits/ 64 <100000000>; +- opp-microvolt = <730000>; +- }; +- +- opp-250000000 { +- opp-hz = /bits/ 64 <250000000>; +- opp-microvolt = <730000>; +- }; +- +- opp-500000000 { +- opp-hz = /bits/ 64 <500000000>; +- opp-microvolt = <730000>; +- }; +- +- opp-667000000 { +- opp-hz = /bits/ 64 <666666666>; +- opp-microvolt = <750000>; +- }; +- + opp-1000000000 { + opp-hz = /bits/ 64 <1000000000>; + opp-microvolt = <770000>; +-- +2.35.1 + diff --git a/queue-5.17/arm64-dts-meson-sm1-bananapi-m5-fix-wrong-gpio-pin-l.patch b/queue-5.17/arm64-dts-meson-sm1-bananapi-m5-fix-wrong-gpio-pin-l.patch new file mode 100644 index 00000000000..e0655af67e5 --- /dev/null +++ b/queue-5.17/arm64-dts-meson-sm1-bananapi-m5-fix-wrong-gpio-pin-l.patch @@ -0,0 +1,42 @@ +From 6ca24e58d6d2e27a88bfb20f61cf707a4ae7f7c9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Apr 2022 10:44:28 -0400 +Subject: arm64: dts: meson-sm1-bananapi-m5: fix wrong GPIO pin labeling for + CON1 + +From: Guillaume Giraudon + +[ Upstream commit 962dd65e575dde950ef0844568edc37cfb39f302 ] + +The labels for lines 61 through 84 on the periphs-banks were offset by 2. +2 lines are missing in the BOOT GPIO lines (contains 14, should be 16) +Added 2 empty entries in BOOT to realigned the rest of GPIO labels +to match the Banana Pi M5 schematics. + +(Thanks to Neil Armstrong for the heads up on the position of the missing pins) + +Fixes: 976e920183e4 ("arm64: dts: meson-sm1: add Banana PI BPI-M5 board dts") +Signed-off-by: Guillaume Giraudon +Reviewed-by: Neil Armstrong +Signed-off-by: Neil Armstrong +Link: https://lore.kernel.org/r/20220411144427.874-1-ggiraudon@prism19.com +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/amlogic/meson-sm1-bananapi-m5.dts | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/boot/dts/amlogic/meson-sm1-bananapi-m5.dts b/arch/arm64/boot/dts/amlogic/meson-sm1-bananapi-m5.dts +index 5751c48620ed..cadba194b149 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-sm1-bananapi-m5.dts ++++ b/arch/arm64/boot/dts/amlogic/meson-sm1-bananapi-m5.dts +@@ -437,6 +437,7 @@ &gpio { + "", + "eMMC_RST#", /* BOOT_12 */ + "eMMC_DS", /* BOOT_13 */ ++ "", "", + /* GPIOC */ + "SD_D0_B", /* GPIOC_0 */ + "SD_D1_B", /* GPIOC_1 */ +-- +2.35.1 + diff --git a/queue-5.17/asoc-cs35l41-fix-a-shift-out-of-bounds-warning-found.patch b/queue-5.17/asoc-cs35l41-fix-a-shift-out-of-bounds-warning-found.patch new file mode 100644 index 00000000000..ea778684dc2 --- /dev/null +++ b/queue-5.17/asoc-cs35l41-fix-a-shift-out-of-bounds-warning-found.patch @@ -0,0 +1,71 @@ +From 1c26253a5e90f03c91ed957e805f220a6812e9bc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Mar 2022 16:18:39 +0800 +Subject: ASoC: cs35l41: Fix a shift-out-of-bounds warning found by UBSAN + +From: Hui Wang + +[ Upstream commit 0b3d5d2e358ca6772fc3662fca27acb12a682fbf ] + +We enabled UBSAN in the ubuntu kernel, and the cs35l41 driver triggers +a warning calltrace like below: + +cs35l41-hda i2c-CSC3551:00-cs35l41-hda.0: bitoffset= 8, word_offset=23, bit_sum mod 32=0, otp_map[i].size = 24 +cs35l41-hda i2c-CSC3551:00-cs35l41-hda.0: bitoffset= 0, word_offset=24, bit_sum mod 32=24, otp_map[i].size = 0 +================================================================================ +UBSAN: shift-out-of-bounds in linux-kernel-src/sound/soc/codecs/cs35l41-lib.c:836:8 +shift exponent 64 is too large for 64-bit type 'long unsigned int' +CPU: 10 PID: 595 Comm: systemd-udevd Not tainted 5.15.0-23-generic #23 +Hardware name: LENOVO \x02MFG_IN_GO/\x02MFG_IN_GO, BIOS N3GET19W (1.00 ) 03/11/2022 +Call Trace: + + show_stack+0x52/0x58 + dump_stack_lvl+0x4a/0x5f + dump_stack+0x10/0x12 + ubsan_epilogue+0x9/0x45 + __ubsan_handle_shift_out_of_bounds.cold+0x61/0xef + ? regmap_unlock_mutex+0xe/0x10 + cs35l41_otp_unpack.cold+0x1c6/0x2b2 [snd_soc_cs35l41_lib] + cs35l41_hda_probe+0x24f/0x33a [snd_hda_scodec_cs35l41] + cs35l41_hda_i2c_probe+0x65/0x90 [snd_hda_scodec_cs35l41_i2c] + +When both bitoffset and otp_map[i].size are 0, the line 836 will +result in GENMASK(-1, 0), this triggers the shift-out-of-bounds +calltrace. + +Here add a checking, if both bitoffset and otp_map[i].size are 0, +do not run GENMASK() and directly set otp_val to 0, this will not +bring any function change on the driver but could avoid the calltrace. + +Signed-off-by: Hui Wang +Link: https://lore.kernel.org/r/20220324081839.62009-2-hui.wang@canonical.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/cs35l41-lib.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/cs35l41-lib.c b/sound/soc/codecs/cs35l41-lib.c +index e5a56bcbb223..281a710a4123 100644 +--- a/sound/soc/codecs/cs35l41-lib.c ++++ b/sound/soc/codecs/cs35l41-lib.c +@@ -831,12 +831,14 @@ int cs35l41_otp_unpack(struct device *dev, struct regmap *regmap) + GENMASK(bit_offset + otp_map[i].size - 33, 0)) << + (32 - bit_offset); + bit_offset += otp_map[i].size - 32; +- } else { ++ } else if (bit_offset + otp_map[i].size - 1 >= 0) { + otp_val = (otp_mem[word_offset] & + GENMASK(bit_offset + otp_map[i].size - 1, bit_offset) + ) >> bit_offset; + bit_offset += otp_map[i].size; +- } ++ } else /* both bit_offset and otp_map[i].size are 0 */ ++ otp_val = 0; ++ + bit_sum += otp_map[i].size; + + if (bit_offset == 32) { +-- +2.35.1 + diff --git a/queue-5.17/asoc-intel-soc-acpi-correct-device-endpoints-for-max.patch b/queue-5.17/asoc-intel-soc-acpi-correct-device-endpoints-for-max.patch new file mode 100644 index 00000000000..31e1446bb41 --- /dev/null +++ b/queue-5.17/asoc-intel-soc-acpi-correct-device-endpoints-for-max.patch @@ -0,0 +1,46 @@ +From ea4c73e6911dab12120afc3844e9c07491b052a5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Apr 2022 14:23:41 -0500 +Subject: ASoC: Intel: soc-acpi: correct device endpoints for max98373 + +From: Chao Song + +[ Upstream commit 97326be14df7bacc6ba5c62c0556298c27ea0432 ] + +The left speaker of max98373 uses spk_r_endpoint, and right +speaker uses spk_l_endpoint, this is obviously wrong. + +This patch corrects the endpoints for max98373 codec. + +Signed-off-by: Chao Song +Signed-off-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20220406192341.271465-1-pierre-louis.bossart@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/common/soc-acpi-intel-tgl-match.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/intel/common/soc-acpi-intel-tgl-match.c b/sound/soc/intel/common/soc-acpi-intel-tgl-match.c +index e2658bca6931..3137cea78d48 100644 +--- a/sound/soc/intel/common/soc-acpi-intel-tgl-match.c ++++ b/sound/soc/intel/common/soc-acpi-intel-tgl-match.c +@@ -132,13 +132,13 @@ static const struct snd_soc_acpi_adr_device mx8373_1_adr[] = { + { + .adr = 0x000123019F837300ull, + .num_endpoints = 1, +- .endpoints = &spk_l_endpoint, ++ .endpoints = &spk_r_endpoint, + .name_prefix = "Right" + }, + { + .adr = 0x000127019F837300ull, + .num_endpoints = 1, +- .endpoints = &spk_r_endpoint, ++ .endpoints = &spk_l_endpoint, + .name_prefix = "Left" + } + }; +-- +2.35.1 + diff --git a/queue-5.17/asoc-intel-sof_es8336-add-a-quirk-for-huawei-mateboo.patch b/queue-5.17/asoc-intel-sof_es8336-add-a-quirk-for-huawei-mateboo.patch new file mode 100644 index 00000000000..88d76a0c8da --- /dev/null +++ b/queue-5.17/asoc-intel-sof_es8336-add-a-quirk-for-huawei-mateboo.patch @@ -0,0 +1,49 @@ +From e16a23e5cb743697d0aa0277cea4ee52b2ef6ee2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Apr 2022 20:49:59 +0200 +Subject: ASoC: Intel: sof_es8336: Add a quirk for Huawei Matebook D15 + +From: Mauro Carvalho Chehab + +[ Upstream commit c7cb4717f641db68e8117635bfcf62a9c27dc8d3 ] + +Based on experimental tests, Huawei Matebook D15 actually uses +both gpio0 and gpio1: the first one controls the speaker, while +the other one controls the headphone. + +Also, the headset is mapped as MIC1, instead of MIC2. + +So, add a quirk for it. + +Signed-off-by: Mauro Carvalho Chehab +Acked-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/d678aef9fc9a07aced611aa7cb8c9b800c649e5a.1649357263.git.mchehab@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/sof_es8336.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/sound/soc/intel/boards/sof_es8336.c b/sound/soc/intel/boards/sof_es8336.c +index 28d7670b8f8f..b18951a8f309 100644 +--- a/sound/soc/intel/boards/sof_es8336.c ++++ b/sound/soc/intel/boards/sof_es8336.c +@@ -252,6 +252,15 @@ static const struct dmi_system_id sof_es8336_quirk_table[] = { + SOF_ES8336_TGL_GPIO_QUIRK | + SOF_ES8336_ENABLE_DMIC) + }, ++ { ++ .callback = sof_es8336_quirk_cb, ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "HUAWEI"), ++ DMI_MATCH(DMI_BOARD_NAME, "BOHB-WAX9-PCB-B2"), ++ }, ++ .driver_data = (void *)(SOF_ES8336_HEADPHONE_GPIO | ++ SOC_ES8336_HEADSET_MIC1) ++ }, + {} + }; + +-- +2.35.1 + diff --git a/queue-5.17/asoc-rt711-5682-check-if-bus-is-active-before-deferr.patch b/queue-5.17/asoc-rt711-5682-check-if-bus-is-active-before-deferr.patch new file mode 100644 index 00000000000..6cc6e5caa35 --- /dev/null +++ b/queue-5.17/asoc-rt711-5682-check-if-bus-is-active-before-deferr.patch @@ -0,0 +1,75 @@ +From a15cd2830f42c0bba97e301513c8c8ae10dd8613 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Apr 2022 14:20:05 -0500 +Subject: ASoC: rt711/5682: check if bus is active before deferred jack + detection + +From: Pierre-Louis Bossart + +[ Upstream commit 770f3d992a3f7330f801dfeee98429b2885c9fdb ] + +This patch takes a defensive programming and paranoid approach in case +the parent device (SoundWire) is pm_runtime resumed but the rt711 +device is not. In that case, during the attachment and initialization, +a jack detection workqueue can be scheduled. Since the pm_runtime +suspend routines will not be invoked, the sequence to cancel all +deferred work is not executed, and the jack detection could happen +after the bus stops operating, leading to a timeout. + +This patch applies the same solution to rt5682, based on the +similarities between codec drivers. The race condition with rt5682 was +not detected experimentally though. + +BugLink: https://github.com/thesofproject/linux/issues/3459 +Signed-off-by: Pierre-Louis Bossart +Reviewed-by: Rander Wang +Reviewed-by: Bard Liao +Link: https://lore.kernel.org/r/20220406192005.262996-1-pierre-louis.bossart@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/rt5682.c | 9 +++++++++ + sound/soc/codecs/rt711.c | 7 +++++++ + 2 files changed, 16 insertions(+) + +diff --git a/sound/soc/codecs/rt5682.c b/sound/soc/codecs/rt5682.c +index c9ff9c89adf7..2b6c6d6b9771 100644 +--- a/sound/soc/codecs/rt5682.c ++++ b/sound/soc/codecs/rt5682.c +@@ -1100,6 +1100,15 @@ void rt5682_jack_detect_handler(struct work_struct *work) + return; + } + ++ if (rt5682->is_sdw) { ++ if (pm_runtime_status_suspended(rt5682->slave->dev.parent)) { ++ dev_dbg(&rt5682->slave->dev, ++ "%s: parent device is pm_runtime_status_suspended, skipping jack detection\n", ++ __func__); ++ return; ++ } ++ } ++ + dapm = snd_soc_component_get_dapm(rt5682->component); + + snd_soc_dapm_mutex_lock(dapm); +diff --git a/sound/soc/codecs/rt711.c b/sound/soc/codecs/rt711.c +index 6770825d037a..ea25fd58d43a 100644 +--- a/sound/soc/codecs/rt711.c ++++ b/sound/soc/codecs/rt711.c +@@ -245,6 +245,13 @@ static void rt711_jack_detect_handler(struct work_struct *work) + if (!rt711->component->card->instantiated) + return; + ++ if (pm_runtime_status_suspended(rt711->slave->dev.parent)) { ++ dev_dbg(&rt711->slave->dev, ++ "%s: parent device is pm_runtime_status_suspended, skipping jack detection\n", ++ __func__); ++ return; ++ } ++ + reg = RT711_VERB_GET_PIN_SENSE | RT711_HP_OUT; + ret = regmap_read(rt711->regmap, reg, &jack_status); + if (ret < 0) +-- +2.35.1 + diff --git a/queue-5.17/asoc-soc-pcm-use-gfp_kernel-when-the-code-is-sleepab.patch b/queue-5.17/asoc-soc-pcm-use-gfp_kernel-when-the-code-is-sleepab.patch new file mode 100644 index 00000000000..7aff2755d88 --- /dev/null +++ b/queue-5.17/asoc-soc-pcm-use-gfp_kernel-when-the-code-is-sleepab.patch @@ -0,0 +1,43 @@ +From 7dff9eca5da5f45bfdf20cca41a4ccc74daa88ff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 31 Mar 2022 22:19:44 +0200 +Subject: ASoC: soc-pcm: use GFP_KERNEL when the code is sleepable + +From: Christophe JAILLET + +[ Upstream commit fb6d679fee95d272c0a94912c4e534146823ee89 ] + +At the kzalloc() call in dpcm_be_connect(), there is no spin lock involved. +It's merely protected by card->pcm_mutex, instead. The spinlock is applied +at the later call with snd_soc_pcm_stream_lock_irq() only for the list +manipulations. (See it's *_irq(), not *_irqsave(); that means the context +being sleepable at that point.) So, we can use GFP_KERNEL safely there. + +This patch revert commit d8a9c6e1f676 ("ASoC: soc-pcm: use GFP_ATOMIC for +dpcm structure") which is no longer needed since commit b7898396f4bb +("ASoC: soc-pcm: Fix and cleanup DPCM locking"). + +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/e740f1930843060e025e3c0f17ec1393cfdafb26.1648757961.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/soc-pcm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c +index 9a954680d492..11c9853e9e80 100644 +--- a/sound/soc/soc-pcm.c ++++ b/sound/soc/soc-pcm.c +@@ -1214,7 +1214,7 @@ static int dpcm_be_connect(struct snd_soc_pcm_runtime *fe, + be_substream->pcm->nonatomic = 1; + } + +- dpcm = kzalloc(sizeof(struct snd_soc_dpcm), GFP_ATOMIC); ++ dpcm = kzalloc(sizeof(struct snd_soc_dpcm), GFP_KERNEL); + if (!dpcm) + return -ENOMEM; + +-- +2.35.1 + diff --git a/queue-5.17/asoc-wm8731-disable-the-regulator-when-probing-fails.patch b/queue-5.17/asoc-wm8731-disable-the-regulator-when-probing-fails.patch new file mode 100644 index 00000000000..d29cf6e492e --- /dev/null +++ b/queue-5.17/asoc-wm8731-disable-the-regulator-when-probing-fails.patch @@ -0,0 +1,90 @@ +From a6481f7ce902e13e3dcd911dabfc18b75da58938 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Apr 2022 20:10:38 +0800 +Subject: ASoC: wm8731: Disable the regulator when probing fails + +From: Zheyu Ma + +[ Upstream commit 92ccbf17eeacf510cf1eed9c252d9332ca24f02d ] + +When the driver fails during probing, the driver should disable the +regulator, not just handle it in wm8731_hw_init(). + +The following log reveals it: + +[ 17.812483] WARNING: CPU: 1 PID: 364 at drivers/regulator/core.c:2257 _regulator_put+0x3ec/0x4e0 +[ 17.815958] RIP: 0010:_regulator_put+0x3ec/0x4e0 +[ 17.824467] Call Trace: +[ 17.824774] +[ 17.825040] regulator_bulk_free+0x82/0xe0 +[ 17.825514] devres_release_group+0x319/0x3d0 +[ 17.825882] i2c_device_probe+0x766/0x940 +[ 17.829198] i2c_register_driver+0xb5/0x130 + +Signed-off-by: Zheyu Ma +Link: https://lore.kernel.org/r/20220405121038.4094051-1-zheyuma97@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wm8731.c | 19 +++++++++++-------- + 1 file changed, 11 insertions(+), 8 deletions(-) + +diff --git a/sound/soc/codecs/wm8731.c b/sound/soc/codecs/wm8731.c +index 86b1f6eaa599..518167d90b10 100644 +--- a/sound/soc/codecs/wm8731.c ++++ b/sound/soc/codecs/wm8731.c +@@ -602,7 +602,7 @@ static int wm8731_hw_init(struct device *dev, struct wm8731_priv *wm8731) + ret = wm8731_reset(wm8731->regmap); + if (ret < 0) { + dev_err(dev, "Failed to issue reset: %d\n", ret); +- goto err_regulator_enable; ++ goto err; + } + + /* Clear POWEROFF, keep everything else disabled */ +@@ -619,10 +619,7 @@ static int wm8731_hw_init(struct device *dev, struct wm8731_priv *wm8731) + + regcache_mark_dirty(wm8731->regmap); + +-err_regulator_enable: +- /* Regulators will be enabled by bias management */ +- regulator_bulk_disable(ARRAY_SIZE(wm8731->supplies), wm8731->supplies); +- ++err: + return ret; + } + +@@ -760,21 +757,27 @@ static int wm8731_i2c_probe(struct i2c_client *i2c, + ret = PTR_ERR(wm8731->regmap); + dev_err(&i2c->dev, "Failed to allocate register map: %d\n", + ret); +- return ret; ++ goto err_regulator_enable; + } + + ret = wm8731_hw_init(&i2c->dev, wm8731); + if (ret != 0) +- return ret; ++ goto err_regulator_enable; + + ret = devm_snd_soc_register_component(&i2c->dev, + &soc_component_dev_wm8731, &wm8731_dai, 1); + if (ret != 0) { + dev_err(&i2c->dev, "Failed to register CODEC: %d\n", ret); +- return ret; ++ goto err_regulator_enable; + } + + return 0; ++ ++err_regulator_enable: ++ /* Regulators will be enabled by bias management */ ++ regulator_bulk_disable(ARRAY_SIZE(wm8731->supplies), wm8731->supplies); ++ ++ return ret; + } + + static int wm8731_i2c_remove(struct i2c_client *client) +-- +2.35.1 + diff --git a/queue-5.17/bluetooth-hci_event-fix-checking-for-invalid-handle-.patch b/queue-5.17/bluetooth-hci_event-fix-checking-for-invalid-handle-.patch new file mode 100644 index 00000000000..bc0bfe81973 --- /dev/null +++ b/queue-5.17/bluetooth-hci_event-fix-checking-for-invalid-handle-.patch @@ -0,0 +1,212 @@ +From dca0705ae6c2009f09bdfc366b720a30b71f0958 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Apr 2022 12:58:16 -0700 +Subject: Bluetooth: hci_event: Fix checking for invalid handle on error status + +From: Luiz Augusto von Dentz + +[ Upstream commit c86cc5a3ec70f5644f1fa21610b943d0441bc1f7 ] + +Commit d5ebaa7c5f6f6 introduces checks for handle range +(e.g HCI_CONN_HANDLE_MAX) but controllers like Intel AX200 don't seem +to respect the valid range int case of error status: + +> HCI Event: Connect Complete (0x03) plen 11 + Status: Page Timeout (0x04) + Handle: 65535 + Address: 94:DB:56:XX:XX:XX (Sony Home Entertainment& + Sound Products Inc) + Link type: ACL (0x01) + Encryption: Disabled (0x00) +[1644965.827560] Bluetooth: hci0: Ignoring HCI_Connection_Complete for invalid handle + +Because of it is impossible to cleanup the connections properly since +the stack would attempt to cancel the connection which is no longer in +progress causing the following trace: + +< HCI Command: Create Connection Cancel (0x01|0x0008) plen 6 + Address: 94:DB:56:XX:XX:XX (Sony Home Entertainment& + Sound Products Inc) += bluetoothd: src/profile.c:record_cb() Unable to get Hands-Free Voice + gateway SDP record: Connection timed out +> HCI Event: Command Complete (0x0e) plen 10 + Create Connection Cancel (0x01|0x0008) ncmd 1 + Status: Unknown Connection Identifier (0x02) + Address: 94:DB:56:XX:XX:XX (Sony Home Entertainment& + Sound Products Inc) +< HCI Command: Create Connection Cancel (0x01|0x0008) plen 6 + Address: 94:DB:56:XX:XX:XX (Sony Home Entertainment& + Sound Products Inc) + +Fixes: d5ebaa7c5f6f6 ("Bluetooth: hci_event: Ignore multiple conn complete events") +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +--- + include/net/bluetooth/hci.h | 1 + + net/bluetooth/hci_event.c | 65 ++++++++++++++++++++----------------- + 2 files changed, 37 insertions(+), 29 deletions(-) + +diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h +index 5cb095b09a94..69ef31cea582 100644 +--- a/include/net/bluetooth/hci.h ++++ b/include/net/bluetooth/hci.h +@@ -578,6 +578,7 @@ enum { + #define HCI_ERROR_CONNECTION_TIMEOUT 0x08 + #define HCI_ERROR_REJ_LIMITED_RESOURCES 0x0d + #define HCI_ERROR_REJ_BAD_ADDR 0x0f ++#define HCI_ERROR_INVALID_PARAMETERS 0x12 + #define HCI_ERROR_REMOTE_USER_TERM 0x13 + #define HCI_ERROR_REMOTE_LOW_RESOURCES 0x14 + #define HCI_ERROR_REMOTE_POWER_OFF 0x15 +diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c +index d984777c9b58..33a1b4115194 100644 +--- a/net/bluetooth/hci_event.c ++++ b/net/bluetooth/hci_event.c +@@ -3067,13 +3067,9 @@ static void hci_conn_complete_evt(struct hci_dev *hdev, void *data, + { + struct hci_ev_conn_complete *ev = data; + struct hci_conn *conn; ++ u8 status = ev->status; + +- if (__le16_to_cpu(ev->handle) > HCI_CONN_HANDLE_MAX) { +- bt_dev_err(hdev, "Ignoring HCI_Connection_Complete for invalid handle"); +- return; +- } +- +- bt_dev_dbg(hdev, "status 0x%2.2x", ev->status); ++ bt_dev_dbg(hdev, "status 0x%2.2x", status); + + hci_dev_lock(hdev); + +@@ -3122,8 +3118,14 @@ static void hci_conn_complete_evt(struct hci_dev *hdev, void *data, + goto unlock; + } + +- if (!ev->status) { ++ if (!status) { + conn->handle = __le16_to_cpu(ev->handle); ++ if (conn->handle > HCI_CONN_HANDLE_MAX) { ++ bt_dev_err(hdev, "Invalid handle: 0x%4.4x > 0x%4.4x", ++ conn->handle, HCI_CONN_HANDLE_MAX); ++ status = HCI_ERROR_INVALID_PARAMETERS; ++ goto done; ++ } + + if (conn->type == ACL_LINK) { + conn->state = BT_CONFIG; +@@ -3164,18 +3166,18 @@ static void hci_conn_complete_evt(struct hci_dev *hdev, void *data, + hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE, sizeof(cp), + &cp); + } +- } else { +- conn->state = BT_CLOSED; +- if (conn->type == ACL_LINK) +- mgmt_connect_failed(hdev, &conn->dst, conn->type, +- conn->dst_type, ev->status); + } + + if (conn->type == ACL_LINK) + hci_sco_setup(conn, ev->status); + +- if (ev->status) { +- hci_connect_cfm(conn, ev->status); ++done: ++ if (status) { ++ conn->state = BT_CLOSED; ++ if (conn->type == ACL_LINK) ++ mgmt_connect_failed(hdev, &conn->dst, conn->type, ++ conn->dst_type, status); ++ hci_connect_cfm(conn, status); + hci_conn_del(conn); + } else if (ev->link_type == SCO_LINK) { + switch (conn->setting & SCO_AIRMODE_MASK) { +@@ -3185,7 +3187,7 @@ static void hci_conn_complete_evt(struct hci_dev *hdev, void *data, + break; + } + +- hci_connect_cfm(conn, ev->status); ++ hci_connect_cfm(conn, status); + } + + unlock: +@@ -4676,6 +4678,7 @@ static void hci_sync_conn_complete_evt(struct hci_dev *hdev, void *data, + { + struct hci_ev_sync_conn_complete *ev = data; + struct hci_conn *conn; ++ u8 status = ev->status; + + switch (ev->link_type) { + case SCO_LINK: +@@ -4690,12 +4693,7 @@ static void hci_sync_conn_complete_evt(struct hci_dev *hdev, void *data, + return; + } + +- if (__le16_to_cpu(ev->handle) > HCI_CONN_HANDLE_MAX) { +- bt_dev_err(hdev, "Ignoring HCI_Sync_Conn_Complete for invalid handle"); +- return; +- } +- +- bt_dev_dbg(hdev, "status 0x%2.2x", ev->status); ++ bt_dev_dbg(hdev, "status 0x%2.2x", status); + + hci_dev_lock(hdev); + +@@ -4729,9 +4727,17 @@ static void hci_sync_conn_complete_evt(struct hci_dev *hdev, void *data, + goto unlock; + } + +- switch (ev->status) { ++ switch (status) { + case 0x00: + conn->handle = __le16_to_cpu(ev->handle); ++ if (conn->handle > HCI_CONN_HANDLE_MAX) { ++ bt_dev_err(hdev, "Invalid handle: 0x%4.4x > 0x%4.4x", ++ conn->handle, HCI_CONN_HANDLE_MAX); ++ status = HCI_ERROR_INVALID_PARAMETERS; ++ conn->state = BT_CLOSED; ++ break; ++ } ++ + conn->state = BT_CONNECTED; + conn->type = ev->link_type; + +@@ -4775,8 +4781,8 @@ static void hci_sync_conn_complete_evt(struct hci_dev *hdev, void *data, + } + } + +- hci_connect_cfm(conn, ev->status); +- if (ev->status) ++ hci_connect_cfm(conn, status); ++ if (status) + hci_conn_del(conn); + + unlock: +@@ -5527,11 +5533,6 @@ static void le_conn_complete_evt(struct hci_dev *hdev, u8 status, + struct smp_irk *irk; + u8 addr_type; + +- if (handle > HCI_CONN_HANDLE_MAX) { +- bt_dev_err(hdev, "Ignoring HCI_LE_Connection_Complete for invalid handle"); +- return; +- } +- + hci_dev_lock(hdev); + + /* All controllers implicitly stop advertising in the event of a +@@ -5603,6 +5604,12 @@ static void le_conn_complete_evt(struct hci_dev *hdev, u8 status, + + conn->dst_type = ev_bdaddr_type(hdev, conn->dst_type, NULL); + ++ if (handle > HCI_CONN_HANDLE_MAX) { ++ bt_dev_err(hdev, "Invalid handle: 0x%4.4x > 0x%4.4x", handle, ++ HCI_CONN_HANDLE_MAX); ++ status = HCI_ERROR_INVALID_PARAMETERS; ++ } ++ + if (status) { + hci_le_conn_failed(conn, status); + goto unlock; +-- +2.35.1 + diff --git a/queue-5.17/bnx2x-fix-napi-api-usage-sequence.patch b/queue-5.17/bnx2x-fix-napi-api-usage-sequence.patch new file mode 100644 index 00000000000..87caae7a4d9 --- /dev/null +++ b/queue-5.17/bnx2x-fix-napi-api-usage-sequence.patch @@ -0,0 +1,152 @@ +From 6f98a79efb649b9cf280d27ea477324306250c3e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Apr 2022 08:39:13 -0700 +Subject: bnx2x: fix napi API usage sequence + +From: Manish Chopra + +[ Upstream commit af68656d66eda219b7f55ce8313a1da0312c79e1 ] + +While handling PCI errors (AER flow) driver tries to +disable NAPI [napi_disable()] after NAPI is deleted +[__netif_napi_del()] which causes unexpected system +hang/crash. + +System message log shows the following: +======================================= +[ 3222.537510] EEH: Detected PCI bus error on PHB#384-PE#800000 [ 3222.537511] EEH: This PCI device has failed 2 times in the last hour and will be permanently disabled after 5 failures. +[ 3222.537512] EEH: Notify device drivers to shutdown [ 3222.537513] EEH: Beginning: 'error_detected(IO frozen)' +[ 3222.537514] EEH: PE#800000 (PCI 0384:80:00.0): Invoking +bnx2x->error_detected(IO frozen) +[ 3222.537516] bnx2x: [bnx2x_io_error_detected:14236(eth14)]IO error detected [ 3222.537650] EEH: PE#800000 (PCI 0384:80:00.0): bnx2x driver reports: +'need reset' +[ 3222.537651] EEH: PE#800000 (PCI 0384:80:00.1): Invoking +bnx2x->error_detected(IO frozen) +[ 3222.537651] bnx2x: [bnx2x_io_error_detected:14236(eth13)]IO error detected [ 3222.537729] EEH: PE#800000 (PCI 0384:80:00.1): bnx2x driver reports: +'need reset' +[ 3222.537729] EEH: Finished:'error_detected(IO frozen)' with aggregate recovery state:'need reset' +[ 3222.537890] EEH: Collect temporary log [ 3222.583481] EEH: of node=0384:80:00.0 [ 3222.583519] EEH: PCI device/vendor: 168e14e4 [ 3222.583557] EEH: PCI cmd/status register: 00100140 [ 3222.583557] EEH: PCI-E capabilities and status follow: +[ 3222.583744] EEH: PCI-E 00: 00020010 012c8da2 00095d5e 00455c82 [ 3222.583892] EEH: PCI-E 10: 10820000 00000000 00000000 00000000 [ 3222.583893] EEH: PCI-E 20: 00000000 [ 3222.583893] EEH: PCI-E AER capability register set follows: +[ 3222.584079] EEH: PCI-E AER 00: 13c10001 00000000 00000000 00062030 [ 3222.584230] EEH: PCI-E AER 10: 00002000 000031c0 000001e0 00000000 [ 3222.584378] EEH: PCI-E AER 20: 00000000 00000000 00000000 00000000 [ 3222.584416] EEH: PCI-E AER 30: 00000000 00000000 [ 3222.584416] EEH: of node=0384:80:00.1 [ 3222.584454] EEH: PCI device/vendor: 168e14e4 [ 3222.584491] EEH: PCI cmd/status register: 00100140 [ 3222.584492] EEH: PCI-E capabilities and status follow: +[ 3222.584677] EEH: PCI-E 00: 00020010 012c8da2 00095d5e 00455c82 [ 3222.584825] EEH: PCI-E 10: 10820000 00000000 00000000 00000000 [ 3222.584826] EEH: PCI-E 20: 00000000 [ 3222.584826] EEH: PCI-E AER capability register set follows: +[ 3222.585011] EEH: PCI-E AER 00: 13c10001 00000000 00000000 00062030 [ 3222.585160] EEH: PCI-E AER 10: 00002000 000031c0 000001e0 00000000 [ 3222.585309] EEH: PCI-E AER 20: 00000000 00000000 00000000 00000000 [ 3222.585347] EEH: PCI-E AER 30: 00000000 00000000 [ 3222.586872] RTAS: event: 5, Type: Platform Error (224), Severity: 2 [ 3222.586873] EEH: Reset without hotplug activity [ 3224.762767] EEH: Beginning: 'slot_reset' +[ 3224.762770] EEH: PE#800000 (PCI 0384:80:00.0): Invoking +bnx2x->slot_reset() +[ 3224.762771] bnx2x: [bnx2x_io_slot_reset:14271(eth14)]IO slot reset initializing... +[ 3224.762887] bnx2x 0384:80:00.0: enabling device (0140 -> 0142) [ 3224.768157] bnx2x: [bnx2x_io_slot_reset:14287(eth14)]IO slot reset +--> driver unload + +Uninterruptible tasks +===================== +crash> ps | grep UN + 213 2 11 c000000004c89e00 UN 0.0 0 0 [eehd] + 215 2 0 c000000004c80000 UN 0.0 0 0 +[kworker/0:2] + 2196 1 28 c000000004504f00 UN 0.1 15936 11136 wickedd + 4287 1 9 c00000020d076800 UN 0.0 4032 3008 agetty + 4289 1 20 c00000020d056680 UN 0.0 7232 3840 agetty + 32423 2 26 c00000020038c580 UN 0.0 0 0 +[kworker/26:3] + 32871 4241 27 c0000002609ddd00 UN 0.1 18624 11648 sshd + 32920 10130 16 c00000027284a100 UN 0.1 48512 12608 sendmail + 33092 32987 0 c000000205218b00 UN 0.1 48512 12608 sendmail + 33154 4567 16 c000000260e51780 UN 0.1 48832 12864 pickup + 33209 4241 36 c000000270cb6500 UN 0.1 18624 11712 sshd + 33473 33283 0 c000000205211480 UN 0.1 48512 12672 sendmail + 33531 4241 37 c00000023c902780 UN 0.1 18624 11648 sshd + +EEH handler hung while bnx2x sleeping and holding RTNL lock +=========================================================== +crash> bt 213 +PID: 213 TASK: c000000004c89e00 CPU: 11 COMMAND: "eehd" + #0 [c000000004d477e0] __schedule at c000000000c70808 + #1 [c000000004d478b0] schedule at c000000000c70ee0 + #2 [c000000004d478e0] schedule_timeout at c000000000c76dec + #3 [c000000004d479c0] msleep at c0000000002120cc + #4 [c000000004d479f0] napi_disable at c000000000a06448 + ^^^^^^^^^^^^^^^^ + #5 [c000000004d47a30] bnx2x_netif_stop at c0080000018dba94 [bnx2x] + #6 [c000000004d47a60] bnx2x_io_slot_reset at c0080000018a551c [bnx2x] + #7 [c000000004d47b20] eeh_report_reset at c00000000004c9bc + #8 [c000000004d47b90] eeh_pe_report at c00000000004d1a8 + #9 [c000000004d47c40] eeh_handle_normal_event at c00000000004da64 + +And the sleeping source code +============================ +crash> dis -ls c000000000a06448 +FILE: ../net/core/dev.c +LINE: 6702 + + 6697 { + 6698 might_sleep(); + 6699 set_bit(NAPI_STATE_DISABLE, &n->state); + 6700 + 6701 while (test_and_set_bit(NAPI_STATE_SCHED, &n->state)) +* 6702 msleep(1); + 6703 while (test_and_set_bit(NAPI_STATE_NPSVC, &n->state)) + 6704 msleep(1); + 6705 + 6706 hrtimer_cancel(&n->timer); + 6707 + 6708 clear_bit(NAPI_STATE_DISABLE, &n->state); + 6709 } + +EEH calls into bnx2x twice based on the system log above, first through +bnx2x_io_error_detected() and then bnx2x_io_slot_reset(), and executes +the following call chains: + +bnx2x_io_error_detected() + +-> bnx2x_eeh_nic_unload() + +-> bnx2x_del_all_napi() + +-> __netif_napi_del() + +bnx2x_io_slot_reset() + +-> bnx2x_netif_stop() + +-> bnx2x_napi_disable() + +->napi_disable() + +Fix this by correcting the sequence of NAPI APIs usage, +that is delete the NAPI after disabling it. + +Fixes: 7fa6f34081f1 ("bnx2x: AER revised") +Reported-by: David Christensen +Tested-by: David Christensen +Signed-off-by: Manish Chopra +Signed-off-by: Ariel Elior +Link: https://lore.kernel.org/r/20220426153913.6966-1-manishc@marvell.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c +index c19b072f3a23..962253db25b8 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c +@@ -14153,10 +14153,6 @@ static int bnx2x_eeh_nic_unload(struct bnx2x *bp) + + /* Stop Tx */ + bnx2x_tx_disable(bp); +- /* Delete all NAPI objects */ +- bnx2x_del_all_napi(bp); +- if (CNIC_LOADED(bp)) +- bnx2x_del_all_napi_cnic(bp); + netdev_reset_tc(bp->dev); + + del_timer_sync(&bp->timer); +@@ -14261,6 +14257,11 @@ static pci_ers_result_t bnx2x_io_slot_reset(struct pci_dev *pdev) + bnx2x_drain_tx_queues(bp); + bnx2x_send_unload_req(bp, UNLOAD_RECOVERY); + bnx2x_netif_stop(bp, 1); ++ bnx2x_del_all_napi(bp); ++ ++ if (CNIC_LOADED(bp)) ++ bnx2x_del_all_napi_cnic(bp); ++ + bnx2x_free_irq(bp); + + /* Report UNLOAD_DONE to MCP */ +-- +2.35.1 + diff --git a/queue-5.17/bonding-do-not-discard-lowest-hash-bit-for-non-layer.patch b/queue-5.17/bonding-do-not-discard-lowest-hash-bit-for-non-layer.patch new file mode 100644 index 00000000000..9a46f9b4ea8 --- /dev/null +++ b/queue-5.17/bonding-do-not-discard-lowest-hash-bit-for-non-layer.patch @@ -0,0 +1,99 @@ +From e35196ac0bc0016b8de42637fbe25aefe0e7bad1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 16 Apr 2022 16:44:10 +0530 +Subject: bonding: do not discard lowest hash bit for non layer3+4 hashing + +From: suresh kumar + +[ Upstream commit 49aefd131739df552f83c566d0665744c30b1d70 ] + +Commit b5f862180d70 was introduced to discard lowest hash bit for layer3+4 hashing +but it also removes last bit from non layer3+4 hashing + +Below script shows layer2+3 hashing will result in same slave to be used with above commit. +$ cat hash.py +#/usr/bin/python3.6 + +h_dests=[0xa0, 0xa1] +h_source=0xe3 +hproto=0x8 +saddr=0x1e7aa8c0 +daddr=0x17aa8c0 + +for h_dest in h_dests: + hash = (h_dest ^ h_source ^ hproto ^ saddr ^ daddr) + hash ^= hash >> 16 + hash ^= hash >> 8 + print(hash) + +print("with last bit removed") +for h_dest in h_dests: + hash = (h_dest ^ h_source ^ hproto ^ saddr ^ daddr) + hash ^= hash >> 16 + hash ^= hash >> 8 + hash = hash >> 1 + print(hash) + +Output: +$ python3.6 hash.py +522133332 +522133333 <-------------- will result in both slaves being used + +with last bit removed +261066666 +261066666 <-------------- only single slave used + +Signed-off-by: suresh kumar +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/bonding/bond_main.c | 13 +++++++++---- + 1 file changed, 9 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c +index aebeb46e6fa6..c9107a8b4b90 100644 +--- a/drivers/net/bonding/bond_main.c ++++ b/drivers/net/bonding/bond_main.c +@@ -3819,14 +3819,19 @@ static bool bond_flow_dissect(struct bonding *bond, struct sk_buff *skb, const v + return true; + } + +-static u32 bond_ip_hash(u32 hash, struct flow_keys *flow) ++static u32 bond_ip_hash(u32 hash, struct flow_keys *flow, int xmit_policy) + { + hash ^= (__force u32)flow_get_u32_dst(flow) ^ + (__force u32)flow_get_u32_src(flow); + hash ^= (hash >> 16); + hash ^= (hash >> 8); ++ + /* discard lowest hash bit to deal with the common even ports pattern */ +- return hash >> 1; ++ if (xmit_policy == BOND_XMIT_POLICY_LAYER34 || ++ xmit_policy == BOND_XMIT_POLICY_ENCAP34) ++ return hash >> 1; ++ ++ return hash; + } + + /* Generate hash based on xmit policy. If @skb is given it is used to linearize +@@ -3856,7 +3861,7 @@ static u32 __bond_xmit_hash(struct bonding *bond, struct sk_buff *skb, const voi + memcpy(&hash, &flow.ports.ports, sizeof(hash)); + } + +- return bond_ip_hash(hash, &flow); ++ return bond_ip_hash(hash, &flow, bond->params.xmit_policy); + } + + /** +@@ -5051,7 +5056,7 @@ static u32 bond_sk_hash_l34(struct sock *sk) + /* L4 */ + memcpy(&hash, &flow.ports.ports, sizeof(hash)); + /* L3 */ +- return bond_ip_hash(hash, &flow); ++ return bond_ip_hash(hash, &flow, BOND_XMIT_POLICY_LAYER34); + } + + static struct net_device *__bond_sk_get_lower_dev(struct bonding *bond, +-- +2.35.1 + diff --git a/queue-5.17/bpf-lwt-fix-crash-when-using-bpf_skb_set_tunnel_key-.patch b/queue-5.17/bpf-lwt-fix-crash-when-using-bpf_skb_set_tunnel_key-.patch new file mode 100644 index 00000000000..3160d678b61 --- /dev/null +++ b/queue-5.17/bpf-lwt-fix-crash-when-using-bpf_skb_set_tunnel_key-.patch @@ -0,0 +1,88 @@ +From 186caf7ddb2d510d63decdc1d67c43e12b2b1ee5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Apr 2022 19:52:19 +0300 +Subject: bpf, lwt: Fix crash when using bpf_skb_set_tunnel_key() from bpf_xmit + lwt hook + +From: Eyal Birger + +[ Upstream commit b02d196c44ead1a5949729be9ff08fe781c3e48a ] + +xmit_check_hhlen() observes the dst for getting the device hard header +length to make sure a modified packet can fit. When a helper which changes +the dst - such as bpf_skb_set_tunnel_key() - is called as part of the +xmit program the accessed dst is no longer valid. + +This leads to the following splat: + + BUG: kernel NULL pointer dereference, address: 00000000000000de + #PF: supervisor read access in kernel mode + #PF: error_code(0x0000) - not-present page + PGD 0 P4D 0 + Oops: 0000 [#1] PREEMPT SMP PTI + CPU: 0 PID: 798 Comm: ping Not tainted 5.18.0-rc2+ #103 + Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014 + RIP: 0010:bpf_xmit+0xfb/0x17f + Code: c6 c0 4d cd 8e 48 c7 c7 7d 33 f0 8e e8 42 09 fb ff 48 8b 45 58 48 8b 95 c8 00 00 00 48 2b 95 c0 00 00 00 48 83 e0 fe 48 8b 00 <0f> b7 80 de 00 00 00 39 c2 73 22 29 d0 b9 20 0a 00 00 31 d2 48 89 + RSP: 0018:ffffb148c0bc7b98 EFLAGS: 00010282 + RAX: 0000000000000000 RBX: 0000000000240008 RCX: 0000000000000000 + RDX: 0000000000000010 RSI: 00000000ffffffea RDI: 00000000ffffffff + RBP: ffff922a828a4e00 R08: ffffffff8f1350e8 R09: 00000000ffffdfff + R10: ffffffff8f055100 R11: ffffffff8f105100 R12: 0000000000000000 + R13: ffff922a828a4e00 R14: 0000000000000040 R15: 0000000000000000 + FS: 00007f414e8f0080(0000) GS:ffff922afdc00000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 00000000000000de CR3: 0000000002d80006 CR4: 0000000000370ef0 + Call Trace: + + lwtunnel_xmit.cold+0x71/0xc8 + ip_finish_output2+0x279/0x520 + ? __ip_finish_output.part.0+0x21/0x130 + +Fix by fetching the device hard header length before running the BPF code. + +Fixes: 3a0af8fd61f9 ("bpf: BPF for lightweight tunnel infrastructure") +Signed-off-by: Eyal Birger +Signed-off-by: Daniel Borkmann +Link: https://lore.kernel.org/bpf/20220420165219.1755407-1-eyal.birger@gmail.com +Signed-off-by: Sasha Levin +--- + net/core/lwt_bpf.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/net/core/lwt_bpf.c b/net/core/lwt_bpf.c +index 349480ef68a5..8b6b5e72b217 100644 +--- a/net/core/lwt_bpf.c ++++ b/net/core/lwt_bpf.c +@@ -159,10 +159,8 @@ static int bpf_output(struct net *net, struct sock *sk, struct sk_buff *skb) + return dst->lwtstate->orig_output(net, sk, skb); + } + +-static int xmit_check_hhlen(struct sk_buff *skb) ++static int xmit_check_hhlen(struct sk_buff *skb, int hh_len) + { +- int hh_len = skb_dst(skb)->dev->hard_header_len; +- + if (skb_headroom(skb) < hh_len) { + int nhead = HH_DATA_ALIGN(hh_len - skb_headroom(skb)); + +@@ -274,6 +272,7 @@ static int bpf_xmit(struct sk_buff *skb) + + bpf = bpf_lwt_lwtunnel(dst->lwtstate); + if (bpf->xmit.prog) { ++ int hh_len = dst->dev->hard_header_len; + __be16 proto = skb->protocol; + int ret; + +@@ -291,7 +290,7 @@ static int bpf_xmit(struct sk_buff *skb) + /* If the header was expanded, headroom might be too + * small for L2 header to come, expand as needed. + */ +- ret = xmit_check_hhlen(skb); ++ ret = xmit_check_hhlen(skb, hh_len); + if (unlikely(ret)) + return ret; + +-- +2.35.1 + diff --git a/queue-5.17/bus-sunxi-rsb-fix-the-return-value-of-sunxi_rsb_devi.patch b/queue-5.17/bus-sunxi-rsb-fix-the-return-value-of-sunxi_rsb_devi.patch new file mode 100644 index 00000000000..2c26b92565e --- /dev/null +++ b/queue-5.17/bus-sunxi-rsb-fix-the-return-value-of-sunxi_rsb_devi.patch @@ -0,0 +1,43 @@ +From b2240109d03cd878dd247dad0ce7ab6e3cc3b0e9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Apr 2022 16:35:49 +0200 +Subject: bus: sunxi-rsb: Fix the return value of sunxi_rsb_device_create() + +From: Christophe JAILLET + +[ Upstream commit fff8c10368e64e7f8960f149375c12ca5f3b30af ] + +This code is really spurious. +It always returns an ERR_PTR, even when err is known to be 0 and calls +put_device() after a successful device_register() call. + +It is likely that the return statement in the normal path is missing. +Add 'return rdev;' to fix it. + +Fixes: d787dcdb9c8f ("bus: sunxi-rsb: Add driver for Allwinner Reduced Serial Bus") +Signed-off-by: Christophe JAILLET +Reviewed-by: Samuel Holland +Tested-by: Samuel Holland +Signed-off-by: Jernej Skrabec +Link: https://lore.kernel.org/r/ef2b9576350bba4c8e05e669e9535e9e2a415763.1650551719.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Sasha Levin +--- + drivers/bus/sunxi-rsb.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/bus/sunxi-rsb.c b/drivers/bus/sunxi-rsb.c +index 4566e730ef2b..60b082fe2ed0 100644 +--- a/drivers/bus/sunxi-rsb.c ++++ b/drivers/bus/sunxi-rsb.c +@@ -227,6 +227,8 @@ static struct sunxi_rsb_device *sunxi_rsb_device_create(struct sunxi_rsb *rsb, + + dev_dbg(&rdev->dev, "device %s registered\n", dev_name(&rdev->dev)); + ++ return rdev; ++ + err_device_add: + put_device(&rdev->dev); + +-- +2.35.1 + diff --git a/queue-5.17/bus-ti-sysc-make-omap3-gpt12-quirk-handling-soc-spec.patch b/queue-5.17/bus-ti-sysc-make-omap3-gpt12-quirk-handling-soc-spec.patch new file mode 100644 index 00000000000..f84b68975ca --- /dev/null +++ b/queue-5.17/bus-ti-sysc-make-omap3-gpt12-quirk-handling-soc-spec.patch @@ -0,0 +1,65 @@ +From 2121689e0ee62c0619a7926baef843bb11da9773 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Apr 2022 12:26:51 +0300 +Subject: bus: ti-sysc: Make omap3 gpt12 quirk handling SoC specific + +From: Tony Lindgren + +[ Upstream commit a12315d6d27093392b6c634e1d35a59f1d1f7a59 ] + +On beagleboard revisions A to B4 we need to use gpt12 as the system timer. +However, the quirk handling added for gpt12 caused a regression for system +suspend for am335x as the PM coprocessor needs the timers idled for +suspend. + +Let's make the gpt12 quirk specific to omap34xx, other SoCs don't need +it. Beagleboard revisions C and later no longer need to use the gpt12 +related quirk. Then at some point, if we decide to drop support for the old +beagleboard revisions A to B4, we can also drop the gpt12 related quirks +completely. + +Fixes: 3ff340e24c9d ("bus: ti-sysc: Fix gpt12 system timer issue with reserved status") +Reported-by: Kevin Hilman +Suggested-by: Kevin Hilman +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + drivers/bus/ti-sysc.c | 16 +++++++++++++++- + 1 file changed, 15 insertions(+), 1 deletion(-) + +diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c +index 54c0ee6dda30..7a1b1f9e4933 100644 +--- a/drivers/bus/ti-sysc.c ++++ b/drivers/bus/ti-sysc.c +@@ -3232,13 +3232,27 @@ static int sysc_check_disabled_devices(struct sysc *ddata) + */ + static int sysc_check_active_timer(struct sysc *ddata) + { ++ int error; ++ + if (ddata->cap->type != TI_SYSC_OMAP2_TIMER && + ddata->cap->type != TI_SYSC_OMAP4_TIMER) + return 0; + ++ /* ++ * Quirk for omap3 beagleboard revision A to B4 to use gpt12. ++ * Revision C and later are fixed with commit 23885389dbbb ("ARM: ++ * dts: Fix timer regression for beagleboard revision c"). This all ++ * can be dropped if we stop supporting old beagleboard revisions ++ * A to B4 at some point. ++ */ ++ if (sysc_soc->soc == SOC_3430) ++ error = -ENXIO; ++ else ++ error = -EBUSY; ++ + if ((ddata->cfg.quirks & SYSC_QUIRK_NO_RESET_ON_INIT) && + (ddata->cfg.quirks & SYSC_QUIRK_NO_IDLE)) +- return -ENXIO; ++ return error; + + return 0; + } +-- +2.35.1 + diff --git a/queue-5.17/cifs-destage-any-unwritten-data-to-the-server-before.patch b/queue-5.17/cifs-destage-any-unwritten-data-to-the-server-before.patch new file mode 100644 index 00000000000..47080aa88a6 --- /dev/null +++ b/queue-5.17/cifs-destage-any-unwritten-data-to-the-server-before.patch @@ -0,0 +1,59 @@ +From a53bec2c1be01e05b9e7a199f1a090672e549f85 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Apr 2022 11:15:36 +1000 +Subject: cifs: destage any unwritten data to the server before calling + copychunk_write + +From: Ronnie Sahlberg + +[ Upstream commit f5d0f921ea362636e4a2efb7c38d1ead373a8700 ] + +because the copychunk_write might cover a region of the file that has not yet +been sent to the server and thus fail. + +A simple way to reproduce this is: +truncate -s 0 /mnt/testfile; strace -f -o x -ttT xfs_io -i -f -c 'pwrite 0k 128k' -c 'fcollapse 16k 24k' /mnt/testfile + +the issue is that the 'pwrite 0k 128k' becomes rearranged on the wire with +the 'fcollapse 16k 24k' due to write-back caching. + +fcollapse is implemented in cifs.ko as a SMB2 IOCTL(COPYCHUNK_WRITE) call +and it will fail serverside since the file is still 0b in size serverside +until the writes have been destaged. +To avoid this we must ensure that we destage any unwritten data to the +server before calling COPYCHUNK_WRITE. + +Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1997373 +Reported-by: Xiaoli Feng +Signed-off-by: Ronnie Sahlberg +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/cifs/smb2ops.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c +index 5d120cd8bc78..13080d6a140b 100644 +--- a/fs/cifs/smb2ops.c ++++ b/fs/cifs/smb2ops.c +@@ -1861,9 +1861,17 @@ smb2_copychunk_range(const unsigned int xid, + int chunks_copied = 0; + bool chunk_sizes_updated = false; + ssize_t bytes_written, total_bytes_written = 0; ++ struct inode *inode; + + pcchunk = kmalloc(sizeof(struct copychunk_ioctl), GFP_KERNEL); + ++ /* ++ * We need to flush all unwritten data before we can send the ++ * copychunk ioctl to the server. ++ */ ++ inode = d_inode(trgtfile->dentry); ++ filemap_write_and_wait(inode->i_mapping); ++ + if (pcchunk == NULL) + return -ENOMEM; + +-- +2.35.1 + diff --git a/queue-5.17/clk-sunxi-sun9i-mmc-check-return-value-after-calling.patch b/queue-5.17/clk-sunxi-sun9i-mmc-check-return-value-after-calling.patch new file mode 100644 index 00000000000..acc6a7a1d3c --- /dev/null +++ b/queue-5.17/clk-sunxi-sun9i-mmc-check-return-value-after-calling.patch @@ -0,0 +1,39 @@ +From 22041b2f379e5f53107586128186a0b48b222784 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Apr 2022 21:43:08 +0800 +Subject: clk: sunxi: sun9i-mmc: check return value after calling + platform_get_resource() + +From: Yang Yingliang + +[ Upstream commit f58ca215cda1975f77b2b762903684a3c101bec9 ] + +It will cause null-ptr-deref if platform_get_resource() returns NULL, +we need check the return value. + +Fixes: 7a6fca879f59 ("clk: sunxi: Add driver for A80 MMC config clocks/resets") +Signed-off-by: Yang Yingliang +Reviewed-by: Samuel Holland +Signed-off-by: Jernej Skrabec +Link: https://lore.kernel.org/r/20220421134308.2885094-1-yangyingliang@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/clk/sunxi/clk-sun9i-mmc.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/clk/sunxi/clk-sun9i-mmc.c b/drivers/clk/sunxi/clk-sun9i-mmc.c +index 542b31d6e96d..636bcf2439ef 100644 +--- a/drivers/clk/sunxi/clk-sun9i-mmc.c ++++ b/drivers/clk/sunxi/clk-sun9i-mmc.c +@@ -109,6 +109,8 @@ static int sun9i_a80_mmc_config_clk_probe(struct platform_device *pdev) + spin_lock_init(&data->lock); + + r = platform_get_resource(pdev, IORESOURCE_MEM, 0); ++ if (!r) ++ return -EINVAL; + /* one clock/reset pair per word */ + count = DIV_ROUND_UP((resource_size(r)), SUN9I_MMC_WIDTH); + data->membase = devm_ioremap_resource(&pdev->dev, r); +-- +2.35.1 + diff --git a/queue-5.17/cpufreq-fix-memory-leak-in-sun50i_cpufreq_nvmem_prob.patch b/queue-5.17/cpufreq-fix-memory-leak-in-sun50i_cpufreq_nvmem_prob.patch new file mode 100644 index 00000000000..e22eaa1b030 --- /dev/null +++ b/queue-5.17/cpufreq-fix-memory-leak-in-sun50i_cpufreq_nvmem_prob.patch @@ -0,0 +1,64 @@ +From 91c4dbca7df8324672e7a207f1514bb8fd6f83e3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 23 Apr 2022 15:12:04 +0000 +Subject: cpufreq: fix memory leak in sun50i_cpufreq_nvmem_probe + +From: Xiaobing Luo + +[ Upstream commit 1aa24a8f3b5133dae4bc1e57427e345445f3e902 ] + +-------------------------------------------- +unreferenced object 0xffff000010742a00 (size 128): + comm "swapper/0", pid 1, jiffies 4294902015 (age 1187.652s) + hex dump (first 32 bytes): + 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + backtrace: + [<00000000b4dfebaa>] __kmalloc+0x338/0x474 + [<00000000d6e716db>] sun50i_cpufreq_nvmem_probe+0xc4/0x36c + [<000000007d6082a0>] platform_probe+0x98/0x11c + [<00000000c990f549>] really_probe+0x234/0x5a0 + [<000000002d9fecc6>] __driver_probe_device+0x194/0x224 + [<00000000cf0b94fa>] driver_probe_device+0x64/0x13c + [<00000000f238e4cf>] __device_attach_driver+0xf8/0x180 + [<000000006720e418>] bus_for_each_drv+0xf8/0x160 + [<00000000df4f14f6>] __device_attach+0x174/0x29c + [<00000000782002fb>] device_initial_probe+0x20/0x30 + [<00000000c2681b06>] bus_probe_device+0xfc/0x110 + [<00000000964cf3bd>] device_add+0x5f0/0xcd0 + [<000000004b9264e3>] platform_device_add+0x198/0x390 + [<00000000fa82a9d0>] platform_device_register_full+0x178/0x210 + [<000000009a5daf13>] sun50i_cpufreq_init+0xf8/0x168 + [<000000000377cc7c>] do_one_initcall+0xe4/0x570 +-------------------------------------------- + +if sun50i_cpufreq_get_efuse failed, then opp_tables leak. + +Fixes: f328584f7bff ("cpufreq: Add sun50i nvmem based CPU scaling driver") +Signed-off-by: Xiaobing Luo +Reviewed-by: Samuel Holland +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/sun50i-cpufreq-nvmem.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/cpufreq/sun50i-cpufreq-nvmem.c b/drivers/cpufreq/sun50i-cpufreq-nvmem.c +index 2deed8d8773f..75e1bf3a08f7 100644 +--- a/drivers/cpufreq/sun50i-cpufreq-nvmem.c ++++ b/drivers/cpufreq/sun50i-cpufreq-nvmem.c +@@ -98,8 +98,10 @@ static int sun50i_cpufreq_nvmem_probe(struct platform_device *pdev) + return -ENOMEM; + + ret = sun50i_cpufreq_get_efuse(&speed); +- if (ret) ++ if (ret) { ++ kfree(opp_tables); + return ret; ++ } + + snprintf(name, MAX_NAME_LEN, "speed%d", speed); + +-- +2.35.1 + diff --git a/queue-5.17/cpufreq-qcom-cpufreq-hw-clear-dcvs-interrupts.patch b/queue-5.17/cpufreq-qcom-cpufreq-hw-clear-dcvs-interrupts.patch new file mode 100644 index 00000000000..1d6023dcc4c --- /dev/null +++ b/queue-5.17/cpufreq-qcom-cpufreq-hw-clear-dcvs-interrupts.patch @@ -0,0 +1,65 @@ +From 3db687653c84046520899089876af06b3db2e98c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Apr 2022 23:09:19 +0300 +Subject: cpufreq: qcom-cpufreq-hw: Clear dcvs interrupts + +From: Vladimir Zapolskiy + +[ Upstream commit e4e6448638a01905faeda9bf96aa9df7c8ef463c ] + +It's noted that dcvs interrupts are not self-clearing, thus an interrupt +handler runs constantly, which leads to a severe regression in runtime. +To fix the problem an explicit write to clear interrupt register is +required, note that on OSM platforms the register may not be present. + +Fixes: 275157b367f4 ("cpufreq: qcom-cpufreq-hw: Add dcvs interrupt support") +Signed-off-by: Vladimir Zapolskiy +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/qcom-cpufreq-hw.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/cpufreq/qcom-cpufreq-hw.c b/drivers/cpufreq/qcom-cpufreq-hw.c +index 1e99b71e7844..ca0f1be1c3b2 100644 +--- a/drivers/cpufreq/qcom-cpufreq-hw.c ++++ b/drivers/cpufreq/qcom-cpufreq-hw.c +@@ -24,6 +24,8 @@ + #define CLK_HW_DIV 2 + #define LUT_TURBO_IND 1 + ++#define GT_IRQ_STATUS BIT(2) ++ + #define HZ_PER_KHZ 1000 + + struct qcom_cpufreq_soc_data { +@@ -31,6 +33,7 @@ struct qcom_cpufreq_soc_data { + u32 reg_domain_state; + u32 reg_freq_lut; + u32 reg_volt_lut; ++ u32 reg_intr_clr; + u32 reg_current_vote; + u32 reg_perf_state; + u8 lut_row_size; +@@ -347,6 +350,10 @@ static irqreturn_t qcom_lmh_dcvs_handle_irq(int irq, void *data) + disable_irq_nosync(c_data->throttle_irq); + schedule_delayed_work(&c_data->throttle_work, 0); + ++ if (c_data->soc_data->reg_intr_clr) ++ writel_relaxed(GT_IRQ_STATUS, ++ c_data->base + c_data->soc_data->reg_intr_clr); ++ + return IRQ_HANDLED; + } + +@@ -364,6 +371,7 @@ static const struct qcom_cpufreq_soc_data epss_soc_data = { + .reg_domain_state = 0x20, + .reg_freq_lut = 0x100, + .reg_volt_lut = 0x200, ++ .reg_intr_clr = 0x308, + .reg_perf_state = 0x320, + .lut_row_size = 4, + }; +-- +2.35.1 + diff --git a/queue-5.17/cpufreq-qcom-cpufreq-hw-fix-throttle-frequency-value.patch b/queue-5.17/cpufreq-qcom-cpufreq-hw-fix-throttle-frequency-value.patch new file mode 100644 index 00000000000..f8f66a07ec0 --- /dev/null +++ b/queue-5.17/cpufreq-qcom-cpufreq-hw-fix-throttle-frequency-value.patch @@ -0,0 +1,86 @@ +From 84879a09efef0abcde8eedcf7cb5da672b1822e4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Apr 2022 10:14:24 +0300 +Subject: cpufreq: qcom-cpufreq-hw: Fix throttle frequency value on EPSS + platforms + +From: Vladimir Zapolskiy + +[ Upstream commit f84ccad5f5660f86a642a3d7e2bfdc4e7a8a2d49 ] + +On QCOM platforms with EPSS flavour of cpufreq IP a throttled frequency is +obtained from another register REG_DOMAIN_STATE, thus the helper function +qcom_lmh_get_throttle_freq() should be modified accordingly, as for now +it returns gibberish since .reg_current_vote is unset for EPSS hardware. + +To exclude a hardcoded magic number 19200 it is replaced by "xo" clock rate +in KHz. + +Fixes: 275157b367f4 ("cpufreq: qcom-cpufreq-hw: Add dcvs interrupt support") +Reviewed-by: Bjorn Andersson +Signed-off-by: Vladimir Zapolskiy +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/qcom-cpufreq-hw.c | 17 +++++++++++------ + 1 file changed, 11 insertions(+), 6 deletions(-) + +diff --git a/drivers/cpufreq/qcom-cpufreq-hw.c b/drivers/cpufreq/qcom-cpufreq-hw.c +index 60d38f62308a..1e99b71e7844 100644 +--- a/drivers/cpufreq/qcom-cpufreq-hw.c ++++ b/drivers/cpufreq/qcom-cpufreq-hw.c +@@ -28,6 +28,7 @@ + + struct qcom_cpufreq_soc_data { + u32 reg_enable; ++ u32 reg_domain_state; + u32 reg_freq_lut; + u32 reg_volt_lut; + u32 reg_current_vote; +@@ -267,11 +268,16 @@ static void qcom_get_related_cpus(int index, struct cpumask *m) + } + } + +-static unsigned int qcom_lmh_get_throttle_freq(struct qcom_cpufreq_data *data) ++static unsigned long qcom_lmh_get_throttle_freq(struct qcom_cpufreq_data *data) + { +- unsigned int val = readl_relaxed(data->base + data->soc_data->reg_current_vote); ++ unsigned int lval; + +- return (val & 0x3FF) * 19200; ++ if (data->soc_data->reg_current_vote) ++ lval = readl_relaxed(data->base + data->soc_data->reg_current_vote) & 0x3ff; ++ else ++ lval = readl_relaxed(data->base + data->soc_data->reg_domain_state) & 0xff; ++ ++ return lval * xo_rate; + } + + static void qcom_lmh_dcvs_notify(struct qcom_cpufreq_data *data) +@@ -281,14 +287,12 @@ static void qcom_lmh_dcvs_notify(struct qcom_cpufreq_data *data) + struct device *dev = get_cpu_device(cpu); + unsigned long freq_hz, throttled_freq; + struct dev_pm_opp *opp; +- unsigned int freq; + + /* + * Get the h/w throttled frequency, normalize it using the + * registered opp table and use it to calculate thermal pressure. + */ +- freq = qcom_lmh_get_throttle_freq(data); +- freq_hz = freq * HZ_PER_KHZ; ++ freq_hz = qcom_lmh_get_throttle_freq(data); + + opp = dev_pm_opp_find_freq_floor(dev, &freq_hz); + if (IS_ERR(opp) && PTR_ERR(opp) == -ERANGE) +@@ -357,6 +361,7 @@ static const struct qcom_cpufreq_soc_data qcom_soc_data = { + + static const struct qcom_cpufreq_soc_data epss_soc_data = { + .reg_enable = 0x0, ++ .reg_domain_state = 0x20, + .reg_freq_lut = 0x100, + .reg_volt_lut = 0x200, + .reg_perf_state = 0x320, +-- +2.35.1 + diff --git a/queue-5.17/cpufreq-qcom-hw-drop-affinity-hint-before-freeing-th.patch b/queue-5.17/cpufreq-qcom-hw-drop-affinity-hint-before-freeing-th.patch new file mode 100644 index 00000000000..51d73407c3c --- /dev/null +++ b/queue-5.17/cpufreq-qcom-hw-drop-affinity-hint-before-freeing-th.patch @@ -0,0 +1,72 @@ +From fe1aadd3b1e7ae80869e299fb0720028a385017d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 26 Mar 2022 18:51:50 +0300 +Subject: cpufreq: qcom-hw: drop affinity hint before freeing the IRQ + +From: Dmitry Baryshkov + +[ Upstream commit be5985b3dbce5ba2af3c8b0f2b7df235c93907e6 ] + +Drop affinity hint before freeing the throttling IRQ to fix the +following trace: + +[ 185.114773] ------------[ cut here ]------------ +[ 185.119517] WARNING: CPU: 7 PID: 43 at kernel/irq/manage.c:1887 free_irq+0x3a4/0x3dc +[ 185.127474] Modules linked in: +[ 185.130618] CPU: 7 PID: 43 Comm: cpuhp/7 Tainted: G S W 5.17.0-rc6-00386-g67382a5b705d-dirty #690 +[ 185.147125] pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) +[ 185.154269] pc : free_irq+0x3a4/0x3dc +[ 185.158031] lr : free_irq+0x33c/0x3dc +[ 185.161792] sp : ffff80000841bc90 +[ 185.165195] x29: ffff80000841bc90 x28: ffffa6edc5c3d000 x27: ffff6d93729e5908 +[ 185.172515] x26: 0000000000000000 x25: ffff6d910109fc00 x24: ffff6d91011490e0 +[ 185.179838] x23: ffff6d9101149218 x22: 0000000000000080 x21: 0000000000000000 +[ 185.187163] x20: ffff6d9101149000 x19: ffff6d910ab61500 x18: ffffffffffffffff +[ 185.194487] x17: 2e35202020202020 x16: 2020202020202020 x15: ffff80008841b9a7 +[ 185.201805] x14: 00000000000003c9 x13: 0000000000000001 x12: 0000000000000040 +[ 185.209135] x11: ffff6d91005aab58 x10: ffff6d91005aab5a x9 : ffffc6a5ad1c5408 +[ 185.216455] x8 : ffff6d91005adb88 x7 : 0000000000000000 x6 : ffffc6a5ab5a91f4 +[ 185.223776] x5 : 0000000000000000 x4 : ffff6d91011490a8 x3 : ffffc6a5ad266108 +[ 185.231098] x2 : 0000000013033204 x1 : ffff6d9101149000 x0 : ffff6d910a9cc000 +[ 185.238421] Call trace: +[ 185.240932] free_irq+0x3a4/0x3dc +[ 185.244334] qcom_cpufreq_hw_cpu_exit+0x78/0xcc +[ 185.248985] cpufreq_offline.isra.0+0x228/0x270 +[ 185.253639] cpuhp_cpufreq_offline+0x10/0x20 +[ 185.258027] cpuhp_invoke_callback+0x16c/0x2b0 +[ 185.262592] cpuhp_thread_fun+0x190/0x250 +[ 185.266710] smpboot_thread_fn+0x12c/0x230 +[ 185.270914] kthread+0xfc/0x100 +[ 185.274145] ret_from_fork+0x10/0x20 +[ 185.277820] irq event stamp: 212 +[ 185.281136] hardirqs last enabled at (211): [] _raw_spin_unlock_irqrestore+0x8c/0xa0 +[ 185.290775] hardirqs last disabled at (212): [] __schedule+0x710/0xa10 +[ 185.299081] softirqs last enabled at (0): [] copy_process+0x7d0/0x1a14 +[ 185.307475] softirqs last disabled at (0): [<0000000000000000>] 0x0 + +Fixes: 3ed6dfbd3bb98 ("cpufreq: qcom-hw: Set CPU affinity of dcvsh interrupts") +Tested-by: Vladimir Zapolskiy +Reviewed-by: Vladimir Zapolskiy +Reviewed-by: Bjorn Andersson +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/qcom-cpufreq-hw.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/cpufreq/qcom-cpufreq-hw.c b/drivers/cpufreq/qcom-cpufreq-hw.c +index effbb680b453..740518d8ae16 100644 +--- a/drivers/cpufreq/qcom-cpufreq-hw.c ++++ b/drivers/cpufreq/qcom-cpufreq-hw.c +@@ -412,6 +412,7 @@ static void qcom_cpufreq_hw_lmh_exit(struct qcom_cpufreq_data *data) + mutex_unlock(&data->throttle_lock); + + cancel_delayed_work_sync(&data->throttle_work); ++ irq_set_affinity_hint(data->throttle_irq, NULL); + free_irq(data->throttle_irq, data); + } + +-- +2.35.1 + diff --git a/queue-5.17/cpufreq-qcom-hw-fix-the-opp-entries-refcounting.patch b/queue-5.17/cpufreq-qcom-hw-fix-the-opp-entries-refcounting.patch new file mode 100644 index 00000000000..ef93391c053 --- /dev/null +++ b/queue-5.17/cpufreq-qcom-hw-fix-the-opp-entries-refcounting.patch @@ -0,0 +1,93 @@ +From 05def0d48374f70139b9c1a0a574aa10ee9d4256 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 26 Mar 2022 18:51:52 +0300 +Subject: cpufreq: qcom-hw: fix the opp entries refcounting + +From: Dmitry Baryshkov + +[ Upstream commit 6240aaad75e1a623872a830d13393d7aabf1052c ] + +The qcom_lmh_dcvs_notify() will get the dev_pm_opp instance for +throttling, but will not put it, ending up with leaking a reference +count and the following backtrace when putting the CPU offline. + +Correctly put the reference count of the returned opp instance. + +[ 84.418025] ------------[ cut here ]------------ +[ 84.422770] WARNING: CPU: 7 PID: 43 at drivers/opp/core.c:1396 _opp_table_kref_release+0x188/0x190 +[ 84.431966] Modules linked in: +[ 84.435106] CPU: 7 PID: 43 Comm: cpuhp/7 Tainted: G S 5.17.0-rc6-00388-g7cf3c0d89c44-dirty #721 +[ 84.451631] pstate: 82400005 (Nzcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--) +[ 84.458781] pc : _opp_table_kref_release+0x188/0x190 +[ 84.463878] lr : _opp_table_kref_release+0x78/0x190 +[ 84.468885] sp : ffff80000841bc70 +[ 84.472294] x29: ffff80000841bc70 x28: ffff6664afe3d000 x27: ffff1db6729e5908 +[ 84.479621] x26: 0000000000000000 x25: 0000000000000000 x24: ffff1db6729e58e0 +[ 84.486946] x23: ffff8000080a5000 x22: ffff1db40aad80e0 x21: ffff1db4002fec80 +[ 84.494277] x20: ffff1db40aad8000 x19: ffffb751c3186300 x18: ffffffffffffffff +[ 84.501603] x17: 5300326563697665 x16: 645f676e696c6f6f x15: 00001186c1df5448 +[ 84.508928] x14: 00000000000002e9 x13: 0000000000000000 x12: 0000000000000000 +[ 84.516256] x11: ffffb751c3186368 x10: ffffb751c39a2a70 x9 : 0000000000000000 +[ 84.523585] x8 : ffff1db4008edf00 x7 : ffffb751c328c000 x6 : 0000000000000001 +[ 84.530916] x5 : 0000000000040000 x4 : 0000000000000001 x3 : ffff1db4008edf00 +[ 84.538247] x2 : 0000000000000000 x1 : ffff1db400aa6100 x0 : ffff1db40aad80d0 +[ 84.545579] Call trace: +[ 84.548101] _opp_table_kref_release+0x188/0x190 +[ 84.552842] dev_pm_opp_remove_all_dynamic+0x8c/0xc0 +[ 84.557949] qcom_cpufreq_hw_cpu_exit+0x30/0xdc +[ 84.562608] cpufreq_offline.isra.0+0x1b4/0x1d8 +[ 84.567270] cpuhp_cpufreq_offline+0x10/0x6c +[ 84.571663] cpuhp_invoke_callback+0x16c/0x2b0 +[ 84.576231] cpuhp_thread_fun+0x190/0x250 +[ 84.580353] smpboot_thread_fn+0x12c/0x230 +[ 84.584568] kthread+0xfc/0x100 +[ 84.587810] ret_from_fork+0x10/0x20 +[ 84.591490] irq event stamp: 3482 +[ 84.594901] hardirqs last enabled at (3481): [] call_rcu+0x39c/0x50c +[ 84.603119] hardirqs last disabled at (3482): [] el1_dbg+0x24/0x8c +[ 84.611074] softirqs last enabled at (310): [] _stext+0x410/0x588 +[ 84.619028] softirqs last disabled at (305): [] __irq_exit_rcu+0x158/0x174 +[ 84.627691] ---[ end trace 0000000000000000 ]--- + +Fixes: 275157b367f4 ("cpufreq: qcom-cpufreq-hw: Add dcvs interrupt support") +Reported-by: kernel test robot +Tested-by: Vladimir Zapolskiy +Reviewed-by: Vladimir Zapolskiy +Reviewed-by: Bjorn Andersson +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/qcom-cpufreq-hw.c | 14 ++++++++++---- + 1 file changed, 10 insertions(+), 4 deletions(-) + +diff --git a/drivers/cpufreq/qcom-cpufreq-hw.c b/drivers/cpufreq/qcom-cpufreq-hw.c +index dc0d5f84d863..60d38f62308a 100644 +--- a/drivers/cpufreq/qcom-cpufreq-hw.c ++++ b/drivers/cpufreq/qcom-cpufreq-hw.c +@@ -292,12 +292,18 @@ static void qcom_lmh_dcvs_notify(struct qcom_cpufreq_data *data) + + opp = dev_pm_opp_find_freq_floor(dev, &freq_hz); + if (IS_ERR(opp) && PTR_ERR(opp) == -ERANGE) +- dev_pm_opp_find_freq_ceil(dev, &freq_hz); ++ opp = dev_pm_opp_find_freq_ceil(dev, &freq_hz); + +- throttled_freq = freq_hz / HZ_PER_KHZ; ++ if (IS_ERR(opp)) { ++ dev_warn(dev, "Can't find the OPP for throttling: %pe!\n", opp); ++ } else { ++ throttled_freq = freq_hz / HZ_PER_KHZ; ++ ++ /* Update thermal pressure (the boost frequencies are accepted) */ ++ arch_update_thermal_pressure(policy->related_cpus, throttled_freq); + +- /* Update thermal pressure (the boost frequencies are accepted) */ +- arch_update_thermal_pressure(policy->related_cpus, throttled_freq); ++ dev_pm_opp_put(opp); ++ } + + /* + * In the unlikely case policy is unregistered do not enable +-- +2.35.1 + diff --git a/queue-5.17/cpufreq-qcom-hw-fix-the-race-between-lmh-worker-and-.patch b/queue-5.17/cpufreq-qcom-hw-fix-the-race-between-lmh-worker-and-.patch new file mode 100644 index 00000000000..15d0a8e6e33 --- /dev/null +++ b/queue-5.17/cpufreq-qcom-hw-fix-the-race-between-lmh-worker-and-.patch @@ -0,0 +1,73 @@ +From 7669cd5a8197610898effd8e63a26cbba8ff999f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 26 Mar 2022 18:51:51 +0300 +Subject: cpufreq: qcom-hw: fix the race between LMH worker and cpuhp + +From: Dmitry Baryshkov + +[ Upstream commit 5e4f009da6be563984ba4db4ef4f32529e9aeb90 ] + +The driver would disable the worker when cpu is being put offline, but +it happens closer to the end of cpufreq_offline(). The function +qcom_lmh_dcvs_poll() can be running in parallel with this, when +policy->cpus already has been updated. Read policy->related_cpus +instead. + +[ 37.122433] ------------[ cut here ]------------ +[ 37.127225] WARNING: CPU: 0 PID: 187 at drivers/base/arch_topology.c:180 topology_update_thermal_pressure+0xec/0x100 +[ 37.138098] Modules linked in: +[ 37.141279] CPU: 0 PID: 187 Comm: kworker/0:3 Tainted: G S 5.17.0-rc6-00389-g37c83d0b8710-dirty #713 +[ 37.158306] Workqueue: events qcom_lmh_dcvs_poll +[ 37.163095] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) +[ 37.170278] pc : topology_update_thermal_pressure+0xec/0x100 +[ 37.176131] lr : topology_update_thermal_pressure+0x20/0x100 +[ 37.181977] sp : ffff800009b6bce0 +[ 37.185402] x29: ffff800009b6bce0 x28: ffffd87abe92b000 x27: ffff04bd7292e205 +[ 37.192792] x26: ffffd87abe930af8 x25: ffffd87abe94e4c8 x24: 0000000000000000 +[ 37.200180] x23: ffff04bb01177018 x22: ffff04bb011770c0 x21: ffff04bb01177000 +[ 37.207567] x20: ffff04bb0a419000 x19: 00000000000c4e00 x18: 0000000000000000 +[ 37.214954] x17: 000000040044ffff x16: 004000b2b5503510 x15: 0000006aaa1326d2 +[ 37.222333] x14: 0000000000000232 x13: 0000000000000001 x12: 0000000000000040 +[ 37.229718] x11: ffff04bb00400000 x10: 968f57bd39f701c8 x9 : ffff04bb0acc8674 +[ 37.237095] x8 : fefefefefefefeff x7 : 0000000000000018 x6 : ffffd87abd90092c +[ 37.244478] x5 : 0000000000000016 x4 : 0000000000000000 x3 : 0000000000000100 +[ 37.251852] x2 : ffff04bb0a419020 x1 : 0000000000000100 x0 : 0000000000000100 +[ 37.259235] Call trace: +[ 37.261771] topology_update_thermal_pressure+0xec/0x100 +[ 37.267266] qcom_lmh_dcvs_poll+0xbc/0x154 +[ 37.271505] process_one_work+0x288/0x69c +[ 37.275654] worker_thread+0x74/0x470 +[ 37.279450] kthread+0xfc/0x100 +[ 37.282712] ret_from_fork+0x10/0x20 +[ 37.286417] irq event stamp: 74 +[ 37.289664] hardirqs last enabled at (73): [] _raw_spin_unlock_irq+0x44/0x80 +[ 37.298632] hardirqs last disabled at (74): [] __schedule+0x710/0xa10 +[ 37.306885] softirqs last enabled at (58): [] _stext+0x410/0x588 +[ 37.314778] softirqs last disabled at (51): [] __irq_exit_rcu+0x158/0x174 +[ 37.323386] ---[ end trace 0000000000000000 ]--- + +Fixes: 275157b367f4 ("cpufreq: qcom-cpufreq-hw: Add dcvs interrupt support") +Signed-off-by: Dmitry Baryshkov +Reviewed-by: Bjorn Andersson +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/qcom-cpufreq-hw.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/cpufreq/qcom-cpufreq-hw.c b/drivers/cpufreq/qcom-cpufreq-hw.c +index 740518d8ae16..dc0d5f84d863 100644 +--- a/drivers/cpufreq/qcom-cpufreq-hw.c ++++ b/drivers/cpufreq/qcom-cpufreq-hw.c +@@ -277,7 +277,7 @@ static unsigned int qcom_lmh_get_throttle_freq(struct qcom_cpufreq_data *data) + static void qcom_lmh_dcvs_notify(struct qcom_cpufreq_data *data) + { + struct cpufreq_policy *policy = data->policy; +- int cpu = cpumask_first(policy->cpus); ++ int cpu = cpumask_first(policy->related_cpus); + struct device *dev = get_cpu_device(cpu); + unsigned long freq_hz, throttled_freq; + struct dev_pm_opp *opp; +-- +2.35.1 + diff --git a/queue-5.17/drivers-net-hippi-fix-deadlock-in-rr_close.patch b/queue-5.17/drivers-net-hippi-fix-deadlock-in-rr_close.patch new file mode 100644 index 00000000000..cbb8e99edbf --- /dev/null +++ b/queue-5.17/drivers-net-hippi-fix-deadlock-in-rr_close.patch @@ -0,0 +1,53 @@ +From cc9fd5a173f3b83196bff54f9cc2072da4fd563d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 17 Apr 2022 20:55:19 +0800 +Subject: drivers: net: hippi: Fix deadlock in rr_close() + +From: Duoming Zhou + +[ Upstream commit bc6de2878429e85c1f1afaa566f7b5abb2243eef ] + +There is a deadlock in rr_close(), which is shown below: + + (Thread 1) | (Thread 2) + | rr_open() +rr_close() | add_timer() + spin_lock_irqsave() //(1) | (wait a time) + ... | rr_timer() + del_timer_sync() | spin_lock_irqsave() //(2) + (wait timer to stop) | ... + +We hold rrpriv->lock in position (1) of thread 1 and +use del_timer_sync() to wait timer to stop, but timer handler +also need rrpriv->lock in position (2) of thread 2. +As a result, rr_close() will block forever. + +This patch extracts del_timer_sync() from the protection of +spin_lock_irqsave(), which could let timer handler to obtain +the needed lock. + +Signed-off-by: Duoming Zhou +Link: https://lore.kernel.org/r/20220417125519.82618-1-duoming@zju.edu.cn +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/hippi/rrunner.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/hippi/rrunner.c b/drivers/net/hippi/rrunner.c +index 16105292b140..74e845fa2e07 100644 +--- a/drivers/net/hippi/rrunner.c ++++ b/drivers/net/hippi/rrunner.c +@@ -1355,7 +1355,9 @@ static int rr_close(struct net_device *dev) + + rrpriv->fw_running = 0; + ++ spin_unlock_irqrestore(&rrpriv->lock, flags); + del_timer_sync(&rrpriv->timer); ++ spin_lock_irqsave(&rrpriv->lock, flags); + + writel(0, ®s->TxPi); + writel(0, ®s->IpRxPi); +-- +2.35.1 + diff --git a/queue-5.17/drm-amd-display-fix-memory-leak-in-dcn21_clock_sourc.patch b/queue-5.17/drm-amd-display-fix-memory-leak-in-dcn21_clock_sourc.patch new file mode 100644 index 00000000000..97b2f7840de --- /dev/null +++ b/queue-5.17/drm-amd-display-fix-memory-leak-in-dcn21_clock_sourc.patch @@ -0,0 +1,34 @@ +From 540404867ba9c00dae31157d9afa0869f42a9022 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Apr 2022 17:03:09 +0800 +Subject: drm/amd/display: Fix memory leak in dcn21_clock_source_create + +From: Miaoqian Lin + +[ Upstream commit 65e54987508b6f0771f56bdfa3ee1926d52785ae ] + +When dcn20_clk_src_construct() fails, we need to release clk_src. + +Fixes: 6f4e6361c3ff ("drm/amd/display: Add Renoir resource (v2)") +Signed-off-by: Miaoqian Lin +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c +index ca1bbc942fd4..67f3cae553e0 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c +@@ -1427,6 +1427,7 @@ static struct clock_source *dcn21_clock_source_create( + return &clk_src->base; + } + ++ kfree(clk_src); + BREAK_TO_DEBUGGER(); + return NULL; + } +-- +2.35.1 + diff --git a/queue-5.17/drm-amdkfd-fix-gws-queue-count.patch b/queue-5.17/drm-amdkfd-fix-gws-queue-count.patch new file mode 100644 index 00000000000..5b81d3f2661 --- /dev/null +++ b/queue-5.17/drm-amdkfd-fix-gws-queue-count.patch @@ -0,0 +1,222 @@ +From 55f15c3beeb9007e8b029fbcaf9dcb625912339a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Apr 2022 11:55:58 -0400 +Subject: drm/amdkfd: Fix GWS queue count + +From: David Yat Sin + +[ Upstream commit 7c6b6e18c890f30965b0589b0a57645e1dbccfde ] + +dqm->gws_queue_count and pdd->qpd.mapped_gws_queue need to be updated +each time the queue gets evicted. + +Fixes: b8020b0304c8 ("drm/amdkfd: Enable over-subscription with >1 GWS queue") +Signed-off-by: David Yat Sin +Reviewed-by: Felix Kuehling +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../drm/amd/amdkfd/kfd_device_queue_manager.c | 83 +++++++++---------- + 1 file changed, 37 insertions(+), 46 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c +index 4b6814949aad..8d40b93747e0 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c +@@ -129,19 +129,33 @@ void program_sh_mem_settings(struct device_queue_manager *dqm, + } + + static void increment_queue_count(struct device_queue_manager *dqm, +- enum kfd_queue_type type) ++ struct qcm_process_device *qpd, ++ struct queue *q) + { + dqm->active_queue_count++; +- if (type == KFD_QUEUE_TYPE_COMPUTE || type == KFD_QUEUE_TYPE_DIQ) ++ if (q->properties.type == KFD_QUEUE_TYPE_COMPUTE || ++ q->properties.type == KFD_QUEUE_TYPE_DIQ) + dqm->active_cp_queue_count++; ++ ++ if (q->properties.is_gws) { ++ dqm->gws_queue_count++; ++ qpd->mapped_gws_queue = true; ++ } + } + + static void decrement_queue_count(struct device_queue_manager *dqm, +- enum kfd_queue_type type) ++ struct qcm_process_device *qpd, ++ struct queue *q) + { + dqm->active_queue_count--; +- if (type == KFD_QUEUE_TYPE_COMPUTE || type == KFD_QUEUE_TYPE_DIQ) ++ if (q->properties.type == KFD_QUEUE_TYPE_COMPUTE || ++ q->properties.type == KFD_QUEUE_TYPE_DIQ) + dqm->active_cp_queue_count--; ++ ++ if (q->properties.is_gws) { ++ dqm->gws_queue_count--; ++ qpd->mapped_gws_queue = false; ++ } + } + + static int allocate_doorbell(struct qcm_process_device *qpd, struct queue *q) +@@ -380,7 +394,7 @@ static int create_queue_nocpsch(struct device_queue_manager *dqm, + list_add(&q->list, &qpd->queues_list); + qpd->queue_count++; + if (q->properties.is_active) +- increment_queue_count(dqm, q->properties.type); ++ increment_queue_count(dqm, qpd, q); + + /* + * Unconditionally increment this counter, regardless of the queue's +@@ -505,13 +519,8 @@ static int destroy_queue_nocpsch_locked(struct device_queue_manager *dqm, + deallocate_vmid(dqm, qpd, q); + } + qpd->queue_count--; +- if (q->properties.is_active) { +- decrement_queue_count(dqm, q->properties.type); +- if (q->properties.is_gws) { +- dqm->gws_queue_count--; +- qpd->mapped_gws_queue = false; +- } +- } ++ if (q->properties.is_active) ++ decrement_queue_count(dqm, qpd, q); + + return retval; + } +@@ -604,12 +613,11 @@ static int update_queue(struct device_queue_manager *dqm, struct queue *q, + * dqm->active_queue_count to determine whether a new runlist must be + * uploaded. + */ +- if (q->properties.is_active && !prev_active) +- increment_queue_count(dqm, q->properties.type); +- else if (!q->properties.is_active && prev_active) +- decrement_queue_count(dqm, q->properties.type); +- +- if (q->gws && !q->properties.is_gws) { ++ if (q->properties.is_active && !prev_active) { ++ increment_queue_count(dqm, &pdd->qpd, q); ++ } else if (!q->properties.is_active && prev_active) { ++ decrement_queue_count(dqm, &pdd->qpd, q); ++ } else if (q->gws && !q->properties.is_gws) { + if (q->properties.is_active) { + dqm->gws_queue_count++; + pdd->qpd.mapped_gws_queue = true; +@@ -671,11 +679,7 @@ static int evict_process_queues_nocpsch(struct device_queue_manager *dqm, + mqd_mgr = dqm->mqd_mgrs[get_mqd_type_from_queue_type( + q->properties.type)]; + q->properties.is_active = false; +- decrement_queue_count(dqm, q->properties.type); +- if (q->properties.is_gws) { +- dqm->gws_queue_count--; +- qpd->mapped_gws_queue = false; +- } ++ decrement_queue_count(dqm, qpd, q); + + if (WARN_ONCE(!dqm->sched_running, "Evict when stopped\n")) + continue; +@@ -721,7 +725,7 @@ static int evict_process_queues_cpsch(struct device_queue_manager *dqm, + continue; + + q->properties.is_active = false; +- decrement_queue_count(dqm, q->properties.type); ++ decrement_queue_count(dqm, qpd, q); + } + pdd->last_evict_timestamp = get_jiffies_64(); + retval = execute_queues_cpsch(dqm, +@@ -792,11 +796,7 @@ static int restore_process_queues_nocpsch(struct device_queue_manager *dqm, + mqd_mgr = dqm->mqd_mgrs[get_mqd_type_from_queue_type( + q->properties.type)]; + q->properties.is_active = true; +- increment_queue_count(dqm, q->properties.type); +- if (q->properties.is_gws) { +- dqm->gws_queue_count++; +- qpd->mapped_gws_queue = true; +- } ++ increment_queue_count(dqm, qpd, q); + + if (WARN_ONCE(!dqm->sched_running, "Restore when stopped\n")) + continue; +@@ -854,7 +854,7 @@ static int restore_process_queues_cpsch(struct device_queue_manager *dqm, + continue; + + q->properties.is_active = true; +- increment_queue_count(dqm, q->properties.type); ++ increment_queue_count(dqm, &pdd->qpd, q); + } + retval = execute_queues_cpsch(dqm, + KFD_UNMAP_QUEUES_FILTER_DYNAMIC_QUEUES, 0); +@@ -1260,7 +1260,7 @@ static int create_kernel_queue_cpsch(struct device_queue_manager *dqm, + dqm->total_queue_count); + + list_add(&kq->list, &qpd->priv_queue_list); +- increment_queue_count(dqm, kq->queue->properties.type); ++ increment_queue_count(dqm, qpd, kq->queue); + qpd->is_debug = true; + execute_queues_cpsch(dqm, KFD_UNMAP_QUEUES_FILTER_DYNAMIC_QUEUES, 0); + dqm_unlock(dqm); +@@ -1274,7 +1274,7 @@ static void destroy_kernel_queue_cpsch(struct device_queue_manager *dqm, + { + dqm_lock(dqm); + list_del(&kq->list); +- decrement_queue_count(dqm, kq->queue->properties.type); ++ decrement_queue_count(dqm, qpd, kq->queue); + qpd->is_debug = false; + execute_queues_cpsch(dqm, KFD_UNMAP_QUEUES_FILTER_ALL_QUEUES, 0); + /* +@@ -1341,7 +1341,7 @@ static int create_queue_cpsch(struct device_queue_manager *dqm, struct queue *q, + qpd->queue_count++; + + if (q->properties.is_active) { +- increment_queue_count(dqm, q->properties.type); ++ increment_queue_count(dqm, qpd, q); + + execute_queues_cpsch(dqm, + KFD_UNMAP_QUEUES_FILTER_DYNAMIC_QUEUES, 0); +@@ -1558,15 +1558,11 @@ static int destroy_queue_cpsch(struct device_queue_manager *dqm, + list_del(&q->list); + qpd->queue_count--; + if (q->properties.is_active) { +- decrement_queue_count(dqm, q->properties.type); ++ decrement_queue_count(dqm, qpd, q); + retval = execute_queues_cpsch(dqm, + KFD_UNMAP_QUEUES_FILTER_DYNAMIC_QUEUES, 0); + if (retval == -ETIME) + qpd->reset_wavefronts = true; +- if (q->properties.is_gws) { +- dqm->gws_queue_count--; +- qpd->mapped_gws_queue = false; +- } + } + + /* +@@ -1757,7 +1753,7 @@ static int process_termination_cpsch(struct device_queue_manager *dqm, + /* Clean all kernel queues */ + list_for_each_entry_safe(kq, kq_next, &qpd->priv_queue_list, list) { + list_del(&kq->list); +- decrement_queue_count(dqm, kq->queue->properties.type); ++ decrement_queue_count(dqm, qpd, kq->queue); + qpd->is_debug = false; + dqm->total_queue_count--; + filter = KFD_UNMAP_QUEUES_FILTER_ALL_QUEUES; +@@ -1770,13 +1766,8 @@ static int process_termination_cpsch(struct device_queue_manager *dqm, + else if (q->properties.type == KFD_QUEUE_TYPE_SDMA_XGMI) + deallocate_sdma_queue(dqm, q); + +- if (q->properties.is_active) { +- decrement_queue_count(dqm, q->properties.type); +- if (q->properties.is_gws) { +- dqm->gws_queue_count--; +- qpd->mapped_gws_queue = false; +- } +- } ++ if (q->properties.is_active) ++ decrement_queue_count(dqm, qpd, q); + + dqm->total_queue_count--; + } +-- +2.35.1 + diff --git a/queue-5.17/drm-sun4i-remove-obsolete-references-to-phys_offset.patch b/queue-5.17/drm-sun4i-remove-obsolete-references-to-phys_offset.patch new file mode 100644 index 00000000000..6b8f2198855 --- /dev/null +++ b/queue-5.17/drm-sun4i-remove-obsolete-references-to-phys_offset.patch @@ -0,0 +1,65 @@ +From 2a5f5755a282efc51df1812983f196f7b6dc9c56 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 24 Apr 2022 11:26:21 -0500 +Subject: drm/sun4i: Remove obsolete references to PHYS_OFFSET + +From: Samuel Holland + +[ Upstream commit dc3ae06c5f2170d879ff58696f629d8c3868aec3 ] + +commit b4bdc4fbf8d0 ("soc: sunxi: Deal with the MBUS DMA offsets in a +central place") added a platform device notifier that sets the DMA +offset for all of the display engine frontend and backend devices. + +The code applying the offset to DMA buffer physical addresses was then +removed from the backend driver in commit 756668ba682e ("drm/sun4i: +backend: Remove the MBUS quirks"), but the code subtracting PHYS_OFFSET +was left in the frontend driver. + +As a result, the offset was applied twice in the frontend driver. This +likely went unnoticed because it only affects specific configurations +(scaling or certain pixel formats) where the frontend is used, on boards +with both one of these older SoCs and more than 1 GB of DRAM. + +In addition, the references to PHYS_OFFSET prevent compiling the driver +on architectures where PHYS_OFFSET is not defined. + +Fixes: b4bdc4fbf8d0 ("soc: sunxi: Deal with the MBUS DMA offsets in a central place") +Reviewed-by: Jernej Skrabec +Signed-off-by: Samuel Holland +Signed-off-by: Maxime Ripard +Link: https://patchwork.freedesktop.org/patch/msgid/20220424162633.12369-4-samuel@sholland.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/sun4i/sun4i_frontend.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/gpu/drm/sun4i/sun4i_frontend.c b/drivers/gpu/drm/sun4i/sun4i_frontend.c +index 56ae38389db0..462fae73eae9 100644 +--- a/drivers/gpu/drm/sun4i/sun4i_frontend.c ++++ b/drivers/gpu/drm/sun4i/sun4i_frontend.c +@@ -222,13 +222,11 @@ void sun4i_frontend_update_buffer(struct sun4i_frontend *frontend, + + /* Set the physical address of the buffer in memory */ + paddr = drm_fb_cma_get_gem_addr(fb, state, 0); +- paddr -= PHYS_OFFSET; + DRM_DEBUG_DRIVER("Setting buffer #0 address to %pad\n", &paddr); + regmap_write(frontend->regs, SUN4I_FRONTEND_BUF_ADDR0_REG, paddr); + + if (fb->format->num_planes > 1) { + paddr = drm_fb_cma_get_gem_addr(fb, state, swap ? 2 : 1); +- paddr -= PHYS_OFFSET; + DRM_DEBUG_DRIVER("Setting buffer #1 address to %pad\n", &paddr); + regmap_write(frontend->regs, SUN4I_FRONTEND_BUF_ADDR1_REG, + paddr); +@@ -236,7 +234,6 @@ void sun4i_frontend_update_buffer(struct sun4i_frontend *frontend, + + if (fb->format->num_planes > 2) { + paddr = drm_fb_cma_get_gem_addr(fb, state, swap ? 1 : 2); +- paddr -= PHYS_OFFSET; + DRM_DEBUG_DRIVER("Setting buffer #2 address to %pad\n", &paddr); + regmap_write(frontend->regs, SUN4I_FRONTEND_BUF_ADDR2_REG, + paddr); +-- +2.35.1 + diff --git a/queue-5.17/erofs-fix-use-after-free-of-on-stack-io.patch b/queue-5.17/erofs-fix-use-after-free-of-on-stack-io.patch new file mode 100644 index 00000000000..ca57cd68cc1 --- /dev/null +++ b/queue-5.17/erofs-fix-use-after-free-of-on-stack-io.patch @@ -0,0 +1,106 @@ +From 04a8223dfd77e26ed78524ead224d83299bdc272 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Apr 2022 19:55:27 +0800 +Subject: erofs: fix use-after-free of on-stack io[] + +From: Hongyu Jin + +[ Upstream commit 60b30050116c0351b90154044345c1b53ae1f323 ] + +The root cause is the race as follows: +Thread #1 Thread #2(irq ctx) + +z_erofs_runqueue() + struct z_erofs_decompressqueue io_A[]; + submit bio A + z_erofs_decompress_kickoff(,,1) + z_erofs_decompressqueue_endio(bio A) + z_erofs_decompress_kickoff(,,-1) + spin_lock_irqsave() + atomic_add_return() + io_wait_event() -> pending_bios is already 0 + [end of function] + wake_up_locked(io_A[]) // crash + +Referenced backtrace in kernel 5.4: + +[ 10.129422] Unable to handle kernel paging request at virtual address eb0454a4 +[ 10.364157] CPU: 0 PID: 709 Comm: getprop Tainted: G WC O 5.4.147-ab09225 #1 +[ 11.556325] [] (__wake_up_common) from [] (__wake_up_locked+0x40/0x48) +[ 11.565487] [] (__wake_up_locked) from [] (z_erofs_vle_unzip_kickoff+0x6c/0xc0) +[ 11.575438] [] (z_erofs_vle_unzip_kickoff) from [] (z_erofs_vle_read_endio+0x16c/0x17c) +[ 11.586082] [] (z_erofs_vle_read_endio) from [] (clone_endio+0xb4/0x1d0) +[ 11.595428] [] (clone_endio) from [] (blk_update_request+0x150/0x4dc) +[ 11.604516] [] (blk_update_request) from [] (mmc_blk_cqe_complete_rq+0x144/0x15c) +[ 11.614640] [] (mmc_blk_cqe_complete_rq) from [] (blk_done_softirq+0xb0/0xcc) +[ 11.624419] [] (blk_done_softirq) from [] (__do_softirq+0x184/0x56c) +[ 11.633419] [] (__do_softirq) from [] (irq_exit+0xd4/0x138) +[ 11.641640] [] (irq_exit) from [] (__handle_domain_irq+0x94/0xd0) +[ 11.650381] [] (__handle_domain_irq) from [] (gic_handle_irq+0x50/0xd4) +[ 11.659641] [] (gic_handle_irq) from [] (__irq_svc+0x70/0xb0) + +Signed-off-by: Hongyu Jin +Reviewed-by: Gao Xiang +Reviewed-by: Chao Yu +Link: https://lore.kernel.org/r/20220401115527.4935-1-hongyu.jin.cn@gmail.com +Signed-off-by: Gao Xiang +Signed-off-by: Sasha Levin +--- + fs/erofs/zdata.c | 12 ++++-------- + fs/erofs/zdata.h | 2 +- + 2 files changed, 5 insertions(+), 9 deletions(-) + +diff --git a/fs/erofs/zdata.c b/fs/erofs/zdata.c +index 423bc1a61da5..a1b48bcafe63 100644 +--- a/fs/erofs/zdata.c ++++ b/fs/erofs/zdata.c +@@ -1073,12 +1073,9 @@ static void z_erofs_decompress_kickoff(struct z_erofs_decompressqueue *io, + + /* wake up the caller thread for sync decompression */ + if (sync) { +- unsigned long flags; +- +- spin_lock_irqsave(&io->u.wait.lock, flags); + if (!atomic_add_return(bios, &io->pending_bios)) +- wake_up_locked(&io->u.wait); +- spin_unlock_irqrestore(&io->u.wait.lock, flags); ++ complete(&io->u.done); ++ + return; + } + +@@ -1224,7 +1221,7 @@ jobqueue_init(struct super_block *sb, + } else { + fg_out: + q = fgq; +- init_waitqueue_head(&fgq->u.wait); ++ init_completion(&fgq->u.done); + atomic_set(&fgq->pending_bios, 0); + } + q->sb = sb; +@@ -1428,8 +1425,7 @@ static void z_erofs_runqueue(struct super_block *sb, + return; + + /* wait until all bios are completed */ +- io_wait_event(io[JQ_SUBMIT].u.wait, +- !atomic_read(&io[JQ_SUBMIT].pending_bios)); ++ wait_for_completion_io(&io[JQ_SUBMIT].u.done); + + /* handle synchronous decompress queue in the caller context */ + z_erofs_decompress_queue(&io[JQ_SUBMIT], pagepool); +diff --git a/fs/erofs/zdata.h b/fs/erofs/zdata.h +index e043216b545f..800b11c53f57 100644 +--- a/fs/erofs/zdata.h ++++ b/fs/erofs/zdata.h +@@ -97,7 +97,7 @@ struct z_erofs_decompressqueue { + z_erofs_next_pcluster_t head; + + union { +- wait_queue_head_t wait; ++ struct completion done; + struct work_struct work; + } u; + }; +-- +2.35.1 + diff --git a/queue-5.17/ext4-fix-bug_on-in-start_this_handle-during-umount-f.patch b/queue-5.17/ext4-fix-bug_on-in-start_this_handle-during-umount-f.patch new file mode 100644 index 00000000000..01d11c56682 --- /dev/null +++ b/queue-5.17/ext4-fix-bug_on-in-start_this_handle-during-umount-f.patch @@ -0,0 +1,118 @@ +From 02bd5bb75f2f83001c2157ceb64eb0cffb73f0fc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Mar 2022 09:24:19 +0800 +Subject: ext4: fix bug_on in start_this_handle during umount filesystem + +From: Ye Bin + +[ Upstream commit b98535d091795a79336f520b0708457aacf55c67 ] + +We got issue as follows: +------------[ cut here ]------------ +kernel BUG at fs/jbd2/transaction.c:389! +invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI +CPU: 9 PID: 131 Comm: kworker/9:1 Not tainted 5.17.0-862.14.0.6.x86_64-00001-g23f87daf7d74-dirty #197 +Workqueue: events flush_stashed_error_work +RIP: 0010:start_this_handle+0x41c/0x1160 +RSP: 0018:ffff888106b47c20 EFLAGS: 00010202 +RAX: ffffed10251b8400 RBX: ffff888128dc204c RCX: ffffffffb52972ac +RDX: 0000000000000200 RSI: 0000000000000004 RDI: ffff888128dc2050 +RBP: 0000000000000039 R08: 0000000000000001 R09: ffffed10251b840a +R10: ffff888128dc204f R11: ffffed10251b8409 R12: ffff888116d78000 +R13: 0000000000000000 R14: dffffc0000000000 R15: ffff888128dc2000 +FS: 0000000000000000(0000) GS:ffff88839d680000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 0000000001620068 CR3: 0000000376c0e000 CR4: 00000000000006e0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +Call Trace: + + jbd2__journal_start+0x38a/0x790 + jbd2_journal_start+0x19/0x20 + flush_stashed_error_work+0x110/0x2b3 + process_one_work+0x688/0x1080 + worker_thread+0x8b/0xc50 + kthread+0x26f/0x310 + ret_from_fork+0x22/0x30 + +Modules linked in: +---[ end trace 0000000000000000 ]--- + +Above issue may happen as follows: + umount read procfs error_work +ext4_put_super + flush_work(&sbi->s_error_work); + + ext4_mb_seq_groups_show + ext4_mb_load_buddy_gfp + ext4_mb_init_group + ext4_mb_init_cache + ext4_read_block_bitmap_nowait + ext4_validate_block_bitmap + ext4_error + ext4_handle_error + schedule_work(&EXT4_SB(sb)->s_error_work); + + ext4_unregister_sysfs(sb); + jbd2_journal_destroy(sbi->s_journal); + journal_kill_thread + journal->j_flags |= JBD2_UNMOUNT; + + flush_stashed_error_work + jbd2_journal_start + start_this_handle + BUG_ON(journal->j_flags & JBD2_UNMOUNT); + +To solve this issue, we call 'ext4_unregister_sysfs() before flushing +s_error_work in ext4_put_super(). + +Signed-off-by: Ye Bin +Reviewed-by: Jan Kara +Reviewed-by: Ritesh Harjani +Link: https://lore.kernel.org/r/20220322012419.725457-1-yebin10@huawei.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/super.c | 19 ++++++++++++------- + 1 file changed, 12 insertions(+), 7 deletions(-) + +diff --git a/fs/ext4/super.c b/fs/ext4/super.c +index ba6530c2d271..fe30f483c59f 100644 +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -1199,20 +1199,25 @@ static void ext4_put_super(struct super_block *sb) + int aborted = 0; + int i, err; + +- ext4_unregister_li_request(sb); +- ext4_quota_off_umount(sb); +- +- flush_work(&sbi->s_error_work); +- destroy_workqueue(sbi->rsv_conversion_wq); +- ext4_release_orphan_info(sb); +- + /* + * Unregister sysfs before destroying jbd2 journal. + * Since we could still access attr_journal_task attribute via sysfs + * path which could have sbi->s_journal->j_task as NULL ++ * Unregister sysfs before flush sbi->s_error_work. ++ * Since user may read /proc/fs/ext4/xx/mb_groups during umount, If ++ * read metadata verify failed then will queue error work. ++ * flush_stashed_error_work will call start_this_handle may trigger ++ * BUG_ON. + */ + ext4_unregister_sysfs(sb); + ++ ext4_unregister_li_request(sb); ++ ext4_quota_off_umount(sb); ++ ++ flush_work(&sbi->s_error_work); ++ destroy_workqueue(sbi->rsv_conversion_wq); ++ ext4_release_orphan_info(sb); ++ + if (sbi->s_journal) { + aborted = is_journal_aborted(sbi->s_journal); + err = jbd2_journal_destroy(sbi->s_journal); +-- +2.35.1 + diff --git a/queue-5.17/gfs2-make-sure-not-to-return-short-direct-writes.patch b/queue-5.17/gfs2-make-sure-not-to-return-short-direct-writes.patch new file mode 100644 index 00000000000..744d8290013 --- /dev/null +++ b/queue-5.17/gfs2-make-sure-not-to-return-short-direct-writes.patch @@ -0,0 +1,37 @@ +From 397fbcbce223d73d72137994deed8f1a936d960f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Mar 2022 23:13:26 +0100 +Subject: gfs2: Make sure not to return short direct writes + +From: Andreas Gruenbacher + +[ Upstream commit 3bde4c48586074202044456285a97ccdf9048988 ] + +When direct writes fail with -ENOTBLK because we're writing into a +hole (gfs2_iomap_begin()) or because of a page invalidation failure +(iomap_dio_rw()), we're falling back to buffered writes. In that case, +when we lose the inode glock in gfs2_file_buffered_write(), we want to +re-acquire it instead of returning a short write. + +Signed-off-by: Andreas Gruenbacher +Signed-off-by: Sasha Levin +--- + fs/gfs2/file.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/gfs2/file.c b/fs/gfs2/file.c +index de0122806fb3..fdc7eda0437a 100644 +--- a/fs/gfs2/file.c ++++ b/fs/gfs2/file.c +@@ -1069,7 +1069,7 @@ static ssize_t gfs2_file_buffered_write(struct kiocb *iocb, + from->count = min(from->count, window_size - leftover); + if (gfs2_holder_queued(gh)) + goto retry_under_glock; +- if (read) ++ if (read && !(iocb->ki_flags & IOCB_DIRECT)) + goto out_uninit; + goto retry; + } +-- +2.35.1 + diff --git a/queue-5.17/gfs2-minor-retry-logic-cleanup.patch b/queue-5.17/gfs2-minor-retry-logic-cleanup.patch new file mode 100644 index 00000000000..54eedc03566 --- /dev/null +++ b/queue-5.17/gfs2-minor-retry-logic-cleanup.patch @@ -0,0 +1,86 @@ +From dd59c1bbf32fd9db3880f085104e806ef9d94f56 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Mar 2022 14:20:38 +0100 +Subject: gfs2: Minor retry logic cleanup + +From: Andreas Gruenbacher + +[ Upstream commit 124c458a401a2497f796e4f2d6cafac6edbea8e9 ] + +Clean up the retry logic in the read and write functions somewhat. + +Signed-off-by: Andreas Gruenbacher +Signed-off-by: Sasha Levin +--- + fs/gfs2/file.c | 34 ++++++++++++++++------------------ + 1 file changed, 16 insertions(+), 18 deletions(-) + +diff --git a/fs/gfs2/file.c b/fs/gfs2/file.c +index b53ad18e5ccb..de0122806fb3 100644 +--- a/fs/gfs2/file.c ++++ b/fs/gfs2/file.c +@@ -851,9 +851,9 @@ static ssize_t gfs2_file_direct_read(struct kiocb *iocb, struct iov_iter *to, + leftover = fault_in_iov_iter_writeable(to, window_size); + gfs2_holder_disallow_demote(gh); + if (leftover != window_size) { +- if (!gfs2_holder_queued(gh)) +- goto retry; +- goto retry_under_glock; ++ if (gfs2_holder_queued(gh)) ++ goto retry_under_glock; ++ goto retry; + } + } + if (gfs2_holder_queued(gh)) +@@ -920,9 +920,9 @@ static ssize_t gfs2_file_direct_write(struct kiocb *iocb, struct iov_iter *from, + leftover = fault_in_iov_iter_readable(from, window_size); + gfs2_holder_disallow_demote(gh); + if (leftover != window_size) { +- if (!gfs2_holder_queued(gh)) +- goto retry; +- goto retry_under_glock; ++ if (gfs2_holder_queued(gh)) ++ goto retry_under_glock; ++ goto retry; + } + } + out: +@@ -989,12 +989,11 @@ static ssize_t gfs2_file_read_iter(struct kiocb *iocb, struct iov_iter *to) + leftover = fault_in_iov_iter_writeable(to, window_size); + gfs2_holder_disallow_demote(&gh); + if (leftover != window_size) { +- if (!gfs2_holder_queued(&gh)) { +- if (written) +- goto out_uninit; +- goto retry; +- } +- goto retry_under_glock; ++ if (gfs2_holder_queued(&gh)) ++ goto retry_under_glock; ++ if (written) ++ goto out_uninit; ++ goto retry; + } + } + if (gfs2_holder_queued(&gh)) +@@ -1068,12 +1067,11 @@ static ssize_t gfs2_file_buffered_write(struct kiocb *iocb, + gfs2_holder_disallow_demote(gh); + if (leftover != window_size) { + from->count = min(from->count, window_size - leftover); +- if (!gfs2_holder_queued(gh)) { +- if (read) +- goto out_uninit; +- goto retry; +- } +- goto retry_under_glock; ++ if (gfs2_holder_queued(gh)) ++ goto retry_under_glock; ++ if (read) ++ goto out_uninit; ++ goto retry; + } + } + out_unlock: +-- +2.35.1 + diff --git a/queue-5.17/gfs2-no-short-reads-or-writes-upon-glock-contention.patch b/queue-5.17/gfs2-no-short-reads-or-writes-upon-glock-contention.patch new file mode 100644 index 00000000000..8742570f67a --- /dev/null +++ b/queue-5.17/gfs2-no-short-reads-or-writes-upon-glock-contention.patch @@ -0,0 +1,52 @@ +From a7ec7949e2320ff75438beeaf7c433f912fbe20f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Apr 2022 14:51:33 +0200 +Subject: gfs2: No short reads or writes upon glock contention + +From: Andreas Gruenbacher + +[ Upstream commit 296abc0d91d8b65d42224dd33452ace14491ad08 ] + +Commit 00bfe02f4796 ("gfs2: Fix mmap + page fault deadlocks for buffered +I/O") changed gfs2_file_read_iter() and gfs2_file_buffered_write() to +allow dropping the inode glock while faulting in user buffers. When the +lock was dropped, a short result was returned to indicate that the +operation was interrupted. + +As pointed out by Linus (see the link below), this behavior is broken +and the operations should always re-acquire the inode glock and resume +the operation instead. + +Link: https://lore.kernel.org/lkml/CAHk-=whaz-g_nOOoo8RRiWNjnv2R+h6_xk2F1J4TuSRxk1MtLw@mail.gmail.com/ +Fixes: 00bfe02f4796 ("gfs2: Fix mmap + page fault deadlocks for buffered I/O") +Signed-off-by: Andreas Gruenbacher +Signed-off-by: Sasha Levin +--- + fs/gfs2/file.c | 4 ---- + 1 file changed, 4 deletions(-) + +diff --git a/fs/gfs2/file.c b/fs/gfs2/file.c +index fdc7eda0437a..fa071d738c78 100644 +--- a/fs/gfs2/file.c ++++ b/fs/gfs2/file.c +@@ -991,8 +991,6 @@ static ssize_t gfs2_file_read_iter(struct kiocb *iocb, struct iov_iter *to) + if (leftover != window_size) { + if (gfs2_holder_queued(&gh)) + goto retry_under_glock; +- if (written) +- goto out_uninit; + goto retry; + } + } +@@ -1069,8 +1067,6 @@ static ssize_t gfs2_file_buffered_write(struct kiocb *iocb, + from->count = min(from->count, window_size - leftover); + if (gfs2_holder_queued(gh)) + goto retry_under_glock; +- if (read && !(iocb->ki_flags & IOCB_DIRECT)) +- goto out_uninit; + goto retry; + } + } +-- +2.35.1 + diff --git a/queue-5.17/ice-wait-5-s-for-emp-reset-after-firmware-flash.patch b/queue-5.17/ice-wait-5-s-for-emp-reset-after-firmware-flash.patch new file mode 100644 index 00000000000..ea6606fae5d --- /dev/null +++ b/queue-5.17/ice-wait-5-s-for-emp-reset-after-firmware-flash.patch @@ -0,0 +1,115 @@ +From 8b59cb1518a657f1415a47a9d9a448b36e054a27 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Apr 2022 17:37:45 +0200 +Subject: ice: wait 5 s for EMP reset after firmware flash +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Petr Oros + +[ Upstream commit b537752e6cbf0e4475c165178ca02241b53ff6ef ] + +We need to wait 5 s for EMP reset after firmware flash. Code was extracted +from OOT driver (ice v1.8.3 downloaded from sourceforge). Without this +wait, fw_activate let card in inconsistent state and recoverable only +by second flash/activate. Flash was tested on these fw's: +From -> To + 3.00 -> 3.10/3.20 + 3.10 -> 3.00/3.20 + 3.20 -> 3.00/3.10 + +Reproducer: +[root@host ~]# devlink dev flash pci/0000:ca:00.0 file E810_XXVDA4_FH_O_SEC_FW_1p6p1p9_NVM_3p10_PLDMoMCTP_0.11_8000AD7B.bin +Preparing to flash +[fw.mgmt] Erasing +[fw.mgmt] Erasing done +[fw.mgmt] Flashing 100% +[fw.mgmt] Flashing done 100% +[fw.undi] Erasing +[fw.undi] Erasing done +[fw.undi] Flashing 100% +[fw.undi] Flashing done 100% +[fw.netlist] Erasing +[fw.netlist] Erasing done +[fw.netlist] Flashing 100% +[fw.netlist] Flashing done 100% +Activate new firmware by devlink reload +[root@host ~]# devlink dev reload pci/0000:ca:00.0 action fw_activate +reload_actions_performed: + fw_activate +[root@host ~]# ip link show ens7f0 +71: ens7f0: mtu 1500 qdisc mq state DOWN mode DEFAULT group default qlen 1000 + link/ether b4:96:91:dc:72:e0 brd ff:ff:ff:ff:ff:ff + altname enp202s0f0 + +dmesg after flash: +[ 55.120788] ice: Copyright (c) 2018, Intel Corporation. +[ 55.274734] ice 0000:ca:00.0: Get PHY capabilities failed status = -5, continuing anyway +[ 55.569797] ice 0000:ca:00.0: The DDP package was successfully loaded: ICE OS Default Package version 1.3.28.0 +[ 55.603629] ice 0000:ca:00.0: Get PHY capability failed. +[ 55.608951] ice 0000:ca:00.0: ice_init_nvm_phy_type failed: -5 +[ 55.647348] ice 0000:ca:00.0: PTP init successful +[ 55.675536] ice 0000:ca:00.0: DCB is enabled in the hardware, max number of TCs supported on this port are 8 +[ 55.685365] ice 0000:ca:00.0: FW LLDP is disabled, DCBx/LLDP in SW mode. +[ 55.692179] ice 0000:ca:00.0: Commit DCB Configuration to the hardware +[ 55.701382] ice 0000:ca:00.0: 126.024 Gb/s available PCIe bandwidth, limited by 16.0 GT/s PCIe x8 link at 0000:c9:02.0 (capable of 252.048 Gb/s with 16.0 GT/s PCIe x16 link) +Reboot doesn’t help, only second flash/activate with OOT or patched +driver put card back in consistent state. + +After patch: +[root@host ~]# devlink dev flash pci/0000:ca:00.0 file E810_XXVDA4_FH_O_SEC_FW_1p6p1p9_NVM_3p10_PLDMoMCTP_0.11_8000AD7B.bin +Preparing to flash +[fw.mgmt] Erasing +[fw.mgmt] Erasing done +[fw.mgmt] Flashing 100% +[fw.mgmt] Flashing done 100% +[fw.undi] Erasing +[fw.undi] Erasing done +[fw.undi] Flashing 100% +[fw.undi] Flashing done 100% +[fw.netlist] Erasing +[fw.netlist] Erasing done +[fw.netlist] Flashing 100% +[fw.netlist] Flashing done 100% +Activate new firmware by devlink reload +[root@host ~]# devlink dev reload pci/0000:ca:00.0 action fw_activate +reload_actions_performed: + fw_activate +[root@host ~]# ip link show ens7f0 +19: ens7f0: mtu 1500 qdisc mq state UP mode DEFAULT group default qlen 1000 + link/ether b4:96:91:dc:72:e0 brd ff:ff:ff:ff:ff:ff + altname enp202s0f0 + +Fixes: 399e27dbbd9e94 ("ice: support immediate firmware activation via devlink reload") +Signed-off-by: Petr Oros +Tested-by: Gurucharan (A Contingent worker at Intel) +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ice/ice_main.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c +index 2de2bbbca1e9..e347030ee2e3 100644 +--- a/drivers/net/ethernet/intel/ice/ice_main.c ++++ b/drivers/net/ethernet/intel/ice/ice_main.c +@@ -6662,12 +6662,15 @@ static void ice_rebuild(struct ice_pf *pf, enum ice_reset_req reset_type) + + dev_dbg(dev, "rebuilding PF after reset_type=%d\n", reset_type); + ++#define ICE_EMP_RESET_SLEEP_MS 5000 + if (reset_type == ICE_RESET_EMPR) { + /* If an EMP reset has occurred, any previously pending flash + * update will have completed. We no longer know whether or + * not the NVM update EMP reset is restricted. + */ + pf->fw_emp_reset_disabled = false; ++ ++ msleep(ICE_EMP_RESET_SLEEP_MS); + } + + err = ice_init_all_ctrlq(hw); +-- +2.35.1 + diff --git a/queue-5.17/iio-dac-ad3552r-fix-an-is_err-vs-null-check.patch b/queue-5.17/iio-dac-ad3552r-fix-an-is_err-vs-null-check.patch new file mode 100644 index 00000000000..1f0c544725c --- /dev/null +++ b/queue-5.17/iio-dac-ad3552r-fix-an-is_err-vs-null-check.patch @@ -0,0 +1,45 @@ +From 8cb966c105b9bf349fc7f0be3d3c0872b8457009 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Apr 2022 14:42:44 +0300 +Subject: iio:dac:ad3552r: Fix an IS_ERR() vs NULL check +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Dan Carpenter + +[ Upstream commit de3b9fe9609a05d3c354c6718ca657962d11d9fe ] + +The fwnode_get_named_child_node() function does not return error +pointers. It returns NULL. Update the check accordingly. + +Fixes: 8f2b54824b28 ("drivers:iio:dac: Add AD3552R driver support") +Signed-off-by: Dan Carpenter +Reviewed-by: Nuno Sá +Link: https://lore.kernel.org/r/20220404114244.GA19201@kili +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/dac/ad3552r.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/iio/dac/ad3552r.c b/drivers/iio/dac/ad3552r.c +index e0a93b27e0e8..d5ea1a1be122 100644 +--- a/drivers/iio/dac/ad3552r.c ++++ b/drivers/iio/dac/ad3552r.c +@@ -809,10 +809,10 @@ static int ad3552r_configure_custom_gain(struct ad3552r_desc *dac, + + gain_child = fwnode_get_named_child_node(child, + "custom-output-range-config"); +- if (IS_ERR(gain_child)) { ++ if (!gain_child) { + dev_err(dev, + "mandatory custom-output-range-config property missing\n"); +- return PTR_ERR(gain_child); ++ return -EINVAL; + } + + dac->ch_data[ch].range_override = 1; +-- +2.35.1 + diff --git a/queue-5.17/iio-dac-ad3552r-fix-signedness-bug-in-ad3552r_reset.patch b/queue-5.17/iio-dac-ad3552r-fix-signedness-bug-in-ad3552r_reset.patch new file mode 100644 index 00000000000..9d52c078939 --- /dev/null +++ b/queue-5.17/iio-dac-ad3552r-fix-signedness-bug-in-ad3552r_reset.patch @@ -0,0 +1,38 @@ +From b5b2203f0863d02cb1d8e2706af1e72537e335f8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Mar 2022 15:23:54 +0300 +Subject: iio: dac: ad3552r: fix signedness bug in ad3552r_reset() + +From: Dan Carpenter + +[ Upstream commit 460bfa65b0de72f4d8a808bc7cfb1cb591a95b18 ] + +The "val" variable is used to store either negative error codes from +ad3552r_read_reg_wrapper() or positive u16 values on success. It needs +to be signed for the error handling to work correctly. + +Fixes: 8f2b54824b28 ("drivers:iio:dac: Add AD3552R driver support") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/20220316122354.GA16825@kili +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/dac/ad3552r.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/iio/dac/ad3552r.c b/drivers/iio/dac/ad3552r.c +index 97f13c0b9631..e0a93b27e0e8 100644 +--- a/drivers/iio/dac/ad3552r.c ++++ b/drivers/iio/dac/ad3552r.c +@@ -656,7 +656,7 @@ static int ad3552r_reset(struct ad3552r_desc *dac) + { + struct reg_addr_pool addr; + int ret; +- u16 val; ++ int val; + + dac->gpio_reset = devm_gpiod_get_optional(&dac->spi->dev, "reset", + GPIOD_OUT_LOW); +-- +2.35.1 + diff --git a/queue-5.17/iio-filter-admv8818-select-regmap_spi-for-admv8818.patch b/queue-5.17/iio-filter-admv8818-select-regmap_spi-for-admv8818.patch new file mode 100644 index 00000000000..9bc82644051 --- /dev/null +++ b/queue-5.17/iio-filter-admv8818-select-regmap_spi-for-admv8818.patch @@ -0,0 +1,42 @@ +From 53544078b2e9e3a5acf003800e5ea762c9ae4599 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 20 Mar 2022 13:54:57 +0800 +Subject: iio:filter:admv8818: select REGMAP_SPI for ADMV8818 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Wang ShaoBo + +[ Upstream commit d85cce86a86746354fffb688dd134609c8277adc ] + +admv8818 driver needs __devm_regmap_init_spi() which is defined +when CONFIG_REGMAP_SPI is set and struct regmap_config when +CONFIG_REGMAP is set, so automatically select CONFIG_REGMAP_SPI +which also sets CONFIG_REGMAP. + +Fixes: f34fe888ad05 ("iio:filter:admv8818: add support for ADMV8818") +Signed-off-by: Wang ShaoBo +Reviewed-by: Nuno Sá +Link: https://lore.kernel.org/r/20220320055457.254983-1-bobo.shaobowang@huawei.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/filter/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/iio/filter/Kconfig b/drivers/iio/filter/Kconfig +index 3ae35817ad82..a85b345ea14e 100644 +--- a/drivers/iio/filter/Kconfig ++++ b/drivers/iio/filter/Kconfig +@@ -8,6 +8,7 @@ menu "Filters" + config ADMV8818 + tristate "Analog Devices ADMV8818 High-Pass and Low-Pass Filter" + depends on SPI && COMMON_CLK && 64BIT ++ select REGMAP_SPI + help + Say yes here to build support for Analog Devices ADMV8818 + 2 GHz to 18 GHz, Digitally Tunable, High-Pass and Low-Pass Filter. +-- +2.35.1 + diff --git a/queue-5.17/iio-imu-bmi160-disable-regulator-in-error-path.patch b/queue-5.17/iio-imu-bmi160-disable-regulator-in-error-path.patch new file mode 100644 index 00000000000..829c488f8f1 --- /dev/null +++ b/queue-5.17/iio-imu-bmi160-disable-regulator-in-error-path.patch @@ -0,0 +1,90 @@ +From 5fb64d0c21853c2ff46b7215f3338703dfc2199b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 27 Mar 2022 08:40:05 -0700 +Subject: iio:imu:bmi160: disable regulator in error path + +From: Tong Zhang + +[ Upstream commit d926054d5565d3cfa2c7c3f7a48e79bcc10453ed ] + +Regulator should be disabled in error path as mentioned in _regulator_put(). +Also disable accel if gyro cannot be enabled. + +[ 16.233604] WARNING: CPU: 0 PID: 2177 at drivers/regulator/core.c:2257 _regulator_put +[ 16.240453] Call Trace: +[ 16.240572] +[ 16.240676] regulator_put+0x26/0x40 +[ 16.240853] regulator_bulk_free+0x26/0x50 +[ 16.241050] release_nodes+0x3f/0x70 +[ 16.241225] devres_release_group+0x147/0x1c0 +[ 16.241441] ? bmi160_core_probe+0x175/0x3a0 [bmi160_core] + +Fixes: 5dea3fb066f0 ("iio: imu: bmi160: added regulator support") +Reviewed-by: Andy Shevchenko +Signed-off-by: Tong Zhang +Link: https://lore.kernel.org/r/20220327154005.806049-1-ztong0001@gmail.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/imu/bmi160/bmi160_core.c | 20 ++++++++++++++------ + 1 file changed, 14 insertions(+), 6 deletions(-) + +diff --git a/drivers/iio/imu/bmi160/bmi160_core.c b/drivers/iio/imu/bmi160/bmi160_core.c +index 824b5124a5f5..01336105792e 100644 +--- a/drivers/iio/imu/bmi160/bmi160_core.c ++++ b/drivers/iio/imu/bmi160/bmi160_core.c +@@ -730,7 +730,7 @@ static int bmi160_chip_init(struct bmi160_data *data, bool use_spi) + + ret = regmap_write(data->regmap, BMI160_REG_CMD, BMI160_CMD_SOFTRESET); + if (ret) +- return ret; ++ goto disable_regulator; + + usleep_range(BMI160_SOFTRESET_USLEEP, BMI160_SOFTRESET_USLEEP + 1); + +@@ -741,29 +741,37 @@ static int bmi160_chip_init(struct bmi160_data *data, bool use_spi) + if (use_spi) { + ret = regmap_read(data->regmap, BMI160_REG_DUMMY, &val); + if (ret) +- return ret; ++ goto disable_regulator; + } + + ret = regmap_read(data->regmap, BMI160_REG_CHIP_ID, &val); + if (ret) { + dev_err(dev, "Error reading chip id\n"); +- return ret; ++ goto disable_regulator; + } + if (val != BMI160_CHIP_ID_VAL) { + dev_err(dev, "Wrong chip id, got %x expected %x\n", + val, BMI160_CHIP_ID_VAL); +- return -ENODEV; ++ ret = -ENODEV; ++ goto disable_regulator; + } + + ret = bmi160_set_mode(data, BMI160_ACCEL, true); + if (ret) +- return ret; ++ goto disable_regulator; + + ret = bmi160_set_mode(data, BMI160_GYRO, true); + if (ret) +- return ret; ++ goto disable_accel; + + return 0; ++ ++disable_accel: ++ bmi160_set_mode(data, BMI160_ACCEL, false); ++ ++disable_regulator: ++ regulator_bulk_disable(ARRAY_SIZE(data->supplies), data->supplies); ++ return ret; + } + + static int bmi160_data_rdy_trigger_set_state(struct iio_trigger *trig, +-- +2.35.1 + diff --git a/queue-5.17/input-cypress-sf-register-a-callback-to-disable-the-.patch b/queue-5.17/input-cypress-sf-register-a-callback-to-disable-the-.patch new file mode 100644 index 00000000000..bc36222e6ad --- /dev/null +++ b/queue-5.17/input-cypress-sf-register-a-callback-to-disable-the-.patch @@ -0,0 +1,66 @@ +From 0e511148b9769fb6c851c15df13b2afa27ab73ef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Apr 2022 19:30:49 -0700 +Subject: Input: cypress-sf - register a callback to disable the regulators + +From: Zheyu Ma + +[ Upstream commit fd0a4b39870d49ff15f6966470185409e261f20f ] + +When the driver fails to probe, we will get the following splat: + +[ 19.311970] ------------[ cut here ]------------ +[ 19.312566] WARNING: CPU: 3 PID: 375 at drivers/regulator/core.c:2257 _regulator_put+0x3ec/0x4e0 +[ 19.317591] RIP: 0010:_regulator_put+0x3ec/0x4e0 +[ 19.328831] Call Trace: +[ 19.329112] +[ 19.329369] regulator_bulk_free+0x82/0xe0 +[ 19.329860] devres_release_group+0x319/0x3d0 +[ 19.330357] i2c_device_probe+0x766/0x940 + +Fix this by adding a callback that will deal with the disabling when the +driver fails to probe. + +Signed-off-by: Zheyu Ma +Link: https://lore.kernel.org/r/20220409022629.3493557-1-zheyuma97@gmail.com +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/keyboard/cypress-sf.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +diff --git a/drivers/input/keyboard/cypress-sf.c b/drivers/input/keyboard/cypress-sf.c +index c28996028e80..9a23eed6a4f4 100644 +--- a/drivers/input/keyboard/cypress-sf.c ++++ b/drivers/input/keyboard/cypress-sf.c +@@ -61,6 +61,14 @@ static irqreturn_t cypress_sf_irq_handler(int irq, void *devid) + return IRQ_HANDLED; + } + ++static void cypress_sf_disable_regulators(void *arg) ++{ ++ struct cypress_sf_data *touchkey = arg; ++ ++ regulator_bulk_disable(ARRAY_SIZE(touchkey->regulators), ++ touchkey->regulators); ++} ++ + static int cypress_sf_probe(struct i2c_client *client) + { + struct cypress_sf_data *touchkey; +@@ -121,6 +129,12 @@ static int cypress_sf_probe(struct i2c_client *client) + return error; + } + ++ error = devm_add_action_or_reset(&client->dev, ++ cypress_sf_disable_regulators, ++ touchkey); ++ if (error) ++ return error; ++ + touchkey->input_dev = devm_input_allocate_device(&client->dev); + if (!touchkey->input_dev) { + dev_err(&client->dev, "Failed to allocate input device\n"); +-- +2.35.1 + diff --git a/queue-5.17/interconnect-qcom-sc7180-drop-ip0-interconnects.patch b/queue-5.17/interconnect-qcom-sc7180-drop-ip0-interconnects.patch new file mode 100644 index 00000000000..2cc60531f8b --- /dev/null +++ b/queue-5.17/interconnect-qcom-sc7180-drop-ip0-interconnects.patch @@ -0,0 +1,164 @@ +From 3c4b0995ef7d22f579e8fa44c9b07e171a2b1d6c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Apr 2022 15:00:32 -0700 +Subject: interconnect: qcom: sc7180: Drop IP0 interconnects + +From: Stephen Boyd + +[ Upstream commit 2f3724930eb4bba74f7d10bc3bef5bb22dd323df ] + +The IPA BCM resource ("IP0") on sc7180 was moved to the clk-rpmh driver +in commit bcd63d222b60 ("clk: qcom: rpmh: Add IPA clock for SC7180") and +modeled as a clk, but this interconnect driver still had it modeled as +an interconnect. This was mostly OK because nobody used the interconnect +definition, until the interconnect framework started dropping bandwidth +requests on interconnects that aren't used via the sync_state callback +in commit 7d3b0b0d8184 ("interconnect: qcom: Use icc_sync_state"). Once +that patch was applied the IP0 resource was going to be controlled from +two places, the clk framework and the interconnect framework. + +Even then, things were probably going to be OK, because commit +b95b668eaaa2 ("interconnect: qcom: icc-rpmh: Add BCMs to commit list in +pre_aggregate") was needed to actually drop bandwidth requests on unused +interconnects, of which the IPA was one of the interconnect that wasn't +getting dropped to zero. Combining the three commits together leads to +bad behavior where the interconnect framework is disabling the IP0 +resource because it has no users while the clk framework thinks the IP0 +resource is on because the only user, the IPA driver, has turned it on +via clk_prepare_enable(). Depending on when sync_state is called, we can +get into a situation like below: + + IPA driver probes + IPA driver gets notified modem started + runtime PM get() + IPA clk enabled -> IP0 resource is ON + sync_state runs + interconnect zeroes out the IP0 resource -> IP0 resource is off + IPA driver tries to access a register and blows up + +The crash is an unclocked access that manifest as an SError. + + SError Interrupt on CPU0, code 0xbe000011 -- SError + CPU: 0 PID: 3595 Comm: mmdata_mgr Not tainted 5.17.1+ #166 + Hardware name: Google Lazor (rev1 - 2) with LTE (DT) + pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) + pc : mutex_lock+0x4c/0x80 + lr : mutex_lock+0x30/0x80 + sp : ffffffc00da9b9c0 + x29: ffffffc00da9b9c0 x28: 0000000000000000 x27: 0000000000000000 + x26: ffffffc00da9bc90 x25: ffffff80c2024010 x24: ffffff80c2024000 + x23: ffffff8083100000 x22: ffffff80831000d0 x21: ffffff80831000a8 + x20: ffffff80831000a8 x19: ffffff8083100070 x18: 00000000ffff0a00 + x17: 000000002f7254f1 x16: 0000000000000100 x15: 0000000000000000 + x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 + x11: 000000000001f0b8 x10: ffffffc00931f0b8 x9 : 0000000000000000 + x8 : 0000000000000000 x7 : fefefefefeff2f60 x6 : 0000808080808080 + x5 : 0000000000000000 x4 : 8080808080800000 x3 : ffffff80d2d4ee28 + x2 : ffffff808c1d6e40 x1 : 0000000000000000 x0 : ffffff8083100070 + Kernel panic - not syncing: Asynchronous SError Interrupt + CPU: 0 PID: 3595 Comm: mmdata_mgr Not tainted 5.17.1+ #166 + Hardware name: Google Lazor (rev1 - 2) with LTE (DT) + Call trace: + dump_backtrace+0xf4/0x114 + show_stack+0x24/0x30 + dump_stack_lvl+0x64/0x7c + dump_stack+0x18/0x38 + panic+0x150/0x38c + nmi_panic+0x88/0xa0 + arm64_serror_panic+0x74/0x80 + do_serror+0x0/0x80 + do_serror+0x58/0x80 + el1h_64_error_handler+0x34/0x4c + el1h_64_error+0x78/0x7c + mutex_lock+0x4c/0x80 + __gsi_channel_start+0x50/0x17c + gsi_channel_start+0x54/0x90 + ipa_endpoint_enable_one+0x34/0xc0 + ipa_open+0x4c/0x120 + +Remove all IP0 resource management from the interconnect driver so that +clk-rpmh is the sole owner. This fixes the issue by preventing the +interconnect driver from overwriting the IP0 resource data that the +clk-rpmh driver wrote. + +Cc: Alex Elder +Cc: Bjorn Andersson +Cc: Taniya Das +Cc: Mike Tipton +Fixes: b95b668eaaa2 ("interconnect: qcom: icc-rpmh: Add BCMs to commit list in pre_aggregate") +Fixes: bcd63d222b60 ("clk: qcom: rpmh: Add IPA clock for SC7180") +Fixes: 7d3b0b0d8184 ("interconnect: qcom: Use icc_sync_state") +Signed-off-by: Stephen Boyd +Tested-by: Alex Elder +Reviewed-by: Alex Elder +Reviewed-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20220412220033.1273607-2-swboyd@chromium.org +Signed-off-by: Georgi Djakov +Signed-off-by: Sasha Levin +--- + drivers/interconnect/qcom/sc7180.c | 21 --------------------- + 1 file changed, 21 deletions(-) + +diff --git a/drivers/interconnect/qcom/sc7180.c b/drivers/interconnect/qcom/sc7180.c +index 12d59c36df53..5f7c0f85fa8e 100644 +--- a/drivers/interconnect/qcom/sc7180.c ++++ b/drivers/interconnect/qcom/sc7180.c +@@ -47,7 +47,6 @@ DEFINE_QNODE(qnm_mnoc_sf, SC7180_MASTER_MNOC_SF_MEM_NOC, 1, 32, SC7180_SLAVE_GEM + DEFINE_QNODE(qnm_snoc_gc, SC7180_MASTER_SNOC_GC_MEM_NOC, 1, 8, SC7180_SLAVE_LLCC); + DEFINE_QNODE(qnm_snoc_sf, SC7180_MASTER_SNOC_SF_MEM_NOC, 1, 16, SC7180_SLAVE_LLCC); + DEFINE_QNODE(qxm_gpu, SC7180_MASTER_GFX3D, 2, 32, SC7180_SLAVE_GEM_NOC_SNOC, SC7180_SLAVE_LLCC); +-DEFINE_QNODE(ipa_core_master, SC7180_MASTER_IPA_CORE, 1, 8, SC7180_SLAVE_IPA_CORE); + DEFINE_QNODE(llcc_mc, SC7180_MASTER_LLCC, 2, 4, SC7180_SLAVE_EBI1); + DEFINE_QNODE(qhm_mnoc_cfg, SC7180_MASTER_CNOC_MNOC_CFG, 1, 4, SC7180_SLAVE_SERVICE_MNOC); + DEFINE_QNODE(qxm_camnoc_hf0, SC7180_MASTER_CAMNOC_HF0, 2, 32, SC7180_SLAVE_MNOC_HF_MEM_NOC); +@@ -129,7 +128,6 @@ DEFINE_QNODE(qhs_mdsp_ms_mpu_cfg, SC7180_SLAVE_MSS_PROC_MS_MPU_CFG, 1, 4); + DEFINE_QNODE(qns_gem_noc_snoc, SC7180_SLAVE_GEM_NOC_SNOC, 1, 8, SC7180_MASTER_GEM_NOC_SNOC); + DEFINE_QNODE(qns_llcc, SC7180_SLAVE_LLCC, 1, 16, SC7180_MASTER_LLCC); + DEFINE_QNODE(srvc_gemnoc, SC7180_SLAVE_SERVICE_GEM_NOC, 1, 4); +-DEFINE_QNODE(ipa_core_slave, SC7180_SLAVE_IPA_CORE, 1, 8); + DEFINE_QNODE(ebi, SC7180_SLAVE_EBI1, 2, 4); + DEFINE_QNODE(qns_mem_noc_hf, SC7180_SLAVE_MNOC_HF_MEM_NOC, 1, 32, SC7180_MASTER_MNOC_HF_MEM_NOC); + DEFINE_QNODE(qns_mem_noc_sf, SC7180_SLAVE_MNOC_SF_MEM_NOC, 1, 32, SC7180_MASTER_MNOC_SF_MEM_NOC); +@@ -160,7 +158,6 @@ DEFINE_QBCM(bcm_mc0, "MC0", true, &ebi); + DEFINE_QBCM(bcm_sh0, "SH0", true, &qns_llcc); + DEFINE_QBCM(bcm_mm0, "MM0", false, &qns_mem_noc_hf); + DEFINE_QBCM(bcm_ce0, "CE0", false, &qxm_crypto); +-DEFINE_QBCM(bcm_ip0, "IP0", false, &ipa_core_slave); + DEFINE_QBCM(bcm_cn0, "CN0", true, &qnm_snoc, &xm_qdss_dap, &qhs_a1_noc_cfg, &qhs_a2_noc_cfg, &qhs_ahb2phy0, &qhs_aop, &qhs_aoss, &qhs_boot_rom, &qhs_camera_cfg, &qhs_camera_nrt_throttle_cfg, &qhs_camera_rt_throttle_cfg, &qhs_clk_ctl, &qhs_cpr_cx, &qhs_cpr_mx, &qhs_crypto0_cfg, &qhs_dcc_cfg, &qhs_ddrss_cfg, &qhs_display_cfg, &qhs_display_rt_throttle_cfg, &qhs_display_throttle_cfg, &qhs_glm, &qhs_gpuss_cfg, &qhs_imem_cfg, &qhs_ipa, &qhs_mnoc_cfg, &qhs_mss_cfg, &qhs_npu_cfg, &qhs_npu_dma_throttle_cfg, &qhs_npu_dsp_throttle_cfg, &qhs_pimem_cfg, &qhs_prng, &qhs_qdss_cfg, &qhs_qm_cfg, &qhs_qm_mpu_cfg, &qhs_qup0, &qhs_qup1, &qhs_security, &qhs_snoc_cfg, &qhs_tcsr, &qhs_tlmm_1, &qhs_tlmm_2, &qhs_tlmm_3, &qhs_ufs_mem_cfg, &qhs_usb3, &qhs_venus_cfg, &qhs_venus_throttle_cfg, &qhs_vsense_ctrl_cfg, &srvc_cnoc); + DEFINE_QBCM(bcm_mm1, "MM1", false, &qxm_camnoc_hf0_uncomp, &qxm_camnoc_hf1_uncomp, &qxm_camnoc_sf_uncomp, &qhm_mnoc_cfg, &qxm_mdp0, &qxm_rot, &qxm_venus0, &qxm_venus_arm9); + DEFINE_QBCM(bcm_sh2, "SH2", false, &acm_sys_tcu); +@@ -372,22 +369,6 @@ static struct qcom_icc_desc sc7180_gem_noc = { + .num_bcms = ARRAY_SIZE(gem_noc_bcms), + }; + +-static struct qcom_icc_bcm *ipa_virt_bcms[] = { +- &bcm_ip0, +-}; +- +-static struct qcom_icc_node *ipa_virt_nodes[] = { +- [MASTER_IPA_CORE] = &ipa_core_master, +- [SLAVE_IPA_CORE] = &ipa_core_slave, +-}; +- +-static struct qcom_icc_desc sc7180_ipa_virt = { +- .nodes = ipa_virt_nodes, +- .num_nodes = ARRAY_SIZE(ipa_virt_nodes), +- .bcms = ipa_virt_bcms, +- .num_bcms = ARRAY_SIZE(ipa_virt_bcms), +-}; +- + static struct qcom_icc_bcm *mc_virt_bcms[] = { + &bcm_acv, + &bcm_mc0, +@@ -519,8 +500,6 @@ static const struct of_device_id qnoc_of_match[] = { + .data = &sc7180_dc_noc}, + { .compatible = "qcom,sc7180-gem-noc", + .data = &sc7180_gem_noc}, +- { .compatible = "qcom,sc7180-ipa-virt", +- .data = &sc7180_ipa_virt}, + { .compatible = "qcom,sc7180-mc-virt", + .data = &sc7180_mc_virt}, + { .compatible = "qcom,sc7180-mmss-noc", +-- +2.35.1 + diff --git a/queue-5.17/interconnect-qcom-sdx55-drop-ip0-interconnects.patch b/queue-5.17/interconnect-qcom-sdx55-drop-ip0-interconnects.patch new file mode 100644 index 00000000000..2af5c24e333 --- /dev/null +++ b/queue-5.17/interconnect-qcom-sdx55-drop-ip0-interconnects.patch @@ -0,0 +1,97 @@ +From 19f4e24786dfbe605589b80dae04c6a00deb3f70 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Apr 2022 15:00:33 -0700 +Subject: interconnect: qcom: sdx55: Drop IP0 interconnects + +From: Stephen Boyd + +[ Upstream commit 2fb251c265608636fc961b7d38e1a03937e57371 ] + +Similar to the sc7180 commit, let's drop the IP0 interconnects here +because the IP0 resource is also used in the clk-rpmh driver on sdx55. +It's bad to have the clk framework and interconnect framework control +the same RPMh resource without any coordination. The rpmh driver in the +kernel doesn't aggregate resources between clients either, so leaving +control to clk-rpmh avoids any issues with unused interconnects turning +off IP0 behind the back of the clk framework. + +Cc: Alex Elder +Cc: Manivannan Sadhasivam +Cc: Bjorn Andersson +Cc: Taniya Das +Cc: Mike Tipton +Fixes: b2150cab9a97 ("clk: qcom: rpmh: add support for SDX55 rpmh IPA clock") +Signed-off-by: Stephen Boyd +Reviewed-by: Alex Elder +Acked-by: Manivannan Sadhasivam +Reviewed-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20220412220033.1273607-3-swboyd@chromium.org +Signed-off-by: Georgi Djakov +Signed-off-by: Sasha Levin +--- + drivers/interconnect/qcom/sdx55.c | 21 --------------------- + 1 file changed, 21 deletions(-) + +diff --git a/drivers/interconnect/qcom/sdx55.c b/drivers/interconnect/qcom/sdx55.c +index 03d604f84cc5..e3ac25a997b7 100644 +--- a/drivers/interconnect/qcom/sdx55.c ++++ b/drivers/interconnect/qcom/sdx55.c +@@ -18,7 +18,6 @@ + #include "icc-rpmh.h" + #include "sdx55.h" + +-DEFINE_QNODE(ipa_core_master, SDX55_MASTER_IPA_CORE, 1, 8, SDX55_SLAVE_IPA_CORE); + DEFINE_QNODE(llcc_mc, SDX55_MASTER_LLCC, 4, 4, SDX55_SLAVE_EBI_CH0); + DEFINE_QNODE(acm_tcu, SDX55_MASTER_TCU_0, 1, 8, SDX55_SLAVE_LLCC, SDX55_SLAVE_MEM_NOC_SNOC, SDX55_SLAVE_MEM_NOC_PCIE_SNOC); + DEFINE_QNODE(qnm_snoc_gc, SDX55_MASTER_SNOC_GC_MEM_NOC, 1, 8, SDX55_SLAVE_LLCC); +@@ -40,7 +39,6 @@ DEFINE_QNODE(xm_pcie, SDX55_MASTER_PCIE, 1, 8, SDX55_SLAVE_ANOC_SNOC); + DEFINE_QNODE(xm_qdss_etr, SDX55_MASTER_QDSS_ETR, 1, 8, SDX55_SLAVE_SNOC_CFG, SDX55_SLAVE_EMAC_CFG, SDX55_SLAVE_USB3, SDX55_SLAVE_AOSS, SDX55_SLAVE_SPMI_FETCHER, SDX55_SLAVE_QDSS_CFG, SDX55_SLAVE_PDM, SDX55_SLAVE_SNOC_MEM_NOC_GC, SDX55_SLAVE_TCSR, SDX55_SLAVE_CNOC_DDRSS, SDX55_SLAVE_SPMI_VGI_COEX, SDX55_SLAVE_QPIC, SDX55_SLAVE_OCIMEM, SDX55_SLAVE_IPA_CFG, SDX55_SLAVE_USB3_PHY_CFG, SDX55_SLAVE_AOP, SDX55_SLAVE_BLSP_1, SDX55_SLAVE_SDCC_1, SDX55_SLAVE_CNOC_MSS, SDX55_SLAVE_PCIE_PARF, SDX55_SLAVE_ECC_CFG, SDX55_SLAVE_AUDIO, SDX55_SLAVE_AOSS, SDX55_SLAVE_PRNG, SDX55_SLAVE_CRYPTO_0_CFG, SDX55_SLAVE_TCU, SDX55_SLAVE_CLK_CTL, SDX55_SLAVE_IMEM_CFG); + DEFINE_QNODE(xm_sdc1, SDX55_MASTER_SDCC_1, 1, 8, SDX55_SLAVE_AOSS, SDX55_SLAVE_IPA_CFG, SDX55_SLAVE_ANOC_SNOC, SDX55_SLAVE_AOP, SDX55_SLAVE_AUDIO); + DEFINE_QNODE(xm_usb3, SDX55_MASTER_USB3, 1, 8, SDX55_SLAVE_ANOC_SNOC); +-DEFINE_QNODE(ipa_core_slave, SDX55_SLAVE_IPA_CORE, 1, 8); + DEFINE_QNODE(ebi, SDX55_SLAVE_EBI_CH0, 1, 4); + DEFINE_QNODE(qns_llcc, SDX55_SLAVE_LLCC, 1, 16, SDX55_SLAVE_EBI_CH0); + DEFINE_QNODE(qns_memnoc_snoc, SDX55_SLAVE_MEM_NOC_SNOC, 1, 8, SDX55_MASTER_MEM_NOC_SNOC); +@@ -82,7 +80,6 @@ DEFINE_QNODE(xs_sys_tcu_cfg, SDX55_SLAVE_TCU, 1, 8); + DEFINE_QBCM(bcm_mc0, "MC0", true, &ebi); + DEFINE_QBCM(bcm_sh0, "SH0", true, &qns_llcc); + DEFINE_QBCM(bcm_ce0, "CE0", false, &qxm_crypto); +-DEFINE_QBCM(bcm_ip0, "IP0", false, &ipa_core_slave); + DEFINE_QBCM(bcm_pn0, "PN0", false, &qhm_snoc_cfg); + DEFINE_QBCM(bcm_sh3, "SH3", false, &xm_apps_rdwr); + DEFINE_QBCM(bcm_sh4, "SH4", false, &qns_memnoc_snoc, &qns_sys_pcie); +@@ -219,22 +216,6 @@ static const struct qcom_icc_desc sdx55_system_noc = { + .num_bcms = ARRAY_SIZE(system_noc_bcms), + }; + +-static struct qcom_icc_bcm *ipa_virt_bcms[] = { +- &bcm_ip0, +-}; +- +-static struct qcom_icc_node *ipa_virt_nodes[] = { +- [MASTER_IPA_CORE] = &ipa_core_master, +- [SLAVE_IPA_CORE] = &ipa_core_slave, +-}; +- +-static const struct qcom_icc_desc sdx55_ipa_virt = { +- .nodes = ipa_virt_nodes, +- .num_nodes = ARRAY_SIZE(ipa_virt_nodes), +- .bcms = ipa_virt_bcms, +- .num_bcms = ARRAY_SIZE(ipa_virt_bcms), +-}; +- + static const struct of_device_id qnoc_of_match[] = { + { .compatible = "qcom,sdx55-mc-virt", + .data = &sdx55_mc_virt}, +@@ -242,8 +223,6 @@ static const struct of_device_id qnoc_of_match[] = { + .data = &sdx55_mem_noc}, + { .compatible = "qcom,sdx55-system-noc", + .data = &sdx55_system_noc}, +- { .compatible = "qcom,sdx55-ipa-virt", +- .data = &sdx55_ipa_virt}, + { } + }; + MODULE_DEVICE_TABLE(of, qnoc_of_match); +-- +2.35.1 + diff --git a/queue-5.17/io_uring-check-reserved-fields-for-recv-recvmsg.patch b/queue-5.17/io_uring-check-reserved-fields-for-recv-recvmsg.patch new file mode 100644 index 00000000000..4a80cc3db1e --- /dev/null +++ b/queue-5.17/io_uring-check-reserved-fields-for-recv-recvmsg.patch @@ -0,0 +1,35 @@ +From a040176a770ed7dc68e37d22ef3f14f9ba22efad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Apr 2022 19:34:57 -0600 +Subject: io_uring: check reserved fields for recv/recvmsg + +From: Jens Axboe + +[ Upstream commit 5a1e99b61b0c81388cde0c808b3e4173907df19f ] + +We should check unused fields for non-zero and -EINVAL if they are set, +making it consistent with other opcodes. + +Fixes: aa1fa28fc73e ("io_uring: add support for recvmsg()") +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + fs/io_uring.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/fs/io_uring.c b/fs/io_uring.c +index 107bce75131e..531d0086d0b3 100644 +--- a/fs/io_uring.c ++++ b/fs/io_uring.c +@@ -5103,6 +5103,8 @@ static int io_recvmsg_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe) + + if (unlikely(req->ctx->flags & IORING_SETUP_IOPOLL)) + return -EINVAL; ++ if (unlikely(sqe->addr2 || sqe->file_index)) ++ return -EINVAL; + + sr->umsg = u64_to_user_ptr(READ_ONCE(sqe->addr)); + sr->len = READ_ONCE(sqe->len); +-- +2.35.1 + diff --git a/queue-5.17/io_uring-check-reserved-fields-for-send-sendmsg.patch b/queue-5.17/io_uring-check-reserved-fields-for-send-sendmsg.patch new file mode 100644 index 00000000000..8a54718301c --- /dev/null +++ b/queue-5.17/io_uring-check-reserved-fields-for-send-sendmsg.patch @@ -0,0 +1,35 @@ +From ee2e54a5b09c2666b906919c5b651421d8375119 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Apr 2022 19:34:11 -0600 +Subject: io_uring: check reserved fields for send/sendmsg + +From: Jens Axboe + +[ Upstream commit 588faa1ea5eecb351100ee5d187b9be99210f70d ] + +We should check unused fields for non-zero and -EINVAL if they are set, +making it consistent with other opcodes. + +Fixes: 0fa03c624d8f ("io_uring: add support for sendmsg()") +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + fs/io_uring.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/fs/io_uring.c b/fs/io_uring.c +index fbba8342172a..107bce75131e 100644 +--- a/fs/io_uring.c ++++ b/fs/io_uring.c +@@ -4890,6 +4890,8 @@ static int io_sendmsg_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe) + + if (unlikely(req->ctx->flags & IORING_SETUP_IOPOLL)) + return -EINVAL; ++ if (unlikely(sqe->addr2 || sqe->file_index)) ++ return -EINVAL; + + sr->umsg = u64_to_user_ptr(READ_ONCE(sqe->addr)); + sr->len = READ_ONCE(sqe->len); +-- +2.35.1 + diff --git a/queue-5.17/io_uring-fix-uninitialized-field-in-rw-io_kiocb.patch b/queue-5.17/io_uring-fix-uninitialized-field-in-rw-io_kiocb.patch new file mode 100644 index 00000000000..e587ba3ceb6 --- /dev/null +++ b/queue-5.17/io_uring-fix-uninitialized-field-in-rw-io_kiocb.patch @@ -0,0 +1,35 @@ +From 7796dfc8534b6ea120d9c907b71015c1d4cfcd81 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Apr 2022 12:57:52 -0400 +Subject: io_uring: fix uninitialized field in rw io_kiocb + +From: Joseph Ravichandran + +[ Upstream commit 32452a3eb8b64e01e2be717f518c0be046975b9d ] + +io_rw_init_file does not initialize kiocb->private, so when iocb_bio_iopoll +reads kiocb->private it can contain uninitialized data. + +Fixes: 3e08773c3841 ("block: switch polling to be bio based") +Signed-off-by: Joseph Ravichandran +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + fs/io_uring.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/io_uring.c b/fs/io_uring.c +index 531d0086d0b3..87df37912055 100644 +--- a/fs/io_uring.c ++++ b/fs/io_uring.c +@@ -3584,6 +3584,7 @@ static int io_rw_init_file(struct io_kiocb *req, fmode_t mode) + if (!(kiocb->ki_flags & IOCB_DIRECT) || !file->f_op->iopoll) + return -EOPNOTSUPP; + ++ kiocb->private = NULL; + kiocb->ki_flags |= IOCB_HIPRI | IOCB_ALLOC_CACHE; + kiocb->ki_complete = io_complete_rw_iopoll; + req->iopoll_completed = 0; +-- +2.35.1 + diff --git a/queue-5.17/ip6_gre-make-o_seqno-start-from-0-in-native-mode.patch b/queue-5.17/ip6_gre-make-o_seqno-start-from-0-in-native-mode.patch new file mode 100644 index 00000000000..28a0720645b --- /dev/null +++ b/queue-5.17/ip6_gre-make-o_seqno-start-from-0-in-native-mode.patch @@ -0,0 +1,70 @@ +From 9513fc97f4ec1b14ddc1c61ea41ee307b78d3997 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Apr 2022 15:08:38 -0700 +Subject: ip6_gre: Make o_seqno start from 0 in native mode + +From: Peilin Ye + +[ Upstream commit fde98ae91f79cab4e020f40c35ed23cbdc59661c ] + +For IP6GRE and IP6GRETAP devices, currently o_seqno starts from 1 in +native mode. According to RFC 2890 2.2., "The first datagram is sent +with a sequence number of 0." Fix it. + +It is worth mentioning that o_seqno already starts from 0 in collect_md +mode, see the "if (tunnel->parms.collect_md)" clause in __gre6_xmit(), +where tunnel->o_seqno is passed to gre_build_header() before getting +incremented. + +Fixes: c12b395a4664 ("gre: Support GRE over IPv6") +Signed-off-by: Peilin Ye +Acked-by: William Tu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv6/ip6_gre.c | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c +index 976236736146..d9e4ac94eab4 100644 +--- a/net/ipv6/ip6_gre.c ++++ b/net/ipv6/ip6_gre.c +@@ -724,6 +724,7 @@ static netdev_tx_t __gre6_xmit(struct sk_buff *skb, + { + struct ip6_tnl *tunnel = netdev_priv(dev); + __be16 protocol; ++ __be16 flags; + + if (dev->type == ARPHRD_ETHER) + IPCB(skb)->flags = 0; +@@ -739,7 +740,6 @@ static netdev_tx_t __gre6_xmit(struct sk_buff *skb, + if (tunnel->parms.collect_md) { + struct ip_tunnel_info *tun_info; + const struct ip_tunnel_key *key; +- __be16 flags; + int tun_hlen; + + tun_info = skb_tunnel_info_txcheck(skb); +@@ -770,15 +770,14 @@ static netdev_tx_t __gre6_xmit(struct sk_buff *skb, + : 0); + + } else { +- if (tunnel->parms.o_flags & TUNNEL_SEQ) +- tunnel->o_seqno++; +- + if (skb_cow_head(skb, dev->needed_headroom ?: tunnel->hlen)) + return -ENOMEM; + +- gre_build_header(skb, tunnel->tun_hlen, tunnel->parms.o_flags, ++ flags = tunnel->parms.o_flags; ++ ++ gre_build_header(skb, tunnel->tun_hlen, flags, + protocol, tunnel->parms.o_key, +- htonl(tunnel->o_seqno)); ++ (flags & TUNNEL_SEQ) ? htonl(tunnel->o_seqno++) : 0); + } + + return ip6_tnl_xmit(skb, dev, dsfield, fl6, encap_limit, pmtu, +-- +2.35.1 + diff --git a/queue-5.17/ip_gre-ip6_gre-fix-race-condition-on-o_seqno-in-coll.patch b/queue-5.17/ip_gre-ip6_gre-fix-race-condition-on-o_seqno-in-coll.patch new file mode 100644 index 00000000000..d58042ab579 --- /dev/null +++ b/queue-5.17/ip_gre-ip6_gre-fix-race-condition-on-o_seqno-in-coll.patch @@ -0,0 +1,152 @@ +From e48b349268419269c7a5fb918f6d90618118e6d1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Apr 2022 15:09:02 -0700 +Subject: ip_gre, ip6_gre: Fix race condition on o_seqno in collect_md mode + +From: Peilin Ye + +[ Upstream commit 31c417c948d7f6909cb63f0ac3298f3c38f8ce20 ] + +As pointed out by Jakub Kicinski, currently using TUNNEL_SEQ in +collect_md mode is racy for [IP6]GRE[TAP] devices. Consider the +following sequence of events: + +1. An [IP6]GRE[TAP] device is created in collect_md mode using "ip link + add ... external". "ip" ignores "[o]seq" if "external" is specified, + so TUNNEL_SEQ is off, and the device is marked as NETIF_F_LLTX (i.e. + it uses lockless TX); +2. Someone sets TUNNEL_SEQ on outgoing skb's, using e.g. + bpf_skb_set_tunnel_key() in an eBPF program attached to this device; +3. gre_fb_xmit() or __gre6_xmit() processes these skb's: + + gre_build_header(skb, tun_hlen, + flags, protocol, + tunnel_id_to_key32(tun_info->key.tun_id), + (flags & TUNNEL_SEQ) ? htonl(tunnel->o_seqno++) + : 0); ^^^^^^^^^^^^^^^^^ + +Since we are not using the TX lock (&txq->_xmit_lock), multiple CPUs may +try to do this tunnel->o_seqno++ in parallel, which is racy. Fix it by +making o_seqno atomic_t. + +As mentioned by Eric Dumazet in commit b790e01aee74 ("ip_gre: lockless +xmit"), making o_seqno atomic_t increases "chance for packets being out +of order at receiver" when NETIF_F_LLTX is on. + +Maybe a better fix would be: + +1. Do not ignore "oseq" in external mode. Users MUST specify "oseq" if + they want the kernel to allow sequencing of outgoing packets; +2. Reject all outgoing TUNNEL_SEQ packets if the device was not created + with "oseq". + +Unfortunately, that would break userspace. + +We could now make [IP6]GRE[TAP] devices always NETIF_F_LLTX, but let us +do it in separate patches to keep this fix minimal. + +Suggested-by: Jakub Kicinski +Fixes: 77a5196a804e ("gre: add sequence number for collect md mode.") +Signed-off-by: Peilin Ye +Acked-by: William Tu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/net/ip6_tunnel.h | 2 +- + include/net/ip_tunnels.h | 2 +- + net/ipv4/ip_gre.c | 6 +++--- + net/ipv6/ip6_gre.c | 7 ++++--- + 4 files changed, 9 insertions(+), 8 deletions(-) + +diff --git a/include/net/ip6_tunnel.h b/include/net/ip6_tunnel.h +index a38c4f1e4e5c..74b369bddf49 100644 +--- a/include/net/ip6_tunnel.h ++++ b/include/net/ip6_tunnel.h +@@ -58,7 +58,7 @@ struct ip6_tnl { + + /* These fields used only by GRE */ + __u32 i_seqno; /* The last seen seqno */ +- __u32 o_seqno; /* The last output seqno */ ++ atomic_t o_seqno; /* The last output seqno */ + int hlen; /* tun_hlen + encap_hlen */ + int tun_hlen; /* Precalculated header length */ + int encap_hlen; /* Encap header length (FOU,GUE) */ +diff --git a/include/net/ip_tunnels.h b/include/net/ip_tunnels.h +index 0219fe907b26..3ec6146f8734 100644 +--- a/include/net/ip_tunnels.h ++++ b/include/net/ip_tunnels.h +@@ -116,7 +116,7 @@ struct ip_tunnel { + + /* These four fields used only by GRE */ + u32 i_seqno; /* The last seen seqno */ +- u32 o_seqno; /* The last output seqno */ ++ atomic_t o_seqno; /* The last output seqno */ + int tun_hlen; /* Precalculated header length */ + + /* These four fields used only by ERSPAN */ +diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c +index ca70b92e80d9..8cf86e42c1d1 100644 +--- a/net/ipv4/ip_gre.c ++++ b/net/ipv4/ip_gre.c +@@ -464,7 +464,7 @@ static void __gre_xmit(struct sk_buff *skb, struct net_device *dev, + /* Push GRE header. */ + gre_build_header(skb, tunnel->tun_hlen, + flags, proto, tunnel->parms.o_key, +- (flags & TUNNEL_SEQ) ? htonl(tunnel->o_seqno++) : 0); ++ (flags & TUNNEL_SEQ) ? htonl(atomic_fetch_inc(&tunnel->o_seqno)) : 0); + + ip_tunnel_xmit(skb, dev, tnl_params, tnl_params->protocol); + } +@@ -502,7 +502,7 @@ static void gre_fb_xmit(struct sk_buff *skb, struct net_device *dev, + (TUNNEL_CSUM | TUNNEL_KEY | TUNNEL_SEQ); + gre_build_header(skb, tunnel_hlen, flags, proto, + tunnel_id_to_key32(tun_info->key.tun_id), +- (flags & TUNNEL_SEQ) ? htonl(tunnel->o_seqno++) : 0); ++ (flags & TUNNEL_SEQ) ? htonl(atomic_fetch_inc(&tunnel->o_seqno)) : 0); + + ip_md_tunnel_xmit(skb, dev, IPPROTO_GRE, tunnel_hlen); + +@@ -579,7 +579,7 @@ static void erspan_fb_xmit(struct sk_buff *skb, struct net_device *dev) + } + + gre_build_header(skb, 8, TUNNEL_SEQ, +- proto, 0, htonl(tunnel->o_seqno++)); ++ proto, 0, htonl(atomic_fetch_inc(&tunnel->o_seqno))); + + ip_md_tunnel_xmit(skb, dev, IPPROTO_GRE, tunnel_hlen); + +diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c +index d9e4ac94eab4..5136959b3dc5 100644 +--- a/net/ipv6/ip6_gre.c ++++ b/net/ipv6/ip6_gre.c +@@ -766,7 +766,7 @@ static netdev_tx_t __gre6_xmit(struct sk_buff *skb, + gre_build_header(skb, tun_hlen, + flags, protocol, + tunnel_id_to_key32(tun_info->key.tun_id), +- (flags & TUNNEL_SEQ) ? htonl(tunnel->o_seqno++) ++ (flags & TUNNEL_SEQ) ? htonl(atomic_fetch_inc(&tunnel->o_seqno)) + : 0); + + } else { +@@ -777,7 +777,8 @@ static netdev_tx_t __gre6_xmit(struct sk_buff *skb, + + gre_build_header(skb, tunnel->tun_hlen, flags, + protocol, tunnel->parms.o_key, +- (flags & TUNNEL_SEQ) ? htonl(tunnel->o_seqno++) : 0); ++ (flags & TUNNEL_SEQ) ? htonl(atomic_fetch_inc(&tunnel->o_seqno)) ++ : 0); + } + + return ip6_tnl_xmit(skb, dev, dsfield, fl6, encap_limit, pmtu, +@@ -1055,7 +1056,7 @@ static netdev_tx_t ip6erspan_tunnel_xmit(struct sk_buff *skb, + /* Push GRE header. */ + proto = (t->parms.erspan_ver == 1) ? htons(ETH_P_ERSPAN) + : htons(ETH_P_ERSPAN2); +- gre_build_header(skb, 8, TUNNEL_SEQ, proto, 0, htonl(t->o_seqno++)); ++ gre_build_header(skb, 8, TUNNEL_SEQ, proto, 0, htonl(atomic_fetch_inc(&t->o_seqno))); + + /* TooBig packet may have updated dst->dev's mtu */ + if (!t->parms.collect_md && dst && dst_mtu(dst) > dst->dev->mtu) +-- +2.35.1 + diff --git a/queue-5.17/ip_gre-make-o_seqno-start-from-0-in-native-mode.patch b/queue-5.17/ip_gre-make-o_seqno-start-from-0-in-native-mode.patch new file mode 100644 index 00000000000..cc6db5afefe --- /dev/null +++ b/queue-5.17/ip_gre-make-o_seqno-start-from-0-in-native-mode.patch @@ -0,0 +1,51 @@ +From 70d46bf01e91dbe9839d8ad6884480d90436c937 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Apr 2022 15:07:57 -0700 +Subject: ip_gre: Make o_seqno start from 0 in native mode + +From: Peilin Ye + +[ Upstream commit ff827beb706ed719c766acf36449801ded0c17fc ] + +For GRE and GRETAP devices, currently o_seqno starts from 1 in native +mode. According to RFC 2890 2.2., "The first datagram is sent with a +sequence number of 0." Fix it. + +It is worth mentioning that o_seqno already starts from 0 in collect_md +mode, see gre_fb_xmit(), where tunnel->o_seqno is passed to +gre_build_header() before getting incremented. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Peilin Ye +Acked-by: William Tu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/ip_gre.c | 8 +++----- + 1 file changed, 3 insertions(+), 5 deletions(-) + +diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c +index 99db2e41ed10..ca70b92e80d9 100644 +--- a/net/ipv4/ip_gre.c ++++ b/net/ipv4/ip_gre.c +@@ -459,14 +459,12 @@ static void __gre_xmit(struct sk_buff *skb, struct net_device *dev, + __be16 proto) + { + struct ip_tunnel *tunnel = netdev_priv(dev); +- +- if (tunnel->parms.o_flags & TUNNEL_SEQ) +- tunnel->o_seqno++; ++ __be16 flags = tunnel->parms.o_flags; + + /* Push GRE header. */ + gre_build_header(skb, tunnel->tun_hlen, +- tunnel->parms.o_flags, proto, tunnel->parms.o_key, +- htonl(tunnel->o_seqno)); ++ flags, proto, tunnel->parms.o_key, ++ (flags & TUNNEL_SEQ) ? htonl(tunnel->o_seqno++) : 0); + + ip_tunnel_xmit(skb, dev, tnl_params, tnl_params->protocol); + } +-- +2.35.1 + diff --git a/queue-5.17/ipvs-correctly-print-the-memory-size-of-ip_vs_conn_t.patch b/queue-5.17/ipvs-correctly-print-the-memory-size-of-ip_vs_conn_t.patch new file mode 100644 index 00000000000..c39f1edd56c --- /dev/null +++ b/queue-5.17/ipvs-correctly-print-the-memory-size-of-ip_vs_conn_t.patch @@ -0,0 +1,38 @@ +From dc5a0348e196b9ed2d421b4bf1653796891a4b93 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Apr 2022 19:05:45 +0800 +Subject: ipvs: correctly print the memory size of ip_vs_conn_tab + +From: Pengcheng Yang + +[ Upstream commit eba1a872cb73314280d5448d934935b23e30b7ca ] + +The memory size of ip_vs_conn_tab changed after we use hlist +instead of list. + +Fixes: 731109e78415 ("ipvs: use hlist instead of list") +Signed-off-by: Pengcheng Yang +Acked-by: Julian Anastasov +Acked-by: Simon Horman +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/ipvs/ip_vs_conn.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/netfilter/ipvs/ip_vs_conn.c b/net/netfilter/ipvs/ip_vs_conn.c +index 2c467c422dc6..fb67f1ca2495 100644 +--- a/net/netfilter/ipvs/ip_vs_conn.c ++++ b/net/netfilter/ipvs/ip_vs_conn.c +@@ -1495,7 +1495,7 @@ int __init ip_vs_conn_init(void) + pr_info("Connection hash table configured " + "(size=%d, memory=%ldKbytes)\n", + ip_vs_conn_tab_size, +- (long)(ip_vs_conn_tab_size*sizeof(struct list_head))/1024); ++ (long)(ip_vs_conn_tab_size*sizeof(*ip_vs_conn_tab))/1024); + IP_VS_DBG(0, "Each connection entry needs %zd bytes at least\n", + sizeof(struct ip_vs_conn)); + +-- +2.35.1 + diff --git a/queue-5.17/ixgbe-ensure-ipsec-vf-pf-compatibility.patch b/queue-5.17/ixgbe-ensure-ipsec-vf-pf-compatibility.patch new file mode 100644 index 00000000000..37580cb56a6 --- /dev/null +++ b/queue-5.17/ixgbe-ensure-ipsec-vf-pf-compatibility.patch @@ -0,0 +1,45 @@ +From 14d6385dbb01b706475c3077390182f22df4525b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Apr 2022 10:31:52 -0700 +Subject: ixgbe: ensure IPsec VF<->PF compatibility + +From: Leon Romanovsky + +[ Upstream commit f049efc7f7cd2f3c419f55040928eaefb13b3636 ] + +The VF driver can forward any IPsec flags and such makes the function +is not extendable and prone to backward/forward incompatibility. + +If new software runs on VF, it won't know that PF configured something +completely different as it "knows" only XFRM_OFFLOAD_INBOUND flag. + +Fixes: eda0333ac293 ("ixgbe: add VF IPsec management") +Reviewed-by: Raed Salem +Signed-off-by: Leon Romanovsky +Reviewed-by: Shannon Nelson +Tested-by: Konrad Jankowski +Signed-off-by: Tony Nguyen +Link: https://lore.kernel.org/r/20220427173152.443102-1-anthony.l.nguyen@intel.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c +index e596e1a9fc75..69d11ff7677d 100644 +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c +@@ -903,7 +903,8 @@ int ixgbe_ipsec_vf_add_sa(struct ixgbe_adapter *adapter, u32 *msgbuf, u32 vf) + /* Tx IPsec offload doesn't seem to work on this + * device, so block these requests for now. + */ +- if (!(sam->flags & XFRM_OFFLOAD_INBOUND)) { ++ sam->flags = sam->flags & ~XFRM_OFFLOAD_IPV6; ++ if (sam->flags != XFRM_OFFLOAD_INBOUND) { + err = -EOPNOTSUPP; + goto err_out; + } +-- +2.35.1 + diff --git a/queue-5.17/ksmbd-increment-reference-count-of-parent-fp.patch b/queue-5.17/ksmbd-increment-reference-count-of-parent-fp.patch new file mode 100644 index 00000000000..ec5c873e4fb --- /dev/null +++ b/queue-5.17/ksmbd-increment-reference-count-of-parent-fp.patch @@ -0,0 +1,51 @@ +From 6aa440e026dda527581d529b5e65f5f6d4db667b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Apr 2022 12:04:43 +0900 +Subject: ksmbd: increment reference count of parent fp + +From: Namjae Jeon + +[ Upstream commit 8510a043d334ecdf83d4604782f288db6bf21d60 ] + +Add missing increment reference count of parent fp in +ksmbd_lookup_fd_inode(). + +Signed-off-by: Namjae Jeon +Reviewed-by: Hyunchul Lee +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/ksmbd/smb2pdu.c | 2 ++ + fs/ksmbd/vfs_cache.c | 1 + + 2 files changed, 3 insertions(+) + +diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c +index 67e8e28e3fc3..a19a2b9c1e56 100644 +--- a/fs/ksmbd/smb2pdu.c ++++ b/fs/ksmbd/smb2pdu.c +@@ -5771,8 +5771,10 @@ static int set_rename_info(struct ksmbd_work *work, struct ksmbd_file *fp, + if (parent_fp) { + if (parent_fp->daccess & FILE_DELETE_LE) { + pr_err("parent dir is opened with delete access\n"); ++ ksmbd_fd_put(work, parent_fp); + return -ESHARE; + } ++ ksmbd_fd_put(work, parent_fp); + } + next: + return smb2_rename(work, fp, user_ns, rename_info, +diff --git a/fs/ksmbd/vfs_cache.c b/fs/ksmbd/vfs_cache.c +index 29c1db66bd0f..8b873d92d785 100644 +--- a/fs/ksmbd/vfs_cache.c ++++ b/fs/ksmbd/vfs_cache.c +@@ -497,6 +497,7 @@ struct ksmbd_file *ksmbd_lookup_fd_inode(struct inode *inode) + list_for_each_entry(lfp, &ci->m_fp_list, node) { + if (inode == file_inode(lfp->filp)) { + atomic_dec(&ci->m_count); ++ lfp = ksmbd_fp_get(lfp); + read_unlock(&ci->m_lock); + return lfp; + } +-- +2.35.1 + diff --git a/queue-5.17/ksmbd-set-fixed-sector-size-to-fs_sector_size_inform.patch b/queue-5.17/ksmbd-set-fixed-sector-size-to-fs_sector_size_inform.patch new file mode 100644 index 00000000000..d6df6344bc3 --- /dev/null +++ b/queue-5.17/ksmbd-set-fixed-sector-size-to-fs_sector_size_inform.patch @@ -0,0 +1,66 @@ +From 635b977f0f575763c493a448f4a5f283ae3fb6af Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Apr 2022 10:01:36 +0900 +Subject: ksmbd: set fixed sector size to FS_SECTOR_SIZE_INFORMATION + +From: Namjae Jeon + +[ Upstream commit 02655a70b7cc0f534531ee65fa72692f4d31a944 ] + +Currently ksmbd is using ->f_bsize from vfs_statfs() as sector size. +If fat/exfat is a local share, ->f_bsize is a cluster size that is too +large to be used as a sector size. Sector sizes larger than 4K cause +problem occurs when mounting an iso file through windows client. + +The error message can be obtained using Mount-DiskImage command, + the error is: +"Mount-DiskImage : The sector size of the physical disk on which the +virtual disk resides is not supported." + +This patch reports fixed 4KB sector size if ->s_blocksize is bigger +than 4KB. + +Signed-off-by: Namjae Jeon +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/ksmbd/smb2pdu.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c +index a19a2b9c1e56..83ffa73c9348 100644 +--- a/fs/ksmbd/smb2pdu.c ++++ b/fs/ksmbd/smb2pdu.c +@@ -11,6 +11,7 @@ + #include + #include + #include ++#include + + #include "glob.h" + #include "smbfsctl.h" +@@ -5005,15 +5006,17 @@ static int smb2_get_info_filesystem(struct ksmbd_work *work, + case FS_SECTOR_SIZE_INFORMATION: + { + struct smb3_fs_ss_info *info; ++ unsigned int sector_size = ++ min_t(unsigned int, path.mnt->mnt_sb->s_blocksize, 4096); + + info = (struct smb3_fs_ss_info *)(rsp->Buffer); + +- info->LogicalBytesPerSector = cpu_to_le32(stfs.f_bsize); ++ info->LogicalBytesPerSector = cpu_to_le32(sector_size); + info->PhysicalBytesPerSectorForAtomicity = +- cpu_to_le32(stfs.f_bsize); +- info->PhysicalBytesPerSectorForPerf = cpu_to_le32(stfs.f_bsize); ++ cpu_to_le32(sector_size); ++ info->PhysicalBytesPerSectorForPerf = cpu_to_le32(sector_size); + info->FSEffPhysicalBytesPerSectorForAtomicity = +- cpu_to_le32(stfs.f_bsize); ++ cpu_to_le32(sector_size); + info->Flags = cpu_to_le32(SSINFO_FLAGS_ALIGNED_DEVICE | + SSINFO_FLAGS_PARTITION_ALIGNED_ON_DEVICE); + info->ByteOffsetForSectorAlignment = 0; +-- +2.35.1 + diff --git a/queue-5.17/mctp-defer-the-kfree-of-object-mdev-addrs.patch b/queue-5.17/mctp-defer-the-kfree-of-object-mdev-addrs.patch new file mode 100644 index 00000000000..41f94fcf5bd --- /dev/null +++ b/queue-5.17/mctp-defer-the-kfree-of-object-mdev-addrs.patch @@ -0,0 +1,175 @@ +From c47c3f9a3bf2d1d287ca37cdbe29a1e8404033ff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Apr 2022 19:43:40 +0800 +Subject: mctp: defer the kfree of object mdev->addrs + +From: Lin Ma + +[ Upstream commit b561275d633bcd8e0e8055ab86f1a13df75a0269 ] + +The function mctp_unregister() reclaims the device's relevant resource +when a netcard detaches. However, a running routine may be unaware of +this and cause the use-after-free of the mdev->addrs object. + +The race condition can be demonstrated below + + cleanup thread another thread + | +unregister_netdev() | mctp_sendmsg() +... | ... + mctp_unregister() | rt = mctp_route_lookup() + ... | mctl_local_output() + kfree(mdev->addrs) | ... + | saddr = rt->dev->addrs[0]; + | + +An attacker can adopt the (recent provided) mtcpserial driver with pty +to fake the device detaching and use the userfaultfd to increase the +race success chance (in mctp_sendmsg). The KASan report for such a POC +is shown below: + +[ 86.051955] ================================================================== +[ 86.051955] BUG: KASAN: use-after-free in mctp_local_output+0x4e9/0xb7d +[ 86.051955] Read of size 1 at addr ffff888005f298c0 by task poc/295 +[ 86.051955] +[ 86.051955] Call Trace: +[ 86.051955] +[ 86.051955] dump_stack_lvl+0x33/0x42 +[ 86.051955] print_report.cold.13+0xb2/0x6b3 +[ 86.051955] ? preempt_schedule_irq+0x57/0x80 +[ 86.051955] ? mctp_local_output+0x4e9/0xb7d +[ 86.051955] kasan_report+0xa5/0x120 +[ 86.051955] ? mctp_local_output+0x4e9/0xb7d +[ 86.051955] mctp_local_output+0x4e9/0xb7d +[ 86.051955] ? mctp_dev_set_key+0x79/0x79 +[ 86.051955] ? copyin+0x38/0x50 +[ 86.051955] ? _copy_from_iter+0x1b6/0xf20 +[ 86.051955] ? sysvec_apic_timer_interrupt+0x97/0xb0 +[ 86.051955] ? asm_sysvec_apic_timer_interrupt+0x12/0x20 +[ 86.051955] ? mctp_local_output+0x1/0xb7d +[ 86.051955] mctp_sendmsg+0x64d/0xdb0 +[ 86.051955] ? mctp_sk_close+0x20/0x20 +[ 86.051955] ? __fget_light+0x2fd/0x4f0 +[ 86.051955] ? mctp_sk_close+0x20/0x20 +[ 86.051955] sock_sendmsg+0xdd/0x110 +[ 86.051955] __sys_sendto+0x1cc/0x2a0 +[ 86.051955] ? __ia32_sys_getpeername+0xa0/0xa0 +[ 86.051955] ? new_sync_write+0x335/0x550 +[ 86.051955] ? alloc_file+0x22f/0x500 +[ 86.051955] ? __ip_do_redirect+0x820/0x1820 +[ 86.051955] ? vfs_write+0x44d/0x7b0 +[ 86.051955] ? vfs_write+0x44d/0x7b0 +[ 86.051955] ? fput_many+0x15/0x120 +[ 86.051955] ? ksys_write+0x155/0x1b0 +[ 86.051955] ? __ia32_sys_read+0xa0/0xa0 +[ 86.051955] __x64_sys_sendto+0xd8/0x1b0 +[ 86.051955] ? exit_to_user_mode_prepare+0x2f/0x120 +[ 86.051955] ? syscall_exit_to_user_mode+0x12/0x20 +[ 86.051955] do_syscall_64+0x3a/0x80 +[ 86.051955] entry_SYSCALL_64_after_hwframe+0x44/0xae +[ 86.051955] RIP: 0033:0x7f82118a56b3 +[ 86.051955] RSP: 002b:00007ffdb154b110 EFLAGS: 00000293 ORIG_RAX: 000000000000002c +[ 86.051955] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f82118a56b3 +[ 86.051955] RDX: 0000000000000010 RSI: 00007f8211cd4000 RDI: 0000000000000007 +[ 86.051955] RBP: 00007ffdb154c1d0 R08: 00007ffdb154b164 R09: 000000000000000c +[ 86.051955] R10: 0000000000000000 R11: 0000000000000293 R12: 000055d779800db0 +[ 86.051955] R13: 00007ffdb154c2b0 R14: 0000000000000000 R15: 0000000000000000 +[ 86.051955] +[ 86.051955] +[ 86.051955] Allocated by task 295: +[ 86.051955] kasan_save_stack+0x1c/0x40 +[ 86.051955] __kasan_kmalloc+0x84/0xa0 +[ 86.051955] mctp_rtm_newaddr+0x242/0x610 +[ 86.051955] rtnetlink_rcv_msg+0x2fd/0x8b0 +[ 86.051955] netlink_rcv_skb+0x11c/0x340 +[ 86.051955] netlink_unicast+0x439/0x630 +[ 86.051955] netlink_sendmsg+0x752/0xc00 +[ 86.051955] sock_sendmsg+0xdd/0x110 +[ 86.051955] __sys_sendto+0x1cc/0x2a0 +[ 86.051955] __x64_sys_sendto+0xd8/0x1b0 +[ 86.051955] do_syscall_64+0x3a/0x80 +[ 86.051955] entry_SYSCALL_64_after_hwframe+0x44/0xae +[ 86.051955] +[ 86.051955] Freed by task 301: +[ 86.051955] kasan_save_stack+0x1c/0x40 +[ 86.051955] kasan_set_track+0x21/0x30 +[ 86.051955] kasan_set_free_info+0x20/0x30 +[ 86.051955] __kasan_slab_free+0x104/0x170 +[ 86.051955] kfree+0x8c/0x290 +[ 86.051955] mctp_dev_notify+0x161/0x2c0 +[ 86.051955] raw_notifier_call_chain+0x8b/0xc0 +[ 86.051955] unregister_netdevice_many+0x299/0x1180 +[ 86.051955] unregister_netdevice_queue+0x210/0x2f0 +[ 86.051955] unregister_netdev+0x13/0x20 +[ 86.051955] mctp_serial_close+0x6d/0xa0 +[ 86.051955] tty_ldisc_kill+0x31/0xa0 +[ 86.051955] tty_ldisc_hangup+0x24f/0x560 +[ 86.051955] __tty_hangup.part.28+0x2ce/0x6b0 +[ 86.051955] tty_release+0x327/0xc70 +[ 86.051955] __fput+0x1df/0x8b0 +[ 86.051955] task_work_run+0xca/0x150 +[ 86.051955] exit_to_user_mode_prepare+0x114/0x120 +[ 86.051955] syscall_exit_to_user_mode+0x12/0x20 +[ 86.051955] do_syscall_64+0x46/0x80 +[ 86.051955] entry_SYSCALL_64_after_hwframe+0x44/0xae +[ 86.051955] +[ 86.051955] The buggy address belongs to the object at ffff888005f298c0 +[ 86.051955] which belongs to the cache kmalloc-8 of size 8 +[ 86.051955] The buggy address is located 0 bytes inside of +[ 86.051955] 8-byte region [ffff888005f298c0, ffff888005f298c8) +[ 86.051955] +[ 86.051955] The buggy address belongs to the physical page: +[ 86.051955] flags: 0x100000000000200(slab|node=0|zone=1) +[ 86.051955] raw: 0100000000000200 dead000000000100 dead000000000122 ffff888005c42280 +[ 86.051955] raw: 0000000000000000 0000000080660066 00000001ffffffff 0000000000000000 +[ 86.051955] page dumped because: kasan: bad access detected +[ 86.051955] +[ 86.051955] Memory state around the buggy address: +[ 86.051955] ffff888005f29780: 00 fc fc fc fc 00 fc fc fc fc 00 fc fc fc fc 00 +[ 86.051955] ffff888005f29800: fc fc fc fc 00 fc fc fc fc 00 fc fc fc fc 00 fc +[ 86.051955] >ffff888005f29880: fc fc fc fb fc fc fc fc fa fc fc fc fc fa fc fc +[ 86.051955] ^ +[ 86.051955] ffff888005f29900: fc fc 00 fc fc fc fc 00 fc fc fc fc 00 fc fc fc +[ 86.051955] ffff888005f29980: fc 00 fc fc fc fc 00 fc fc fc fc 00 fc fc fc fc +[ 86.051955] ================================================================== + +To this end, just like the commit e04480920d1e ("Bluetooth: defer +cleanup of resources in hci_unregister_dev()") this patch defers the +destructive kfree(mdev->addrs) in mctp_unregister to the mctp_dev_put, +where the refcount of mdev is zero and the entire device is reclaimed. +This prevents the use-after-free because the sendmsg thread holds the +reference of mdev in the mctp_route object. + +Fixes: 583be982d934 (mctp: Add device handling and netlink interface) +Signed-off-by: Lin Ma +Acked-by: Jeremy Kerr +Link: https://lore.kernel.org/r/20220422114340.32346-1-linma@zju.edu.cn +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/mctp/device.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/mctp/device.c b/net/mctp/device.c +index f86ef6d751bd..9150b9789d25 100644 +--- a/net/mctp/device.c ++++ b/net/mctp/device.c +@@ -312,6 +312,7 @@ void mctp_dev_hold(struct mctp_dev *mdev) + void mctp_dev_put(struct mctp_dev *mdev) + { + if (mdev && refcount_dec_and_test(&mdev->refs)) { ++ kfree(mdev->addrs); + dev_put(mdev->dev); + kfree_rcu(mdev, rcu); + } +@@ -440,7 +441,6 @@ static void mctp_unregister(struct net_device *dev) + + mctp_route_remove_dev(mdev); + mctp_neigh_remove_dev(mdev); +- kfree(mdev->addrs); + + mctp_dev_put(mdev); + } +-- +2.35.1 + diff --git a/queue-5.17/memory-renesas-rpc-if-fix-hf-ospi-data-transfer-in-m.patch b/queue-5.17/memory-renesas-rpc-if-fix-hf-ospi-data-transfer-in-m.patch new file mode 100644 index 00000000000..0796f9b1472 --- /dev/null +++ b/queue-5.17/memory-renesas-rpc-if-fix-hf-ospi-data-transfer-in-m.patch @@ -0,0 +1,169 @@ +From 363c583953518217127f49aaa4ec304be7164386 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Apr 2022 09:05:26 +0200 +Subject: memory: renesas-rpc-if: Fix HF/OSPI data transfer in Manual Mode + +From: Geert Uytterhoeven + +[ Upstream commit 7e842d70fe599bc13594b650b2144c4b6e6d6bf1 ] + +HyperFlash devices fail to probe: + + rpc-if-hyperflash rpc-if-hyperflash: probing of hyperbus device failed + +In HyperFlash or Octal-SPI Flash mode, the Transfer Data Enable bits +(SPIDE) in the Manual Mode Enable Setting Register (SMENR) are derived +from half of the transfer size, cfr. the rpcif_bits_set() helper +function. However, rpcif_reg_{read,write}() does not take the bus size +into account, and does not double all Manual Mode Data Register access +sizes when communicating with a HyperFlash or Octal-SPI Flash device. + +Fix this, and avoid the back-and-forth conversion between transfer size +and Transfer Data Enable bits, by explicitly storing the transfer size +in struct rpcif, and using that value to determine access size in +rpcif_reg_{read,write}(). + +Enforce that the "high" Manual Mode Read/Write Data Registers +(SM[RW]DR1) are only used for 8-byte data accesses. +While at it, forbid writing to the Manual Mode Read Data Registers, +as they are read-only. + +Fixes: fff53a551db50f5e ("memory: renesas-rpc-if: Correct QSPI data transfer in Manual mode") +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Krzysztof Kozlowski +Tested-by: Lad Prabhakar +Tested-by: Wolfram Sang +Reviewed-by: Wolfram Sang +Link: https://lore.kernel.org/r/cde9bfacf704c81865f57b15d1b48a4793da4286.1649681476.git.geert+renesas@glider.be +Link: https://lore.kernel.org/r/20220420070526.9367-1-krzysztof.kozlowski@linaro.org' +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + drivers/memory/renesas-rpc-if.c | 60 +++++++++++++++++++++++++-------- + include/memory/renesas-rpc-if.h | 1 + + 2 files changed, 47 insertions(+), 14 deletions(-) + +diff --git a/drivers/memory/renesas-rpc-if.c b/drivers/memory/renesas-rpc-if.c +index 2e545f473cc6..019a0822bde0 100644 +--- a/drivers/memory/renesas-rpc-if.c ++++ b/drivers/memory/renesas-rpc-if.c +@@ -164,25 +164,39 @@ static const struct regmap_access_table rpcif_volatile_table = { + + + /* +- * Custom accessor functions to ensure SMRDR0 and SMWDR0 are always accessed +- * with proper width. Requires SMENR_SPIDE to be correctly set before! ++ * Custom accessor functions to ensure SM[RW]DR[01] are always accessed with ++ * proper width. Requires rpcif.xfer_size to be correctly set before! + */ + static int rpcif_reg_read(void *context, unsigned int reg, unsigned int *val) + { + struct rpcif *rpc = context; + +- if (reg == RPCIF_SMRDR0 || reg == RPCIF_SMWDR0) { +- u32 spide = readl(rpc->base + RPCIF_SMENR) & RPCIF_SMENR_SPIDE(0xF); +- +- if (spide == 0x8) { ++ switch (reg) { ++ case RPCIF_SMRDR0: ++ case RPCIF_SMWDR0: ++ switch (rpc->xfer_size) { ++ case 1: + *val = readb(rpc->base + reg); + return 0; +- } else if (spide == 0xC) { ++ ++ case 2: + *val = readw(rpc->base + reg); + return 0; +- } else if (spide != 0xF) { ++ ++ case 4: ++ case 8: ++ *val = readl(rpc->base + reg); ++ return 0; ++ ++ default: + return -EILSEQ; + } ++ ++ case RPCIF_SMRDR1: ++ case RPCIF_SMWDR1: ++ if (rpc->xfer_size != 8) ++ return -EILSEQ; ++ break; + } + + *val = readl(rpc->base + reg); +@@ -193,18 +207,34 @@ static int rpcif_reg_write(void *context, unsigned int reg, unsigned int val) + { + struct rpcif *rpc = context; + +- if (reg == RPCIF_SMRDR0 || reg == RPCIF_SMWDR0) { +- u32 spide = readl(rpc->base + RPCIF_SMENR) & RPCIF_SMENR_SPIDE(0xF); +- +- if (spide == 0x8) { ++ switch (reg) { ++ case RPCIF_SMWDR0: ++ switch (rpc->xfer_size) { ++ case 1: + writeb(val, rpc->base + reg); + return 0; +- } else if (spide == 0xC) { ++ ++ case 2: + writew(val, rpc->base + reg); + return 0; +- } else if (spide != 0xF) { ++ ++ case 4: ++ case 8: ++ writel(val, rpc->base + reg); ++ return 0; ++ ++ default: + return -EILSEQ; + } ++ ++ case RPCIF_SMWDR1: ++ if (rpc->xfer_size != 8) ++ return -EILSEQ; ++ break; ++ ++ case RPCIF_SMRDR0: ++ case RPCIF_SMRDR1: ++ return -EPERM; + } + + writel(val, rpc->base + reg); +@@ -469,6 +499,7 @@ int rpcif_manual_xfer(struct rpcif *rpc) + + smenr |= RPCIF_SMENR_SPIDE(rpcif_bits_set(rpc, nbytes)); + regmap_write(rpc->regmap, RPCIF_SMENR, smenr); ++ rpc->xfer_size = nbytes; + + memcpy(data, rpc->buffer + pos, nbytes); + if (nbytes == 8) { +@@ -533,6 +564,7 @@ int rpcif_manual_xfer(struct rpcif *rpc) + regmap_write(rpc->regmap, RPCIF_SMENR, smenr); + regmap_write(rpc->regmap, RPCIF_SMCR, + rpc->smcr | RPCIF_SMCR_SPIE); ++ rpc->xfer_size = nbytes; + ret = wait_msg_xfer_end(rpc); + if (ret) + goto err_out; +diff --git a/include/memory/renesas-rpc-if.h b/include/memory/renesas-rpc-if.h +index 7c93f5177532..9c0ad64b8d29 100644 +--- a/include/memory/renesas-rpc-if.h ++++ b/include/memory/renesas-rpc-if.h +@@ -72,6 +72,7 @@ struct rpcif { + enum rpcif_type type; + enum rpcif_data_dir dir; + u8 bus_size; ++ u8 xfer_size; + void *buffer; + u32 xferlen; + u32 smcr; +-- +2.35.1 + diff --git a/queue-5.17/mtd-fix-part-field-data-corruption-in-mtd_info.patch b/queue-5.17/mtd-fix-part-field-data-corruption-in-mtd_info.patch new file mode 100644 index 00000000000..caa76d74865 --- /dev/null +++ b/queue-5.17/mtd-fix-part-field-data-corruption-in-mtd_info.patch @@ -0,0 +1,48 @@ +From b6afca52eed4d7a81d8abef300685d5af951028a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 17 Apr 2022 11:46:47 -0700 +Subject: mtd: fix 'part' field data corruption in mtd_info + +From: Oleksandr Ocheretnyi + +[ Upstream commit 37c5f9e80e015d0df17d0c377c18523002986851 ] + +Commit 46b5889cc2c5 ("mtd: implement proper partition handling") +started using "mtd_get_master_ofs()" in mtd callbacks to determine +memory offsets by means of 'part' field from mtd_info, what previously +was smashed accessing 'master' field in the mtd_set_dev_defaults() method. +That provides wrong offset what causes hardware access errors. + +Just make 'part', 'master' as separate fields, rather than using +union type to avoid 'part' data corruption when mtd_set_dev_defaults() +is called. + +Fixes: 46b5889cc2c5 ("mtd: implement proper partition handling") +Signed-off-by: Oleksandr Ocheretnyi +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20220417184649.449289-1-oocheret@cisco.com +Signed-off-by: Sasha Levin +--- + include/linux/mtd/mtd.h | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/include/linux/mtd/mtd.h b/include/linux/mtd/mtd.h +index 1ffa933121f6..12ed7bb071be 100644 +--- a/include/linux/mtd/mtd.h ++++ b/include/linux/mtd/mtd.h +@@ -392,10 +392,8 @@ struct mtd_info { + /* List of partitions attached to this MTD device */ + struct list_head partitions; + +- union { +- struct mtd_part part; +- struct mtd_master master; +- }; ++ struct mtd_part part; ++ struct mtd_master master; + }; + + static inline struct mtd_info *mtd_get_master(struct mtd_info *mtd) +-- +2.35.1 + diff --git a/queue-5.17/mtd-rawnand-fix-ecc-parameters-for-mt7622.patch b/queue-5.17/mtd-rawnand-fix-ecc-parameters-for-mt7622.patch new file mode 100644 index 00000000000..b7017f9019a --- /dev/null +++ b/queue-5.17/mtd-rawnand-fix-ecc-parameters-for-mt7622.patch @@ -0,0 +1,99 @@ +From 18b876849ae996b2cb81639d9ce9738607a21631 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 3 Apr 2022 00:03:13 +0800 +Subject: mtd: rawnand: fix ecc parameters for mt7622 + +From: Chuanhong Guo + +[ Upstream commit 9fe4e0d3cbfe90152137963cc024ecb63db6e8e6 ] + +According to the datasheet, mt7622 only has 5 ECC capabilities instead +of 7, and the decoding error register is arranged as follows: ++------+---------+---------+---------+---------+ +| Bits | 19:15 | 14:10 | 9:5 | 4:0 | ++------+---------+---------+---------+---------+ +| Name | ERRNUM3 | ERRNUM2 | ERRNUM1 | ERRNUM0 | ++------+---------+---------+---------+---------+ +This means err_mask should be 0x1f instead of 0x3f and the number of +bits shifted in mtk_ecc_get_stats should be 5 instead of 8. + +This commit introduces err_shift for the difference in this register +and fix other existing parameters. + +Public MT7622 reference manual can be found on [0] and the info this +commit is based on is from page 656 and page 660. + +[0]: https://wiki.banana-pi.org/Banana_Pi_BPI-R64#Documents + +Fixes: 98dea8d71931 ("mtd: nand: mtk: Support MT7622 NAND flash controller.") +Signed-off-by: Chuanhong Guo +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20220402160315.919094-1-gch981213@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/mtd/nand/raw/mtk_ecc.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/drivers/mtd/nand/raw/mtk_ecc.c b/drivers/mtd/nand/raw/mtk_ecc.c +index 1b47964cb6da..4f6adb657c89 100644 +--- a/drivers/mtd/nand/raw/mtk_ecc.c ++++ b/drivers/mtd/nand/raw/mtk_ecc.c +@@ -43,6 +43,7 @@ + + struct mtk_ecc_caps { + u32 err_mask; ++ u32 err_shift; + const u8 *ecc_strength; + const u32 *ecc_regs; + u8 num_ecc_strength; +@@ -76,7 +77,7 @@ static const u8 ecc_strength_mt2712[] = { + }; + + static const u8 ecc_strength_mt7622[] = { +- 4, 6, 8, 10, 12, 14, 16 ++ 4, 6, 8, 10, 12 + }; + + enum mtk_ecc_regs { +@@ -221,7 +222,7 @@ void mtk_ecc_get_stats(struct mtk_ecc *ecc, struct mtk_ecc_stats *stats, + for (i = 0; i < sectors; i++) { + offset = (i >> 2) << 2; + err = readl(ecc->regs + ECC_DECENUM0 + offset); +- err = err >> ((i % 4) * 8); ++ err = err >> ((i % 4) * ecc->caps->err_shift); + err &= ecc->caps->err_mask; + if (err == ecc->caps->err_mask) { + /* uncorrectable errors */ +@@ -449,6 +450,7 @@ EXPORT_SYMBOL(mtk_ecc_get_parity_bits); + + static const struct mtk_ecc_caps mtk_ecc_caps_mt2701 = { + .err_mask = 0x3f, ++ .err_shift = 8, + .ecc_strength = ecc_strength_mt2701, + .ecc_regs = mt2701_ecc_regs, + .num_ecc_strength = 20, +@@ -459,6 +461,7 @@ static const struct mtk_ecc_caps mtk_ecc_caps_mt2701 = { + + static const struct mtk_ecc_caps mtk_ecc_caps_mt2712 = { + .err_mask = 0x7f, ++ .err_shift = 8, + .ecc_strength = ecc_strength_mt2712, + .ecc_regs = mt2712_ecc_regs, + .num_ecc_strength = 23, +@@ -468,10 +471,11 @@ static const struct mtk_ecc_caps mtk_ecc_caps_mt2712 = { + }; + + static const struct mtk_ecc_caps mtk_ecc_caps_mt7622 = { +- .err_mask = 0x3f, ++ .err_mask = 0x1f, ++ .err_shift = 5, + .ecc_strength = ecc_strength_mt7622, + .ecc_regs = mt7622_ecc_regs, +- .num_ecc_strength = 7, ++ .num_ecc_strength = 5, + .ecc_mode_shift = 4, + .parity_bits = 13, + .pg_irq_sel = 0, +-- +2.35.1 + diff --git a/queue-5.17/mtd-rawnand-fix-return-value-check-of-wait_for_compl.patch b/queue-5.17/mtd-rawnand-fix-return-value-check-of-wait_for_compl.patch new file mode 100644 index 00000000000..66d4dd12992 --- /dev/null +++ b/queue-5.17/mtd-rawnand-fix-return-value-check-of-wait_for_compl.patch @@ -0,0 +1,84 @@ +From 5e4a2e9797cec89d4e05915b95359f1491ea6768 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Apr 2022 08:34:31 +0000 +Subject: mtd: rawnand: Fix return value check of wait_for_completion_timeout + +From: Miaoqian Lin + +[ Upstream commit 084c16ab423a8890121b902b405823bfec5b4365 ] + +wait_for_completion_timeout() returns unsigned long not int. +It returns 0 if timed out, and positive if completed. +The check for <= 0 is ambiguous and should be == 0 here +indicating timeout which is the only error case. + +Fixes: 83738d87e3a0 ("mtd: sh_flctl: Add DMA capabilty") +Signed-off-by: Miaoqian Lin +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20220412083435.29254-1-linmq006@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/mtd/nand/raw/sh_flctl.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +diff --git a/drivers/mtd/nand/raw/sh_flctl.c b/drivers/mtd/nand/raw/sh_flctl.c +index 13df4bdf792a..8f89e2d3d817 100644 +--- a/drivers/mtd/nand/raw/sh_flctl.c ++++ b/drivers/mtd/nand/raw/sh_flctl.c +@@ -384,7 +384,8 @@ static int flctl_dma_fifo0_transfer(struct sh_flctl *flctl, unsigned long *buf, + dma_addr_t dma_addr; + dma_cookie_t cookie; + uint32_t reg; +- int ret; ++ int ret = 0; ++ unsigned long time_left; + + if (dir == DMA_FROM_DEVICE) { + chan = flctl->chan_fifo0_rx; +@@ -425,13 +426,14 @@ static int flctl_dma_fifo0_transfer(struct sh_flctl *flctl, unsigned long *buf, + goto out; + } + +- ret = ++ time_left = + wait_for_completion_timeout(&flctl->dma_complete, + msecs_to_jiffies(3000)); + +- if (ret <= 0) { ++ if (time_left == 0) { + dmaengine_terminate_all(chan); + dev_err(&flctl->pdev->dev, "wait_for_completion_timeout\n"); ++ ret = -ETIMEDOUT; + } + + out: +@@ -441,7 +443,7 @@ static int flctl_dma_fifo0_transfer(struct sh_flctl *flctl, unsigned long *buf, + + dma_unmap_single(chan->device->dev, dma_addr, len, dir); + +- /* ret > 0 is success */ ++ /* ret == 0 is success */ + return ret; + } + +@@ -465,7 +467,7 @@ static void read_fiforeg(struct sh_flctl *flctl, int rlen, int offset) + + /* initiate DMA transfer */ + if (flctl->chan_fifo0_rx && rlen >= 32 && +- flctl_dma_fifo0_transfer(flctl, buf, rlen, DMA_FROM_DEVICE) > 0) ++ !flctl_dma_fifo0_transfer(flctl, buf, rlen, DMA_FROM_DEVICE)) + goto convert; /* DMA success */ + + /* do polling transfer */ +@@ -524,7 +526,7 @@ static void write_ec_fiforeg(struct sh_flctl *flctl, int rlen, + + /* initiate DMA transfer */ + if (flctl->chan_fifo0_tx && rlen >= 32 && +- flctl_dma_fifo0_transfer(flctl, buf, rlen, DMA_TO_DEVICE) > 0) ++ !flctl_dma_fifo0_transfer(flctl, buf, rlen, DMA_TO_DEVICE)) + return; /* DMA success */ + + /* do polling transfer */ +-- +2.35.1 + diff --git a/queue-5.17/net-bcmgenet-hide-status-block-before-tx-timestampin.patch b/queue-5.17/net-bcmgenet-hide-status-block-before-tx-timestampin.patch new file mode 100644 index 00000000000..5518c3ec17d --- /dev/null +++ b/queue-5.17/net-bcmgenet-hide-status-block-before-tx-timestampin.patch @@ -0,0 +1,61 @@ +From c035b9ecccb11e479d62563575e74b3541499aa0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 24 Apr 2022 09:53:07 -0700 +Subject: net: bcmgenet: hide status block before TX timestamping + +From: Jonathan Lemon + +[ Upstream commit acac0541d1d65e81e599ec399d34d184d2424401 ] + +The hardware checksum offloading requires use of a transmit +status block inserted before the outgoing frame data, this was +updated in '9a9ba2a4aaaa ("net: bcmgenet: always enable status blocks")' + +However, skb_tx_timestamp() assumes that it is passed a raw frame +and PTP parsing chokes on this status block. + +Fix this by calling __skb_pull(), which hides the TSB before calling +skb_tx_timestamp(), so an outgoing PTP packet is parsed correctly. + +As the data in the skb has already been set up for DMA, and the +dma_unmap_* calls use a separately stored address, there is no +no effective change in the data transmission. + +Signed-off-by: Jonathan Lemon +Acked-by: Florian Fainelli +Link: https://lore.kernel.org/r/20220424165307.591145-1-jonathan.lemon@gmail.com +Fixes: d03825fba459 ("net: bcmgenet: add skb_tx_timestamp call") +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/genet/bcmgenet.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c +index 2da804f84b48..c2bfb25e087c 100644 +--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c ++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c +@@ -2035,6 +2035,11 @@ static struct sk_buff *bcmgenet_add_tsb(struct net_device *dev, + return skb; + } + ++static void bcmgenet_hide_tsb(struct sk_buff *skb) ++{ ++ __skb_pull(skb, sizeof(struct status_64)); ++} ++ + static netdev_tx_t bcmgenet_xmit(struct sk_buff *skb, struct net_device *dev) + { + struct bcmgenet_priv *priv = netdev_priv(dev); +@@ -2141,6 +2146,8 @@ static netdev_tx_t bcmgenet_xmit(struct sk_buff *skb, struct net_device *dev) + } + + GENET_CB(skb)->last_cb = tx_cb_ptr; ++ ++ bcmgenet_hide_tsb(skb); + skb_tx_timestamp(skb); + + /* Decrement total BD count and advance our write pointer */ +-- +2.35.1 + diff --git a/queue-5.17/net-dsa-add-missing-of_node_put-in-dsa_port_link_reg.patch b/queue-5.17/net-dsa-add-missing-of_node_put-in-dsa_port_link_reg.patch new file mode 100644 index 00000000000..73862c2277e --- /dev/null +++ b/queue-5.17/net-dsa-add-missing-of_node_put-in-dsa_port_link_reg.patch @@ -0,0 +1,39 @@ +From 0eb9ef0fa529b3586e64d1d0f70f5791da0ec4b2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Apr 2022 19:04:08 +0800 +Subject: net: dsa: Add missing of_node_put() in dsa_port_link_register_of + +From: Miaoqian Lin + +[ Upstream commit fc06b2867f4cea543505acfb194c2be4ebf0c7d3 ] + +The device_node pointer is returned by of_parse_phandle() with refcount +incremented. We should use of_node_put() on it when done. +of_node_put() will check for NULL value. + +Fixes: a20f997010c4 ("net: dsa: Don't instantiate phylink for CPU/DSA ports unless needed") +Signed-off-by: Miaoqian Lin +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/dsa/port.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/dsa/port.c b/net/dsa/port.c +index 1a40c52f5a42..4368fd32c4a5 100644 +--- a/net/dsa/port.c ++++ b/net/dsa/port.c +@@ -1240,8 +1240,10 @@ int dsa_port_link_register_of(struct dsa_port *dp) + if (ds->ops->phylink_mac_link_down) + ds->ops->phylink_mac_link_down(ds, port, + MLO_AN_FIXED, PHY_INTERFACE_MODE_NA); ++ of_node_put(phy_np); + return dsa_port_phylink_register(dp); + } ++ of_node_put(phy_np); + return 0; + } + +-- +2.35.1 + diff --git a/queue-5.17/net-dsa-lantiq_gswip-don-t-set-gswip_mii_cfg_rmii_cl.patch b/queue-5.17/net-dsa-lantiq_gswip-don-t-set-gswip_mii_cfg_rmii_cl.patch new file mode 100644 index 00000000000..3db0da2479d --- /dev/null +++ b/queue-5.17/net-dsa-lantiq_gswip-don-t-set-gswip_mii_cfg_rmii_cl.patch @@ -0,0 +1,60 @@ +From 358d0b6e5e4c5783437e25f53ab7841179a7f4e1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Apr 2022 17:20:27 +0200 +Subject: net: dsa: lantiq_gswip: Don't set GSWIP_MII_CFG_RMII_CLK + +From: Martin Blumenstingl + +[ Upstream commit 71cffebf6358a7f5031f5b208bbdc1cb4db6e539 ] + +Commit 4b5923249b8fa4 ("net: dsa: lantiq_gswip: Configure all remaining +GSWIP_MII_CFG bits") added all known bits in the GSWIP_MII_CFGp +register. It helped bring this register into a well-defined state so the +driver has to rely less on the bootloader to do things right. +Unfortunately it also sets the GSWIP_MII_CFG_RMII_CLK bit without any +possibility to configure it. Upon further testing it turns out that all +boards which are supported by the GSWIP driver in OpenWrt which use an +RMII PHY have a dedicated oscillator on the board which provides the +50MHz RMII reference clock. + +Don't set the GSWIP_MII_CFG_RMII_CLK bit (but keep the code which always +clears it) to fix support for the Fritz!Box 7362 SL in OpenWrt. This is +a board with two Atheros AR8030 RMII PHYs. With the "RMII clock" bit set +the MAC also generates the RMII reference clock whose signal then +conflicts with the signal from the oscillator on the board. This results +in a constant cycle of the PHY detecting link up/down (and as a result +of that: the two ports using the AR8030 PHYs are not working). + +At the time of writing this patch there's no known board where the MAC +(GSWIP) has to generate the RMII reference clock. If needed this can be +implemented in future by providing a device-tree flag so the +GSWIP_MII_CFG_RMII_CLK bit can be toggled per port. + +Fixes: 4b5923249b8fa4 ("net: dsa: lantiq_gswip: Configure all remaining GSWIP_MII_CFG bits") +Tested-by: Jan Hoffmann +Signed-off-by: Martin Blumenstingl +Acked-by: Hauke Mehrtens +Link: https://lore.kernel.org/r/20220425152027.2220750-1-martin.blumenstingl@googlemail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/lantiq_gswip.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/net/dsa/lantiq_gswip.c b/drivers/net/dsa/lantiq_gswip.c +index 8a7a8093a156..8acec33a4702 100644 +--- a/drivers/net/dsa/lantiq_gswip.c ++++ b/drivers/net/dsa/lantiq_gswip.c +@@ -1637,9 +1637,6 @@ static void gswip_phylink_mac_config(struct dsa_switch *ds, int port, + break; + case PHY_INTERFACE_MODE_RMII: + miicfg |= GSWIP_MII_CFG_MODE_RMIIM; +- +- /* Configure the RMII clock as output: */ +- miicfg |= GSWIP_MII_CFG_RMII_CLK; + break; + case PHY_INTERFACE_MODE_RGMII: + case PHY_INTERFACE_MODE_RGMII_ID: +-- +2.35.1 + diff --git a/queue-5.17/net-dsa-mv88e6xxx-fix-port_hidden_wait-to-account-fo.patch b/queue-5.17/net-dsa-mv88e6xxx-fix-port_hidden_wait-to-account-fo.patch new file mode 100644 index 00000000000..6dcd8b46470 --- /dev/null +++ b/queue-5.17/net-dsa-mv88e6xxx-fix-port_hidden_wait-to-account-fo.patch @@ -0,0 +1,54 @@ +From fe48e7d41685ddc4ab78a6d7130e35d73fae292e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Apr 2022 07:04:54 +0000 +Subject: net: dsa: mv88e6xxx: Fix port_hidden_wait to account for + port_base_addr +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Nathan Rossi + +[ Upstream commit 24cbdb910bb62b5be3865275e5682be1a7708c0f ] + +The other port_hidden functions rely on the port_read/port_write +functions to access the hidden control port. These functions apply the +offset for port_base_addr where applicable. Update port_hidden_wait to +use the port_wait_bit so that port_base_addr offsets are accounted for +when waiting for the busy bit to change. + +Without the offset the port_hidden_wait function would timeout on +devices that have a non-zero port_base_addr (e.g. MV88E6141), however +devices that have a zero port_base_addr would operate correctly (e.g. +MV88E6390). + +Fixes: 609070133aff ("net: dsa: mv88e6xxx: update code operating on hidden registers") +Signed-off-by: Nathan Rossi +Reviewed-by: Marek Behún +Reviewed-by: Andrew Lunn +Link: https://lore.kernel.org/r/20220425070454.348584-1-nathan@nathanrossi.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/mv88e6xxx/port_hidden.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/dsa/mv88e6xxx/port_hidden.c b/drivers/net/dsa/mv88e6xxx/port_hidden.c +index b49d05f0e117..7a9f9ff6dedf 100644 +--- a/drivers/net/dsa/mv88e6xxx/port_hidden.c ++++ b/drivers/net/dsa/mv88e6xxx/port_hidden.c +@@ -40,8 +40,9 @@ int mv88e6xxx_port_hidden_wait(struct mv88e6xxx_chip *chip) + { + int bit = __bf_shf(MV88E6XXX_PORT_RESERVED_1A_BUSY); + +- return mv88e6xxx_wait_bit(chip, MV88E6XXX_PORT_RESERVED_1A_CTRL_PORT, +- MV88E6XXX_PORT_RESERVED_1A, bit, 0); ++ return mv88e6xxx_port_wait_bit(chip, ++ MV88E6XXX_PORT_RESERVED_1A_CTRL_PORT, ++ MV88E6XXX_PORT_RESERVED_1A, bit, 0); + } + + int mv88e6xxx_port_hidden_read(struct mv88e6xxx_chip *chip, int block, int port, +-- +2.35.1 + diff --git a/queue-5.17/net-enetc-allow-tc-etf-offload-even-with-netif_f_csu.patch b/queue-5.17/net-enetc-allow-tc-etf-offload-even-with-netif_f_csu.patch new file mode 100644 index 00000000000..198ef3b59c2 --- /dev/null +++ b/queue-5.17/net-enetc-allow-tc-etf-offload-even-with-netif_f_csu.patch @@ -0,0 +1,53 @@ +From 2b69475a87c5ee3926672b66a76f5f978c967cb9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Apr 2022 23:30:17 +0300 +Subject: net: enetc: allow tc-etf offload even with NETIF_F_CSUM_MASK + +From: Vladimir Oltean + +[ Upstream commit 66a2f5ef68faaf950746747d790a0c95f7ec96d2 ] + +The Time-Specified Departure feature is indeed mutually exclusive with +TX IP checksumming in ENETC, but TX checksumming in itself is broken and +was removed from this driver in commit 82728b91f124 ("enetc: Remove Tx +checksumming offload code"). + +The blamed commit declared NETIF_F_HW_CSUM in dev->features to comply +with software TSO's expectations, and still did the checksumming in +software by calling skb_checksum_help(). So there isn't any restriction +for the Time-Specified Departure feature. + +However, enetc_setup_tc_txtime() doesn't understand that, and blindly +looks for NETIF_F_CSUM_MASK. + +Instead of checking for things which can literally never happen in the +current code base, just remove the check and let the driver offload +tc-etf qdiscs. + +Fixes: acede3c5dad5 ("net: enetc: declare NETIF_F_HW_CSUM and do it in software") +Signed-off-by: Vladimir Oltean +Link: https://lore.kernel.org/r/20220427203017.1291634-1-vladimir.oltean@nxp.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/enetc/enetc_qos.c | 4 ---- + 1 file changed, 4 deletions(-) + +diff --git a/drivers/net/ethernet/freescale/enetc/enetc_qos.c b/drivers/net/ethernet/freescale/enetc/enetc_qos.c +index d3d7172e0fcc..3b148d4e0f0c 100644 +--- a/drivers/net/ethernet/freescale/enetc/enetc_qos.c ++++ b/drivers/net/ethernet/freescale/enetc/enetc_qos.c +@@ -308,10 +308,6 @@ int enetc_setup_tc_txtime(struct net_device *ndev, void *type_data) + if (tc < 0 || tc >= priv->num_tx_rings) + return -EINVAL; + +- /* Do not support TXSTART and TX CSUM offload simutaniously */ +- if (ndev->features & NETIF_F_CSUM_MASK) +- return -EBUSY; +- + /* TSD and Qbv are mutually exclusive in hardware */ + if (enetc_rd(&priv->si->hw, ENETC_QBV_PTGCR_OFFSET) & ENETC_QBV_TGE) + return -EBUSY; +-- +2.35.1 + diff --git a/queue-5.17/net-fec-add-missing-of_node_put-in-fec_enet_init_sto.patch b/queue-5.17/net-fec-add-missing-of_node_put-in-fec_enet_init_sto.patch new file mode 100644 index 00000000000..b7b847cc52e --- /dev/null +++ b/queue-5.17/net-fec-add-missing-of_node_put-in-fec_enet_init_sto.patch @@ -0,0 +1,36 @@ +From f916333fecef363335078c321373dbbbc2f224a8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Apr 2022 20:52:31 +0800 +Subject: net: fec: add missing of_node_put() in fec_enet_init_stop_mode() + +From: Yang Yingliang + +[ Upstream commit d2b52ec056d5bddb055c8f21d7489a23548d0838 ] + +Put device node in error path in fec_enet_init_stop_mode(). + +Fixes: 8a448bf832af ("net: ethernet: fec: move GPR register offset and bit into DT") +Signed-off-by: Yang Yingliang +Link: https://lore.kernel.org/r/20220426125231.375688-1-yangyingliang@huawei.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/fec_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c +index 796133de527e..870919c66518 100644 +--- a/drivers/net/ethernet/freescale/fec_main.c ++++ b/drivers/net/ethernet/freescale/fec_main.c +@@ -3731,7 +3731,7 @@ static int fec_enet_init_stop_mode(struct fec_enet_private *fep, + ARRAY_SIZE(out_val)); + if (ret) { + dev_dbg(&fep->pdev->dev, "no stop mode property\n"); +- return ret; ++ goto out; + } + + fep->stop_gpr.gpr = syscon_node_to_regmap(gpr_np); +-- +2.35.1 + diff --git a/queue-5.17/net-hns3-add-return-value-for-mailbox-handling-in-pf.patch b/queue-5.17/net-hns3-add-return-value-for-mailbox-handling-in-pf.patch new file mode 100644 index 00000000000..9cd5200a8bd --- /dev/null +++ b/queue-5.17/net-hns3-add-return-value-for-mailbox-handling-in-pf.patch @@ -0,0 +1,100 @@ +From dd0748c20dc2529fe6d3f1f32b0dabc123dd60d8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 24 Apr 2022 20:57:25 +0800 +Subject: net: hns3: add return value for mailbox handling in PF + +From: Jian Shen + +[ Upstream commit c59d606296842409a6e5a4828235b0bd46b12bc4 ] + +Currently, there are some querying mailboxes sent from VF to PF, +and VF will wait the PF's handling result. For mailbox +HCLGE_MBX_GET_QID_IN_PF and HCLGE_MBX_GET_RSS_KEY, it may fail +when the input parameter is invalid, but the prototype of their +handler function is void. In this case, PF always return success +to VF, which may cause the VF get incorrect result. + +Fixes it by adding return value for these function. + +Fixes: 63b1279d9905 ("net: hns3: check queue id range before using") +Fixes: 532cfc0df1e4 ("net: hns3: add a check for index in hclge_get_rss_key()") +Signed-off-by: Jian Shen +Signed-off-by: Guangbin Huang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../hisilicon/hns3/hns3pf/hclge_mbx.c | 22 ++++++++++--------- + 1 file changed, 12 insertions(+), 10 deletions(-) + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c +index 53f939923c28..7998ca617a92 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c +@@ -594,9 +594,9 @@ static int hclge_set_vf_mtu(struct hclge_vport *vport, + return hclge_set_vport_mtu(vport, mtu); + } + +-static void hclge_get_queue_id_in_pf(struct hclge_vport *vport, +- struct hclge_mbx_vf_to_pf_cmd *mbx_req, +- struct hclge_respond_to_vf_msg *resp_msg) ++static int hclge_get_queue_id_in_pf(struct hclge_vport *vport, ++ struct hclge_mbx_vf_to_pf_cmd *mbx_req, ++ struct hclge_respond_to_vf_msg *resp_msg) + { + struct hnae3_handle *handle = &vport->nic; + struct hclge_dev *hdev = vport->back; +@@ -606,17 +606,18 @@ static void hclge_get_queue_id_in_pf(struct hclge_vport *vport, + if (queue_id >= handle->kinfo.num_tqps) { + dev_err(&hdev->pdev->dev, "Invalid queue id(%u) from VF %u\n", + queue_id, mbx_req->mbx_src_vfid); +- return; ++ return -EINVAL; + } + + qid_in_pf = hclge_covert_handle_qid_global(&vport->nic, queue_id); + memcpy(resp_msg->data, &qid_in_pf, sizeof(qid_in_pf)); + resp_msg->len = sizeof(qid_in_pf); ++ return 0; + } + +-static void hclge_get_rss_key(struct hclge_vport *vport, +- struct hclge_mbx_vf_to_pf_cmd *mbx_req, +- struct hclge_respond_to_vf_msg *resp_msg) ++static int hclge_get_rss_key(struct hclge_vport *vport, ++ struct hclge_mbx_vf_to_pf_cmd *mbx_req, ++ struct hclge_respond_to_vf_msg *resp_msg) + { + #define HCLGE_RSS_MBX_RESP_LEN 8 + struct hclge_dev *hdev = vport->back; +@@ -634,13 +635,14 @@ static void hclge_get_rss_key(struct hclge_vport *vport, + dev_warn(&hdev->pdev->dev, + "failed to get the rss hash key, the index(%u) invalid !\n", + index); +- return; ++ return -EINVAL; + } + + memcpy(resp_msg->data, + &rss_cfg->rss_hash_key[index * HCLGE_RSS_MBX_RESP_LEN], + HCLGE_RSS_MBX_RESP_LEN); + resp_msg->len = HCLGE_RSS_MBX_RESP_LEN; ++ return 0; + } + + static void hclge_link_fail_parse(struct hclge_dev *hdev, u8 link_fail_code) +@@ -816,10 +818,10 @@ void hclge_mbx_handler(struct hclge_dev *hdev) + "VF fail(%d) to set mtu\n", ret); + break; + case HCLGE_MBX_GET_QID_IN_PF: +- hclge_get_queue_id_in_pf(vport, req, &resp_msg); ++ ret = hclge_get_queue_id_in_pf(vport, req, &resp_msg); + break; + case HCLGE_MBX_GET_RSS_KEY: +- hclge_get_rss_key(vport, req, &resp_msg); ++ ret = hclge_get_rss_key(vport, req, &resp_msg); + break; + case HCLGE_MBX_GET_LINK_MODE: + hclge_get_link_mode(vport, req); +-- +2.35.1 + diff --git a/queue-5.17/net-hns3-add-validity-check-for-message-data-length.patch b/queue-5.17/net-hns3-add-validity-check-for-message-data-length.patch new file mode 100644 index 00000000000..263acc03d59 --- /dev/null +++ b/queue-5.17/net-hns3-add-validity-check-for-message-data-length.patch @@ -0,0 +1,42 @@ +From 0e40fcbef050be0f1ef089caa3f9020ff227f415 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 24 Apr 2022 20:57:24 +0800 +Subject: net: hns3: add validity check for message data length + +From: Jian Shen + +[ Upstream commit 7d413735cb18ff73aaba3457b16b08332e8d3cc4 ] + +Add validity check for message data length in function +hclge_send_mbx_msg(), avoid unexpected overflow. + +Fixes: dde1a86e93ca ("net: hns3: Add mailbox support to PF driver") +Signed-off-by: Jian Shen +Signed-off-by: Guangbin Huang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c +index 36cbafc5f944..53f939923c28 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c +@@ -94,6 +94,13 @@ static int hclge_send_mbx_msg(struct hclge_vport *vport, u8 *msg, u16 msg_len, + enum hclge_comm_cmd_status status; + struct hclge_desc desc; + ++ if (msg_len > HCLGE_MBX_MAX_MSG_SIZE) { ++ dev_err(&hdev->pdev->dev, ++ "msg data length(=%u) exceeds maximum(=%u)\n", ++ msg_len, HCLGE_MBX_MAX_MSG_SIZE); ++ return -EMSGSIZE; ++ } ++ + resp_pf_to_vf = (struct hclge_mbx_pf_to_vf_cmd *)desc.data; + + hclge_cmd_setup_basic_desc(&desc, HCLGEVF_OPC_MBX_PF_TO_VF, false); +-- +2.35.1 + diff --git a/queue-5.17/net-hns3-clear-inited-state-and-stop-client-after-fa.patch b/queue-5.17/net-hns3-clear-inited-state-and-stop-client-after-fa.patch new file mode 100644 index 00000000000..0fbb45cac9f --- /dev/null +++ b/queue-5.17/net-hns3-clear-inited-state-and-stop-client-after-fa.patch @@ -0,0 +1,54 @@ +From 09f22e3f4654f1dccd5138b3730928dd19cc0006 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 24 Apr 2022 20:57:20 +0800 +Subject: net: hns3: clear inited state and stop client after failed to + register netdev + +From: Jian Shen + +[ Upstream commit e98365afc1e94ea1609268866a44112b3572c58b ] + +If failed to register netdev, it needs to clear INITED state and stop +client in case of cause problem when concurrency with uninitialized +process of driver. + +Fixes: a289a7e5c1d4 ("net: hns3: put off calling register_netdev() until client initialize complete") +Signed-off-by: Jian Shen +Signed-off-by: Guangbin Huang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +index f6082be7481c..f33b4c351a70 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +@@ -5132,6 +5132,13 @@ static void hns3_state_init(struct hnae3_handle *handle) + set_bit(HNS3_NIC_STATE_RXD_ADV_LAYOUT_ENABLE, &priv->state); + } + ++static void hns3_state_uninit(struct hnae3_handle *handle) ++{ ++ struct hns3_nic_priv *priv = handle->priv; ++ ++ clear_bit(HNS3_NIC_STATE_INITED, &priv->state); ++} ++ + static int hns3_client_init(struct hnae3_handle *handle) + { + struct pci_dev *pdev = handle->pdev; +@@ -5249,7 +5256,9 @@ static int hns3_client_init(struct hnae3_handle *handle) + return ret; + + out_reg_netdev_fail: ++ hns3_state_uninit(handle); + hns3_dbg_uninit(handle); ++ hns3_client_stop(handle); + out_client_start: + hns3_free_rx_cpu_rmap(netdev); + hns3_nic_uninit_irq(priv); +-- +2.35.1 + diff --git a/queue-5.17/net-hns3-fix-error-log-of-tx-rx-tqps-stats.patch b/queue-5.17/net-hns3-fix-error-log-of-tx-rx-tqps-stats.patch new file mode 100644 index 00000000000..bc0eb472d9f --- /dev/null +++ b/queue-5.17/net-hns3-fix-error-log-of-tx-rx-tqps-stats.patch @@ -0,0 +1,46 @@ +From 4bb9d1be13c5c343ebe86e082a92bf0f9c794305 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 24 Apr 2022 20:57:22 +0800 +Subject: net: hns3: fix error log of tx/rx tqps stats + +From: Peng Li + +[ Upstream commit 123521b6b260d901937d3fb598ab88d260c857a6 ] + +The comments in function hclge_comm_tqps_update_stats is not right, +so fix it. + +Fixes: 287db5c40d15 ("net: hns3: create new set of common tqp stats APIs for PF and VF reuse") +Signed-off-by: Peng Li +Signed-off-by: Guangbin Huang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../hisilicon/hns3/hns3_common/hclge_comm_tqp_stats.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_common/hclge_comm_tqp_stats.c b/drivers/net/ethernet/hisilicon/hns3/hns3_common/hclge_comm_tqp_stats.c +index 0c60f41fca8a..f3c9395d8351 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3_common/hclge_comm_tqp_stats.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_common/hclge_comm_tqp_stats.c +@@ -75,7 +75,7 @@ int hclge_comm_tqps_update_stats(struct hnae3_handle *handle, + ret = hclge_comm_cmd_send(hw, &desc, 1); + if (ret) { + dev_err(&hw->cmq.csq.pdev->dev, +- "failed to get tqp stat, ret = %d, tx = %u.\n", ++ "failed to get tqp stat, ret = %d, rx = %u.\n", + ret, i); + return ret; + } +@@ -89,7 +89,7 @@ int hclge_comm_tqps_update_stats(struct hnae3_handle *handle, + ret = hclge_comm_cmd_send(hw, &desc, 1); + if (ret) { + dev_err(&hw->cmq.csq.pdev->dev, +- "failed to get tqp stat, ret = %d, rx = %u.\n", ++ "failed to get tqp stat, ret = %d, tx = %u.\n", + ret, i); + return ret; + } +-- +2.35.1 + diff --git a/queue-5.17/net-hns3-modify-the-return-code-of-hclge_get_ring_ch.patch b/queue-5.17/net-hns3-modify-the-return-code-of-hclge_get_ring_ch.patch new file mode 100644 index 00000000000..7926cb3cefa --- /dev/null +++ b/queue-5.17/net-hns3-modify-the-return-code-of-hclge_get_ring_ch.patch @@ -0,0 +1,40 @@ +From a5cb55dd453b7c8772f1112d96a34b8989fcea9d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 24 Apr 2022 20:57:23 +0800 +Subject: net: hns3: modify the return code of hclge_get_ring_chain_from_mbx + +From: Jie Wang + +[ Upstream commit 48009e9972974c52a5f649f761862dd67bce3d13 ] + +Currently, function hclge_get_ring_chain_from_mbx will return -ENOMEM if +ring_num is bigger than HCLGE_MBX_MAX_RING_CHAIN_PARAM_NUM. It is better to +return -EINVAL for the invalid parameter case. + +So this patch fixes it by return -EINVAL in this abnormal branch. + +Fixes: 5d02a58dae60 ("net: hns3: fix for buffer overflow smatch warning") +Signed-off-by: Jie Wang +Signed-off-by: Guangbin Huang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c +index 6799d16de34b..36cbafc5f944 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c +@@ -176,7 +176,7 @@ static int hclge_get_ring_chain_from_mbx( + ring_num = req->msg.ring_num; + + if (ring_num > HCLGE_MBX_MAX_RING_CHAIN_PARAM_NUM) +- return -ENOMEM; ++ return -EINVAL; + + for (i = 0; i < ring_num; i++) { + if (req->msg.param[i].tqp_index >= vport->nic.kinfo.rss_size) { +-- +2.35.1 + diff --git a/queue-5.17/net-lan966x-fix-a-couple-off-by-one-bugs.patch b/queue-5.17/net-lan966x-fix-a-couple-off-by-one-bugs.patch new file mode 100644 index 00000000000..01f833d9e41 --- /dev/null +++ b/queue-5.17/net-lan966x-fix-a-couple-off-by-one-bugs.patch @@ -0,0 +1,49 @@ +From 869be75f7806f6bca870502025a967c846134bf3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Apr 2022 18:46:13 +0300 +Subject: net: lan966x: fix a couple off by one bugs + +From: Dan Carpenter + +[ Upstream commit 9810c58c7051ae83e7ac326fca3daa823da6b778 ] + +The lan966x->ports[] array has lan966x->num_phys_ports elements. These +are assigned in lan966x_probe(). That means the > comparison should be +changed to >=. + +The first off by one check is harmless but the second one could lead to +an out of bounds access and a crash. + +Fixes: 5ccd66e01cbe ("net: lan966x: add support for interrupts from analyzer") +Signed-off-by: Dan Carpenter +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/microchip/lan966x/lan966x_mac.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/microchip/lan966x/lan966x_mac.c b/drivers/net/ethernet/microchip/lan966x/lan966x_mac.c +index 2679111ef669..005e56ea5da1 100644 +--- a/drivers/net/ethernet/microchip/lan966x/lan966x_mac.c ++++ b/drivers/net/ethernet/microchip/lan966x/lan966x_mac.c +@@ -346,7 +346,7 @@ static void lan966x_mac_irq_process(struct lan966x *lan966x, u32 row, + + lan966x_mac_process_raw_entry(&raw_entries[column], + mac, &vid, &dest_idx); +- if (WARN_ON(dest_idx > lan966x->num_phys_ports)) ++ if (WARN_ON(dest_idx >= lan966x->num_phys_ports)) + continue; + + /* If the entry in SW is found, then there is nothing +@@ -393,7 +393,7 @@ static void lan966x_mac_irq_process(struct lan966x *lan966x, u32 row, + + lan966x_mac_process_raw_entry(&raw_entries[column], + mac, &vid, &dest_idx); +- if (WARN_ON(dest_idx > lan966x->num_phys_ports)) ++ if (WARN_ON(dest_idx >= lan966x->num_phys_ports)) + continue; + + mac_entry = lan966x_mac_alloc_entry(mac, vid, dest_idx); +-- +2.35.1 + diff --git a/queue-5.17/net-phy-marvell10g-fix-return-value-on-error.patch b/queue-5.17/net-phy-marvell10g-fix-return-value-on-error.patch new file mode 100644 index 00000000000..581902a2560 --- /dev/null +++ b/queue-5.17/net-phy-marvell10g-fix-return-value-on-error.patch @@ -0,0 +1,41 @@ +From 07ad05aa5800c46bfd2193c1f778d68489090d9b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Apr 2022 09:27:38 +0300 +Subject: net: phy: marvell10g: fix return value on error +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Baruch Siach + +[ Upstream commit 0ed9704b660b259b54743cad8a84a11148f60f0a ] + +Return back the error value that we get from phy_read_mmd(). + +Fixes: c84786fa8f91 ("net: phy: marvell10g: read copper results from CSSR1") +Signed-off-by: Baruch Siach +Reviewed-by: Marek Behún +Reviewed-by: Russell King (Oracle) +Link: https://lore.kernel.org/r/f47cb031aeae873bb008ba35001607304a171a20.1650868058.git.baruch@tkos.co.il +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/phy/marvell10g.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/phy/marvell10g.c b/drivers/net/phy/marvell10g.c +index b6fea119fe13..2b7d0720720b 100644 +--- a/drivers/net/phy/marvell10g.c ++++ b/drivers/net/phy/marvell10g.c +@@ -880,7 +880,7 @@ static int mv3310_read_status_copper(struct phy_device *phydev) + + cssr1 = phy_read_mmd(phydev, MDIO_MMD_PCS, MV_PCS_CSSR1); + if (cssr1 < 0) +- return val; ++ return cssr1; + + /* If the link settings are not resolved, mark the link down */ + if (!(cssr1 & MV_PCS_CSSR1_RESOLVED)) { +-- +2.35.1 + diff --git a/queue-5.17/net-smc-sync-err-code-when-tcp-connection-was-refuse.patch b/queue-5.17/net-smc-sync-err-code-when-tcp-connection-was-refuse.patch new file mode 100644 index 00000000000..98ebed4fc97 --- /dev/null +++ b/queue-5.17/net-smc-sync-err-code-when-tcp-connection-was-refuse.patch @@ -0,0 +1,41 @@ +From cd9e669cdb8d92a27e70135d5487629d6791be9c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Apr 2022 17:40:27 +0800 +Subject: net/smc: sync err code when tcp connection was refused + +From: liuyacan + +[ Upstream commit 4e2e65e2e56c6ceb4ea1719360080c0af083229e ] + +In the current implementation, when TCP initiates a connection +to an unavailable [ip,port], ECONNREFUSED will be stored in the +TCP socket, but SMC will not. However, some apps (like curl) use +getsockopt(,,SO_ERROR,,) to get the error information, which makes +them miss the error message and behave strangely. + +Fixes: 50717a37db03 ("net/smc: nonblocking connect rework") +Signed-off-by: liuyacan +Reviewed-by: Tony Lu +Acked-by: Karsten Graul +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/smc/af_smc.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c +index 68cd110722a4..fd9d9cfd0f3d 100644 +--- a/net/smc/af_smc.c ++++ b/net/smc/af_smc.c +@@ -1357,6 +1357,8 @@ static void smc_connect_work(struct work_struct *work) + smc->sk.sk_state = SMC_CLOSED; + if (rc == -EPIPE || rc == -EAGAIN) + smc->sk.sk_err = EPIPE; ++ else if (rc == -ECONNREFUSED) ++ smc->sk.sk_err = ECONNREFUSED; + else if (signal_pending(current)) + smc->sk.sk_err = -sock_intr_errno(timeo); + sock_put(&smc->sk); /* passive closing */ +-- +2.35.1 + diff --git a/queue-5.17/netfilter-conntrack-fix-udp-offload-timeout-sysctl.patch b/queue-5.17/netfilter-conntrack-fix-udp-offload-timeout-sysctl.patch new file mode 100644 index 00000000000..0b4b15ee6a0 --- /dev/null +++ b/queue-5.17/netfilter-conntrack-fix-udp-offload-timeout-sysctl.patch @@ -0,0 +1,45 @@ +From 0dd5c7bd79fc3b19d458cec194a9cd4e727c3599 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Apr 2022 14:09:00 +0300 +Subject: netfilter: conntrack: fix udp offload timeout sysctl + +From: Volodymyr Mytnyk + +[ Upstream commit 626873c446f7559d5af8b48cefad903ffd85cf4e ] + +`nf_flowtable_udp_timeout` sysctl option is available only +if CONFIG_NFT_FLOW_OFFLOAD enabled. But infra for this flow +offload UDP timeout was added under CONFIG_NF_FLOW_TABLE +config option. So, if you have CONFIG_NFT_FLOW_OFFLOAD +disabled and CONFIG_NF_FLOW_TABLE enabled, the +`nf_flowtable_udp_timeout` is not present in sysfs. +Please note, that TCP flow offload timeout sysctl option +is present even CONFIG_NFT_FLOW_OFFLOAD is disabled. + +I suppose it was a typo in commit that adds UDP flow offload +timeout and CONFIG_NF_FLOW_TABLE should be used instead. + +Fixes: 975c57504da1 ("netfilter: conntrack: Introduce udp offload timeout configuration") +Signed-off-by: Volodymyr Mytnyk +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_conntrack_standalone.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/netfilter/nf_conntrack_standalone.c b/net/netfilter/nf_conntrack_standalone.c +index 3e1afd10a9b6..55aa55b252b2 100644 +--- a/net/netfilter/nf_conntrack_standalone.c ++++ b/net/netfilter/nf_conntrack_standalone.c +@@ -823,7 +823,7 @@ static struct ctl_table nf_ct_sysctl_table[] = { + .mode = 0644, + .proc_handler = proc_dointvec_jiffies, + }, +-#if IS_ENABLED(CONFIG_NFT_FLOW_OFFLOAD) ++#if IS_ENABLED(CONFIG_NF_FLOW_TABLE) + [NF_SYSCTL_CT_PROTO_TIMEOUT_UDP_OFFLOAD] = { + .procname = "nf_flowtable_udp_timeout", + .maxlen = sizeof(unsigned int), +-- +2.35.1 + diff --git a/queue-5.17/netfilter-nf_conntrack_tcp-re-init-for-syn-packets-o.patch b/queue-5.17/netfilter-nf_conntrack_tcp-re-init-for-syn-packets-o.patch new file mode 100644 index 00000000000..f63a24f6a63 --- /dev/null +++ b/queue-5.17/netfilter-nf_conntrack_tcp-re-init-for-syn-packets-o.patch @@ -0,0 +1,100 @@ +From fc402e572f9d62c9e7eea784056396a123d99d57 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Apr 2022 11:47:11 +0200 +Subject: netfilter: nf_conntrack_tcp: re-init for syn packets only + +From: Florian Westphal + +[ Upstream commit c7aab4f17021b636a0ee75bcf28e06fb7c94ab48 ] + +Jaco Kroon reported tcp problems that Eric Dumazet and Neal Cardwell +pinpointed to nf_conntrack tcp_in_window() bug. + +tcp trace shows following sequence: + +I > R Flags [S], seq 3451342529, win 62580, options [.. tfo [|tcp]> +R > I Flags [S.], seq 2699962254, ack 3451342530, win 65535, options [..] +R > I Flags [P.], seq 1:89, ack 1, [..] + +Note 3rd ACK is from responder to initiator so following branch is taken: + } else if (((state->state == TCP_CONNTRACK_SYN_SENT + && dir == IP_CT_DIR_ORIGINAL) + || (state->state == TCP_CONNTRACK_SYN_RECV + && dir == IP_CT_DIR_REPLY)) + && after(end, sender->td_end)) { + +... because state == TCP_CONNTRACK_SYN_RECV and dir is REPLY. +This causes the scaling factor to be reset to 0: window scale option +is only present in syn(ack) packets. This in turn makes nf_conntrack +mark valid packets as out-of-window. + +This was always broken, it exists even in original commit where +window tracking was added to ip_conntrack (nf_conntrack predecessor) +in 2.6.9-rc1 kernel. + +Restrict to 'tcph->syn', just like the 3rd condtional added in +commit 82b72cb94666 ("netfilter: conntrack: re-init state for retransmitted syn-ack"). + +Upon closer look, those conditionals/branches can be merged: + +Because earlier checks prevent syn-ack from showing up in +original direction, the 'dir' checks in the conditional quoted above are +redundant, remove them. Return early for pure syn retransmitted in reply +direction (simultaneous open). + +Fixes: 9fb9cbb1082d ("[NETFILTER]: Add nf_conntrack subsystem.") +Reported-by: Jaco Kroon +Signed-off-by: Florian Westphal +Acked-by: Jozsef Kadlecsik +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_conntrack_proto_tcp.c | 21 ++++++--------------- + 1 file changed, 6 insertions(+), 15 deletions(-) + +diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c +index 8ec55cd72572..204a5cdff5b1 100644 +--- a/net/netfilter/nf_conntrack_proto_tcp.c ++++ b/net/netfilter/nf_conntrack_proto_tcp.c +@@ -556,24 +556,14 @@ static bool tcp_in_window(struct nf_conn *ct, + } + + } +- } else if (((state->state == TCP_CONNTRACK_SYN_SENT +- && dir == IP_CT_DIR_ORIGINAL) +- || (state->state == TCP_CONNTRACK_SYN_RECV +- && dir == IP_CT_DIR_REPLY)) +- && after(end, sender->td_end)) { ++ } else if (tcph->syn && ++ after(end, sender->td_end) && ++ (state->state == TCP_CONNTRACK_SYN_SENT || ++ state->state == TCP_CONNTRACK_SYN_RECV)) { + /* + * RFC 793: "if a TCP is reinitialized ... then it need + * not wait at all; it must only be sure to use sequence + * numbers larger than those recently used." +- */ +- sender->td_end = +- sender->td_maxend = end; +- sender->td_maxwin = (win == 0 ? 1 : win); +- +- tcp_options(skb, dataoff, tcph, sender); +- } else if (tcph->syn && dir == IP_CT_DIR_REPLY && +- state->state == TCP_CONNTRACK_SYN_SENT) { +- /* Retransmitted syn-ack, or syn (simultaneous open). + * + * Re-init state for this direction, just like for the first + * syn(-ack) reply, it might differ in seq, ack or tcp options. +@@ -581,7 +571,8 @@ static bool tcp_in_window(struct nf_conn *ct, + tcp_init_sender(sender, receiver, + skb, dataoff, tcph, + end, win); +- if (!tcph->ack) ++ ++ if (dir == IP_CT_DIR_REPLY && !tcph->ack) + return true; + } + +-- +2.35.1 + diff --git a/queue-5.17/netfilter-nft_set_rbtree-overlap-detection-with-elem.patch b/queue-5.17/netfilter-nft_set_rbtree-overlap-detection-with-elem.patch new file mode 100644 index 00000000000..902678cb583 --- /dev/null +++ b/queue-5.17/netfilter-nft_set_rbtree-overlap-detection-with-elem.patch @@ -0,0 +1,49 @@ +From 0910e7bff39538e2d1f55ad782085abf797d919a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Apr 2022 12:21:05 +0200 +Subject: netfilter: nft_set_rbtree: overlap detection with element re-addition + after deletion + +From: Pablo Neira Ayuso + +[ Upstream commit babc3dc9524f0bcb5a0ec61f3c3639b11508fad6 ] + +This patch fixes spurious EEXIST errors. + +Extend d2df92e98a34 ("netfilter: nft_set_rbtree: handle element +re-addition after deletion") to deal with elements with same end flags +in the same transation. + +Reset the overlap flag as described by 7c84d41416d8 ("netfilter: +nft_set_rbtree: Detect partial overlaps on insertion"). + +Fixes: 7c84d41416d8 ("netfilter: nft_set_rbtree: Detect partial overlaps on insertion") +Fixes: d2df92e98a34 ("netfilter: nft_set_rbtree: handle element re-addition after deletion") +Signed-off-by: Pablo Neira Ayuso +Reviewed-by: Stefano Brivio +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nft_set_rbtree.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/net/netfilter/nft_set_rbtree.c b/net/netfilter/nft_set_rbtree.c +index d600a566da32..7325bee7d144 100644 +--- a/net/netfilter/nft_set_rbtree.c ++++ b/net/netfilter/nft_set_rbtree.c +@@ -349,7 +349,11 @@ static int __nft_rbtree_insert(const struct net *net, const struct nft_set *set, + *ext = &rbe->ext; + return -EEXIST; + } else { +- p = &parent->rb_left; ++ overlap = false; ++ if (nft_rbtree_interval_end(rbe)) ++ p = &parent->rb_left; ++ else ++ p = &parent->rb_right; + } + } + +-- +2.35.1 + diff --git a/queue-5.17/perf-arm-spe-fix-addresses-of-synthesized-spe-events.patch b/queue-5.17/perf-arm-spe-fix-addresses-of-synthesized-spe-events.patch new file mode 100644 index 00000000000..5b771cf9185 --- /dev/null +++ b/queue-5.17/perf-arm-spe-fix-addresses-of-synthesized-spe-events.patch @@ -0,0 +1,54 @@ +From b31d1c8847017e82560c6c806098e7970a13ac61 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Apr 2022 17:52:03 +0100 +Subject: perf arm-spe: Fix addresses of synthesized SPE events + +From: Timothy Hayes + +[ Upstream commit 4e13f6706d5aee1a6b835a44f6cf4971a921dcb8 ] + +This patch corrects a bug whereby synthesized events from SPE +samples are missing virtual addresses. + +Fixes: 54f7815efef7fad9 ("perf arm-spe: Fill address info for samples") +Reviewed-by: Leo Yan +Signed-off-by: Timothy Hayes +Cc: Alexander Shishkin +Cc: bpf@vger.kernel.org +Cc: Jiri Olsa +Cc: John Fastabend +Cc: John Garry +Cc: KP Singh +Cc: Leo Yan +Cc: linux-arm-kernel@lists.infradead.org +Cc: Mark Rutland +Cc: Martin KaFai Lau +Cc: Mathieu Poirier +Cc: Namhyung Kim +Cc: netdev@vger.kernel.org +Cc: Song Liu +Cc: Will Deacon +Cc: Yonghong Song +Link: https://lore.kernel.org/r/20220421165205.117662-2-timothy.hayes@arm.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/arm-spe.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/perf/util/arm-spe.c b/tools/perf/util/arm-spe.c +index d2b64e3f588b..151cc38a171c 100644 +--- a/tools/perf/util/arm-spe.c ++++ b/tools/perf/util/arm-spe.c +@@ -1036,7 +1036,7 @@ arm_spe_synth_events(struct arm_spe *spe, struct perf_session *session) + attr.sample_type = evsel->core.attr.sample_type & PERF_SAMPLE_MASK; + attr.sample_type |= PERF_SAMPLE_IP | PERF_SAMPLE_TID | + PERF_SAMPLE_PERIOD | PERF_SAMPLE_DATA_SRC | +- PERF_SAMPLE_WEIGHT; ++ PERF_SAMPLE_WEIGHT | PERF_SAMPLE_ADDR; + if (spe->timeless_decoding) + attr.sample_type &= ~(u64)PERF_SAMPLE_TIME; + else +-- +2.35.1 + diff --git a/queue-5.17/phy-amlogic-fix-error-path-in-phy_g12a_usb3_pcie_pro.patch b/queue-5.17/phy-amlogic-fix-error-path-in-phy_g12a_usb3_pcie_pro.patch new file mode 100644 index 00000000000..32f16e29758 --- /dev/null +++ b/queue-5.17/phy-amlogic-fix-error-path-in-phy_g12a_usb3_pcie_pro.patch @@ -0,0 +1,73 @@ +From 14cff6577afde6a69d5d22e813eb2c480e0f9e52 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Apr 2022 16:03:10 +0200 +Subject: phy: amlogic: fix error path in phy_g12a_usb3_pcie_probe() + +From: Heiner Kallweit + +[ Upstream commit 2c8045d48dee703ad8eab2be7d6547765a89c069 ] + +If clk_prepare_enable() fails we call clk_disable_unprepare() +in the error path what results in a warning that the clock +is disabled and unprepared already. +And if we fail later in phy_g12a_usb3_pcie_probe() then we +bail out w/o calling clk_disable_unprepare(). +This patch fixes both errors. + +Fixes: 36077e16c050 ("phy: amlogic: Add Amlogic G12A USB3 + PCIE Combo PHY Driver") +Signed-off-by: Heiner Kallweit +Link: https://lore.kernel.org/r/8e416f95-1084-ee28-860e-7884f7fa2e32@gmail.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + .../phy/amlogic/phy-meson-g12a-usb3-pcie.c | 20 +++++++++++-------- + 1 file changed, 12 insertions(+), 8 deletions(-) + +diff --git a/drivers/phy/amlogic/phy-meson-g12a-usb3-pcie.c b/drivers/phy/amlogic/phy-meson-g12a-usb3-pcie.c +index 5b471ab80fe2..54d65a6f0fcc 100644 +--- a/drivers/phy/amlogic/phy-meson-g12a-usb3-pcie.c ++++ b/drivers/phy/amlogic/phy-meson-g12a-usb3-pcie.c +@@ -414,19 +414,19 @@ static int phy_g12a_usb3_pcie_probe(struct platform_device *pdev) + + ret = clk_prepare_enable(priv->clk_ref); + if (ret) +- goto err_disable_clk_ref; ++ return ret; + + priv->reset = devm_reset_control_array_get_exclusive(dev); +- if (IS_ERR(priv->reset)) +- return PTR_ERR(priv->reset); ++ if (IS_ERR(priv->reset)) { ++ ret = PTR_ERR(priv->reset); ++ goto err_disable_clk_ref; ++ } + + priv->phy = devm_phy_create(dev, np, &phy_g12a_usb3_pcie_ops); + if (IS_ERR(priv->phy)) { + ret = PTR_ERR(priv->phy); +- if (ret != -EPROBE_DEFER) +- dev_err(dev, "failed to create PHY\n"); +- +- return ret; ++ dev_err_probe(dev, ret, "failed to create PHY\n"); ++ goto err_disable_clk_ref; + } + + phy_set_drvdata(priv->phy, priv); +@@ -434,8 +434,12 @@ static int phy_g12a_usb3_pcie_probe(struct platform_device *pdev) + + phy_provider = devm_of_phy_provider_register(dev, + phy_g12a_usb3_pcie_xlate); ++ if (IS_ERR(phy_provider)) { ++ ret = PTR_ERR(phy_provider); ++ goto err_disable_clk_ref; ++ } + +- return PTR_ERR_OR_ZERO(phy_provider); ++ return 0; + + err_disable_clk_ref: + clk_disable_unprepare(priv->clk_ref); +-- +2.35.1 + diff --git a/queue-5.17/phy-mapphone-mdm6600-fix-pm-error-handling-in-phy_md.patch b/queue-5.17/phy-mapphone-mdm6600-fix-pm-error-handling-in-phy_md.patch new file mode 100644 index 00000000000..67c5b788805 --- /dev/null +++ b/queue-5.17/phy-mapphone-mdm6600-fix-pm-error-handling-in-phy_md.patch @@ -0,0 +1,46 @@ +From 922ca306081965143afc7b3cb008a7ef970445e4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Mar 2022 02:46:11 +0000 +Subject: phy: mapphone-mdm6600: Fix PM error handling in phy_mdm6600_probe + +From: Miaoqian Lin + +[ Upstream commit d644e0d79829b1b9a14beedbdb0dc1256fc3677d ] + +The pm_runtime_enable will increase power disable depth. +If the probe fails, we should use pm_runtime_disable() to balance +pm_runtime_enable(). And use pm_runtime_dont_use_autosuspend() to +undo pm_runtime_use_autosuspend() +In the PM Runtime docs: + Drivers in ->remove() callback should undo the runtime PM changes done + in ->probe(). Usually this means calling pm_runtime_disable(), + pm_runtime_dont_use_autosuspend() etc. + +We should do this in error handling. + +Fixes: f7f50b2a7b05 ("phy: mapphone-mdm6600: Add runtime PM support for n_gsm on USB suspend") +Signed-off-by: Miaoqian Lin +Link: https://lore.kernel.org/r/20220301024615.31899-1-linmq006@gmail.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/motorola/phy-mapphone-mdm6600.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/phy/motorola/phy-mapphone-mdm6600.c b/drivers/phy/motorola/phy-mapphone-mdm6600.c +index 5172971f4c36..3cd4d51c247c 100644 +--- a/drivers/phy/motorola/phy-mapphone-mdm6600.c ++++ b/drivers/phy/motorola/phy-mapphone-mdm6600.c +@@ -629,7 +629,8 @@ static int phy_mdm6600_probe(struct platform_device *pdev) + cleanup: + if (error < 0) + phy_mdm6600_device_power_off(ddata); +- ++ pm_runtime_disable(ddata->dev); ++ pm_runtime_dont_use_autosuspend(ddata->dev); + return error; + } + +-- +2.35.1 + diff --git a/queue-5.17/phy-samsung-exynos5250-sata-fix-missing-device-put-i.patch b/queue-5.17/phy-samsung-exynos5250-sata-fix-missing-device-put-i.patch new file mode 100644 index 00000000000..17da2e532ae --- /dev/null +++ b/queue-5.17/phy-samsung-exynos5250-sata-fix-missing-device-put-i.patch @@ -0,0 +1,77 @@ +From e9e60ca6eab61c3875fc9812d4407b22d50fb897 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Apr 2022 11:18:57 +0200 +Subject: phy: samsung: exynos5250-sata: fix missing device put in probe error + paths + +From: Krzysztof Kozlowski + +[ Upstream commit 5c8402c4db45dd55c2c93c8d730f5dfa7c78a702 ] + +The actions of of_find_i2c_device_by_node() in probe function should be +reversed in error paths by putting the reference to obtained device. + +Fixes: bcff4cba41bc ("PHY: Exynos: Add Exynos5250 SATA PHY driver") +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Alim Akhtar +Link: https://lore.kernel.org/r/20220407091857.230386-2-krzysztof.kozlowski@linaro.org +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/samsung/phy-exynos5250-sata.c | 20 ++++++++++++++------ + 1 file changed, 14 insertions(+), 6 deletions(-) + +diff --git a/drivers/phy/samsung/phy-exynos5250-sata.c b/drivers/phy/samsung/phy-exynos5250-sata.c +index 6c305a3fe187..595adba5fb8f 100644 +--- a/drivers/phy/samsung/phy-exynos5250-sata.c ++++ b/drivers/phy/samsung/phy-exynos5250-sata.c +@@ -196,20 +196,21 @@ static int exynos_sata_phy_probe(struct platform_device *pdev) + sata_phy->phyclk = devm_clk_get(dev, "sata_phyctrl"); + if (IS_ERR(sata_phy->phyclk)) { + dev_err(dev, "failed to get clk for PHY\n"); +- return PTR_ERR(sata_phy->phyclk); ++ ret = PTR_ERR(sata_phy->phyclk); ++ goto put_dev; + } + + ret = clk_prepare_enable(sata_phy->phyclk); + if (ret < 0) { + dev_err(dev, "failed to enable source clk\n"); +- return ret; ++ goto put_dev; + } + + sata_phy->phy = devm_phy_create(dev, NULL, &exynos_sata_phy_ops); + if (IS_ERR(sata_phy->phy)) { +- clk_disable_unprepare(sata_phy->phyclk); + dev_err(dev, "failed to create PHY\n"); +- return PTR_ERR(sata_phy->phy); ++ ret = PTR_ERR(sata_phy->phy); ++ goto clk_disable; + } + + phy_set_drvdata(sata_phy->phy, sata_phy); +@@ -217,11 +218,18 @@ static int exynos_sata_phy_probe(struct platform_device *pdev) + phy_provider = devm_of_phy_provider_register(dev, + of_phy_simple_xlate); + if (IS_ERR(phy_provider)) { +- clk_disable_unprepare(sata_phy->phyclk); +- return PTR_ERR(phy_provider); ++ ret = PTR_ERR(phy_provider); ++ goto clk_disable; + } + + return 0; ++ ++clk_disable: ++ clk_disable_unprepare(sata_phy->phyclk); ++put_dev: ++ put_device(&sata_phy->client->dev); ++ ++ return ret; + } + + static const struct of_device_id exynos_sata_phy_of_match[] = { +-- +2.35.1 + diff --git a/queue-5.17/phy-samsung-fix-missing-of_node_put-in-exynos_sata_p.patch b/queue-5.17/phy-samsung-fix-missing-of_node_put-in-exynos_sata_p.patch new file mode 100644 index 00000000000..b04795dffda --- /dev/null +++ b/queue-5.17/phy-samsung-fix-missing-of_node_put-in-exynos_sata_p.patch @@ -0,0 +1,38 @@ +From 264d23131767b5144fd2a44d2bb8ba1dc8cb3469 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Apr 2022 11:18:56 +0200 +Subject: phy: samsung: Fix missing of_node_put() in exynos_sata_phy_probe + +From: Miaoqian Lin + +[ Upstream commit 388ec8f079f2f20d5cd183c3bc6f33cbc3ffd3ef ] + +The device_node pointer is returned by of_parse_phandle() with refcount +incremented. We should use of_node_put() on it when done. + +Fixes: bcff4cba41bc ("PHY: Exynos: Add Exynos5250 SATA PHY driver") +Signed-off-by: Miaoqian Lin +Reviewed-by: Krzysztof Kozlowski +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20220407091857.230386-1-krzysztof.kozlowski@linaro.org +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/samsung/phy-exynos5250-sata.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/phy/samsung/phy-exynos5250-sata.c b/drivers/phy/samsung/phy-exynos5250-sata.c +index 9ec234243f7c..6c305a3fe187 100644 +--- a/drivers/phy/samsung/phy-exynos5250-sata.c ++++ b/drivers/phy/samsung/phy-exynos5250-sata.c +@@ -187,6 +187,7 @@ static int exynos_sata_phy_probe(struct platform_device *pdev) + return -EINVAL; + + sata_phy->client = of_find_i2c_device_by_node(node); ++ of_node_put(node); + if (!sata_phy->client) + return -EPROBE_DEFER; + +-- +2.35.1 + diff --git a/queue-5.17/phy-ti-add-missing-pm_runtime_disable-in-serdes_am65.patch b/queue-5.17/phy-ti-add-missing-pm_runtime_disable-in-serdes_am65.patch new file mode 100644 index 00000000000..93357876b1b --- /dev/null +++ b/queue-5.17/phy-ti-add-missing-pm_runtime_disable-in-serdes_am65.patch @@ -0,0 +1,39 @@ +From e0e85e38d8bf68ee68d3882f5d94b27e3acef42f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Mar 2022 02:58:49 +0000 +Subject: phy: ti: Add missing pm_runtime_disable() in serdes_am654_probe + +From: Miaoqian Lin + +[ Upstream commit ce88613e5bd579478653a028291098143f2a5bdf ] + +The pm_runtime_enable() will increase power disable depth. +If the probe fails, we should use pm_runtime_disable() to balance +pm_runtime_enable(). +Add missing pm_runtime_disable() for serdes_am654_probe(). + +Fixes: 71e2f5c5c224 ("phy: ti: Add a new SERDES driver for TI's AM654x SoC") +Signed-off-by: Miaoqian Lin +Link: https://lore.kernel.org/r/20220301025853.1911-1-linmq006@gmail.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/ti/phy-am654-serdes.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/phy/ti/phy-am654-serdes.c b/drivers/phy/ti/phy-am654-serdes.c +index c1211c4f863c..0be727bb9f79 100644 +--- a/drivers/phy/ti/phy-am654-serdes.c ++++ b/drivers/phy/ti/phy-am654-serdes.c +@@ -838,7 +838,7 @@ static int serdes_am654_probe(struct platform_device *pdev) + + clk_err: + of_clk_del_provider(node); +- ++ pm_runtime_disable(dev); + return ret; + } + +-- +2.35.1 + diff --git a/queue-5.17/phy-ti-omap-usb2-fix-error-handling-in-omap_usb2_ena.patch b/queue-5.17/phy-ti-omap-usb2-fix-error-handling-in-omap_usb2_ena.patch new file mode 100644 index 00000000000..91872c4ec37 --- /dev/null +++ b/queue-5.17/phy-ti-omap-usb2-fix-error-handling-in-omap_usb2_ena.patch @@ -0,0 +1,38 @@ +From 7ae66a0e5db3104b9bc5b56e1a1470f56ac19957 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Mar 2022 10:57:46 +0000 +Subject: phy: ti: omap-usb2: Fix error handling in omap_usb2_enable_clocks + +From: Miaoqian Lin + +[ Upstream commit 3588060befff75ff39fab7122b94c6fb3148fcda ] + +The corresponding API for clk_prepare_enable is clk_disable_unprepare. +Make sure that the clock is unprepared on exit by changing clk_disable +to clk_disable_unprepare. + +Fixes: ed31ee7cf1fe ("phy: ti: usb2: Fix logic on -EPROBE_DEFER") +Signed-off-by: Miaoqian Lin +Link: https://lore.kernel.org/r/20220318105748.19532-1-linmq006@gmail.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/ti/phy-omap-usb2.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/phy/ti/phy-omap-usb2.c b/drivers/phy/ti/phy-omap-usb2.c +index 3a505fe5715a..31a775877f6e 100644 +--- a/drivers/phy/ti/phy-omap-usb2.c ++++ b/drivers/phy/ti/phy-omap-usb2.c +@@ -215,7 +215,7 @@ static int omap_usb2_enable_clocks(struct omap_usb *phy) + return 0; + + err1: +- clk_disable(phy->wkupclk); ++ clk_disable_unprepare(phy->wkupclk); + + err0: + return ret; +-- +2.35.1 + diff --git a/queue-5.17/pinctrl-mediatek-moore-fix-build-error.patch b/queue-5.17/pinctrl-mediatek-moore-fix-build-error.patch new file mode 100644 index 00000000000..6f486b53525 --- /dev/null +++ b/queue-5.17/pinctrl-mediatek-moore-fix-build-error.patch @@ -0,0 +1,42 @@ +From 9bcda1390ce81aff995ade77bc5c48558bd9ffc4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 9 Apr 2022 18:59:58 +0800 +Subject: pinctrl: mediatek: moore: Fix build error + +From: YueHaibing + +[ Upstream commit 87950929e2ff2236207bdbe14bff8230558b541b ] + +If EINT_MTK is m and PINCTRL_MTK_V2 is y, build fails: + +drivers/pinctrl/mediatek/pinctrl-moore.o: In function `mtk_gpio_set_config': +pinctrl-moore.c:(.text+0xa6c): undefined reference to `mtk_eint_set_debounce' +drivers/pinctrl/mediatek/pinctrl-moore.o: In function `mtk_gpio_to_irq': +pinctrl-moore.c:(.text+0xacc): undefined reference to `mtk_eint_find_irq' + +Select EINT_MTK for PINCTRL_MTK_V2 to fix this. + +Fixes: 8174a8512e3e ("pinctrl: mediatek: make MediaTek pinctrl v2 driver ready for buidling loadable module") +Signed-off-by: YueHaibing +Link: https://lore.kernel.org/r/20220409105958.37412-1-yuehaibing@huawei.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/mediatek/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/pinctrl/mediatek/Kconfig b/drivers/pinctrl/mediatek/Kconfig +index 66db4ac5d169..c7fa1525e42a 100644 +--- a/drivers/pinctrl/mediatek/Kconfig ++++ b/drivers/pinctrl/mediatek/Kconfig +@@ -30,6 +30,7 @@ config PINCTRL_MTK_MOORE + select GENERIC_PINMUX_FUNCTIONS + select GPIOLIB + select OF_GPIO ++ select EINT_MTK + select PINCTRL_MTK_V2 + + config PINCTRL_MTK_PARIS +-- +2.35.1 + diff --git a/queue-5.17/pinctrl-pistachio-fix-use-of-irq_of_parse_and_map.patch b/queue-5.17/pinctrl-pistachio-fix-use-of-irq_of_parse_and_map.patch new file mode 100644 index 00000000000..55d5c982af9 --- /dev/null +++ b/queue-5.17/pinctrl-pistachio-fix-use-of-irq_of_parse_and_map.patch @@ -0,0 +1,43 @@ +From bc94114fb328a4cf307631d52db2493964caff65 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 24 Apr 2022 03:14:30 +0000 +Subject: pinctrl: pistachio: fix use of irq_of_parse_and_map() + +From: Lv Ruyi + +[ Upstream commit 0c9843a74a85224a89daa81fa66891dae2f930e1 ] + +The irq_of_parse_and_map() function returns 0 on failure, and does not +return an negative value. + +Fixes: cefc03e5995e ("pinctrl: Add Pistachio SoC pin control driver") +Reported-by: Zeal Robot +Signed-off-by: Lv Ruyi +Link: https://lore.kernel.org/r/20220424031430.3170759-1-lv.ruyi@zte.com.cn +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/pinctrl-pistachio.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/pinctrl/pinctrl-pistachio.c b/drivers/pinctrl/pinctrl-pistachio.c +index 8d271c6b0ca4..5de691c630b4 100644 +--- a/drivers/pinctrl/pinctrl-pistachio.c ++++ b/drivers/pinctrl/pinctrl-pistachio.c +@@ -1374,10 +1374,10 @@ static int pistachio_gpio_register(struct pistachio_pinctrl *pctl) + } + + irq = irq_of_parse_and_map(child, 0); +- if (irq < 0) { +- dev_err(pctl->dev, "No IRQ for bank %u: %d\n", i, irq); ++ if (!irq) { ++ dev_err(pctl->dev, "No IRQ for bank %u\n", i); + of_node_put(child); +- ret = irq; ++ ret = -EINVAL; + goto err; + } + +-- +2.35.1 + diff --git a/queue-5.17/pinctrl-qcom-sm6350-fix-order-of-ufs-sdc-pins.patch b/queue-5.17/pinctrl-qcom-sm6350-fix-order-of-ufs-sdc-pins.patch new file mode 100644 index 00000000000..7058444d69e --- /dev/null +++ b/queue-5.17/pinctrl-qcom-sm6350-fix-order-of-ufs-sdc-pins.patch @@ -0,0 +1,51 @@ +From 109833269e456e24273348dd8a30e4b670dd0a5c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Mar 2022 19:30:02 +0100 +Subject: pinctrl: qcom: sm6350: fix order of UFS & SDC pins + +From: Luca Weiss + +[ Upstream commit ef0beba1a5fb0c693ddf7d31246bd96c925ffd00 ] + +In other places the SDC and UFS pins have been swapped but this was +missed in the PINCTRL_PIN definitions. Fix that. + +Fixes: 7d74b55afd27 ("pinctrl: qcom: Add SM6350 pinctrl driver") +Signed-off-by: Luca Weiss +Link: https://lore.kernel.org/r/20220318183004.858707-5-luca.weiss@fairphone.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/qcom/pinctrl-sm6350.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/drivers/pinctrl/qcom/pinctrl-sm6350.c b/drivers/pinctrl/qcom/pinctrl-sm6350.c +index 4d37b817b232..a91a86628f2f 100644 +--- a/drivers/pinctrl/qcom/pinctrl-sm6350.c ++++ b/drivers/pinctrl/qcom/pinctrl-sm6350.c +@@ -264,14 +264,14 @@ static const struct pinctrl_pin_desc sm6350_pins[] = { + PINCTRL_PIN(153, "GPIO_153"), + PINCTRL_PIN(154, "GPIO_154"), + PINCTRL_PIN(155, "GPIO_155"), +- PINCTRL_PIN(156, "SDC1_RCLK"), +- PINCTRL_PIN(157, "SDC1_CLK"), +- PINCTRL_PIN(158, "SDC1_CMD"), +- PINCTRL_PIN(159, "SDC1_DATA"), +- PINCTRL_PIN(160, "SDC2_CLK"), +- PINCTRL_PIN(161, "SDC2_CMD"), +- PINCTRL_PIN(162, "SDC2_DATA"), +- PINCTRL_PIN(163, "UFS_RESET"), ++ PINCTRL_PIN(156, "UFS_RESET"), ++ PINCTRL_PIN(157, "SDC1_RCLK"), ++ PINCTRL_PIN(158, "SDC1_CLK"), ++ PINCTRL_PIN(159, "SDC1_CMD"), ++ PINCTRL_PIN(160, "SDC1_DATA"), ++ PINCTRL_PIN(161, "SDC2_CLK"), ++ PINCTRL_PIN(162, "SDC2_CMD"), ++ PINCTRL_PIN(163, "SDC2_DATA"), + }; + + #define DECLARE_MSM_GPIO_PINS(pin) \ +-- +2.35.1 + diff --git a/queue-5.17/pinctrl-rockchip-fix-rk3308-pinmux-bits.patch b/queue-5.17/pinctrl-rockchip-fix-rk3308-pinmux-bits.patch new file mode 100644 index 00000000000..49d49f555c8 --- /dev/null +++ b/queue-5.17/pinctrl-rockchip-fix-rk3308-pinmux-bits.patch @@ -0,0 +1,162 @@ +From 622ab70d2703bbb865c00920ef18d2f8b86c6b14 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Apr 2022 16:24:31 +0200 +Subject: pinctrl: rockchip: fix RK3308 pinmux bits + +From: Luca Ceresoli + +[ Upstream commit 1f3e25a068832f8892a5ff71467622d012f5bc9f ] + +Some of the pinmuxing bits described in rk3308_mux_recalced_data are wrong, +pointing to non-existing registers. + +Fix the entire table. + +Also add a comment in front of each entry with the same string that appears +in the datasheet to make the table easier to compare with the docs. + +This fix has been tested on real hardware for the gpio3b3_sel entry. + +Fixes: 7825aeb7b208 ("pinctrl: rockchip: add rk3308 SoC support") +Signed-off-by: Luca Ceresoli +Reviewed-by: Heiko Stuebner +Link: https://lore.kernel.org/r/20220420142432.248565-1-luca.ceresoli@bootlin.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/pinctrl-rockchip.c | 45 ++++++++++++++++++++---------- + 1 file changed, 30 insertions(+), 15 deletions(-) + +diff --git a/drivers/pinctrl/pinctrl-rockchip.c b/drivers/pinctrl/pinctrl-rockchip.c +index a1b598b86aa9..65fa305b5f59 100644 +--- a/drivers/pinctrl/pinctrl-rockchip.c ++++ b/drivers/pinctrl/pinctrl-rockchip.c +@@ -457,95 +457,110 @@ static struct rockchip_mux_recalced_data rk3128_mux_recalced_data[] = { + + static struct rockchip_mux_recalced_data rk3308_mux_recalced_data[] = { + { ++ /* gpio1b6_sel */ + .num = 1, + .pin = 14, + .reg = 0x28, + .bit = 12, + .mask = 0xf + }, { ++ /* gpio1b7_sel */ + .num = 1, + .pin = 15, + .reg = 0x2c, + .bit = 0, + .mask = 0x3 + }, { ++ /* gpio1c2_sel */ + .num = 1, + .pin = 18, + .reg = 0x30, + .bit = 4, + .mask = 0xf + }, { ++ /* gpio1c3_sel */ + .num = 1, + .pin = 19, + .reg = 0x30, + .bit = 8, + .mask = 0xf + }, { ++ /* gpio1c4_sel */ + .num = 1, + .pin = 20, + .reg = 0x30, + .bit = 12, + .mask = 0xf + }, { ++ /* gpio1c5_sel */ + .num = 1, + .pin = 21, + .reg = 0x34, + .bit = 0, + .mask = 0xf + }, { ++ /* gpio1c6_sel */ + .num = 1, + .pin = 22, + .reg = 0x34, + .bit = 4, + .mask = 0xf + }, { ++ /* gpio1c7_sel */ + .num = 1, + .pin = 23, + .reg = 0x34, + .bit = 8, + .mask = 0xf + }, { ++ /* gpio3b4_sel */ + .num = 3, + .pin = 12, + .reg = 0x68, + .bit = 8, + .mask = 0xf + }, { ++ /* gpio3b5_sel */ + .num = 3, + .pin = 13, + .reg = 0x68, + .bit = 12, + .mask = 0xf + }, { ++ /* gpio2a2_sel */ + .num = 2, + .pin = 2, +- .reg = 0x608, +- .bit = 0, +- .mask = 0x7 ++ .reg = 0x40, ++ .bit = 4, ++ .mask = 0x3 + }, { ++ /* gpio2a3_sel */ + .num = 2, + .pin = 3, +- .reg = 0x608, +- .bit = 4, +- .mask = 0x7 ++ .reg = 0x40, ++ .bit = 6, ++ .mask = 0x3 + }, { ++ /* gpio2c0_sel */ + .num = 2, + .pin = 16, +- .reg = 0x610, +- .bit = 8, +- .mask = 0x7 ++ .reg = 0x50, ++ .bit = 0, ++ .mask = 0x3 + }, { ++ /* gpio3b2_sel */ + .num = 3, + .pin = 10, +- .reg = 0x610, +- .bit = 0, +- .mask = 0x7 ++ .reg = 0x68, ++ .bit = 4, ++ .mask = 0x3 + }, { ++ /* gpio3b3_sel */ + .num = 3, + .pin = 11, +- .reg = 0x610, +- .bit = 4, +- .mask = 0x7 ++ .reg = 0x68, ++ .bit = 6, ++ .mask = 0x3 + }, + }; + +-- +2.35.1 + diff --git a/queue-5.17/pinctrl-stm32-do-not-call-stm32_gpio_get-for-edge-tr.patch b/queue-5.17/pinctrl-stm32-do-not-call-stm32_gpio_get-for-edge-tr.patch new file mode 100644 index 00000000000..e11e412bc77 --- /dev/null +++ b/queue-5.17/pinctrl-stm32-do-not-call-stm32_gpio_get-for-edge-tr.patch @@ -0,0 +1,50 @@ +From f722bca9ef16bbec60bc8e0a776d3702ab985f8c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Apr 2022 23:54:10 +0200 +Subject: pinctrl: stm32: Do not call stm32_gpio_get() for edge triggered IRQs + in EOI + +From: Marek Vasut + +[ Upstream commit e74200ebf7c4f6a7a7d1be9f63833ddba251effa ] + +The stm32_gpio_get() should only be called for LEVEL triggered interrupts, +skip calling it for EDGE triggered interrupts altogether to avoid wasting +CPU cycles in EOI handler. On this platform, EDGE triggered interrupts are +the majority and LEVEL triggered interrupts are the exception no less, and +the CPU cycles are not abundant. + +Fixes: 47beed513a85b ("pinctrl: stm32: Add level interrupt support to gpio irq chip") +Signed-off-by: Marek Vasut +Cc: Alexandre Torgue +Cc: Fabien Dessenne +Cc: Linus Walleij +Cc: Marc Zyngier +Cc: linux-stm32@st-md-mailman.stormreply.com +Cc: linux-arm-kernel@lists.infradead.org +To: linux-gpio@vger.kernel.org +Link: https://lore.kernel.org/r/20220415215410.498349-1-marex@denx.de +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/stm32/pinctrl-stm32.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/pinctrl/stm32/pinctrl-stm32.c b/drivers/pinctrl/stm32/pinctrl-stm32.c +index 9ed764731570..df1d6b466fb7 100644 +--- a/drivers/pinctrl/stm32/pinctrl-stm32.c ++++ b/drivers/pinctrl/stm32/pinctrl-stm32.c +@@ -311,6 +311,10 @@ static void stm32_gpio_irq_trigger(struct irq_data *d) + struct stm32_gpio_bank *bank = d->domain->host_data; + int level; + ++ /* Do not access the GPIO if this is not LEVEL triggered IRQ. */ ++ if (!(bank->irq_type[d->hwirq] & IRQ_TYPE_LEVEL_MASK)) ++ return; ++ + /* If level interrupt type then retrig */ + level = stm32_gpio_get(&bank->gpio_chip, d->hwirq); + if ((level == 0 && bank->irq_type[d->hwirq] == IRQ_TYPE_LEVEL_LOW) || +-- +2.35.1 + diff --git a/queue-5.17/pinctrl-stm32-keep-pinctrl-block-clock-enabled-when-.patch b/queue-5.17/pinctrl-stm32-keep-pinctrl-block-clock-enabled-when-.patch new file mode 100644 index 00000000000..29278e1bea2 --- /dev/null +++ b/queue-5.17/pinctrl-stm32-keep-pinctrl-block-clock-enabled-when-.patch @@ -0,0 +1,140 @@ +From df2e1ecf7fd0b779dff59e4a3cd09548077ab5a9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Apr 2022 16:08:27 +0200 +Subject: pinctrl: stm32: Keep pinctrl block clock enabled when LEVEL IRQ + requested + +From: Marek Vasut + +[ Upstream commit 05d8af449d93e04547b4c6b328e39c890bc803f4 ] + +The current EOI handler for LEVEL triggered interrupts calls clk_enable(), +register IO, clk_disable(). The clock manipulation requires locking which +happens with IRQs disabled in clk_enable_lock(). Instead of turning the +clock on and off all the time, enable the clock in case LEVEL interrupt is +requested and keep the clock enabled until all LEVEL interrupts are freed. +The LEVEL interrupts are an exception on this platform and seldom used, so +this does not affect the common case. + +This simplifies the LEVEL interrupt handling considerably and also fixes +the following splat found when using preempt-rt: + ------------[ cut here ]------------ + WARNING: CPU: 0 PID: 0 at kernel/locking/rtmutex.c:2040 __rt_mutex_trylock+0x37/0x62 + Modules linked in: + CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.10.109-rt65-stable-standard-00068-g6a5afc4b1217 #85 + Hardware name: STM32 (Device Tree Support) + [] (unwind_backtrace) from [] (show_stack+0xb/0xc) + [] (show_stack) from [] (dump_stack+0x6f/0x84) + [] (dump_stack) from [] (__warn+0x7f/0xa4) + [] (__warn) from [] (warn_slowpath_fmt+0x3b/0x74) + [] (warn_slowpath_fmt) from [] (__rt_mutex_trylock+0x37/0x62) + [] (__rt_mutex_trylock) from [] (rt_spin_trylock+0x7/0x16) + [] (rt_spin_trylock) from [] (clk_enable_lock+0xb/0x80) + [] (clk_enable_lock) from [] (clk_core_enable_lock+0x9/0x18) + [] (clk_core_enable_lock) from [] (stm32_gpio_get+0x11/0x24) + [] (stm32_gpio_get) from [] (stm32_gpio_irq_trigger+0x1f/0x48) + [] (stm32_gpio_irq_trigger) from [] (handle_fasteoi_irq+0x71/0xa8) + [] (handle_fasteoi_irq) from [] (generic_handle_irq+0x19/0x22) + [] (generic_handle_irq) from [] (__handle_domain_irq+0x55/0x64) + [] (__handle_domain_irq) from [] (gic_handle_irq+0x53/0x64) + [] (gic_handle_irq) from [] (__irq_svc+0x65/0xc0) + Exception stack(0xc0e01f18 to 0xc0e01f60) + 1f00: 0000300c 00000000 + 1f20: 0000300c c010ff01 00000000 00000000 c0e00000 c0e07714 00000001 c0e01f78 + 1f40: c0e07758 00000000 ef7cd0ff c0e01f68 c010554b c0105542 40000033 ffffffff + [] (__irq_svc) from [] (arch_cpu_idle+0xc/0x1e) + [] (arch_cpu_idle) from [] (default_idle_call+0x21/0x3c) + [] (default_idle_call) from [] (do_idle+0xe3/0x1e4) + [] (do_idle) from [] (cpu_startup_entry+0x13/0x14) + [] (cpu_startup_entry) from [] (start_kernel+0x397/0x3d4) + [] (start_kernel) from [<00000000>] (0x0) + ---[ end trace 0000000000000002 ]--- + +Power consumption measured on STM32MP157C DHCOM SoM is not increased or +is below noise threshold. + +Fixes: 47beed513a85b ("pinctrl: stm32: Add level interrupt support to gpio irq chip") +Signed-off-by: Marek Vasut +Cc: Alexandre Torgue +Cc: Fabien Dessenne +Cc: Linus Walleij +Cc: Marc Zyngier +Cc: linux-stm32@st-md-mailman.stormreply.com +Cc: linux-arm-kernel@lists.infradead.org +To: linux-gpio@vger.kernel.org +Reviewed-by: Fabien Dessenne +Link: https://lore.kernel.org/r/20220421140827.214088-1-marex@denx.de +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/stm32/pinctrl-stm32.c | 19 +++++++++++++++++-- + 1 file changed, 17 insertions(+), 2 deletions(-) + +diff --git a/drivers/pinctrl/stm32/pinctrl-stm32.c b/drivers/pinctrl/stm32/pinctrl-stm32.c +index df1d6b466fb7..f7c9459f6628 100644 +--- a/drivers/pinctrl/stm32/pinctrl-stm32.c ++++ b/drivers/pinctrl/stm32/pinctrl-stm32.c +@@ -225,6 +225,13 @@ static void stm32_gpio_free(struct gpio_chip *chip, unsigned offset) + pinctrl_gpio_free(chip->base + offset); + } + ++static int stm32_gpio_get_noclk(struct gpio_chip *chip, unsigned int offset) ++{ ++ struct stm32_gpio_bank *bank = gpiochip_get_data(chip); ++ ++ return !!(readl_relaxed(bank->base + STM32_GPIO_IDR) & BIT(offset)); ++} ++ + static int stm32_gpio_get(struct gpio_chip *chip, unsigned offset) + { + struct stm32_gpio_bank *bank = gpiochip_get_data(chip); +@@ -232,7 +239,7 @@ static int stm32_gpio_get(struct gpio_chip *chip, unsigned offset) + + clk_enable(bank->clk); + +- ret = !!(readl_relaxed(bank->base + STM32_GPIO_IDR) & BIT(offset)); ++ ret = stm32_gpio_get_noclk(chip, offset); + + clk_disable(bank->clk); + +@@ -316,7 +323,7 @@ static void stm32_gpio_irq_trigger(struct irq_data *d) + return; + + /* If level interrupt type then retrig */ +- level = stm32_gpio_get(&bank->gpio_chip, d->hwirq); ++ level = stm32_gpio_get_noclk(&bank->gpio_chip, d->hwirq); + if ((level == 0 && bank->irq_type[d->hwirq] == IRQ_TYPE_LEVEL_LOW) || + (level == 1 && bank->irq_type[d->hwirq] == IRQ_TYPE_LEVEL_HIGH)) + irq_chip_retrigger_hierarchy(d); +@@ -358,6 +365,7 @@ static int stm32_gpio_irq_request_resources(struct irq_data *irq_data) + { + struct stm32_gpio_bank *bank = irq_data->domain->host_data; + struct stm32_pinctrl *pctl = dev_get_drvdata(bank->gpio_chip.parent); ++ unsigned long flags; + int ret; + + ret = stm32_gpio_direction_input(&bank->gpio_chip, irq_data->hwirq); +@@ -371,6 +379,10 @@ static int stm32_gpio_irq_request_resources(struct irq_data *irq_data) + return ret; + } + ++ flags = irqd_get_trigger_type(irq_data); ++ if (flags & IRQ_TYPE_LEVEL_MASK) ++ clk_enable(bank->clk); ++ + return 0; + } + +@@ -378,6 +390,9 @@ static void stm32_gpio_irq_release_resources(struct irq_data *irq_data) + { + struct stm32_gpio_bank *bank = irq_data->domain->host_data; + ++ if (bank->irq_type[irq_data->hwirq] & IRQ_TYPE_LEVEL_MASK) ++ clk_disable(bank->clk); ++ + gpiochip_unlock_as_irq(&bank->gpio_chip, irq_data->hwirq); + } + +-- +2.35.1 + diff --git a/queue-5.17/platform-x86-asus-wmi-fix-driver-not-binding-when-fa.patch b/queue-5.17/platform-x86-asus-wmi-fix-driver-not-binding-when-fa.patch new file mode 100644 index 00000000000..dce90bf8482 --- /dev/null +++ b/queue-5.17/platform-x86-asus-wmi-fix-driver-not-binding-when-fa.patch @@ -0,0 +1,58 @@ +From 3a05b37aa6fe14b20f1537dfcccbdb2e9934ec85 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Apr 2022 13:49:56 +0200 +Subject: platform/x86: asus-wmi: Fix driver not binding when fan curve control + probe fails + +From: Hans de Goede + +[ Upstream commit 9fe1bb29ea0ab231aa916dad4bcf0c435beb5869 ] + +Before this commit fan_curve_check_present() was trying to not cause +the probe to fail on devices without fan curve control by testing for +known error codes returned by asus_wmi_evaluate_method_buf(). + +Checking for ENODATA or ENODEV, with the latter being returned by this +function when an ACPI integer with a value of ASUS_WMI_UNSUPPORTED_METHOD +is returned. But for other ACPI integer returns this function just returns +them as is, including the ASUS_WMI_DSTS_UNKNOWN_BIT value of 2. + +On the Asus U36SD ASUS_WMI_DSTS_UNKNOWN_BIT gets returned, leading to: + + asus-nb-wmi: probe of asus-nb-wmi failed with error 2 + +Instead of playing whack a mole with error codes here, simply treat all +errors as there not being any fan curves, fixing the driver no longer +loading on the Asus U36SD laptop. + +Fixes: e3d13da7f77d ("platform/x86: asus-wmi: Fix regression when probing for fan curve control") +BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=2079125 +Cc: Luke D. Jones +Signed-off-by: Hans de Goede +Link: https://lore.kernel.org/r/20220427114956.332919-1-hdegoede@redhat.com +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/asus-wmi.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c +index 399a4a345224..1e7bc0c595c7 100644 +--- a/drivers/platform/x86/asus-wmi.c ++++ b/drivers/platform/x86/asus-wmi.c +@@ -2227,9 +2227,10 @@ static int fan_curve_check_present(struct asus_wmi *asus, bool *available, + + err = fan_curve_get_factory_default(asus, fan_dev); + if (err) { +- if (err == -ENODEV || err == -ENODATA) +- return 0; +- return err; ++ pr_debug("fan_curve_get_factory_default(0x%08x) failed: %d\n", ++ fan_dev, err); ++ /* Don't cause probe to fail on devices without fan-curves */ ++ return 0; + } + + *available = true; +-- +2.35.1 + diff --git a/queue-5.17/platform-x86-asus-wmi-potential-buffer-overflow-in-a.patch b/queue-5.17/platform-x86-asus-wmi-potential-buffer-overflow-in-a.patch new file mode 100644 index 00000000000..0bce7c79b2d --- /dev/null +++ b/queue-5.17/platform-x86-asus-wmi-potential-buffer-overflow-in-a.patch @@ -0,0 +1,47 @@ +From d39d6e952f0dcce060df9c8596cde5cc048cf1c3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Apr 2022 10:37:44 +0300 +Subject: platform/x86: asus-wmi: Potential buffer overflow in + asus_wmi_evaluate_method_buf() + +From: Dan Carpenter + +[ Upstream commit 4345ece8f0bcc682f1fb3b648922c9be5f7dbe6c ] + +This code tests for if the obj->buffer.length is larger than the buffer +but then it just does the memcpy() anyway. + +Fixes: 0f0ac158d28f ("platform/x86: asus-wmi: Add support for custom fan curves") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/20220413073744.GB8812@kili +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/asus-wmi.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c +index adab31b52f2a..399a4a345224 100644 +--- a/drivers/platform/x86/asus-wmi.c ++++ b/drivers/platform/x86/asus-wmi.c +@@ -371,10 +371,14 @@ static int asus_wmi_evaluate_method_buf(u32 method_id, + + switch (obj->type) { + case ACPI_TYPE_BUFFER: +- if (obj->buffer.length > size) ++ if (obj->buffer.length > size) { + err = -ENOSPC; +- if (obj->buffer.length == 0) ++ break; ++ } ++ if (obj->buffer.length == 0) { + err = -ENODATA; ++ break; ++ } + + memcpy(ret_buffer, obj->buffer.pointer, obj->buffer.length); + break; +-- +2.35.1 + diff --git a/queue-5.17/powerpc-perf-fix-32bit-compile.patch b/queue-5.17/powerpc-perf-fix-32bit-compile.patch new file mode 100644 index 00000000000..7e9ec911819 --- /dev/null +++ b/queue-5.17/powerpc-perf-fix-32bit-compile.patch @@ -0,0 +1,44 @@ +From b92e4f3f14a1f01b3a4bc3df8cf7203f3b27ca38 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Apr 2022 12:57:56 +1000 +Subject: powerpc/perf: Fix 32bit compile + +From: Alexey Kardashevskiy + +[ Upstream commit bb82c574691daf8f7fa9a160264d15c5804cb769 ] + +The "read_bhrb" global symbol is only called under CONFIG_PPC64 of +arch/powerpc/perf/core-book3s.c but it is compiled for both 32 and 64 bit +anyway (and LLVM fails to link this on 32bit). + +This fixes it by moving bhrb.o to obj64 targets. + +Signed-off-by: Alexey Kardashevskiy +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20220421025756.571995-1-aik@ozlabs.ru +Signed-off-by: Sasha Levin +--- + arch/powerpc/perf/Makefile | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/powerpc/perf/Makefile b/arch/powerpc/perf/Makefile +index 2f46e31c7612..4f53d0b97539 100644 +--- a/arch/powerpc/perf/Makefile ++++ b/arch/powerpc/perf/Makefile +@@ -3,11 +3,11 @@ + obj-y += callchain.o callchain_$(BITS).o perf_regs.o + obj-$(CONFIG_COMPAT) += callchain_32.o + +-obj-$(CONFIG_PPC_PERF_CTRS) += core-book3s.o bhrb.o ++obj-$(CONFIG_PPC_PERF_CTRS) += core-book3s.o + obj64-$(CONFIG_PPC_PERF_CTRS) += ppc970-pmu.o power5-pmu.o \ + power5+-pmu.o power6-pmu.o power7-pmu.o \ + isa207-common.o power8-pmu.o power9-pmu.o \ +- generic-compat-pmu.o power10-pmu.o ++ generic-compat-pmu.o power10-pmu.o bhrb.o + obj32-$(CONFIG_PPC_PERF_CTRS) += mpc7450-pmu.o + + obj-$(CONFIG_PPC_POWERNV) += imc-pmu.o +-- +2.35.1 + diff --git a/queue-5.17/revert-ibmvnic-add-ethtool-private-flag-for-driver-d.patch b/queue-5.17/revert-ibmvnic-add-ethtool-private-flag-for-driver-d.patch new file mode 100644 index 00000000000..e7b6ffba0ae --- /dev/null +++ b/queue-5.17/revert-ibmvnic-add-ethtool-private-flag-for-driver-d.patch @@ -0,0 +1,258 @@ +From ffbbe0d08b0f16273a00093268505b3b9ea96ce9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Apr 2022 18:51:46 -0500 +Subject: Revert "ibmvnic: Add ethtool private flag for driver-defined queue + limits" + +From: Dany Madden + +[ Upstream commit aeaf59b78712c7a1827c76f086acff4f586e072f ] + +This reverts commit 723ad916134784b317b72f3f6cf0f7ba774e5dae + +When client requests channel or ring size larger than what the server +can support the server will cap the request to the supported max. So, +the client would not be able to successfully request resources that +exceed the server limit. + +Fixes: 723ad9161347 ("ibmvnic: Add ethtool private flag for driver-defined queue limits") +Signed-off-by: Dany Madden +Link: https://lore.kernel.org/r/20220427235146.23189-1-drt@linux.ibm.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/ibm/ibmvnic.c | 129 ++++++++--------------------- + drivers/net/ethernet/ibm/ibmvnic.h | 6 -- + 2 files changed, 35 insertions(+), 100 deletions(-) + +diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c +index b4804ce63151..a4428a7d0f35 100644 +--- a/drivers/net/ethernet/ibm/ibmvnic.c ++++ b/drivers/net/ethernet/ibm/ibmvnic.c +@@ -3209,13 +3209,8 @@ static void ibmvnic_get_ringparam(struct net_device *netdev, + { + struct ibmvnic_adapter *adapter = netdev_priv(netdev); + +- if (adapter->priv_flags & IBMVNIC_USE_SERVER_MAXES) { +- ring->rx_max_pending = adapter->max_rx_add_entries_per_subcrq; +- ring->tx_max_pending = adapter->max_tx_entries_per_subcrq; +- } else { +- ring->rx_max_pending = IBMVNIC_MAX_QUEUE_SZ; +- ring->tx_max_pending = IBMVNIC_MAX_QUEUE_SZ; +- } ++ ring->rx_max_pending = adapter->max_rx_add_entries_per_subcrq; ++ ring->tx_max_pending = adapter->max_tx_entries_per_subcrq; + ring->rx_mini_max_pending = 0; + ring->rx_jumbo_max_pending = 0; + ring->rx_pending = adapter->req_rx_add_entries_per_subcrq; +@@ -3230,23 +3225,21 @@ static int ibmvnic_set_ringparam(struct net_device *netdev, + struct netlink_ext_ack *extack) + { + struct ibmvnic_adapter *adapter = netdev_priv(netdev); +- int ret; + +- ret = 0; ++ if (ring->rx_pending > adapter->max_rx_add_entries_per_subcrq || ++ ring->tx_pending > adapter->max_tx_entries_per_subcrq) { ++ netdev_err(netdev, "Invalid request.\n"); ++ netdev_err(netdev, "Max tx buffers = %llu\n", ++ adapter->max_rx_add_entries_per_subcrq); ++ netdev_err(netdev, "Max rx buffers = %llu\n", ++ adapter->max_tx_entries_per_subcrq); ++ return -EINVAL; ++ } ++ + adapter->desired.rx_entries = ring->rx_pending; + adapter->desired.tx_entries = ring->tx_pending; + +- ret = wait_for_reset(adapter); +- +- if (!ret && +- (adapter->req_rx_add_entries_per_subcrq != ring->rx_pending || +- adapter->req_tx_entries_per_subcrq != ring->tx_pending)) +- netdev_info(netdev, +- "Could not match full ringsize request. Requested: RX %d, TX %d; Allowed: RX %llu, TX %llu\n", +- ring->rx_pending, ring->tx_pending, +- adapter->req_rx_add_entries_per_subcrq, +- adapter->req_tx_entries_per_subcrq); +- return ret; ++ return wait_for_reset(adapter); + } + + static void ibmvnic_get_channels(struct net_device *netdev, +@@ -3254,14 +3247,8 @@ static void ibmvnic_get_channels(struct net_device *netdev, + { + struct ibmvnic_adapter *adapter = netdev_priv(netdev); + +- if (adapter->priv_flags & IBMVNIC_USE_SERVER_MAXES) { +- channels->max_rx = adapter->max_rx_queues; +- channels->max_tx = adapter->max_tx_queues; +- } else { +- channels->max_rx = IBMVNIC_MAX_QUEUES; +- channels->max_tx = IBMVNIC_MAX_QUEUES; +- } +- ++ channels->max_rx = adapter->max_rx_queues; ++ channels->max_tx = adapter->max_tx_queues; + channels->max_other = 0; + channels->max_combined = 0; + channels->rx_count = adapter->req_rx_queues; +@@ -3274,22 +3261,11 @@ static int ibmvnic_set_channels(struct net_device *netdev, + struct ethtool_channels *channels) + { + struct ibmvnic_adapter *adapter = netdev_priv(netdev); +- int ret; + +- ret = 0; + adapter->desired.rx_queues = channels->rx_count; + adapter->desired.tx_queues = channels->tx_count; + +- ret = wait_for_reset(adapter); +- +- if (!ret && +- (adapter->req_rx_queues != channels->rx_count || +- adapter->req_tx_queues != channels->tx_count)) +- netdev_info(netdev, +- "Could not match full channels request. Requested: RX %d, TX %d; Allowed: RX %llu, TX %llu\n", +- channels->rx_count, channels->tx_count, +- adapter->req_rx_queues, adapter->req_tx_queues); +- return ret; ++ return wait_for_reset(adapter); + } + + static void ibmvnic_get_strings(struct net_device *dev, u32 stringset, u8 *data) +@@ -3297,43 +3273,32 @@ static void ibmvnic_get_strings(struct net_device *dev, u32 stringset, u8 *data) + struct ibmvnic_adapter *adapter = netdev_priv(dev); + int i; + +- switch (stringset) { +- case ETH_SS_STATS: +- for (i = 0; i < ARRAY_SIZE(ibmvnic_stats); +- i++, data += ETH_GSTRING_LEN) +- memcpy(data, ibmvnic_stats[i].name, ETH_GSTRING_LEN); ++ if (stringset != ETH_SS_STATS) ++ return; + +- for (i = 0; i < adapter->req_tx_queues; i++) { +- snprintf(data, ETH_GSTRING_LEN, "tx%d_packets", i); +- data += ETH_GSTRING_LEN; ++ for (i = 0; i < ARRAY_SIZE(ibmvnic_stats); i++, data += ETH_GSTRING_LEN) ++ memcpy(data, ibmvnic_stats[i].name, ETH_GSTRING_LEN); + +- snprintf(data, ETH_GSTRING_LEN, "tx%d_bytes", i); +- data += ETH_GSTRING_LEN; ++ for (i = 0; i < adapter->req_tx_queues; i++) { ++ snprintf(data, ETH_GSTRING_LEN, "tx%d_packets", i); ++ data += ETH_GSTRING_LEN; + +- snprintf(data, ETH_GSTRING_LEN, +- "tx%d_dropped_packets", i); +- data += ETH_GSTRING_LEN; +- } ++ snprintf(data, ETH_GSTRING_LEN, "tx%d_bytes", i); ++ data += ETH_GSTRING_LEN; + +- for (i = 0; i < adapter->req_rx_queues; i++) { +- snprintf(data, ETH_GSTRING_LEN, "rx%d_packets", i); +- data += ETH_GSTRING_LEN; ++ snprintf(data, ETH_GSTRING_LEN, "tx%d_dropped_packets", i); ++ data += ETH_GSTRING_LEN; ++ } + +- snprintf(data, ETH_GSTRING_LEN, "rx%d_bytes", i); +- data += ETH_GSTRING_LEN; ++ for (i = 0; i < adapter->req_rx_queues; i++) { ++ snprintf(data, ETH_GSTRING_LEN, "rx%d_packets", i); ++ data += ETH_GSTRING_LEN; + +- snprintf(data, ETH_GSTRING_LEN, "rx%d_interrupts", i); +- data += ETH_GSTRING_LEN; +- } +- break; ++ snprintf(data, ETH_GSTRING_LEN, "rx%d_bytes", i); ++ data += ETH_GSTRING_LEN; + +- case ETH_SS_PRIV_FLAGS: +- for (i = 0; i < ARRAY_SIZE(ibmvnic_priv_flags); i++) +- strcpy(data + i * ETH_GSTRING_LEN, +- ibmvnic_priv_flags[i]); +- break; +- default: +- return; ++ snprintf(data, ETH_GSTRING_LEN, "rx%d_interrupts", i); ++ data += ETH_GSTRING_LEN; + } + } + +@@ -3346,8 +3311,6 @@ static int ibmvnic_get_sset_count(struct net_device *dev, int sset) + return ARRAY_SIZE(ibmvnic_stats) + + adapter->req_tx_queues * NUM_TX_STATS + + adapter->req_rx_queues * NUM_RX_STATS; +- case ETH_SS_PRIV_FLAGS: +- return ARRAY_SIZE(ibmvnic_priv_flags); + default: + return -EOPNOTSUPP; + } +@@ -3400,26 +3363,6 @@ static void ibmvnic_get_ethtool_stats(struct net_device *dev, + } + } + +-static u32 ibmvnic_get_priv_flags(struct net_device *netdev) +-{ +- struct ibmvnic_adapter *adapter = netdev_priv(netdev); +- +- return adapter->priv_flags; +-} +- +-static int ibmvnic_set_priv_flags(struct net_device *netdev, u32 flags) +-{ +- struct ibmvnic_adapter *adapter = netdev_priv(netdev); +- bool which_maxes = !!(flags & IBMVNIC_USE_SERVER_MAXES); +- +- if (which_maxes) +- adapter->priv_flags |= IBMVNIC_USE_SERVER_MAXES; +- else +- adapter->priv_flags &= ~IBMVNIC_USE_SERVER_MAXES; +- +- return 0; +-} +- + static const struct ethtool_ops ibmvnic_ethtool_ops = { + .get_drvinfo = ibmvnic_get_drvinfo, + .get_msglevel = ibmvnic_get_msglevel, +@@ -3433,8 +3376,6 @@ static const struct ethtool_ops ibmvnic_ethtool_ops = { + .get_sset_count = ibmvnic_get_sset_count, + .get_ethtool_stats = ibmvnic_get_ethtool_stats, + .get_link_ksettings = ibmvnic_get_link_ksettings, +- .get_priv_flags = ibmvnic_get_priv_flags, +- .set_priv_flags = ibmvnic_set_priv_flags, + }; + + /* Routines for managing CRQs/sCRQs */ +diff --git a/drivers/net/ethernet/ibm/ibmvnic.h b/drivers/net/ethernet/ibm/ibmvnic.h +index 8f5cefb932dd..1310c861bf83 100644 +--- a/drivers/net/ethernet/ibm/ibmvnic.h ++++ b/drivers/net/ethernet/ibm/ibmvnic.h +@@ -41,11 +41,6 @@ + + #define IBMVNIC_RESET_DELAY 100 + +-static const char ibmvnic_priv_flags[][ETH_GSTRING_LEN] = { +-#define IBMVNIC_USE_SERVER_MAXES 0x1 +- "use-server-maxes" +-}; +- + struct ibmvnic_login_buffer { + __be32 len; + __be32 version; +@@ -883,7 +878,6 @@ struct ibmvnic_adapter { + struct ibmvnic_control_ip_offload_buffer ip_offload_ctrl; + dma_addr_t ip_offload_ctrl_tok; + u32 msg_enable; +- u32 priv_flags; + + /* Vital Product Data (VPD) */ + struct ibmvnic_vpd *vpd; +-- +2.35.1 + diff --git a/queue-5.17/sctp-check-asoc-strreset_chunk-in-sctp_generate_reco.patch b/queue-5.17/sctp-check-asoc-strreset_chunk-in-sctp_generate_reco.patch new file mode 100644 index 00000000000..b759efdc77c --- /dev/null +++ b/queue-5.17/sctp-check-asoc-strreset_chunk-in-sctp_generate_reco.patch @@ -0,0 +1,66 @@ +From b2450e030b8d593d90d13f1e8c56d13038982ba0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Apr 2022 16:52:41 -0400 +Subject: sctp: check asoc strreset_chunk in sctp_generate_reconf_event + +From: Xin Long + +[ Upstream commit 165e3e17fe8fe6a8aab319bc6e631a2e23b9a857 ] + +A null pointer reference issue can be triggered when the response of a +stream reconf request arrives after the timer is triggered, such as: + + send Incoming SSN Reset Request ---> + CPU0: + reconf timer is triggered, + go to the handler code before hold sk lock + <--- reply with Outgoing SSN Reset Request + CPU1: + process Outgoing SSN Reset Request, + and set asoc->strreset_chunk to NULL + CPU0: + continue the handler code, hold sk lock, + and try to hold asoc->strreset_chunk, crash! + +In Ying Xu's testing, the call trace is: + + [ ] BUG: kernel NULL pointer dereference, address: 0000000000000010 + [ ] RIP: 0010:sctp_chunk_hold+0xe/0x40 [sctp] + [ ] Call Trace: + [ ] + [ ] sctp_sf_send_reconf+0x2c/0x100 [sctp] + [ ] sctp_do_sm+0xa4/0x220 [sctp] + [ ] sctp_generate_reconf_event+0xbd/0xe0 [sctp] + [ ] call_timer_fn+0x26/0x130 + +This patch is to fix it by returning from the timer handler if asoc +strreset_chunk is already set to NULL. + +Fixes: 7b9438de0cd4 ("sctp: add stream reconf timer") +Reported-by: Ying Xu +Signed-off-by: Xin Long +Acked-by: Marcelo Ricardo Leitner +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/sctp/sm_sideeffect.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c +index b3815b568e8e..463c4a58d2c3 100644 +--- a/net/sctp/sm_sideeffect.c ++++ b/net/sctp/sm_sideeffect.c +@@ -458,6 +458,10 @@ void sctp_generate_reconf_event(struct timer_list *t) + goto out_unlock; + } + ++ /* This happens when the response arrives after the timer is triggered. */ ++ if (!asoc->strreset_chunk) ++ goto out_unlock; ++ + error = sctp_do_sm(net, SCTP_EVENT_T_TIMEOUT, + SCTP_ST_TIMEOUT(SCTP_EVENT_TIMEOUT_RECONF), + asoc->state, asoc->ep, asoc, +-- +2.35.1 + diff --git a/queue-5.17/selftest-vm-verify-mmap-addr-in-mremap_test.patch b/queue-5.17/selftest-vm-verify-mmap-addr-in-mremap_test.patch new file mode 100644 index 00000000000..2171e710b43 --- /dev/null +++ b/queue-5.17/selftest-vm-verify-mmap-addr-in-mremap_test.patch @@ -0,0 +1,109 @@ +From f49670bcc1970c2024af181f10b99b4248cf43e8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Apr 2022 16:35:49 -0700 +Subject: selftest/vm: verify mmap addr in mremap_test + +From: Sidhartha Kumar + +[ Upstream commit 9c85a9bae267f6b5e5e374d0d023bbbe9db096d3 ] + +Avoid calling mmap with requested addresses that are less than the +system's mmap_min_addr. When run as root, mmap returns EACCES when +trying to map addresses < mmap_min_addr. This is not one of the error +codes for the condition to retry the mmap in the test. + +Rather than arbitrarily retrying on EACCES, don't attempt an mmap until +addr > vm.mmap_min_addr. + +Add a munmap call after an alignment check as the mappings are retained +after the retry and can reach the vm.max_map_count sysctl. + +Link: https://lkml.kernel.org/r/20220420215721.4868-1-sidhartha.kumar@oracle.com +Signed-off-by: Sidhartha Kumar +Reviewed-by: Shuah Khan +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/vm/mremap_test.c | 41 +++++++++++++++++++++++- + 1 file changed, 40 insertions(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/vm/mremap_test.c b/tools/testing/selftests/vm/mremap_test.c +index 7c0b0617b9f8..9a518fee6306 100644 +--- a/tools/testing/selftests/vm/mremap_test.c ++++ b/tools/testing/selftests/vm/mremap_test.c +@@ -6,6 +6,7 @@ + + #include + #include ++#include + #include + #include + #include +@@ -63,6 +64,35 @@ enum { + .expect_failure = should_fail \ + } + ++/* Returns mmap_min_addr sysctl tunable from procfs */ ++static unsigned long long get_mmap_min_addr(void) ++{ ++ FILE *fp; ++ int n_matched; ++ static unsigned long long addr; ++ ++ if (addr) ++ return addr; ++ ++ fp = fopen("/proc/sys/vm/mmap_min_addr", "r"); ++ if (fp == NULL) { ++ ksft_print_msg("Failed to open /proc/sys/vm/mmap_min_addr: %s\n", ++ strerror(errno)); ++ exit(KSFT_SKIP); ++ } ++ ++ n_matched = fscanf(fp, "%llu", &addr); ++ if (n_matched != 1) { ++ ksft_print_msg("Failed to read /proc/sys/vm/mmap_min_addr: %s\n", ++ strerror(errno)); ++ fclose(fp); ++ exit(KSFT_SKIP); ++ } ++ ++ fclose(fp); ++ return addr; ++} ++ + /* + * Returns the start address of the mapping on success, else returns + * NULL on failure. +@@ -71,8 +101,15 @@ static void *get_source_mapping(struct config c) + { + unsigned long long addr = 0ULL; + void *src_addr = NULL; ++ unsigned long long mmap_min_addr; ++ ++ mmap_min_addr = get_mmap_min_addr(); ++ + retry: + addr += c.src_alignment; ++ if (addr < mmap_min_addr) ++ goto retry; ++ + src_addr = mmap((void *) addr, c.region_size, PROT_READ | PROT_WRITE, + MAP_FIXED_NOREPLACE | MAP_ANONYMOUS | MAP_SHARED, + -1, 0); +@@ -90,8 +127,10 @@ static void *get_source_mapping(struct config c) + * alignment in the tests. + */ + if (((unsigned long long) src_addr & (c.src_alignment - 1)) || +- !((unsigned long long) src_addr & c.src_alignment)) ++ !((unsigned long long) src_addr & c.src_alignment)) { ++ munmap(src_addr, c.region_size); + goto retry; ++ } + + if (!src_addr) + goto error; +-- +2.35.1 + diff --git a/queue-5.17/selftest-vm-verify-remap-destination-address-in-mrem.patch b/queue-5.17/selftest-vm-verify-remap-destination-address-in-mrem.patch new file mode 100644 index 00000000000..fee0962ec54 --- /dev/null +++ b/queue-5.17/selftest-vm-verify-remap-destination-address-in-mrem.patch @@ -0,0 +1,107 @@ +From 72c1a2eb210f25d6ade47e308f3fad226e922b28 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Apr 2022 16:35:52 -0700 +Subject: selftest/vm: verify remap destination address in mremap_test + +From: Sidhartha Kumar + +[ Upstream commit 18d609daa546c919fd36b62a7b510c18de4b4af8 ] + +Because mremap does not have a MAP_FIXED_NOREPLACE flag, it can destroy +existing mappings. This causes a segfault when regions such as text are +remapped and the permissions are changed. + +Verify the requested mremap destination address does not overlap any +existing mappings by using mmap's MAP_FIXED_NOREPLACE flag. Keep +incrementing the destination address until a valid mapping is found or +fail the current test once the max address is reached. + +Link: https://lkml.kernel.org/r/20220420215721.4868-2-sidhartha.kumar@oracle.com +Signed-off-by: Sidhartha Kumar +Reviewed-by: Shuah Khan +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/vm/mremap_test.c | 42 ++++++++++++++++++++++-- + 1 file changed, 39 insertions(+), 3 deletions(-) + +diff --git a/tools/testing/selftests/vm/mremap_test.c b/tools/testing/selftests/vm/mremap_test.c +index 9a518fee6306..58775dab3cc6 100644 +--- a/tools/testing/selftests/vm/mremap_test.c ++++ b/tools/testing/selftests/vm/mremap_test.c +@@ -10,6 +10,7 @@ + #include + #include + #include ++#include + + #include "../kselftest.h" + +@@ -64,6 +65,30 @@ enum { + .expect_failure = should_fail \ + } + ++/* ++ * Returns false if the requested remap region overlaps with an ++ * existing mapping (e.g text, stack) else returns true. ++ */ ++static bool is_remap_region_valid(void *addr, unsigned long long size) ++{ ++ void *remap_addr = NULL; ++ bool ret = true; ++ ++ /* Use MAP_FIXED_NOREPLACE flag to ensure region is not mapped */ ++ remap_addr = mmap(addr, size, PROT_READ | PROT_WRITE, ++ MAP_FIXED_NOREPLACE | MAP_ANONYMOUS | MAP_SHARED, ++ -1, 0); ++ ++ if (remap_addr == MAP_FAILED) { ++ if (errno == EEXIST) ++ ret = false; ++ } else { ++ munmap(remap_addr, size); ++ } ++ ++ return ret; ++} ++ + /* Returns mmap_min_addr sysctl tunable from procfs */ + static unsigned long long get_mmap_min_addr(void) + { +@@ -111,8 +136,8 @@ static void *get_source_mapping(struct config c) + goto retry; + + src_addr = mmap((void *) addr, c.region_size, PROT_READ | PROT_WRITE, +- MAP_FIXED_NOREPLACE | MAP_ANONYMOUS | MAP_SHARED, +- -1, 0); ++ MAP_FIXED_NOREPLACE | MAP_ANONYMOUS | MAP_SHARED, ++ -1, 0); + if (src_addr == MAP_FAILED) { + if (errno == EPERM || errno == EEXIST) + goto retry; +@@ -179,9 +204,20 @@ static long long remap_region(struct config c, unsigned int threshold_mb, + if (!((unsigned long long) addr & c.dest_alignment)) + addr = (void *) ((unsigned long long) addr | c.dest_alignment); + ++ /* Don't destroy existing mappings unless expected to overlap */ ++ while (!is_remap_region_valid(addr, c.region_size) && !c.overlapping) { ++ /* Check for unsigned overflow */ ++ if (addr + c.dest_alignment < addr) { ++ ksft_print_msg("Couldn't find a valid region to remap to\n"); ++ ret = -1; ++ goto out; ++ } ++ addr += c.dest_alignment; ++ } ++ + clock_gettime(CLOCK_MONOTONIC, &t_start); + dest_addr = mremap(src_addr, c.region_size, c.region_size, +- MREMAP_MAYMOVE|MREMAP_FIXED, (char *) addr); ++ MREMAP_MAYMOVE|MREMAP_FIXED, (char *) addr); + clock_gettime(CLOCK_MONOTONIC, &t_end); + + if (dest_addr == MAP_FAILED) { +-- +2.35.1 + diff --git a/queue-5.17/series b/queue-5.17/series index 913d08db92e..c74afb48e89 100644 --- a/queue-5.17/series +++ b/queue-5.17/series @@ -52,3 +52,125 @@ x86-cpu-load-microcode-during-restore_processor_state.patch x86-pci-xen-disable-pci-msi-masking-for-xen_hvm-guests.patch iocost-don-t-reset-the-inuse-weight-of-under-weighted-debtors.patch virtio_net-fix-wrong-buf-address-calculation-when-using-xdp.patch +cpufreq-qcom-hw-drop-affinity-hint-before-freeing-th.patch +cpufreq-qcom-hw-fix-the-race-between-lmh-worker-and-.patch +cpufreq-qcom-hw-fix-the-opp-entries-refcounting.patch +cpufreq-qcom-cpufreq-hw-fix-throttle-frequency-value.patch +video-fbdev-udlfb-properly-check-endpoint-type.patch +arm64-dts-meson-remove-cpu-opps-below-1ghz-for-g12b-.patch +arm64-dts-meson-remove-cpu-opps-below-1ghz-for-sm1-b.patch +iio-dac-ad3552r-fix-signedness-bug-in-ad3552r_reset.patch +iio-imu-bmi160-disable-regulator-in-error-path.patch +iio-filter-admv8818-select-regmap_spi-for-admv8818.patch +mtd-rawnand-fix-ecc-parameters-for-mt7622.patch +tee-optee-add-missing-mutext_destroy-in-optee_ffa_pr.patch +xsk-fix-l2fwd-for-copy-mode-busy-poll-combo.patch +arm64-dts-imx8qm-correct-scu-clock-controller-s-comp.patch +usb-fix-xhci-event-ring-dequeue-pointer-erdp-update-.patch +soc-imx-imx8m-blk-ctrl-fix-imx8mn_dispblk_pd_isi-han.patch +arm-dts-imx6qdl-apalis-fix-sgtl5000-detection-issue.patch +iio-dac-ad3552r-fix-an-is_err-vs-null-check.patch +arm64-dts-imx8mq-tqma8mq-change-the-spi-nor-tx.patch +arm64-dts-imx8mn-fix-sai-nodes.patch +arm64-dts-meson-sm1-bananapi-m5-fix-wrong-gpio-pin-l.patch +phy-samsung-fix-missing-of_node_put-in-exynos_sata_p.patch +phy-samsung-exynos5250-sata-fix-missing-device-put-i.patch +arm-omap2-fix-refcount-leak-in-omap_gic_of_init.patch +bus-ti-sysc-make-omap3-gpt12-quirk-handling-soc-spec.patch +arm-dts-dra7-fix-suspend-warning-for-vpe-powerdomain.patch +phy-ti-omap-usb2-fix-error-handling-in-omap_usb2_ena.patch +arm-dts-at91-map-mclk-for-wm8731-on-at91sam9g20ek.patch +arm-dts-at91-sama5d4_xplained-fix-pinctrl-phandle-na.patch +arm-dts-at91-fix-pinctrl-phandles.patch +phy-mapphone-mdm6600-fix-pm-error-handling-in-phy_md.patch +phy-ti-add-missing-pm_runtime_disable-in-serdes_am65.patch +interconnect-qcom-sc7180-drop-ip0-interconnects.patch +interconnect-qcom-sdx55-drop-ip0-interconnects.patch +arm-dts-fix-mmc-order-for-omap3-gta04.patch +arm-dts-am33xx-l4-add-missing-touchscreen-clock-prop.patch +arm-dts-am3517-evm-fix-misc-pinmuxing.patch +arm-dts-logicpd-som-lv-fix-wrong-pinmuxing-on-omap35.patch +pinctrl-qcom-sm6350-fix-order-of-ufs-sdc-pins.patch +ipvs-correctly-print-the-memory-size-of-ip_vs_conn_t.patch +phy-amlogic-fix-error-path-in-phy_g12a_usb3_pcie_pro.patch +pinctrl-mediatek-moore-fix-build-error.patch +mtd-rawnand-fix-return-value-check-of-wait_for_compl.patch +mtd-fix-part-field-data-corruption-in-mtd_info.patch +pinctrl-stm32-do-not-call-stm32_gpio_get-for-edge-tr.patch +memory-renesas-rpc-if-fix-hf-ospi-data-transfer-in-m.patch +net-dsa-add-missing-of_node_put-in-dsa_port_link_reg.patch +netfilter-nft_set_rbtree-overlap-detection-with-elem.patch +bpf-lwt-fix-crash-when-using-bpf_skb_set_tunnel_key-.patch +pinctrl-rockchip-fix-rk3308-pinmux-bits.patch +tcp-md5-incorrect-tcp_header_len-for-incoming-connec.patch +pinctrl-stm32-keep-pinctrl-block-clock-enabled-when-.patch +tcp-ensure-to-use-the-most-recently-sent-skb-when-fi.patch +wireguard-device-check-for-metadata_dst-with-skb_val.patch +sctp-check-asoc-strreset_chunk-in-sctp_generate_reco.patch +arm-dts-imx6ull-colibri-fix-vqmmc-regulator.patch +arm64-dts-imx8mn-ddr4-evk-describe-the-32.768-khz-pm.patch +pinctrl-pistachio-fix-use-of-irq_of_parse_and_map.patch +cpufreq-fix-memory-leak-in-sun50i_cpufreq_nvmem_prob.patch +net-hns3-clear-inited-state-and-stop-client-after-fa.patch +net-hns3-fix-error-log-of-tx-rx-tqps-stats.patch +net-hns3-modify-the-return-code-of-hclge_get_ring_ch.patch +net-hns3-add-validity-check-for-message-data-length.patch +net-hns3-add-return-value-for-mailbox-handling-in-pf.patch +net-smc-sync-err-code-when-tcp-connection-was-refuse.patch +net-lan966x-fix-a-couple-off-by-one-bugs.patch +ip_gre-make-o_seqno-start-from-0-in-native-mode.patch +ip6_gre-make-o_seqno-start-from-0-in-native-mode.patch +ip_gre-ip6_gre-fix-race-condition-on-o_seqno-in-coll.patch +tcp-fix-potential-xmit-stalls-caused-by-tcp_notsent_.patch +tcp-make-sure-treq-af_specific-is-initialized.patch +bus-sunxi-rsb-fix-the-return-value-of-sunxi_rsb_devi.patch +clk-sunxi-sun9i-mmc-check-return-value-after-calling.patch +cpufreq-qcom-cpufreq-hw-clear-dcvs-interrupts.patch +mctp-defer-the-kfree-of-object-mdev-addrs.patch +net-bcmgenet-hide-status-block-before-tx-timestampin.patch +net-phy-marvell10g-fix-return-value-on-error.patch +net-dsa-mv88e6xxx-fix-port_hidden_wait-to-account-fo.patch +drm-sun4i-remove-obsolete-references-to-phys_offset.patch +ice-wait-5-s-for-emp-reset-after-firmware-flash.patch +bluetooth-hci_event-fix-checking-for-invalid-handle-.patch +net-dsa-lantiq_gswip-don-t-set-gswip_mii_cfg_rmii_cl.patch +io_uring-check-reserved-fields-for-send-sendmsg.patch +io_uring-check-reserved-fields-for-recv-recvmsg.patch +netfilter-nf_conntrack_tcp-re-init-for-syn-packets-o.patch +netfilter-conntrack-fix-udp-offload-timeout-sysctl.patch +platform-x86-asus-wmi-potential-buffer-overflow-in-a.patch +platform-x86-asus-wmi-fix-driver-not-binding-when-fa.patch +drm-amdkfd-fix-gws-queue-count.patch +drm-amd-display-fix-memory-leak-in-dcn21_clock_sourc.patch +tls-skip-tls_append_frag-on-zero-copy-size.patch +bnx2x-fix-napi-api-usage-sequence.patch +net-fec-add-missing-of_node_put-in-fec_enet_init_sto.patch +gfs2-minor-retry-logic-cleanup.patch +gfs2-make-sure-not-to-return-short-direct-writes.patch +gfs2-no-short-reads-or-writes-upon-glock-contention.patch +perf-arm-spe-fix-addresses-of-synthesized-spe-events.patch +ixgbe-ensure-ipsec-vf-pf-compatibility.patch +net-enetc-allow-tc-etf-offload-even-with-netif_f_csu.patch +revert-ibmvnic-add-ethtool-private-flag-for-driver-d.patch +tcp-fix-f-rto-may-not-work-correctly-when-receiving-.patch +io_uring-fix-uninitialized-field-in-rw-io_kiocb.patch +asoc-soc-pcm-use-gfp_kernel-when-the-code-is-sleepab.patch +asoc-cs35l41-fix-a-shift-out-of-bounds-warning-found.patch +asoc-rt711-5682-check-if-bus-is-active-before-deferr.patch +asoc-intel-soc-acpi-correct-device-endpoints-for-max.patch +asoc-wm8731-disable-the-regulator-when-probing-fails.patch +asoc-intel-sof_es8336-add-a-quirk-for-huawei-mateboo.patch +input-cypress-sf-register-a-callback-to-disable-the-.patch +ext4-fix-bug_on-in-start_this_handle-during-umount-f.patch +arch-xtensa-platforms-fix-deadlock-in-rs_close.patch +ksmbd-increment-reference-count-of-parent-fp.patch +ksmbd-set-fixed-sector-size-to-fs_sector_size_inform.patch +erofs-fix-use-after-free-of-on-stack-io.patch +bonding-do-not-discard-lowest-hash-bit-for-non-layer.patch +x86-__memcpy_flushcache-fix-wrong-alignment-if-size-.patch +cifs-destage-any-unwritten-data-to-the-server-before.patch +drivers-net-hippi-fix-deadlock-in-rr_close.patch +powerpc-perf-fix-32bit-compile.patch +alsa-hda-intel-dsp-config-add-raptorlake-pci-ids.patch +selftest-vm-verify-mmap-addr-in-mremap_test.patch +selftest-vm-verify-remap-destination-address-in-mrem.patch diff --git a/queue-5.17/soc-imx-imx8m-blk-ctrl-fix-imx8mn_dispblk_pd_isi-han.patch b/queue-5.17/soc-imx-imx8m-blk-ctrl-fix-imx8mn_dispblk_pd_isi-han.patch new file mode 100644 index 00000000000..8c978f3cb34 --- /dev/null +++ b/queue-5.17/soc-imx-imx8m-blk-ctrl-fix-imx8mn_dispblk_pd_isi-han.patch @@ -0,0 +1,38 @@ +From 491a857be57649baf4dd83ffe5b1cc7664a53267 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 20 Mar 2022 15:52:12 -0500 +Subject: soc: imx: imx8m-blk-ctrl: Fix IMX8MN_DISPBLK_PD_ISI hang + +From: Adam Ford + +[ Upstream commit e2aa165cd0163cef83cb295eb572aa9fb1604cf4 ] + +The imx8mn clock list for the ISI lists four clocks, but DOMAIN_MAX_CLKS +was set to 3. Because of this, attempts to enable the fourth clock failed, +threw some splat, and ultimately hung. + +Fixes: 7f511d514e8c ("soc: imx: imx8m-blk-ctrl: add i.MX8MN DISP blk-ctrl") +Signed-off-by: Adam Ford +Reviewed-by: Lucas Stach +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + drivers/soc/imx/imx8m-blk-ctrl.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/soc/imx/imx8m-blk-ctrl.c b/drivers/soc/imx/imx8m-blk-ctrl.c +index 511e74f0db8a..e096cca9f18a 100644 +--- a/drivers/soc/imx/imx8m-blk-ctrl.c ++++ b/drivers/soc/imx/imx8m-blk-ctrl.c +@@ -49,7 +49,7 @@ struct imx8m_blk_ctrl_domain_data { + u32 mipi_phy_rst_mask; + }; + +-#define DOMAIN_MAX_CLKS 3 ++#define DOMAIN_MAX_CLKS 4 + + struct imx8m_blk_ctrl_domain { + struct generic_pm_domain genpd; +-- +2.35.1 + diff --git a/queue-5.17/tcp-ensure-to-use-the-most-recently-sent-skb-when-fi.patch b/queue-5.17/tcp-ensure-to-use-the-most-recently-sent-skb-when-fi.patch new file mode 100644 index 00000000000..4f6bf70b0ea --- /dev/null +++ b/queue-5.17/tcp-ensure-to-use-the-most-recently-sent-skb-when-fi.patch @@ -0,0 +1,103 @@ +From c5aeaea5e9e3424668212deca0480975d1772954 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Apr 2022 10:34:41 +0800 +Subject: tcp: ensure to use the most recently sent skb when filling the rate + sample + +From: Pengcheng Yang + +[ Upstream commit b253a0680ceadc5d7b4acca7aa2d870326cad8ad ] + +If an ACK (s)acks multiple skbs, we favor the information +from the most recently sent skb by choosing the skb with +the highest prior_delivered count. But in the interval +between receiving ACKs, we send multiple skbs with the same +prior_delivered, because the tp->delivered only changes +when we receive an ACK. + +We used RACK's solution, copying tcp_rack_sent_after() as +tcp_skb_sent_after() helper to determine "which packet was +sent last?". Later, we will use tcp_skb_sent_after() instead +in RACK. + +Fixes: b9f64820fb22 ("tcp: track data delivery rate for a TCP connection") +Signed-off-by: Pengcheng Yang +Cc: Paolo Abeni +Acked-by: Neal Cardwell +Tested-by: Neal Cardwell +Reviewed-by: Eric Dumazet +Link: https://lore.kernel.org/r/1650422081-22153-1-git-send-email-yangpc@wangsu.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + include/net/tcp.h | 6 ++++++ + net/ipv4/tcp_rate.c | 11 ++++++++--- + 2 files changed, 14 insertions(+), 3 deletions(-) + +diff --git a/include/net/tcp.h b/include/net/tcp.h +index b9fc978fb2ca..9f459e8f1689 100644 +--- a/include/net/tcp.h ++++ b/include/net/tcp.h +@@ -1042,6 +1042,7 @@ struct rate_sample { + int losses; /* number of packets marked lost upon ACK */ + u32 acked_sacked; /* number of packets newly (S)ACKed upon ACK */ + u32 prior_in_flight; /* in flight before this ACK */ ++ u32 last_end_seq; /* end_seq of most recently ACKed packet */ + bool is_app_limited; /* is sample from packet with bubble in pipe? */ + bool is_retrans; /* is sample from retransmission? */ + bool is_ack_delayed; /* is this (likely) a delayed ACK? */ +@@ -1164,6 +1165,11 @@ void tcp_rate_gen(struct sock *sk, u32 delivered, u32 lost, + bool is_sack_reneg, struct rate_sample *rs); + void tcp_rate_check_app_limited(struct sock *sk); + ++static inline bool tcp_skb_sent_after(u64 t1, u64 t2, u32 seq1, u32 seq2) ++{ ++ return t1 > t2 || (t1 == t2 && after(seq1, seq2)); ++} ++ + /* These functions determine how the current flow behaves in respect of SACK + * handling. SACK is negotiated with the peer, and therefore it can vary + * between different flows. +diff --git a/net/ipv4/tcp_rate.c b/net/ipv4/tcp_rate.c +index fbab921670cc..9a8e014d9b5b 100644 +--- a/net/ipv4/tcp_rate.c ++++ b/net/ipv4/tcp_rate.c +@@ -74,27 +74,32 @@ void tcp_rate_skb_sent(struct sock *sk, struct sk_buff *skb) + * + * If an ACK (s)acks multiple skbs (e.g., stretched-acks), this function is + * called multiple times. We favor the information from the most recently +- * sent skb, i.e., the skb with the highest prior_delivered count. ++ * sent skb, i.e., the skb with the most recently sent time and the highest ++ * sequence. + */ + void tcp_rate_skb_delivered(struct sock *sk, struct sk_buff *skb, + struct rate_sample *rs) + { + struct tcp_sock *tp = tcp_sk(sk); + struct tcp_skb_cb *scb = TCP_SKB_CB(skb); ++ u64 tx_tstamp; + + if (!scb->tx.delivered_mstamp) + return; + ++ tx_tstamp = tcp_skb_timestamp_us(skb); + if (!rs->prior_delivered || +- after(scb->tx.delivered, rs->prior_delivered)) { ++ tcp_skb_sent_after(tx_tstamp, tp->first_tx_mstamp, ++ scb->end_seq, rs->last_end_seq)) { + rs->prior_delivered_ce = scb->tx.delivered_ce; + rs->prior_delivered = scb->tx.delivered; + rs->prior_mstamp = scb->tx.delivered_mstamp; + rs->is_app_limited = scb->tx.is_app_limited; + rs->is_retrans = scb->sacked & TCPCB_RETRANS; ++ rs->last_end_seq = scb->end_seq; + + /* Record send time of most recently ACKed packet: */ +- tp->first_tx_mstamp = tcp_skb_timestamp_us(skb); ++ tp->first_tx_mstamp = tx_tstamp; + /* Find the duration of the "send phase" of this window: */ + rs->interval_us = tcp_stamp_us_delta(tp->first_tx_mstamp, + scb->tx.first_tx_mstamp); +-- +2.35.1 + diff --git a/queue-5.17/tcp-fix-f-rto-may-not-work-correctly-when-receiving-.patch b/queue-5.17/tcp-fix-f-rto-may-not-work-correctly-when-receiving-.patch new file mode 100644 index 00000000000..3883c1f9f82 --- /dev/null +++ b/queue-5.17/tcp-fix-f-rto-may-not-work-correctly-when-receiving-.patch @@ -0,0 +1,88 @@ +From 40e8f0bc68076dddd698c2feb0c4ba7e85b4f378 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Apr 2022 18:03:39 +0800 +Subject: tcp: fix F-RTO may not work correctly when receiving DSACK + +From: Pengcheng Yang + +[ Upstream commit d9157f6806d1499e173770df1f1b234763de5c79 ] + +Currently DSACK is regarded as a dupack, which may cause +F-RTO to incorrectly enter "loss was real" when receiving +DSACK. + +Packetdrill to demonstrate: + +// Enable F-RTO and TLP + 0 `sysctl -q net.ipv4.tcp_frto=2` + 0 `sysctl -q net.ipv4.tcp_early_retrans=3` + 0 `sysctl -q net.ipv4.tcp_congestion_control=cubic` + +// Establish a connection + +0 socket(..., SOCK_STREAM, IPPROTO_TCP) = 3 + +0 setsockopt(3, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0 + +0 bind(3, ..., ...) = 0 + +0 listen(3, 1) = 0 + +// RTT 10ms, RTO 210ms + +.1 < S 0:0(0) win 32792 + +0 > S. 0:0(0) ack 1 <...> + +.01 < . 1:1(0) ack 1 win 257 + +0 accept(3, ..., ...) = 4 + +// Send 2 data segments + +0 write(4, ..., 2000) = 2000 + +0 > P. 1:2001(2000) ack 1 + +// TLP ++.022 > P. 1001:2001(1000) ack 1 + +// Continue to send 8 data segments + +0 write(4, ..., 10000) = 10000 + +0 > P. 2001:10001(8000) ack 1 + +// RTO ++.188 > . 1:1001(1000) ack 1 + +// The original data is acked and new data is sent(F-RTO step 2.b) + +0 < . 1:1(0) ack 2001 win 257 + +0 > P. 10001:12001(2000) ack 1 + +// D-SACK caused by TLP is regarded as a dupack, this results in +// the incorrect judgment of "loss was real"(F-RTO step 3.a) ++.022 < . 1:1(0) ack 2001 win 257 + +// Never-retransmitted data(3001:4001) are acked and +// expect to switch to open state(F-RTO step 3.b) + +0 < . 1:1(0) ack 4001 win 257 ++0 %{ assert tcpi_ca_state == 0, tcpi_ca_state }% + +Fixes: e33099f96d99 ("tcp: implement RFC5682 F-RTO") +Signed-off-by: Pengcheng Yang +Acked-by: Neal Cardwell +Tested-by: Neal Cardwell +Reviewed-by: Eric Dumazet +Link: https://lore.kernel.org/r/1650967419-2150-1-git-send-email-yangpc@wangsu.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_input.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index 525bf37c0fdb..7bf84ce34d9e 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -3867,7 +3867,8 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag) + tcp_process_tlp_ack(sk, ack, flag); + + if (tcp_ack_is_dubious(sk, flag)) { +- if (!(flag & (FLAG_SND_UNA_ADVANCED | FLAG_NOT_DUP))) { ++ if (!(flag & (FLAG_SND_UNA_ADVANCED | ++ FLAG_NOT_DUP | FLAG_DSACKING_ACK))) { + num_dupack = 1; + /* Consider if pure acks were aggregated in tcp_add_backlog() */ + if (!(flag & FLAG_DATA)) +-- +2.35.1 + diff --git a/queue-5.17/tcp-fix-potential-xmit-stalls-caused-by-tcp_notsent_.patch b/queue-5.17/tcp-fix-potential-xmit-stalls-caused-by-tcp_notsent_.patch new file mode 100644 index 00000000000..d356fe0a92c --- /dev/null +++ b/queue-5.17/tcp-fix-potential-xmit-stalls-caused-by-tcp_notsent_.patch @@ -0,0 +1,145 @@ +From c47bd01e9e5770f542a4cc6e0c02442468607ef4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 24 Apr 2022 17:34:07 -0700 +Subject: tcp: fix potential xmit stalls caused by TCP_NOTSENT_LOWAT + +From: Eric Dumazet + +[ Upstream commit 4bfe744ff1644fbc0a991a2677dc874475dd6776 ] + +I had this bug sitting for too long in my pile, it is time to fix it. + +Thanks to Doug Porter for reminding me of it! + +We had various attempts in the past, including commit +0cbe6a8f089e ("tcp: remove SOCK_QUEUE_SHRUNK"), +but the issue is that TCP stack currently only generates +EPOLLOUT from input path, when tp->snd_una has advanced +and skb(s) cleaned from rtx queue. + +If a flow has a big RTT, and/or receives SACKs, it is possible +that the notsent part (tp->write_seq - tp->snd_nxt) reaches 0 +and no more data can be sent until tp->snd_una finally advances. + +What is needed is to also check if POLLOUT needs to be generated +whenever tp->snd_nxt is advanced, from output path. + +This bug triggers more often after an idle period, as +we do not receive ACK for at least one RTT. tcp_notsent_lowat +could be a fraction of what CWND and pacing rate would allow to +send during this RTT. + +In a followup patch, I will remove the bogus call +to tcp_chrono_stop(sk, TCP_CHRONO_SNDBUF_LIMITED) +from tcp_check_space(). Fact that we have decided to generate +an EPOLLOUT does not mean the application has immediately +refilled the transmit queue. This optimistic call +might have been the reason the bug seemed not too serious. + +Tested: + +200 ms rtt, 1% packet loss, 32 MB tcp_rmem[2] and tcp_wmem[2] + +$ echo 500000 >/proc/sys/net/ipv4/tcp_notsent_lowat +$ cat bench_rr.sh +SUM=0 +for i in {1..10} +do + V=`netperf -H remote_host -l30 -t TCP_RR -- -r 10000000,10000 -o LOCAL_BYTES_SENT | egrep -v "MIGRATED|Bytes"` + echo $V + SUM=$(($SUM + $V)) +done +echo SUM=$SUM + +Before patch: +$ bench_rr.sh +130000000 +80000000 +140000000 +140000000 +140000000 +140000000 +130000000 +40000000 +90000000 +110000000 +SUM=1140000000 + +After patch: +$ bench_rr.sh +430000000 +590000000 +530000000 +450000000 +450000000 +350000000 +450000000 +490000000 +480000000 +460000000 +SUM=4680000000 # This is 410 % of the value before patch. + +Fixes: c9bee3b7fdec ("tcp: TCP_NOTSENT_LOWAT socket option") +Signed-off-by: Eric Dumazet +Reported-by: Doug Porter +Cc: Soheil Hassas Yeganeh +Cc: Neal Cardwell +Acked-by: Soheil Hassas Yeganeh +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/net/tcp.h | 1 + + net/ipv4/tcp_input.c | 12 +++++++++++- + net/ipv4/tcp_output.c | 1 + + 3 files changed, 13 insertions(+), 1 deletion(-) + +diff --git a/include/net/tcp.h b/include/net/tcp.h +index 9f459e8f1689..40c05972178b 100644 +--- a/include/net/tcp.h ++++ b/include/net/tcp.h +@@ -620,6 +620,7 @@ void tcp_synack_rtt_meas(struct sock *sk, struct request_sock *req); + void tcp_reset(struct sock *sk, struct sk_buff *skb); + void tcp_skb_mark_lost_uncond_verify(struct tcp_sock *tp, struct sk_buff *skb); + void tcp_fin(struct sock *sk); ++void tcp_check_space(struct sock *sk); + + /* tcp_timer.c */ + void tcp_init_xmit_timers(struct sock *); +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index bfe4112e000c..525bf37c0fdb 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -5437,7 +5437,17 @@ static void tcp_new_space(struct sock *sk) + INDIRECT_CALL_1(sk->sk_write_space, sk_stream_write_space, sk); + } + +-static void tcp_check_space(struct sock *sk) ++/* Caller made space either from: ++ * 1) Freeing skbs in rtx queues (after tp->snd_una has advanced) ++ * 2) Sent skbs from output queue (and thus advancing tp->snd_nxt) ++ * ++ * We might be able to generate EPOLLOUT to the application if: ++ * 1) Space consumed in output/rtx queues is below sk->sk_sndbuf/2 ++ * 2) notsent amount (tp->write_seq - tp->snd_nxt) became ++ * small enough that tcp_stream_memory_free() decides it ++ * is time to generate EPOLLOUT. ++ */ ++void tcp_check_space(struct sock *sk) + { + /* pairs with tcp_poll() */ + smp_mb(); +diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c +index 257780f93305..0b5eab685154 100644 +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -82,6 +82,7 @@ static void tcp_event_new_data_sent(struct sock *sk, struct sk_buff *skb) + + NET_ADD_STATS(sock_net(sk), LINUX_MIB_TCPORIGDATASENT, + tcp_skb_pcount(skb)); ++ tcp_check_space(sk); + } + + /* SND.NXT, if window was not shrunk or the amount of shrunk was less than one +-- +2.35.1 + diff --git a/queue-5.17/tcp-make-sure-treq-af_specific-is-initialized.patch b/queue-5.17/tcp-make-sure-treq-af_specific-is-initialized.patch new file mode 100644 index 00000000000..5db39b2dfc9 --- /dev/null +++ b/queue-5.17/tcp-make-sure-treq-af_specific-is-initialized.patch @@ -0,0 +1,145 @@ +From f00e14efc4983e0ca9ccdf6a58dc9f4949afc813 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 24 Apr 2022 13:35:09 -0700 +Subject: tcp: make sure treq->af_specific is initialized + +From: Eric Dumazet + +[ Upstream commit ba5a4fdd63ae0c575707030db0b634b160baddd7 ] + +syzbot complained about a recent change in TCP stack, +hitting a NULL pointer [1] + +tcp request sockets have an af_specific pointer, which +was used before the blamed change only for SYNACK generation +in non SYNCOOKIE mode. + +tcp requests sockets momentarily created when third packet +coming from client in SYNCOOKIE mode were not using +treq->af_specific. + +Make sure this field is populated, in the same way normal +TCP requests sockets do in tcp_conn_request(). + +[1] +TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. +general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN +KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] +CPU: 1 PID: 3695 Comm: syz-executor864 Not tainted 5.18.0-rc3-syzkaller-00224-g5fd1fe4807f9 #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 +RIP: 0010:tcp_create_openreq_child+0xe16/0x16b0 net/ipv4/tcp_minisocks.c:534 +Code: 48 c1 ea 03 80 3c 02 00 0f 85 e5 07 00 00 4c 8b b3 28 01 00 00 48 b8 00 00 00 00 00 fc ff df 49 8d 7e 08 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 c9 07 00 00 48 8b 3c 24 48 89 de 41 ff 56 08 48 +RSP: 0018:ffffc90000de0588 EFLAGS: 00010202 +RAX: dffffc0000000000 RBX: ffff888076490330 RCX: 0000000000000100 +RDX: 0000000000000001 RSI: ffffffff87d67ff0 RDI: 0000000000000008 +RBP: ffff88806ee1c7f8 R08: 0000000000000000 R09: 0000000000000000 +R10: ffffffff87d67f00 R11: 0000000000000000 R12: ffff88806ee1bfc0 +R13: ffff88801b0e0368 R14: 0000000000000000 R15: 0000000000000000 +FS: 00007f517fe58700(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 00007ffcead76960 CR3: 000000006f97b000 CR4: 00000000003506e0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +Call Trace: + + tcp_v6_syn_recv_sock+0x199/0x23b0 net/ipv6/tcp_ipv6.c:1267 + tcp_get_cookie_sock+0xc9/0x850 net/ipv4/syncookies.c:207 + cookie_v6_check+0x15c3/0x2340 net/ipv6/syncookies.c:258 + tcp_v6_cookie_check net/ipv6/tcp_ipv6.c:1131 [inline] + tcp_v6_do_rcv+0x1148/0x13b0 net/ipv6/tcp_ipv6.c:1486 + tcp_v6_rcv+0x3305/0x3840 net/ipv6/tcp_ipv6.c:1725 + ip6_protocol_deliver_rcu+0x2e9/0x1900 net/ipv6/ip6_input.c:422 + ip6_input_finish+0x14c/0x2c0 net/ipv6/ip6_input.c:464 + NF_HOOK include/linux/netfilter.h:307 [inline] + NF_HOOK include/linux/netfilter.h:301 [inline] + ip6_input+0x9c/0xd0 net/ipv6/ip6_input.c:473 + dst_input include/net/dst.h:461 [inline] + ip6_rcv_finish net/ipv6/ip6_input.c:76 [inline] + NF_HOOK include/linux/netfilter.h:307 [inline] + NF_HOOK include/linux/netfilter.h:301 [inline] + ipv6_rcv+0x27f/0x3b0 net/ipv6/ip6_input.c:297 + __netif_receive_skb_one_core+0x114/0x180 net/core/dev.c:5405 + __netif_receive_skb+0x24/0x1b0 net/core/dev.c:5519 + process_backlog+0x3a0/0x7c0 net/core/dev.c:5847 + __napi_poll+0xb3/0x6e0 net/core/dev.c:6413 + napi_poll net/core/dev.c:6480 [inline] + net_rx_action+0x8ec/0xc60 net/core/dev.c:6567 + __do_softirq+0x29b/0x9c2 kernel/softirq.c:558 + invoke_softirq kernel/softirq.c:432 [inline] + __irq_exit_rcu+0x123/0x180 kernel/softirq.c:637 + irq_exit_rcu+0x5/0x20 kernel/softirq.c:649 + sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1097 + +Fixes: 5b0b9e4c2c89 ("tcp: md5: incorrect tcp_header_len for incoming connections") +Signed-off-by: Eric Dumazet +Cc: Francesco Ruggeri +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/net/tcp.h | 1 + + net/ipv4/syncookies.c | 8 +++++++- + net/ipv6/syncookies.c | 3 ++- + 3 files changed, 10 insertions(+), 2 deletions(-) + +diff --git a/include/net/tcp.h b/include/net/tcp.h +index 40c05972178b..a3fe2f9bc01c 100644 +--- a/include/net/tcp.h ++++ b/include/net/tcp.h +@@ -480,6 +480,7 @@ int __cookie_v4_check(const struct iphdr *iph, const struct tcphdr *th, + u32 cookie); + struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb); + struct request_sock *cookie_tcp_reqsk_alloc(const struct request_sock_ops *ops, ++ const struct tcp_request_sock_ops *af_ops, + struct sock *sk, struct sk_buff *skb); + #ifdef CONFIG_SYN_COOKIES + +diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c +index 2cb3b852d148..f33c31dd7366 100644 +--- a/net/ipv4/syncookies.c ++++ b/net/ipv4/syncookies.c +@@ -281,6 +281,7 @@ bool cookie_ecn_ok(const struct tcp_options_received *tcp_opt, + EXPORT_SYMBOL(cookie_ecn_ok); + + struct request_sock *cookie_tcp_reqsk_alloc(const struct request_sock_ops *ops, ++ const struct tcp_request_sock_ops *af_ops, + struct sock *sk, + struct sk_buff *skb) + { +@@ -297,6 +298,10 @@ struct request_sock *cookie_tcp_reqsk_alloc(const struct request_sock_ops *ops, + return NULL; + + treq = tcp_rsk(req); ++ ++ /* treq->af_specific might be used to perform TCP_MD5 lookup */ ++ treq->af_specific = af_ops; ++ + treq->syn_tos = TCP_SKB_CB(skb)->ip_dsfield; + #if IS_ENABLED(CONFIG_MPTCP) + treq->is_mptcp = sk_is_mptcp(sk); +@@ -364,7 +369,8 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb) + goto out; + + ret = NULL; +- req = cookie_tcp_reqsk_alloc(&tcp_request_sock_ops, sk, skb); ++ req = cookie_tcp_reqsk_alloc(&tcp_request_sock_ops, ++ &tcp_request_sock_ipv4_ops, sk, skb); + if (!req) + goto out; + +diff --git a/net/ipv6/syncookies.c b/net/ipv6/syncookies.c +index d1b61d00368e..9cc123f000fb 100644 +--- a/net/ipv6/syncookies.c ++++ b/net/ipv6/syncookies.c +@@ -170,7 +170,8 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb) + goto out; + + ret = NULL; +- req = cookie_tcp_reqsk_alloc(&tcp6_request_sock_ops, sk, skb); ++ req = cookie_tcp_reqsk_alloc(&tcp6_request_sock_ops, ++ &tcp_request_sock_ipv6_ops, sk, skb); + if (!req) + goto out; + +-- +2.35.1 + diff --git a/queue-5.17/tcp-md5-incorrect-tcp_header_len-for-incoming-connec.patch b/queue-5.17/tcp-md5-incorrect-tcp_header_len-for-incoming-connec.patch new file mode 100644 index 00000000000..46f32d359f9 --- /dev/null +++ b/queue-5.17/tcp-md5-incorrect-tcp_header_len-for-incoming-connec.patch @@ -0,0 +1,40 @@ +From 3ad225bd4cf79f4b6b8df538a6219db4dd2ee173 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Apr 2022 17:50:26 -0700 +Subject: tcp: md5: incorrect tcp_header_len for incoming connections + +From: Francesco Ruggeri + +[ Upstream commit 5b0b9e4c2c895227c8852488b3f09839233bba54 ] + +In tcp_create_openreq_child we adjust tcp_header_len for md5 using the +remote address in newsk. But that address is still 0 in newsk at this +point, and it is only set later by the callers (tcp_v[46]_syn_recv_sock). +Use the address from the request socket instead. + +Fixes: cfb6eeb4c860 ("[TCP]: MD5 Signature Option (RFC2385) support.") +Signed-off-by: Francesco Ruggeri +Reviewed-by: Eric Dumazet +Link: https://lore.kernel.org/r/20220421005026.686A45EC01F2@us226.sjc.aristanetworks.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_minisocks.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c +index 7c2d3ac2363a..492737d2b7d3 100644 +--- a/net/ipv4/tcp_minisocks.c ++++ b/net/ipv4/tcp_minisocks.c +@@ -531,7 +531,7 @@ struct sock *tcp_create_openreq_child(const struct sock *sk, + newtp->tsoffset = treq->ts_off; + #ifdef CONFIG_TCP_MD5SIG + newtp->md5sig_info = NULL; /*XXX*/ +- if (newtp->af_specific->md5_lookup(sk, newsk)) ++ if (treq->af_specific->req_md5_lookup(sk, req_to_sk(req))) + newtp->tcp_header_len += TCPOLEN_MD5SIG_ALIGNED; + #endif + if (skb->len >= TCP_MSS_DEFAULT + newtp->tcp_header_len) +-- +2.35.1 + diff --git a/queue-5.17/tee-optee-add-missing-mutext_destroy-in-optee_ffa_pr.patch b/queue-5.17/tee-optee-add-missing-mutext_destroy-in-optee_ffa_pr.patch new file mode 100644 index 00000000000..cb57a6b4c93 --- /dev/null +++ b/queue-5.17/tee-optee-add-missing-mutext_destroy-in-optee_ffa_pr.patch @@ -0,0 +1,37 @@ +From 555d9e87e6f5802a244cf6e20a3934168773bf66 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Mar 2022 21:50:47 +0800 +Subject: tee: optee: add missing mutext_destroy in optee_ffa_probe + +From: Dongliang Mu + +[ Upstream commit b5e22886839ae466fcf03295150094516c0fd8eb ] + +The error handling code of optee_ffa_probe misses the mutex_destroy of +ffa.mutex when mutext_init succeeds. + +Fix this by adding mutex_destory of ffa.mutex at the error handling part + +Fixes: aceeafefff73 ("optee: use driver internal tee_context for some rpc") +Signed-off-by: Dongliang Mu +Signed-off-by: Jens Wiklander +Signed-off-by: Sasha Levin +--- + drivers/tee/optee/ffa_abi.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/tee/optee/ffa_abi.c b/drivers/tee/optee/ffa_abi.c +index f744ab15bf2c..30a6119a2b16 100644 +--- a/drivers/tee/optee/ffa_abi.c ++++ b/drivers/tee/optee/ffa_abi.c +@@ -894,6 +894,7 @@ static int optee_ffa_probe(struct ffa_device *ffa_dev) + rhashtable_free_and_destroy(&optee->ffa.global_ids, rh_free_fn, NULL); + optee_supp_uninit(&optee->supp); + mutex_destroy(&optee->call_queue.mutex); ++ mutex_destroy(&optee->ffa.mutex); + err_unreg_supp_teedev: + tee_device_unregister(optee->supp_teedev); + err_unreg_teedev: +-- +2.35.1 + diff --git a/queue-5.17/tls-skip-tls_append_frag-on-zero-copy-size.patch b/queue-5.17/tls-skip-tls_append_frag-on-zero-copy-size.patch new file mode 100644 index 00000000000..3c05aa77d9c --- /dev/null +++ b/queue-5.17/tls-skip-tls_append_frag-on-zero-copy-size.patch @@ -0,0 +1,59 @@ +From bdb52280cd468abdb0ae6d883d12573823d61b03 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Apr 2022 18:49:49 +0300 +Subject: tls: Skip tls_append_frag on zero copy size + +From: Maxim Mikityanskiy + +[ Upstream commit a0df71948e9548de819a6f1da68f5f1742258a52 ] + +Calling tls_append_frag when max_open_record_len == record->len might +add an empty fragment to the TLS record if the call happens to be on the +page boundary. Normally tls_append_frag coalesces the zero-sized +fragment to the previous one, but not if it's on page boundary. + +If a resync happens then, the mlx5 driver posts dump WQEs in +tx_post_resync_dump, and the empty fragment may become a data segment +with byte_count == 0, which will confuse the NIC and lead to a CQE +error. + +This commit fixes the described issue by skipping tls_append_frag on +zero size to avoid adding empty fragments. The fix is not in the driver, +because an empty fragment is hardly the desired behavior. + +Fixes: e8f69799810c ("net/tls: Add generic NIC offload infrastructure") +Signed-off-by: Maxim Mikityanskiy +Reviewed-by: Tariq Toukan +Link: https://lore.kernel.org/r/20220426154949.159055-1-maximmi@nvidia.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/tls/tls_device.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +diff --git a/net/tls/tls_device.c b/net/tls/tls_device.c +index b932469ee69c..a40553e83f8b 100644 +--- a/net/tls/tls_device.c ++++ b/net/tls/tls_device.c +@@ -483,11 +483,13 @@ static int tls_push_data(struct sock *sk, + copy = min_t(size_t, size, (pfrag->size - pfrag->offset)); + copy = min_t(size_t, copy, (max_open_record_len - record->len)); + +- rc = tls_device_copy_data(page_address(pfrag->page) + +- pfrag->offset, copy, msg_iter); +- if (rc) +- goto handle_error; +- tls_append_frag(record, pfrag, copy); ++ if (copy) { ++ rc = tls_device_copy_data(page_address(pfrag->page) + ++ pfrag->offset, copy, msg_iter); ++ if (rc) ++ goto handle_error; ++ tls_append_frag(record, pfrag, copy); ++ } + + size -= copy; + if (!size) { +-- +2.35.1 + diff --git a/queue-5.17/usb-fix-xhci-event-ring-dequeue-pointer-erdp-update-.patch b/queue-5.17/usb-fix-xhci-event-ring-dequeue-pointer-erdp-update-.patch new file mode 100644 index 00000000000..91c6875106a --- /dev/null +++ b/queue-5.17/usb-fix-xhci-event-ring-dequeue-pointer-erdp-update-.patch @@ -0,0 +1,64 @@ +From bb4337fdb6f04642fdf4e8f4e6d87fe826eb7df6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Apr 2022 16:48:21 +0300 +Subject: USB: Fix xhci event ring dequeue pointer ERDP update issue + +From: Weitao Wang + +[ Upstream commit e91ac20889d1a26d077cc511365cd7ff4346a6f3 ] + +In some situations software handles TRB events slower than adding TRBs. +If the number of TRB events to be processed in a given interrupt is exactly +the same as the event ring size 256, then the local variable +"event_ring_deq" that holds the initial dequeue position is equal to +software_dequeue after handling all 256 interrupts. + +It will cause driver to not update ERDP to hardware, + +Software dequeue pointer is out of sync with ERDP on interrupt exit. +On the next interrupt, the event ring may full but driver will not +update ERDP as software_dequeue is equal to ERDP. + +[ 536.377115] xhci_hcd 0000:00:12.0: ERROR unknown event type 37 +[ 566.933173] sd 8:0:0:0: [sdb] tag#27 uas_eh_abort_handler 0 uas-tag 7 inflight: CMD OUT +[ 566.933181] sd 8:0:0:0: [sdb] tag#27 CDB: Write(10) 2a 00 17 71 e6 78 00 00 08 00 +[ 572.041186] xhci_hcd On some situataions,the0000:00:12.0: xHCI host not responding to stop endpoint command. +[ 572.057193] xhci_hcd 0000:00:12.0: Host halt failed, -110 +[ 572.057196] xhci_hcd 0000:00:12.0: xHCI host controller not responding, assume dead +[ 572.057236] sd 8:0:0:0: [sdb] tag#26 uas_eh_abort_handler 0 uas-tag 6 inflight: CMD +[ 572.057240] sd 8:0:0:0: [sdb] tag#26 CDB: Write(10) 2a 00 38 eb cc d8 00 00 08 00 +[ 572.057244] sd 8:0:0:0: [sdb] tag#25 uas_eh_abort_handler 0 uas-tag 5 inflight: CMD + +Hardware ERDP is updated mid event handling if there are more than 128 +events in an interrupt (half of ring size). +Fix this by updating the software local variable at the same time as +hardware ERDP. + +[commit message rewording -Mathias] + +Fixes: dc0ffbea5729 ("usb: host: xhci: update event ring dequeue pointer on purpose") +Reviewed-by: Peter Chen +Signed-off-by: Weitao Wang +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20220408134823.2527272-2-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/host/xhci-ring.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c +index d0b6806275e0..f9707997969d 100644 +--- a/drivers/usb/host/xhci-ring.c ++++ b/drivers/usb/host/xhci-ring.c +@@ -3141,6 +3141,7 @@ irqreturn_t xhci_irq(struct usb_hcd *hcd) + if (event_loop++ < TRBS_PER_SEGMENT / 2) + continue; + xhci_update_erst_dequeue(xhci, event_ring_deq); ++ event_ring_deq = xhci->event_ring->dequeue; + + /* ring is half-full, force isoc trbs to interrupt more often */ + if (xhci->isoc_bei_interval > AVOID_BEI_INTERVAL_MIN) +-- +2.35.1 + diff --git a/queue-5.17/video-fbdev-udlfb-properly-check-endpoint-type.patch b/queue-5.17/video-fbdev-udlfb-properly-check-endpoint-type.patch new file mode 100644 index 00000000000..4e7014a16cb --- /dev/null +++ b/queue-5.17/video-fbdev-udlfb-properly-check-endpoint-type.patch @@ -0,0 +1,92 @@ +From 7a6d20de15da7d7d509eba1c2ea5160808e85e5c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Mar 2022 23:04:38 +0300 +Subject: video: fbdev: udlfb: properly check endpoint type + +From: Pavel Skripkin + +[ Upstream commit aaf7dbe07385e0b8deb7237eca2a79926bbc7091 ] + +syzbot reported warning in usb_submit_urb, which is caused by wrong +endpoint type. + +This driver uses out bulk endpoint for communication, so +let's check if this endpoint is present and bail out early if not. + +Fail log: + +usb 1-1: BOGUS urb xfer, pipe 3 != type 1 +WARNING: CPU: 0 PID: 4822 at drivers/usb/core/urb.c:493 usb_submit_urb+0xd27/0x1540 drivers/usb/core/urb.c:493 +Modules linked in: +CPU: 0 PID: 4822 Comm: kworker/0:3 Tainted: G W 5.13.0-syzkaller #0 +... +Workqueue: usb_hub_wq hub_event +RIP: 0010:usb_submit_urb+0xd27/0x1540 drivers/usb/core/urb.c:493 +... +Call Trace: + dlfb_submit_urb+0x89/0x160 drivers/video/fbdev/udlfb.c:1969 + dlfb_set_video_mode+0x21f0/0x2950 drivers/video/fbdev/udlfb.c:315 + dlfb_ops_set_par+0x2a3/0x840 drivers/video/fbdev/udlfb.c:1110 + dlfb_usb_probe.cold+0x113e/0x1f4a drivers/video/fbdev/udlfb.c:1732 + usb_probe_interface+0x315/0x7f0 drivers/usb/core/driver.c:396 + +Fixes: 88e58b1a42f8 ("Staging: add udlfb driver") +Reported-and-tested-by: syzbot+53ce4a4246d0fe0fee34@syzkaller.appspotmail.com +Signed-off-by: Pavel Skripkin +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/udlfb.c | 14 ++++++++++++-- + 1 file changed, 12 insertions(+), 2 deletions(-) + +diff --git a/drivers/video/fbdev/udlfb.c b/drivers/video/fbdev/udlfb.c +index 90f48b71fd8f..d9eec1b60e66 100644 +--- a/drivers/video/fbdev/udlfb.c ++++ b/drivers/video/fbdev/udlfb.c +@@ -1649,8 +1649,9 @@ static int dlfb_usb_probe(struct usb_interface *intf, + const struct device_attribute *attr; + struct dlfb_data *dlfb; + struct fb_info *info; +- int retval = -ENOMEM; ++ int retval; + struct usb_device *usbdev = interface_to_usbdev(intf); ++ struct usb_endpoint_descriptor *out; + + /* usb initialization */ + dlfb = kzalloc(sizeof(*dlfb), GFP_KERNEL); +@@ -1664,6 +1665,12 @@ static int dlfb_usb_probe(struct usb_interface *intf, + dlfb->udev = usb_get_dev(usbdev); + usb_set_intfdata(intf, dlfb); + ++ retval = usb_find_common_endpoints(intf->cur_altsetting, NULL, &out, NULL, NULL); ++ if (retval) { ++ dev_err(&intf->dev, "Device should have at lease 1 bulk endpoint!\n"); ++ goto error; ++ } ++ + dev_dbg(&intf->dev, "console enable=%d\n", console); + dev_dbg(&intf->dev, "fb_defio enable=%d\n", fb_defio); + dev_dbg(&intf->dev, "shadow enable=%d\n", shadow); +@@ -1673,6 +1680,7 @@ static int dlfb_usb_probe(struct usb_interface *intf, + if (!dlfb_parse_vendor_descriptor(dlfb, intf)) { + dev_err(&intf->dev, + "firmware not recognized, incompatible device?\n"); ++ retval = -ENODEV; + goto error; + } + +@@ -1686,8 +1694,10 @@ static int dlfb_usb_probe(struct usb_interface *intf, + + /* allocates framebuffer driver structure, not framebuffer memory */ + info = framebuffer_alloc(0, &dlfb->udev->dev); +- if (!info) ++ if (!info) { ++ retval = -ENOMEM; + goto error; ++ } + + dlfb->info = info; + info->par = dlfb; +-- +2.35.1 + diff --git a/queue-5.17/wireguard-device-check-for-metadata_dst-with-skb_val.patch b/queue-5.17/wireguard-device-check-for-metadata_dst-with-skb_val.patch new file mode 100644 index 00000000000..032569ba10e --- /dev/null +++ b/queue-5.17/wireguard-device-check-for-metadata_dst-with-skb_val.patch @@ -0,0 +1,103 @@ +From 3484ba0b6800665e27e2711cc119aaddd645101e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Apr 2022 15:48:05 +0200 +Subject: wireguard: device: check for metadata_dst with skb_valid_dst() + +From: Nikolay Aleksandrov + +[ Upstream commit 45ac774c33d834fe9d4de06ab5f1022fe8cd2071 ] + +When we try to transmit an skb with md_dst attached through wireguard +we hit a null pointer dereference in wg_xmit() due to the use of +dst_mtu() which calls into dst_blackhole_mtu() which in turn tries to +dereference dst->dev. + +Since wireguard doesn't use md_dsts we should use skb_valid_dst(), which +checks for DST_METADATA flag, and if it's set, then falls back to +wireguard's device mtu. That gives us the best chance of transmitting +the packet; otherwise if the blackhole netdev is used we'd get +ETH_MIN_MTU. + + [ 263.693506] BUG: kernel NULL pointer dereference, address: 00000000000000e0 + [ 263.693908] #PF: supervisor read access in kernel mode + [ 263.694174] #PF: error_code(0x0000) - not-present page + [ 263.694424] PGD 0 P4D 0 + [ 263.694653] Oops: 0000 [#1] PREEMPT SMP NOPTI + [ 263.694876] CPU: 5 PID: 951 Comm: mausezahn Kdump: loaded Not tainted 5.18.0-rc1+ #522 + [ 263.695190] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1.fc35 04/01/2014 + [ 263.695529] RIP: 0010:dst_blackhole_mtu+0x17/0x20 + [ 263.695770] Code: 00 00 00 0f 1f 44 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 8b 47 10 48 83 e0 fc 8b 40 04 85 c0 75 09 48 8b 07 <8b> 80 e0 00 00 00 c3 66 90 0f 1f 44 00 00 48 89 d7 be 01 00 00 00 + [ 263.696339] RSP: 0018:ffffa4a4422fbb28 EFLAGS: 00010246 + [ 263.696600] RAX: 0000000000000000 RBX: ffff8ac9c3553000 RCX: 0000000000000000 + [ 263.696891] RDX: 0000000000000401 RSI: 00000000fffffe01 RDI: ffffc4a43fb48900 + [ 263.697178] RBP: ffffa4a4422fbb90 R08: ffffffff9622635e R09: 0000000000000002 + [ 263.697469] R10: ffffffff9b69a6c0 R11: ffffa4a4422fbd0c R12: ffff8ac9d18b1a00 + [ 263.697766] R13: ffff8ac9d0ce1840 R14: ffff8ac9d18b1a00 R15: ffff8ac9c3553000 + [ 263.698054] FS: 00007f3704c337c0(0000) GS:ffff8acaebf40000(0000) knlGS:0000000000000000 + [ 263.698470] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + [ 263.698826] CR2: 00000000000000e0 CR3: 0000000117a5c000 CR4: 00000000000006e0 + [ 263.699214] Call Trace: + [ 263.699505] + [ 263.699759] wg_xmit+0x411/0x450 + [ 263.700059] ? bpf_skb_set_tunnel_key+0x46/0x2d0 + [ 263.700382] ? dev_queue_xmit_nit+0x31/0x2b0 + [ 263.700719] dev_hard_start_xmit+0xd9/0x220 + [ 263.701047] __dev_queue_xmit+0x8b9/0xd30 + [ 263.701344] __bpf_redirect+0x1a4/0x380 + [ 263.701664] __dev_queue_xmit+0x83b/0xd30 + [ 263.701961] ? packet_parse_headers+0xb4/0xf0 + [ 263.702275] packet_sendmsg+0x9a8/0x16a0 + [ 263.702596] ? _raw_spin_unlock_irqrestore+0x23/0x40 + [ 263.702933] sock_sendmsg+0x5e/0x60 + [ 263.703239] __sys_sendto+0xf0/0x160 + [ 263.703549] __x64_sys_sendto+0x20/0x30 + [ 263.703853] do_syscall_64+0x3b/0x90 + [ 263.704162] entry_SYSCALL_64_after_hwframe+0x44/0xae + [ 263.704494] RIP: 0033:0x7f3704d50506 + [ 263.704789] Code: 48 c7 c0 ff ff ff ff eb b7 66 2e 0f 1f 84 00 00 00 00 00 90 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 11 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 72 c3 90 55 48 83 ec 30 44 89 4c 24 2c 4c 89 + [ 263.705652] RSP: 002b:00007ffe954b0b88 EFLAGS: 00000246 ORIG_RAX: 000000000000002c + [ 263.706141] RAX: ffffffffffffffda RBX: 0000558bb259b490 RCX: 00007f3704d50506 + [ 263.706544] RDX: 000000000000004a RSI: 0000558bb259b7b2 RDI: 0000000000000003 + [ 263.706952] RBP: 0000000000000000 R08: 00007ffe954b0b90 R09: 0000000000000014 + [ 263.707339] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffe954b0b90 + [ 263.707735] R13: 000000000000004a R14: 0000558bb259b7b2 R15: 0000000000000001 + [ 263.708132] + [ 263.708398] Modules linked in: bridge netconsole bonding [last unloaded: bridge] + [ 263.708942] CR2: 00000000000000e0 + +Fixes: e7096c131e51 ("net: WireGuard secure network tunnel") +Link: https://github.com/cilium/cilium/issues/19428 +Reported-by: Martynas Pumputis +Signed-off-by: Nikolay Aleksandrov +Acked-by: Daniel Borkmann +Signed-off-by: Jason A. Donenfeld +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/wireguard/device.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireguard/device.c b/drivers/net/wireguard/device.c +index a46067c38bf5..5eaef79c06e1 100644 +--- a/drivers/net/wireguard/device.c ++++ b/drivers/net/wireguard/device.c +@@ -19,6 +19,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -152,7 +153,7 @@ static netdev_tx_t wg_xmit(struct sk_buff *skb, struct net_device *dev) + goto err_peer; + } + +- mtu = skb_dst(skb) ? dst_mtu(skb_dst(skb)) : dev->mtu; ++ mtu = skb_valid_dst(skb) ? dst_mtu(skb_dst(skb)) : dev->mtu; + + __skb_queue_head_init(&packets); + if (!skb_is_gso(skb)) { +-- +2.35.1 + diff --git a/queue-5.17/x86-__memcpy_flushcache-fix-wrong-alignment-if-size-.patch b/queue-5.17/x86-__memcpy_flushcache-fix-wrong-alignment-if-size-.patch new file mode 100644 index 00000000000..65c4aa37765 --- /dev/null +++ b/queue-5.17/x86-__memcpy_flushcache-fix-wrong-alignment-if-size-.patch @@ -0,0 +1,51 @@ +From 64e4b936791a3a750dc892e741a3c5c93d290a3f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Apr 2022 09:56:23 -0400 +Subject: x86: __memcpy_flushcache: fix wrong alignment if size > 2^32 + +From: Mikulas Patocka + +[ Upstream commit a6823e4e360fe975bd3da4ab156df7c74c8b07f3 ] + +The first "if" condition in __memcpy_flushcache is supposed to align the +"dest" variable to 8 bytes and copy data up to this alignment. However, +this condition may misbehave if "size" is greater than 4GiB. + +The statement min_t(unsigned, size, ALIGN(dest, 8) - dest); casts both +arguments to unsigned int and selects the smaller one. However, the +cast truncates high bits in "size" and it results in misbehavior. + +For example: + + suppose that size == 0x100000001, dest == 0x200000002 + min_t(unsigned, size, ALIGN(dest, 8) - dest) == min_t(0x1, 0xe) == 0x1; + ... + dest += 0x1; + +so we copy just one byte "and" dest remains unaligned. + +This patch fixes the bug by replacing unsigned with size_t. + +Signed-off-by: Mikulas Patocka +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + arch/x86/lib/usercopy_64.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/x86/lib/usercopy_64.c b/arch/x86/lib/usercopy_64.c +index 0402a749f3a0..0ae6cf804197 100644 +--- a/arch/x86/lib/usercopy_64.c ++++ b/arch/x86/lib/usercopy_64.c +@@ -119,7 +119,7 @@ void __memcpy_flushcache(void *_dst, const void *_src, size_t size) + + /* cache copy and flush to align dest */ + if (!IS_ALIGNED(dest, 8)) { +- unsigned len = min_t(unsigned, size, ALIGN(dest, 8) - dest); ++ size_t len = min_t(size_t, size, ALIGN(dest, 8) - dest); + + memcpy((void *) dest, (void *) source, len); + clean_cache_range((void *) dest, len); +-- +2.35.1 + diff --git a/queue-5.17/xsk-fix-l2fwd-for-copy-mode-busy-poll-combo.patch b/queue-5.17/xsk-fix-l2fwd-for-copy-mode-busy-poll-combo.patch new file mode 100644 index 00000000000..954f32f5f71 --- /dev/null +++ b/queue-5.17/xsk-fix-l2fwd-for-copy-mode-busy-poll-combo.patch @@ -0,0 +1,55 @@ +From 2427cd8ab5e033723c6596d643c7ff71eae8e70b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Apr 2022 17:58:04 +0200 +Subject: xsk: Fix l2fwd for copy mode + busy poll combo + +From: Maciej Fijalkowski + +[ Upstream commit 8de8b71b787f38983d414d2dba169a3bfefa668a ] + +While checking AF_XDP copy mode combined with busy poll, strange +results were observed. rxdrop and txonly scenarios worked fine, but +l2fwd broke immediately. + +After a deeper look, it turned out that for l2fwd, Tx side was exiting +early due to xsk_no_wakeup() returning true and in the end +xsk_generic_xmit() was never called. Note that AF_XDP Tx in copy mode +is syscall steered, so the current behavior is broken. + +Txonly scenario only worked due to the fact that +sk_mark_napi_id_once_xdp() was never called - since Rx side is not in +the picture for this case and mentioned function is called in +xsk_rcv_check(), sk::sk_napi_id was never set, which in turn meant that +xsk_no_wakeup() was returning false (see the sk->sk_napi_id >= +MIN_NAPI_ID check in there). + +To fix this, prefer busy poll in xsk_sendmsg() only when zero copy is +enabled on a given AF_XDP socket. By doing so, busy poll in copy mode +would not exit early on Tx side and eventually xsk_generic_xmit() will +be called. + +Fixes: a0731952d9cd ("xsk: Add busy-poll support for {recv,send}msg()") +Signed-off-by: Maciej Fijalkowski +Signed-off-by: Daniel Borkmann +Link: https://lore.kernel.org/bpf/20220406155804.434493-1-maciej.fijalkowski@intel.com +Signed-off-by: Sasha Levin +--- + net/xdp/xsk.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c +index ac343cd8ff3f..39a82bfb5caa 100644 +--- a/net/xdp/xsk.c ++++ b/net/xdp/xsk.c +@@ -640,7 +640,7 @@ static int __xsk_sendmsg(struct socket *sock, struct msghdr *m, size_t total_len + if (sk_can_busy_loop(sk)) + sk_busy_loop(sk, 1); /* only support non-blocking sockets */ + +- if (xsk_no_wakeup(sk)) ++ if (xs->zc && xsk_no_wakeup(sk)) + return 0; + + pool = xs->pool; +-- +2.35.1 +