From: Sasha Levin Date: Mon, 22 Aug 2022 13:27:03 +0000 (-0400) Subject: Fixes for 5.10 X-Git-Tag: v4.9.326~29^2~4 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=d2c289539660b70266d8f164249018f95bf5a29e;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.10 Signed-off-by: Sasha Levin --- diff --git a/queue-5.10/alsa-control-use-deferred-fasync-helper.patch b/queue-5.10/alsa-control-use-deferred-fasync-helper.patch new file mode 100644 index 00000000000..bce39796a25 --- /dev/null +++ b/queue-5.10/alsa-control-use-deferred-fasync-helper.patch @@ -0,0 +1,81 @@ +From b69651fe6eb9a2fc50a7d9ab8fc075a724c3e016 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Jul 2022 14:59:45 +0200 +Subject: ALSA: control: Use deferred fasync helper + +From: Takashi Iwai + +[ Upstream commit 4a971e84a7ae10a38d875cd2d4e487c8d1682ca3 ] + +For avoiding the potential deadlock via kill_fasync() call, use the +new fasync helpers to defer the invocation from the control API. Note +that it's merely a workaround. + +Another note: although we haven't received reports about the deadlock +with the control API, the deadlock is still potentially possible, and +it's better to align the behavior with other core APIs (PCM and +timer); so let's move altogether. + +Link: https://lore.kernel.org/r/20220728125945.29533-5-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + include/sound/control.h | 2 +- + sound/core/control.c | 7 ++++--- + 2 files changed, 5 insertions(+), 4 deletions(-) + +diff --git a/include/sound/control.h b/include/sound/control.h +index 77d9fa10812d..41bd72ffd232 100644 +--- a/include/sound/control.h ++++ b/include/sound/control.h +@@ -103,7 +103,7 @@ struct snd_ctl_file { + int preferred_subdevice[SND_CTL_SUBDEV_ITEMS]; + wait_queue_head_t change_sleep; + spinlock_t read_lock; +- struct fasync_struct *fasync; ++ struct snd_fasync *fasync; + int subscribed; /* read interface is activated */ + struct list_head events; /* waiting events for read */ + }; +diff --git a/sound/core/control.c b/sound/core/control.c +index 3b44378b9dec..732eb515d2f5 100644 +--- a/sound/core/control.c ++++ b/sound/core/control.c +@@ -121,6 +121,7 @@ static int snd_ctl_release(struct inode *inode, struct file *file) + if (control->vd[idx].owner == ctl) + control->vd[idx].owner = NULL; + up_write(&card->controls_rwsem); ++ snd_fasync_free(ctl->fasync); + snd_ctl_empty_read_queue(ctl); + put_pid(ctl->pid); + kfree(ctl); +@@ -175,7 +176,7 @@ void snd_ctl_notify(struct snd_card *card, unsigned int mask, + _found: + wake_up(&ctl->change_sleep); + spin_unlock(&ctl->read_lock); +- kill_fasync(&ctl->fasync, SIGIO, POLL_IN); ++ snd_kill_fasync(ctl->fasync, SIGIO, POLL_IN); + } + read_unlock_irqrestore(&card->ctl_files_rwlock, flags); + } +@@ -1941,7 +1942,7 @@ static int snd_ctl_fasync(int fd, struct file * file, int on) + struct snd_ctl_file *ctl; + + ctl = file->private_data; +- return fasync_helper(fd, file, on, &ctl->fasync); ++ return snd_fasync_helper(fd, file, on, &ctl->fasync); + } + + /* return the preferred subdevice number if already assigned; +@@ -2015,7 +2016,7 @@ static int snd_ctl_dev_disconnect(struct snd_device *device) + read_lock_irqsave(&card->ctl_files_rwlock, flags); + list_for_each_entry(ctl, &card->ctl_files, list) { + wake_up(&ctl->change_sleep); +- kill_fasync(&ctl->fasync, SIGIO, POLL_ERR); ++ snd_kill_fasync(ctl->fasync, SIGIO, POLL_ERR); + } + read_unlock_irqrestore(&card->ctl_files_rwlock, flags); + +-- +2.35.1 + diff --git a/queue-5.10/alsa-core-add-async-signal-helpers.patch b/queue-5.10/alsa-core-add-async-signal-helpers.patch new file mode 100644 index 00000000000..d8891c1328b --- /dev/null +++ b/queue-5.10/alsa-core-add-async-signal-helpers.patch @@ -0,0 +1,158 @@ +From 8f33e57bfdc2a97655ca9dd201855736c775ddab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Jul 2022 14:59:42 +0200 +Subject: ALSA: core: Add async signal helpers + +From: Takashi Iwai + +[ Upstream commit ef34a0ae7a2654bc9e58675e36898217fb2799d8 ] + +Currently the call of kill_fasync() from an interrupt handler might +lead to potential spin deadlocks, as spotted by syzkaller. +Unfortunately, it's not so trivial to fix this lock chain as it's +involved with the tasklist_lock that is touched in allover places. + +As a temporary workaround, this patch provides the way to defer the +async signal notification in a work. The new helper functions, +snd_fasync_helper() and snd_kill_faync() are replacements for +fasync_helper() and kill_fasync(), respectively. In addition, +snd_fasync_free() needs to be called at the destructor of the relevant +file object. + +Link: https://lore.kernel.org/r/20220728125945.29533-2-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + include/sound/core.h | 8 ++++ + sound/core/misc.c | 94 ++++++++++++++++++++++++++++++++++++++++++++ + 2 files changed, 102 insertions(+) + +diff --git a/include/sound/core.h b/include/sound/core.h +index 0462c577d7a3..85610ede9ea0 100644 +--- a/include/sound/core.h ++++ b/include/sound/core.h +@@ -446,4 +446,12 @@ snd_pci_quirk_lookup_id(u16 vendor, u16 device, + } + #endif + ++/* async signal helpers */ ++struct snd_fasync; ++ ++int snd_fasync_helper(int fd, struct file *file, int on, ++ struct snd_fasync **fasyncp); ++void snd_kill_fasync(struct snd_fasync *fasync, int signal, int poll); ++void snd_fasync_free(struct snd_fasync *fasync); ++ + #endif /* __SOUND_CORE_H */ +diff --git a/sound/core/misc.c b/sound/core/misc.c +index 3579dd7a161f..c3f3d94b5197 100644 +--- a/sound/core/misc.c ++++ b/sound/core/misc.c +@@ -10,6 +10,7 @@ + #include + #include + #include ++#include + #include + + #ifdef CONFIG_SND_DEBUG +@@ -145,3 +146,96 @@ snd_pci_quirk_lookup(struct pci_dev *pci, const struct snd_pci_quirk *list) + } + EXPORT_SYMBOL(snd_pci_quirk_lookup); + #endif ++ ++/* ++ * Deferred async signal helpers ++ * ++ * Below are a few helper functions to wrap the async signal handling ++ * in the deferred work. The main purpose is to avoid the messy deadlock ++ * around tasklist_lock and co at the kill_fasync() invocation. ++ * fasync_helper() and kill_fasync() are replaced with snd_fasync_helper() ++ * and snd_kill_fasync(), respectively. In addition, snd_fasync_free() has ++ * to be called at releasing the relevant file object. ++ */ ++struct snd_fasync { ++ struct fasync_struct *fasync; ++ int signal; ++ int poll; ++ int on; ++ struct list_head list; ++}; ++ ++static DEFINE_SPINLOCK(snd_fasync_lock); ++static LIST_HEAD(snd_fasync_list); ++ ++static void snd_fasync_work_fn(struct work_struct *work) ++{ ++ struct snd_fasync *fasync; ++ ++ spin_lock_irq(&snd_fasync_lock); ++ while (!list_empty(&snd_fasync_list)) { ++ fasync = list_first_entry(&snd_fasync_list, struct snd_fasync, list); ++ list_del_init(&fasync->list); ++ spin_unlock_irq(&snd_fasync_lock); ++ if (fasync->on) ++ kill_fasync(&fasync->fasync, fasync->signal, fasync->poll); ++ spin_lock_irq(&snd_fasync_lock); ++ } ++ spin_unlock_irq(&snd_fasync_lock); ++} ++ ++static DECLARE_WORK(snd_fasync_work, snd_fasync_work_fn); ++ ++int snd_fasync_helper(int fd, struct file *file, int on, ++ struct snd_fasync **fasyncp) ++{ ++ struct snd_fasync *fasync = NULL; ++ ++ if (on) { ++ fasync = kzalloc(sizeof(*fasync), GFP_KERNEL); ++ if (!fasync) ++ return -ENOMEM; ++ INIT_LIST_HEAD(&fasync->list); ++ } ++ ++ spin_lock_irq(&snd_fasync_lock); ++ if (*fasyncp) { ++ kfree(fasync); ++ fasync = *fasyncp; ++ } else { ++ if (!fasync) { ++ spin_unlock_irq(&snd_fasync_lock); ++ return 0; ++ } ++ *fasyncp = fasync; ++ } ++ fasync->on = on; ++ spin_unlock_irq(&snd_fasync_lock); ++ return fasync_helper(fd, file, on, &fasync->fasync); ++} ++EXPORT_SYMBOL_GPL(snd_fasync_helper); ++ ++void snd_kill_fasync(struct snd_fasync *fasync, int signal, int poll) ++{ ++ unsigned long flags; ++ ++ if (!fasync || !fasync->on) ++ return; ++ spin_lock_irqsave(&snd_fasync_lock, flags); ++ fasync->signal = signal; ++ fasync->poll = poll; ++ list_move(&fasync->list, &snd_fasync_list); ++ schedule_work(&snd_fasync_work); ++ spin_unlock_irqrestore(&snd_fasync_lock, flags); ++} ++EXPORT_SYMBOL_GPL(snd_kill_fasync); ++ ++void snd_fasync_free(struct snd_fasync *fasync) ++{ ++ if (!fasync) ++ return; ++ fasync->on = 0; ++ flush_work(&snd_fasync_work); ++ kfree(fasync); ++} ++EXPORT_SYMBOL_GPL(snd_fasync_free); +-- +2.35.1 + diff --git a/queue-5.10/alsa-timer-use-deferred-fasync-helper.patch b/queue-5.10/alsa-timer-use-deferred-fasync-helper.patch new file mode 100644 index 00000000000..a5173e2166f --- /dev/null +++ b/queue-5.10/alsa-timer-use-deferred-fasync-helper.patch @@ -0,0 +1,83 @@ +From a2dff819cc4ac69dabd85ee11a199773e1d00699 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Jul 2022 14:59:43 +0200 +Subject: ALSA: timer: Use deferred fasync helper + +From: Takashi Iwai + +[ Upstream commit 95cc637c1afd83fb7dd3d7c8a53710488f4caf9c ] + +For avoiding the potential deadlock via kill_fasync() call, use the +new fasync helpers to defer the invocation from PCI API. Note that +it's merely a workaround. + +Reported-by: syzbot+1ee0910eca9c94f71f25@syzkaller.appspotmail.com +Reported-by: syzbot+49b10793b867871ee26f@syzkaller.appspotmail.com +Reported-by: syzbot+8285e973a41b5aa68902@syzkaller.appspotmail.com +Link: https://lore.kernel.org/r/20220728125945.29533-3-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/core/timer.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +diff --git a/sound/core/timer.c b/sound/core/timer.c +index 04cd8953605a..764d2b19344e 100644 +--- a/sound/core/timer.c ++++ b/sound/core/timer.c +@@ -83,7 +83,7 @@ struct snd_timer_user { + unsigned int filter; + struct timespec64 tstamp; /* trigger tstamp */ + wait_queue_head_t qchange_sleep; +- struct fasync_struct *fasync; ++ struct snd_fasync *fasync; + struct mutex ioctl_lock; + }; + +@@ -1345,7 +1345,7 @@ static void snd_timer_user_interrupt(struct snd_timer_instance *timeri, + } + __wake: + spin_unlock(&tu->qlock); +- kill_fasync(&tu->fasync, SIGIO, POLL_IN); ++ snd_kill_fasync(tu->fasync, SIGIO, POLL_IN); + wake_up(&tu->qchange_sleep); + } + +@@ -1383,7 +1383,7 @@ static void snd_timer_user_ccallback(struct snd_timer_instance *timeri, + spin_lock_irqsave(&tu->qlock, flags); + snd_timer_user_append_to_tqueue(tu, &r1); + spin_unlock_irqrestore(&tu->qlock, flags); +- kill_fasync(&tu->fasync, SIGIO, POLL_IN); ++ snd_kill_fasync(tu->fasync, SIGIO, POLL_IN); + wake_up(&tu->qchange_sleep); + } + +@@ -1453,7 +1453,7 @@ static void snd_timer_user_tinterrupt(struct snd_timer_instance *timeri, + spin_unlock(&tu->qlock); + if (append == 0) + return; +- kill_fasync(&tu->fasync, SIGIO, POLL_IN); ++ snd_kill_fasync(tu->fasync, SIGIO, POLL_IN); + wake_up(&tu->qchange_sleep); + } + +@@ -1521,6 +1521,7 @@ static int snd_timer_user_release(struct inode *inode, struct file *file) + snd_timer_instance_free(tu->timeri); + } + mutex_unlock(&tu->ioctl_lock); ++ snd_fasync_free(tu->fasync); + kfree(tu->queue); + kfree(tu->tqueue); + kfree(tu); +@@ -2135,7 +2136,7 @@ static int snd_timer_user_fasync(int fd, struct file * file, int on) + struct snd_timer_user *tu; + + tu = file->private_data; +- return fasync_helper(fd, file, on, &tu->fasync); ++ return snd_fasync_helper(fd, file, on, &tu->fasync); + } + + static ssize_t snd_timer_user_read(struct file *file, char __user *buffer, +-- +2.35.1 + diff --git a/queue-5.10/asoc-sof-intel-move-sof_intel_dsp_desc-forward.patch b/queue-5.10/asoc-sof-intel-move-sof_intel_dsp_desc-forward.patch new file mode 100644 index 00000000000..c7376ad53a8 --- /dev/null +++ b/queue-5.10/asoc-sof-intel-move-sof_intel_dsp_desc-forward.patch @@ -0,0 +1,65 @@ +From f708c895d08d6d2c75f0894dfc4c8fda223b6dd9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jul 2021 19:54:49 +0800 +Subject: ASoC: SOF: intel: move sof_intel_dsp_desc() forward + +From: Bard Liao + +[ Upstream commit 2f1315ae94b46bf0d5b4be29be15cc3641364404 ] + +sof_intel_dsp_desc() will be used by hda_dsp_check_sdw_irq() in the +following commit. + +Signed-off-by: Bard Liao +Reviewed-by: Pierre-Louis Bossart +Reviewed-by: Ranjani Sridharan +Link: https://lore.kernel.org/r/20210723115451.7245-5-yung-chuan.liao@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/intel/hda.c | 22 +++++++++++----------- + 1 file changed, 11 insertions(+), 11 deletions(-) + +diff --git a/sound/soc/sof/intel/hda.c b/sound/soc/sof/intel/hda.c +index b0faf050132d..b4cc72483137 100644 +--- a/sound/soc/sof/intel/hda.c ++++ b/sound/soc/sof/intel/hda.c +@@ -39,6 +39,17 @@ + #define EXCEPT_MAX_HDR_SIZE 0x400 + #define HDA_EXT_ROM_STATUS_SIZE 8 + ++static const struct sof_intel_dsp_desc ++ *get_chip_info(struct snd_sof_pdata *pdata) ++{ ++ const struct sof_dev_desc *desc = pdata->desc; ++ const struct sof_intel_dsp_desc *chip_info; ++ ++ chip_info = desc->chip_info; ++ ++ return chip_info; ++} ++ + #if IS_ENABLED(CONFIG_SND_SOC_SOF_INTEL_SOUNDWIRE) + + /* +@@ -674,17 +685,6 @@ static int hda_init_caps(struct snd_sof_dev *sdev) + return 0; + } + +-static const struct sof_intel_dsp_desc +- *get_chip_info(struct snd_sof_pdata *pdata) +-{ +- const struct sof_dev_desc *desc = pdata->desc; +- const struct sof_intel_dsp_desc *chip_info; +- +- chip_info = desc->chip_info; +- +- return chip_info; +-} +- + static irqreturn_t hda_dsp_interrupt_handler(int irq, void *context) + { + struct snd_sof_dev *sdev = context; +-- +2.35.1 + diff --git a/queue-5.10/audit-log-nftables-configuration-change-events-once-.patch b/queue-5.10/audit-log-nftables-configuration-change-events-once-.patch new file mode 100644 index 00000000000..1a3ac9023c9 --- /dev/null +++ b/queue-5.10/audit-log-nftables-configuration-change-events-once-.patch @@ -0,0 +1,353 @@ +From 714bb40fddbc97450d2d0f45ab5184422c1453cf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Mar 2021 13:38:59 -0400 +Subject: audit: log nftables configuration change events once per table + +From: Richard Guy Briggs + +[ Upstream commit c520292f29b8047285bcfbc2322fa2a9bf02521a ] + +Reduce logging of nftables events to a level similar to iptables. +Restore the table field to list the table, adding the generation. + +Indicate the op as the most significant operation in the event. + +A couple of sample events: + +type=PROCTITLE msg=audit(2021-03-18 09:30:49.801:143) : proctitle=/usr/bin/python3 -s /usr/sbin/firewalld --nofork --nopid +type=SYSCALL msg=audit(2021-03-18 09:30:49.801:143) : arch=x86_64 syscall=sendmsg success=yes exit=172 a0=0x6 a1=0x7ffdcfcbe650 a2=0x0 a3=0x7ffdcfcbd52c items=0 ppid=1 pid=367 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=roo +t sgid=root fsgid=root tty=(none) ses=unset comm=firewalld exe=/usr/bin/python3.9 subj=system_u:system_r:firewalld_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(2021-03-18 09:30:49.801:143) : table=firewalld:2 family=ipv6 entries=1 op=nft_register_table pid=367 subj=system_u:system_r:firewalld_t:s0 comm=firewalld +type=NETFILTER_CFG msg=audit(2021-03-18 09:30:49.801:143) : table=firewalld:2 family=ipv4 entries=1 op=nft_register_table pid=367 subj=system_u:system_r:firewalld_t:s0 comm=firewalld +type=NETFILTER_CFG msg=audit(2021-03-18 09:30:49.801:143) : table=firewalld:2 family=inet entries=1 op=nft_register_table pid=367 subj=system_u:system_r:firewalld_t:s0 comm=firewalld + +type=PROCTITLE msg=audit(2021-03-18 09:30:49.839:144) : proctitle=/usr/bin/python3 -s /usr/sbin/firewalld --nofork --nopid +type=SYSCALL msg=audit(2021-03-18 09:30:49.839:144) : arch=x86_64 syscall=sendmsg success=yes exit=22792 a0=0x6 a1=0x7ffdcfcbe650 a2=0x0 a3=0x7ffdcfcbd52c items=0 ppid=1 pid=367 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=r +oot sgid=root fsgid=root tty=(none) ses=unset comm=firewalld exe=/usr/bin/python3.9 subj=system_u:system_r:firewalld_t:s0 key=(null) +type=NETFILTER_CFG msg=audit(2021-03-18 09:30:49.839:144) : table=firewalld:3 family=ipv6 entries=30 op=nft_register_chain pid=367 subj=system_u:system_r:firewalld_t:s0 comm=firewalld +type=NETFILTER_CFG msg=audit(2021-03-18 09:30:49.839:144) : table=firewalld:3 family=ipv4 entries=30 op=nft_register_chain pid=367 subj=system_u:system_r:firewalld_t:s0 comm=firewalld +type=NETFILTER_CFG msg=audit(2021-03-18 09:30:49.839:144) : table=firewalld:3 family=inet entries=165 op=nft_register_chain pid=367 subj=system_u:system_r:firewalld_t:s0 comm=firewalld + +The issue was originally documented in +https://github.com/linux-audit/audit-kernel/issues/124 + +Signed-off-by: Richard Guy Briggs +Acked-by: Paul Moore +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_tables_api.c | 186 +++++++++++++++++++--------------- + 1 file changed, 103 insertions(+), 83 deletions(-) + +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index 990a0274e555..507d3d24a347 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -66,6 +66,41 @@ static const struct rhashtable_params nft_objname_ht_params = { + .automatic_shrinking = true, + }; + ++struct nft_audit_data { ++ struct nft_table *table; ++ int entries; ++ int op; ++ struct list_head list; ++}; ++ ++static const u8 nft2audit_op[NFT_MSG_MAX] = { // enum nf_tables_msg_types ++ [NFT_MSG_NEWTABLE] = AUDIT_NFT_OP_TABLE_REGISTER, ++ [NFT_MSG_GETTABLE] = AUDIT_NFT_OP_INVALID, ++ [NFT_MSG_DELTABLE] = AUDIT_NFT_OP_TABLE_UNREGISTER, ++ [NFT_MSG_NEWCHAIN] = AUDIT_NFT_OP_CHAIN_REGISTER, ++ [NFT_MSG_GETCHAIN] = AUDIT_NFT_OP_INVALID, ++ [NFT_MSG_DELCHAIN] = AUDIT_NFT_OP_CHAIN_UNREGISTER, ++ [NFT_MSG_NEWRULE] = AUDIT_NFT_OP_RULE_REGISTER, ++ [NFT_MSG_GETRULE] = AUDIT_NFT_OP_INVALID, ++ [NFT_MSG_DELRULE] = AUDIT_NFT_OP_RULE_UNREGISTER, ++ [NFT_MSG_NEWSET] = AUDIT_NFT_OP_SET_REGISTER, ++ [NFT_MSG_GETSET] = AUDIT_NFT_OP_INVALID, ++ [NFT_MSG_DELSET] = AUDIT_NFT_OP_SET_UNREGISTER, ++ [NFT_MSG_NEWSETELEM] = AUDIT_NFT_OP_SETELEM_REGISTER, ++ [NFT_MSG_GETSETELEM] = AUDIT_NFT_OP_INVALID, ++ [NFT_MSG_DELSETELEM] = AUDIT_NFT_OP_SETELEM_UNREGISTER, ++ [NFT_MSG_NEWGEN] = AUDIT_NFT_OP_GEN_REGISTER, ++ [NFT_MSG_GETGEN] = AUDIT_NFT_OP_INVALID, ++ [NFT_MSG_TRACE] = AUDIT_NFT_OP_INVALID, ++ [NFT_MSG_NEWOBJ] = AUDIT_NFT_OP_OBJ_REGISTER, ++ [NFT_MSG_GETOBJ] = AUDIT_NFT_OP_INVALID, ++ [NFT_MSG_DELOBJ] = AUDIT_NFT_OP_OBJ_UNREGISTER, ++ [NFT_MSG_GETOBJ_RESET] = AUDIT_NFT_OP_OBJ_RESET, ++ [NFT_MSG_NEWFLOWTABLE] = AUDIT_NFT_OP_FLOWTABLE_REGISTER, ++ [NFT_MSG_GETFLOWTABLE] = AUDIT_NFT_OP_INVALID, ++ [NFT_MSG_DELFLOWTABLE] = AUDIT_NFT_OP_FLOWTABLE_UNREGISTER, ++}; ++ + static void nft_validate_state_update(struct net *net, u8 new_validate_state) + { + switch (net->nft.validate_state) { +@@ -710,17 +745,6 @@ static void nf_tables_table_notify(const struct nft_ctx *ctx, int event) + { + struct sk_buff *skb; + int err; +- char *buf = kasprintf(GFP_KERNEL, "%s:%llu;?:0", +- ctx->table->name, ctx->table->handle); +- +- audit_log_nfcfg(buf, +- ctx->family, +- ctx->table->use, +- event == NFT_MSG_NEWTABLE ? +- AUDIT_NFT_OP_TABLE_REGISTER : +- AUDIT_NFT_OP_TABLE_UNREGISTER, +- GFP_KERNEL); +- kfree(buf); + + if (!ctx->report && + !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES)) +@@ -1477,18 +1501,6 @@ static void nf_tables_chain_notify(const struct nft_ctx *ctx, int event) + { + struct sk_buff *skb; + int err; +- char *buf = kasprintf(GFP_KERNEL, "%s:%llu;%s:%llu", +- ctx->table->name, ctx->table->handle, +- ctx->chain->name, ctx->chain->handle); +- +- audit_log_nfcfg(buf, +- ctx->family, +- ctx->chain->use, +- event == NFT_MSG_NEWCHAIN ? +- AUDIT_NFT_OP_CHAIN_REGISTER : +- AUDIT_NFT_OP_CHAIN_UNREGISTER, +- GFP_KERNEL); +- kfree(buf); + + if (!ctx->report && + !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES)) +@@ -2844,18 +2856,6 @@ static void nf_tables_rule_notify(const struct nft_ctx *ctx, + { + struct sk_buff *skb; + int err; +- char *buf = kasprintf(GFP_KERNEL, "%s:%llu;%s:%llu", +- ctx->table->name, ctx->table->handle, +- ctx->chain->name, ctx->chain->handle); +- +- audit_log_nfcfg(buf, +- ctx->family, +- rule->handle, +- event == NFT_MSG_NEWRULE ? +- AUDIT_NFT_OP_RULE_REGISTER : +- AUDIT_NFT_OP_RULE_UNREGISTER, +- GFP_KERNEL); +- kfree(buf); + + if (!ctx->report && + !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES)) +@@ -3882,18 +3882,6 @@ static void nf_tables_set_notify(const struct nft_ctx *ctx, + struct sk_buff *skb; + u32 portid = ctx->portid; + int err; +- char *buf = kasprintf(gfp_flags, "%s:%llu;%s:%llu", +- ctx->table->name, ctx->table->handle, +- set->name, set->handle); +- +- audit_log_nfcfg(buf, +- ctx->family, +- set->field_count, +- event == NFT_MSG_NEWSET ? +- AUDIT_NFT_OP_SET_REGISTER : +- AUDIT_NFT_OP_SET_UNREGISTER, +- gfp_flags); +- kfree(buf); + + if (!ctx->report && + !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES)) +@@ -5035,18 +5023,6 @@ static void nf_tables_setelem_notify(const struct nft_ctx *ctx, + u32 portid = ctx->portid; + struct sk_buff *skb; + int err; +- char *buf = kasprintf(GFP_KERNEL, "%s:%llu;%s:%llu", +- ctx->table->name, ctx->table->handle, +- set->name, set->handle); +- +- audit_log_nfcfg(buf, +- ctx->family, +- set->handle, +- event == NFT_MSG_NEWSETELEM ? +- AUDIT_NFT_OP_SETELEM_REGISTER : +- AUDIT_NFT_OP_SETELEM_UNREGISTER, +- GFP_KERNEL); +- kfree(buf); + + if (!ctx->report && !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES)) + return; +@@ -6180,12 +6156,11 @@ static int nf_tables_dump_obj(struct sk_buff *skb, struct netlink_callback *cb) + filter->type != NFT_OBJECT_UNSPEC && + obj->ops->type->type != filter->type) + goto cont; +- + if (reset) { + char *buf = kasprintf(GFP_ATOMIC, +- "%s:%llu;?:0", ++ "%s:%u", + table->name, +- table->handle); ++ net->nft.base_seq); + + audit_log_nfcfg(buf, + family, +@@ -6306,8 +6281,8 @@ static int nf_tables_getobj(struct net *net, struct sock *nlsk, + reset = true; + + if (reset) { +- char *buf = kasprintf(GFP_ATOMIC, "%s:%llu;?:0", +- table->name, table->handle); ++ char *buf = kasprintf(GFP_ATOMIC, "%s:%u", ++ table->name, net->nft.base_seq); + + audit_log_nfcfg(buf, + family, +@@ -6394,15 +6369,15 @@ void nft_obj_notify(struct net *net, const struct nft_table *table, + { + struct sk_buff *skb; + int err; +- char *buf = kasprintf(gfp, "%s:%llu;?:0", +- table->name, table->handle); ++ char *buf = kasprintf(gfp, "%s:%u", ++ table->name, net->nft.base_seq); + + audit_log_nfcfg(buf, + family, + obj->handle, + event == NFT_MSG_NEWOBJ ? +- AUDIT_NFT_OP_OBJ_REGISTER : +- AUDIT_NFT_OP_OBJ_UNREGISTER, ++ AUDIT_NFT_OP_OBJ_REGISTER : ++ AUDIT_NFT_OP_OBJ_UNREGISTER, + gfp); + kfree(buf); + +@@ -7220,18 +7195,6 @@ static void nf_tables_flowtable_notify(struct nft_ctx *ctx, + { + struct sk_buff *skb; + int err; +- char *buf = kasprintf(GFP_KERNEL, "%s:%llu;%s:%llu", +- flowtable->table->name, flowtable->table->handle, +- flowtable->name, flowtable->handle); +- +- audit_log_nfcfg(buf, +- ctx->family, +- flowtable->hooknum, +- event == NFT_MSG_NEWFLOWTABLE ? +- AUDIT_NFT_OP_FLOWTABLE_REGISTER : +- AUDIT_NFT_OP_FLOWTABLE_UNREGISTER, +- GFP_KERNEL); +- kfree(buf); + + if (!ctx->report && + !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES)) +@@ -7352,9 +7315,6 @@ static void nf_tables_gen_notify(struct net *net, struct sk_buff *skb, + struct sk_buff *skb2; + int err; + +- audit_log_nfcfg("?:0;?:0", 0, net->nft.base_seq, +- AUDIT_NFT_OP_GEN_REGISTER, GFP_KERNEL); +- + if (!nlmsg_report(nlh) && + !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES)) + return; +@@ -7885,12 +7845,64 @@ static void nft_commit_notify(struct net *net, u32 portid) + WARN_ON_ONCE(!list_empty(&net->nft.notify_list)); + } + ++static int nf_tables_commit_audit_alloc(struct list_head *adl, ++ struct nft_table *table) ++{ ++ struct nft_audit_data *adp; ++ ++ list_for_each_entry(adp, adl, list) { ++ if (adp->table == table) ++ return 0; ++ } ++ adp = kzalloc(sizeof(*adp), GFP_KERNEL); ++ if (!adp) ++ return -ENOMEM; ++ adp->table = table; ++ list_add(&adp->list, adl); ++ return 0; ++} ++ ++static void nf_tables_commit_audit_collect(struct list_head *adl, ++ struct nft_table *table, u32 op) ++{ ++ struct nft_audit_data *adp; ++ ++ list_for_each_entry(adp, adl, list) { ++ if (adp->table == table) ++ goto found; ++ } ++ WARN_ONCE("table=%s not expected in commit list", table->name); ++ return; ++found: ++ adp->entries++; ++ if (!adp->op || adp->op > op) ++ adp->op = op; ++} ++ ++#define AUNFTABLENAMELEN (NFT_TABLE_MAXNAMELEN + 22) ++ ++static void nf_tables_commit_audit_log(struct list_head *adl, u32 generation) ++{ ++ struct nft_audit_data *adp, *adn; ++ char aubuf[AUNFTABLENAMELEN]; ++ ++ list_for_each_entry_safe(adp, adn, adl, list) { ++ snprintf(aubuf, AUNFTABLENAMELEN, "%s:%u", adp->table->name, ++ generation); ++ audit_log_nfcfg(aubuf, adp->table->family, adp->entries, ++ nft2audit_op[adp->op], GFP_KERNEL); ++ list_del(&adp->list); ++ kfree(adp); ++ } ++} ++ + static int nf_tables_commit(struct net *net, struct sk_buff *skb) + { + struct nft_trans *trans, *next; + struct nft_trans_elem *te; + struct nft_chain *chain; + struct nft_table *table; ++ LIST_HEAD(adl); + int err; + + if (list_empty(&net->nft.commit_list)) { +@@ -7910,6 +7922,11 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb) + list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) { + int ret; + ++ ret = nf_tables_commit_audit_alloc(&adl, trans->ctx.table); ++ if (ret) { ++ nf_tables_commit_chain_prepare_cancel(net); ++ return ret; ++ } + if (trans->msg_type == NFT_MSG_NEWRULE || + trans->msg_type == NFT_MSG_DELRULE) { + chain = trans->ctx.chain; +@@ -7938,6 +7955,8 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb) + net->nft.gencursor = nft_gencursor_next(net); + + list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) { ++ nf_tables_commit_audit_collect(&adl, trans->ctx.table, ++ trans->msg_type); + switch (trans->msg_type) { + case NFT_MSG_NEWTABLE: + if (nft_trans_table_update(trans)) { +@@ -8092,6 +8111,7 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb) + + nft_commit_notify(net, NETLINK_CB(skb).portid); + nf_tables_gen_notify(net, skb, NFT_MSG_NEWGEN); ++ nf_tables_commit_audit_log(&adl, net->nft.base_seq); + nf_tables_commit_release(net); + + return 0; +-- +2.35.1 + diff --git a/queue-5.10/clk-qcom-clk-alpha-pll-fix-clk_trion_pll_configure-d.patch b/queue-5.10/clk-qcom-clk-alpha-pll-fix-clk_trion_pll_configure-d.patch new file mode 100644 index 00000000000..6e8ebdc717d --- /dev/null +++ b/queue-5.10/clk-qcom-clk-alpha-pll-fix-clk_trion_pll_configure-d.patch @@ -0,0 +1,40 @@ +From 8c0262a34241c80017756fa82b35bc5d8274f534 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Jul 2022 09:27:11 +0300 +Subject: clk: qcom: clk-alpha-pll: fix clk_trion_pll_configure description + +From: Vladimir Zapolskiy + +[ Upstream commit 94bed9bb05c7850ff5d80b87cc29004901f37956 ] + +After merging lucid and trion pll functions in commit 0b01489475c6 +("clk: qcom: clk-alpha-pll: same regs and ops for trion and lucid") +the function clk_trion_pll_configure() is left with an old description +header, which results in a W=2 compile time warning, fix it. + +Acked-by: Stephen Boyd +Reviewed-by: Vinod Koul +Signed-off-by: Vladimir Zapolskiy +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20220701062711.2757855-1-vladimir.zapolskiy@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/clk-alpha-pll.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/qcom/clk-alpha-pll.c b/drivers/clk/qcom/clk-alpha-pll.c +index 1a571c04a76c..cf265ab035ea 100644 +--- a/drivers/clk/qcom/clk-alpha-pll.c ++++ b/drivers/clk/qcom/clk-alpha-pll.c +@@ -1379,7 +1379,7 @@ const struct clk_ops clk_alpha_pll_postdiv_fabia_ops = { + EXPORT_SYMBOL_GPL(clk_alpha_pll_postdiv_fabia_ops); + + /** +- * clk_lucid_pll_configure - configure the lucid pll ++ * clk_trion_pll_configure - configure the trion pll + * + * @pll: clk alpha pll + * @regmap: register map +-- +2.35.1 + diff --git a/queue-5.10/clk-qcom-ipq8074-dont-disable-gcc_sleep_clk_src.patch b/queue-5.10/clk-qcom-ipq8074-dont-disable-gcc_sleep_clk_src.patch new file mode 100644 index 00000000000..4b4dd699bc8 --- /dev/null +++ b/queue-5.10/clk-qcom-ipq8074-dont-disable-gcc_sleep_clk_src.patch @@ -0,0 +1,85 @@ +From 0ebddd64d7936fe9dc8ad23dcdadace8c44b2c54 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 15 May 2022 23:00:47 +0200 +Subject: clk: qcom: ipq8074: dont disable gcc_sleep_clk_src + +From: Robert Marko + +[ Upstream commit 1bf7305e79aab095196131bdc87a97796e0e3fac ] + +Once the usb sleep clocks are disabled, clock framework is trying to +disable the sleep clock source also. + +However, it seems that it cannot be disabled and trying to do so produces: +[ 245.436390] ------------[ cut here ]------------ +[ 245.441233] gcc_sleep_clk_src status stuck at 'on' +[ 245.441254] WARNING: CPU: 2 PID: 223 at clk_branch_wait+0x130/0x140 +[ 245.450435] Modules linked in: xhci_plat_hcd xhci_hcd dwc3 dwc3_qcom leds_gpio +[ 245.456601] CPU: 2 PID: 223 Comm: sh Not tainted 5.18.0-rc4 #215 +[ 245.463889] Hardware name: Xiaomi AX9000 (DT) +[ 245.470050] pstate: 204000c5 (nzCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) +[ 245.474307] pc : clk_branch_wait+0x130/0x140 +[ 245.481073] lr : clk_branch_wait+0x130/0x140 +[ 245.485588] sp : ffffffc009f2bad0 +[ 245.489838] x29: ffffffc009f2bad0 x28: ffffff8003e6c800 x27: 0000000000000000 +[ 245.493057] x26: 0000000000000000 x25: 0000000000000000 x24: ffffff800226ef20 +[ 245.500175] x23: ffffffc0089ff550 x22: 0000000000000000 x21: ffffffc008476ad0 +[ 245.507294] x20: 0000000000000000 x19: ffffffc00965ac70 x18: fffffffffffc51a7 +[ 245.514413] x17: 68702e3030303837 x16: 3a6d726f6674616c x15: ffffffc089f2b777 +[ 245.521531] x14: ffffffc0095c9d18 x13: 0000000000000129 x12: 0000000000000129 +[ 245.528649] x11: 00000000ffffffea x10: ffffffc009621d18 x9 : 0000000000000001 +[ 245.535767] x8 : 0000000000000001 x7 : 0000000000017fe8 x6 : 0000000000000001 +[ 245.542885] x5 : ffffff803fdca6d8 x4 : 0000000000000000 x3 : 0000000000000027 +[ 245.550002] x2 : 0000000000000027 x1 : 0000000000000023 x0 : 0000000000000026 +[ 245.557122] Call trace: +[ 245.564229] clk_branch_wait+0x130/0x140 +[ 245.566490] clk_branch2_disable+0x2c/0x40 +[ 245.570656] clk_core_disable+0x60/0xb0 +[ 245.574561] clk_core_disable+0x68/0xb0 +[ 245.578293] clk_disable+0x30/0x50 +[ 245.582113] dwc3_qcom_remove+0x60/0xc0 [dwc3_qcom] +[ 245.585588] platform_remove+0x28/0x60 +[ 245.590361] device_remove+0x4c/0x80 +[ 245.594179] device_release_driver_internal+0x1dc/0x230 +[ 245.597914] device_driver_detach+0x18/0x30 +[ 245.602861] unbind_store+0xec/0x110 +[ 245.607027] drv_attr_store+0x24/0x40 +[ 245.610847] sysfs_kf_write+0x44/0x60 +[ 245.614405] kernfs_fop_write_iter+0x128/0x1c0 +[ 245.618052] new_sync_write+0xc0/0x130 +[ 245.622391] vfs_write+0x1d4/0x2a0 +[ 245.626123] ksys_write+0x58/0xe0 +[ 245.629508] __arm64_sys_write+0x1c/0x30 +[ 245.632895] invoke_syscall.constprop.0+0x5c/0x110 +[ 245.636890] do_el0_svc+0xa0/0x150 +[ 245.641488] el0_svc+0x18/0x60 +[ 245.644872] el0t_64_sync_handler+0xa4/0x130 +[ 245.647914] el0t_64_sync+0x174/0x178 +[ 245.652340] ---[ end trace 0000000000000000 ]--- + +So, add CLK_IS_CRITICAL flag to the clock so that the kernel won't try +to disable the sleep clock. + +Signed-off-by: Robert Marko +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20220515210048.483898-10-robimarko@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/gcc-ipq8074.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/clk/qcom/gcc-ipq8074.c b/drivers/clk/qcom/gcc-ipq8074.c +index 2c2ecfc5e61f..d6d5defb82c9 100644 +--- a/drivers/clk/qcom/gcc-ipq8074.c ++++ b/drivers/clk/qcom/gcc-ipq8074.c +@@ -662,6 +662,7 @@ static struct clk_branch gcc_sleep_clk_src = { + }, + .num_parents = 1, + .ops = &clk_branch2_ops, ++ .flags = CLK_IS_CRITICAL, + }, + }, + }; +-- +2.35.1 + diff --git a/queue-5.10/clk-ti-stop-using-legacy-clkctrl-names-for-omap4-and.patch b/queue-5.10/clk-ti-stop-using-legacy-clkctrl-names-for-omap4-and.patch new file mode 100644 index 00000000000..df859829917 --- /dev/null +++ b/queue-5.10/clk-ti-stop-using-legacy-clkctrl-names-for-omap4-and.patch @@ -0,0 +1,682 @@ +From 0a1d34e15f8548496bf3ac106fccebee561672ed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Jun 2022 09:43:06 +0300 +Subject: clk: ti: Stop using legacy clkctrl names for omap4 and 5 + +From: Tony Lindgren + +[ Upstream commit 255584b138343d4a28c6d25bd82d04b09460d672 ] + +With the addition of clock-output-names, we can now unify the internal +clock naming for omap4 and 5 to follow the other TI SoCs. + +We are still using legacy clkctrl names for omap4 and 5 based on the clock +manager name which is wrong. Instead, we want to use the clkctrl clock +based naming. + +We must now also drop the legacy TI_CLK_CLKCTRL_COMPAT quirk for the +clkctrl clock. + +This change will allow further devicetree warning cleanup as already +done for am3/4 and dra7. + +Cc: linux-clk@vger.kernel.org +Cc: Stephen Boyd +Cc: Tero Kristo +Signed-off-by: Tony Lindgren +Link: https://lore.kernel.org/r/20220615064306.22254-1-tony@atomide.com +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/ti/clk-44xx.c | 210 +++++++++++++++++++------------------- + drivers/clk/ti/clk-54xx.c | 160 ++++++++++++++--------------- + drivers/clk/ti/clkctrl.c | 4 - + 3 files changed, 185 insertions(+), 189 deletions(-) + +diff --git a/drivers/clk/ti/clk-44xx.c b/drivers/clk/ti/clk-44xx.c +index a38c92153979..cbf9922d93d4 100644 +--- a/drivers/clk/ti/clk-44xx.c ++++ b/drivers/clk/ti/clk-44xx.c +@@ -56,7 +56,7 @@ static const struct omap_clkctrl_bit_data omap4_aess_bit_data[] __initconst = { + }; + + static const char * const omap4_func_dmic_abe_gfclk_parents[] __initconst = { +- "abe_cm:clk:0018:26", ++ "abe-clkctrl:0018:26", + "pad_clks_ck", + "slimbus_clk", + NULL, +@@ -76,7 +76,7 @@ static const struct omap_clkctrl_bit_data omap4_dmic_bit_data[] __initconst = { + }; + + static const char * const omap4_func_mcasp_abe_gfclk_parents[] __initconst = { +- "abe_cm:clk:0020:26", ++ "abe-clkctrl:0020:26", + "pad_clks_ck", + "slimbus_clk", + NULL, +@@ -89,7 +89,7 @@ static const struct omap_clkctrl_bit_data omap4_mcasp_bit_data[] __initconst = { + }; + + static const char * const omap4_func_mcbsp1_gfclk_parents[] __initconst = { +- "abe_cm:clk:0028:26", ++ "abe-clkctrl:0028:26", + "pad_clks_ck", + "slimbus_clk", + NULL, +@@ -102,7 +102,7 @@ static const struct omap_clkctrl_bit_data omap4_mcbsp1_bit_data[] __initconst = + }; + + static const char * const omap4_func_mcbsp2_gfclk_parents[] __initconst = { +- "abe_cm:clk:0030:26", ++ "abe-clkctrl:0030:26", + "pad_clks_ck", + "slimbus_clk", + NULL, +@@ -115,7 +115,7 @@ static const struct omap_clkctrl_bit_data omap4_mcbsp2_bit_data[] __initconst = + }; + + static const char * const omap4_func_mcbsp3_gfclk_parents[] __initconst = { +- "abe_cm:clk:0038:26", ++ "abe-clkctrl:0038:26", + "pad_clks_ck", + "slimbus_clk", + NULL, +@@ -183,18 +183,18 @@ static const struct omap_clkctrl_bit_data omap4_timer8_bit_data[] __initconst = + + static const struct omap_clkctrl_reg_data omap4_abe_clkctrl_regs[] __initconst = { + { OMAP4_L4_ABE_CLKCTRL, NULL, 0, "ocp_abe_iclk" }, +- { OMAP4_AESS_CLKCTRL, omap4_aess_bit_data, CLKF_SW_SUP, "abe_cm:clk:0008:24" }, ++ { OMAP4_AESS_CLKCTRL, omap4_aess_bit_data, CLKF_SW_SUP, "abe-clkctrl:0008:24" }, + { OMAP4_MCPDM_CLKCTRL, NULL, CLKF_SW_SUP, "pad_clks_ck" }, +- { OMAP4_DMIC_CLKCTRL, omap4_dmic_bit_data, CLKF_SW_SUP, "abe_cm:clk:0018:24" }, +- { OMAP4_MCASP_CLKCTRL, omap4_mcasp_bit_data, CLKF_SW_SUP, "abe_cm:clk:0020:24" }, +- { OMAP4_MCBSP1_CLKCTRL, omap4_mcbsp1_bit_data, CLKF_SW_SUP, "abe_cm:clk:0028:24" }, +- { OMAP4_MCBSP2_CLKCTRL, omap4_mcbsp2_bit_data, CLKF_SW_SUP, "abe_cm:clk:0030:24" }, +- { OMAP4_MCBSP3_CLKCTRL, omap4_mcbsp3_bit_data, CLKF_SW_SUP, "abe_cm:clk:0038:24" }, +- { OMAP4_SLIMBUS1_CLKCTRL, omap4_slimbus1_bit_data, CLKF_SW_SUP, "abe_cm:clk:0040:8" }, +- { OMAP4_TIMER5_CLKCTRL, omap4_timer5_bit_data, CLKF_SW_SUP, "abe_cm:clk:0048:24" }, +- { OMAP4_TIMER6_CLKCTRL, omap4_timer6_bit_data, CLKF_SW_SUP, "abe_cm:clk:0050:24" }, +- { OMAP4_TIMER7_CLKCTRL, omap4_timer7_bit_data, CLKF_SW_SUP, "abe_cm:clk:0058:24" }, +- { OMAP4_TIMER8_CLKCTRL, omap4_timer8_bit_data, CLKF_SW_SUP, "abe_cm:clk:0060:24" }, ++ { OMAP4_DMIC_CLKCTRL, omap4_dmic_bit_data, CLKF_SW_SUP, "abe-clkctrl:0018:24" }, ++ { OMAP4_MCASP_CLKCTRL, omap4_mcasp_bit_data, CLKF_SW_SUP, "abe-clkctrl:0020:24" }, ++ { OMAP4_MCBSP1_CLKCTRL, omap4_mcbsp1_bit_data, CLKF_SW_SUP, "abe-clkctrl:0028:24" }, ++ { OMAP4_MCBSP2_CLKCTRL, omap4_mcbsp2_bit_data, CLKF_SW_SUP, "abe-clkctrl:0030:24" }, ++ { OMAP4_MCBSP3_CLKCTRL, omap4_mcbsp3_bit_data, CLKF_SW_SUP, "abe-clkctrl:0038:24" }, ++ { OMAP4_SLIMBUS1_CLKCTRL, omap4_slimbus1_bit_data, CLKF_SW_SUP, "abe-clkctrl:0040:8" }, ++ { OMAP4_TIMER5_CLKCTRL, omap4_timer5_bit_data, CLKF_SW_SUP, "abe-clkctrl:0048:24" }, ++ { OMAP4_TIMER6_CLKCTRL, omap4_timer6_bit_data, CLKF_SW_SUP, "abe-clkctrl:0050:24" }, ++ { OMAP4_TIMER7_CLKCTRL, omap4_timer7_bit_data, CLKF_SW_SUP, "abe-clkctrl:0058:24" }, ++ { OMAP4_TIMER8_CLKCTRL, omap4_timer8_bit_data, CLKF_SW_SUP, "abe-clkctrl:0060:24" }, + { OMAP4_WD_TIMER3_CLKCTRL, NULL, CLKF_SW_SUP, "sys_32k_ck" }, + { 0 }, + }; +@@ -287,7 +287,7 @@ static const struct omap_clkctrl_bit_data omap4_fdif_bit_data[] __initconst = { + + static const struct omap_clkctrl_reg_data omap4_iss_clkctrl_regs[] __initconst = { + { OMAP4_ISS_CLKCTRL, omap4_iss_bit_data, CLKF_SW_SUP, "ducati_clk_mux_ck" }, +- { OMAP4_FDIF_CLKCTRL, omap4_fdif_bit_data, CLKF_SW_SUP, "iss_cm:clk:0008:24" }, ++ { OMAP4_FDIF_CLKCTRL, omap4_fdif_bit_data, CLKF_SW_SUP, "iss-clkctrl:0008:24" }, + { 0 }, + }; + +@@ -320,7 +320,7 @@ static const struct omap_clkctrl_bit_data omap4_dss_core_bit_data[] __initconst + }; + + static const struct omap_clkctrl_reg_data omap4_l3_dss_clkctrl_regs[] __initconst = { +- { OMAP4_DSS_CORE_CLKCTRL, omap4_dss_core_bit_data, CLKF_SW_SUP, "l3_dss_cm:clk:0000:8" }, ++ { OMAP4_DSS_CORE_CLKCTRL, omap4_dss_core_bit_data, CLKF_SW_SUP, "l3-dss-clkctrl:0000:8" }, + { 0 }, + }; + +@@ -336,7 +336,7 @@ static const struct omap_clkctrl_bit_data omap4_gpu_bit_data[] __initconst = { + }; + + static const struct omap_clkctrl_reg_data omap4_l3_gfx_clkctrl_regs[] __initconst = { +- { OMAP4_GPU_CLKCTRL, omap4_gpu_bit_data, CLKF_SW_SUP, "l3_gfx_cm:clk:0000:24" }, ++ { OMAP4_GPU_CLKCTRL, omap4_gpu_bit_data, CLKF_SW_SUP, "l3-gfx-clkctrl:0000:24" }, + { 0 }, + }; + +@@ -372,12 +372,12 @@ static const struct omap_clkctrl_bit_data omap4_hsi_bit_data[] __initconst = { + }; + + static const char * const omap4_usb_host_hs_utmi_p1_clk_parents[] __initconst = { +- "l3_init_cm:clk:0038:24", ++ "l3-init-clkctrl:0038:24", + NULL, + }; + + static const char * const omap4_usb_host_hs_utmi_p2_clk_parents[] __initconst = { +- "l3_init_cm:clk:0038:25", ++ "l3-init-clkctrl:0038:25", + NULL, + }; + +@@ -418,7 +418,7 @@ static const struct omap_clkctrl_bit_data omap4_usb_host_hs_bit_data[] __initcon + }; + + static const char * const omap4_usb_otg_hs_xclk_parents[] __initconst = { +- "l3_init_cm:clk:0040:24", ++ "l3-init-clkctrl:0040:24", + NULL, + }; + +@@ -452,14 +452,14 @@ static const struct omap_clkctrl_bit_data omap4_ocp2scp_usb_phy_bit_data[] __ini + }; + + static const struct omap_clkctrl_reg_data omap4_l3_init_clkctrl_regs[] __initconst = { +- { OMAP4_MMC1_CLKCTRL, omap4_mmc1_bit_data, CLKF_SW_SUP, "l3_init_cm:clk:0008:24" }, +- { OMAP4_MMC2_CLKCTRL, omap4_mmc2_bit_data, CLKF_SW_SUP, "l3_init_cm:clk:0010:24" }, +- { OMAP4_HSI_CLKCTRL, omap4_hsi_bit_data, CLKF_HW_SUP, "l3_init_cm:clk:0018:24" }, ++ { OMAP4_MMC1_CLKCTRL, omap4_mmc1_bit_data, CLKF_SW_SUP, "l3-init-clkctrl:0008:24" }, ++ { OMAP4_MMC2_CLKCTRL, omap4_mmc2_bit_data, CLKF_SW_SUP, "l3-init-clkctrl:0010:24" }, ++ { OMAP4_HSI_CLKCTRL, omap4_hsi_bit_data, CLKF_HW_SUP, "l3-init-clkctrl:0018:24" }, + { OMAP4_USB_HOST_HS_CLKCTRL, omap4_usb_host_hs_bit_data, CLKF_SW_SUP, "init_60m_fclk" }, + { OMAP4_USB_OTG_HS_CLKCTRL, omap4_usb_otg_hs_bit_data, CLKF_HW_SUP, "l3_div_ck" }, + { OMAP4_USB_TLL_HS_CLKCTRL, omap4_usb_tll_hs_bit_data, CLKF_HW_SUP, "l4_div_ck" }, + { OMAP4_USB_HOST_FS_CLKCTRL, NULL, CLKF_SW_SUP, "func_48mc_fclk" }, +- { OMAP4_OCP2SCP_USB_PHY_CLKCTRL, omap4_ocp2scp_usb_phy_bit_data, CLKF_HW_SUP, "l3_init_cm:clk:00c0:8" }, ++ { OMAP4_OCP2SCP_USB_PHY_CLKCTRL, omap4_ocp2scp_usb_phy_bit_data, CLKF_HW_SUP, "l3-init-clkctrl:00c0:8" }, + { 0 }, + }; + +@@ -530,7 +530,7 @@ static const struct omap_clkctrl_bit_data omap4_gpio6_bit_data[] __initconst = { + }; + + static const char * const omap4_per_mcbsp4_gfclk_parents[] __initconst = { +- "l4_per_cm:clk:00c0:26", ++ "l4-per-clkctrl:00c0:26", + "pad_clks_ck", + NULL, + }; +@@ -570,12 +570,12 @@ static const struct omap_clkctrl_bit_data omap4_slimbus2_bit_data[] __initconst + }; + + static const struct omap_clkctrl_reg_data omap4_l4_per_clkctrl_regs[] __initconst = { +- { OMAP4_TIMER10_CLKCTRL, omap4_timer10_bit_data, CLKF_SW_SUP, "l4_per_cm:clk:0008:24" }, +- { OMAP4_TIMER11_CLKCTRL, omap4_timer11_bit_data, CLKF_SW_SUP, "l4_per_cm:clk:0010:24" }, +- { OMAP4_TIMER2_CLKCTRL, omap4_timer2_bit_data, CLKF_SW_SUP, "l4_per_cm:clk:0018:24" }, +- { OMAP4_TIMER3_CLKCTRL, omap4_timer3_bit_data, CLKF_SW_SUP, "l4_per_cm:clk:0020:24" }, +- { OMAP4_TIMER4_CLKCTRL, omap4_timer4_bit_data, CLKF_SW_SUP, "l4_per_cm:clk:0028:24" }, +- { OMAP4_TIMER9_CLKCTRL, omap4_timer9_bit_data, CLKF_SW_SUP, "l4_per_cm:clk:0030:24" }, ++ { OMAP4_TIMER10_CLKCTRL, omap4_timer10_bit_data, CLKF_SW_SUP, "l4-per-clkctrl:0008:24" }, ++ { OMAP4_TIMER11_CLKCTRL, omap4_timer11_bit_data, CLKF_SW_SUP, "l4-per-clkctrl:0010:24" }, ++ { OMAP4_TIMER2_CLKCTRL, omap4_timer2_bit_data, CLKF_SW_SUP, "l4-per-clkctrl:0018:24" }, ++ { OMAP4_TIMER3_CLKCTRL, omap4_timer3_bit_data, CLKF_SW_SUP, "l4-per-clkctrl:0020:24" }, ++ { OMAP4_TIMER4_CLKCTRL, omap4_timer4_bit_data, CLKF_SW_SUP, "l4-per-clkctrl:0028:24" }, ++ { OMAP4_TIMER9_CLKCTRL, omap4_timer9_bit_data, CLKF_SW_SUP, "l4-per-clkctrl:0030:24" }, + { OMAP4_ELM_CLKCTRL, NULL, 0, "l4_div_ck" }, + { OMAP4_GPIO2_CLKCTRL, omap4_gpio2_bit_data, CLKF_HW_SUP, "l4_div_ck" }, + { OMAP4_GPIO3_CLKCTRL, omap4_gpio3_bit_data, CLKF_HW_SUP, "l4_div_ck" }, +@@ -588,14 +588,14 @@ static const struct omap_clkctrl_reg_data omap4_l4_per_clkctrl_regs[] __initcons + { OMAP4_I2C3_CLKCTRL, NULL, CLKF_SW_SUP, "func_96m_fclk" }, + { OMAP4_I2C4_CLKCTRL, NULL, CLKF_SW_SUP, "func_96m_fclk" }, + { OMAP4_L4_PER_CLKCTRL, NULL, 0, "l4_div_ck" }, +- { OMAP4_MCBSP4_CLKCTRL, omap4_mcbsp4_bit_data, CLKF_SW_SUP, "l4_per_cm:clk:00c0:24" }, ++ { OMAP4_MCBSP4_CLKCTRL, omap4_mcbsp4_bit_data, CLKF_SW_SUP, "l4-per-clkctrl:00c0:24" }, + { OMAP4_MCSPI1_CLKCTRL, NULL, CLKF_SW_SUP, "func_48m_fclk" }, + { OMAP4_MCSPI2_CLKCTRL, NULL, CLKF_SW_SUP, "func_48m_fclk" }, + { OMAP4_MCSPI3_CLKCTRL, NULL, CLKF_SW_SUP, "func_48m_fclk" }, + { OMAP4_MCSPI4_CLKCTRL, NULL, CLKF_SW_SUP, "func_48m_fclk" }, + { OMAP4_MMC3_CLKCTRL, NULL, CLKF_SW_SUP, "func_48m_fclk" }, + { OMAP4_MMC4_CLKCTRL, NULL, CLKF_SW_SUP, "func_48m_fclk" }, +- { OMAP4_SLIMBUS2_CLKCTRL, omap4_slimbus2_bit_data, CLKF_SW_SUP, "l4_per_cm:clk:0118:8" }, ++ { OMAP4_SLIMBUS2_CLKCTRL, omap4_slimbus2_bit_data, CLKF_SW_SUP, "l4-per-clkctrl:0118:8" }, + { OMAP4_UART1_CLKCTRL, NULL, CLKF_SW_SUP, "func_48m_fclk" }, + { OMAP4_UART2_CLKCTRL, NULL, CLKF_SW_SUP, "func_48m_fclk" }, + { OMAP4_UART3_CLKCTRL, NULL, CLKF_SW_SUP, "func_48m_fclk" }, +@@ -630,7 +630,7 @@ static const struct omap_clkctrl_reg_data omap4_l4_wkup_clkctrl_regs[] __initcon + { OMAP4_L4_WKUP_CLKCTRL, NULL, 0, "l4_wkup_clk_mux_ck" }, + { OMAP4_WD_TIMER2_CLKCTRL, NULL, CLKF_SW_SUP, "sys_32k_ck" }, + { OMAP4_GPIO1_CLKCTRL, omap4_gpio1_bit_data, CLKF_HW_SUP, "l4_wkup_clk_mux_ck" }, +- { OMAP4_TIMER1_CLKCTRL, omap4_timer1_bit_data, CLKF_SW_SUP, "l4_wkup_cm:clk:0020:24" }, ++ { OMAP4_TIMER1_CLKCTRL, omap4_timer1_bit_data, CLKF_SW_SUP, "l4-wkup-clkctrl:0020:24" }, + { OMAP4_COUNTER_32K_CLKCTRL, NULL, 0, "sys_32k_ck" }, + { OMAP4_KBD_CLKCTRL, NULL, CLKF_SW_SUP, "sys_32k_ck" }, + { 0 }, +@@ -644,7 +644,7 @@ static const char * const omap4_pmd_stm_clock_mux_ck_parents[] __initconst = { + }; + + static const char * const omap4_trace_clk_div_div_ck_parents[] __initconst = { +- "emu_sys_cm:clk:0000:22", ++ "emu-sys-clkctrl:0000:22", + NULL, + }; + +@@ -662,7 +662,7 @@ static const struct omap_clkctrl_div_data omap4_trace_clk_div_div_ck_data __init + }; + + static const char * const omap4_stm_clk_div_ck_parents[] __initconst = { +- "emu_sys_cm:clk:0000:20", ++ "emu-sys-clkctrl:0000:20", + NULL, + }; + +@@ -716,73 +716,73 @@ static struct ti_dt_clk omap44xx_clks[] = { + * hwmod support. Once hwmod is removed, these can be removed + * also. + */ +- DT_CLK(NULL, "aess_fclk", "abe_cm:0008:24"), +- DT_CLK(NULL, "cm2_dm10_mux", "l4_per_cm:0008:24"), +- DT_CLK(NULL, "cm2_dm11_mux", "l4_per_cm:0010:24"), +- DT_CLK(NULL, "cm2_dm2_mux", "l4_per_cm:0018:24"), +- DT_CLK(NULL, "cm2_dm3_mux", "l4_per_cm:0020:24"), +- DT_CLK(NULL, "cm2_dm4_mux", "l4_per_cm:0028:24"), +- DT_CLK(NULL, "cm2_dm9_mux", "l4_per_cm:0030:24"), +- DT_CLK(NULL, "dmic_sync_mux_ck", "abe_cm:0018:26"), +- DT_CLK(NULL, "dmt1_clk_mux", "l4_wkup_cm:0020:24"), +- DT_CLK(NULL, "dss_48mhz_clk", "l3_dss_cm:0000:9"), +- DT_CLK(NULL, "dss_dss_clk", "l3_dss_cm:0000:8"), +- DT_CLK(NULL, "dss_sys_clk", "l3_dss_cm:0000:10"), +- DT_CLK(NULL, "dss_tv_clk", "l3_dss_cm:0000:11"), +- DT_CLK(NULL, "fdif_fck", "iss_cm:0008:24"), +- DT_CLK(NULL, "func_dmic_abe_gfclk", "abe_cm:0018:24"), +- DT_CLK(NULL, "func_mcasp_abe_gfclk", "abe_cm:0020:24"), +- DT_CLK(NULL, "func_mcbsp1_gfclk", "abe_cm:0028:24"), +- DT_CLK(NULL, "func_mcbsp2_gfclk", "abe_cm:0030:24"), +- DT_CLK(NULL, "func_mcbsp3_gfclk", "abe_cm:0038:24"), +- DT_CLK(NULL, "gpio1_dbclk", "l4_wkup_cm:0018:8"), +- DT_CLK(NULL, "gpio2_dbclk", "l4_per_cm:0040:8"), +- DT_CLK(NULL, "gpio3_dbclk", "l4_per_cm:0048:8"), +- DT_CLK(NULL, "gpio4_dbclk", "l4_per_cm:0050:8"), +- DT_CLK(NULL, "gpio5_dbclk", "l4_per_cm:0058:8"), +- DT_CLK(NULL, "gpio6_dbclk", "l4_per_cm:0060:8"), +- DT_CLK(NULL, "hsi_fck", "l3_init_cm:0018:24"), +- DT_CLK(NULL, "hsmmc1_fclk", "l3_init_cm:0008:24"), +- DT_CLK(NULL, "hsmmc2_fclk", "l3_init_cm:0010:24"), +- DT_CLK(NULL, "iss_ctrlclk", "iss_cm:0000:8"), +- DT_CLK(NULL, "mcasp_sync_mux_ck", "abe_cm:0020:26"), +- DT_CLK(NULL, "mcbsp1_sync_mux_ck", "abe_cm:0028:26"), +- DT_CLK(NULL, "mcbsp2_sync_mux_ck", "abe_cm:0030:26"), +- DT_CLK(NULL, "mcbsp3_sync_mux_ck", "abe_cm:0038:26"), +- DT_CLK(NULL, "mcbsp4_sync_mux_ck", "l4_per_cm:00c0:26"), +- DT_CLK(NULL, "ocp2scp_usb_phy_phy_48m", "l3_init_cm:00c0:8"), +- DT_CLK(NULL, "otg_60m_gfclk", "l3_init_cm:0040:24"), +- DT_CLK(NULL, "per_mcbsp4_gfclk", "l4_per_cm:00c0:24"), +- DT_CLK(NULL, "pmd_stm_clock_mux_ck", "emu_sys_cm:0000:20"), +- DT_CLK(NULL, "pmd_trace_clk_mux_ck", "emu_sys_cm:0000:22"), +- DT_CLK(NULL, "sgx_clk_mux", "l3_gfx_cm:0000:24"), +- DT_CLK(NULL, "slimbus1_fclk_0", "abe_cm:0040:8"), +- DT_CLK(NULL, "slimbus1_fclk_1", "abe_cm:0040:9"), +- DT_CLK(NULL, "slimbus1_fclk_2", "abe_cm:0040:10"), +- DT_CLK(NULL, "slimbus1_slimbus_clk", "abe_cm:0040:11"), +- DT_CLK(NULL, "slimbus2_fclk_0", "l4_per_cm:0118:8"), +- DT_CLK(NULL, "slimbus2_fclk_1", "l4_per_cm:0118:9"), +- DT_CLK(NULL, "slimbus2_slimbus_clk", "l4_per_cm:0118:10"), +- DT_CLK(NULL, "stm_clk_div_ck", "emu_sys_cm:0000:27"), +- DT_CLK(NULL, "timer5_sync_mux", "abe_cm:0048:24"), +- DT_CLK(NULL, "timer6_sync_mux", "abe_cm:0050:24"), +- DT_CLK(NULL, "timer7_sync_mux", "abe_cm:0058:24"), +- DT_CLK(NULL, "timer8_sync_mux", "abe_cm:0060:24"), +- DT_CLK(NULL, "trace_clk_div_div_ck", "emu_sys_cm:0000:24"), +- DT_CLK(NULL, "usb_host_hs_func48mclk", "l3_init_cm:0038:15"), +- DT_CLK(NULL, "usb_host_hs_hsic480m_p1_clk", "l3_init_cm:0038:13"), +- DT_CLK(NULL, "usb_host_hs_hsic480m_p2_clk", "l3_init_cm:0038:14"), +- DT_CLK(NULL, "usb_host_hs_hsic60m_p1_clk", "l3_init_cm:0038:11"), +- DT_CLK(NULL, "usb_host_hs_hsic60m_p2_clk", "l3_init_cm:0038:12"), +- DT_CLK(NULL, "usb_host_hs_utmi_p1_clk", "l3_init_cm:0038:8"), +- DT_CLK(NULL, "usb_host_hs_utmi_p2_clk", "l3_init_cm:0038:9"), +- DT_CLK(NULL, "usb_host_hs_utmi_p3_clk", "l3_init_cm:0038:10"), +- DT_CLK(NULL, "usb_otg_hs_xclk", "l3_init_cm:0040:8"), +- DT_CLK(NULL, "usb_tll_hs_usb_ch0_clk", "l3_init_cm:0048:8"), +- DT_CLK(NULL, "usb_tll_hs_usb_ch1_clk", "l3_init_cm:0048:9"), +- DT_CLK(NULL, "usb_tll_hs_usb_ch2_clk", "l3_init_cm:0048:10"), +- DT_CLK(NULL, "utmi_p1_gfclk", "l3_init_cm:0038:24"), +- DT_CLK(NULL, "utmi_p2_gfclk", "l3_init_cm:0038:25"), ++ DT_CLK(NULL, "aess_fclk", "abe-clkctrl:0008:24"), ++ DT_CLK(NULL, "cm2_dm10_mux", "l4-per-clkctrl:0008:24"), ++ DT_CLK(NULL, "cm2_dm11_mux", "l4-per-clkctrl:0010:24"), ++ DT_CLK(NULL, "cm2_dm2_mux", "l4-per-clkctrl:0018:24"), ++ DT_CLK(NULL, "cm2_dm3_mux", "l4-per-clkctrl:0020:24"), ++ DT_CLK(NULL, "cm2_dm4_mux", "l4-per-clkctrl:0028:24"), ++ DT_CLK(NULL, "cm2_dm9_mux", "l4-per-clkctrl:0030:24"), ++ DT_CLK(NULL, "dmic_sync_mux_ck", "abe-clkctrl:0018:26"), ++ DT_CLK(NULL, "dmt1_clk_mux", "l4-wkup-clkctrl:0020:24"), ++ DT_CLK(NULL, "dss_48mhz_clk", "l3-dss-clkctrl:0000:9"), ++ DT_CLK(NULL, "dss_dss_clk", "l3-dss-clkctrl:0000:8"), ++ DT_CLK(NULL, "dss_sys_clk", "l3-dss-clkctrl:0000:10"), ++ DT_CLK(NULL, "dss_tv_clk", "l3-dss-clkctrl:0000:11"), ++ DT_CLK(NULL, "fdif_fck", "iss-clkctrl:0008:24"), ++ DT_CLK(NULL, "func_dmic_abe_gfclk", "abe-clkctrl:0018:24"), ++ DT_CLK(NULL, "func_mcasp_abe_gfclk", "abe-clkctrl:0020:24"), ++ DT_CLK(NULL, "func_mcbsp1_gfclk", "abe-clkctrl:0028:24"), ++ DT_CLK(NULL, "func_mcbsp2_gfclk", "abe-clkctrl:0030:24"), ++ DT_CLK(NULL, "func_mcbsp3_gfclk", "abe-clkctrl:0038:24"), ++ DT_CLK(NULL, "gpio1_dbclk", "l4-wkup-clkctrl:0018:8"), ++ DT_CLK(NULL, "gpio2_dbclk", "l4-per-clkctrl:0040:8"), ++ DT_CLK(NULL, "gpio3_dbclk", "l4-per-clkctrl:0048:8"), ++ DT_CLK(NULL, "gpio4_dbclk", "l4-per-clkctrl:0050:8"), ++ DT_CLK(NULL, "gpio5_dbclk", "l4-per-clkctrl:0058:8"), ++ DT_CLK(NULL, "gpio6_dbclk", "l4-per-clkctrl:0060:8"), ++ DT_CLK(NULL, "hsi_fck", "l3-init-clkctrl:0018:24"), ++ DT_CLK(NULL, "hsmmc1_fclk", "l3-init-clkctrl:0008:24"), ++ DT_CLK(NULL, "hsmmc2_fclk", "l3-init-clkctrl:0010:24"), ++ DT_CLK(NULL, "iss_ctrlclk", "iss-clkctrl:0000:8"), ++ DT_CLK(NULL, "mcasp_sync_mux_ck", "abe-clkctrl:0020:26"), ++ DT_CLK(NULL, "mcbsp1_sync_mux_ck", "abe-clkctrl:0028:26"), ++ DT_CLK(NULL, "mcbsp2_sync_mux_ck", "abe-clkctrl:0030:26"), ++ DT_CLK(NULL, "mcbsp3_sync_mux_ck", "abe-clkctrl:0038:26"), ++ DT_CLK(NULL, "mcbsp4_sync_mux_ck", "l4-per-clkctrl:00c0:26"), ++ DT_CLK(NULL, "ocp2scp_usb_phy_phy_48m", "l3-init-clkctrl:00c0:8"), ++ DT_CLK(NULL, "otg_60m_gfclk", "l3-init-clkctrl:0040:24"), ++ DT_CLK(NULL, "per_mcbsp4_gfclk", "l4-per-clkctrl:00c0:24"), ++ DT_CLK(NULL, "pmd_stm_clock_mux_ck", "emu-sys-clkctrl:0000:20"), ++ DT_CLK(NULL, "pmd_trace_clk_mux_ck", "emu-sys-clkctrl:0000:22"), ++ DT_CLK(NULL, "sgx_clk_mux", "l3-gfx-clkctrl:0000:24"), ++ DT_CLK(NULL, "slimbus1_fclk_0", "abe-clkctrl:0040:8"), ++ DT_CLK(NULL, "slimbus1_fclk_1", "abe-clkctrl:0040:9"), ++ DT_CLK(NULL, "slimbus1_fclk_2", "abe-clkctrl:0040:10"), ++ DT_CLK(NULL, "slimbus1_slimbus_clk", "abe-clkctrl:0040:11"), ++ DT_CLK(NULL, "slimbus2_fclk_0", "l4-per-clkctrl:0118:8"), ++ DT_CLK(NULL, "slimbus2_fclk_1", "l4-per-clkctrl:0118:9"), ++ DT_CLK(NULL, "slimbus2_slimbus_clk", "l4-per-clkctrl:0118:10"), ++ DT_CLK(NULL, "stm_clk_div_ck", "emu-sys-clkctrl:0000:27"), ++ DT_CLK(NULL, "timer5_sync_mux", "abe-clkctrl:0048:24"), ++ DT_CLK(NULL, "timer6_sync_mux", "abe-clkctrl:0050:24"), ++ DT_CLK(NULL, "timer7_sync_mux", "abe-clkctrl:0058:24"), ++ DT_CLK(NULL, "timer8_sync_mux", "abe-clkctrl:0060:24"), ++ DT_CLK(NULL, "trace_clk_div_div_ck", "emu-sys-clkctrl:0000:24"), ++ DT_CLK(NULL, "usb_host_hs_func48mclk", "l3-init-clkctrl:0038:15"), ++ DT_CLK(NULL, "usb_host_hs_hsic480m_p1_clk", "l3-init-clkctrl:0038:13"), ++ DT_CLK(NULL, "usb_host_hs_hsic480m_p2_clk", "l3-init-clkctrl:0038:14"), ++ DT_CLK(NULL, "usb_host_hs_hsic60m_p1_clk", "l3-init-clkctrl:0038:11"), ++ DT_CLK(NULL, "usb_host_hs_hsic60m_p2_clk", "l3-init-clkctrl:0038:12"), ++ DT_CLK(NULL, "usb_host_hs_utmi_p1_clk", "l3-init-clkctrl:0038:8"), ++ DT_CLK(NULL, "usb_host_hs_utmi_p2_clk", "l3-init-clkctrl:0038:9"), ++ DT_CLK(NULL, "usb_host_hs_utmi_p3_clk", "l3_init-clkctrl:0038:10"), ++ DT_CLK(NULL, "usb_otg_hs_xclk", "l3-init-clkctrl:0040:8"), ++ DT_CLK(NULL, "usb_tll_hs_usb_ch0_clk", "l3-init-clkctrl:0048:8"), ++ DT_CLK(NULL, "usb_tll_hs_usb_ch1_clk", "l3-init-clkctrl:0048:9"), ++ DT_CLK(NULL, "usb_tll_hs_usb_ch2_clk", "l3-init-clkctrl:0048:10"), ++ DT_CLK(NULL, "utmi_p1_gfclk", "l3-init-clkctrl:0038:24"), ++ DT_CLK(NULL, "utmi_p2_gfclk", "l3-init-clkctrl:0038:25"), + { .node_name = NULL }, + }; + +diff --git a/drivers/clk/ti/clk-54xx.c b/drivers/clk/ti/clk-54xx.c +index 8694bc9f5fc7..04a5408085ac 100644 +--- a/drivers/clk/ti/clk-54xx.c ++++ b/drivers/clk/ti/clk-54xx.c +@@ -50,7 +50,7 @@ static const struct omap_clkctrl_bit_data omap5_aess_bit_data[] __initconst = { + }; + + static const char * const omap5_dmic_gfclk_parents[] __initconst = { +- "abe_cm:clk:0018:26", ++ "abe-clkctrl:0018:26", + "pad_clks_ck", + "slimbus_clk", + NULL, +@@ -70,7 +70,7 @@ static const struct omap_clkctrl_bit_data omap5_dmic_bit_data[] __initconst = { + }; + + static const char * const omap5_mcbsp1_gfclk_parents[] __initconst = { +- "abe_cm:clk:0028:26", ++ "abe-clkctrl:0028:26", + "pad_clks_ck", + "slimbus_clk", + NULL, +@@ -83,7 +83,7 @@ static const struct omap_clkctrl_bit_data omap5_mcbsp1_bit_data[] __initconst = + }; + + static const char * const omap5_mcbsp2_gfclk_parents[] __initconst = { +- "abe_cm:clk:0030:26", ++ "abe-clkctrl:0030:26", + "pad_clks_ck", + "slimbus_clk", + NULL, +@@ -96,7 +96,7 @@ static const struct omap_clkctrl_bit_data omap5_mcbsp2_bit_data[] __initconst = + }; + + static const char * const omap5_mcbsp3_gfclk_parents[] __initconst = { +- "abe_cm:clk:0038:26", ++ "abe-clkctrl:0038:26", + "pad_clks_ck", + "slimbus_clk", + NULL, +@@ -136,16 +136,16 @@ static const struct omap_clkctrl_bit_data omap5_timer8_bit_data[] __initconst = + + static const struct omap_clkctrl_reg_data omap5_abe_clkctrl_regs[] __initconst = { + { OMAP5_L4_ABE_CLKCTRL, NULL, 0, "abe_iclk" }, +- { OMAP5_AESS_CLKCTRL, omap5_aess_bit_data, CLKF_SW_SUP, "abe_cm:clk:0008:24" }, ++ { OMAP5_AESS_CLKCTRL, omap5_aess_bit_data, CLKF_SW_SUP, "abe-clkctrl:0008:24" }, + { OMAP5_MCPDM_CLKCTRL, NULL, CLKF_SW_SUP, "pad_clks_ck" }, +- { OMAP5_DMIC_CLKCTRL, omap5_dmic_bit_data, CLKF_SW_SUP, "abe_cm:clk:0018:24" }, +- { OMAP5_MCBSP1_CLKCTRL, omap5_mcbsp1_bit_data, CLKF_SW_SUP, "abe_cm:clk:0028:24" }, +- { OMAP5_MCBSP2_CLKCTRL, omap5_mcbsp2_bit_data, CLKF_SW_SUP, "abe_cm:clk:0030:24" }, +- { OMAP5_MCBSP3_CLKCTRL, omap5_mcbsp3_bit_data, CLKF_SW_SUP, "abe_cm:clk:0038:24" }, +- { OMAP5_TIMER5_CLKCTRL, omap5_timer5_bit_data, CLKF_SW_SUP, "abe_cm:clk:0048:24" }, +- { OMAP5_TIMER6_CLKCTRL, omap5_timer6_bit_data, CLKF_SW_SUP, "abe_cm:clk:0050:24" }, +- { OMAP5_TIMER7_CLKCTRL, omap5_timer7_bit_data, CLKF_SW_SUP, "abe_cm:clk:0058:24" }, +- { OMAP5_TIMER8_CLKCTRL, omap5_timer8_bit_data, CLKF_SW_SUP, "abe_cm:clk:0060:24" }, ++ { OMAP5_DMIC_CLKCTRL, omap5_dmic_bit_data, CLKF_SW_SUP, "abe-clkctrl:0018:24" }, ++ { OMAP5_MCBSP1_CLKCTRL, omap5_mcbsp1_bit_data, CLKF_SW_SUP, "abe-clkctrl:0028:24" }, ++ { OMAP5_MCBSP2_CLKCTRL, omap5_mcbsp2_bit_data, CLKF_SW_SUP, "abe-clkctrl:0030:24" }, ++ { OMAP5_MCBSP3_CLKCTRL, omap5_mcbsp3_bit_data, CLKF_SW_SUP, "abe-clkctrl:0038:24" }, ++ { OMAP5_TIMER5_CLKCTRL, omap5_timer5_bit_data, CLKF_SW_SUP, "abe-clkctrl:0048:24" }, ++ { OMAP5_TIMER6_CLKCTRL, omap5_timer6_bit_data, CLKF_SW_SUP, "abe-clkctrl:0050:24" }, ++ { OMAP5_TIMER7_CLKCTRL, omap5_timer7_bit_data, CLKF_SW_SUP, "abe-clkctrl:0058:24" }, ++ { OMAP5_TIMER8_CLKCTRL, omap5_timer8_bit_data, CLKF_SW_SUP, "abe-clkctrl:0060:24" }, + { 0 }, + }; + +@@ -266,12 +266,12 @@ static const struct omap_clkctrl_bit_data omap5_gpio8_bit_data[] __initconst = { + }; + + static const struct omap_clkctrl_reg_data omap5_l4per_clkctrl_regs[] __initconst = { +- { OMAP5_TIMER10_CLKCTRL, omap5_timer10_bit_data, CLKF_SW_SUP, "l4per_cm:clk:0008:24" }, +- { OMAP5_TIMER11_CLKCTRL, omap5_timer11_bit_data, CLKF_SW_SUP, "l4per_cm:clk:0010:24" }, +- { OMAP5_TIMER2_CLKCTRL, omap5_timer2_bit_data, CLKF_SW_SUP, "l4per_cm:clk:0018:24" }, +- { OMAP5_TIMER3_CLKCTRL, omap5_timer3_bit_data, CLKF_SW_SUP, "l4per_cm:clk:0020:24" }, +- { OMAP5_TIMER4_CLKCTRL, omap5_timer4_bit_data, CLKF_SW_SUP, "l4per_cm:clk:0028:24" }, +- { OMAP5_TIMER9_CLKCTRL, omap5_timer9_bit_data, CLKF_SW_SUP, "l4per_cm:clk:0030:24" }, ++ { OMAP5_TIMER10_CLKCTRL, omap5_timer10_bit_data, CLKF_SW_SUP, "l4per-clkctrl:0008:24" }, ++ { OMAP5_TIMER11_CLKCTRL, omap5_timer11_bit_data, CLKF_SW_SUP, "l4per-clkctrl:0010:24" }, ++ { OMAP5_TIMER2_CLKCTRL, omap5_timer2_bit_data, CLKF_SW_SUP, "l4per-clkctrl:0018:24" }, ++ { OMAP5_TIMER3_CLKCTRL, omap5_timer3_bit_data, CLKF_SW_SUP, "l4per-clkctrl:0020:24" }, ++ { OMAP5_TIMER4_CLKCTRL, omap5_timer4_bit_data, CLKF_SW_SUP, "l4per-clkctrl:0028:24" }, ++ { OMAP5_TIMER9_CLKCTRL, omap5_timer9_bit_data, CLKF_SW_SUP, "l4per-clkctrl:0030:24" }, + { OMAP5_GPIO2_CLKCTRL, omap5_gpio2_bit_data, CLKF_HW_SUP, "l4_root_clk_div" }, + { OMAP5_GPIO3_CLKCTRL, omap5_gpio3_bit_data, CLKF_HW_SUP, "l4_root_clk_div" }, + { OMAP5_GPIO4_CLKCTRL, omap5_gpio4_bit_data, CLKF_HW_SUP, "l4_root_clk_div" }, +@@ -343,7 +343,7 @@ static const struct omap_clkctrl_bit_data omap5_dss_core_bit_data[] __initconst + }; + + static const struct omap_clkctrl_reg_data omap5_dss_clkctrl_regs[] __initconst = { +- { OMAP5_DSS_CORE_CLKCTRL, omap5_dss_core_bit_data, CLKF_SW_SUP, "dss_cm:clk:0000:8" }, ++ { OMAP5_DSS_CORE_CLKCTRL, omap5_dss_core_bit_data, CLKF_SW_SUP, "dss-clkctrl:0000:8" }, + { 0 }, + }; + +@@ -376,7 +376,7 @@ static const struct omap_clkctrl_bit_data omap5_gpu_core_bit_data[] __initconst + }; + + static const struct omap_clkctrl_reg_data omap5_gpu_clkctrl_regs[] __initconst = { +- { OMAP5_GPU_CLKCTRL, omap5_gpu_core_bit_data, CLKF_SW_SUP, "gpu_cm:clk:0000:24" }, ++ { OMAP5_GPU_CLKCTRL, omap5_gpu_core_bit_data, CLKF_SW_SUP, "gpu-clkctrl:0000:24" }, + { 0 }, + }; + +@@ -387,7 +387,7 @@ static const char * const omap5_mmc1_fclk_mux_parents[] __initconst = { + }; + + static const char * const omap5_mmc1_fclk_parents[] __initconst = { +- "l3init_cm:clk:0008:24", ++ "l3init-clkctrl:0008:24", + NULL, + }; + +@@ -403,7 +403,7 @@ static const struct omap_clkctrl_bit_data omap5_mmc1_bit_data[] __initconst = { + }; + + static const char * const omap5_mmc2_fclk_parents[] __initconst = { +- "l3init_cm:clk:0010:24", ++ "l3init-clkctrl:0010:24", + NULL, + }; + +@@ -428,12 +428,12 @@ static const char * const omap5_usb_host_hs_hsic480m_p3_clk_parents[] __initcons + }; + + static const char * const omap5_usb_host_hs_utmi_p1_clk_parents[] __initconst = { +- "l3init_cm:clk:0038:24", ++ "l3init-clkctrl:0038:24", + NULL, + }; + + static const char * const omap5_usb_host_hs_utmi_p2_clk_parents[] __initconst = { +- "l3init_cm:clk:0038:25", ++ "l3init-clkctrl:0038:25", + NULL, + }; + +@@ -492,8 +492,8 @@ static const struct omap_clkctrl_bit_data omap5_usb_otg_ss_bit_data[] __initcons + }; + + static const struct omap_clkctrl_reg_data omap5_l3init_clkctrl_regs[] __initconst = { +- { OMAP5_MMC1_CLKCTRL, omap5_mmc1_bit_data, CLKF_SW_SUP, "l3init_cm:clk:0008:25" }, +- { OMAP5_MMC2_CLKCTRL, omap5_mmc2_bit_data, CLKF_SW_SUP, "l3init_cm:clk:0010:25" }, ++ { OMAP5_MMC1_CLKCTRL, omap5_mmc1_bit_data, CLKF_SW_SUP, "l3init-clkctrl:0008:25" }, ++ { OMAP5_MMC2_CLKCTRL, omap5_mmc2_bit_data, CLKF_SW_SUP, "l3init-clkctrl:0010:25" }, + { OMAP5_USB_HOST_HS_CLKCTRL, omap5_usb_host_hs_bit_data, CLKF_SW_SUP, "l3init_60m_fclk" }, + { OMAP5_USB_TLL_HS_CLKCTRL, omap5_usb_tll_hs_bit_data, CLKF_HW_SUP, "l4_root_clk_div" }, + { OMAP5_SATA_CLKCTRL, omap5_sata_bit_data, CLKF_SW_SUP, "func_48m_fclk" }, +@@ -517,7 +517,7 @@ static const struct omap_clkctrl_reg_data omap5_wkupaon_clkctrl_regs[] __initcon + { OMAP5_L4_WKUP_CLKCTRL, NULL, 0, "wkupaon_iclk_mux" }, + { OMAP5_WD_TIMER2_CLKCTRL, NULL, CLKF_SW_SUP, "sys_32k_ck" }, + { OMAP5_GPIO1_CLKCTRL, omap5_gpio1_bit_data, CLKF_HW_SUP, "wkupaon_iclk_mux" }, +- { OMAP5_TIMER1_CLKCTRL, omap5_timer1_bit_data, CLKF_SW_SUP, "wkupaon_cm:clk:0020:24" }, ++ { OMAP5_TIMER1_CLKCTRL, omap5_timer1_bit_data, CLKF_SW_SUP, "wkupaon-clkctrl:0020:24" }, + { OMAP5_COUNTER_32K_CLKCTRL, NULL, 0, "wkupaon_iclk_mux" }, + { OMAP5_KBD_CLKCTRL, NULL, CLKF_SW_SUP, "sys_32k_ck" }, + { 0 }, +@@ -547,58 +547,58 @@ const struct omap_clkctrl_data omap5_clkctrl_data[] __initconst = { + static struct ti_dt_clk omap54xx_clks[] = { + DT_CLK(NULL, "timer_32k_ck", "sys_32k_ck"), + DT_CLK(NULL, "sys_clkin_ck", "sys_clkin"), +- DT_CLK(NULL, "dmic_gfclk", "abe_cm:0018:24"), +- DT_CLK(NULL, "dmic_sync_mux_ck", "abe_cm:0018:26"), +- DT_CLK(NULL, "dss_32khz_clk", "dss_cm:0000:11"), +- DT_CLK(NULL, "dss_48mhz_clk", "dss_cm:0000:9"), +- DT_CLK(NULL, "dss_dss_clk", "dss_cm:0000:8"), +- DT_CLK(NULL, "dss_sys_clk", "dss_cm:0000:10"), +- DT_CLK(NULL, "gpio1_dbclk", "wkupaon_cm:0018:8"), +- DT_CLK(NULL, "gpio2_dbclk", "l4per_cm:0040:8"), +- DT_CLK(NULL, "gpio3_dbclk", "l4per_cm:0048:8"), +- DT_CLK(NULL, "gpio4_dbclk", "l4per_cm:0050:8"), +- DT_CLK(NULL, "gpio5_dbclk", "l4per_cm:0058:8"), +- DT_CLK(NULL, "gpio6_dbclk", "l4per_cm:0060:8"), +- DT_CLK(NULL, "gpio7_dbclk", "l4per_cm:00f0:8"), +- DT_CLK(NULL, "gpio8_dbclk", "l4per_cm:00f8:8"), +- DT_CLK(NULL, "mcbsp1_gfclk", "abe_cm:0028:24"), +- DT_CLK(NULL, "mcbsp1_sync_mux_ck", "abe_cm:0028:26"), +- DT_CLK(NULL, "mcbsp2_gfclk", "abe_cm:0030:24"), +- DT_CLK(NULL, "mcbsp2_sync_mux_ck", "abe_cm:0030:26"), +- DT_CLK(NULL, "mcbsp3_gfclk", "abe_cm:0038:24"), +- DT_CLK(NULL, "mcbsp3_sync_mux_ck", "abe_cm:0038:26"), +- DT_CLK(NULL, "mmc1_32khz_clk", "l3init_cm:0008:8"), +- DT_CLK(NULL, "mmc1_fclk", "l3init_cm:0008:25"), +- DT_CLK(NULL, "mmc1_fclk_mux", "l3init_cm:0008:24"), +- DT_CLK(NULL, "mmc2_fclk", "l3init_cm:0010:25"), +- DT_CLK(NULL, "mmc2_fclk_mux", "l3init_cm:0010:24"), +- DT_CLK(NULL, "sata_ref_clk", "l3init_cm:0068:8"), +- DT_CLK(NULL, "timer10_gfclk_mux", "l4per_cm:0008:24"), +- DT_CLK(NULL, "timer11_gfclk_mux", "l4per_cm:0010:24"), +- DT_CLK(NULL, "timer1_gfclk_mux", "wkupaon_cm:0020:24"), +- DT_CLK(NULL, "timer2_gfclk_mux", "l4per_cm:0018:24"), +- DT_CLK(NULL, "timer3_gfclk_mux", "l4per_cm:0020:24"), +- DT_CLK(NULL, "timer4_gfclk_mux", "l4per_cm:0028:24"), +- DT_CLK(NULL, "timer5_gfclk_mux", "abe_cm:0048:24"), +- DT_CLK(NULL, "timer6_gfclk_mux", "abe_cm:0050:24"), +- DT_CLK(NULL, "timer7_gfclk_mux", "abe_cm:0058:24"), +- DT_CLK(NULL, "timer8_gfclk_mux", "abe_cm:0060:24"), +- DT_CLK(NULL, "timer9_gfclk_mux", "l4per_cm:0030:24"), +- DT_CLK(NULL, "usb_host_hs_hsic480m_p1_clk", "l3init_cm:0038:13"), +- DT_CLK(NULL, "usb_host_hs_hsic480m_p2_clk", "l3init_cm:0038:14"), +- DT_CLK(NULL, "usb_host_hs_hsic480m_p3_clk", "l3init_cm:0038:7"), +- DT_CLK(NULL, "usb_host_hs_hsic60m_p1_clk", "l3init_cm:0038:11"), +- DT_CLK(NULL, "usb_host_hs_hsic60m_p2_clk", "l3init_cm:0038:12"), +- DT_CLK(NULL, "usb_host_hs_hsic60m_p3_clk", "l3init_cm:0038:6"), +- DT_CLK(NULL, "usb_host_hs_utmi_p1_clk", "l3init_cm:0038:8"), +- DT_CLK(NULL, "usb_host_hs_utmi_p2_clk", "l3init_cm:0038:9"), +- DT_CLK(NULL, "usb_host_hs_utmi_p3_clk", "l3init_cm:0038:10"), +- DT_CLK(NULL, "usb_otg_ss_refclk960m", "l3init_cm:00d0:8"), +- DT_CLK(NULL, "usb_tll_hs_usb_ch0_clk", "l3init_cm:0048:8"), +- DT_CLK(NULL, "usb_tll_hs_usb_ch1_clk", "l3init_cm:0048:9"), +- DT_CLK(NULL, "usb_tll_hs_usb_ch2_clk", "l3init_cm:0048:10"), +- DT_CLK(NULL, "utmi_p1_gfclk", "l3init_cm:0038:24"), +- DT_CLK(NULL, "utmi_p2_gfclk", "l3init_cm:0038:25"), ++ DT_CLK(NULL, "dmic_gfclk", "abe-clkctrl:0018:24"), ++ DT_CLK(NULL, "dmic_sync_mux_ck", "abe-clkctrl:0018:26"), ++ DT_CLK(NULL, "dss_32khz_clk", "dss-clkctrl:0000:11"), ++ DT_CLK(NULL, "dss_48mhz_clk", "dss-clkctrl:0000:9"), ++ DT_CLK(NULL, "dss_dss_clk", "dss-clkctrl:0000:8"), ++ DT_CLK(NULL, "dss_sys_clk", "dss-clkctrl:0000:10"), ++ DT_CLK(NULL, "gpio1_dbclk", "wkupaon-clkctrl:0018:8"), ++ DT_CLK(NULL, "gpio2_dbclk", "l4per-clkctrl:0040:8"), ++ DT_CLK(NULL, "gpio3_dbclk", "l4per-clkctrl:0048:8"), ++ DT_CLK(NULL, "gpio4_dbclk", "l4per-clkctrl:0050:8"), ++ DT_CLK(NULL, "gpio5_dbclk", "l4per-clkctrl:0058:8"), ++ DT_CLK(NULL, "gpio6_dbclk", "l4per-clkctrl:0060:8"), ++ DT_CLK(NULL, "gpio7_dbclk", "l4per-clkctrl:00f0:8"), ++ DT_CLK(NULL, "gpio8_dbclk", "l4per-clkctrl:00f8:8"), ++ DT_CLK(NULL, "mcbsp1_gfclk", "abe-clkctrl:0028:24"), ++ DT_CLK(NULL, "mcbsp1_sync_mux_ck", "abe-clkctrl:0028:26"), ++ DT_CLK(NULL, "mcbsp2_gfclk", "abe-clkctrl:0030:24"), ++ DT_CLK(NULL, "mcbsp2_sync_mux_ck", "abe-clkctrl:0030:26"), ++ DT_CLK(NULL, "mcbsp3_gfclk", "abe-clkctrl:0038:24"), ++ DT_CLK(NULL, "mcbsp3_sync_mux_ck", "abe-clkctrl:0038:26"), ++ DT_CLK(NULL, "mmc1_32khz_clk", "l3init-clkctrl:0008:8"), ++ DT_CLK(NULL, "mmc1_fclk", "l3init-clkctrl:0008:25"), ++ DT_CLK(NULL, "mmc1_fclk_mux", "l3init-clkctrl:0008:24"), ++ DT_CLK(NULL, "mmc2_fclk", "l3init-clkctrl:0010:25"), ++ DT_CLK(NULL, "mmc2_fclk_mux", "l3init-clkctrl:0010:24"), ++ DT_CLK(NULL, "sata_ref_clk", "l3init-clkctrl:0068:8"), ++ DT_CLK(NULL, "timer10_gfclk_mux", "l4per-clkctrl:0008:24"), ++ DT_CLK(NULL, "timer11_gfclk_mux", "l4per-clkctrl:0010:24"), ++ DT_CLK(NULL, "timer1_gfclk_mux", "wkupaon-clkctrl:0020:24"), ++ DT_CLK(NULL, "timer2_gfclk_mux", "l4per-clkctrl:0018:24"), ++ DT_CLK(NULL, "timer3_gfclk_mux", "l4per-clkctrl:0020:24"), ++ DT_CLK(NULL, "timer4_gfclk_mux", "l4per-clkctrl:0028:24"), ++ DT_CLK(NULL, "timer5_gfclk_mux", "abe-clkctrl:0048:24"), ++ DT_CLK(NULL, "timer6_gfclk_mux", "abe-clkctrl:0050:24"), ++ DT_CLK(NULL, "timer7_gfclk_mux", "abe-clkctrl:0058:24"), ++ DT_CLK(NULL, "timer8_gfclk_mux", "abe-clkctrl:0060:24"), ++ DT_CLK(NULL, "timer9_gfclk_mux", "l4per-clkctrl:0030:24"), ++ DT_CLK(NULL, "usb_host_hs_hsic480m_p1_clk", "l3init-clkctrl:0038:13"), ++ DT_CLK(NULL, "usb_host_hs_hsic480m_p2_clk", "l3init-clkctrl:0038:14"), ++ DT_CLK(NULL, "usb_host_hs_hsic480m_p3_clk", "l3init-clkctrl:0038:7"), ++ DT_CLK(NULL, "usb_host_hs_hsic60m_p1_clk", "l3init-clkctrl:0038:11"), ++ DT_CLK(NULL, "usb_host_hs_hsic60m_p2_clk", "l3init-clkctrl:0038:12"), ++ DT_CLK(NULL, "usb_host_hs_hsic60m_p3_clk", "l3init-clkctrl:0038:6"), ++ DT_CLK(NULL, "usb_host_hs_utmi_p1_clk", "l3init-clkctrl:0038:8"), ++ DT_CLK(NULL, "usb_host_hs_utmi_p2_clk", "l3init-clkctrl:0038:9"), ++ DT_CLK(NULL, "usb_host_hs_utmi_p3_clk", "l3init-clkctrl:0038:10"), ++ DT_CLK(NULL, "usb_otg_ss_refclk960m", "l3init-clkctrl:00d0:8"), ++ DT_CLK(NULL, "usb_tll_hs_usb_ch0_clk", "l3init-clkctrl:0048:8"), ++ DT_CLK(NULL, "usb_tll_hs_usb_ch1_clk", "l3init-clkctrl:0048:9"), ++ DT_CLK(NULL, "usb_tll_hs_usb_ch2_clk", "l3init-clkctrl:0048:10"), ++ DT_CLK(NULL, "utmi_p1_gfclk", "l3init-clkctrl:0038:24"), ++ DT_CLK(NULL, "utmi_p2_gfclk", "l3init-clkctrl:0038:25"), + { .node_name = NULL }, + }; + +diff --git a/drivers/clk/ti/clkctrl.c b/drivers/clk/ti/clkctrl.c +index 864c484bde1b..08a85c559f79 100644 +--- a/drivers/clk/ti/clkctrl.c ++++ b/drivers/clk/ti/clkctrl.c +@@ -511,10 +511,6 @@ static void __init _ti_omap4_clkctrl_setup(struct device_node *node) + char *c; + u16 soc_mask = 0; + +- if (!(ti_clk_get_features()->flags & TI_CLK_CLKCTRL_COMPAT) && +- of_node_name_eq(node, "clk")) +- ti_clk_features.flags |= TI_CLK_CLKCTRL_COMPAT; +- + addrp = of_get_address(node, 0, NULL, NULL); + addr = (u32)of_translate_address(node, addrp); + +-- +2.35.1 + diff --git a/queue-5.10/csky-kprobe-reclaim-insn_slot-on-kprobe-unregistrati.patch b/queue-5.10/csky-kprobe-reclaim-insn_slot-on-kprobe-unregistrati.patch new file mode 100644 index 00000000000..c1fe50da3ad --- /dev/null +++ b/queue-5.10/csky-kprobe-reclaim-insn_slot-on-kprobe-unregistrati.patch @@ -0,0 +1,40 @@ +From a0be869cb824f314176cc17cd287584a0b3a7838 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 May 2022 16:02:41 +0800 +Subject: csky/kprobe: reclaim insn_slot on kprobe unregistration + +From: Liao Chang + +[ Upstream commit a2310c74d418deca0f1d749c45f1f43162510f51 ] + +On kprobe registration kernel allocate one insn_slot for new kprobe, +but it forget to reclaim the insn_slot on unregistration, leading to a +potential leakage. + +Reported-by: Chen Guokai +Reviewed-by: Masami Hiramatsu (Google) +Signed-off-by: Liao Chang +Signed-off-by: Guo Ren +Signed-off-by: Sasha Levin +--- + arch/csky/kernel/probes/kprobes.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/arch/csky/kernel/probes/kprobes.c b/arch/csky/kernel/probes/kprobes.c +index 556b9ba61ec0..79272dde72db 100644 +--- a/arch/csky/kernel/probes/kprobes.c ++++ b/arch/csky/kernel/probes/kprobes.c +@@ -124,6 +124,10 @@ void __kprobes arch_disarm_kprobe(struct kprobe *p) + + void __kprobes arch_remove_kprobe(struct kprobe *p) + { ++ if (p->ainsn.api.insn) { ++ free_insn_slot(p->ainsn.api.insn, 0); ++ p->ainsn.api.insn = NULL; ++ } + } + + static void __kprobes save_previous_kprobe(struct kprobe_ctlblk *kcb) +-- +2.35.1 + diff --git a/queue-5.10/cxl-fix-a-memory-leak-in-an-error-handling-path.patch b/queue-5.10/cxl-fix-a-memory-leak-in-an-error-handling-path.patch new file mode 100644 index 00000000000..50cb950ee54 --- /dev/null +++ b/queue-5.10/cxl-fix-a-memory-leak-in-an-error-handling-path.patch @@ -0,0 +1,36 @@ +From 0701f4035ce9aa6b293ee449e065b9eb6ed764bc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Jul 2022 21:14:48 +0200 +Subject: cxl: Fix a memory leak in an error handling path + +From: Christophe JAILLET + +[ Upstream commit 3a15b45b5454da862376b5d69a4967f5c6fa1368 ] + +A bitmap_zalloc() must be balanced by a corresponding bitmap_free() in the +error handling path of afu_allocate_irqs(). + +Acked-by: Andrew Donnellan +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/ce5869418f5838187946eb6b11a52715a93ece3d.1657566849.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/misc/cxl/irq.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/misc/cxl/irq.c b/drivers/misc/cxl/irq.c +index 4cb829d5d873..2e4dcfebf19a 100644 +--- a/drivers/misc/cxl/irq.c ++++ b/drivers/misc/cxl/irq.c +@@ -349,6 +349,7 @@ int afu_allocate_irqs(struct cxl_context *ctx, u32 count) + + out: + cxl_ops->release_irq_ranges(&ctx->irqs, ctx->afu->adapter); ++ bitmap_free(ctx->irq_bitmap); + afu_irq_name_free(ctx); + return -ENOMEM; + } +-- +2.35.1 + diff --git a/queue-5.10/dmaengine-sprd-cleanup-in-.remove-after-pm_runtime_g.patch b/queue-5.10/dmaengine-sprd-cleanup-in-.remove-after-pm_runtime_g.patch new file mode 100644 index 00000000000..0719fd3b8ae --- /dev/null +++ b/queue-5.10/dmaengine-sprd-cleanup-in-.remove-after-pm_runtime_g.patch @@ -0,0 +1,51 @@ +From 566f57ae00edcd9d9002d6013e4601191b1ce47a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Jul 2022 22:40:54 +0200 +Subject: dmaengine: sprd: Cleanup in .remove() after pm_runtime_get_sync() + failed +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 1e42f82cbec7b2cc4873751e7791e6611901c5fc ] + +It's not allowed to quit remove early without cleaning up completely. +Otherwise this results in resource leaks that probably yield graver +problems later. Here for example some tasklets might survive the lifetime +of the sprd-dma device and access sdev which is freed after .remove() +returns. + +As none of the device freeing requires an active device, just ignore the +return value of pm_runtime_get_sync(). + +Signed-off-by: Uwe Kleine-König +Reviewed-by: Baolin Wang +Link: https://lore.kernel.org/r/20220721204054.323602-1-u.kleine-koenig@pengutronix.de +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/sprd-dma.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/drivers/dma/sprd-dma.c b/drivers/dma/sprd-dma.c +index 4357d2395e6b..60115d8d4083 100644 +--- a/drivers/dma/sprd-dma.c ++++ b/drivers/dma/sprd-dma.c +@@ -1236,11 +1236,8 @@ static int sprd_dma_remove(struct platform_device *pdev) + { + struct sprd_dma_dev *sdev = platform_get_drvdata(pdev); + struct sprd_dma_chn *c, *cn; +- int ret; + +- ret = pm_runtime_get_sync(&pdev->dev); +- if (ret < 0) +- return ret; ++ pm_runtime_get_sync(&pdev->dev); + + /* explicitly free the irq */ + if (sdev->irq > 0) +-- +2.35.1 + diff --git a/queue-5.10/drivers-md-fix-a-potential-use-after-free-bug.patch b/queue-5.10/drivers-md-fix-a-potential-use-after-free-bug.patch new file mode 100644 index 00000000000..43fa8aa5479 --- /dev/null +++ b/queue-5.10/drivers-md-fix-a-potential-use-after-free-bug.patch @@ -0,0 +1,44 @@ +From e006c5eed7642642760642042f44c2752034eb8f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Jul 2022 19:39:19 +0800 +Subject: drivers:md:fix a potential use-after-free bug + +From: Wentao_Liang + +[ Upstream commit 104212471b1c1817b311771d817fb692af983173 ] + +In line 2884, "raid5_release_stripe(sh);" drops the reference to sh and +may cause sh to be released. However, sh is subsequently used in lines +2886 "if (sh->batch_head && sh != sh->batch_head)". This may result in an +use-after-free bug. + +It can be fixed by moving "raid5_release_stripe(sh);" to the bottom of +the function. + +Signed-off-by: Wentao_Liang +Signed-off-by: Song Liu +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/md/raid5.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c +index c8cafdb094aa..01c7edf32936 100644 +--- a/drivers/md/raid5.c ++++ b/drivers/md/raid5.c +@@ -2864,10 +2864,10 @@ static void raid5_end_write_request(struct bio *bi) + if (!test_and_clear_bit(R5_DOUBLE_LOCKED, &sh->dev[i].flags)) + clear_bit(R5_LOCKED, &sh->dev[i].flags); + set_bit(STRIPE_HANDLE, &sh->state); +- raid5_release_stripe(sh); + + if (sh->batch_head && sh != sh->batch_head) + raid5_release_stripe(sh->batch_head); ++ raid5_release_stripe(sh); + } + + static void raid5_error(struct mddev *mddev, struct md_rdev *rdev) +-- +2.35.1 + diff --git a/queue-5.10/drm-meson-fix-overflow-implicit-truncation-warnings.patch b/queue-5.10/drm-meson-fix-overflow-implicit-truncation-warnings.patch new file mode 100644 index 00000000000..688bdf75f44 --- /dev/null +++ b/queue-5.10/drm-meson-fix-overflow-implicit-truncation-warnings.patch @@ -0,0 +1,72 @@ +From 1c8fde9d3c3fb935d52ec9bb2ecdb3af5ac0fdbe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 May 2022 22:14:13 +0530 +Subject: drm/meson: Fix overflow implicit truncation warnings +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Sai Prakash Ranjan + +[ Upstream commit 98692f52c588225034cbff458622c2c06dfcb544 ] + +Fix -Woverflow warnings for drm/meson driver which is a result +of moving arm64 custom MMIO accessor macros to asm-generic function +implementations giving a bonus type-checking now and uncovering these +overflow warnings. + +drivers/gpu/drm/meson/meson_viu.c: In function ‘meson_viu_init’: +drivers/gpu/drm/meson/meson_registers.h:1826:48: error: large integer implicitly truncated to unsigned type [-Werror=overflow] + #define VIU_OSD_BLEND_REORDER(dest, src) ((src) << (dest * 4)) + ^ +drivers/gpu/drm/meson/meson_viu.c:472:18: note: in expansion of macro ‘VIU_OSD_BLEND_REORDER’ + writel_relaxed(VIU_OSD_BLEND_REORDER(0, 1) | + ^~~~~~~~~~~~~~~~~~~~~ + +Reported-by: kernel test robot +Signed-off-by: Sai Prakash Ranjan +Reviewed-by: Arnd Bergmann +Cc: Arnd Bergmann +Cc: Neil Armstrong +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/meson/meson_viu.c | 22 +++++++++++----------- + 1 file changed, 11 insertions(+), 11 deletions(-) + +diff --git a/drivers/gpu/drm/meson/meson_viu.c b/drivers/gpu/drm/meson/meson_viu.c +index 259f3e6bec90..bb7e109534de 100644 +--- a/drivers/gpu/drm/meson/meson_viu.c ++++ b/drivers/gpu/drm/meson/meson_viu.c +@@ -469,17 +469,17 @@ void meson_viu_init(struct meson_drm *priv) + priv->io_base + _REG(VD2_IF0_LUMA_FIFO_SIZE)); + + if (meson_vpu_is_compatible(priv, VPU_COMPATIBLE_G12A)) { +- writel_relaxed(VIU_OSD_BLEND_REORDER(0, 1) | +- VIU_OSD_BLEND_REORDER(1, 0) | +- VIU_OSD_BLEND_REORDER(2, 0) | +- VIU_OSD_BLEND_REORDER(3, 0) | +- VIU_OSD_BLEND_DIN_EN(1) | +- VIU_OSD_BLEND1_DIN3_BYPASS_TO_DOUT1 | +- VIU_OSD_BLEND1_DOUT_BYPASS_TO_BLEND2 | +- VIU_OSD_BLEND_DIN0_BYPASS_TO_DOUT0 | +- VIU_OSD_BLEND_BLEN2_PREMULT_EN(1) | +- VIU_OSD_BLEND_HOLD_LINES(4), +- priv->io_base + _REG(VIU_OSD_BLEND_CTRL)); ++ u32 val = (u32)VIU_OSD_BLEND_REORDER(0, 1) | ++ (u32)VIU_OSD_BLEND_REORDER(1, 0) | ++ (u32)VIU_OSD_BLEND_REORDER(2, 0) | ++ (u32)VIU_OSD_BLEND_REORDER(3, 0) | ++ (u32)VIU_OSD_BLEND_DIN_EN(1) | ++ (u32)VIU_OSD_BLEND1_DIN3_BYPASS_TO_DOUT1 | ++ (u32)VIU_OSD_BLEND1_DOUT_BYPASS_TO_BLEND2 | ++ (u32)VIU_OSD_BLEND_DIN0_BYPASS_TO_DOUT0 | ++ (u32)VIU_OSD_BLEND_BLEN2_PREMULT_EN(1) | ++ (u32)VIU_OSD_BLEND_HOLD_LINES(4); ++ writel_relaxed(val, priv->io_base + _REG(VIU_OSD_BLEND_CTRL)); + + writel_relaxed(OSD_BLEND_PATH_SEL_ENABLE, + priv->io_base + _REG(OSD1_BLEND_SRC_CTRL)); +-- +2.35.1 + diff --git a/queue-5.10/drm-meson-fix-refcount-bugs-in-meson_vpu_has_availab.patch b/queue-5.10/drm-meson-fix-refcount-bugs-in-meson_vpu_has_availab.patch new file mode 100644 index 00000000000..23cd65b4a88 --- /dev/null +++ b/queue-5.10/drm-meson-fix-refcount-bugs-in-meson_vpu_has_availab.patch @@ -0,0 +1,46 @@ +From e6258bf26f3f1abdb4451e3f598c5bba19d1e930 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Jul 2022 09:07:22 +0800 +Subject: drm/meson: Fix refcount bugs in meson_vpu_has_available_connectors() + +From: Liang He + +[ Upstream commit 91b3c8dbe898df158fd2a84675f3a284ff6666f7 ] + +In this function, there are two refcount leak bugs: +(1) when breaking out of for_each_endpoint_of_node(), we need call +the of_node_put() for the 'ep'; +(2) we should call of_node_put() for the reference returned by +of_graph_get_remote_port() when it is not used anymore. + +Fixes: bbbe775ec5b5 ("drm: Add support for Amlogic Meson Graphic Controller") +Signed-off-by: Liang He +Acked-by: Martin Blumenstingl +Acked-by: Neil Armstrong +Signed-off-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/20220726010722.1319416-1-windhl@126.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/meson/meson_drv.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/meson/meson_drv.c b/drivers/gpu/drm/meson/meson_drv.c +index 728fea509412..2d022f3fb437 100644 +--- a/drivers/gpu/drm/meson/meson_drv.c ++++ b/drivers/gpu/drm/meson/meson_drv.c +@@ -116,8 +116,11 @@ static bool meson_vpu_has_available_connectors(struct device *dev) + for_each_endpoint_of_node(dev->of_node, ep) { + /* If the endpoint node exists, consider it enabled */ + remote = of_graph_get_remote_port(ep); +- if (remote) ++ if (remote) { ++ of_node_put(remote); ++ of_node_put(ep); + return true; ++ } + } + + return false; +-- +2.35.1 + diff --git a/queue-5.10/drm-sun4i-dsi-prevent-underflow-when-computing-packe.patch b/queue-5.10/drm-sun4i-dsi-prevent-underflow-when-computing-packe.patch new file mode 100644 index 00000000000..25a30126500 --- /dev/null +++ b/queue-5.10/drm-sun4i-dsi-prevent-underflow-when-computing-packe.patch @@ -0,0 +1,79 @@ +From 3c12efb4f88a5c8ab2d0aaa33f60ccd8e7c8f5b7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Aug 2022 22:16:23 -0500 +Subject: drm/sun4i: dsi: Prevent underflow when computing packet sizes + +From: Samuel Holland + +[ Upstream commit 82a1356a933d8443139f8886f11b63c974a09a67 ] + +Currently, the packet overhead is subtracted using unsigned arithmetic. +With a short sync pulse, this could underflow and wrap around to near +the maximal u16 value. Fix this by using signed subtraction. The call to +max() will correctly handle any negative numbers that are produced. + +Apply the same fix to the other timings, even though those subtractions +are less likely to underflow. + +Fixes: 133add5b5ad4 ("drm/sun4i: Add Allwinner A31 MIPI-DSI controller support") +Signed-off-by: Samuel Holland +Reviewed-by: Jernej Skrabec +Signed-off-by: Maxime Ripard +Link: https://lore.kernel.org/r/20220812031623.34057-1-samuel@sholland.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c b/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c +index 4f5efcace68e..51edb4244af7 100644 +--- a/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c ++++ b/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c +@@ -531,7 +531,7 @@ static void sun6i_dsi_setup_timings(struct sun6i_dsi *dsi, + struct drm_display_mode *mode) + { + struct mipi_dsi_device *device = dsi->device; +- unsigned int Bpp = mipi_dsi_pixel_format_to_bpp(device->format) / 8; ++ int Bpp = mipi_dsi_pixel_format_to_bpp(device->format) / 8; + u16 hbp = 0, hfp = 0, hsa = 0, hblk = 0, vblk = 0; + u32 basic_ctl = 0; + size_t bytes; +@@ -555,7 +555,7 @@ static void sun6i_dsi_setup_timings(struct sun6i_dsi *dsi, + * (4 bytes). Its minimal size is therefore 10 bytes + */ + #define HSA_PACKET_OVERHEAD 10 +- hsa = max((unsigned int)HSA_PACKET_OVERHEAD, ++ hsa = max(HSA_PACKET_OVERHEAD, + (mode->hsync_end - mode->hsync_start) * Bpp - HSA_PACKET_OVERHEAD); + + /* +@@ -564,7 +564,7 @@ static void sun6i_dsi_setup_timings(struct sun6i_dsi *dsi, + * therefore 6 bytes + */ + #define HBP_PACKET_OVERHEAD 6 +- hbp = max((unsigned int)HBP_PACKET_OVERHEAD, ++ hbp = max(HBP_PACKET_OVERHEAD, + (mode->htotal - mode->hsync_end) * Bpp - HBP_PACKET_OVERHEAD); + + /* +@@ -574,7 +574,7 @@ static void sun6i_dsi_setup_timings(struct sun6i_dsi *dsi, + * 16 bytes + */ + #define HFP_PACKET_OVERHEAD 16 +- hfp = max((unsigned int)HFP_PACKET_OVERHEAD, ++ hfp = max(HFP_PACKET_OVERHEAD, + (mode->hsync_start - mode->hdisplay) * Bpp - HFP_PACKET_OVERHEAD); + + /* +@@ -583,7 +583,7 @@ static void sun6i_dsi_setup_timings(struct sun6i_dsi *dsi, + * bytes). Its minimal size is therefore 10 bytes. + */ + #define HBLK_PACKET_OVERHEAD 10 +- hblk = max((unsigned int)HBLK_PACKET_OVERHEAD, ++ hblk = max(HBLK_PACKET_OVERHEAD, + (mode->htotal - (mode->hsync_end - mode->hsync_start)) * Bpp - + HBLK_PACKET_OVERHEAD); + +-- +2.35.1 + diff --git a/queue-5.10/ext4-avoid-remove-directory-when-directory-is-corrup.patch b/queue-5.10/ext4-avoid-remove-directory-when-directory-is-corrup.patch new file mode 100644 index 00000000000..5d7e7ad9481 --- /dev/null +++ b/queue-5.10/ext4-avoid-remove-directory-when-directory-is-corrup.patch @@ -0,0 +1,43 @@ +From 87f22331a85e64cc3e8e95834949cc075624c0cb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Jun 2022 17:02:23 +0800 +Subject: ext4: avoid remove directory when directory is corrupted + +From: Ye Bin + +[ Upstream commit b24e77ef1c6d4dbf42749ad4903c97539cc9755a ] + +Now if check directoy entry is corrupted, ext4_empty_dir may return true +then directory will be removed when file system mounted with "errors=continue". +In order not to make things worse just return false when directory is corrupted. + +Signed-off-by: Ye Bin +Reviewed-by: Jan Kara +Link: https://lore.kernel.org/r/20220622090223.682234-1-yebin10@huawei.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/namei.c | 7 ++----- + 1 file changed, 2 insertions(+), 5 deletions(-) + +diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c +index afc20d32c9fd..58b0f1b12095 100644 +--- a/fs/ext4/namei.c ++++ b/fs/ext4/namei.c +@@ -2961,11 +2961,8 @@ bool ext4_empty_dir(struct inode *inode) + de = (struct ext4_dir_entry_2 *) (bh->b_data + + (offset & (sb->s_blocksize - 1))); + if (ext4_check_dir_entry(inode, NULL, de, bh, +- bh->b_data, bh->b_size, offset)) { +- offset = (offset | (sb->s_blocksize - 1)) + 1; +- continue; +- } +- if (le32_to_cpu(de->inode)) { ++ bh->b_data, bh->b_size, offset) || ++ le32_to_cpu(de->inode)) { + brelse(bh); + return false; + } +-- +2.35.1 + diff --git a/queue-5.10/ext4-avoid-resizing-to-a-partial-cluster-size.patch b/queue-5.10/ext4-avoid-resizing-to-a-partial-cluster-size.patch new file mode 100644 index 00000000000..434a3eb0999 --- /dev/null +++ b/queue-5.10/ext4-avoid-resizing-to-a-partial-cluster-size.patch @@ -0,0 +1,47 @@ +From 095ed774b21d7440ab34c799489849888ac92223 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Jul 2022 04:27:48 +0000 +Subject: ext4: avoid resizing to a partial cluster size + +From: Kiselev, Oleg + +[ Upstream commit 69cb8e9d8cd97cdf5e293b26d70a9dee3e35e6bd ] + +This patch avoids an attempt to resize the filesystem to an +unaligned cluster boundary. An online resize to a size that is not +integral to cluster size results in the last iteration attempting to +grow the fs by a negative amount, which trips a BUG_ON and leaves the fs +with a corrupted in-memory superblock. + +Signed-off-by: Oleg Kiselev +Link: https://lore.kernel.org/r/0E92A0AB-4F16-4F1A-94B7-702CC6504FDE@amazon.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/resize.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c +index 5cfea77f3322..f6409ddfd117 100644 +--- a/fs/ext4/resize.c ++++ b/fs/ext4/resize.c +@@ -1957,6 +1957,16 @@ int ext4_resize_fs(struct super_block *sb, ext4_fsblk_t n_blocks_count) + } + brelse(bh); + ++ /* ++ * For bigalloc, trim the requested size to the nearest cluster ++ * boundary to avoid creating an unusable filesystem. We do this ++ * silently, instead of returning an error, to avoid breaking ++ * callers that blindly resize the filesystem to the full size of ++ * the underlying block device. ++ */ ++ if (ext4_has_feature_bigalloc(sb)) ++ n_blocks_count &= ~((1 << EXT4_CLUSTER_BITS(sb)) - 1); ++ + retry: + o_blocks_count = ext4_blocks_count(es); + +-- +2.35.1 + diff --git a/queue-5.10/f2fs-fix-to-avoid-use-f2fs_bug_on-in-f2fs_new_node_p.patch b/queue-5.10/f2fs-fix-to-avoid-use-f2fs_bug_on-in-f2fs_new_node_p.patch new file mode 100644 index 00000000000..f2741d1c5ff --- /dev/null +++ b/queue-5.10/f2fs-fix-to-avoid-use-f2fs_bug_on-in-f2fs_new_node_p.patch @@ -0,0 +1,63 @@ +From f2a52ae3ee69cb96fb2e0d87bb3ac6b9106154d1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Jul 2022 00:03:23 +0800 +Subject: f2fs: fix to avoid use f2fs_bug_on() in f2fs_new_node_page() + +From: Chao Yu + +[ Upstream commit 141170b759e03958f296033bb7001be62d1d363b ] + +As Dipanjan Das reported, syzkaller +found a f2fs bug as below: + +RIP: 0010:f2fs_new_node_page+0x19ac/0x1fc0 fs/f2fs/node.c:1295 +Call Trace: + write_all_xattrs fs/f2fs/xattr.c:487 [inline] + __f2fs_setxattr+0xe76/0x2e10 fs/f2fs/xattr.c:743 + f2fs_setxattr+0x233/0xab0 fs/f2fs/xattr.c:790 + f2fs_xattr_generic_set+0x133/0x170 fs/f2fs/xattr.c:86 + __vfs_setxattr+0x115/0x180 fs/xattr.c:182 + __vfs_setxattr_noperm+0x125/0x5f0 fs/xattr.c:216 + __vfs_setxattr_locked+0x1cf/0x260 fs/xattr.c:277 + vfs_setxattr+0x13f/0x330 fs/xattr.c:303 + setxattr+0x146/0x160 fs/xattr.c:611 + path_setxattr+0x1a7/0x1d0 fs/xattr.c:630 + __do_sys_lsetxattr fs/xattr.c:653 [inline] + __se_sys_lsetxattr fs/xattr.c:649 [inline] + __x64_sys_lsetxattr+0xbd/0x150 fs/xattr.c:649 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x46/0xb0 + +NAT entry and nat bitmap can be inconsistent, e.g. one nid is free +in nat bitmap, and blkaddr in its NAT entry is not NULL_ADDR, it +may trigger BUG_ON() in f2fs_new_node_page(), fix it. + +Reported-by: Dipanjan Das +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/node.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c +index 5fa10d0b0068..c63274d4b74b 100644 +--- a/fs/f2fs/node.c ++++ b/fs/f2fs/node.c +@@ -1238,7 +1238,11 @@ struct page *f2fs_new_node_page(struct dnode_of_data *dn, unsigned int ofs) + dec_valid_node_count(sbi, dn->inode, !ofs); + goto fail; + } +- f2fs_bug_on(sbi, new_ni.blk_addr != NULL_ADDR); ++ if (unlikely(new_ni.blk_addr != NULL_ADDR)) { ++ err = -EFSCORRUPTED; ++ set_sbi_flag(sbi, SBI_NEED_FSCK); ++ goto fail; ++ } + #endif + new_ni.nid = dn->nid; + new_ni.ino = dn->inode->i_ino; +-- +2.35.1 + diff --git a/queue-5.10/f2fs-fix-to-do-sanity-check-on-segment-type-in-build.patch b/queue-5.10/f2fs-fix-to-do-sanity-check-on-segment-type-in-build.patch new file mode 100644 index 00000000000..6624059ee08 --- /dev/null +++ b/queue-5.10/f2fs-fix-to-do-sanity-check-on-segment-type-in-build.patch @@ -0,0 +1,78 @@ +From e1f722b4811137c27e90d1fda233bddf25d0e623 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Jul 2022 22:51:05 +0800 +Subject: f2fs: fix to do sanity check on segment type in build_sit_entries() + +From: Chao Yu + +[ Upstream commit 09beadf289d6e300553e60d6e76f13c0427ecab3 ] + +As Wenqing Liu reported in bugzilla: + +https://bugzilla.kernel.org/show_bug.cgi?id=216285 + +RIP: 0010:memcpy_erms+0x6/0x10 + f2fs_update_meta_page+0x84/0x570 [f2fs] + change_curseg.constprop.0+0x159/0xbd0 [f2fs] + f2fs_do_replace_block+0x5c7/0x18a0 [f2fs] + f2fs_replace_block+0xeb/0x180 [f2fs] + recover_data+0x1abd/0x6f50 [f2fs] + f2fs_recover_fsync_data+0x12ce/0x3250 [f2fs] + f2fs_fill_super+0x4459/0x6190 [f2fs] + mount_bdev+0x2cf/0x3b0 + legacy_get_tree+0xed/0x1d0 + vfs_get_tree+0x81/0x2b0 + path_mount+0x47e/0x19d0 + do_mount+0xce/0xf0 + __x64_sys_mount+0x12c/0x1a0 + do_syscall_64+0x38/0x90 + entry_SYSCALL_64_after_hwframe+0x63/0xcd + +The root cause is segment type is invalid, so in f2fs_do_replace_block(), +f2fs accesses f2fs_sm_info::curseg_array with out-of-range segment type, +result in accessing invalid curseg->sum_blk during memcpy in +f2fs_update_meta_page(). Fix this by adding sanity check on segment type +in build_sit_entries(). + +Reported-by: Wenqing Liu +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/segment.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c +index 20091f4cf84d..19224e7d2ad0 100644 +--- a/fs/f2fs/segment.c ++++ b/fs/f2fs/segment.c +@@ -4449,6 +4449,12 @@ static int build_sit_entries(struct f2fs_sb_info *sbi) + return err; + seg_info_from_raw_sit(se, &sit); + ++ if (se->type >= NR_PERSISTENT_LOG) { ++ f2fs_err(sbi, "Invalid segment type: %u, segno: %u", ++ se->type, start); ++ return -EFSCORRUPTED; ++ } ++ + sit_valid_blocks[SE_PAGETYPE(se)] += se->valid_blocks; + + /* build discard map only one time */ +@@ -4495,6 +4501,13 @@ static int build_sit_entries(struct f2fs_sb_info *sbi) + break; + seg_info_from_raw_sit(se, &sit); + ++ if (se->type >= NR_PERSISTENT_LOG) { ++ f2fs_err(sbi, "Invalid segment type: %u, segno: %u", ++ se->type, start); ++ err = -EFSCORRUPTED; ++ break; ++ } ++ + sit_valid_blocks[SE_PAGETYPE(se)] += se->valid_blocks; + + if (is_set_ckpt_flags(sbi, CP_TRIMMED_FLAG)) { +-- +2.35.1 + diff --git a/queue-5.10/gadgetfs-ep_io-wait-until-irq-finishes.patch b/queue-5.10/gadgetfs-ep_io-wait-until-irq-finishes.patch new file mode 100644 index 00000000000..1cd1b4b7093 --- /dev/null +++ b/queue-5.10/gadgetfs-ep_io-wait-until-irq-finishes.patch @@ -0,0 +1,37 @@ +From 6365e39f65c8a3ab994250fd1fdb46e0bc0a621c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Jul 2022 09:06:44 +0200 +Subject: gadgetfs: ep_io - wait until IRQ finishes + +From: Jozef Martiniak + +[ Upstream commit 04cb742d4d8f30dc2e83b46ac317eec09191c68e ] + +after usb_ep_queue() if wait_for_completion_interruptible() is +interrupted we need to wait until IRQ gets finished. + +Otherwise complete() from epio_complete() can corrupt stack. + +Signed-off-by: Jozef Martiniak +Link: https://lore.kernel.org/r/20220708070645.6130-1-jomajm@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/legacy/inode.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c +index 454860d52ce7..cd097474b6c3 100644 +--- a/drivers/usb/gadget/legacy/inode.c ++++ b/drivers/usb/gadget/legacy/inode.c +@@ -362,6 +362,7 @@ ep_io (struct ep_data *epdata, void *buf, unsigned len) + spin_unlock_irq (&epdata->dev->lock); + + DBG (epdata->dev, "endpoint gone\n"); ++ wait_for_completion(&done); + epdata->status = -ENODEV; + } + } +-- +2.35.1 + diff --git a/queue-5.10/irqchip-tegra-fix-overflow-implicit-truncation-warni.patch b/queue-5.10/irqchip-tegra-fix-overflow-implicit-truncation-warni.patch new file mode 100644 index 00000000000..881fbf26647 --- /dev/null +++ b/queue-5.10/irqchip-tegra-fix-overflow-implicit-truncation-warni.patch @@ -0,0 +1,76 @@ +From aee61adf68e079dd882aec1e8029ef1a568e5a36 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 May 2022 22:14:12 +0530 +Subject: irqchip/tegra: Fix overflow implicit truncation warnings +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Sai Prakash Ranjan + +[ Upstream commit 443685992bda9bb4f8b17fc02c9f6c60e62b1461 ] + +Fix -Woverflow warnings for tegra irqchip driver which is a result +of moving arm64 custom MMIO accessor macros to asm-generic function +implementations giving a bonus type-checking now and uncovering these +overflow warnings. + +drivers/irqchip/irq-tegra.c: In function ‘tegra_ictlr_suspend’: +drivers/irqchip/irq-tegra.c:151:18: warning: large integer implicitly truncated to unsigned type [-Woverflow] + writel_relaxed(~0ul, ictlr + ICTLR_COP_IER_CLR); + ^ + +Suggested-by: Marc Zyngier +Signed-off-by: Sai Prakash Ranjan +Reviewed-by: Arnd Bergmann +Cc: Marc Zyngier +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + drivers/irqchip/irq-tegra.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/irqchip/irq-tegra.c b/drivers/irqchip/irq-tegra.c +index e1f771c72fc4..ad3e2c1b3c87 100644 +--- a/drivers/irqchip/irq-tegra.c ++++ b/drivers/irqchip/irq-tegra.c +@@ -148,10 +148,10 @@ static int tegra_ictlr_suspend(void) + lic->cop_iep[i] = readl_relaxed(ictlr + ICTLR_COP_IEP_CLASS); + + /* Disable COP interrupts */ +- writel_relaxed(~0ul, ictlr + ICTLR_COP_IER_CLR); ++ writel_relaxed(GENMASK(31, 0), ictlr + ICTLR_COP_IER_CLR); + + /* Disable CPU interrupts */ +- writel_relaxed(~0ul, ictlr + ICTLR_CPU_IER_CLR); ++ writel_relaxed(GENMASK(31, 0), ictlr + ICTLR_CPU_IER_CLR); + + /* Enable the wakeup sources of ictlr */ + writel_relaxed(lic->ictlr_wake_mask[i], ictlr + ICTLR_CPU_IER_SET); +@@ -172,12 +172,12 @@ static void tegra_ictlr_resume(void) + + writel_relaxed(lic->cpu_iep[i], + ictlr + ICTLR_CPU_IEP_CLASS); +- writel_relaxed(~0ul, ictlr + ICTLR_CPU_IER_CLR); ++ writel_relaxed(GENMASK(31, 0), ictlr + ICTLR_CPU_IER_CLR); + writel_relaxed(lic->cpu_ier[i], + ictlr + ICTLR_CPU_IER_SET); + writel_relaxed(lic->cop_iep[i], + ictlr + ICTLR_COP_IEP_CLASS); +- writel_relaxed(~0ul, ictlr + ICTLR_COP_IER_CLR); ++ writel_relaxed(GENMASK(31, 0), ictlr + ICTLR_COP_IER_CLR); + writel_relaxed(lic->cop_ier[i], + ictlr + ICTLR_COP_IER_SET); + } +@@ -312,7 +312,7 @@ static int __init tegra_ictlr_init(struct device_node *node, + lic->base[i] = base; + + /* Disable all interrupts */ +- writel_relaxed(~0UL, base + ICTLR_CPU_IER_CLR); ++ writel_relaxed(GENMASK(31, 0), base + ICTLR_CPU_IER_CLR); + /* All interrupts target IRQ */ + writel_relaxed(0, base + ICTLR_CPU_IEP_CLASS); + +-- +2.35.1 + diff --git a/queue-5.10/lib-list_debug.c-detect-uninitialized-lists.patch b/queue-5.10/lib-list_debug.c-detect-uninitialized-lists.patch new file mode 100644 index 00000000000..93cd0f51474 --- /dev/null +++ b/queue-5.10/lib-list_debug.c-detect-uninitialized-lists.patch @@ -0,0 +1,80 @@ +From da3c993e750981fef050ccf411bdd794aab6dd63 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 May 2022 15:29:51 -0700 +Subject: lib/list_debug.c: Detect uninitialized lists + +From: Guenter Roeck + +[ Upstream commit 0cc011c576aaa4de505046f7a6c90933d7c749a9 ] + +In some circumstances, attempts are made to add entries to or to remove +entries from an uninitialized list. A prime example is +amdgpu_bo_vm_destroy(): It is indirectly called from +ttm_bo_init_reserved() if that function fails, and tries to remove an +entry from a list. However, that list is only initialized in +amdgpu_bo_create_vm() after the call to ttm_bo_init_reserved() returned +success. This results in crashes such as + + BUG: kernel NULL pointer dereference, address: 0000000000000000 + #PF: supervisor read access in kernel mode + #PF: error_code(0x0000) - not-present page + PGD 0 P4D 0 + Oops: 0000 [#1] PREEMPT SMP NOPTI + CPU: 1 PID: 1479 Comm: chrome Not tainted 5.10.110-15768-g29a72e65dae5 + Hardware name: Google Grunt/Grunt, BIOS Google_Grunt.11031.149.0 07/15/2020 + RIP: 0010:__list_del_entry_valid+0x26/0x7d + ... + Call Trace: + amdgpu_bo_vm_destroy+0x48/0x8b + ttm_bo_init_reserved+0x1d7/0x1e0 + amdgpu_bo_create+0x212/0x476 + ? amdgpu_bo_user_destroy+0x23/0x23 + ? kmem_cache_alloc+0x60/0x271 + amdgpu_bo_create_vm+0x40/0x7d + amdgpu_vm_pt_create+0xe8/0x24b + ... + +Check if the list's prev and next pointers are NULL to catch such problems. + +Link: https://lkml.kernel.org/r/20220531222951.92073-1-linux@roeck-us.net +Signed-off-by: Guenter Roeck +Cc: Steven Rostedt +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + lib/list_debug.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/lib/list_debug.c b/lib/list_debug.c +index 5d5424b51b74..413daa72a3d8 100644 +--- a/lib/list_debug.c ++++ b/lib/list_debug.c +@@ -20,7 +20,11 @@ + bool __list_add_valid(struct list_head *new, struct list_head *prev, + struct list_head *next) + { +- if (CHECK_DATA_CORRUPTION(next->prev != prev, ++ if (CHECK_DATA_CORRUPTION(prev == NULL, ++ "list_add corruption. prev is NULL.\n") || ++ CHECK_DATA_CORRUPTION(next == NULL, ++ "list_add corruption. next is NULL.\n") || ++ CHECK_DATA_CORRUPTION(next->prev != prev, + "list_add corruption. next->prev should be prev (%px), but was %px. (next=%px).\n", + prev, next->prev, next) || + CHECK_DATA_CORRUPTION(prev->next != next, +@@ -42,7 +46,11 @@ bool __list_del_entry_valid(struct list_head *entry) + prev = entry->prev; + next = entry->next; + +- if (CHECK_DATA_CORRUPTION(next == LIST_POISON1, ++ if (CHECK_DATA_CORRUPTION(next == NULL, ++ "list_del corruption, %px->next is NULL\n", entry) || ++ CHECK_DATA_CORRUPTION(prev == NULL, ++ "list_del corruption, %px->prev is NULL\n", entry) || ++ CHECK_DATA_CORRUPTION(next == LIST_POISON1, + "list_del corruption, %px->next is LIST_POISON1 (%px)\n", + entry, LIST_POISON1) || + CHECK_DATA_CORRUPTION(prev == LIST_POISON2, +-- +2.35.1 + diff --git a/queue-5.10/md-notify-sysfs-sync_completed-in-md_reap_sync_threa.patch b/queue-5.10/md-notify-sysfs-sync_completed-in-md_reap_sync_threa.patch new file mode 100644 index 00000000000..338b502ab2f --- /dev/null +++ b/queue-5.10/md-notify-sysfs-sync_completed-in-md_reap_sync_threa.patch @@ -0,0 +1,50 @@ +From aef996f2e811fa2e8c123f09d181a9e3c9170ba8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Jun 2022 10:27:56 -0600 +Subject: md: Notify sysfs sync_completed in md_reap_sync_thread() + +From: Logan Gunthorpe + +[ Upstream commit 9973f0fa7d20269fe6fefe6333997fb5914449c1 ] + +The mdadm test 07layouts randomly produces a kernel hung task deadlock. +The deadlock is caused by the suspend_lo/suspend_hi files being set by +the mdadm background process during reshape and not being cleared +because the process hangs. (Leaving aside the issue of the fragility of +freezing kernel tasks by buggy userspace processes...) + +When the background mdadm process hangs it, is waiting (without a +timeout) on a change to the sync_completed file signalling that the +reshape has completed. The process is woken up a couple times when +the reshape finishes but it is woken up before MD_RECOVERY_RUNNING +is cleared so sync_completed_show() reports 0 instead of "none". + +To fix this, notify the sysfs file in md_reap_sync_thread() after +MD_RECOVERY_RUNNING has been cleared. This wakes up mdadm and causes +it to continue and write to suspend_lo/suspend_hi to allow IO to +continue. + +Signed-off-by: Logan Gunthorpe +Reviewed-by: Christoph Hellwig +Signed-off-by: Song Liu +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/md/md.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/md/md.c b/drivers/md/md.c +index 4463ef3e3729..884317ee1759 100644 +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -9424,6 +9424,7 @@ void md_reap_sync_thread(struct mddev *mddev) + wake_up(&resync_wait); + /* flag recovery needed just to double check */ + set_bit(MD_RECOVERY_NEEDED, &mddev->recovery); ++ sysfs_notify_dirent_safe(mddev->sysfs_completed); + sysfs_notify_dirent_safe(mddev->sysfs_action); + md_new_event(mddev); + if (mddev->event_work.func) +-- +2.35.1 + diff --git a/queue-5.10/mips-cavium-octeon-fix-missing-of_node_put-in-octeon.patch b/queue-5.10/mips-cavium-octeon-fix-missing-of_node_put-in-octeon.patch new file mode 100644 index 00000000000..41f9ab9c82e --- /dev/null +++ b/queue-5.10/mips-cavium-octeon-fix-missing-of_node_put-in-octeon.patch @@ -0,0 +1,42 @@ +From 5627e989dcd1b571cc4edc0177e5e8313a5e01ac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Jul 2022 20:41:12 +0800 +Subject: mips: cavium-octeon: Fix missing of_node_put() in + octeon2_usb_clocks_start + +From: Liang He + +[ Upstream commit 7a9f743ceead60ed454c46fbc3085ee9a79cbebb ] + +We should call of_node_put() for the reference 'uctl_node' returned by +of_get_parent() which will increase the refcount. Otherwise, there will +be a refcount leak bug. + +Signed-off-by: Liang He +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/cavium-octeon/octeon-platform.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/arch/mips/cavium-octeon/octeon-platform.c b/arch/mips/cavium-octeon/octeon-platform.c +index a994022e32c9..ce05c0dd3acd 100644 +--- a/arch/mips/cavium-octeon/octeon-platform.c ++++ b/arch/mips/cavium-octeon/octeon-platform.c +@@ -86,11 +86,12 @@ static void octeon2_usb_clocks_start(struct device *dev) + "refclk-frequency", &clock_rate); + if (i) { + dev_err(dev, "No UCTL \"refclk-frequency\"\n"); ++ of_node_put(uctl_node); + goto exit; + } + i = of_property_read_string(uctl_node, + "refclk-type", &clock_type); +- ++ of_node_put(uctl_node); + if (!i && strcmp("crystal", clock_type) == 0) + is_crystal_clock = true; + } +-- +2.35.1 + diff --git a/queue-5.10/mips-tlbex-explicitly-compare-_page_no_exec-against-.patch b/queue-5.10/mips-tlbex-explicitly-compare-_page_no_exec-against-.patch new file mode 100644 index 00000000000..1f22db9300c --- /dev/null +++ b/queue-5.10/mips-tlbex-explicitly-compare-_page_no_exec-against-.patch @@ -0,0 +1,70 @@ +From bce536be5cf49cd84af26f17c40a30754f618f2c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Aug 2022 10:59:36 -0700 +Subject: MIPS: tlbex: Explicitly compare _PAGE_NO_EXEC against 0 + +From: Nathan Chancellor + +[ Upstream commit 74de14fe05dd6b151d73cb0c73c8ec874cbdcde6 ] + +When CONFIG_XPA is enabled, Clang warns: + + arch/mips/mm/tlbex.c:629:24: error: converting the result of '<<' to a boolean; did you mean '(1 << _PAGE_NO_EXEC_SHIFT) != 0'? [-Werror,-Wint-in-bool-context] + if (cpu_has_rixi && !!_PAGE_NO_EXEC) { + ^ + arch/mips/include/asm/pgtable-bits.h:174:28: note: expanded from macro '_PAGE_NO_EXEC' + # define _PAGE_NO_EXEC (1 << _PAGE_NO_EXEC_SHIFT) + ^ + arch/mips/mm/tlbex.c:2568:24: error: converting the result of '<<' to a boolean; did you mean '(1 << _PAGE_NO_EXEC_SHIFT) != 0'? [-Werror,-Wint-in-bool-context] + if (!cpu_has_rixi || !_PAGE_NO_EXEC) { + ^ + arch/mips/include/asm/pgtable-bits.h:174:28: note: expanded from macro '_PAGE_NO_EXEC' + # define _PAGE_NO_EXEC (1 << _PAGE_NO_EXEC_SHIFT) + ^ + 2 errors generated. + +_PAGE_NO_EXEC can be '0' or '1 << _PAGE_NO_EXEC_SHIFT' depending on the +build and runtime configuration, which is what the negation operators +are trying to convey. To silence the warning, explicitly compare against +0 so the result of the '<<' operator is not implicitly converted to a +boolean. + +According to its documentation, GCC enables -Wint-in-bool-context with +-Wall but this warning is not visible when building the same +configuration with GCC. It appears GCC only warns when compiling C++, +not C, although the documentation makes no note of this: +https://godbolt.org/z/x39q3brxf + +Reported-by: Sudip Mukherjee (Codethink) +Signed-off-by: Nathan Chancellor +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/mm/tlbex.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/mips/mm/tlbex.c b/arch/mips/mm/tlbex.c +index a7521b8f7658..e8e3635dda09 100644 +--- a/arch/mips/mm/tlbex.c ++++ b/arch/mips/mm/tlbex.c +@@ -633,7 +633,7 @@ static __maybe_unused void build_convert_pte_to_entrylo(u32 **p, + return; + } + +- if (cpu_has_rixi && !!_PAGE_NO_EXEC) { ++ if (cpu_has_rixi && _PAGE_NO_EXEC != 0) { + if (fill_includes_sw_bits) { + UASM_i_ROTR(p, reg, reg, ilog2(_PAGE_GLOBAL)); + } else { +@@ -2572,7 +2572,7 @@ static void check_pabits(void) + unsigned long entry; + unsigned pabits, fillbits; + +- if (!cpu_has_rixi || !_PAGE_NO_EXEC) { ++ if (!cpu_has_rixi || _PAGE_NO_EXEC == 0) { + /* + * We'll only be making use of the fact that we can rotate bits + * into the fill if the CPU supports RIXI, so don't bother +-- +2.35.1 + diff --git a/queue-5.10/modules-ensure-natural-alignment-for-.altinstruction.patch b/queue-5.10/modules-ensure-natural-alignment-for-.altinstruction.patch new file mode 100644 index 00000000000..6bbe6add0e0 --- /dev/null +++ b/queue-5.10/modules-ensure-natural-alignment-for-.altinstruction.patch @@ -0,0 +1,57 @@ +From 1051a2550572375dccaea8d11af7ca1b22b112ea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Jul 2022 11:44:54 +0200 +Subject: modules: Ensure natural alignment for .altinstructions and + __bug_table sections + +From: Helge Deller + +[ Upstream commit 87c482bdfa79f378297d92af49cdf265be199df5 ] + +In the kernel image vmlinux.lds.S linker scripts the .altinstructions +and __bug_table sections are 4- or 8-byte aligned because they hold 32- +and/or 64-bit values. + +Most architectures use altinstructions and BUG() or WARN() in modules as +well, but in the module linker script (module.lds.S) those sections are +currently missing. As consequence the linker will store their content +byte-aligned by default, which then can lead to unnecessary unaligned +memory accesses by the CPU when those tables are processed at runtime. + +Usually unaligned memory accesses are unnoticed, because either the +hardware (as on x86 CPUs) or in-kernel exception handlers (e.g. on +parisc or sparc) emulate and fix them up at runtime. Nevertheless, such +unaligned accesses introduce a performance penalty and can even crash +the kernel if there is a bug in the unalignment exception handlers +(which happened once to me on the parisc architecture and which is why I +noticed that issue at all). + +This patch fixes a non-critical issue and might be backported at any time. +It's trivial and shouldn't introduce any regression because it simply +tells the linker to use a different (8-byte alignment) for those +sections by default. + +Signed-off-by: Helge Deller +Link: https://lore.kernel.org/all/Yr8%2Fgr8e8I7tVX4d@p100/ +Signed-off-by: Luis Chamberlain +Signed-off-by: Sasha Levin +--- + scripts/module.lds.S | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/scripts/module.lds.S b/scripts/module.lds.S +index c5f12195817b..2c510db6c2ed 100644 +--- a/scripts/module.lds.S ++++ b/scripts/module.lds.S +@@ -22,6 +22,8 @@ SECTIONS { + + .init_array 0 : ALIGN(8) { *(SORT(.init_array.*)) *(.init_array) } + ++ .altinstructions 0 : ALIGN(8) { KEEP(*(.altinstructions)) } ++ __bug_table 0 : ALIGN(8) { KEEP(*(__bug_table)) } + __jump_table 0 : ALIGN(8) { KEEP(*(__jump_table)) } + + __patchable_function_entries : { *(__patchable_function_entries) } +-- +2.35.1 + diff --git a/queue-5.10/netfilter-add-helper-function-to-set-up-the-nfnetlin.patch b/queue-5.10/netfilter-add-helper-function-to-set-up-the-nfnetlin.patch new file mode 100644 index 00000000000..3cd5851f229 --- /dev/null +++ b/queue-5.10/netfilter-add-helper-function-to-set-up-the-nfnetlin.patch @@ -0,0 +1,732 @@ +From 2ebfe16ff9dd9685892eb367918d9f26699b4c80 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Mar 2021 16:58:37 +0200 +Subject: netfilter: add helper function to set up the nfnetlink header and use + it + +From: Pablo Neira Ayuso + +[ Upstream commit 19c28b1374fb1073a9ec873a6c10bf5f16b10b9d ] + +This patch adds a helper function to set up the netlink and nfnetlink headers. +Update existing codebase to use it. + +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + include/linux/netfilter/nfnetlink.h | 27 +++++++ + net/netfilter/ipset/ip_set_core.c | 17 +---- + net/netfilter/nf_conntrack_netlink.c | 77 ++++++-------------- + net/netfilter/nf_tables_api.c | 102 +++++++-------------------- + net/netfilter/nf_tables_trace.c | 9 +-- + net/netfilter/nfnetlink_acct.c | 11 +-- + net/netfilter/nfnetlink_cthelper.c | 11 +-- + net/netfilter/nfnetlink_cttimeout.c | 22 ++---- + net/netfilter/nfnetlink_log.c | 11 +-- + net/netfilter/nfnetlink_queue.c | 12 ++-- + net/netfilter/nft_compat.c | 11 +-- + 11 files changed, 102 insertions(+), 208 deletions(-) + +diff --git a/include/linux/netfilter/nfnetlink.h b/include/linux/netfilter/nfnetlink.h +index f6267e2883f2..791d516e1e88 100644 +--- a/include/linux/netfilter/nfnetlink.h ++++ b/include/linux/netfilter/nfnetlink.h +@@ -57,6 +57,33 @@ static inline u16 nfnl_msg_type(u8 subsys, u8 msg_type) + return subsys << 8 | msg_type; + } + ++static inline void nfnl_fill_hdr(struct nlmsghdr *nlh, u8 family, u8 version, ++ __be16 res_id) ++{ ++ struct nfgenmsg *nfmsg; ++ ++ nfmsg = nlmsg_data(nlh); ++ nfmsg->nfgen_family = family; ++ nfmsg->version = version; ++ nfmsg->res_id = res_id; ++} ++ ++static inline struct nlmsghdr *nfnl_msg_put(struct sk_buff *skb, u32 portid, ++ u32 seq, int type, int flags, ++ u8 family, u8 version, ++ __be16 res_id) ++{ ++ struct nlmsghdr *nlh; ++ ++ nlh = nlmsg_put(skb, portid, seq, type, sizeof(struct nfgenmsg), flags); ++ if (!nlh) ++ return NULL; ++ ++ nfnl_fill_hdr(nlh, family, version, res_id); ++ ++ return nlh; ++} ++ + void nfnl_lock(__u8 subsys_id); + void nfnl_unlock(__u8 subsys_id); + #ifdef CONFIG_PROVE_LOCKING +diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c +index 2b19189a930f..c17a7dda0163 100644 +--- a/net/netfilter/ipset/ip_set_core.c ++++ b/net/netfilter/ipset/ip_set_core.c +@@ -963,20 +963,9 @@ static struct nlmsghdr * + start_msg(struct sk_buff *skb, u32 portid, u32 seq, unsigned int flags, + enum ipset_cmd cmd) + { +- struct nlmsghdr *nlh; +- struct nfgenmsg *nfmsg; +- +- nlh = nlmsg_put(skb, portid, seq, nfnl_msg_type(NFNL_SUBSYS_IPSET, cmd), +- sizeof(*nfmsg), flags); +- if (!nlh) +- return NULL; +- +- nfmsg = nlmsg_data(nlh); +- nfmsg->nfgen_family = NFPROTO_IPV4; +- nfmsg->version = NFNETLINK_V0; +- nfmsg->res_id = 0; +- +- return nlh; ++ return nfnl_msg_put(skb, portid, seq, ++ nfnl_msg_type(NFNL_SUBSYS_IPSET, cmd), flags, ++ NFPROTO_IPV4, NFNETLINK_V0, 0); + } + + /* Create a set */ +diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c +index eeeaa34b3e7b..9e6898164199 100644 +--- a/net/netfilter/nf_conntrack_netlink.c ++++ b/net/netfilter/nf_conntrack_netlink.c +@@ -553,22 +553,17 @@ ctnetlink_fill_info(struct sk_buff *skb, u32 portid, u32 seq, u32 type, + { + const struct nf_conntrack_zone *zone; + struct nlmsghdr *nlh; +- struct nfgenmsg *nfmsg; + struct nlattr *nest_parms; + unsigned int event; + + if (portid) + flags |= NLM_F_MULTI; + event = nfnl_msg_type(NFNL_SUBSYS_CTNETLINK, IPCTNL_MSG_CT_NEW); +- nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags); +- if (nlh == NULL) ++ nlh = nfnl_msg_put(skb, portid, seq, event, flags, nf_ct_l3num(ct), ++ NFNETLINK_V0, 0); ++ if (!nlh) + goto nlmsg_failure; + +- nfmsg = nlmsg_data(nlh); +- nfmsg->nfgen_family = nf_ct_l3num(ct); +- nfmsg->version = NFNETLINK_V0; +- nfmsg->res_id = 0; +- + zone = nf_ct_zone(ct); + + nest_parms = nla_nest_start(skb, CTA_TUPLE_ORIG); +@@ -711,7 +706,6 @@ ctnetlink_conntrack_event(unsigned int events, struct nf_ct_event *item) + const struct nf_conntrack_zone *zone; + struct net *net; + struct nlmsghdr *nlh; +- struct nfgenmsg *nfmsg; + struct nlattr *nest_parms; + struct nf_conn *ct = item->ct; + struct sk_buff *skb; +@@ -741,15 +735,11 @@ ctnetlink_conntrack_event(unsigned int events, struct nf_ct_event *item) + goto errout; + + type = nfnl_msg_type(NFNL_SUBSYS_CTNETLINK, type); +- nlh = nlmsg_put(skb, item->portid, 0, type, sizeof(*nfmsg), flags); +- if (nlh == NULL) ++ nlh = nfnl_msg_put(skb, item->portid, 0, type, flags, nf_ct_l3num(ct), ++ NFNETLINK_V0, 0); ++ if (!nlh) + goto nlmsg_failure; + +- nfmsg = nlmsg_data(nlh); +- nfmsg->nfgen_family = nf_ct_l3num(ct); +- nfmsg->version = NFNETLINK_V0; +- nfmsg->res_id = 0; +- + zone = nf_ct_zone(ct); + + nest_parms = nla_nest_start(skb, CTA_TUPLE_ORIG); +@@ -2483,20 +2473,15 @@ ctnetlink_ct_stat_cpu_fill_info(struct sk_buff *skb, u32 portid, u32 seq, + __u16 cpu, const struct ip_conntrack_stat *st) + { + struct nlmsghdr *nlh; +- struct nfgenmsg *nfmsg; + unsigned int flags = portid ? NLM_F_MULTI : 0, event; + + event = nfnl_msg_type(NFNL_SUBSYS_CTNETLINK, + IPCTNL_MSG_CT_GET_STATS_CPU); +- nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags); +- if (nlh == NULL) ++ nlh = nfnl_msg_put(skb, portid, seq, event, flags, AF_UNSPEC, ++ NFNETLINK_V0, htons(cpu)); ++ if (!nlh) + goto nlmsg_failure; + +- nfmsg = nlmsg_data(nlh); +- nfmsg->nfgen_family = AF_UNSPEC; +- nfmsg->version = NFNETLINK_V0; +- nfmsg->res_id = htons(cpu); +- + if (nla_put_be32(skb, CTA_STATS_FOUND, htonl(st->found)) || + nla_put_be32(skb, CTA_STATS_INVALID, htonl(st->invalid)) || + nla_put_be32(skb, CTA_STATS_INSERT, htonl(st->insert)) || +@@ -2568,20 +2553,15 @@ ctnetlink_stat_ct_fill_info(struct sk_buff *skb, u32 portid, u32 seq, u32 type, + struct net *net) + { + struct nlmsghdr *nlh; +- struct nfgenmsg *nfmsg; + unsigned int flags = portid ? NLM_F_MULTI : 0, event; + unsigned int nr_conntracks = atomic_read(&net->ct.count); + + event = nfnl_msg_type(NFNL_SUBSYS_CTNETLINK, IPCTNL_MSG_CT_GET_STATS); +- nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags); +- if (nlh == NULL) ++ nlh = nfnl_msg_put(skb, portid, seq, event, flags, AF_UNSPEC, ++ NFNETLINK_V0, 0); ++ if (!nlh) + goto nlmsg_failure; + +- nfmsg = nlmsg_data(nlh); +- nfmsg->nfgen_family = AF_UNSPEC; +- nfmsg->version = NFNETLINK_V0; +- nfmsg->res_id = 0; +- + if (nla_put_be32(skb, CTA_STATS_GLOBAL_ENTRIES, htonl(nr_conntracks))) + goto nla_put_failure; + +@@ -3085,19 +3065,14 @@ ctnetlink_exp_fill_info(struct sk_buff *skb, u32 portid, u32 seq, + int event, const struct nf_conntrack_expect *exp) + { + struct nlmsghdr *nlh; +- struct nfgenmsg *nfmsg; + unsigned int flags = portid ? NLM_F_MULTI : 0; + + event = nfnl_msg_type(NFNL_SUBSYS_CTNETLINK_EXP, event); +- nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags); +- if (nlh == NULL) ++ nlh = nfnl_msg_put(skb, portid, seq, event, flags, ++ exp->tuple.src.l3num, NFNETLINK_V0, 0); ++ if (!nlh) + goto nlmsg_failure; + +- nfmsg = nlmsg_data(nlh); +- nfmsg->nfgen_family = exp->tuple.src.l3num; +- nfmsg->version = NFNETLINK_V0; +- nfmsg->res_id = 0; +- + if (ctnetlink_exp_dump_expect(skb, exp) < 0) + goto nla_put_failure; + +@@ -3117,7 +3092,6 @@ ctnetlink_expect_event(unsigned int events, struct nf_exp_event *item) + struct nf_conntrack_expect *exp = item->exp; + struct net *net = nf_ct_exp_net(exp); + struct nlmsghdr *nlh; +- struct nfgenmsg *nfmsg; + struct sk_buff *skb; + unsigned int type, group; + int flags = 0; +@@ -3140,15 +3114,11 @@ ctnetlink_expect_event(unsigned int events, struct nf_exp_event *item) + goto errout; + + type = nfnl_msg_type(NFNL_SUBSYS_CTNETLINK_EXP, type); +- nlh = nlmsg_put(skb, item->portid, 0, type, sizeof(*nfmsg), flags); +- if (nlh == NULL) ++ nlh = nfnl_msg_put(skb, item->portid, 0, type, flags, ++ exp->tuple.src.l3num, NFNETLINK_V0, 0); ++ if (!nlh) + goto nlmsg_failure; + +- nfmsg = nlmsg_data(nlh); +- nfmsg->nfgen_family = exp->tuple.src.l3num; +- nfmsg->version = NFNETLINK_V0; +- nfmsg->res_id = 0; +- + if (ctnetlink_exp_dump_expect(skb, exp) < 0) + goto nla_put_failure; + +@@ -3716,20 +3686,15 @@ ctnetlink_exp_stat_fill_info(struct sk_buff *skb, u32 portid, u32 seq, int cpu, + const struct ip_conntrack_stat *st) + { + struct nlmsghdr *nlh; +- struct nfgenmsg *nfmsg; + unsigned int flags = portid ? NLM_F_MULTI : 0, event; + + event = nfnl_msg_type(NFNL_SUBSYS_CTNETLINK, + IPCTNL_MSG_EXP_GET_STATS_CPU); +- nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags); +- if (nlh == NULL) ++ nlh = nfnl_msg_put(skb, portid, seq, event, flags, AF_UNSPEC, ++ NFNETLINK_V0, htons(cpu)); ++ if (!nlh) + goto nlmsg_failure; + +- nfmsg = nlmsg_data(nlh); +- nfmsg->nfgen_family = AF_UNSPEC; +- nfmsg->version = NFNETLINK_V0; +- nfmsg->res_id = htons(cpu); +- + if (nla_put_be32(skb, CTA_STATS_EXP_NEW, htonl(st->expect_new)) || + nla_put_be32(skb, CTA_STATS_EXP_CREATE, htonl(st->expect_create)) || + nla_put_be32(skb, CTA_STATS_EXP_DELETE, htonl(st->expect_delete))) +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index 2ed8ccb9c8c1..e638e7380e79 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -702,18 +702,13 @@ static int nf_tables_fill_table_info(struct sk_buff *skb, struct net *net, + int family, const struct nft_table *table) + { + struct nlmsghdr *nlh; +- struct nfgenmsg *nfmsg; + + event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event); +- nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags); +- if (nlh == NULL) ++ nlh = nfnl_msg_put(skb, portid, seq, event, flags, family, ++ NFNETLINK_V0, nft_base_seq(net)); ++ if (!nlh) + goto nla_put_failure; + +- nfmsg = nlmsg_data(nlh); +- nfmsg->nfgen_family = family; +- nfmsg->version = NFNETLINK_V0; +- nfmsg->res_id = nft_base_seq(net); +- + if (nla_put_string(skb, NFTA_TABLE_NAME, table->name) || + nla_put_be32(skb, NFTA_TABLE_FLAGS, htonl(table->flags)) || + nla_put_be32(skb, NFTA_TABLE_USE, htonl(table->use)) || +@@ -1443,18 +1438,13 @@ static int nf_tables_fill_chain_info(struct sk_buff *skb, struct net *net, + const struct nft_chain *chain) + { + struct nlmsghdr *nlh; +- struct nfgenmsg *nfmsg; + + event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event); +- nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags); +- if (nlh == NULL) ++ nlh = nfnl_msg_put(skb, portid, seq, event, flags, family, ++ NFNETLINK_V0, nft_base_seq(net)); ++ if (!nlh) + goto nla_put_failure; + +- nfmsg = nlmsg_data(nlh); +- nfmsg->nfgen_family = family; +- nfmsg->version = NFNETLINK_V0; +- nfmsg->res_id = nft_base_seq(net); +- + if (nla_put_string(skb, NFTA_CHAIN_TABLE, table->name)) + goto nla_put_failure; + if (nla_put_be64(skb, NFTA_CHAIN_HANDLE, cpu_to_be64(chain->handle), +@@ -2803,20 +2793,15 @@ static int nf_tables_fill_rule_info(struct sk_buff *skb, struct net *net, + const struct nft_rule *prule) + { + struct nlmsghdr *nlh; +- struct nfgenmsg *nfmsg; + const struct nft_expr *expr, *next; + struct nlattr *list; + u16 type = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event); + +- nlh = nlmsg_put(skb, portid, seq, type, sizeof(struct nfgenmsg), flags); +- if (nlh == NULL) ++ nlh = nfnl_msg_put(skb, portid, seq, type, flags, family, NFNETLINK_V0, ++ nft_base_seq(net)); ++ if (!nlh) + goto nla_put_failure; + +- nfmsg = nlmsg_data(nlh); +- nfmsg->nfgen_family = family; +- nfmsg->version = NFNETLINK_V0; +- nfmsg->res_id = nft_base_seq(net); +- + if (nla_put_string(skb, NFTA_RULE_TABLE, table->name)) + goto nla_put_failure; + if (nla_put_string(skb, NFTA_RULE_CHAIN, chain->name)) +@@ -3791,23 +3776,17 @@ static int nf_tables_fill_set_concat(struct sk_buff *skb, + static int nf_tables_fill_set(struct sk_buff *skb, const struct nft_ctx *ctx, + const struct nft_set *set, u16 event, u16 flags) + { +- struct nfgenmsg *nfmsg; + struct nlmsghdr *nlh; + u32 portid = ctx->portid; + struct nlattr *nest; + u32 seq = ctx->seq; + + event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event); +- nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), +- flags); +- if (nlh == NULL) ++ nlh = nfnl_msg_put(skb, portid, seq, event, flags, ctx->family, ++ NFNETLINK_V0, nft_base_seq(ctx->net)); ++ if (!nlh) + goto nla_put_failure; + +- nfmsg = nlmsg_data(nlh); +- nfmsg->nfgen_family = ctx->family; +- nfmsg->version = NFNETLINK_V0; +- nfmsg->res_id = nft_base_seq(ctx->net); +- + if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name)) + goto nla_put_failure; + if (nla_put_string(skb, NFTA_SET_NAME, set->name)) +@@ -4715,7 +4694,6 @@ static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb) + struct nft_set *set; + struct nft_set_dump_args args; + bool set_found = false; +- struct nfgenmsg *nfmsg; + struct nlmsghdr *nlh; + struct nlattr *nest; + u32 portid, seq; +@@ -4748,16 +4726,11 @@ static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb) + portid = NETLINK_CB(cb->skb).portid; + seq = cb->nlh->nlmsg_seq; + +- nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), +- NLM_F_MULTI); +- if (nlh == NULL) ++ nlh = nfnl_msg_put(skb, portid, seq, event, NLM_F_MULTI, ++ table->family, NFNETLINK_V0, nft_base_seq(net)); ++ if (!nlh) + goto nla_put_failure; + +- nfmsg = nlmsg_data(nlh); +- nfmsg->nfgen_family = table->family; +- nfmsg->version = NFNETLINK_V0; +- nfmsg->res_id = nft_base_seq(net); +- + if (nla_put_string(skb, NFTA_SET_ELEM_LIST_TABLE, table->name)) + goto nla_put_failure; + if (nla_put_string(skb, NFTA_SET_ELEM_LIST_SET, set->name)) +@@ -4814,22 +4787,16 @@ static int nf_tables_fill_setelem_info(struct sk_buff *skb, + const struct nft_set *set, + const struct nft_set_elem *elem) + { +- struct nfgenmsg *nfmsg; + struct nlmsghdr *nlh; + struct nlattr *nest; + int err; + + event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event); +- nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), +- flags); +- if (nlh == NULL) ++ nlh = nfnl_msg_put(skb, portid, seq, event, flags, ctx->family, ++ NFNETLINK_V0, nft_base_seq(ctx->net)); ++ if (!nlh) + goto nla_put_failure; + +- nfmsg = nlmsg_data(nlh); +- nfmsg->nfgen_family = ctx->family; +- nfmsg->version = NFNETLINK_V0; +- nfmsg->res_id = nft_base_seq(ctx->net); +- + if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name)) + goto nla_put_failure; + if (nla_put_string(skb, NFTA_SET_NAME, set->name)) +@@ -6086,19 +6053,14 @@ static int nf_tables_fill_obj_info(struct sk_buff *skb, struct net *net, + int family, const struct nft_table *table, + struct nft_object *obj, bool reset) + { +- struct nfgenmsg *nfmsg; + struct nlmsghdr *nlh; + + event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event); +- nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags); +- if (nlh == NULL) ++ nlh = nfnl_msg_put(skb, portid, seq, event, flags, family, ++ NFNETLINK_V0, nft_base_seq(net)); ++ if (!nlh) + goto nla_put_failure; + +- nfmsg = nlmsg_data(nlh); +- nfmsg->nfgen_family = family; +- nfmsg->version = NFNETLINK_V0; +- nfmsg->res_id = nft_base_seq(net); +- + if (nla_put_string(skb, NFTA_OBJ_TABLE, table->name) || + nla_put_string(skb, NFTA_OBJ_NAME, obj->key.name) || + nla_put_be32(skb, NFTA_OBJ_TYPE, htonl(obj->ops->type->type)) || +@@ -6997,20 +6959,15 @@ static int nf_tables_fill_flowtable_info(struct sk_buff *skb, struct net *net, + struct list_head *hook_list) + { + struct nlattr *nest, *nest_devs; +- struct nfgenmsg *nfmsg; + struct nft_hook *hook; + struct nlmsghdr *nlh; + + event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event); +- nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags); +- if (nlh == NULL) ++ nlh = nfnl_msg_put(skb, portid, seq, event, flags, family, ++ NFNETLINK_V0, nft_base_seq(net)); ++ if (!nlh) + goto nla_put_failure; + +- nfmsg = nlmsg_data(nlh); +- nfmsg->nfgen_family = family; +- nfmsg->version = NFNETLINK_V0; +- nfmsg->res_id = nft_base_seq(net); +- + if (nla_put_string(skb, NFTA_FLOWTABLE_TABLE, flowtable->table->name) || + nla_put_string(skb, NFTA_FLOWTABLE_NAME, flowtable->name) || + nla_put_be32(skb, NFTA_FLOWTABLE_USE, htonl(flowtable->use)) || +@@ -7243,19 +7200,14 @@ static int nf_tables_fill_gen_info(struct sk_buff *skb, struct net *net, + u32 portid, u32 seq) + { + struct nlmsghdr *nlh; +- struct nfgenmsg *nfmsg; + char buf[TASK_COMM_LEN]; + int event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, NFT_MSG_NEWGEN); + +- nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), 0); +- if (nlh == NULL) ++ nlh = nfnl_msg_put(skb, portid, seq, event, 0, AF_UNSPEC, ++ NFNETLINK_V0, nft_base_seq(net)); ++ if (!nlh) + goto nla_put_failure; + +- nfmsg = nlmsg_data(nlh); +- nfmsg->nfgen_family = AF_UNSPEC; +- nfmsg->version = NFNETLINK_V0; +- nfmsg->res_id = nft_base_seq(net); +- + if (nla_put_be32(skb, NFTA_GEN_ID, htonl(net->nft.base_seq)) || + nla_put_be32(skb, NFTA_GEN_PROC_PID, htonl(task_pid_nr(current))) || + nla_put_string(skb, NFTA_GEN_PROC_NAME, get_task_comm(buf, current))) +diff --git a/net/netfilter/nf_tables_trace.c b/net/netfilter/nf_tables_trace.c +index 87b36da5cd98..0cf3278007ba 100644 +--- a/net/netfilter/nf_tables_trace.c ++++ b/net/netfilter/nf_tables_trace.c +@@ -183,7 +183,6 @@ static bool nft_trace_have_verdict_chain(struct nft_traceinfo *info) + void nft_trace_notify(struct nft_traceinfo *info) + { + const struct nft_pktinfo *pkt = info->pkt; +- struct nfgenmsg *nfmsg; + struct nlmsghdr *nlh; + struct sk_buff *skb; + unsigned int size; +@@ -219,15 +218,11 @@ void nft_trace_notify(struct nft_traceinfo *info) + return; + + event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, NFT_MSG_TRACE); +- nlh = nlmsg_put(skb, 0, 0, event, sizeof(struct nfgenmsg), 0); ++ nlh = nfnl_msg_put(skb, 0, 0, event, 0, info->basechain->type->family, ++ NFNETLINK_V0, 0); + if (!nlh) + goto nla_put_failure; + +- nfmsg = nlmsg_data(nlh); +- nfmsg->nfgen_family = info->basechain->type->family; +- nfmsg->version = NFNETLINK_V0; +- nfmsg->res_id = 0; +- + if (nla_put_be32(skb, NFTA_TRACE_NFPROTO, htonl(nft_pf(pkt)))) + goto nla_put_failure; + +diff --git a/net/netfilter/nfnetlink_acct.c b/net/netfilter/nfnetlink_acct.c +index 5bfec829c12f..ec3e378da73d 100644 +--- a/net/netfilter/nfnetlink_acct.c ++++ b/net/netfilter/nfnetlink_acct.c +@@ -132,21 +132,16 @@ nfnl_acct_fill_info(struct sk_buff *skb, u32 portid, u32 seq, u32 type, + int event, struct nf_acct *acct) + { + struct nlmsghdr *nlh; +- struct nfgenmsg *nfmsg; + unsigned int flags = portid ? NLM_F_MULTI : 0; + u64 pkts, bytes; + u32 old_flags; + + event = nfnl_msg_type(NFNL_SUBSYS_ACCT, event); +- nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags); +- if (nlh == NULL) ++ nlh = nfnl_msg_put(skb, portid, seq, event, flags, AF_UNSPEC, ++ NFNETLINK_V0, 0); ++ if (!nlh) + goto nlmsg_failure; + +- nfmsg = nlmsg_data(nlh); +- nfmsg->nfgen_family = AF_UNSPEC; +- nfmsg->version = NFNETLINK_V0; +- nfmsg->res_id = 0; +- + if (nla_put_string(skb, NFACCT_NAME, acct->name)) + goto nla_put_failure; + +diff --git a/net/netfilter/nfnetlink_cthelper.c b/net/netfilter/nfnetlink_cthelper.c +index 91afbf8ac8cf..52d5f2411834 100644 +--- a/net/netfilter/nfnetlink_cthelper.c ++++ b/net/netfilter/nfnetlink_cthelper.c +@@ -530,20 +530,15 @@ nfnl_cthelper_fill_info(struct sk_buff *skb, u32 portid, u32 seq, u32 type, + int event, struct nf_conntrack_helper *helper) + { + struct nlmsghdr *nlh; +- struct nfgenmsg *nfmsg; + unsigned int flags = portid ? NLM_F_MULTI : 0; + int status; + + event = nfnl_msg_type(NFNL_SUBSYS_CTHELPER, event); +- nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags); +- if (nlh == NULL) ++ nlh = nfnl_msg_put(skb, portid, seq, event, flags, AF_UNSPEC, ++ NFNETLINK_V0, 0); ++ if (!nlh) + goto nlmsg_failure; + +- nfmsg = nlmsg_data(nlh); +- nfmsg->nfgen_family = AF_UNSPEC; +- nfmsg->version = NFNETLINK_V0; +- nfmsg->res_id = 0; +- + if (nla_put_string(skb, NFCTH_NAME, helper->name)) + goto nla_put_failure; + +diff --git a/net/netfilter/nfnetlink_cttimeout.c b/net/netfilter/nfnetlink_cttimeout.c +index 89a381f7f945..de831a257512 100644 +--- a/net/netfilter/nfnetlink_cttimeout.c ++++ b/net/netfilter/nfnetlink_cttimeout.c +@@ -160,22 +160,17 @@ ctnl_timeout_fill_info(struct sk_buff *skb, u32 portid, u32 seq, u32 type, + int event, struct ctnl_timeout *timeout) + { + struct nlmsghdr *nlh; +- struct nfgenmsg *nfmsg; + unsigned int flags = portid ? NLM_F_MULTI : 0; + const struct nf_conntrack_l4proto *l4proto = timeout->timeout.l4proto; + struct nlattr *nest_parms; + int ret; + + event = nfnl_msg_type(NFNL_SUBSYS_CTNETLINK_TIMEOUT, event); +- nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags); +- if (nlh == NULL) ++ nlh = nfnl_msg_put(skb, portid, seq, event, flags, AF_UNSPEC, ++ NFNETLINK_V0, 0); ++ if (!nlh) + goto nlmsg_failure; + +- nfmsg = nlmsg_data(nlh); +- nfmsg->nfgen_family = AF_UNSPEC; +- nfmsg->version = NFNETLINK_V0; +- nfmsg->res_id = 0; +- + if (nla_put_string(skb, CTA_TIMEOUT_NAME, timeout->name) || + nla_put_be16(skb, CTA_TIMEOUT_L3PROTO, + htons(timeout->timeout.l3num)) || +@@ -382,21 +377,16 @@ cttimeout_default_fill_info(struct net *net, struct sk_buff *skb, u32 portid, + const unsigned int *timeouts) + { + struct nlmsghdr *nlh; +- struct nfgenmsg *nfmsg; + unsigned int flags = portid ? NLM_F_MULTI : 0; + struct nlattr *nest_parms; + int ret; + + event = nfnl_msg_type(NFNL_SUBSYS_CTNETLINK_TIMEOUT, event); +- nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags); +- if (nlh == NULL) ++ nlh = nfnl_msg_put(skb, portid, seq, event, flags, AF_UNSPEC, ++ NFNETLINK_V0, 0); ++ if (!nlh) + goto nlmsg_failure; + +- nfmsg = nlmsg_data(nlh); +- nfmsg->nfgen_family = AF_UNSPEC; +- nfmsg->version = NFNETLINK_V0; +- nfmsg->res_id = 0; +- + if (nla_put_be16(skb, CTA_TIMEOUT_L3PROTO, htons(l3num)) || + nla_put_u8(skb, CTA_TIMEOUT_L4PROTO, l4proto->l4proto)) + goto nla_put_failure; +diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c +index 33c13edbca4b..f087baa95b07 100644 +--- a/net/netfilter/nfnetlink_log.c ++++ b/net/netfilter/nfnetlink_log.c +@@ -452,20 +452,15 @@ __build_packet_message(struct nfnl_log_net *log, + { + struct nfulnl_msg_packet_hdr pmsg; + struct nlmsghdr *nlh; +- struct nfgenmsg *nfmsg; + sk_buff_data_t old_tail = inst->skb->tail; + struct sock *sk; + const unsigned char *hwhdrp; + +- nlh = nlmsg_put(inst->skb, 0, 0, +- nfnl_msg_type(NFNL_SUBSYS_ULOG, NFULNL_MSG_PACKET), +- sizeof(struct nfgenmsg), 0); ++ nlh = nfnl_msg_put(inst->skb, 0, 0, ++ nfnl_msg_type(NFNL_SUBSYS_ULOG, NFULNL_MSG_PACKET), ++ 0, pf, NFNETLINK_V0, htons(inst->group_num)); + if (!nlh) + return -1; +- nfmsg = nlmsg_data(nlh); +- nfmsg->nfgen_family = pf; +- nfmsg->version = NFNETLINK_V0; +- nfmsg->res_id = htons(inst->group_num); + + memset(&pmsg, 0, sizeof(pmsg)); + pmsg.hw_protocol = skb->protocol; +diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c +index 72d30922ed29..9d87606c76ff 100644 +--- a/net/netfilter/nfnetlink_queue.c ++++ b/net/netfilter/nfnetlink_queue.c +@@ -383,7 +383,6 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue, + struct nlattr *nla; + struct nfqnl_msg_packet_hdr *pmsg; + struct nlmsghdr *nlh; +- struct nfgenmsg *nfmsg; + struct sk_buff *entskb = entry->skb; + struct net_device *indev; + struct net_device *outdev; +@@ -469,18 +468,15 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue, + goto nlmsg_failure; + } + +- nlh = nlmsg_put(skb, 0, 0, +- nfnl_msg_type(NFNL_SUBSYS_QUEUE, NFQNL_MSG_PACKET), +- sizeof(struct nfgenmsg), 0); ++ nlh = nfnl_msg_put(skb, 0, 0, ++ nfnl_msg_type(NFNL_SUBSYS_QUEUE, NFQNL_MSG_PACKET), ++ 0, entry->state.pf, NFNETLINK_V0, ++ htons(queue->queue_num)); + if (!nlh) { + skb_tx_error(entskb); + kfree_skb(skb); + goto nlmsg_failure; + } +- nfmsg = nlmsg_data(nlh); +- nfmsg->nfgen_family = entry->state.pf; +- nfmsg->version = NFNETLINK_V0; +- nfmsg->res_id = htons(queue->queue_num); + + nla = __nla_reserve(skb, NFQA_PACKET_HDR, sizeof(*pmsg)); + pmsg = nla_data(nla); +diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c +index 8e56f353ff35..b8dbd20a6a4c 100644 +--- a/net/netfilter/nft_compat.c ++++ b/net/netfilter/nft_compat.c +@@ -591,19 +591,14 @@ nfnl_compat_fill_info(struct sk_buff *skb, u32 portid, u32 seq, u32 type, + int rev, int target) + { + struct nlmsghdr *nlh; +- struct nfgenmsg *nfmsg; + unsigned int flags = portid ? NLM_F_MULTI : 0; + + event = nfnl_msg_type(NFNL_SUBSYS_NFT_COMPAT, event); +- nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags); +- if (nlh == NULL) ++ nlh = nfnl_msg_put(skb, portid, seq, event, flags, family, ++ NFNETLINK_V0, 0); ++ if (!nlh) + goto nlmsg_failure; + +- nfmsg = nlmsg_data(nlh); +- nfmsg->nfgen_family = family; +- nfmsg->version = NFNETLINK_V0; +- nfmsg->res_id = 0; +- + if (nla_put_string(skb, NFTA_COMPAT_NAME, name) || + nla_put_be32(skb, NFTA_COMPAT_REV, htonl(rev)) || + nla_put_be32(skb, NFTA_COMPAT_TYPE, htonl(target))) +-- +2.35.1 + diff --git a/queue-5.10/netfilter-nftables-add-helper-function-to-set-the-ba.patch b/queue-5.10/netfilter-nftables-add-helper-function-to-set-the-ba.patch new file mode 100644 index 00000000000..8c03d02b74b --- /dev/null +++ b/queue-5.10/netfilter-nftables-add-helper-function-to-set-the-ba.patch @@ -0,0 +1,120 @@ +From 22d971db9c92fdfcd2f184168fec54b820d9bdd3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Mar 2021 00:18:02 +0200 +Subject: netfilter: nftables: add helper function to set the base sequence + number + +From: Pablo Neira Ayuso + +[ Upstream commit 802b805162a1b7d8391c40ac8a878e9e63287aff ] + +This patch adds a helper function to calculate the base sequence number +field that is stored in the nfnetlink header. Use the helper function +whenever possible. + +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_tables_api.c | 23 ++++++++++++++--------- + 1 file changed, 14 insertions(+), 9 deletions(-) + +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index 507d3d24a347..2ed8ccb9c8c1 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -683,6 +683,11 @@ nf_tables_chain_type_lookup(struct net *net, const struct nlattr *nla, + return ERR_PTR(-ENOENT); + } + ++static __be16 nft_base_seq(const struct net *net) ++{ ++ return htons(net->nft.base_seq & 0xffff); ++} ++ + static const struct nla_policy nft_table_policy[NFTA_TABLE_MAX + 1] = { + [NFTA_TABLE_NAME] = { .type = NLA_STRING, + .len = NFT_TABLE_MAXNAMELEN - 1 }, +@@ -707,7 +712,7 @@ static int nf_tables_fill_table_info(struct sk_buff *skb, struct net *net, + nfmsg = nlmsg_data(nlh); + nfmsg->nfgen_family = family; + nfmsg->version = NFNETLINK_V0; +- nfmsg->res_id = htons(net->nft.base_seq & 0xffff); ++ nfmsg->res_id = nft_base_seq(net); + + if (nla_put_string(skb, NFTA_TABLE_NAME, table->name) || + nla_put_be32(skb, NFTA_TABLE_FLAGS, htonl(table->flags)) || +@@ -1448,7 +1453,7 @@ static int nf_tables_fill_chain_info(struct sk_buff *skb, struct net *net, + nfmsg = nlmsg_data(nlh); + nfmsg->nfgen_family = family; + nfmsg->version = NFNETLINK_V0; +- nfmsg->res_id = htons(net->nft.base_seq & 0xffff); ++ nfmsg->res_id = nft_base_seq(net); + + if (nla_put_string(skb, NFTA_CHAIN_TABLE, table->name)) + goto nla_put_failure; +@@ -2810,7 +2815,7 @@ static int nf_tables_fill_rule_info(struct sk_buff *skb, struct net *net, + nfmsg = nlmsg_data(nlh); + nfmsg->nfgen_family = family; + nfmsg->version = NFNETLINK_V0; +- nfmsg->res_id = htons(net->nft.base_seq & 0xffff); ++ nfmsg->res_id = nft_base_seq(net); + + if (nla_put_string(skb, NFTA_RULE_TABLE, table->name)) + goto nla_put_failure; +@@ -3801,7 +3806,7 @@ static int nf_tables_fill_set(struct sk_buff *skb, const struct nft_ctx *ctx, + nfmsg = nlmsg_data(nlh); + nfmsg->nfgen_family = ctx->family; + nfmsg->version = NFNETLINK_V0; +- nfmsg->res_id = htons(ctx->net->nft.base_seq & 0xffff); ++ nfmsg->res_id = nft_base_seq(ctx->net); + + if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name)) + goto nla_put_failure; +@@ -4751,7 +4756,7 @@ static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb) + nfmsg = nlmsg_data(nlh); + nfmsg->nfgen_family = table->family; + nfmsg->version = NFNETLINK_V0; +- nfmsg->res_id = htons(net->nft.base_seq & 0xffff); ++ nfmsg->res_id = nft_base_seq(net); + + if (nla_put_string(skb, NFTA_SET_ELEM_LIST_TABLE, table->name)) + goto nla_put_failure; +@@ -4823,7 +4828,7 @@ static int nf_tables_fill_setelem_info(struct sk_buff *skb, + nfmsg = nlmsg_data(nlh); + nfmsg->nfgen_family = ctx->family; + nfmsg->version = NFNETLINK_V0; +- nfmsg->res_id = htons(ctx->net->nft.base_seq & 0xffff); ++ nfmsg->res_id = nft_base_seq(ctx->net); + + if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name)) + goto nla_put_failure; +@@ -6092,7 +6097,7 @@ static int nf_tables_fill_obj_info(struct sk_buff *skb, struct net *net, + nfmsg = nlmsg_data(nlh); + nfmsg->nfgen_family = family; + nfmsg->version = NFNETLINK_V0; +- nfmsg->res_id = htons(net->nft.base_seq & 0xffff); ++ nfmsg->res_id = nft_base_seq(net); + + if (nla_put_string(skb, NFTA_OBJ_TABLE, table->name) || + nla_put_string(skb, NFTA_OBJ_NAME, obj->key.name) || +@@ -7004,7 +7009,7 @@ static int nf_tables_fill_flowtable_info(struct sk_buff *skb, struct net *net, + nfmsg = nlmsg_data(nlh); + nfmsg->nfgen_family = family; + nfmsg->version = NFNETLINK_V0; +- nfmsg->res_id = htons(net->nft.base_seq & 0xffff); ++ nfmsg->res_id = nft_base_seq(net); + + if (nla_put_string(skb, NFTA_FLOWTABLE_TABLE, flowtable->table->name) || + nla_put_string(skb, NFTA_FLOWTABLE_NAME, flowtable->name) || +@@ -7249,7 +7254,7 @@ static int nf_tables_fill_gen_info(struct sk_buff *skb, struct net *net, + nfmsg = nlmsg_data(nlh); + nfmsg->nfgen_family = AF_UNSPEC; + nfmsg->version = NFNETLINK_V0; +- nfmsg->res_id = htons(net->nft.base_seq & 0xffff); ++ nfmsg->res_id = nft_base_seq(net); + + if (nla_put_be32(skb, NFTA_GEN_ID, htonl(net->nft.base_seq)) || + nla_put_be32(skb, NFTA_GEN_PROC_PID, htonl(task_pid_nr(current))) || +-- +2.35.1 + diff --git a/queue-5.10/nvmet-tcp-fix-lockdep-complaint-on-nvmet_tcp_wq-flus.patch b/queue-5.10/nvmet-tcp-fix-lockdep-complaint-on-nvmet_tcp_wq-flus.patch new file mode 100644 index 00000000000..b4c17eaff26 --- /dev/null +++ b/queue-5.10/nvmet-tcp-fix-lockdep-complaint-on-nvmet_tcp_wq-flus.patch @@ -0,0 +1,46 @@ +From 8b4c5db499550412eb1b0529d84c509da28b6e74 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 24 Jul 2022 11:58:43 +0300 +Subject: nvmet-tcp: fix lockdep complaint on nvmet_tcp_wq flush during queue + teardown + +From: Sagi Grimberg + +[ Upstream commit 533d2e8b4d5e4c89772a0adce913525fb86cbbee ] + +We probably need nvmet_tcp_wq to have MEM_RECLAIM as we are +sending/receiving for the socket from works on this workqueue. +Also this eliminates lockdep complaints: +-- +[ 6174.010200] workqueue: WQ_MEM_RECLAIM +nvmet-wq:nvmet_tcp_release_queue_work [nvmet_tcp] is flushing +!WQ_MEM_RECLAIM nvmet_tcp_wq:nvmet_tcp_io_work [nvmet_tcp] +[ 6174.010216] WARNING: CPU: 20 PID: 14456 at kernel/workqueue.c:2628 +check_flush_dependency+0x110/0x14c + +Reported-by: Yi Zhang +Signed-off-by: Sagi Grimberg +Signed-off-by: Christoph Hellwig +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/tcp.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c +index 96b67a70cbbb..d030d5e69dc5 100644 +--- a/drivers/nvme/target/tcp.c ++++ b/drivers/nvme/target/tcp.c +@@ -1802,7 +1802,8 @@ static int __init nvmet_tcp_init(void) + { + int ret; + +- nvmet_tcp_wq = alloc_workqueue("nvmet_tcp_wq", WQ_HIGHPRI, 0); ++ nvmet_tcp_wq = alloc_workqueue("nvmet_tcp_wq", ++ WQ_MEM_RECLAIM | WQ_HIGHPRI, 0); + if (!nvmet_tcp_wq) + return -ENOMEM; + +-- +2.35.1 + diff --git a/queue-5.10/pci-acpi-guard-arm64-specific-mcfg_quirks.patch b/queue-5.10/pci-acpi-guard-arm64-specific-mcfg_quirks.patch new file mode 100644 index 00000000000..a27a7d53bc6 --- /dev/null +++ b/queue-5.10/pci-acpi-guard-arm64-specific-mcfg_quirks.patch @@ -0,0 +1,44 @@ +From 85bcef28c3bbbbf8b0f4e943e99fc67c84504728 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Jul 2022 20:42:10 +0800 +Subject: PCI/ACPI: Guard ARM64-specific mcfg_quirks + +From: Huacai Chen + +[ Upstream commit 40a6cc141b4b9580de140bcb3e893445708acc5d ] + +Guard ARM64-specific quirks with CONFIG_ARM64 to avoid build errors, +since mcfg_quirks will be shared by more than one architectures. + +Link: https://lore.kernel.org/r/20220714124216.1489304-2-chenhuacai@loongson.cn +Signed-off-by: Huacai Chen +Signed-off-by: Bjorn Helgaas +Signed-off-by: Sasha Levin +--- + drivers/acpi/pci_mcfg.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/acpi/pci_mcfg.c b/drivers/acpi/pci_mcfg.c +index 95f23acd5b80..2709ef2b0351 100644 +--- a/drivers/acpi/pci_mcfg.c ++++ b/drivers/acpi/pci_mcfg.c +@@ -41,6 +41,8 @@ struct mcfg_fixup { + static struct mcfg_fixup mcfg_quirks[] = { + /* { OEM_ID, OEM_TABLE_ID, REV, SEGMENT, BUS_RANGE, ops, cfgres }, */ + ++#ifdef CONFIG_ARM64 ++ + #define AL_ECAM(table_id, rev, seg, ops) \ + { "AMAZON", table_id, rev, seg, MCFG_BUS_ANY, ops } + +@@ -162,6 +164,7 @@ static struct mcfg_fixup mcfg_quirks[] = { + ALTRA_ECAM_QUIRK(1, 13), + ALTRA_ECAM_QUIRK(1, 14), + ALTRA_ECAM_QUIRK(1, 15), ++#endif /* ARM64 */ + }; + + static char mcfg_oem_id[ACPI_OEM_ID_SIZE]; +-- +2.35.1 + diff --git a/queue-5.10/pci-add-acs-quirk-for-broadcom-bcm5750x-nics.patch b/queue-5.10/pci-add-acs-quirk-for-broadcom-bcm5750x-nics.patch new file mode 100644 index 00000000000..f145fd0a176 --- /dev/null +++ b/queue-5.10/pci-add-acs-quirk-for-broadcom-bcm5750x-nics.patch @@ -0,0 +1,44 @@ +From 44b084d2720458ec88bd6576d2ac4907a3002419 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Jun 2022 13:41:47 -0400 +Subject: PCI: Add ACS quirk for Broadcom BCM5750x NICs + +From: Pavan Chebbi + +[ Upstream commit afd306a65cedb9589564bdb23a0c368abc4215fd ] + +The Broadcom BCM5750x NICs may be multi-function devices. They do not +advertise ACS capability. Peer-to-peer transactions are not possible +between the individual functions, so it is safe to treat them as fully +isolated. + +Add an ACS quirk for these devices so the functions can be in independent +IOMMU groups and attached individually to userspace applications using +VFIO. + +Link: https://lore.kernel.org/r/1654796507-28610-1-git-send-email-michael.chan@broadcom.com +Signed-off-by: Pavan Chebbi +Signed-off-by: Michael Chan +Signed-off-by: Bjorn Helgaas +Signed-off-by: Sasha Levin +--- + drivers/pci/quirks.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c +index 1be2894ada70..fb2e52fd01b3 100644 +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -4897,6 +4897,9 @@ static const struct pci_dev_acs_enabled { + { PCI_VENDOR_ID_AMPERE, 0xE00C, pci_quirk_xgene_acs }, + /* Broadcom multi-function device */ + { PCI_VENDOR_ID_BROADCOM, 0x16D7, pci_quirk_mf_endpoint_acs }, ++ { PCI_VENDOR_ID_BROADCOM, 0x1750, pci_quirk_mf_endpoint_acs }, ++ { PCI_VENDOR_ID_BROADCOM, 0x1751, pci_quirk_mf_endpoint_acs }, ++ { PCI_VENDOR_ID_BROADCOM, 0x1752, pci_quirk_mf_endpoint_acs }, + { PCI_VENDOR_ID_BROADCOM, 0xD714, pci_quirk_brcm_acs }, + /* Amazon Annapurna Labs */ + { PCI_VENDOR_ID_AMAZON_ANNAPURNA_LABS, 0x0031, pci_quirk_al_acs }, +-- +2.35.1 + diff --git a/queue-5.10/pinctrl-intel-check-against-matching-data-instead-of.patch b/queue-5.10/pinctrl-intel-check-against-matching-data-instead-of.patch new file mode 100644 index 00000000000..833749ef727 --- /dev/null +++ b/queue-5.10/pinctrl-intel-check-against-matching-data-instead-of.patch @@ -0,0 +1,67 @@ +From ab98a65db01361e1b1a93e8686dea360689f7f19 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Jun 2022 19:41:28 +0300 +Subject: pinctrl: intel: Check against matching data instead of ACPI companion + +From: Andy Shevchenko + +[ Upstream commit c551bd81d198bf1dcd4398d5454acdc0309dbe77 ] + +In some cases we may get a platform device that has ACPI companion +which is different to the pin control described in the ACPI tables. +This is primarily happens when device is instantiated by board file. + +In order to allow this device being enumerated, refactor +intel_pinctrl_get_soc_data() to check the matching data instead of +ACPI companion. + +Reported-by: Henning Schild +Signed-off-by: Andy Shevchenko +Tested-by: Henning Schild +Acked-by: Hans de Goede +Acked-by: Mika Westerberg +Acked-by: Linus Walleij +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/intel/pinctrl-intel.c | 14 ++++++-------- + 1 file changed, 6 insertions(+), 8 deletions(-) + +diff --git a/drivers/pinctrl/intel/pinctrl-intel.c b/drivers/pinctrl/intel/pinctrl-intel.c +index 348c670a7b07..4de832ac47d3 100644 +--- a/drivers/pinctrl/intel/pinctrl-intel.c ++++ b/drivers/pinctrl/intel/pinctrl-intel.c +@@ -1571,16 +1571,14 @@ EXPORT_SYMBOL_GPL(intel_pinctrl_probe_by_uid); + + const struct intel_pinctrl_soc_data *intel_pinctrl_get_soc_data(struct platform_device *pdev) + { ++ const struct intel_pinctrl_soc_data * const *table; + const struct intel_pinctrl_soc_data *data = NULL; +- const struct intel_pinctrl_soc_data **table; +- struct acpi_device *adev; +- unsigned int i; + +- adev = ACPI_COMPANION(&pdev->dev); +- if (adev) { +- const void *match = device_get_match_data(&pdev->dev); ++ table = device_get_match_data(&pdev->dev); ++ if (table) { ++ struct acpi_device *adev = ACPI_COMPANION(&pdev->dev); ++ unsigned int i; + +- table = (const struct intel_pinctrl_soc_data **)match; + for (i = 0; table[i]; i++) { + if (!strcmp(adev->pnp.unique_id, table[i]->uid)) { + data = table[i]; +@@ -1594,7 +1592,7 @@ const struct intel_pinctrl_soc_data *intel_pinctrl_get_soc_data(struct platform_ + if (!id) + return ERR_PTR(-ENODEV); + +- table = (const struct intel_pinctrl_soc_data **)id->driver_data; ++ table = (const struct intel_pinctrl_soc_data * const *)id->driver_data; + data = table[pdev->id]; + } + +-- +2.35.1 + diff --git a/queue-5.10/platform-chrome-cros_ec_proto-don-t-show-mkbp-versio.patch b/queue-5.10/platform-chrome-cros_ec_proto-don-t-show-mkbp-versio.patch new file mode 100644 index 00000000000..0e39bee5e23 --- /dev/null +++ b/queue-5.10/platform-chrome-cros_ec_proto-don-t-show-mkbp-versio.patch @@ -0,0 +1,48 @@ +From 3afb6e831f261c74641a0b0156f7d7292fb93932 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Jun 2022 08:49:49 +0000 +Subject: platform/chrome: cros_ec_proto: don't show MKBP version if + unsupported + +From: Tzung-Bi Shih + +[ Upstream commit b36f0643ff14a2fb281b105418e4e73c9d7c11d0 ] + +It wrongly showed the following message when it doesn't support MKBP: +"MKBP support version 4294967295". + +Fix it. + +Reviewed-by: Guenter Roeck +Signed-off-by: Tzung-Bi Shih +Link: https://lore.kernel.org/r/20220609084957.3684698-14-tzungbi@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/platform/chrome/cros_ec_proto.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/platform/chrome/cros_ec_proto.c b/drivers/platform/chrome/cros_ec_proto.c +index e1fadf059e05..3a2a78ff3330 100644 +--- a/drivers/platform/chrome/cros_ec_proto.c ++++ b/drivers/platform/chrome/cros_ec_proto.c +@@ -507,13 +507,13 @@ int cros_ec_query_all(struct cros_ec_device *ec_dev) + ret = cros_ec_get_host_command_version_mask(ec_dev, + EC_CMD_GET_NEXT_EVENT, + &ver_mask); +- if (ret < 0 || ver_mask == 0) ++ if (ret < 0 || ver_mask == 0) { + ec_dev->mkbp_event_supported = 0; +- else ++ } else { + ec_dev->mkbp_event_supported = fls(ver_mask); + +- dev_dbg(ec_dev->dev, "MKBP support version %u\n", +- ec_dev->mkbp_event_supported - 1); ++ dev_dbg(ec_dev->dev, "MKBP support version %u\n", ec_dev->mkbp_event_supported - 1); ++ } + + /* Probe if host sleep v1 is supported for S0ix failure detection. */ + ret = cros_ec_get_host_command_version_mask(ec_dev, +-- +2.35.1 + diff --git a/queue-5.10/powerpc-32-don-t-always-pass-mcpu-powerpc-to-the-com.patch b/queue-5.10/powerpc-32-don-t-always-pass-mcpu-powerpc-to-the-com.patch new file mode 100644 index 00000000000..5a57c6322c9 --- /dev/null +++ b/queue-5.10/powerpc-32-don-t-always-pass-mcpu-powerpc-to-the-com.patch @@ -0,0 +1,151 @@ +From 74ee6d33c5195dfeaea198a237a65f5942037a42 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Jul 2022 16:19:30 +0200 +Subject: powerpc/32: Don't always pass -mcpu=powerpc to the compiler +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Christophe Leroy + +[ Upstream commit 446cda1b21d9a6b3697fe399c6a3a00ff4a285f5 ] + +Since commit 4bf4f42a2feb ("powerpc/kbuild: Set default generic +machine type for 32-bit compile"), when building a 32 bits kernel +with a bi-arch version of GCC, or when building a book3s/32 kernel, +the option -mcpu=powerpc is passed to GCC at all time, relying on it +being eventually overriden by a subsequent -mcpu=xxxx. + +But when building the same kernel with a 32 bits only version of GCC, +that is not done, relying on gcc being built with the expected default +CPU. + +This logic has two problems. First, it is a bit fragile to rely on +whether the GCC version is bi-arch or not, because today we can have +bi-arch versions of GCC configured with a 32 bits default. Second, +there are some versions of GCC which don't support -mcpu=powerpc, +for instance for e500 SPE-only versions. + +So, stop relying on this approximative logic and allow the user to +decide whether he/she wants to use the toolchain's default CPU or if +he/she wants to set one, and allow only possible CPUs based on the +selected target. + +Reported-by: Pali Rohár +Signed-off-by: Christophe Leroy +Tested-by: Pali Rohár +Reviewed-by: Arnd Bergmann +Reviewed-by: Segher Boessenkool +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/d4df724691351531bf46d685d654689e5dfa0d74.1657549153.git.christophe.leroy@csgroup.eu +Signed-off-by: Sasha Levin +--- + arch/powerpc/Makefile | 26 +------------------------- + arch/powerpc/platforms/Kconfig.cputype | 21 ++++++++++++++++++--- + 2 files changed, 19 insertions(+), 28 deletions(-) + +diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile +index 7a96cdefbd4e..59175651f0b9 100644 +--- a/arch/powerpc/Makefile ++++ b/arch/powerpc/Makefile +@@ -17,23 +17,6 @@ HAS_BIARCH := $(call cc-option-yn, -m32) + # Set default 32 bits cross compilers for vdso and boot wrapper + CROSS32_COMPILE ?= + +-ifeq ($(HAS_BIARCH),y) +-ifeq ($(CROSS32_COMPILE),) +-ifdef CONFIG_PPC32 +-# These options will be overridden by any -mcpu option that the CPU +-# or platform code sets later on the command line, but they are needed +-# to set a sane 32-bit cpu target for the 64-bit cross compiler which +-# may default to the wrong ISA. +-KBUILD_CFLAGS += -mcpu=powerpc +-KBUILD_AFLAGS += -mcpu=powerpc +-endif +-endif +-endif +- +-ifdef CONFIG_PPC_BOOK3S_32 +-KBUILD_CFLAGS += -mcpu=powerpc +-endif +- + # If we're on a ppc/ppc64/ppc64le machine use that defconfig, otherwise just use + # ppc64_defconfig because we have nothing better to go on. + uname := $(shell uname -m) +@@ -190,6 +173,7 @@ endif + endif + + CFLAGS-$(CONFIG_TARGET_CPU_BOOL) += $(call cc-option,-mcpu=$(CONFIG_TARGET_CPU)) ++AFLAGS-$(CONFIG_TARGET_CPU_BOOL) += $(call cc-option,-mcpu=$(CONFIG_TARGET_CPU)) + + # Altivec option not allowed with e500mc64 in GCC. + ifdef CONFIG_ALTIVEC +@@ -200,14 +184,6 @@ endif + CFLAGS-$(CONFIG_E5500_CPU) += $(E5500_CPU) + CFLAGS-$(CONFIG_E6500_CPU) += $(call cc-option,-mcpu=e6500,$(E5500_CPU)) + +-ifdef CONFIG_PPC32 +-ifdef CONFIG_PPC_E500MC +-CFLAGS-y += $(call cc-option,-mcpu=e500mc,-mcpu=powerpc) +-else +-CFLAGS-$(CONFIG_E500) += $(call cc-option,-mcpu=8540 -msoft-float,-mcpu=powerpc) +-endif +-endif +- + asinstr := $(call as-instr,lis 9$(comma)foo@high,-DHAVE_AS_ATHIGH=1) + + KBUILD_CPPFLAGS += -I $(srctree)/arch/$(ARCH) $(asinstr) +diff --git a/arch/powerpc/platforms/Kconfig.cputype b/arch/powerpc/platforms/Kconfig.cputype +index 75ebfbff4deb..84f9dd476bbb 100644 +--- a/arch/powerpc/platforms/Kconfig.cputype ++++ b/arch/powerpc/platforms/Kconfig.cputype +@@ -119,9 +119,9 @@ config GENERIC_CPU + depends on PPC64 && CPU_LITTLE_ENDIAN + select ARCH_HAS_FAST_MULTIPLIER + +-config GENERIC_CPU ++config POWERPC_CPU + bool "Generic 32 bits powerpc" +- depends on PPC32 && !PPC_8xx ++ depends on PPC32 && !PPC_8xx && !PPC_85xx + + config CELL_CPU + bool "Cell Broadband Engine" +@@ -175,11 +175,23 @@ config G4_CPU + depends on PPC_BOOK3S_32 + select ALTIVEC + ++config E500_CPU ++ bool "e500 (8540)" ++ depends on PPC_85xx && !PPC_E500MC ++ ++config E500MC_CPU ++ bool "e500mc" ++ depends on PPC_85xx && PPC_E500MC ++ ++config TOOLCHAIN_DEFAULT_CPU ++ bool "Rely on the toolchain's implicit default CPU" ++ depends on PPC32 ++ + endchoice + + config TARGET_CPU_BOOL + bool +- default !GENERIC_CPU ++ default !GENERIC_CPU && !TOOLCHAIN_DEFAULT_CPU + + config TARGET_CPU + string +@@ -194,6 +206,9 @@ config TARGET_CPU + default "e300c2" if E300C2_CPU + default "e300c3" if E300C3_CPU + default "G4" if G4_CPU ++ default "8540" if E500_CPU ++ default "e500mc" if E500MC_CPU ++ default "powerpc" if POWERPC_CPU + + config PPC_BOOK3S + def_bool y +-- +2.35.1 + diff --git a/queue-5.10/powerpc-64-init-jump-labels-before-parse_early_param.patch b/queue-5.10/powerpc-64-init-jump-labels-before-parse_early_param.patch new file mode 100644 index 00000000000..c1a6e901ef2 --- /dev/null +++ b/queue-5.10/powerpc-64-init-jump-labels-before-parse_early_param.patch @@ -0,0 +1,65 @@ +From 17f026212d00ba4476f37031d44f24d880019685 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Jul 2022 09:57:47 +0800 +Subject: powerpc/64: Init jump labels before parse_early_param() + +From: Zhouyi Zhou + +[ Upstream commit ca829e05d3d4f728810cc5e4b468d9ebc7745eb3 ] + +On 64-bit, calling jump_label_init() in setup_feature_keys() is too +late because static keys may be used in subroutines of +parse_early_param() which is again subroutine of early_init_devtree(). + +For example booting with "threadirqs": + + static_key_enable_cpuslocked(): static key '0xc000000002953260' used before call to jump_label_init() + WARNING: CPU: 0 PID: 0 at kernel/jump_label.c:166 static_key_enable_cpuslocked+0xfc/0x120 + ... + NIP static_key_enable_cpuslocked+0xfc/0x120 + LR static_key_enable_cpuslocked+0xf8/0x120 + Call Trace: + static_key_enable_cpuslocked+0xf8/0x120 (unreliable) + static_key_enable+0x30/0x50 + setup_forced_irqthreads+0x28/0x40 + do_early_param+0xa0/0x108 + parse_args+0x290/0x4e0 + parse_early_options+0x48/0x5c + parse_early_param+0x58/0x84 + early_init_devtree+0xd4/0x518 + early_setup+0xb4/0x214 + +So call jump_label_init() just before parse_early_param() in +early_init_devtree(). + +Suggested-by: Michael Ellerman +Signed-off-by: Zhouyi Zhou +[mpe: Add call trace to change log and minor wording edits.] +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20220726015747.11754-1-zhouzhouyi@gmail.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/prom.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/arch/powerpc/kernel/prom.c b/arch/powerpc/kernel/prom.c +index 7a14a094be8a..1dfb4c213fea 100644 +--- a/arch/powerpc/kernel/prom.c ++++ b/arch/powerpc/kernel/prom.c +@@ -750,6 +750,13 @@ void __init early_init_devtree(void *params) + of_scan_flat_dt(early_init_dt_scan_root, NULL); + of_scan_flat_dt(early_init_dt_scan_memory_ppc, NULL); + ++ /* ++ * As generic code authors expect to be able to use static keys ++ * in early_param() handlers, we initialize the static keys just ++ * before parsing early params (it's fine to call jump_label_init() ++ * more than once). ++ */ ++ jump_label_init(); + parse_early_param(); + + /* make sure we've parsed cmdline for mem= before this */ +-- +2.35.1 + diff --git a/queue-5.10/rdma-rxe-limit-the-number-of-calls-to-each-tasklet.patch b/queue-5.10/rdma-rxe-limit-the-number-of-calls-to-each-tasklet.patch new file mode 100644 index 00000000000..0784213ddbe --- /dev/null +++ b/queue-5.10/rdma-rxe-limit-the-number-of-calls-to-each-tasklet.patch @@ -0,0 +1,88 @@ +From 6dc462c82f82d33dd88b717e505763529fb1ac97 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Jun 2022 14:04:25 -0500 +Subject: RDMA/rxe: Limit the number of calls to each tasklet + +From: Bob Pearson + +[ Upstream commit eff6d998ca297cb0b2e53b032a56cf8e04dd8b17 ] + +Limit the maximum number of calls to each tasklet from rxe_do_task() +before yielding the cpu. When the limit is reached reschedule the tasklet +and exit the calling loop. This patch prevents one tasklet from consuming +100% of a cpu core and causing a deadlock or soft lockup. + +Link: https://lore.kernel.org/r/20220630190425.2251-9-rpearsonhpe@gmail.com +Signed-off-by: Bob Pearson +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/rxe/rxe_param.h | 6 ++++++ + drivers/infiniband/sw/rxe/rxe_task.c | 16 ++++++++++++---- + 2 files changed, 18 insertions(+), 4 deletions(-) + +diff --git a/drivers/infiniband/sw/rxe/rxe_param.h b/drivers/infiniband/sw/rxe/rxe_param.h +index f9fb56ec6dfd..dca86422b0a2 100644 +--- a/drivers/infiniband/sw/rxe/rxe_param.h ++++ b/drivers/infiniband/sw/rxe/rxe_param.h +@@ -98,6 +98,12 @@ enum rxe_device_param { + RXE_INFLIGHT_SKBS_PER_QP_HIGH = 64, + RXE_INFLIGHT_SKBS_PER_QP_LOW = 16, + ++ /* Max number of interations of each tasklet ++ * before yielding the cpu to let other ++ * work make progress ++ */ ++ RXE_MAX_ITERATIONS = 1024, ++ + /* Delay before calling arbiter timer */ + RXE_NSEC_ARB_TIMER_DELAY = 200, + +diff --git a/drivers/infiniband/sw/rxe/rxe_task.c b/drivers/infiniband/sw/rxe/rxe_task.c +index 6951fdcb31bf..568cf56c236b 100644 +--- a/drivers/infiniband/sw/rxe/rxe_task.c ++++ b/drivers/infiniband/sw/rxe/rxe_task.c +@@ -8,7 +8,7 @@ + #include + #include + +-#include "rxe_task.h" ++#include "rxe.h" + + int __rxe_do_task(struct rxe_task *task) + +@@ -34,6 +34,7 @@ void rxe_do_task(struct tasklet_struct *t) + int ret; + unsigned long flags; + struct rxe_task *task = from_tasklet(task, t, tasklet); ++ unsigned int iterations = RXE_MAX_ITERATIONS; + + spin_lock_irqsave(&task->state_lock, flags); + switch (task->state) { +@@ -62,13 +63,20 @@ void rxe_do_task(struct tasklet_struct *t) + spin_lock_irqsave(&task->state_lock, flags); + switch (task->state) { + case TASK_STATE_BUSY: +- if (ret) ++ if (ret) { + task->state = TASK_STATE_START; +- else ++ } else if (iterations--) { + cont = 1; ++ } else { ++ /* reschedule the tasklet and exit ++ * the loop to give up the cpu ++ */ ++ tasklet_schedule(&task->tasklet); ++ task->state = TASK_STATE_START; ++ } + break; + +- /* soneone tried to run the task since the last time we called ++ /* someone tried to run the task since the last time we called + * func, so we will call one more time regardless of the + * return value + */ +-- +2.35.1 + diff --git a/queue-5.10/risc-v-add-fast-call-path-of-crash_kexec.patch b/queue-5.10/risc-v-add-fast-call-path-of-crash_kexec.patch new file mode 100644 index 00000000000..c159ccdb247 --- /dev/null +++ b/queue-5.10/risc-v-add-fast-call-path-of-crash_kexec.patch @@ -0,0 +1,73 @@ +From bd9b1c0a1b150eb2d452fedd2b7240930d077913 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Jun 2022 16:23:08 +0800 +Subject: RISC-V: Add fast call path of crash_kexec() + +From: Xianting Tian + +[ Upstream commit 3f1901110a89b0e2e13adb2ac8d1a7102879ea98 ] + +Currently, almost all archs (x86, arm64, mips...) support fast call +of crash_kexec() when "regs && kexec_should_crash()" is true. But +RISC-V not, it can only enter crash system via panic(). However panic() +doesn't pass the regs of the real accident scene to crash_kexec(), +it caused we can't get accurate backtrace via gdb, + $ riscv64-linux-gnu-gdb vmlinux vmcore + Reading symbols from vmlinux... + [New LWP 95] + #0 console_unlock () at kernel/printk/printk.c:2557 + 2557 if (do_cond_resched) + (gdb) bt + #0 console_unlock () at kernel/printk/printk.c:2557 + #1 0x0000000000000000 in ?? () + +With the patch we can get the accurate backtrace, + $ riscv64-linux-gnu-gdb vmlinux vmcore + Reading symbols from vmlinux... + [New LWP 95] + #0 0xffffffe00063a4e0 in test_thread (data=) at drivers/test_crash.c:81 + 81 *(int *)p = 0xdead; + (gdb) + (gdb) bt + #0 0xffffffe00064d5c0 in test_thread (data=) at drivers/test_crash.c:81 + #1 0x0000000000000000 in ?? () + +Test code to produce NULL address dereference in test_crash.c, + void *p = NULL; + *(int *)p = 0xdead; + +Reviewed-by: Guo Ren +Tested-by: Xianting Tian +Signed-off-by: Xianting Tian +Link: https://lore.kernel.org/r/20220606082308.2883458-1-xianting.tian@linux.alibaba.com +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + arch/riscv/kernel/traps.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/arch/riscv/kernel/traps.c b/arch/riscv/kernel/traps.c +index ad14f4466d92..c1a13011fb8e 100644 +--- a/arch/riscv/kernel/traps.c ++++ b/arch/riscv/kernel/traps.c +@@ -15,6 +15,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -43,6 +44,9 @@ void die(struct pt_regs *regs, const char *str) + + ret = notify_die(DIE_OOPS, str, regs, 0, regs->cause, SIGSEGV); + ++ if (regs && kexec_should_crash(current)) ++ crash_kexec(regs); ++ + bust_spinlocks(0); + add_taint(TAINT_DIE, LOCKDEP_NOW_UNRELIABLE); + spin_unlock_irq(&die_lock); +-- +2.35.1 + diff --git a/queue-5.10/riscv-dts-sifive-add-fu540-topology-information.patch b/queue-5.10/riscv-dts-sifive-add-fu540-topology-information.patch new file mode 100644 index 00000000000..8a33fa9150c --- /dev/null +++ b/queue-5.10/riscv-dts-sifive-add-fu540-topology-information.patch @@ -0,0 +1,60 @@ +From 1c3fb44f2d4f43151b1cfe543f57bc0e63b0d42d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Jul 2022 20:04:33 +0100 +Subject: riscv: dts: sifive: Add fu540 topology information + +From: Conor Dooley + +[ Upstream commit af8f260abc608c06e4466a282b53f1e2dc09f042 ] + +The fu540 has no cpu-map node, so tools like hwloc cannot correctly +parse the topology. Add the node using the existing node labels. + +Reported-by: Brice Goglin +Link: https://github.com/open-mpi/hwloc/issues/536 +Signed-off-by: Conor Dooley +Link: https://lore.kernel.org/r/20220705190435.1790466-3-mail@conchuod.ie +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + arch/riscv/boot/dts/sifive/fu540-c000.dtsi | 24 ++++++++++++++++++++++ + 1 file changed, 24 insertions(+) + +diff --git a/arch/riscv/boot/dts/sifive/fu540-c000.dtsi b/arch/riscv/boot/dts/sifive/fu540-c000.dtsi +index 64c06c9b41dc..87d6e5a4253f 100644 +--- a/arch/riscv/boot/dts/sifive/fu540-c000.dtsi ++++ b/arch/riscv/boot/dts/sifive/fu540-c000.dtsi +@@ -133,6 +133,30 @@ + interrupt-controller; + }; + }; ++ ++ cpu-map { ++ cluster0 { ++ core0 { ++ cpu = <&cpu0>; ++ }; ++ ++ core1 { ++ cpu = <&cpu1>; ++ }; ++ ++ core2 { ++ cpu = <&cpu2>; ++ }; ++ ++ core3 { ++ cpu = <&cpu3>; ++ }; ++ ++ core4 { ++ cpu = <&cpu4>; ++ }; ++ }; ++ }; + }; + soc { + #address-cells = <2>; +-- +2.35.1 + diff --git a/queue-5.10/riscv-mmap-with-prot_write-but-no-prot_read-is-inval.patch b/queue-5.10/riscv-mmap-with-prot_write-but-no-prot_read-is-inval.patch new file mode 100644 index 00000000000..d3f93f6836d --- /dev/null +++ b/queue-5.10/riscv-mmap-with-prot_write-but-no-prot_read-is-inval.patch @@ -0,0 +1,47 @@ +From 14db1099d443c7ab1e97584f7861895a6eea01b8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 May 2022 15:56:52 +0800 +Subject: riscv: mmap with PROT_WRITE but no PROT_READ is invalid + +From: Celeste Liu + +[ Upstream commit 2139619bcad7ac44cc8f6f749089120594056613 ] + +As mentioned in Table 4.5 in RISC-V spec Volume 2 Section 4.3, write +but not read is "Reserved for future use.". For now, they are not valid. +In the current code, -wx is marked as invalid, but -w- is not marked +as invalid. +This patch refines that judgment. + +Reported-by: xctan +Co-developed-by: dram +Signed-off-by: dram +Co-developed-by: Ruizhe Pan +Signed-off-by: Ruizhe Pan +Signed-off-by: Celeste Liu +Link: https://lore.kernel.org/r/PH7PR14MB559464DBDD310E755F5B21E8CEDC9@PH7PR14MB5594.namprd14.prod.outlook.com +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + arch/riscv/kernel/sys_riscv.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/arch/riscv/kernel/sys_riscv.c b/arch/riscv/kernel/sys_riscv.c +index 12f8a7fce78b..8a7880b9c433 100644 +--- a/arch/riscv/kernel/sys_riscv.c ++++ b/arch/riscv/kernel/sys_riscv.c +@@ -18,9 +18,8 @@ static long riscv_sys_mmap(unsigned long addr, unsigned long len, + if (unlikely(offset & (~PAGE_MASK >> page_shift_offset))) + return -EINVAL; + +- if ((prot & PROT_WRITE) && (prot & PROT_EXEC)) +- if (unlikely(!(prot & PROT_READ))) +- return -EINVAL; ++ if (unlikely((prot & PROT_WRITE) && !(prot & PROT_READ))) ++ return -EINVAL; + + return ksys_mmap_pgoff(addr, len, prot, flags, fd, + offset >> (PAGE_SHIFT - page_shift_offset)); +-- +2.35.1 + diff --git a/queue-5.10/scsi-lpfc-prevent-buffer-overflow-crashes-in-debugfs.patch b/queue-5.10/scsi-lpfc-prevent-buffer-overflow-crashes-in-debugfs.patch new file mode 100644 index 00000000000..2970b8bc295 --- /dev/null +++ b/queue-5.10/scsi-lpfc-prevent-buffer-overflow-crashes-in-debugfs.patch @@ -0,0 +1,86 @@ +From 9e952818fc49d55ee833c72361ea2025042180ed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Jul 2022 14:14:15 -0700 +Subject: scsi: lpfc: Prevent buffer overflow crashes in debugfs with malformed + user input + +From: James Smart + +[ Upstream commit f8191d40aa612981ce897e66cda6a88db8df17bb ] + +Malformed user input to debugfs results in buffer overflow crashes. Adapt +input string lengths to fit within internal buffers, leaving space for NULL +terminators. + +Link: https://lore.kernel.org/r/20220701211425.2708-3-jsmart2021@gmail.com +Co-developed-by: Justin Tee +Signed-off-by: Justin Tee +Signed-off-by: James Smart +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/lpfc/lpfc_debugfs.c | 20 ++++++++++---------- + 1 file changed, 10 insertions(+), 10 deletions(-) + +diff --git a/drivers/scsi/lpfc/lpfc_debugfs.c b/drivers/scsi/lpfc/lpfc_debugfs.c +index beaf3a8d206f..fbc76d69ea0b 100644 +--- a/drivers/scsi/lpfc/lpfc_debugfs.c ++++ b/drivers/scsi/lpfc/lpfc_debugfs.c +@@ -2609,8 +2609,8 @@ lpfc_debugfs_multixripools_write(struct file *file, const char __user *buf, + struct lpfc_sli4_hdw_queue *qp; + struct lpfc_multixri_pool *multixri_pool; + +- if (nbytes > 64) +- nbytes = 64; ++ if (nbytes > sizeof(mybuf) - 1) ++ nbytes = sizeof(mybuf) - 1; + + memset(mybuf, 0, sizeof(mybuf)); + +@@ -2690,8 +2690,8 @@ lpfc_debugfs_nvmestat_write(struct file *file, const char __user *buf, + if (!phba->targetport) + return -ENXIO; + +- if (nbytes > 64) +- nbytes = 64; ++ if (nbytes > sizeof(mybuf) - 1) ++ nbytes = sizeof(mybuf) - 1; + + memset(mybuf, 0, sizeof(mybuf)); + +@@ -2828,8 +2828,8 @@ lpfc_debugfs_ioktime_write(struct file *file, const char __user *buf, + char mybuf[64]; + char *pbuf; + +- if (nbytes > 64) +- nbytes = 64; ++ if (nbytes > sizeof(mybuf) - 1) ++ nbytes = sizeof(mybuf) - 1; + + memset(mybuf, 0, sizeof(mybuf)); + +@@ -2956,8 +2956,8 @@ lpfc_debugfs_nvmeio_trc_write(struct file *file, const char __user *buf, + char mybuf[64]; + char *pbuf; + +- if (nbytes > 63) +- nbytes = 63; ++ if (nbytes > sizeof(mybuf) - 1) ++ nbytes = sizeof(mybuf) - 1; + + memset(mybuf, 0, sizeof(mybuf)); + +@@ -3062,8 +3062,8 @@ lpfc_debugfs_hdwqstat_write(struct file *file, const char __user *buf, + char *pbuf; + int i; + +- if (nbytes > 64) +- nbytes = 64; ++ if (nbytes > sizeof(mybuf) - 1) ++ nbytes = sizeof(mybuf) - 1; + + memset(mybuf, 0, sizeof(mybuf)); + +-- +2.35.1 + diff --git a/queue-5.10/selftests-kprobe-do-not-test-for-grp-without-event-f.patch b/queue-5.10/selftests-kprobe-do-not-test-for-grp-without-event-f.patch new file mode 100644 index 00000000000..0d2c1dffafe --- /dev/null +++ b/queue-5.10/selftests-kprobe-do-not-test-for-grp-without-event-f.patch @@ -0,0 +1,50 @@ +From a61c405c946bca2edf094bacd9d47b558aea799e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Jul 2022 16:17:07 -0400 +Subject: selftests/kprobe: Do not test for GRP/ without event failures + +From: Steven Rostedt (Google) + +[ Upstream commit f5eab65ff2b76449286d18efc7fee3e0b72f7d9b ] + +A new feature is added where kprobes (and other probes) do not need to +explicitly state the event name when creating a probe. The event name will +come from what is being attached. + +That is: + + # echo 'p:foo/ vfs_read' > kprobe_events + +Will no longer error, but instead create an event: + + # cat kprobe_events + p:foo/p_vfs_read_0 vfs_read + +This should not be tested as an error case anymore. Remove it from the +selftest as now this feature "breaks" the selftest as it no longer fails +as expected. + +Link: https://lore.kernel.org/all/1656296348-16111-1-git-send-email-quic_linyyuan@quicinc.com/ +Link: https://lkml.kernel.org/r/20220712161707.6dc08a14@gandalf.local.home + +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +--- + .../selftests/ftrace/test.d/kprobe/kprobe_syntax_errors.tc | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_syntax_errors.tc b/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_syntax_errors.tc +index fa928b431555..7c02509c71d0 100644 +--- a/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_syntax_errors.tc ++++ b/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_syntax_errors.tc +@@ -21,7 +21,6 @@ check_error 'p:^/bar vfs_read' # NO_GROUP_NAME + check_error 'p:^12345678901234567890123456789012345678901234567890123456789012345/bar vfs_read' # GROUP_TOO_LONG + + check_error 'p:^foo.1/bar vfs_read' # BAD_GROUP_NAME +-check_error 'p:foo/^ vfs_read' # NO_EVENT_NAME + check_error 'p:foo/^12345678901234567890123456789012345678901234567890123456789012345 vfs_read' # EVENT_TOO_LONG + check_error 'p:foo/^bar.1 vfs_read' # BAD_EVENT_NAME + +-- +2.35.1 + diff --git a/queue-5.10/series b/queue-5.10/series index df79c2608f8..3c168664263 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -92,3 +92,58 @@ stmmac-intel-add-a-missing-clk_disable_unprepare-call-in-intel_eth_pci_remove.pa igb-add-lock-to-avoid-data-race.patch kbuild-fix-the-modules-order-between-drivers-and-libs.patch gcc-plugins-undefine-latent_entropy_plugin-when-plugin-disabled-for-a-file.patch +asoc-sof-intel-move-sof_intel_dsp_desc-forward.patch +drm-meson-fix-refcount-bugs-in-meson_vpu_has_availab.patch +audit-log-nftables-configuration-change-events-once-.patch +netfilter-nftables-add-helper-function-to-set-the-ba.patch +netfilter-add-helper-function-to-set-up-the-nfnetlin.patch +drm-sun4i-dsi-prevent-underflow-when-computing-packe.patch +pci-add-acs-quirk-for-broadcom-bcm5750x-nics.patch +platform-chrome-cros_ec_proto-don-t-show-mkbp-versio.patch +usb-cdns3-fix-use-after-free-at-workaround-2.patch +usb-gadget-uvc-call-uvc-uvcg_warn-on-completed-statu.patch +irqchip-tegra-fix-overflow-implicit-truncation-warni.patch +drm-meson-fix-overflow-implicit-truncation-warnings.patch +clk-ti-stop-using-legacy-clkctrl-names-for-omap4-and.patch +usb-host-ohci-ppc-of-fix-refcount-leak-bug.patch +usb-renesas-fix-refcount-leak-bug.patch +usb-dwc2-gadget-remove-d-pull-up-while-no-vbus-with-.patch +vboxguest-do-not-use-devm-for-irq.patch +clk-qcom-ipq8074-dont-disable-gcc_sleep_clk_src.patch +uacce-handle-parent-device-removal-or-parent-driver-.patch +zram-do-not-lookup-algorithm-in-backends-table.patch +clk-qcom-clk-alpha-pll-fix-clk_trion_pll_configure-d.patch +scsi-lpfc-prevent-buffer-overflow-crashes-in-debugfs.patch +gadgetfs-ep_io-wait-until-irq-finishes.patch +pinctrl-intel-check-against-matching-data-instead-of.patch +cxl-fix-a-memory-leak-in-an-error-handling-path.patch +pci-acpi-guard-arm64-specific-mcfg_quirks.patch +um-add-noreboot-command-line-option-for-panic_timeou.patch +rdma-rxe-limit-the-number-of-calls-to-each-tasklet.patch +csky-kprobe-reclaim-insn_slot-on-kprobe-unregistrati.patch +selftests-kprobe-do-not-test-for-grp-without-event-f.patch +dmaengine-sprd-cleanup-in-.remove-after-pm_runtime_g.patch +md-notify-sysfs-sync_completed-in-md_reap_sync_threa.patch +nvmet-tcp-fix-lockdep-complaint-on-nvmet_tcp_wq-flus.patch +drivers-md-fix-a-potential-use-after-free-bug.patch +ext4-avoid-remove-directory-when-directory-is-corrup.patch +ext4-avoid-resizing-to-a-partial-cluster-size.patch +lib-list_debug.c-detect-uninitialized-lists.patch +tty-serial-fix-refcount-leak-bug-in-ucc_uart.c.patch +vfio-clear-the-caps-buf-to-null-after-free.patch +mips-cavium-octeon-fix-missing-of_node_put-in-octeon.patch +modules-ensure-natural-alignment-for-.altinstruction.patch +riscv-dts-sifive-add-fu540-topology-information.patch +riscv-mmap-with-prot_write-but-no-prot_read-is-inval.patch +risc-v-add-fast-call-path-of-crash_kexec.patch +watchdog-export-lockup_detector_reconfigure.patch +powerpc-32-don-t-always-pass-mcpu-powerpc-to-the-com.patch +alsa-core-add-async-signal-helpers.patch +alsa-timer-use-deferred-fasync-helper.patch +alsa-control-use-deferred-fasync-helper.patch +f2fs-fix-to-avoid-use-f2fs_bug_on-in-f2fs_new_node_p.patch +f2fs-fix-to-do-sanity-check-on-segment-type-in-build.patch +smb3-check-xattr-value-length-earlier.patch +powerpc-64-init-jump-labels-before-parse_early_param.patch +video-fbdev-i740fb-check-the-argument-of-i740_calc_v.patch +mips-tlbex-explicitly-compare-_page_no_exec-against-.patch diff --git a/queue-5.10/smb3-check-xattr-value-length-earlier.patch b/queue-5.10/smb3-check-xattr-value-length-earlier.patch new file mode 100644 index 00000000000..68f5ead192c --- /dev/null +++ b/queue-5.10/smb3-check-xattr-value-length-earlier.patch @@ -0,0 +1,51 @@ +From c07519a7aa243a6495e1c72cd4053dc26c13e954 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Jul 2022 11:43:44 -0500 +Subject: smb3: check xattr value length earlier + +From: Steve French + +[ Upstream commit 5fa2cffba0b82336a2244d941322eb1627ff787b ] + +Coverity complains about assigning a pointer based on +value length before checking that value length goes +beyond the end of the SMB. Although this is even more +unlikely as value length is a single byte, and the +pointer is not dereferenced until laterm, it is clearer +to check the lengths first. + +Addresses-Coverity: 1467704 ("Speculative execution data leak") +Reviewed-by: Ronnie Sahlberg +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/cifs/smb2ops.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c +index b855abfaaf87..b6d72e3c5eba 100644 +--- a/fs/cifs/smb2ops.c ++++ b/fs/cifs/smb2ops.c +@@ -1000,9 +1000,7 @@ move_smb2_ea_to_cifs(char *dst, size_t dst_size, + size_t name_len, value_len, user_name_len; + + while (src_size > 0) { +- name = &src->ea_data[0]; + name_len = (size_t)src->ea_name_length; +- value = &src->ea_data[src->ea_name_length + 1]; + value_len = (size_t)le16_to_cpu(src->ea_value_length); + + if (name_len == 0) +@@ -1014,6 +1012,9 @@ move_smb2_ea_to_cifs(char *dst, size_t dst_size, + goto out; + } + ++ name = &src->ea_data[0]; ++ value = &src->ea_data[src->ea_name_length + 1]; ++ + if (ea_name) { + if (ea_name_len == name_len && + memcmp(ea_name, name, name_len) == 0) { +-- +2.35.1 + diff --git a/queue-5.10/tty-serial-fix-refcount-leak-bug-in-ucc_uart.c.patch b/queue-5.10/tty-serial-fix-refcount-leak-bug-in-ucc_uart.c.patch new file mode 100644 index 00000000000..14ed56aab1d --- /dev/null +++ b/queue-5.10/tty-serial-fix-refcount-leak-bug-in-ucc_uart.c.patch @@ -0,0 +1,38 @@ +From bc2ecd5bfc28d702e06b7a78ce399581228e2bca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 18 Jun 2022 14:08:50 +0800 +Subject: tty: serial: Fix refcount leak bug in ucc_uart.c + +From: Liang He + +[ Upstream commit d24d7bb2cd947676f9b71fb944d045e09b8b282f ] + +In soc_info(), of_find_node_by_type() will return a node pointer +with refcount incremented. We should use of_node_put() when it is +not used anymore. + +Acked-by: Timur Tabi +Signed-off-by: Liang He +Link: https://lore.kernel.org/r/20220618060850.4058525-1-windhl@126.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/ucc_uart.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/tty/serial/ucc_uart.c b/drivers/tty/serial/ucc_uart.c +index d6a8604157ab..d1fecc88330e 100644 +--- a/drivers/tty/serial/ucc_uart.c ++++ b/drivers/tty/serial/ucc_uart.c +@@ -1137,6 +1137,8 @@ static unsigned int soc_info(unsigned int *rev_h, unsigned int *rev_l) + /* No compatible property, so try the name. */ + soc_string = np->name; + ++ of_node_put(np); ++ + /* Extract the SOC number from the "PowerPC," string */ + if ((sscanf(soc_string, "PowerPC,%u", &soc) != 1) || !soc) + return 0; +-- +2.35.1 + diff --git a/queue-5.10/uacce-handle-parent-device-removal-or-parent-driver-.patch b/queue-5.10/uacce-handle-parent-device-removal-or-parent-driver-.patch new file mode 100644 index 00000000000..39d0ac85aa4 --- /dev/null +++ b/queue-5.10/uacce-handle-parent-device-removal-or-parent-driver-.patch @@ -0,0 +1,351 @@ +From 5c50e1742a26e703f99b95ff559a97756949bccd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Jul 2022 11:48:43 +0800 +Subject: uacce: Handle parent device removal or parent driver module rmmod + +From: Jean-Philippe Brucker + +[ Upstream commit 80fc671bcc0173836e9032b0c698ea74c13b9d7c ] + +The uacce driver must deal with a possible removal of the parent device +or parent driver module rmmod at any time. + +Although uacce_remove(), called on device removal and on driver unbind, +prevents future use of the uacce fops by removing the cdev, fops that +were called before that point may still be running. + +Serialize uacce_fops_open() and uacce_remove() with uacce->mutex. +Serialize other fops against uacce_remove() with q->mutex. +Since we need to protect uacce_fops_poll() which gets called on the fast +path, replace uacce->queues_lock with q->mutex to improve scalability. +The other fops are only used during setup. + +uacce_queue_is_valid(), checked under q->mutex or uacce->mutex, denotes +whether uacce_remove() has disabled all queues. If that is the case, +don't go any further since the parent device is being removed and +uacce->ops should not be called anymore. + +Reported-by: Yang Shen +Signed-off-by: Zhangfei Gao +Signed-off-by: Jean-Philippe Brucker +Link: https://lore.kernel.org/r/20220701034843.7502-1-zhangfei.gao@linaro.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/misc/uacce/uacce.c | 133 ++++++++++++++++++++++++------------- + include/linux/uacce.h | 6 +- + 2 files changed, 91 insertions(+), 48 deletions(-) + +diff --git a/drivers/misc/uacce/uacce.c b/drivers/misc/uacce/uacce.c +index 56dd98ab5a81..95e56eb2cdd0 100644 +--- a/drivers/misc/uacce/uacce.c ++++ b/drivers/misc/uacce/uacce.c +@@ -9,43 +9,38 @@ + + static struct class *uacce_class; + static dev_t uacce_devt; +-static DEFINE_MUTEX(uacce_mutex); + static DEFINE_XARRAY_ALLOC(uacce_xa); + +-static int uacce_start_queue(struct uacce_queue *q) ++/* ++ * If the parent driver or the device disappears, the queue state is invalid and ++ * ops are not usable anymore. ++ */ ++static bool uacce_queue_is_valid(struct uacce_queue *q) + { +- int ret = 0; ++ return q->state == UACCE_Q_INIT || q->state == UACCE_Q_STARTED; ++} + +- mutex_lock(&uacce_mutex); ++static int uacce_start_queue(struct uacce_queue *q) ++{ ++ int ret; + +- if (q->state != UACCE_Q_INIT) { +- ret = -EINVAL; +- goto out_with_lock; +- } ++ if (q->state != UACCE_Q_INIT) ++ return -EINVAL; + + if (q->uacce->ops->start_queue) { + ret = q->uacce->ops->start_queue(q); + if (ret < 0) +- goto out_with_lock; ++ return ret; + } + + q->state = UACCE_Q_STARTED; +- +-out_with_lock: +- mutex_unlock(&uacce_mutex); +- +- return ret; ++ return 0; + } + + static int uacce_put_queue(struct uacce_queue *q) + { + struct uacce_device *uacce = q->uacce; + +- mutex_lock(&uacce_mutex); +- +- if (q->state == UACCE_Q_ZOMBIE) +- goto out; +- + if ((q->state == UACCE_Q_STARTED) && uacce->ops->stop_queue) + uacce->ops->stop_queue(q); + +@@ -54,8 +49,6 @@ static int uacce_put_queue(struct uacce_queue *q) + uacce->ops->put_queue(q); + + q->state = UACCE_Q_ZOMBIE; +-out: +- mutex_unlock(&uacce_mutex); + + return 0; + } +@@ -65,20 +58,36 @@ static long uacce_fops_unl_ioctl(struct file *filep, + { + struct uacce_queue *q = filep->private_data; + struct uacce_device *uacce = q->uacce; ++ long ret = -ENXIO; ++ ++ /* ++ * uacce->ops->ioctl() may take the mmap_lock when copying arg to/from ++ * user. Avoid a circular lock dependency with uacce_fops_mmap(), which ++ * gets called with mmap_lock held, by taking uacce->mutex instead of ++ * q->mutex. Doing this in uacce_fops_mmap() is not possible because ++ * uacce_fops_open() calls iommu_sva_bind_device(), which takes ++ * mmap_lock, while holding uacce->mutex. ++ */ ++ mutex_lock(&uacce->mutex); ++ if (!uacce_queue_is_valid(q)) ++ goto out_unlock; + + switch (cmd) { + case UACCE_CMD_START_Q: +- return uacce_start_queue(q); +- ++ ret = uacce_start_queue(q); ++ break; + case UACCE_CMD_PUT_Q: +- return uacce_put_queue(q); +- ++ ret = uacce_put_queue(q); ++ break; + default: +- if (!uacce->ops->ioctl) +- return -EINVAL; +- +- return uacce->ops->ioctl(q, cmd, arg); ++ if (uacce->ops->ioctl) ++ ret = uacce->ops->ioctl(q, cmd, arg); ++ else ++ ret = -EINVAL; + } ++out_unlock: ++ mutex_unlock(&uacce->mutex); ++ return ret; + } + + #ifdef CONFIG_COMPAT +@@ -136,6 +145,13 @@ static int uacce_fops_open(struct inode *inode, struct file *filep) + if (!q) + return -ENOMEM; + ++ mutex_lock(&uacce->mutex); ++ ++ if (!uacce->parent) { ++ ret = -EINVAL; ++ goto out_with_mem; ++ } ++ + ret = uacce_bind_queue(uacce, q); + if (ret) + goto out_with_mem; +@@ -152,10 +168,9 @@ static int uacce_fops_open(struct inode *inode, struct file *filep) + filep->private_data = q; + uacce->inode = inode; + q->state = UACCE_Q_INIT; +- +- mutex_lock(&uacce->queues_lock); ++ mutex_init(&q->mutex); + list_add(&q->list, &uacce->queues); +- mutex_unlock(&uacce->queues_lock); ++ mutex_unlock(&uacce->mutex); + + return 0; + +@@ -163,18 +178,20 @@ static int uacce_fops_open(struct inode *inode, struct file *filep) + uacce_unbind_queue(q); + out_with_mem: + kfree(q); ++ mutex_unlock(&uacce->mutex); + return ret; + } + + static int uacce_fops_release(struct inode *inode, struct file *filep) + { + struct uacce_queue *q = filep->private_data; ++ struct uacce_device *uacce = q->uacce; + +- mutex_lock(&q->uacce->queues_lock); +- list_del(&q->list); +- mutex_unlock(&q->uacce->queues_lock); ++ mutex_lock(&uacce->mutex); + uacce_put_queue(q); + uacce_unbind_queue(q); ++ list_del(&q->list); ++ mutex_unlock(&uacce->mutex); + kfree(q); + + return 0; +@@ -217,10 +234,9 @@ static int uacce_fops_mmap(struct file *filep, struct vm_area_struct *vma) + vma->vm_private_data = q; + qfr->type = type; + +- mutex_lock(&uacce_mutex); +- +- if (q->state != UACCE_Q_INIT && q->state != UACCE_Q_STARTED) { +- ret = -EINVAL; ++ mutex_lock(&q->mutex); ++ if (!uacce_queue_is_valid(q)) { ++ ret = -ENXIO; + goto out_with_lock; + } + +@@ -259,12 +275,12 @@ static int uacce_fops_mmap(struct file *filep, struct vm_area_struct *vma) + } + + q->qfrs[type] = qfr; +- mutex_unlock(&uacce_mutex); ++ mutex_unlock(&q->mutex); + + return ret; + + out_with_lock: +- mutex_unlock(&uacce_mutex); ++ mutex_unlock(&q->mutex); + kfree(qfr); + return ret; + } +@@ -273,12 +289,20 @@ static __poll_t uacce_fops_poll(struct file *file, poll_table *wait) + { + struct uacce_queue *q = file->private_data; + struct uacce_device *uacce = q->uacce; ++ __poll_t ret = 0; ++ ++ mutex_lock(&q->mutex); ++ if (!uacce_queue_is_valid(q)) ++ goto out_unlock; + + poll_wait(file, &q->wait, wait); ++ + if (uacce->ops->is_q_updated && uacce->ops->is_q_updated(q)) +- return EPOLLIN | EPOLLRDNORM; ++ ret = EPOLLIN | EPOLLRDNORM; + +- return 0; ++out_unlock: ++ mutex_unlock(&q->mutex); ++ return ret; + } + + static const struct file_operations uacce_fops = { +@@ -431,7 +455,7 @@ struct uacce_device *uacce_alloc(struct device *parent, + goto err_with_uacce; + + INIT_LIST_HEAD(&uacce->queues); +- mutex_init(&uacce->queues_lock); ++ mutex_init(&uacce->mutex); + device_initialize(&uacce->dev); + uacce->dev.devt = MKDEV(MAJOR(uacce_devt), uacce->dev_id); + uacce->dev.class = uacce_class; +@@ -489,13 +513,23 @@ void uacce_remove(struct uacce_device *uacce) + if (uacce->inode) + unmap_mapping_range(uacce->inode->i_mapping, 0, 0, 1); + ++ /* ++ * uacce_fops_open() may be running concurrently, even after we remove ++ * the cdev. Holding uacce->mutex ensures that open() does not obtain a ++ * removed uacce device. ++ */ ++ mutex_lock(&uacce->mutex); + /* ensure no open queue remains */ +- mutex_lock(&uacce->queues_lock); + list_for_each_entry_safe(q, next_q, &uacce->queues, list) { ++ /* ++ * Taking q->mutex ensures that fops do not use the defunct ++ * uacce->ops after the queue is disabled. ++ */ ++ mutex_lock(&q->mutex); + uacce_put_queue(q); ++ mutex_unlock(&q->mutex); + uacce_unbind_queue(q); + } +- mutex_unlock(&uacce->queues_lock); + + /* disable sva now since no opened queues */ + if (uacce->flags & UACCE_DEV_SVA) +@@ -504,6 +538,13 @@ void uacce_remove(struct uacce_device *uacce) + if (uacce->cdev) + cdev_device_del(uacce->cdev, &uacce->dev); + xa_erase(&uacce_xa, uacce->dev_id); ++ /* ++ * uacce exists as long as there are open fds, but ops will be freed ++ * now. Ensure that bugs cause NULL deref rather than use-after-free. ++ */ ++ uacce->ops = NULL; ++ uacce->parent = NULL; ++ mutex_unlock(&uacce->mutex); + put_device(&uacce->dev); + } + EXPORT_SYMBOL_GPL(uacce_remove); +diff --git a/include/linux/uacce.h b/include/linux/uacce.h +index 48e319f40275..9ce88c28b0a8 100644 +--- a/include/linux/uacce.h ++++ b/include/linux/uacce.h +@@ -70,6 +70,7 @@ enum uacce_q_state { + * @wait: wait queue head + * @list: index into uacce queues list + * @qfrs: pointer of qfr regions ++ * @mutex: protects queue state + * @state: queue state machine + * @pasid: pasid associated to the mm + * @handle: iommu_sva handle returned by iommu_sva_bind_device() +@@ -80,6 +81,7 @@ struct uacce_queue { + wait_queue_head_t wait; + struct list_head list; + struct uacce_qfile_region *qfrs[UACCE_MAX_REGION]; ++ struct mutex mutex; + enum uacce_q_state state; + u32 pasid; + struct iommu_sva *handle; +@@ -97,9 +99,9 @@ struct uacce_queue { + * @dev_id: id of the uacce device + * @cdev: cdev of the uacce + * @dev: dev of the uacce ++ * @mutex: protects uacce operation + * @priv: private pointer of the uacce + * @queues: list of queues +- * @queues_lock: lock for queues list + * @inode: core vfs + */ + struct uacce_device { +@@ -113,9 +115,9 @@ struct uacce_device { + u32 dev_id; + struct cdev *cdev; + struct device dev; ++ struct mutex mutex; + void *priv; + struct list_head queues; +- struct mutex queues_lock; + struct inode *inode; + }; + +-- +2.35.1 + diff --git a/queue-5.10/um-add-noreboot-command-line-option-for-panic_timeou.patch b/queue-5.10/um-add-noreboot-command-line-option-for-panic_timeou.patch new file mode 100644 index 00000000000..fa8e31a3243 --- /dev/null +++ b/queue-5.10/um-add-noreboot-command-line-option-for-panic_timeou.patch @@ -0,0 +1,63 @@ +From def17f562aa7453ed23270921ac4de244e5254d9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Jul 2022 13:56:17 +0200 +Subject: um: add "noreboot" command line option for PANIC_TIMEOUT=-1 setups + +From: Jason A. Donenfeld + +[ Upstream commit dda520d07b95072a0b63f6c52a8eb566d08ea897 ] + +QEMU has a -no-reboot option, which halts instead of reboots when the +guest asks to reboot. This is invaluable when used with +CONFIG_PANIC_TIMEOUT=-1 (and panic_on_warn), because it allows panics +and warnings to be caught immediately in CI. Implement this in UML too, +by way of a basic setup param. + +Signed-off-by: Jason A. Donenfeld +Signed-off-by: Richard Weinberger +Signed-off-by: Sasha Levin +--- + arch/um/os-Linux/skas/process.c | 17 ++++++++++++++++- + 1 file changed, 16 insertions(+), 1 deletion(-) + +diff --git a/arch/um/os-Linux/skas/process.c b/arch/um/os-Linux/skas/process.c +index 94a7c4125ebc..eecde73b2e78 100644 +--- a/arch/um/os-Linux/skas/process.c ++++ b/arch/um/os-Linux/skas/process.c +@@ -5,6 +5,7 @@ + */ + + #include ++#include + #include + #include + #include +@@ -644,10 +645,24 @@ void halt_skas(void) + UML_LONGJMP(&initial_jmpbuf, INIT_JMP_HALT); + } + ++static bool noreboot; ++ ++static int __init noreboot_cmd_param(char *str, int *add) ++{ ++ noreboot = true; ++ return 0; ++} ++ ++__uml_setup("noreboot", noreboot_cmd_param, ++"noreboot\n" ++" Rather than rebooting, exit always, akin to QEMU's -no-reboot option.\n" ++" This is useful if you're using CONFIG_PANIC_TIMEOUT in order to catch\n" ++" crashes in CI\n"); ++ + void reboot_skas(void) + { + block_signals_trace(); +- UML_LONGJMP(&initial_jmpbuf, INIT_JMP_REBOOT); ++ UML_LONGJMP(&initial_jmpbuf, noreboot ? INIT_JMP_HALT : INIT_JMP_REBOOT); + } + + void __switch_mm(struct mm_id *mm_idp) +-- +2.35.1 + diff --git a/queue-5.10/usb-cdns3-fix-use-after-free-at-workaround-2.patch b/queue-5.10/usb-cdns3-fix-use-after-free-at-workaround-2.patch new file mode 100644 index 00000000000..87899211399 --- /dev/null +++ b/queue-5.10/usb-cdns3-fix-use-after-free-at-workaround-2.patch @@ -0,0 +1,53 @@ +From 779c26a83145d4cdae2fed49b072472efe581b1f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Jun 2022 14:04:30 -0500 +Subject: usb: cdns3 fix use-after-free at workaround 2 + +From: Frank Li + +[ Upstream commit 7d602f30149a117eea260208b1661bc404c21dfd ] + +BUG: KFENCE: use-after-free read in __list_del_entry_valid+0x10/0xac + +cdns3_wa2_remove_old_request() +{ + ... + kfree(priv_req->request.buf); + cdns3_gadget_ep_free_request(&priv_ep->endpoint, &priv_req->request); + list_del_init(&priv_req->list); + ^^^ use after free + ... +} + +cdns3_gadget_ep_free_request() free the space pointed by priv_req, +but priv_req is used in the following list_del_init(). + +This patch move list_del_init() before cdns3_gadget_ep_free_request(). + +Signed-off-by: Frank Li +Signed-off-by: Faqiang Zhu +Link: https://lore.kernel.org/r/20220608190430.2814358-1-Frank.Li@nxp.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/cdns3/gadget.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/cdns3/gadget.c b/drivers/usb/cdns3/gadget.c +index f120da442d43..a37ea946459c 100644 +--- a/drivers/usb/cdns3/gadget.c ++++ b/drivers/usb/cdns3/gadget.c +@@ -655,9 +655,9 @@ static void cdns3_wa2_remove_old_request(struct cdns3_endpoint *priv_ep) + trace_cdns3_wa2(priv_ep, "removes eldest request"); + + kfree(priv_req->request.buf); ++ list_del_init(&priv_req->list); + cdns3_gadget_ep_free_request(&priv_ep->endpoint, + &priv_req->request); +- list_del_init(&priv_req->list); + --priv_ep->wa2_counter; + + if (!chain) +-- +2.35.1 + diff --git a/queue-5.10/usb-dwc2-gadget-remove-d-pull-up-while-no-vbus-with-.patch b/queue-5.10/usb-dwc2-gadget-remove-d-pull-up-while-no-vbus-with-.patch new file mode 100644 index 00000000000..2c0158a22f4 --- /dev/null +++ b/queue-5.10/usb-dwc2-gadget-remove-d-pull-up-while-no-vbus-with-.patch @@ -0,0 +1,45 @@ +From 24bb18535943eeb4a3ac75bc28aa4bbdb98e5d68 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Jun 2022 18:07:17 +0200 +Subject: usb: dwc2: gadget: remove D+ pull-up while no vbus with + usb-role-switch + +From: Amelie Delaunay + +[ Upstream commit db638c6500abaffb8f7770b2a69c40d003d54ae1 ] + +When using usb-role-switch, D+ pull-up is set as soon as DTCL_SFTDISCON is +cleared, whatever the vbus valid signal state is. The pull-up should not +be set when vbus isn't present (this is determined by the drd controller). + +This patch ensures that B-Session (so Peripheral role + vbus valid signal) +is valid before clearing the DCTL_SFTDISCON bit when role switch is used. +Keep original behavior when usb-role-switch isn't used. + +Acked-by: Minas Harutyunyan +Signed-off-by: Amelie Delaunay +Signed-off-by: Fabrice Gasnier +Link: https://lore.kernel.org/r/20220622160717.314580-1-fabrice.gasnier@foss.st.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc2/gadget.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c +index 64485f82dc5b..da0df69cc234 100644 +--- a/drivers/usb/dwc2/gadget.c ++++ b/drivers/usb/dwc2/gadget.c +@@ -3593,7 +3593,8 @@ void dwc2_hsotg_core_disconnect(struct dwc2_hsotg *hsotg) + void dwc2_hsotg_core_connect(struct dwc2_hsotg *hsotg) + { + /* remove the soft-disconnect and let's go */ +- dwc2_clear_bit(hsotg, DCTL, DCTL_SFTDISCON); ++ if (!hsotg->role_sw || (dwc2_readl(hsotg, GOTGCTL) & GOTGCTL_BSESVLD)) ++ dwc2_clear_bit(hsotg, DCTL, DCTL_SFTDISCON); + } + + /** +-- +2.35.1 + diff --git a/queue-5.10/usb-gadget-uvc-call-uvc-uvcg_warn-on-completed-statu.patch b/queue-5.10/usb-gadget-uvc-call-uvc-uvcg_warn-on-completed-statu.patch new file mode 100644 index 00000000000..3fab359b72e --- /dev/null +++ b/queue-5.10/usb-gadget-uvc-call-uvc-uvcg_warn-on-completed-statu.patch @@ -0,0 +1,39 @@ +From b0efcbf07f232522da3068cd727d0c354492b478 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 May 2022 00:38:48 +0200 +Subject: usb: gadget: uvc: call uvc uvcg_warn on completed status instead of + uvcg_info + +From: Michael Grzeschik + +[ Upstream commit a725d0f6dfc5d3739d6499f30ec865305ba3544d ] + +Likewise to the uvcvideo hostside driver, this patch is changing the +usb_request message of an non zero completion handler call from dev_info +to dev_warn. + +Reviewed-by: Laurent Pinchart +Signed-off-by: Michael Grzeschik +Link: https://lore.kernel.org/r/20220529223848.105914-4-m.grzeschik@pengutronix.de +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/function/uvc_video.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/gadget/function/uvc_video.c b/drivers/usb/gadget/function/uvc_video.c +index 633e23d58d86..5ce548c2359d 100644 +--- a/drivers/usb/gadget/function/uvc_video.c ++++ b/drivers/usb/gadget/function/uvc_video.c +@@ -159,7 +159,7 @@ uvc_video_complete(struct usb_ep *ep, struct usb_request *req) + break; + + default: +- uvcg_info(&video->uvc->func, ++ uvcg_warn(&video->uvc->func, + "VS request completed with status %d.\n", + req->status); + uvcg_queue_cancel(queue, 0); +-- +2.35.1 + diff --git a/queue-5.10/usb-host-ohci-ppc-of-fix-refcount-leak-bug.patch b/queue-5.10/usb-host-ohci-ppc-of-fix-refcount-leak-bug.patch new file mode 100644 index 00000000000..150907da5e8 --- /dev/null +++ b/queue-5.10/usb-host-ohci-ppc-of-fix-refcount-leak-bug.patch @@ -0,0 +1,37 @@ +From 3850013bbcd5b36d9e0fb2ede8fed55297c6fdef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Jun 2022 11:46:37 +0800 +Subject: usb: host: ohci-ppc-of: Fix refcount leak bug + +From: Liang He + +[ Upstream commit 40a959d7042bb7711e404ad2318b30e9f92c6b9b ] + +In ohci_hcd_ppc_of_probe(), of_find_compatible_node() will return +a node pointer with refcount incremented. We should use of_node_put() +when it is not used anymore. + +Acked-by: Alan Stern +Signed-off-by: Liang He +Link: https://lore.kernel.org/r/20220617034637.4003115-1-windhl@126.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/host/ohci-ppc-of.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/usb/host/ohci-ppc-of.c b/drivers/usb/host/ohci-ppc-of.c +index 45f7cceb6df3..98e46725999e 100644 +--- a/drivers/usb/host/ohci-ppc-of.c ++++ b/drivers/usb/host/ohci-ppc-of.c +@@ -169,6 +169,7 @@ static int ohci_hcd_ppc_of_probe(struct platform_device *op) + release_mem_region(res.start, 0x4); + } else + pr_debug("%s: cannot get ehci offset from fdt\n", __FILE__); ++ of_node_put(np); + } + + irq_dispose_mapping(irq); +-- +2.35.1 + diff --git a/queue-5.10/usb-renesas-fix-refcount-leak-bug.patch b/queue-5.10/usb-renesas-fix-refcount-leak-bug.patch new file mode 100644 index 00000000000..028122886c7 --- /dev/null +++ b/queue-5.10/usb-renesas-fix-refcount-leak-bug.patch @@ -0,0 +1,39 @@ +From 8e81e1bf3415bf767b221c8247f4c0f65baa5b37 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 18 Jun 2022 10:32:05 +0800 +Subject: usb: renesas: Fix refcount leak bug + +From: Liang He + +[ Upstream commit 9d6d5303c39b8bc182475b22f45504106a07f086 ] + +In usbhs_rza1_hardware_init(), of_find_node_by_name() will return +a node pointer with refcount incremented. We should use of_node_put() +when it is not used anymore. + +Signed-off-by: Liang He +Link: https://lore.kernel.org/r/20220618023205.4056548-1-windhl@126.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/renesas_usbhs/rza.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/usb/renesas_usbhs/rza.c b/drivers/usb/renesas_usbhs/rza.c +index 24de64edb674..2d77edefb4b3 100644 +--- a/drivers/usb/renesas_usbhs/rza.c ++++ b/drivers/usb/renesas_usbhs/rza.c +@@ -23,6 +23,10 @@ static int usbhs_rza1_hardware_init(struct platform_device *pdev) + extal_clk = of_find_node_by_name(NULL, "extal"); + of_property_read_u32(usb_x1_clk, "clock-frequency", &freq_usb); + of_property_read_u32(extal_clk, "clock-frequency", &freq_extal); ++ ++ of_node_put(usb_x1_clk); ++ of_node_put(extal_clk); ++ + if (freq_usb == 0) { + if (freq_extal == 12000000) { + /* Select 12MHz XTAL */ +-- +2.35.1 + diff --git a/queue-5.10/vboxguest-do-not-use-devm-for-irq.patch b/queue-5.10/vboxguest-do-not-use-devm-for-irq.patch new file mode 100644 index 00000000000..e0500120f95 --- /dev/null +++ b/queue-5.10/vboxguest-do-not-use-devm-for-irq.patch @@ -0,0 +1,81 @@ +From 3208c375de15572832875f40c9271833ce08bc26 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 12 Jun 2022 14:37:44 +0100 +Subject: vboxguest: Do not use devm for irq + +From: Pascal Terjan + +[ Upstream commit 6169525b76764acb81918aa387ac168fb9a55575 ] + +When relying on devm it doesn't get freed early enough which causes the +following warning when unloading the module: + +[249348.837181] remove_proc_entry: removing non-empty directory 'irq/20', leaking at least 'vboxguest' +[249348.837219] WARNING: CPU: 0 PID: 6708 at fs/proc/generic.c:715 remove_proc_entry+0x119/0x140 + +[249348.837379] Call Trace: +[249348.837385] unregister_irq_proc+0xbd/0xe0 +[249348.837392] free_desc+0x23/0x60 +[249348.837396] irq_free_descs+0x4a/0x70 +[249348.837401] irq_domain_free_irqs+0x160/0x1a0 +[249348.837452] mp_unmap_irq+0x5c/0x60 +[249348.837458] acpi_unregister_gsi_ioapic+0x29/0x40 +[249348.837463] acpi_unregister_gsi+0x17/0x30 +[249348.837467] acpi_pci_irq_disable+0xbf/0xe0 +[249348.837473] pcibios_disable_device+0x20/0x30 +[249348.837478] pci_disable_device+0xef/0x120 +[249348.837482] vbg_pci_remove+0x6c/0x70 [vboxguest] + +Reviewed-by: Hans de Goede +Signed-off-by: Pascal Terjan +Link: https://lore.kernel.org/r/20220612133744.4030602-1-pterjan@google.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/virt/vboxguest/vboxguest_linux.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/virt/vboxguest/vboxguest_linux.c b/drivers/virt/vboxguest/vboxguest_linux.c +index 73eb34849eab..4ccfd30c2a30 100644 +--- a/drivers/virt/vboxguest/vboxguest_linux.c ++++ b/drivers/virt/vboxguest/vboxguest_linux.c +@@ -356,8 +356,8 @@ static int vbg_pci_probe(struct pci_dev *pci, const struct pci_device_id *id) + goto err_vbg_core_exit; + } + +- ret = devm_request_irq(dev, pci->irq, vbg_core_isr, IRQF_SHARED, +- DEVICE_NAME, gdev); ++ ret = request_irq(pci->irq, vbg_core_isr, IRQF_SHARED, DEVICE_NAME, ++ gdev); + if (ret) { + vbg_err("vboxguest: Error requesting irq: %d\n", ret); + goto err_vbg_core_exit; +@@ -367,7 +367,7 @@ static int vbg_pci_probe(struct pci_dev *pci, const struct pci_device_id *id) + if (ret) { + vbg_err("vboxguest: Error misc_register %s failed: %d\n", + DEVICE_NAME, ret); +- goto err_vbg_core_exit; ++ goto err_free_irq; + } + + ret = misc_register(&gdev->misc_device_user); +@@ -403,6 +403,8 @@ static int vbg_pci_probe(struct pci_dev *pci, const struct pci_device_id *id) + misc_deregister(&gdev->misc_device_user); + err_unregister_misc_device: + misc_deregister(&gdev->misc_device); ++err_free_irq: ++ free_irq(pci->irq, gdev); + err_vbg_core_exit: + vbg_core_exit(gdev); + err_disable_pcidev: +@@ -419,6 +421,7 @@ static void vbg_pci_remove(struct pci_dev *pci) + vbg_gdev = NULL; + mutex_unlock(&vbg_gdev_mutex); + ++ free_irq(pci->irq, gdev); + device_remove_file(gdev->dev, &dev_attr_host_features); + device_remove_file(gdev->dev, &dev_attr_host_version); + misc_deregister(&gdev->misc_device_user); +-- +2.35.1 + diff --git a/queue-5.10/vfio-clear-the-caps-buf-to-null-after-free.patch b/queue-5.10/vfio-clear-the-caps-buf-to-null-after-free.patch new file mode 100644 index 00000000000..1af5a00e300 --- /dev/null +++ b/queue-5.10/vfio-clear-the-caps-buf-to-null-after-free.patch @@ -0,0 +1,38 @@ +From a5f72f33828c9283f546c83caa84facc0b64e70b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Jun 2022 10:29:48 +0800 +Subject: vfio: Clear the caps->buf to NULL after free + +From: Schspa Shi + +[ Upstream commit 6641085e8d7b3f061911517f79a2a15a0a21b97b ] + +On buffer resize failure, vfio_info_cap_add() will free the buffer, +report zero for the size, and return -ENOMEM. As additional +hardening, also clear the buffer pointer to prevent any chance of a +double free. + +Signed-off-by: Schspa Shi +Reviewed-by: Cornelia Huck +Link: https://lore.kernel.org/r/20220629022948.55608-1-schspa@gmail.com +Signed-off-by: Alex Williamson +Signed-off-by: Sasha Levin +--- + drivers/vfio/vfio.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/vfio/vfio.c b/drivers/vfio/vfio.c +index f886f2db8153..90db9d66867c 100644 +--- a/drivers/vfio/vfio.c ++++ b/drivers/vfio/vfio.c +@@ -1783,6 +1783,7 @@ struct vfio_info_cap_header *vfio_info_cap_add(struct vfio_info_cap *caps, + buf = krealloc(caps->buf, caps->size + size, GFP_KERNEL); + if (!buf) { + kfree(caps->buf); ++ caps->buf = NULL; + caps->size = 0; + return ERR_PTR(-ENOMEM); + } +-- +2.35.1 + diff --git a/queue-5.10/video-fbdev-i740fb-check-the-argument-of-i740_calc_v.patch b/queue-5.10/video-fbdev-i740fb-check-the-argument-of-i740_calc_v.patch new file mode 100644 index 00000000000..56bc4554400 --- /dev/null +++ b/queue-5.10/video-fbdev-i740fb-check-the-argument-of-i740_calc_v.patch @@ -0,0 +1,67 @@ +From a3b263d01bcd7833830893f3b5f3aad77abef6be Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Aug 2022 17:24:19 +0800 +Subject: video: fbdev: i740fb: Check the argument of i740_calc_vclk() + +From: Zheyu Ma + +[ Upstream commit 40bf722f8064f50200b8c4f8946cd625b441dda9 ] + +Since the user can control the arguments of the ioctl() from the user +space, under special arguments that may result in a divide-by-zero bug. + +If the user provides an improper 'pixclock' value that makes the argumet +of i740_calc_vclk() less than 'I740_RFREQ_FIX', it will cause a +divide-by-zero bug in: + drivers/video/fbdev/i740fb.c:353 p_best = min(15, ilog2(I740_MAX_VCO_FREQ / (freq / I740_RFREQ_FIX))); + +The following log can reveal it: + +divide error: 0000 [#1] PREEMPT SMP KASAN PTI +RIP: 0010:i740_calc_vclk drivers/video/fbdev/i740fb.c:353 [inline] +RIP: 0010:i740fb_decode_var drivers/video/fbdev/i740fb.c:646 [inline] +RIP: 0010:i740fb_set_par+0x163f/0x3b70 drivers/video/fbdev/i740fb.c:742 +Call Trace: + fb_set_var+0x604/0xeb0 drivers/video/fbdev/core/fbmem.c:1034 + do_fb_ioctl+0x234/0x670 drivers/video/fbdev/core/fbmem.c:1110 + fb_ioctl+0xdd/0x130 drivers/video/fbdev/core/fbmem.c:1189 + +Fix this by checking the argument of i740_calc_vclk() first. + +Signed-off-by: Zheyu Ma +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/i740fb.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/drivers/video/fbdev/i740fb.c b/drivers/video/fbdev/i740fb.c +index 52cce0db8bd3..ad5ced4ef972 100644 +--- a/drivers/video/fbdev/i740fb.c ++++ b/drivers/video/fbdev/i740fb.c +@@ -400,7 +400,7 @@ static int i740fb_decode_var(const struct fb_var_screeninfo *var, + u32 xres, right, hslen, left, xtotal; + u32 yres, lower, vslen, upper, ytotal; + u32 vxres, xoffset, vyres, yoffset; +- u32 bpp, base, dacspeed24, mem; ++ u32 bpp, base, dacspeed24, mem, freq; + u8 r7; + int i; + +@@ -643,7 +643,12 @@ static int i740fb_decode_var(const struct fb_var_screeninfo *var, + par->atc[VGA_ATC_OVERSCAN] = 0; + + /* Calculate VCLK that most closely matches the requested dot clock */ +- i740_calc_vclk((((u32)1e9) / var->pixclock) * (u32)(1e3), par); ++ freq = (((u32)1e9) / var->pixclock) * (u32)(1e3); ++ if (freq < I740_RFREQ_FIX) { ++ fb_dbg(info, "invalid pixclock\n"); ++ freq = I740_RFREQ_FIX; ++ } ++ i740_calc_vclk(freq, par); + + /* Since we program the clocks ourselves, always use VCLK2. */ + par->misc |= 0x0C; +-- +2.35.1 + diff --git a/queue-5.10/watchdog-export-lockup_detector_reconfigure.patch b/queue-5.10/watchdog-export-lockup_detector_reconfigure.patch new file mode 100644 index 00000000000..431d69c4d8c --- /dev/null +++ b/queue-5.10/watchdog-export-lockup_detector_reconfigure.patch @@ -0,0 +1,115 @@ +From 560ebe59024a18a23a273f3ab85adee72a9acf16 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Jul 2022 17:47:27 +0200 +Subject: watchdog: export lockup_detector_reconfigure + +From: Laurent Dufour + +[ Upstream commit 7c56a8733d0a2a4be2438a7512566e5ce552fccf ] + +In some circumstances it may be interesting to reconfigure the watchdog +from inside the kernel. + +On PowerPC, this may helpful before and after a LPAR migration (LPM) is +initiated, because it implies some latencies, watchdog, and especially NMI +watchdog is expected to be triggered during this operation. Reconfiguring +the watchdog with a factor, would prevent it to happen too frequently +during LPM. + +Rename lockup_detector_reconfigure() as __lockup_detector_reconfigure() and +create a new function lockup_detector_reconfigure() calling +__lockup_detector_reconfigure() under the protection of watchdog_mutex. + +Signed-off-by: Laurent Dufour +[mpe: Squash in build fix from Laurent, reported by Sachin] +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20220713154729.80789-3-ldufour@linux.ibm.com +Signed-off-by: Sasha Levin +--- + include/linux/nmi.h | 2 ++ + kernel/watchdog.c | 21 ++++++++++++++++----- + 2 files changed, 18 insertions(+), 5 deletions(-) + +diff --git a/include/linux/nmi.h b/include/linux/nmi.h +index 750c7f395ca9..f700ff2df074 100644 +--- a/include/linux/nmi.h ++++ b/include/linux/nmi.h +@@ -122,6 +122,8 @@ int watchdog_nmi_probe(void); + int watchdog_nmi_enable(unsigned int cpu); + void watchdog_nmi_disable(unsigned int cpu); + ++void lockup_detector_reconfigure(void); ++ + /** + * touch_nmi_watchdog - restart NMI watchdog timeout. + * +diff --git a/kernel/watchdog.c b/kernel/watchdog.c +index 01bf977090dc..ec34d9f2eab2 100644 +--- a/kernel/watchdog.c ++++ b/kernel/watchdog.c +@@ -518,7 +518,7 @@ int lockup_detector_offline_cpu(unsigned int cpu) + return 0; + } + +-static void lockup_detector_reconfigure(void) ++static void __lockup_detector_reconfigure(void) + { + cpus_read_lock(); + watchdog_nmi_stop(); +@@ -538,6 +538,13 @@ static void lockup_detector_reconfigure(void) + __lockup_detector_cleanup(); + } + ++void lockup_detector_reconfigure(void) ++{ ++ mutex_lock(&watchdog_mutex); ++ __lockup_detector_reconfigure(); ++ mutex_unlock(&watchdog_mutex); ++} ++ + /* + * Create the watchdog thread infrastructure and configure the detector(s). + * +@@ -558,13 +565,13 @@ static __init void lockup_detector_setup(void) + return; + + mutex_lock(&watchdog_mutex); +- lockup_detector_reconfigure(); ++ __lockup_detector_reconfigure(); + softlockup_initialized = true; + mutex_unlock(&watchdog_mutex); + } + + #else /* CONFIG_SOFTLOCKUP_DETECTOR */ +-static void lockup_detector_reconfigure(void) ++static void __lockup_detector_reconfigure(void) + { + cpus_read_lock(); + watchdog_nmi_stop(); +@@ -572,9 +579,13 @@ static void lockup_detector_reconfigure(void) + watchdog_nmi_start(); + cpus_read_unlock(); + } ++void lockup_detector_reconfigure(void) ++{ ++ __lockup_detector_reconfigure(); ++} + static inline void lockup_detector_setup(void) + { +- lockup_detector_reconfigure(); ++ __lockup_detector_reconfigure(); + } + #endif /* !CONFIG_SOFTLOCKUP_DETECTOR */ + +@@ -614,7 +625,7 @@ static void proc_watchdog_update(void) + { + /* Remove impossible cpus to keep sysctl output clean. */ + cpumask_and(&watchdog_cpumask, &watchdog_cpumask, cpu_possible_mask); +- lockup_detector_reconfigure(); ++ __lockup_detector_reconfigure(); + } + + /* +-- +2.35.1 + diff --git a/queue-5.10/zram-do-not-lookup-algorithm-in-backends-table.patch b/queue-5.10/zram-do-not-lookup-algorithm-in-backends-table.patch new file mode 100644 index 00000000000..8944c878260 --- /dev/null +++ b/queue-5.10/zram-do-not-lookup-algorithm-in-backends-table.patch @@ -0,0 +1,100 @@ +From d9e3d13806b61b0136243e4436ab610d0fa3bc37 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Jun 2022 11:35:01 +0900 +Subject: zram: do not lookup algorithm in backends table + +From: Sergey Senozhatsky + +[ Upstream commit dc89997264de565999a1cb55db3f295d3a8e457b ] + +Always use crypto_has_comp() so that crypto can lookup module, call +usermodhelper to load the modules, wait for usermodhelper to finish and so +on. Otherwise crypto will do all of these steps under CPU hot-plug lock +and this looks like too much stuff to handle under the CPU hot-plug lock. +Besides this can end up in a deadlock when usermodhelper triggers a code +path that attempts to lock the CPU hot-plug lock, that zram already holds. + +An example of such deadlock: + +- path A. zram grabs CPU hot-plug lock, execs /sbin/modprobe from crypto + and waits for modprobe to finish + +disksize_store + zcomp_create + __cpuhp_state_add_instance + __cpuhp_state_add_instance_cpuslocked + zcomp_cpu_up_prepare + crypto_alloc_base + crypto_alg_mod_lookup + call_usermodehelper_exec + wait_for_completion_killable + do_wait_for_common + schedule + +- path B. async work kthread that brings in scsi device. It wants to + register CPUHP states at some point, and it needs the CPU hot-plug + lock for that, which is owned by zram. + +async_run_entry_fn + scsi_probe_and_add_lun + scsi_mq_alloc_queue + blk_mq_init_queue + blk_mq_init_allocated_queue + blk_mq_realloc_hw_ctxs + __cpuhp_state_add_instance + __cpuhp_state_add_instance_cpuslocked + mutex_lock + schedule + +- path C. modprobe sleeps, waiting for all aync works to finish. + +load_module + do_init_module + async_synchronize_full + async_synchronize_cookie_domain + schedule + +[senozhatsky@chromium.org: add comment] + Link: https://lkml.kernel.org/r/20220624060606.1014474-1-senozhatsky@chromium.org +Link: https://lkml.kernel.org/r/20220622023501.517125-1-senozhatsky@chromium.org +Signed-off-by: Sergey Senozhatsky +Cc: Minchan Kim +Cc: Nitin Gupta +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + drivers/block/zram/zcomp.c | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +diff --git a/drivers/block/zram/zcomp.c b/drivers/block/zram/zcomp.c +index 33e3b76c4fa9..b08650417bf0 100644 +--- a/drivers/block/zram/zcomp.c ++++ b/drivers/block/zram/zcomp.c +@@ -61,12 +61,6 @@ static int zcomp_strm_init(struct zcomp_strm *zstrm, struct zcomp *comp) + + bool zcomp_available_algorithm(const char *comp) + { +- int i; +- +- i = sysfs_match_string(backends, comp); +- if (i >= 0) +- return true; +- + /* + * Crypto does not ignore a trailing new line symbol, + * so make sure you don't supply a string containing +@@ -215,6 +209,11 @@ struct zcomp *zcomp_create(const char *compress) + struct zcomp *comp; + int error; + ++ /* ++ * Crypto API will execute /sbin/modprobe if the compression module ++ * is not loaded yet. We must do it here, otherwise we are about to ++ * call /sbin/modprobe under CPU hot-plug lock. ++ */ + if (!zcomp_available_algorithm(compress)) + return ERR_PTR(-EINVAL); + +-- +2.35.1 +