From: Greg Kroah-Hartman Date: Mon, 5 Jun 2023 15:01:57 +0000 (+0200) Subject: 6.3-stable patches X-Git-Tag: v4.14.317~78 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=fd2ed66281c82bbc5c873f5b858508dcbace84d7;p=thirdparty%2Fkernel%2Fstable-queue.git 6.3-stable patches added patches: dt-bindings-usb-snps-dwc3-fix-snps-hsphy_interface-type.patch md-raid5-fix-miscalculation-of-end_sector-in-raid5_read_one_chunk.patch misc-fastrpc-reassign-memory-ownership-only-for-remote-heap.patch misc-fastrpc-reject-new-invocations-during-device-removal.patch misc-fastrpc-return-epipe-to-invocations-on-device-removal.patch net-usb-qmi_wwan-set-dtr-quirk-for-broadmobi-bm818.patch usb-cdns3-fix-ncm-gadget-rx-speed-20x-slow-than-expection-at-imx8qm.patch usb-gadget-f_fs-add-unbind-event-before-functionfs_unbind.patch --- diff --git a/queue-6.3/dt-bindings-usb-snps-dwc3-fix-snps-hsphy_interface-type.patch b/queue-6.3/dt-bindings-usb-snps-dwc3-fix-snps-hsphy_interface-type.patch new file mode 100644 index 00000000000..7bb7acb493e --- /dev/null +++ b/queue-6.3/dt-bindings-usb-snps-dwc3-fix-snps-hsphy_interface-type.patch @@ -0,0 +1,32 @@ +From 7b32040f6d7f885ffc09a6df7c17992d56d2eab8 Mon Sep 17 00:00:00 2001 +From: Marek Vasut +Date: Mon, 15 May 2023 19:24:56 +0200 +Subject: dt-bindings: usb: snps,dwc3: Fix "snps,hsphy_interface" type + +From: Marek Vasut + +commit 7b32040f6d7f885ffc09a6df7c17992d56d2eab8 upstream. + +The "snps,hsphy_interface" is string, not u8. Fix the type. + +Fixes: 389d77658801 ("dt-bindings: usb: Convert DWC USB3 bindings to DT schema") +Cc: stable +Reviewed-by: Krzysztof Kozlowski +Signed-off-by: Marek Vasut +Link: https://lore.kernel.org/r/20230515172456.179049-1-marex@denx.de +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/devicetree/bindings/usb/snps,dwc3.yaml | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/Documentation/devicetree/bindings/usb/snps,dwc3.yaml ++++ b/Documentation/devicetree/bindings/usb/snps,dwc3.yaml +@@ -270,7 +270,7 @@ properties: + description: + High-Speed PHY interface selection between UTMI+ and ULPI when the + DWC_USB3_HSPHY_INTERFACE has value 3. +- $ref: /schemas/types.yaml#/definitions/uint8 ++ $ref: /schemas/types.yaml#/definitions/string + enum: [utmi, ulpi] + + snps,quirk-frame-length-adjustment: diff --git a/queue-6.3/md-raid5-fix-miscalculation-of-end_sector-in-raid5_read_one_chunk.patch b/queue-6.3/md-raid5-fix-miscalculation-of-end_sector-in-raid5_read_one_chunk.patch new file mode 100644 index 00000000000..105fc095cb1 --- /dev/null +++ b/queue-6.3/md-raid5-fix-miscalculation-of-end_sector-in-raid5_read_one_chunk.patch @@ -0,0 +1,36 @@ +From 8557dc27126949c702bd3aafe8a7e0b7e4fcb44c Mon Sep 17 00:00:00 2001 +From: Yu Kuai +Date: Wed, 24 May 2023 09:41:18 +0800 +Subject: md/raid5: fix miscalculation of 'end_sector' in raid5_read_one_chunk() + +From: Yu Kuai + +commit 8557dc27126949c702bd3aafe8a7e0b7e4fcb44c upstream. + +'end_sector' is compared to 'rdev->recovery_offset', which is offset to +rdev, however, commit e82ed3a4fbb5 ("md/raid6: refactor +raid5_read_one_chunk") changes the calculation of 'end_sector' to offset +to the array. Fix this miscalculation. + +Fixes: e82ed3a4fbb5 ("md/raid6: refactor raid5_read_one_chunk") +Cc: stable@vger.kernel.org # v5.12+ +Signed-off-by: Yu Kuai +Reviewed-by: Christoph Hellwig +Signed-off-by: Song Liu +Link: https://lore.kernel.org/r/20230524014118.3172781-1-yukuai1@huaweicloud.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/md/raid5.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/md/raid5.c ++++ b/drivers/md/raid5.c +@@ -5516,7 +5516,7 @@ static int raid5_read_one_chunk(struct m + + sector = raid5_compute_sector(conf, raid_bio->bi_iter.bi_sector, 0, + &dd_idx, NULL); +- end_sector = bio_end_sector(raid_bio); ++ end_sector = sector + bio_sectors(raid_bio); + + rcu_read_lock(); + if (r5c_big_stripe_cached(conf, sector)) diff --git a/queue-6.3/misc-fastrpc-reassign-memory-ownership-only-for-remote-heap.patch b/queue-6.3/misc-fastrpc-reassign-memory-ownership-only-for-remote-heap.patch new file mode 100644 index 00000000000..9d3792ec13b --- /dev/null +++ b/queue-6.3/misc-fastrpc-reassign-memory-ownership-only-for-remote-heap.patch @@ -0,0 +1,49 @@ +From 3c7d0079a1831118ef232bd9c2f34d058a1f31c2 Mon Sep 17 00:00:00 2001 +From: Ekansh Gupta +Date: Tue, 23 May 2023 16:25:48 +0100 +Subject: misc: fastrpc: Reassign memory ownership only for remote heap + +From: Ekansh Gupta + +commit 3c7d0079a1831118ef232bd9c2f34d058a1f31c2 upstream. + +The userspace map request for remote heap allocates CMA memory. +The ownership of this memory needs to be reassigned to proper +owners to allow access from the protection domain running on +DSP. This reassigning of ownership is not correct if done for +any other supported flags. + +When any other flag is requested from userspace, fastrpc is +trying to reassign the ownership of memory and this reassignment +is getting skipped for remote heap request which is incorrect. +Add proper flag check to reassign the memory only if remote heap +is requested. + +Fixes: 532ad70c6d44 ("misc: fastrpc: Add mmap request assigning for static PD pool") +Cc: stable +Tested-by: Ekansh Gupta +Signed-off-by: Ekansh Gupta +Reviewed-by: Srinivas Kandagatla +Signed-off-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20230523152550.438363-3-srinivas.kandagatla@linaro.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/misc/fastrpc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c +index 32a5415624bf..a654dc416480 100644 +--- a/drivers/misc/fastrpc.c ++++ b/drivers/misc/fastrpc.c +@@ -1904,7 +1904,7 @@ static int fastrpc_req_mmap(struct fastrpc_user *fl, char __user *argp) + req.vaddrout = rsp_msg.vaddr; + + /* Add memory to static PD pool, protection thru hypervisor */ +- if (req.flags != ADSP_MMAP_REMOTE_HEAP_ADDR && fl->cctx->vmcount) { ++ if (req.flags == ADSP_MMAP_REMOTE_HEAP_ADDR && fl->cctx->vmcount) { + struct qcom_scm_vmperm perm; + + perm.vmid = QCOM_SCM_VMID_HLOS; +-- +2.41.0 + diff --git a/queue-6.3/misc-fastrpc-reject-new-invocations-during-device-removal.patch b/queue-6.3/misc-fastrpc-reject-new-invocations-during-device-removal.patch new file mode 100644 index 00000000000..6b509388333 --- /dev/null +++ b/queue-6.3/misc-fastrpc-reject-new-invocations-during-device-removal.patch @@ -0,0 +1,50 @@ +From 46248400d81e2aa0b65cd659d6f40188192a58b6 Mon Sep 17 00:00:00 2001 +From: Richard Acayan +Date: Tue, 23 May 2023 16:25:50 +0100 +Subject: misc: fastrpc: reject new invocations during device removal + +From: Richard Acayan + +commit 46248400d81e2aa0b65cd659d6f40188192a58b6 upstream. + +The channel's rpmsg object allows new invocations to be made. After old +invocations are already interrupted, the driver shouldn't try to invoke +anymore. Invalidating the rpmsg at the end of the driver removal +function makes it easy to cause a race condition in userspace. Even +closing a file descriptor before the driver finishes its cleanup can +cause an invocation via fastrpc_release_current_dsp_process() and +subsequent timeout. + +Invalidate the channel before the invocations are interrupted to make +sure that no invocations can be created to hang after the device closes. + +Fixes: c68cfb718c8f ("misc: fastrpc: Add support for context Invoke method") +Cc: stable +Signed-off-by: Richard Acayan +Signed-off-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20230523152550.438363-5-srinivas.kandagatla@linaro.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/misc/fastrpc.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/misc/fastrpc.c ++++ b/drivers/misc/fastrpc.c +@@ -2351,7 +2351,9 @@ static void fastrpc_rpmsg_remove(struct + struct fastrpc_user *user; + unsigned long flags; + ++ /* No invocations past this point */ + spin_lock_irqsave(&cctx->lock, flags); ++ cctx->rpdev = NULL; + list_for_each_entry(user, &cctx->users, user) + fastrpc_notify_users(user); + spin_unlock_irqrestore(&cctx->lock, flags); +@@ -2370,7 +2372,6 @@ static void fastrpc_rpmsg_remove(struct + + of_platform_depopulate(&rpdev->dev); + +- cctx->rpdev = NULL; + fastrpc_channel_ctx_put(cctx); + } + diff --git a/queue-6.3/misc-fastrpc-return-epipe-to-invocations-on-device-removal.patch b/queue-6.3/misc-fastrpc-return-epipe-to-invocations-on-device-removal.patch new file mode 100644 index 00000000000..402a22df84d --- /dev/null +++ b/queue-6.3/misc-fastrpc-return-epipe-to-invocations-on-device-removal.patch @@ -0,0 +1,41 @@ +From b6a062853ddf6b4f653af2d8b75ba45bb9a036ad Mon Sep 17 00:00:00 2001 +From: Richard Acayan +Date: Tue, 23 May 2023 16:25:49 +0100 +Subject: misc: fastrpc: return -EPIPE to invocations on device removal + +From: Richard Acayan + +commit b6a062853ddf6b4f653af2d8b75ba45bb9a036ad upstream. + +The return value is initialized as -1, or -EPERM. The completion of an +invocation implies that the return value is set appropriately, but +"Permission denied" does not accurately describe the outcome of the +invocation. Set the invocation's return value to a more appropriate +"Broken pipe", as the cleanup breaks the driver's connection with rpmsg. + +Fixes: c68cfb718c8f ("misc: fastrpc: Add support for context Invoke method") +Cc: stable +Signed-off-by: Richard Acayan +Reviewed-by: Srinivas Kandagatla +Signed-off-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20230523152550.438363-4-srinivas.kandagatla@linaro.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman +--- + drivers/misc/fastrpc.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/misc/fastrpc.c ++++ b/drivers/misc/fastrpc.c +@@ -2337,8 +2337,10 @@ static void fastrpc_notify_users(struct + struct fastrpc_invoke_ctx *ctx; + + spin_lock(&user->lock); +- list_for_each_entry(ctx, &user->pending, node) ++ list_for_each_entry(ctx, &user->pending, node) { ++ ctx->retval = -EPIPE; + complete(&ctx->work); ++ } + spin_unlock(&user->lock); + } + diff --git a/queue-6.3/net-usb-qmi_wwan-set-dtr-quirk-for-broadmobi-bm818.patch b/queue-6.3/net-usb-qmi_wwan-set-dtr-quirk-for-broadmobi-bm818.patch new file mode 100644 index 00000000000..a9528802e30 --- /dev/null +++ b/queue-6.3/net-usb-qmi_wwan-set-dtr-quirk-for-broadmobi-bm818.patch @@ -0,0 +1,36 @@ +From 36936a56e1814f6c526fe71fbf980beab4f5577a Mon Sep 17 00:00:00 2001 +From: Sebastian Krzyszkowiak +Date: Fri, 26 May 2023 16:38:11 +0200 +Subject: net: usb: qmi_wwan: Set DTR quirk for BroadMobi BM818 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Sebastian Krzyszkowiak + +commit 36936a56e1814f6c526fe71fbf980beab4f5577a upstream. + +BM818 is based on Qualcomm MDM9607 chipset. + +Fixes: 9a07406b00cd ("net: usb: qmi_wwan: Add the BroadMobi BM818 card") +Cc: stable@vger.kernel.org +Signed-off-by: Sebastian Krzyszkowiak +Acked-by: Bjørn Mork +Link: https://lore.kernel.org/r/20230526-bm818-dtr-v1-1-64bbfa6ba8af@puri.sm +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/usb/qmi_wwan.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/usb/qmi_wwan.c ++++ b/drivers/net/usb/qmi_wwan.c +@@ -1325,7 +1325,7 @@ static const struct usb_device_id produc + {QMI_FIXED_INTF(0x2001, 0x7e3d, 4)}, /* D-Link DWM-222 A2 */ + {QMI_FIXED_INTF(0x2020, 0x2031, 4)}, /* Olicard 600 */ + {QMI_FIXED_INTF(0x2020, 0x2033, 4)}, /* BroadMobi BM806U */ +- {QMI_FIXED_INTF(0x2020, 0x2060, 4)}, /* BroadMobi BM818 */ ++ {QMI_QUIRK_SET_DTR(0x2020, 0x2060, 4)}, /* BroadMobi BM818 */ + {QMI_FIXED_INTF(0x0f3d, 0x68a2, 8)}, /* Sierra Wireless MC7700 */ + {QMI_FIXED_INTF(0x114f, 0x68a2, 8)}, /* Sierra Wireless MC7750 */ + {QMI_FIXED_INTF(0x1199, 0x68a2, 8)}, /* Sierra Wireless MC7710 in QMI mode */ diff --git a/queue-6.3/series b/queue-6.3/series index 22271e0aa10..c21da58c29e 100644 --- a/queue-6.3/series +++ b/queue-6.3/series @@ -205,3 +205,11 @@ iio-addac-ad74413-fix-resistance-input-processing.patch iio-adc-ad7192-change-shorted-channels-to-differential.patch iio-adc-stm32-adc-skip-adc-diff-channels-setup-if-none-is-present.patch iio-dac-build-ad5758-driver-when-ad5758-is-selected.patch +net-usb-qmi_wwan-set-dtr-quirk-for-broadmobi-bm818.patch +dt-bindings-usb-snps-dwc3-fix-snps-hsphy_interface-type.patch +usb-cdns3-fix-ncm-gadget-rx-speed-20x-slow-than-expection-at-imx8qm.patch +usb-gadget-f_fs-add-unbind-event-before-functionfs_unbind.patch +md-raid5-fix-miscalculation-of-end_sector-in-raid5_read_one_chunk.patch +misc-fastrpc-reassign-memory-ownership-only-for-remote-heap.patch +misc-fastrpc-return-epipe-to-invocations-on-device-removal.patch +misc-fastrpc-reject-new-invocations-during-device-removal.patch diff --git a/queue-6.3/usb-cdns3-fix-ncm-gadget-rx-speed-20x-slow-than-expection-at-imx8qm.patch b/queue-6.3/usb-cdns3-fix-ncm-gadget-rx-speed-20x-slow-than-expection-at-imx8qm.patch new file mode 100644 index 00000000000..c14910366a2 --- /dev/null +++ b/queue-6.3/usb-cdns3-fix-ncm-gadget-rx-speed-20x-slow-than-expection-at-imx8qm.patch @@ -0,0 +1,57 @@ +From dbe678f6192f27879ac9ff6bc7a1036aad85aae9 Mon Sep 17 00:00:00 2001 +From: Frank Li +Date: Thu, 18 May 2023 11:49:45 -0400 +Subject: usb: cdns3: fix NCM gadget RX speed 20x slow than expection at iMX8QM + +From: Frank Li + +commit dbe678f6192f27879ac9ff6bc7a1036aad85aae9 upstream. + +At iMX8QM platform, enable NCM gadget and run 'iperf3 -s'. +At host, run 'iperf3 -V -c fe80::6863:98ff:feef:3e0%enxc6e147509498' + +[ 5] 0.00-1.00 sec 1.55 MBytes 13.0 Mbits/sec 90 4.18 KBytes +[ 5] 1.00-2.00 sec 1.44 MBytes 12.0 Mbits/sec 75 4.18 KBytes +[ 5] 2.00-3.00 sec 1.48 MBytes 12.4 Mbits/sec 75 4.18 KBytes + +Expected speed should be bigger than 300Mbits/sec. + +The root cause of this performance drop was found to be data corruption +happening at 4K borders in some Ethernet packets, leading to TCP +checksum errors. This corruption occurs from the position +(4K - (address & 0x7F)) to 4K. The u_ether function's allocation of +skb_buff reserves 64B, meaning all RX addresses resemble 0xXXXX0040. + +Force trb_burst_size to 16 can fix this problem. + +Cc: stable@vger.kernel.org +Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver") +Signed-off-by: Frank Li +Link: https://lore.kernel.org/r/20230518154946.3666662-1-Frank.Li@nxp.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/cdns3/cdns3-gadget.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +--- a/drivers/usb/cdns3/cdns3-gadget.c ++++ b/drivers/usb/cdns3/cdns3-gadget.c +@@ -2097,6 +2097,19 @@ int cdns3_ep_config(struct cdns3_endpoin + else + priv_ep->trb_burst_size = 16; + ++ /* ++ * In versions preceding DEV_VER_V2, for example, iMX8QM, there exit the bugs ++ * in the DMA. These bugs occur when the trb_burst_size exceeds 16 and the ++ * address is not aligned to 128 Bytes (which is a product of the 64-bit AXI ++ * and AXI maximum burst length of 16 or 0xF+1, dma_axi_ctrl0[3:0]). This ++ * results in data corruption when it crosses the 4K border. The corruption ++ * specifically occurs from the position (4K - (address & 0x7F)) to 4K. ++ * ++ * So force trb_burst_size to 16 at such platform. ++ */ ++ if (priv_dev->dev_ver < DEV_VER_V2) ++ priv_ep->trb_burst_size = 16; ++ + mult = min_t(u8, mult, EP_CFG_MULT_MAX); + buffering = min_t(u8, buffering, EP_CFG_BUFFERING_MAX); + maxburst = min_t(u8, maxburst, EP_CFG_MAXBURST_MAX); diff --git a/queue-6.3/usb-gadget-f_fs-add-unbind-event-before-functionfs_unbind.patch b/queue-6.3/usb-gadget-f_fs-add-unbind-event-before-functionfs_unbind.patch new file mode 100644 index 00000000000..b849b59bda1 --- /dev/null +++ b/queue-6.3/usb-gadget-f_fs-add-unbind-event-before-functionfs_unbind.patch @@ -0,0 +1,65 @@ +From efb6b535207395a5c7317993602e2503ca8cb4b3 Mon Sep 17 00:00:00 2001 +From: Uttkarsh Aggarwal +Date: Thu, 25 May 2023 14:58:54 +0530 +Subject: usb: gadget: f_fs: Add unbind event before functionfs_unbind + +From: Uttkarsh Aggarwal + +commit efb6b535207395a5c7317993602e2503ca8cb4b3 upstream. + +While exercising the unbind path, with the current implementation +the functionfs_unbind would be calling which waits for the ffs->mutex +to be available, however within the same time ffs_ep0_read is invoked +& if no setup packets are pending, it will invoke function +wait_event_interruptible_exclusive_locked_irq which by definition waits +for the ev.count to be increased inside the same mutex for which +functionfs_unbind is waiting. +This creates deadlock situation because the functionfs_unbind won't +get the lock until ev.count is increased which can only happen if +the caller ffs_func_unbind can proceed further. + +Following is the illustration: + + CPU1 CPU2 + +ffs_func_unbind() ffs_ep0_read() + mutex_lock(ffs->mutex) + wait_event(ffs->ev.count) +functionfs_unbind() + mutex_lock(ffs->mutex) + mutex_unlock(ffs->mutex) + +ffs_event_add() + + + +Fix this by moving the event unbind before functionfs_unbind +to ensure the ev.count is incrased properly. + +Fixes: 6a19da111057 ("usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait") +Cc: stable +Signed-off-by: Uttkarsh Aggarwal +Link: https://lore.kernel.org/r/20230525092854.7992-1-quic_uaggarwa@quicinc.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/function/f_fs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/gadget/function/f_fs.c ++++ b/drivers/usb/gadget/function/f_fs.c +@@ -3620,6 +3620,7 @@ static void ffs_func_unbind(struct usb_c + /* Drain any pending AIO completions */ + drain_workqueue(ffs->io_completion_wq); + ++ ffs_event_add(ffs, FUNCTIONFS_UNBIND); + if (!--opts->refcnt) + functionfs_unbind(ffs); + +@@ -3644,7 +3645,6 @@ static void ffs_func_unbind(struct usb_c + func->function.ssp_descriptors = NULL; + func->interfaces_nums = NULL; + +- ffs_event_add(ffs, FUNCTIONFS_UNBIND); + } + + static struct usb_function *ffs_alloc(struct usb_function_instance *fi)