From 437354261a308196a63380e9fc01c6cc4e50f3fa Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Sun, 12 Dec 2021 15:57:23 +0100 Subject: [PATCH] 5.15-stable patches added patches: alsa-usb-audio-reorder-snd_djm_devices-entries.patch asoc-codecs-wcd934x-handle-channel-mappping-list-correctly.patch asoc-codecs-wcd934x-return-correct-value-from-mixer-put.patch asoc-codecs-wsa881x-fix-return-values-from-kcontrol-put.patch asoc-qdsp6-q6routing-fix-return-value-from-msm_routing_put_audio_mixer.patch asoc-rt5682-fix-crash-due-to-out-of-scope-stack-vars.patch block-fix-ioprio_get-ioprio_who_pgrp-vs-setuid-2.patch bpf-sockmap-re-evaluate-proto-ops-when-psock-is-removed-from-sockmap.patch clk-imx-use-module_platform_driver.patch clk-qcom-clk-alpha-pll-don-t-reconfigure-running-trion.patch documentation-locking-locktypes-update-migrate_disable-bits.patch drm-amd-display-fix-dpia-outbox-timeout-after-s3-s4-reset.patch dt-bindings-net-reintroduce-phy-no-lane-swap-binding.patch hwmon-dell-smm-fix-warning-on-proc-i8k-creation-error.patch i2c-mpc-use-atomic-read-and-fix-break-condition.patch i40e-fix-failed-opcode-appearing-if-handling-messages-from-vf.patch i40e-fix-null-pointer-dereference-in-i40e_dbg_dump_desc.patch i40e-fix-pre-set-max-number-of-queues-for-vf.patch mtd-rawnand-fsmc-fix-timing-computation.patch mtd-rawnand-fsmc-take-instruction-delay-into-account.patch net-altera-set-a-couple-error-code-in-probe.patch net-cdc_ncm-allow-for-dwntboutmaxsize-to-be-unset-or-zero.patch net-fec-only-clear-interrupt-of-handling-queue-in-fec_enet_rx_queue.patch net-neigh-clear-whole-pneigh_entry-at-alloc-time.patch net-qla3xxx-fix-an-error-code-in-ql_adapter_up.patch perf-tools-fix-smt-detection-fast-read-path.patch pm-runtime-fix-pm_runtime_active-kerneldoc-comment.patch qede-validate-non-lso-skb-length.patch rdma-hns-do-not-destroy-qp-resources-in-the-hw-resetting-phase.patch rdma-hns-do-not-halt-commands-during-reset-until-later.patch revert-pci-aardvark-fix-support-for-pci_rom_address1-on-emulated-bridge.patch scsi-pm80xx-do-not-call-scsi_remove_host-in-pm8001_alloc.patch scsi-scsi_debug-fix-buffer-size-of-report-zones-command.patch selftests-fib_tests-rework-fib_rp_filter_test.patch tools-build-remove-needless-libpython-version-feature-check-that-breaks-test-all-fast-path.patch tracefs-set-all-files-to-the-same-group-ownership-as-the-mount-option.patch --- ...udio-reorder-snd_djm_devices-entries.patch | 54 ++++ ...ndle-channel-mappping-list-correctly.patch | 196 +++++++++++++ ...-return-correct-value-from-mixer-put.patch | 46 ++++ ...-fix-return-values-from-kcontrol-put.patch | 60 ++++ ...lue-from-msm_routing_put_audio_mixer.patch | 60 ++++ ...crash-due-to-out-of-scope-stack-vars.patch | 58 ++++ ...prio_get-ioprio_who_pgrp-vs-setuid-2.patch | 43 +++ ...s-when-psock-is-removed-from-sockmap.patch | 81 ++++++ .../clk-imx-use-module_platform_driver.patch | 48 ++++ ...-pll-don-t-reconfigure-running-trion.patch | 49 ++++ ...ocktypes-update-migrate_disable-bits.patch | 55 ++++ ...pia-outbox-timeout-after-s3-s4-reset.patch | 55 ++++ ...reintroduce-phy-no-lane-swap-binding.patch | 45 +++ ...x-warning-on-proc-i8k-creation-error.patch | 46 ++++ ...-atomic-read-and-fix-break-condition.patch | 39 +++ ...pearing-if-handling-messages-from-vf.patch | 258 ++++++++++++++++++ ...er-dereference-in-i40e_dbg_dump_desc.patch | 43 +++ ...-pre-set-max-number-of-queues-for-vf.patch | 38 +++ ...-rawnand-fsmc-fix-timing-computation.patch | 106 +++++++ ...-take-instruction-delay-into-account.patch | 44 +++ ...era-set-a-couple-error-code-in-probe.patch | 45 +++ ...-dwntboutmaxsize-to-be-unset-or-zero.patch | 73 +++++ ...-handling-queue-in-fec_enet_rx_queue.patch | 61 +++++ ...ear-whole-pneigh_entry-at-alloc-time.patch | 97 +++++++ ...x-fix-an-error-code-in-ql_adapter_up.patch | 57 ++++ ...ols-fix-smt-detection-fast-read-path.patch | 44 +++ ...-pm_runtime_active-kerneldoc-comment.patch | 31 +++ .../qede-validate-non-lso-skb-length.patch | 50 ++++ ...-resources-in-the-hw-resetting-phase.patch | 86 ++++++ ...lt-commands-during-reset-until-later.patch | 68 +++++ ...-pci_rom_address1-on-emulated-bridge.patch | 100 +++++++ ...all-scsi_remove_host-in-pm8001_alloc.patch | 71 +++++ ...-buffer-size-of-report-zones-command.patch | 37 +++ ...-fib_tests-rework-fib_rp_filter_test.patch | 170 ++++++++++++ queue-5.15/series | 36 +++ ...check-that-breaks-test-all-fast-path.patch | 183 +++++++++++++ ...-group-ownership-as-the-mount-option.patch | 146 ++++++++++ 37 files changed, 2779 insertions(+) create mode 100644 queue-5.15/alsa-usb-audio-reorder-snd_djm_devices-entries.patch create mode 100644 queue-5.15/asoc-codecs-wcd934x-handle-channel-mappping-list-correctly.patch create mode 100644 queue-5.15/asoc-codecs-wcd934x-return-correct-value-from-mixer-put.patch create mode 100644 queue-5.15/asoc-codecs-wsa881x-fix-return-values-from-kcontrol-put.patch create mode 100644 queue-5.15/asoc-qdsp6-q6routing-fix-return-value-from-msm_routing_put_audio_mixer.patch create mode 100644 queue-5.15/asoc-rt5682-fix-crash-due-to-out-of-scope-stack-vars.patch create mode 100644 queue-5.15/block-fix-ioprio_get-ioprio_who_pgrp-vs-setuid-2.patch create mode 100644 queue-5.15/bpf-sockmap-re-evaluate-proto-ops-when-psock-is-removed-from-sockmap.patch create mode 100644 queue-5.15/clk-imx-use-module_platform_driver.patch create mode 100644 queue-5.15/clk-qcom-clk-alpha-pll-don-t-reconfigure-running-trion.patch create mode 100644 queue-5.15/documentation-locking-locktypes-update-migrate_disable-bits.patch create mode 100644 queue-5.15/drm-amd-display-fix-dpia-outbox-timeout-after-s3-s4-reset.patch create mode 100644 queue-5.15/dt-bindings-net-reintroduce-phy-no-lane-swap-binding.patch create mode 100644 queue-5.15/hwmon-dell-smm-fix-warning-on-proc-i8k-creation-error.patch create mode 100644 queue-5.15/i2c-mpc-use-atomic-read-and-fix-break-condition.patch create mode 100644 queue-5.15/i40e-fix-failed-opcode-appearing-if-handling-messages-from-vf.patch create mode 100644 queue-5.15/i40e-fix-null-pointer-dereference-in-i40e_dbg_dump_desc.patch create mode 100644 queue-5.15/i40e-fix-pre-set-max-number-of-queues-for-vf.patch create mode 100644 queue-5.15/mtd-rawnand-fsmc-fix-timing-computation.patch create mode 100644 queue-5.15/mtd-rawnand-fsmc-take-instruction-delay-into-account.patch create mode 100644 queue-5.15/net-altera-set-a-couple-error-code-in-probe.patch create mode 100644 queue-5.15/net-cdc_ncm-allow-for-dwntboutmaxsize-to-be-unset-or-zero.patch create mode 100644 queue-5.15/net-fec-only-clear-interrupt-of-handling-queue-in-fec_enet_rx_queue.patch create mode 100644 queue-5.15/net-neigh-clear-whole-pneigh_entry-at-alloc-time.patch create mode 100644 queue-5.15/net-qla3xxx-fix-an-error-code-in-ql_adapter_up.patch create mode 100644 queue-5.15/perf-tools-fix-smt-detection-fast-read-path.patch create mode 100644 queue-5.15/pm-runtime-fix-pm_runtime_active-kerneldoc-comment.patch create mode 100644 queue-5.15/qede-validate-non-lso-skb-length.patch create mode 100644 queue-5.15/rdma-hns-do-not-destroy-qp-resources-in-the-hw-resetting-phase.patch create mode 100644 queue-5.15/rdma-hns-do-not-halt-commands-during-reset-until-later.patch create mode 100644 queue-5.15/revert-pci-aardvark-fix-support-for-pci_rom_address1-on-emulated-bridge.patch create mode 100644 queue-5.15/scsi-pm80xx-do-not-call-scsi_remove_host-in-pm8001_alloc.patch create mode 100644 queue-5.15/scsi-scsi_debug-fix-buffer-size-of-report-zones-command.patch create mode 100644 queue-5.15/selftests-fib_tests-rework-fib_rp_filter_test.patch create mode 100644 queue-5.15/tools-build-remove-needless-libpython-version-feature-check-that-breaks-test-all-fast-path.patch create mode 100644 queue-5.15/tracefs-set-all-files-to-the-same-group-ownership-as-the-mount-option.patch diff --git a/queue-5.15/alsa-usb-audio-reorder-snd_djm_devices-entries.patch b/queue-5.15/alsa-usb-audio-reorder-snd_djm_devices-entries.patch new file mode 100644 index 00000000000..2ef334095f8 --- /dev/null +++ b/queue-5.15/alsa-usb-audio-reorder-snd_djm_devices-entries.patch @@ -0,0 +1,54 @@ +From fb1af5bea4670c835e42fc0c14c49d3499468774 Mon Sep 17 00:00:00 2001 +From: Geraldo Nascimento +Date: Sat, 4 Dec 2021 15:52:24 -0300 +Subject: ALSA: usb-audio: Reorder snd_djm_devices[] entries + +From: Geraldo Nascimento + +commit fb1af5bea4670c835e42fc0c14c49d3499468774 upstream. + +Olivia Mackintosh has posted to alsa-devel reporting that +there's a potential bug that could break mixer quirks for Pioneer +devices introduced by 6d27788160362a7ee6c0d317636fe4b1ddbe59a7 +"ALSA: usb-audio: Add support for the Pioneer DJM 750MK2 +Mixer/Soundcard". + +This happened because the DJM 750 MK2 was added last to the Pioneer DJM +device table index and defined as 0x4 but was added to snd_djm_devices[] +just after the DJM 750 (MK1) entry instead of last, after the DJM 900 +NXS2. This escaped review. + +To prevent that from ever happening again, Takashi Iwai suggested to use +C99 array designators in snd_djm_devices[] instead of simply reordering +the entries. + +Fixes: 6d2778816036 ("ALSA: usb-audio: Add support for the Pioneer DJM 750MK2") +Reported-by: Olivia Mackintosh +Suggested-by: Takashi Iwai +Signed-off-by: Geraldo Nascimento +Link: https://lore.kernel.org/r/Yau46FDzoql0SNnW@geday +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/usb/mixer_quirks.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/sound/usb/mixer_quirks.c ++++ b/sound/usb/mixer_quirks.c +@@ -3016,11 +3016,11 @@ static const struct snd_djm_ctl snd_djm_ + + + static const struct snd_djm_device snd_djm_devices[] = { +- SND_DJM_DEVICE(250mk2), +- SND_DJM_DEVICE(750), +- SND_DJM_DEVICE(750mk2), +- SND_DJM_DEVICE(850), +- SND_DJM_DEVICE(900nxs2) ++ [SND_DJM_250MK2_IDX] = SND_DJM_DEVICE(250mk2), ++ [SND_DJM_750_IDX] = SND_DJM_DEVICE(750), ++ [SND_DJM_850_IDX] = SND_DJM_DEVICE(850), ++ [SND_DJM_900NXS2_IDX] = SND_DJM_DEVICE(900nxs2), ++ [SND_DJM_750MK2_IDX] = SND_DJM_DEVICE(750mk2), + }; + + diff --git a/queue-5.15/asoc-codecs-wcd934x-handle-channel-mappping-list-correctly.patch b/queue-5.15/asoc-codecs-wcd934x-handle-channel-mappping-list-correctly.patch new file mode 100644 index 00000000000..f191f297356 --- /dev/null +++ b/queue-5.15/asoc-codecs-wcd934x-handle-channel-mappping-list-correctly.patch @@ -0,0 +1,196 @@ +From 23ba28616d3063bd4c4953598ed5e439ca891101 Mon Sep 17 00:00:00 2001 +From: Srinivas Kandagatla +Date: Tue, 30 Nov 2021 16:05:04 +0000 +Subject: ASoC: codecs: wcd934x: handle channel mappping list correctly + +From: Srinivas Kandagatla + +commit 23ba28616d3063bd4c4953598ed5e439ca891101 upstream. + +Currently each channel is added as list to dai channel list, however +there is danger of adding same channel to multiple dai channel list +which endups corrupting the other list where its already added. + +This patch ensures that the channel is actually free before adding to +the dai channel list and also ensures that the channel is on the list +before deleting it. + +This check was missing previously, and we did not hit this issue as +we were testing very simple usecases with sequence of amixer commands. + +Fixes: a70d9245759a ("ASoC: wcd934x: add capture dapm widgets") +Fixes: dd9eb19b5673 ("ASoC: wcd934x: add playback dapm widgets") +Signed-off-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20211130160507.22180-2-srinivas.kandagatla@linaro.org +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/codecs/wcd934x.c | 119 +++++++++++++++++++++++++++++++++------------ + 1 file changed, 88 insertions(+), 31 deletions(-) + +--- a/sound/soc/codecs/wcd934x.c ++++ b/sound/soc/codecs/wcd934x.c +@@ -3326,6 +3326,31 @@ static int slim_rx_mux_get(struct snd_kc + return 0; + } + ++static int slim_rx_mux_to_dai_id(int mux) ++{ ++ int aif_id; ++ ++ switch (mux) { ++ case 1: ++ aif_id = AIF1_PB; ++ break; ++ case 2: ++ aif_id = AIF2_PB; ++ break; ++ case 3: ++ aif_id = AIF3_PB; ++ break; ++ case 4: ++ aif_id = AIF4_PB; ++ break; ++ default: ++ aif_id = -1; ++ break; ++ } ++ ++ return aif_id; ++} ++ + static int slim_rx_mux_put(struct snd_kcontrol *kc, + struct snd_ctl_elem_value *ucontrol) + { +@@ -3333,43 +3358,59 @@ static int slim_rx_mux_put(struct snd_kc + struct wcd934x_codec *wcd = dev_get_drvdata(w->dapm->dev); + struct soc_enum *e = (struct soc_enum *)kc->private_value; + struct snd_soc_dapm_update *update = NULL; ++ struct wcd934x_slim_ch *ch, *c; + u32 port_id = w->shift; ++ bool found = false; ++ int mux_idx; ++ int prev_mux_idx = wcd->rx_port_value[port_id]; ++ int aif_id; + +- if (wcd->rx_port_value[port_id] == ucontrol->value.enumerated.item[0]) +- return 0; ++ mux_idx = ucontrol->value.enumerated.item[0]; + +- wcd->rx_port_value[port_id] = ucontrol->value.enumerated.item[0]; ++ if (mux_idx == prev_mux_idx) ++ return 0; + +- switch (wcd->rx_port_value[port_id]) { ++ switch(mux_idx) { + case 0: +- list_del_init(&wcd->rx_chs[port_id].list); +- break; +- case 1: +- list_add_tail(&wcd->rx_chs[port_id].list, +- &wcd->dai[AIF1_PB].slim_ch_list); +- break; +- case 2: +- list_add_tail(&wcd->rx_chs[port_id].list, +- &wcd->dai[AIF2_PB].slim_ch_list); +- break; +- case 3: +- list_add_tail(&wcd->rx_chs[port_id].list, +- &wcd->dai[AIF3_PB].slim_ch_list); ++ aif_id = slim_rx_mux_to_dai_id(prev_mux_idx); ++ if (aif_id < 0) ++ return 0; ++ ++ list_for_each_entry_safe(ch, c, &wcd->dai[aif_id].slim_ch_list, list) { ++ if (ch->port == port_id + WCD934X_RX_START) { ++ found = true; ++ list_del_init(&ch->list); ++ break; ++ } ++ } ++ if (!found) ++ return 0; ++ + break; +- case 4: +- list_add_tail(&wcd->rx_chs[port_id].list, +- &wcd->dai[AIF4_PB].slim_ch_list); ++ case 1 ... 4: ++ aif_id = slim_rx_mux_to_dai_id(mux_idx); ++ if (aif_id < 0) ++ return 0; ++ ++ if (list_empty(&wcd->rx_chs[port_id].list)) { ++ list_add_tail(&wcd->rx_chs[port_id].list, ++ &wcd->dai[aif_id].slim_ch_list); ++ } else { ++ dev_err(wcd->dev ,"SLIM_RX%d PORT is busy\n", port_id); ++ return 0; ++ } + break; ++ + default: +- dev_err(wcd->dev, "Unknown AIF %d\n", +- wcd->rx_port_value[port_id]); ++ dev_err(wcd->dev, "Unknown AIF %d\n", mux_idx); + goto err; + } + ++ wcd->rx_port_value[port_id] = mux_idx; + snd_soc_dapm_mux_update_power(w->dapm, kc, wcd->rx_port_value[port_id], + e, update); + +- return 0; ++ return 1; + err: + return -EINVAL; + } +@@ -3815,6 +3856,7 @@ static int slim_tx_mixer_put(struct snd_ + struct soc_mixer_control *mixer = + (struct soc_mixer_control *)kc->private_value; + int enable = ucontrol->value.integer.value[0]; ++ struct wcd934x_slim_ch *ch, *c; + int dai_id = widget->shift; + int port_id = mixer->shift; + +@@ -3822,17 +3864,32 @@ static int slim_tx_mixer_put(struct snd_ + if (enable == wcd->tx_port_value[port_id]) + return 0; + +- wcd->tx_port_value[port_id] = enable; +- +- if (enable) +- list_add_tail(&wcd->tx_chs[port_id].list, +- &wcd->dai[dai_id].slim_ch_list); +- else +- list_del_init(&wcd->tx_chs[port_id].list); ++ if (enable) { ++ if (list_empty(&wcd->tx_chs[port_id].list)) { ++ list_add_tail(&wcd->tx_chs[port_id].list, ++ &wcd->dai[dai_id].slim_ch_list); ++ } else { ++ dev_err(wcd->dev ,"SLIM_TX%d PORT is busy\n", port_id); ++ return 0; ++ } ++ } else { ++ bool found = false; ++ ++ list_for_each_entry_safe(ch, c, &wcd->dai[dai_id].slim_ch_list, list) { ++ if (ch->port == port_id) { ++ found = true; ++ list_del_init(&wcd->tx_chs[port_id].list); ++ break; ++ } ++ } ++ if (!found) ++ return 0; ++ } + ++ wcd->tx_port_value[port_id] = enable; + snd_soc_dapm_mixer_update_power(widget->dapm, kc, enable, update); + +- return 0; ++ return 1; + } + + static const struct snd_kcontrol_new aif1_slim_cap_mixer[] = { diff --git a/queue-5.15/asoc-codecs-wcd934x-return-correct-value-from-mixer-put.patch b/queue-5.15/asoc-codecs-wcd934x-return-correct-value-from-mixer-put.patch new file mode 100644 index 00000000000..244c9aa1ebc --- /dev/null +++ b/queue-5.15/asoc-codecs-wcd934x-return-correct-value-from-mixer-put.patch @@ -0,0 +1,46 @@ +From d9be0ff4796d1b6f5ee391c1b7e3653a43cedfab Mon Sep 17 00:00:00 2001 +From: Srinivas Kandagatla +Date: Tue, 30 Nov 2021 16:05:06 +0000 +Subject: ASoC: codecs: wcd934x: return correct value from mixer put + +From: Srinivas Kandagatla + +commit d9be0ff4796d1b6f5ee391c1b7e3653a43cedfab upstream. + +wcd934x_compander_set() currently returns zero eventhough it changes the value. +Fix this, so that change notifications are sent correctly. + +Fixes: 1cde8b822332 ("ASoC: wcd934x: add basic controls") +Signed-off-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20211130160507.22180-4-srinivas.kandagatla@linaro.org +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/codecs/wcd934x.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/sound/soc/codecs/wcd934x.c ++++ b/sound/soc/codecs/wcd934x.c +@@ -3256,6 +3256,9 @@ static int wcd934x_compander_set(struct + int value = ucontrol->value.integer.value[0]; + int sel; + ++ if (wcd->comp_enabled[comp] == value) ++ return 0; ++ + wcd->comp_enabled[comp] = value; + sel = value ? WCD934X_HPH_GAIN_SRC_SEL_COMPANDER : + WCD934X_HPH_GAIN_SRC_SEL_REGISTER; +@@ -3279,10 +3282,10 @@ static int wcd934x_compander_set(struct + case COMPANDER_8: + break; + default: +- break; ++ return 0; + } + +- return 0; ++ return 1; + } + + static int wcd934x_rx_hph_mode_get(struct snd_kcontrol *kc, diff --git a/queue-5.15/asoc-codecs-wsa881x-fix-return-values-from-kcontrol-put.patch b/queue-5.15/asoc-codecs-wsa881x-fix-return-values-from-kcontrol-put.patch new file mode 100644 index 00000000000..5311d7c5268 --- /dev/null +++ b/queue-5.15/asoc-codecs-wsa881x-fix-return-values-from-kcontrol-put.patch @@ -0,0 +1,60 @@ +From 3fc27e9a1f619b50700f020e6cd270c1b74755f0 Mon Sep 17 00:00:00 2001 +From: Srinivas Kandagatla +Date: Tue, 30 Nov 2021 16:05:07 +0000 +Subject: ASoC: codecs: wsa881x: fix return values from kcontrol put + +From: Srinivas Kandagatla + +commit 3fc27e9a1f619b50700f020e6cd270c1b74755f0 upstream. + +wsa881x_set_port() and wsa881x_put_pa_gain() currently returns zero eventhough +it changes the value. Fix this, so that change notifications are sent +correctly. + +Fixes: a0aab9e1404a ("ASoC: codecs: add wsa881x amplifier support") +Signed-off-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20211130160507.22180-5-srinivas.kandagatla@linaro.org +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/codecs/wsa881x.c | 16 ++++++++++++---- + 1 file changed, 12 insertions(+), 4 deletions(-) + +--- a/sound/soc/codecs/wsa881x.c ++++ b/sound/soc/codecs/wsa881x.c +@@ -772,7 +772,8 @@ static int wsa881x_put_pa_gain(struct sn + + usleep_range(1000, 1010); + } +- return 0; ++ ++ return 1; + } + + static int wsa881x_get_port(struct snd_kcontrol *kcontrol, +@@ -816,15 +817,22 @@ static int wsa881x_set_port(struct snd_k + (struct soc_mixer_control *)kcontrol->private_value; + int portidx = mixer->reg; + +- if (ucontrol->value.integer.value[0]) ++ if (ucontrol->value.integer.value[0]) { ++ if (data->port_enable[portidx]) ++ return 0; ++ + data->port_enable[portidx] = true; +- else ++ } else { ++ if (!data->port_enable[portidx]) ++ return 0; ++ + data->port_enable[portidx] = false; ++ } + + if (portidx == WSA881X_PORT_BOOST) /* Boost Switch */ + wsa881x_boost_ctrl(comp, data->port_enable[portidx]); + +- return 0; ++ return 1; + } + + static const char * const smart_boost_lvl_text[] = { diff --git a/queue-5.15/asoc-qdsp6-q6routing-fix-return-value-from-msm_routing_put_audio_mixer.patch b/queue-5.15/asoc-qdsp6-q6routing-fix-return-value-from-msm_routing_put_audio_mixer.patch new file mode 100644 index 00000000000..c3ee65c3e92 --- /dev/null +++ b/queue-5.15/asoc-qdsp6-q6routing-fix-return-value-from-msm_routing_put_audio_mixer.patch @@ -0,0 +1,60 @@ +From 4739d88ad8e1900f809f8a5c98f3c1b65bf76220 Mon Sep 17 00:00:00 2001 +From: Srinivas Kandagatla +Date: Tue, 30 Nov 2021 16:31:10 +0000 +Subject: ASoC: qdsp6: q6routing: Fix return value from msm_routing_put_audio_mixer + +From: Srinivas Kandagatla + +commit 4739d88ad8e1900f809f8a5c98f3c1b65bf76220 upstream. + +msm_routing_put_audio_mixer() can return incorrect value in various scenarios. + +scenario 1: +amixer cset iface=MIXER,name='SLIMBUS_0_RX Audio Mixer MultiMedia1' 1 +amixer cset iface=MIXER,name='SLIMBUS_0_RX Audio Mixer MultiMedia1' 0 + +return value is 0 instead of 1 eventhough value was changed + +scenario 2: +amixer cset iface=MIXER,name='SLIMBUS_0_RX Audio Mixer MultiMedia1' 1 +amixer cset iface=MIXER,name='SLIMBUS_0_RX Audio Mixer MultiMedia1' 1 + +return value is 1 instead of 0 eventhough the value was not changed + +scenario 3: +amixer cset iface=MIXER,name='SLIMBUS_0_RX Audio Mixer MultiMedia1' 0 +return value is 1 instead of 0 eventhough the value was not changed + +Fix this by adding checks, so that change notifications are sent correctly. + +Fixes: e3a33673e845 ("ASoC: qdsp6: q6routing: Add q6routing driver") +Signed-off-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20211130163110.5628-1-srinivas.kandagatla@linaro.org +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/qcom/qdsp6/q6routing.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/sound/soc/qcom/qdsp6/q6routing.c ++++ b/sound/soc/qcom/qdsp6/q6routing.c +@@ -492,14 +492,16 @@ static int msm_routing_put_audio_mixer(s + struct session_data *session = &data->sessions[session_id]; + + if (ucontrol->value.integer.value[0]) { ++ if (session->port_id == be_id) ++ return 0; ++ + session->port_id = be_id; + snd_soc_dapm_mixer_update_power(dapm, kcontrol, 1, update); + } else { +- if (session->port_id == be_id) { +- session->port_id = -1; ++ if (session->port_id == -1 || session->port_id != be_id) + return 0; +- } + ++ session->port_id = -1; + snd_soc_dapm_mixer_update_power(dapm, kcontrol, 0, update); + } + diff --git a/queue-5.15/asoc-rt5682-fix-crash-due-to-out-of-scope-stack-vars.patch b/queue-5.15/asoc-rt5682-fix-crash-due-to-out-of-scope-stack-vars.patch new file mode 100644 index 00000000000..7289da1b666 --- /dev/null +++ b/queue-5.15/asoc-rt5682-fix-crash-due-to-out-of-scope-stack-vars.patch @@ -0,0 +1,58 @@ +From 4999d703c0e66f9f196b6edc0b8fdeca8846b8b6 Mon Sep 17 00:00:00 2001 +From: Rob Clark +Date: Wed, 17 Nov 2021 17:04:52 -0800 +Subject: ASoC: rt5682: Fix crash due to out of scope stack vars + +From: Rob Clark + +commit 4999d703c0e66f9f196b6edc0b8fdeca8846b8b6 upstream. + +Move the declaration of temporary arrays to somewhere that won't go out +of scope before the devm_clk_hw_register() call, lest we be at the whim +of the compiler for whether those stack variables get overwritten. + +Fixes a crash seen with gcc version 11.2.1 20210728 (Red Hat 11.2.1-1) + +Fixes: edbd24ea1e5c ("ASoC: rt5682: Drop usage of __clk_get_name()") +Signed-off-by: Rob Clark +Reviewed-by: Stephen Boyd +Link: https://lore.kernel.org/r/20211118010453.843286-1-robdclark@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/codecs/rt5682.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +--- a/sound/soc/codecs/rt5682.c ++++ b/sound/soc/codecs/rt5682.c +@@ -2840,6 +2840,8 @@ static int rt5682_register_dai_clks(stru + + for (i = 0; i < RT5682_DAI_NUM_CLKS; ++i) { + struct clk_init_data init = { }; ++ struct clk_parent_data parent_data; ++ const struct clk_hw *parent; + + dai_clk_hw = &rt5682->dai_clks_hw[i]; + +@@ -2847,17 +2849,17 @@ static int rt5682_register_dai_clks(stru + case RT5682_DAI_WCLK_IDX: + /* Make MCLK the parent of WCLK */ + if (rt5682->mclk) { +- init.parent_data = &(struct clk_parent_data){ ++ parent_data = (struct clk_parent_data){ + .fw_name = "mclk", + }; ++ init.parent_data = &parent_data; + init.num_parents = 1; + } + break; + case RT5682_DAI_BCLK_IDX: + /* Make WCLK the parent of BCLK */ +- init.parent_hws = &(const struct clk_hw *){ +- &rt5682->dai_clks_hw[RT5682_DAI_WCLK_IDX] +- }; ++ parent = &rt5682->dai_clks_hw[RT5682_DAI_WCLK_IDX]; ++ init.parent_hws = &parent; + init.num_parents = 1; + break; + default: diff --git a/queue-5.15/block-fix-ioprio_get-ioprio_who_pgrp-vs-setuid-2.patch b/queue-5.15/block-fix-ioprio_get-ioprio_who_pgrp-vs-setuid-2.patch new file mode 100644 index 00000000000..22c84df2091 --- /dev/null +++ b/queue-5.15/block-fix-ioprio_get-ioprio_who_pgrp-vs-setuid-2.patch @@ -0,0 +1,43 @@ +From e6a59aac8a8713f335a37d762db0dbe80e7f6d38 Mon Sep 17 00:00:00 2001 +From: Davidlohr Bueso +Date: Fri, 10 Dec 2021 10:20:58 -0800 +Subject: block: fix ioprio_get(IOPRIO_WHO_PGRP) vs setuid(2) + +From: Davidlohr Bueso + +commit e6a59aac8a8713f335a37d762db0dbe80e7f6d38 upstream. + +do_each_pid_thread(PIDTYPE_PGID) can race with a concurrent +change_pid(PIDTYPE_PGID) that can move the task from one hlist +to another while iterating. Serialize ioprio_get to take +the tasklist_lock in this case, just like it's set counterpart. + +Fixes: d69b78ba1de (ioprio: grab rcu_read_lock in sys_ioprio_{set,get}()) +Acked-by: Oleg Nesterov +Signed-off-by: Davidlohr Bueso +Link: https://lore.kernel.org/r/20211210182058.43417-1-dave@stgolabs.net +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +--- + block/ioprio.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/block/ioprio.c ++++ b/block/ioprio.c +@@ -220,6 +220,7 @@ SYSCALL_DEFINE2(ioprio_get, int, which, + pgrp = task_pgrp(current); + else + pgrp = find_vpid(who); ++ read_lock(&tasklist_lock); + do_each_pid_thread(pgrp, PIDTYPE_PGID, p) { + tmpio = get_task_ioprio(p); + if (tmpio < 0) +@@ -229,6 +230,8 @@ SYSCALL_DEFINE2(ioprio_get, int, which, + else + ret = ioprio_best(ret, tmpio); + } while_each_pid_thread(pgrp, PIDTYPE_PGID, p); ++ read_unlock(&tasklist_lock); ++ + break; + case IOPRIO_WHO_USER: + uid = make_kuid(current_user_ns(), who); diff --git a/queue-5.15/bpf-sockmap-re-evaluate-proto-ops-when-psock-is-removed-from-sockmap.patch b/queue-5.15/bpf-sockmap-re-evaluate-proto-ops-when-psock-is-removed-from-sockmap.patch new file mode 100644 index 00000000000..728b915e2e6 --- /dev/null +++ b/queue-5.15/bpf-sockmap-re-evaluate-proto-ops-when-psock-is-removed-from-sockmap.patch @@ -0,0 +1,81 @@ +From c0d95d3380ee099d735e08618c0d599e72f6c8b0 Mon Sep 17 00:00:00 2001 +From: John Fastabend +Date: Fri, 19 Nov 2021 10:14:18 -0800 +Subject: bpf, sockmap: Re-evaluate proto ops when psock is removed from sockmap + +From: John Fastabend + +commit c0d95d3380ee099d735e08618c0d599e72f6c8b0 upstream. + +When a sock is added to a sock map we evaluate what proto op hooks need to +be used. However, when the program is removed from the sock map we have not +been evaluating if that changes the required program layout. + +Before the patch listed in the 'fixes' tag this was not causing failures +because the base program set handles all cases. Specifically, the case with +a stream parser and the case with out a stream parser are both handled. With +the fix below we identified a race when running with a proto op that attempts +to read skbs off both the stream parser and the skb->receive_queue. Namely, +that a race existed where when the stream parser is empty checking the +skb->receive_queue from recvmsg at the precies moment when the parser is +paused and the receive_queue is not empty could result in skipping the stream +parser. This may break a RX policy depending on the parser to run. + +The fix tag then loads a specific proto ops that resolved this race. But, we +missed removing that proto ops recv hook when the sock is removed from the +sockmap. The result is the stream parser is stopped so no more skbs will be +aggregated there, but the hook and BPF program continues to be attached on +the psock. User space will then get an EBUSY when trying to read the socket +because the recvmsg() handler is now waiting on a stopped stream parser. + +To fix we rerun the proto ops init() function which will look at the new set +of progs attached to the psock and rest the proto ops hook to the correct +handlers. And in the above case where we remove the sock from the sock map +the RX prog will no longer be listed so the proto ops is removed. + +Fixes: c5d2177a72a16 ("bpf, sockmap: Fix race in ingress receive verdict with redirect to self") +Signed-off-by: John Fastabend +Signed-off-by: Daniel Borkmann +Link: https://lore.kernel.org/bpf/20211119181418.353932-3-john.fastabend@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + net/core/skmsg.c | 5 +++++ + net/core/sock_map.c | 5 ++++- + 2 files changed, 9 insertions(+), 1 deletion(-) + +--- a/net/core/skmsg.c ++++ b/net/core/skmsg.c +@@ -1124,6 +1124,8 @@ void sk_psock_start_strp(struct sock *sk + + void sk_psock_stop_strp(struct sock *sk, struct sk_psock *psock) + { ++ psock_set_prog(&psock->progs.stream_parser, NULL); ++ + if (!psock->saved_data_ready) + return; + +@@ -1212,6 +1214,9 @@ void sk_psock_start_verdict(struct sock + + void sk_psock_stop_verdict(struct sock *sk, struct sk_psock *psock) + { ++ psock_set_prog(&psock->progs.stream_verdict, NULL); ++ psock_set_prog(&psock->progs.skb_verdict, NULL); ++ + if (!psock->saved_data_ready) + return; + +--- a/net/core/sock_map.c ++++ b/net/core/sock_map.c +@@ -167,8 +167,11 @@ static void sock_map_del_link(struct soc + write_lock_bh(&sk->sk_callback_lock); + if (strp_stop) + sk_psock_stop_strp(sk, psock); +- else ++ if (verdict_stop) + sk_psock_stop_verdict(sk, psock); ++ ++ if (psock->psock_update_sk_prot) ++ psock->psock_update_sk_prot(sk, psock, false); + write_unlock_bh(&sk->sk_callback_lock); + } + } diff --git a/queue-5.15/clk-imx-use-module_platform_driver.patch b/queue-5.15/clk-imx-use-module_platform_driver.patch new file mode 100644 index 00000000000..f7854d20ccb --- /dev/null +++ b/queue-5.15/clk-imx-use-module_platform_driver.patch @@ -0,0 +1,48 @@ +From eee377b8f44e7ac4f76bbf2440e5cbbc1d25c25f Mon Sep 17 00:00:00 2001 +From: Miles Chen +Date: Sun, 5 Sep 2021 07:54:18 +0800 +Subject: clk: imx: use module_platform_driver + +From: Miles Chen + +commit eee377b8f44e7ac4f76bbf2440e5cbbc1d25c25f upstream. + +Replace builtin_platform_driver_probe with module_platform_driver_probe +because CONFIG_CLK_IMX8QXP can be set to =m (kernel module). + +Fixes: e0d0d4d86c766 ("clk: imx8qxp: Support building i.MX8QXP clock driver as module") +Cc: Fabio Estevam +Cc: Stephen Boyd +Signed-off-by: Miles Chen +Link: https://lore.kernel.org/r/20210904235418.2442-1-miles.chen@mediatek.com +Reviewed-by: Fabio Estevam +Reviewed-by: Stephen Boyd +Signed-off-by: Stephen Boyd +Signed-off-by: Greg Kroah-Hartman +--- + drivers/clk/imx/clk-imx8qxp-lpcg.c | 2 +- + drivers/clk/imx/clk-imx8qxp.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/clk/imx/clk-imx8qxp-lpcg.c ++++ b/drivers/clk/imx/clk-imx8qxp-lpcg.c +@@ -370,7 +370,7 @@ static struct platform_driver imx8qxp_lp + .probe = imx8qxp_lpcg_clk_probe, + }; + +-builtin_platform_driver(imx8qxp_lpcg_clk_driver); ++module_platform_driver(imx8qxp_lpcg_clk_driver); + + MODULE_AUTHOR("Aisheng Dong "); + MODULE_DESCRIPTION("NXP i.MX8QXP LPCG clock driver"); +--- a/drivers/clk/imx/clk-imx8qxp.c ++++ b/drivers/clk/imx/clk-imx8qxp.c +@@ -308,7 +308,7 @@ static struct platform_driver imx8qxp_cl + }, + .probe = imx8qxp_clk_probe, + }; +-builtin_platform_driver(imx8qxp_clk_driver); ++module_platform_driver(imx8qxp_clk_driver); + + MODULE_AUTHOR("Aisheng Dong "); + MODULE_DESCRIPTION("NXP i.MX8QXP clock driver"); diff --git a/queue-5.15/clk-qcom-clk-alpha-pll-don-t-reconfigure-running-trion.patch b/queue-5.15/clk-qcom-clk-alpha-pll-don-t-reconfigure-running-trion.patch new file mode 100644 index 00000000000..f59bfbeb6b7 --- /dev/null +++ b/queue-5.15/clk-qcom-clk-alpha-pll-don-t-reconfigure-running-trion.patch @@ -0,0 +1,49 @@ +From a1f0019c342bd83240b05be68c9888549dde7935 Mon Sep 17 00:00:00 2001 +From: Bjorn Andersson +Date: Tue, 23 Nov 2021 08:25:08 -0800 +Subject: clk: qcom: clk-alpha-pll: Don't reconfigure running Trion + +From: Bjorn Andersson + +commit a1f0019c342bd83240b05be68c9888549dde7935 upstream. + +In the event that the bootloader has configured the Trion PLL as source +for the display clocks, e.g. for the continuous splashscreen, then there +will also be RCGs that are clocked by this instance. + +Reconfiguring, and in particular disabling the output of, the PLL will +cause issues for these downstream RCGs and has been shown to prevent +them from being re-parented. + +Follow downstream and skip configuration if it's determined that the PLL +is already running. + +Fixes: 59128c20a6a9 ("clk: qcom: clk-alpha-pll: Add support for controlling Lucid PLLs") +Signed-off-by: Bjorn Andersson +Reviewed-by: Robert Foss +Reviewed-by: Vinod Koul +Link: https://lore.kernel.org/r/20211123162508.153711-1-bjorn.andersson@linaro.org +Signed-off-by: Stephen Boyd +Signed-off-by: Greg Kroah-Hartman +--- + drivers/clk/qcom/clk-alpha-pll.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/drivers/clk/qcom/clk-alpha-pll.c ++++ b/drivers/clk/qcom/clk-alpha-pll.c +@@ -1429,6 +1429,15 @@ EXPORT_SYMBOL_GPL(clk_alpha_pll_postdiv_ + void clk_trion_pll_configure(struct clk_alpha_pll *pll, struct regmap *regmap, + const struct alpha_pll_config *config) + { ++ /* ++ * If the bootloader left the PLL enabled it's likely that there are ++ * RCGs that will lock up if we disable the PLL below. ++ */ ++ if (trion_pll_is_enabled(pll, regmap)) { ++ pr_debug("Trion PLL is already enabled, skipping configuration\n"); ++ return; ++ } ++ + clk_alpha_pll_write_config(regmap, PLL_L_VAL(pll), config->l); + regmap_write(regmap, PLL_CAL_L_VAL(pll), TRION_PLL_CAL_VAL); + clk_alpha_pll_write_config(regmap, PLL_ALPHA_VAL(pll), config->alpha); diff --git a/queue-5.15/documentation-locking-locktypes-update-migrate_disable-bits.patch b/queue-5.15/documentation-locking-locktypes-update-migrate_disable-bits.patch new file mode 100644 index 00000000000..f5620ecb0cb --- /dev/null +++ b/queue-5.15/documentation-locking-locktypes-update-migrate_disable-bits.patch @@ -0,0 +1,55 @@ +From 6a631c0432dcccbcf45839016a07c015e335e9ae Mon Sep 17 00:00:00 2001 +From: Sebastian Andrzej Siewior +Date: Sat, 27 Nov 2021 17:31:59 +0100 +Subject: Documentation/locking/locktypes: Update migrate_disable() bits. + +From: Sebastian Andrzej Siewior + +commit 6a631c0432dcccbcf45839016a07c015e335e9ae upstream. + +The initial implementation of migrate_disable() for mainline was a +wrapper around preempt_disable(). RT kernels substituted this with +a real migrate disable implementation. + +Later on mainline gained true migrate disable support, but the +documentation was not updated. + +Update the documentation, remove the claims about migrate_disable() +mapping to preempt_disable() on non-PREEMPT_RT kernels. + +Fixes: 74d862b682f51 ("sched: Make migrate_disable/enable() independent of RT") +Signed-off-by: Sebastian Andrzej Siewior +Signed-off-by: Daniel Borkmann +Link: https://lore.kernel.org/bpf/20211127163200.10466-2-bigeasy@linutronix.de +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/locking/locktypes.rst | 9 +++------ + 1 file changed, 3 insertions(+), 6 deletions(-) + +--- a/Documentation/locking/locktypes.rst ++++ b/Documentation/locking/locktypes.rst +@@ -439,11 +439,9 @@ preemption. The following substitution w + spin_lock(&p->lock); + p->count += this_cpu_read(var2); + +-On a non-PREEMPT_RT kernel migrate_disable() maps to preempt_disable() +-which makes the above code fully equivalent. On a PREEMPT_RT kernel + migrate_disable() ensures that the task is pinned on the current CPU which + in turn guarantees that the per-CPU access to var1 and var2 are staying on +-the same CPU. ++the same CPU while the task remains preemptible. + + The migrate_disable() substitution is not valid for the following + scenario:: +@@ -456,9 +454,8 @@ scenario:: + p = this_cpu_ptr(&var1); + p->val = func2(); + +-While correct on a non-PREEMPT_RT kernel, this breaks on PREEMPT_RT because +-here migrate_disable() does not protect against reentrancy from a +-preempting task. A correct substitution for this case is:: ++This breaks because migrate_disable() does not protect against reentrancy from ++a preempting task. A correct substitution for this case is:: + + func() + { diff --git a/queue-5.15/drm-amd-display-fix-dpia-outbox-timeout-after-s3-s4-reset.patch b/queue-5.15/drm-amd-display-fix-dpia-outbox-timeout-after-s3-s4-reset.patch new file mode 100644 index 00000000000..4f86383e0bb --- /dev/null +++ b/queue-5.15/drm-amd-display-fix-dpia-outbox-timeout-after-s3-s4-reset.patch @@ -0,0 +1,55 @@ +From af6902ec415655236adea91826bd96ed0ab16f42 Mon Sep 17 00:00:00 2001 +From: Nicholas Kazlauskas +Date: Tue, 23 Nov 2021 11:56:38 -0500 +Subject: drm/amd/display: Fix DPIA outbox timeout after S3/S4/reset + +From: Nicholas Kazlauskas + +commit af6902ec415655236adea91826bd96ed0ab16f42 upstream. + +[Why] +The HW interrupt gets disabled after S3/S4/reset so we don't receive +notifications for HPD or AUX from DMUB - leading to timeout and +black screen with (or without) DPIA links connected. + +[How] +Re-enable the interrupt after S3/S4/reset like we do for the other +DC interrupts. + +Guard both instances of the outbox interrupt enable or we'll hang +during restore on ASIC that don't support it. + +Fixes: 6eff272dbee7ad ("drm/amd/display: Fix DPIA outbox timeout after GPU reset") + +Reviewed-by: Jude Shih +Acked-by: Pavle Kotarac +Signed-off-by: Nicholas Kazlauskas +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -2213,7 +2213,8 @@ static int dm_resume(void *handle) + if (amdgpu_in_reset(adev)) { + dc_state = dm->cached_dc_state; + +- amdgpu_dm_outbox_init(adev); ++ if (dc_enable_dmub_notifications(adev->dm.dc)) ++ amdgpu_dm_outbox_init(adev); + + r = dm_dmub_hw_init(adev); + if (r) +@@ -2262,6 +2263,10 @@ static int dm_resume(void *handle) + /* TODO: Remove dc_state->dccg, use dc->dccg directly. */ + dc_resource_state_construct(dm->dc, dm_state->context); + ++ /* Re-enable outbox interrupts for DPIA. */ ++ if (dc_enable_dmub_notifications(adev->dm.dc)) ++ amdgpu_dm_outbox_init(adev); ++ + /* Before powering on DC we need to re-initialize DMUB. */ + r = dm_dmub_hw_init(adev); + if (r) diff --git a/queue-5.15/dt-bindings-net-reintroduce-phy-no-lane-swap-binding.patch b/queue-5.15/dt-bindings-net-reintroduce-phy-no-lane-swap-binding.patch new file mode 100644 index 00000000000..afa4beacf26 --- /dev/null +++ b/queue-5.15/dt-bindings-net-reintroduce-phy-no-lane-swap-binding.patch @@ -0,0 +1,45 @@ +From 96db48c9d777a73a33b1d516c5cfed7a417a5f40 Mon Sep 17 00:00:00 2001 +From: Alexander Stein +Date: Tue, 30 Nov 2021 09:27:56 +0100 +Subject: dt-bindings: net: Reintroduce PHY no lane swap binding + +From: Alexander Stein + +commit 96db48c9d777a73a33b1d516c5cfed7a417a5f40 upstream. + +This binding was already documented in phy.txt, commit 252ae5330daa +("Documentation: devicetree: Add PHY no lane swap binding"), but got +accidently removed during YAML conversion in commit d8704342c109 +("dt-bindings: net: Add a YAML schemas for the generic PHY options"). + +Note: 'enet-phy-lane-no-swap' and the absence of 'enet-phy-lane-swap' are +not identical, as the former one disable this feature, while the latter +one doesn't change anything. + +Fixes: d8704342c109 ("dt-bindings: net: Add a YAML schemas for the generic PHY options") +Signed-off-by: Alexander Stein +Reviewed-by: Andrew Lunn +Link: https://lore.kernel.org/r/20211130082756.713919-1-alexander.stein@ew.tq-group.com +Signed-off-by: Rob Herring +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/devicetree/bindings/net/ethernet-phy.yaml | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/Documentation/devicetree/bindings/net/ethernet-phy.yaml ++++ b/Documentation/devicetree/bindings/net/ethernet-phy.yaml +@@ -91,6 +91,14 @@ properties: + compensate for the board being designed with the lanes + swapped. + ++ enet-phy-lane-no-swap: ++ $ref: /schemas/types.yaml#/definitions/flag ++ description: ++ If set, indicates that PHY will disable swap of the ++ TX/RX lanes. This property allows the PHY to work correcly after ++ e.g. wrong bootstrap configuration caused by issues in PCB ++ layout design. ++ + eee-broken-100tx: + $ref: /schemas/types.yaml#/definitions/flag + description: diff --git a/queue-5.15/hwmon-dell-smm-fix-warning-on-proc-i8k-creation-error.patch b/queue-5.15/hwmon-dell-smm-fix-warning-on-proc-i8k-creation-error.patch new file mode 100644 index 00000000000..e38b7b92310 --- /dev/null +++ b/queue-5.15/hwmon-dell-smm-fix-warning-on-proc-i8k-creation-error.patch @@ -0,0 +1,46 @@ +From dbd3e6eaf3d813939b28e8a66e29d81cdc836445 Mon Sep 17 00:00:00 2001 +From: Armin Wolf +Date: Fri, 12 Nov 2021 18:14:40 +0100 +Subject: hwmon: (dell-smm) Fix warning on /proc/i8k creation error +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Armin Wolf + +commit dbd3e6eaf3d813939b28e8a66e29d81cdc836445 upstream. + +The removal function is called regardless of whether +/proc/i8k was created successfully or not, the later +causing a WARN() on module removal. +Fix that by only registering the removal function +if /proc/i8k was created successfully. + +Tested on a Inspiron 3505. + +Fixes: 039ae58503f3 ("hwmon: Allow to compile dell-smm-hwmon driver without /proc/i8k") +Signed-off-by: Armin Wolf +Acked-by: Pali Rohár +Link: https://lore.kernel.org/r/20211112171440.59006-1-W_Armin@gmx.de +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hwmon/dell-smm-hwmon.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +--- a/drivers/hwmon/dell-smm-hwmon.c ++++ b/drivers/hwmon/dell-smm-hwmon.c +@@ -623,10 +623,9 @@ static void __init i8k_init_procfs(struc + { + struct dell_smm_data *data = dev_get_drvdata(dev); + +- /* Register the proc entry */ +- proc_create_data("i8k", 0, NULL, &i8k_proc_ops, data); +- +- devm_add_action_or_reset(dev, i8k_exit_procfs, NULL); ++ /* Only register exit function if creation was successful */ ++ if (proc_create_data("i8k", 0, NULL, &i8k_proc_ops, data)) ++ devm_add_action_or_reset(dev, i8k_exit_procfs, NULL); + } + + #else diff --git a/queue-5.15/i2c-mpc-use-atomic-read-and-fix-break-condition.patch b/queue-5.15/i2c-mpc-use-atomic-read-and-fix-break-condition.patch new file mode 100644 index 00000000000..4fd66ef44bd --- /dev/null +++ b/queue-5.15/i2c-mpc-use-atomic-read-and-fix-break-condition.patch @@ -0,0 +1,39 @@ +From a74c313aca266fab0d1d1a72becbb8b7b5286b6e Mon Sep 17 00:00:00 2001 +From: Chris Packham +Date: Tue, 7 Dec 2021 17:21:44 +1300 +Subject: i2c: mpc: Use atomic read and fix break condition + +From: Chris Packham + +commit a74c313aca266fab0d1d1a72becbb8b7b5286b6e upstream. + +Maxime points out that the polling code in mpc_i2c_isr should use the +_atomic API because it is called in an irq context and that the +behaviour of the MCF bit is that it is 1 when the byte transfer is +complete. All of this means the original code was effectively a +udelay(100). + +Fix this by using readb_poll_timeout_atomic() and removing the negation +of the break condition. + +Fixes: 4a8ac5e45cda ("i2c: mpc: Poll for MCF") +Reported-by: Maxime Bizon +Signed-off-by: Chris Packham +Tested-by: Maxime Bizon +Signed-off-by: Wolfram Sang +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i2c/busses/i2c-mpc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/i2c/busses/i2c-mpc.c ++++ b/drivers/i2c/busses/i2c-mpc.c +@@ -636,7 +636,7 @@ static irqreturn_t mpc_i2c_isr(int irq, + status = readb(i2c->base + MPC_I2C_SR); + if (status & CSR_MIF) { + /* Wait up to 100us for transfer to properly complete */ +- readb_poll_timeout(i2c->base + MPC_I2C_SR, status, !(status & CSR_MCF), 0, 100); ++ readb_poll_timeout_atomic(i2c->base + MPC_I2C_SR, status, status & CSR_MCF, 0, 100); + writeb(0, i2c->base + MPC_I2C_SR); + mpc_i2c_do_intr(i2c, status); + return IRQ_HANDLED; diff --git a/queue-5.15/i40e-fix-failed-opcode-appearing-if-handling-messages-from-vf.patch b/queue-5.15/i40e-fix-failed-opcode-appearing-if-handling-messages-from-vf.patch new file mode 100644 index 00000000000..0d83e14420a --- /dev/null +++ b/queue-5.15/i40e-fix-failed-opcode-appearing-if-handling-messages-from-vf.patch @@ -0,0 +1,258 @@ +From 61125b8be85dfbc7e9c7fe1cc6c6d631ab603516 Mon Sep 17 00:00:00 2001 +From: Karen Sornek +Date: Fri, 14 May 2021 11:43:13 +0200 +Subject: i40e: Fix failed opcode appearing if handling messages from VF + +From: Karen Sornek + +commit 61125b8be85dfbc7e9c7fe1cc6c6d631ab603516 upstream. + +Fix failed operation code appearing if handling messages from VF. +Implemented by waiting for VF appropriate state if request starts +handle while VF reset. +Without this patch the message handling request while VF is in +a reset state ends with error -5 (I40E_ERR_PARAM). + +Fixes: 5c3c48ac6bf5 ("i40e: implement virtual device interface") +Signed-off-by: Grzegorz Szczurek +Signed-off-by: Karen Sornek +Tested-by: Tony Brelinski +Signed-off-by: Tony Nguyen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 70 ++++++++++++++------- + drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h | 2 + 2 files changed, 50 insertions(+), 22 deletions(-) + +--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +@@ -1949,6 +1949,32 @@ static int i40e_vc_send_resp_to_vf(struc + } + + /** ++ * i40e_sync_vf_state ++ * @vf: pointer to the VF info ++ * @state: VF state ++ * ++ * Called from a VF message to synchronize the service with a potential ++ * VF reset state ++ **/ ++static bool i40e_sync_vf_state(struct i40e_vf *vf, enum i40e_vf_states state) ++{ ++ int i; ++ ++ /* When handling some messages, it needs VF state to be set. ++ * It is possible that this flag is cleared during VF reset, ++ * so there is a need to wait until the end of the reset to ++ * handle the request message correctly. ++ */ ++ for (i = 0; i < I40E_VF_STATE_WAIT_COUNT; i++) { ++ if (test_bit(state, &vf->vf_states)) ++ return true; ++ usleep_range(10000, 20000); ++ } ++ ++ return test_bit(state, &vf->vf_states); ++} ++ ++/** + * i40e_vc_get_version_msg + * @vf: pointer to the VF info + * @msg: pointer to the msg buffer +@@ -2008,7 +2034,7 @@ static int i40e_vc_get_vf_resources_msg( + size_t len = 0; + int ret; + +- if (!test_bit(I40E_VF_STATE_INIT, &vf->vf_states)) { ++ if (!i40e_sync_vf_state(vf, I40E_VF_STATE_INIT)) { + aq_ret = I40E_ERR_PARAM; + goto err; + } +@@ -2131,7 +2157,7 @@ static int i40e_vc_config_promiscuous_mo + bool allmulti = false; + bool alluni = false; + +- if (!test_bit(I40E_VF_STATE_ACTIVE, &vf->vf_states)) { ++ if (!i40e_sync_vf_state(vf, I40E_VF_STATE_ACTIVE)) { + aq_ret = I40E_ERR_PARAM; + goto err_out; + } +@@ -2219,7 +2245,7 @@ static int i40e_vc_config_queues_msg(str + struct i40e_vsi *vsi; + u16 num_qps_all = 0; + +- if (!test_bit(I40E_VF_STATE_ACTIVE, &vf->vf_states)) { ++ if (!i40e_sync_vf_state(vf, I40E_VF_STATE_ACTIVE)) { + aq_ret = I40E_ERR_PARAM; + goto error_param; + } +@@ -2368,7 +2394,7 @@ static int i40e_vc_config_irq_map_msg(st + i40e_status aq_ret = 0; + int i; + +- if (!test_bit(I40E_VF_STATE_ACTIVE, &vf->vf_states)) { ++ if (!i40e_sync_vf_state(vf, I40E_VF_STATE_ACTIVE)) { + aq_ret = I40E_ERR_PARAM; + goto error_param; + } +@@ -2540,7 +2566,7 @@ static int i40e_vc_disable_queues_msg(st + struct i40e_pf *pf = vf->pf; + i40e_status aq_ret = 0; + +- if (!test_bit(I40E_VF_STATE_ACTIVE, &vf->vf_states)) { ++ if (!i40e_sync_vf_state(vf, I40E_VF_STATE_ACTIVE)) { + aq_ret = I40E_ERR_PARAM; + goto error_param; + } +@@ -2590,7 +2616,7 @@ static int i40e_vc_request_queues_msg(st + u8 cur_pairs = vf->num_queue_pairs; + struct i40e_pf *pf = vf->pf; + +- if (!test_bit(I40E_VF_STATE_ACTIVE, &vf->vf_states)) ++ if (!i40e_sync_vf_state(vf, I40E_VF_STATE_ACTIVE)) + return -EINVAL; + + if (req_pairs > I40E_MAX_VF_QUEUES) { +@@ -2635,7 +2661,7 @@ static int i40e_vc_get_stats_msg(struct + + memset(&stats, 0, sizeof(struct i40e_eth_stats)); + +- if (!test_bit(I40E_VF_STATE_ACTIVE, &vf->vf_states)) { ++ if (!i40e_sync_vf_state(vf, I40E_VF_STATE_ACTIVE)) { + aq_ret = I40E_ERR_PARAM; + goto error_param; + } +@@ -2752,7 +2778,7 @@ static int i40e_vc_add_mac_addr_msg(stru + i40e_status ret = 0; + int i; + +- if (!test_bit(I40E_VF_STATE_ACTIVE, &vf->vf_states) || ++ if (!i40e_sync_vf_state(vf, I40E_VF_STATE_ACTIVE) || + !i40e_vc_isvalid_vsi_id(vf, al->vsi_id)) { + ret = I40E_ERR_PARAM; + goto error_param; +@@ -2824,7 +2850,7 @@ static int i40e_vc_del_mac_addr_msg(stru + i40e_status ret = 0; + int i; + +- if (!test_bit(I40E_VF_STATE_ACTIVE, &vf->vf_states) || ++ if (!i40e_sync_vf_state(vf, I40E_VF_STATE_ACTIVE) || + !i40e_vc_isvalid_vsi_id(vf, al->vsi_id)) { + ret = I40E_ERR_PARAM; + goto error_param; +@@ -2968,7 +2994,7 @@ static int i40e_vc_remove_vlan_msg(struc + i40e_status aq_ret = 0; + int i; + +- if (!test_bit(I40E_VF_STATE_ACTIVE, &vf->vf_states) || ++ if (!i40e_sync_vf_state(vf, I40E_VF_STATE_ACTIVE) || + !i40e_vc_isvalid_vsi_id(vf, vfl->vsi_id)) { + aq_ret = I40E_ERR_PARAM; + goto error_param; +@@ -3088,9 +3114,9 @@ static int i40e_vc_config_rss_key(struct + struct i40e_vsi *vsi = NULL; + i40e_status aq_ret = 0; + +- if (!test_bit(I40E_VF_STATE_ACTIVE, &vf->vf_states) || ++ if (!i40e_sync_vf_state(vf, I40E_VF_STATE_ACTIVE) || + !i40e_vc_isvalid_vsi_id(vf, vrk->vsi_id) || +- (vrk->key_len != I40E_HKEY_ARRAY_SIZE)) { ++ vrk->key_len != I40E_HKEY_ARRAY_SIZE) { + aq_ret = I40E_ERR_PARAM; + goto err; + } +@@ -3119,9 +3145,9 @@ static int i40e_vc_config_rss_lut(struct + i40e_status aq_ret = 0; + u16 i; + +- if (!test_bit(I40E_VF_STATE_ACTIVE, &vf->vf_states) || ++ if (!i40e_sync_vf_state(vf, I40E_VF_STATE_ACTIVE) || + !i40e_vc_isvalid_vsi_id(vf, vrl->vsi_id) || +- (vrl->lut_entries != I40E_VF_HLUT_ARRAY_SIZE)) { ++ vrl->lut_entries != I40E_VF_HLUT_ARRAY_SIZE) { + aq_ret = I40E_ERR_PARAM; + goto err; + } +@@ -3154,7 +3180,7 @@ static int i40e_vc_get_rss_hena(struct i + i40e_status aq_ret = 0; + int len = 0; + +- if (!test_bit(I40E_VF_STATE_ACTIVE, &vf->vf_states)) { ++ if (!i40e_sync_vf_state(vf, I40E_VF_STATE_ACTIVE)) { + aq_ret = I40E_ERR_PARAM; + goto err; + } +@@ -3190,7 +3216,7 @@ static int i40e_vc_set_rss_hena(struct i + struct i40e_hw *hw = &pf->hw; + i40e_status aq_ret = 0; + +- if (!test_bit(I40E_VF_STATE_ACTIVE, &vf->vf_states)) { ++ if (!i40e_sync_vf_state(vf, I40E_VF_STATE_ACTIVE)) { + aq_ret = I40E_ERR_PARAM; + goto err; + } +@@ -3215,7 +3241,7 @@ static int i40e_vc_enable_vlan_stripping + i40e_status aq_ret = 0; + struct i40e_vsi *vsi; + +- if (!test_bit(I40E_VF_STATE_ACTIVE, &vf->vf_states)) { ++ if (!i40e_sync_vf_state(vf, I40E_VF_STATE_ACTIVE)) { + aq_ret = I40E_ERR_PARAM; + goto err; + } +@@ -3241,7 +3267,7 @@ static int i40e_vc_disable_vlan_strippin + i40e_status aq_ret = 0; + struct i40e_vsi *vsi; + +- if (!test_bit(I40E_VF_STATE_ACTIVE, &vf->vf_states)) { ++ if (!i40e_sync_vf_state(vf, I40E_VF_STATE_ACTIVE)) { + aq_ret = I40E_ERR_PARAM; + goto err; + } +@@ -3468,7 +3494,7 @@ static int i40e_vc_del_cloud_filter(stru + i40e_status aq_ret = 0; + int i, ret; + +- if (!test_bit(I40E_VF_STATE_ACTIVE, &vf->vf_states)) { ++ if (!i40e_sync_vf_state(vf, I40E_VF_STATE_ACTIVE)) { + aq_ret = I40E_ERR_PARAM; + goto err; + } +@@ -3599,7 +3625,7 @@ static int i40e_vc_add_cloud_filter(stru + i40e_status aq_ret = 0; + int i, ret; + +- if (!test_bit(I40E_VF_STATE_ACTIVE, &vf->vf_states)) { ++ if (!i40e_sync_vf_state(vf, I40E_VF_STATE_ACTIVE)) { + aq_ret = I40E_ERR_PARAM; + goto err_out; + } +@@ -3708,7 +3734,7 @@ static int i40e_vc_add_qch_msg(struct i4 + i40e_status aq_ret = 0; + u64 speed = 0; + +- if (!test_bit(I40E_VF_STATE_ACTIVE, &vf->vf_states)) { ++ if (!i40e_sync_vf_state(vf, I40E_VF_STATE_ACTIVE)) { + aq_ret = I40E_ERR_PARAM; + goto err; + } +@@ -3824,7 +3850,7 @@ static int i40e_vc_del_qch_msg(struct i4 + struct i40e_pf *pf = vf->pf; + i40e_status aq_ret = 0; + +- if (!test_bit(I40E_VF_STATE_ACTIVE, &vf->vf_states)) { ++ if (!i40e_sync_vf_state(vf, I40E_VF_STATE_ACTIVE)) { + aq_ret = I40E_ERR_PARAM; + goto err; + } +--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h ++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h +@@ -18,6 +18,8 @@ + + #define I40E_MAX_VF_PROMISC_FLAGS 3 + ++#define I40E_VF_STATE_WAIT_COUNT 20 ++ + /* Various queue ctrls */ + enum i40e_queue_ctrl { + I40E_QUEUE_CTRL_UNKNOWN = 0, diff --git a/queue-5.15/i40e-fix-null-pointer-dereference-in-i40e_dbg_dump_desc.patch b/queue-5.15/i40e-fix-null-pointer-dereference-in-i40e_dbg_dump_desc.patch new file mode 100644 index 00000000000..30bb3df30ac --- /dev/null +++ b/queue-5.15/i40e-fix-null-pointer-dereference-in-i40e_dbg_dump_desc.patch @@ -0,0 +1,43 @@ +From 23ec111bf3549aae37140330c31a16abfc172421 Mon Sep 17 00:00:00 2001 +From: Norbert Zulinski +Date: Mon, 22 Nov 2021 12:29:05 +0100 +Subject: i40e: Fix NULL pointer dereference in i40e_dbg_dump_desc + +From: Norbert Zulinski + +commit 23ec111bf3549aae37140330c31a16abfc172421 upstream. + +When trying to dump VFs VSI RX/TX descriptors +using debugfs there was a crash +due to NULL pointer dereference in i40e_dbg_dump_desc. +Added a check to i40e_dbg_dump_desc that checks if +VSI type is correct for dumping RX/TX descriptors. + +Fixes: 02e9c290814c ("i40e: debugfs interface") +Signed-off-by: Sylwester Dziedziuch +Signed-off-by: Norbert Zulinski +Signed-off-by: Mateusz Palczewski +Tested-by: Gurucharan G +Signed-off-by: Tony Nguyen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/i40e/i40e_debugfs.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/drivers/net/ethernet/intel/i40e/i40e_debugfs.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_debugfs.c +@@ -553,6 +553,14 @@ static void i40e_dbg_dump_desc(int cnt, + dev_info(&pf->pdev->dev, "vsi %d not found\n", vsi_seid); + return; + } ++ if (vsi->type != I40E_VSI_MAIN && ++ vsi->type != I40E_VSI_FDIR && ++ vsi->type != I40E_VSI_VMDQ2) { ++ dev_info(&pf->pdev->dev, ++ "vsi %d type %d descriptor rings not available\n", ++ vsi_seid, vsi->type); ++ return; ++ } + if (type == RING_TYPE_XDP && !i40e_enabled_xdp_vsi(vsi)) { + dev_info(&pf->pdev->dev, "XDP not enabled on VSI %d\n", vsi_seid); + return; diff --git a/queue-5.15/i40e-fix-pre-set-max-number-of-queues-for-vf.patch b/queue-5.15/i40e-fix-pre-set-max-number-of-queues-for-vf.patch new file mode 100644 index 00000000000..458498e4749 --- /dev/null +++ b/queue-5.15/i40e-fix-pre-set-max-number-of-queues-for-vf.patch @@ -0,0 +1,38 @@ +From 8aa55ab422d9d0d825ebfb877702ed661e96e682 Mon Sep 17 00:00:00 2001 +From: Mateusz Palczewski +Date: Fri, 16 Jul 2021 11:33:56 +0200 +Subject: i40e: Fix pre-set max number of queues for VF + +From: Mateusz Palczewski + +commit 8aa55ab422d9d0d825ebfb877702ed661e96e682 upstream. + +After setting pre-set combined to 16 queues and reserving 16 queues by +tc qdisc, pre-set maximum combined queues returned to default value +after VF reset being 4 and this generated errors during removing tc. +Fixed by removing clear num_req_queues before reset VF. + +Fixes: e284fc280473 (i40e: Add and delete cloud filter) +Signed-off-by: Grzegorz Szczurek +Signed-off-by: Mateusz Palczewski +Tested-by: Bindushree P +Signed-off-by: Tony Nguyen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 5 ----- + 1 file changed, 5 deletions(-) + +--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +@@ -3823,11 +3823,6 @@ static int i40e_vc_add_qch_msg(struct i4 + + /* set this flag only after making sure all inputs are sane */ + vf->adq_enabled = true; +- /* num_req_queues is set when user changes number of queues via ethtool +- * and this causes issue for default VSI(which depends on this variable) +- * when ADq is enabled, hence reset it. +- */ +- vf->num_req_queues = 0; + + /* reset the VF in order to allocate resources */ + i40e_vc_reset_vf(vf, true); diff --git a/queue-5.15/mtd-rawnand-fsmc-fix-timing-computation.patch b/queue-5.15/mtd-rawnand-fsmc-fix-timing-computation.patch new file mode 100644 index 00000000000..7b68edd5862 --- /dev/null +++ b/queue-5.15/mtd-rawnand-fsmc-fix-timing-computation.patch @@ -0,0 +1,106 @@ +From 9472335eaa1452b51dc8e8edaa1a342997cb80c7 Mon Sep 17 00:00:00 2001 +From: Herve Codina +Date: Fri, 19 Nov 2021 16:03:16 +0100 +Subject: mtd: rawnand: fsmc: Fix timing computation + +From: Herve Codina + +commit 9472335eaa1452b51dc8e8edaa1a342997cb80c7 upstream. + +Under certain circumstances, the timing settings calculated by +the FSMC NAND controller driver were inaccurate. +These settings led to incorrect data reads or fallback to +timing mode 0 depending on the NAND chip used. + +The timing computation did not take into account the following +constraint given in SPEAr3xx reference manual: + twait >= tCEA - (tset * TCLK) + TOUTDEL + TINDEL + +Enhance the timings calculation by taking into account this +additional constraint. + +This change has no impact on slow timing modes such as mode 0. +Indeed, on mode 0, computed values are the same with and +without the patch. + +NANDs which previously stayed in mode 0 because of fallback to +mode 0 can now work at higher speeds and NANDs which were not +working at all because of the corrupted data work at high +speeds without troubles. + +Overall improvement on a Micron/MT29F1G08 (flash_speed tool): + mode0 mode3 +eraseblock write speed 3220 KiB/s 4511 KiB/s +eraseblock read speed 4491 KiB/s 7529 KiB/s + +Fixes: d9fb079571833 ("mtd: nand: fsmc: add support for SDR timings") +Signed-off-by: Herve Codina +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20211119150316.43080-5-herve.codina@bootlin.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mtd/nand/raw/fsmc_nand.c | 32 ++++++++++++++++++++++++-------- + 1 file changed, 24 insertions(+), 8 deletions(-) + +--- a/drivers/mtd/nand/raw/fsmc_nand.c ++++ b/drivers/mtd/nand/raw/fsmc_nand.c +@@ -94,6 +94,14 @@ + + #define FSMC_BUSY_WAIT_TIMEOUT (1 * HZ) + ++/* ++ * According to SPEAr300 Reference Manual (RM0082) ++ * TOUDEL = 7ns (Output delay from the flip-flops to the board) ++ * TINDEL = 5ns (Input delay from the board to the flipflop) ++ */ ++#define TOUTDEL 7000 ++#define TINDEL 5000 ++ + struct fsmc_nand_timings { + u8 tclr; + u8 tar; +@@ -278,7 +286,7 @@ static int fsmc_calc_timings(struct fsmc + { + unsigned long hclk = clk_get_rate(host->clk); + unsigned long hclkn = NSEC_PER_SEC / hclk; +- u32 thiz, thold, twait, tset; ++ u32 thiz, thold, twait, tset, twait_min; + + if (sdrt->tRC_min < 30000) + return -EOPNOTSUPP; +@@ -310,13 +318,6 @@ static int fsmc_calc_timings(struct fsmc + else if (tims->thold > FSMC_THOLD_MASK) + tims->thold = FSMC_THOLD_MASK; + +- twait = max(sdrt->tRP_min, sdrt->tWP_min); +- tims->twait = DIV_ROUND_UP(twait / 1000, hclkn) - 1; +- if (tims->twait == 0) +- tims->twait = 1; +- else if (tims->twait > FSMC_TWAIT_MASK) +- tims->twait = FSMC_TWAIT_MASK; +- + tset = max(sdrt->tCS_min - sdrt->tWP_min, + sdrt->tCEA_max - sdrt->tREA_max); + tims->tset = DIV_ROUND_UP(tset / 1000, hclkn) - 1; +@@ -325,6 +326,21 @@ static int fsmc_calc_timings(struct fsmc + else if (tims->tset > FSMC_TSET_MASK) + tims->tset = FSMC_TSET_MASK; + ++ /* ++ * According to SPEAr300 Reference Manual (RM0082) which gives more ++ * information related to FSMSC timings than the SPEAr600 one (RM0305), ++ * twait >= tCEA - (tset * TCLK) + TOUTDEL + TINDEL ++ */ ++ twait_min = sdrt->tCEA_max - ((tims->tset + 1) * hclkn * 1000) ++ + TOUTDEL + TINDEL; ++ twait = max3(sdrt->tRP_min, sdrt->tWP_min, twait_min); ++ ++ tims->twait = DIV_ROUND_UP(twait / 1000, hclkn) - 1; ++ if (tims->twait == 0) ++ tims->twait = 1; ++ else if (tims->twait > FSMC_TWAIT_MASK) ++ tims->twait = FSMC_TWAIT_MASK; ++ + return 0; + } + diff --git a/queue-5.15/mtd-rawnand-fsmc-take-instruction-delay-into-account.patch b/queue-5.15/mtd-rawnand-fsmc-take-instruction-delay-into-account.patch new file mode 100644 index 00000000000..ccf22c0c91c --- /dev/null +++ b/queue-5.15/mtd-rawnand-fsmc-take-instruction-delay-into-account.patch @@ -0,0 +1,44 @@ +From a4ca0c439f2d5ce9a3dc118d882f9f03449864c8 Mon Sep 17 00:00:00 2001 +From: Herve Codina +Date: Fri, 19 Nov 2021 16:03:15 +0100 +Subject: mtd: rawnand: fsmc: Take instruction delay into account + +From: Herve Codina + +commit a4ca0c439f2d5ce9a3dc118d882f9f03449864c8 upstream. + +The FSMC NAND controller should apply a delay after the +instruction has been issued on the bus. +The FSMC NAND controller driver did not handle this delay. + +Add this waiting delay in the FSMC NAND controller driver. + +Fixes: 4da712e70294 ("mtd: nand: fsmc: use ->exec_op()") +Signed-off-by: Herve Codina +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20211119150316.43080-4-herve.codina@bootlin.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mtd/nand/raw/fsmc_nand.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/mtd/nand/raw/fsmc_nand.c ++++ b/drivers/mtd/nand/raw/fsmc_nand.c +@@ -15,6 +15,7 @@ + + #include + #include ++#include + #include + #include + #include +@@ -664,6 +665,9 @@ static int fsmc_exec_op(struct nand_chip + instr->ctx.waitrdy.timeout_ms); + break; + } ++ ++ if (instr->delay_ns) ++ ndelay(instr->delay_ns); + } + + return ret; diff --git a/queue-5.15/net-altera-set-a-couple-error-code-in-probe.patch b/queue-5.15/net-altera-set-a-couple-error-code-in-probe.patch new file mode 100644 index 00000000000..1f8d10c5b04 --- /dev/null +++ b/queue-5.15/net-altera-set-a-couple-error-code-in-probe.patch @@ -0,0 +1,45 @@ +From badd7857f5c933a3dc34942a2c11d67fdbdc24de Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Fri, 3 Dec 2021 13:11:28 +0300 +Subject: net: altera: set a couple error code in probe() + +From: Dan Carpenter + +commit badd7857f5c933a3dc34942a2c11d67fdbdc24de upstream. + +There are two error paths which accidentally return success instead of +a negative error code. + +Fixes: bbd2190ce96d ("Altera TSE: Add main and header file for Altera Ethernet Driver") +Signed-off-by: Dan Carpenter +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/altera/altera_tse_main.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +--- a/drivers/net/ethernet/altera/altera_tse_main.c ++++ b/drivers/net/ethernet/altera/altera_tse_main.c +@@ -1430,16 +1430,19 @@ static int altera_tse_probe(struct platf + priv->rxdescmem_busaddr = dma_res->start; + + } else { ++ ret = -ENODEV; + goto err_free_netdev; + } + +- if (!dma_set_mask(priv->device, DMA_BIT_MASK(priv->dmaops->dmamask))) ++ if (!dma_set_mask(priv->device, DMA_BIT_MASK(priv->dmaops->dmamask))) { + dma_set_coherent_mask(priv->device, + DMA_BIT_MASK(priv->dmaops->dmamask)); +- else if (!dma_set_mask(priv->device, DMA_BIT_MASK(32))) ++ } else if (!dma_set_mask(priv->device, DMA_BIT_MASK(32))) { + dma_set_coherent_mask(priv->device, DMA_BIT_MASK(32)); +- else ++ } else { ++ ret = -EIO; + goto err_free_netdev; ++ } + + /* MAC address space */ + ret = request_and_map(pdev, "control_port", &control_port, diff --git a/queue-5.15/net-cdc_ncm-allow-for-dwntboutmaxsize-to-be-unset-or-zero.patch b/queue-5.15/net-cdc_ncm-allow-for-dwntboutmaxsize-to-be-unset-or-zero.patch new file mode 100644 index 00000000000..7ade1cc5d2b --- /dev/null +++ b/queue-5.15/net-cdc_ncm-allow-for-dwntboutmaxsize-to-be-unset-or-zero.patch @@ -0,0 +1,73 @@ +From 2be6d4d16a0849455a5c22490e3c5983495fed00 Mon Sep 17 00:00:00 2001 +From: Lee Jones +Date: Thu, 2 Dec 2021 14:34:37 +0000 +Subject: net: cdc_ncm: Allow for dwNtbOutMaxSize to be unset or zero +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Lee Jones + +commit 2be6d4d16a0849455a5c22490e3c5983495fed00 upstream. + +Currently, due to the sequential use of min_t() and clamp_t() macros, +in cdc_ncm_check_tx_max(), if dwNtbOutMaxSize is not set, the logic +sets tx_max to 0. This is then used to allocate the data area of the +SKB requested later in cdc_ncm_fill_tx_frame(). + +This does not cause an issue presently because when memory is +allocated during initialisation phase of SKB creation, more memory +(512b) is allocated than is required for the SKB headers alone (320b), +leaving some space (512b - 320b = 192b) for CDC data (172b). + +However, if more elements (for example 3 x u64 = [24b]) were added to +one of the SKB header structs, say 'struct skb_shared_info', +increasing its original size (320b [320b aligned]) to something larger +(344b [384b aligned]), then suddenly the CDC data (172b) no longer +fits in the spare SKB data area (512b - 384b = 128b). + +Consequently the SKB bounds checking semantics fails and panics: + + skbuff: skb_over_panic: text:ffffffff830a5b5f len:184 put:172 \ + head:ffff888119227c00 data:ffff888119227c00 tail:0xb8 end:0x80 dev: + + ------------[ cut here ]------------ + kernel BUG at net/core/skbuff.c:110! + RIP: 0010:skb_panic+0x14f/0x160 net/core/skbuff.c:106 + + Call Trace: + + skb_over_panic+0x2c/0x30 net/core/skbuff.c:115 + skb_put+0x205/0x210 net/core/skbuff.c:1877 + skb_put_zero include/linux/skbuff.h:2270 [inline] + cdc_ncm_ndp16 drivers/net/usb/cdc_ncm.c:1116 [inline] + cdc_ncm_fill_tx_frame+0x127f/0x3d50 drivers/net/usb/cdc_ncm.c:1293 + cdc_ncm_tx_fixup+0x98/0xf0 drivers/net/usb/cdc_ncm.c:1514 + +By overriding the max value with the default CDC_NCM_NTB_MAX_SIZE_TX +when not offered through the system provided params, we ensure enough +data space is allocated to handle the CDC data, meaning no crash will +occur. + +Cc: Oliver Neukum +Fixes: 289507d3364f9 ("net: cdc_ncm: use sysfs for rx/tx aggregation tuning") +Signed-off-by: Lee Jones +Reviewed-by: Bjørn Mork +Link: https://lore.kernel.org/r/20211202143437.1411410-1-lee.jones@linaro.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/usb/cdc_ncm.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/net/usb/cdc_ncm.c ++++ b/drivers/net/usb/cdc_ncm.c +@@ -181,6 +181,8 @@ static u32 cdc_ncm_check_tx_max(struct u + min = ctx->max_datagram_size + ctx->max_ndp_size + sizeof(struct usb_cdc_ncm_nth32); + + max = min_t(u32, CDC_NCM_NTB_MAX_SIZE_TX, le32_to_cpu(ctx->ncm_parm.dwNtbOutMaxSize)); ++ if (max == 0) ++ max = CDC_NCM_NTB_MAX_SIZE_TX; /* dwNtbOutMaxSize not set */ + + /* some devices set dwNtbOutMaxSize too low for the above default */ + min = min(min, max); diff --git a/queue-5.15/net-fec-only-clear-interrupt-of-handling-queue-in-fec_enet_rx_queue.patch b/queue-5.15/net-fec-only-clear-interrupt-of-handling-queue-in-fec_enet_rx_queue.patch new file mode 100644 index 00000000000..9928b91d27a --- /dev/null +++ b/queue-5.15/net-fec-only-clear-interrupt-of-handling-queue-in-fec_enet_rx_queue.patch @@ -0,0 +1,61 @@ +From b5bd95d17102b6719e3531d627875b9690371383 Mon Sep 17 00:00:00 2001 +From: Joakim Zhang +Date: Mon, 6 Dec 2021 21:54:57 +0800 +Subject: net: fec: only clear interrupt of handling queue in fec_enet_rx_queue() + +From: Joakim Zhang + +commit b5bd95d17102b6719e3531d627875b9690371383 upstream. + +Background: +We have a customer is running a Profinet stack on the 8MM which receives and +responds PNIO packets every 4ms and PNIO-CM packets every 40ms. However, from +time to time the received PNIO-CM package is "stock" and is only handled when +receiving a new PNIO-CM or DCERPC-Ping packet (tcpdump shows the PNIO-CM and +the DCERPC-Ping packet at the same time but the PNIO-CM HW timestamp is from +the expected 40 ms and not the 2s delay of the DCERPC-Ping). + +After debugging, we noticed PNIO, PNIO-CM and DCERPC-Ping packets would +be handled by different RX queues. + +The root cause should be driver ack all queues' interrupt when handle a +specific queue in fec_enet_rx_queue(). The blamed patch is introduced to +receive as much packets as possible once to avoid interrupt flooding. +But it's unreasonable to clear other queues'interrupt when handling one +queue, this patch tries to fix it. + +Fixes: ed63f1dcd578 (net: fec: clear receive interrupts before processing a packet) +Cc: Russell King +Reported-by: Nicolas Diaz +Signed-off-by: Joakim Zhang +Link: https://lore.kernel.org/r/20211206135457.15946-1-qiangqing.zhang@nxp.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/freescale/fec.h | 3 +++ + drivers/net/ethernet/freescale/fec_main.c | 2 +- + 2 files changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/freescale/fec.h ++++ b/drivers/net/ethernet/freescale/fec.h +@@ -377,6 +377,9 @@ struct bufdesc_ex { + #define FEC_ENET_WAKEUP ((uint)0x00020000) /* Wakeup request */ + #define FEC_ENET_TXF (FEC_ENET_TXF_0 | FEC_ENET_TXF_1 | FEC_ENET_TXF_2) + #define FEC_ENET_RXF (FEC_ENET_RXF_0 | FEC_ENET_RXF_1 | FEC_ENET_RXF_2) ++#define FEC_ENET_RXF_GET(X) (((X) == 0) ? FEC_ENET_RXF_0 : \ ++ (((X) == 1) ? FEC_ENET_RXF_1 : \ ++ FEC_ENET_RXF_2)) + #define FEC_ENET_TS_AVAIL ((uint)0x00010000) + #define FEC_ENET_TS_TIMER ((uint)0x00008000) + +--- a/drivers/net/ethernet/freescale/fec_main.c ++++ b/drivers/net/ethernet/freescale/fec_main.c +@@ -1480,7 +1480,7 @@ fec_enet_rx_queue(struct net_device *nde + break; + pkt_received++; + +- writel(FEC_ENET_RXF, fep->hwp + FEC_IEVENT); ++ writel(FEC_ENET_RXF_GET(queue_id), fep->hwp + FEC_IEVENT); + + /* Check for errors. */ + status ^= BD_ENET_RX_LAST; diff --git a/queue-5.15/net-neigh-clear-whole-pneigh_entry-at-alloc-time.patch b/queue-5.15/net-neigh-clear-whole-pneigh_entry-at-alloc-time.patch new file mode 100644 index 00000000000..0b347f69ddb --- /dev/null +++ b/queue-5.15/net-neigh-clear-whole-pneigh_entry-at-alloc-time.patch @@ -0,0 +1,97 @@ +From e195e9b5dee6459d8c8e6a314cc71a644a0537fd Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Mon, 6 Dec 2021 08:53:29 -0800 +Subject: net, neigh: clear whole pneigh_entry at alloc time + +From: Eric Dumazet + +commit e195e9b5dee6459d8c8e6a314cc71a644a0537fd upstream. + +Commit 2c611ad97a82 ("net, neigh: Extend neigh->flags to 32 bit +to allow for extensions") enables a new KMSAM warning [1] + +I think the bug is actually older, because the following intruction +only occurred if ndm->ndm_flags had NTF_PROXY set. + + pn->flags = ndm->ndm_flags; + +Let's clear all pneigh_entry fields at alloc time. + +[1] +BUG: KMSAN: uninit-value in pneigh_fill_info+0x986/0xb30 net/core/neighbour.c:2593 + pneigh_fill_info+0x986/0xb30 net/core/neighbour.c:2593 + pneigh_dump_table net/core/neighbour.c:2715 [inline] + neigh_dump_info+0x1e3f/0x2c60 net/core/neighbour.c:2832 + netlink_dump+0xaca/0x16a0 net/netlink/af_netlink.c:2265 + __netlink_dump_start+0xd1c/0xee0 net/netlink/af_netlink.c:2370 + netlink_dump_start include/linux/netlink.h:254 [inline] + rtnetlink_rcv_msg+0x181b/0x18c0 net/core/rtnetlink.c:5534 + netlink_rcv_skb+0x447/0x800 net/netlink/af_netlink.c:2491 + rtnetlink_rcv+0x50/0x60 net/core/rtnetlink.c:5589 + netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] + netlink_unicast+0x1095/0x1360 net/netlink/af_netlink.c:1345 + netlink_sendmsg+0x16f3/0x1870 net/netlink/af_netlink.c:1916 + sock_sendmsg_nosec net/socket.c:704 [inline] + sock_sendmsg net/socket.c:724 [inline] + sock_write_iter+0x594/0x690 net/socket.c:1057 + call_write_iter include/linux/fs.h:2162 [inline] + new_sync_write fs/read_write.c:503 [inline] + vfs_write+0x1318/0x2030 fs/read_write.c:590 + ksys_write+0x28c/0x520 fs/read_write.c:643 + __do_sys_write fs/read_write.c:655 [inline] + __se_sys_write fs/read_write.c:652 [inline] + __x64_sys_write+0xdb/0x120 fs/read_write.c:652 + do_syscall_x64 arch/x86/entry/common.c:51 [inline] + do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 + entry_SYSCALL_64_after_hwframe+0x44/0xae + +Uninit was created at: + slab_post_alloc_hook mm/slab.h:524 [inline] + slab_alloc_node mm/slub.c:3251 [inline] + slab_alloc mm/slub.c:3259 [inline] + __kmalloc+0xc3c/0x12d0 mm/slub.c:4437 + kmalloc include/linux/slab.h:595 [inline] + pneigh_lookup+0x60f/0xd70 net/core/neighbour.c:766 + arp_req_set_public net/ipv4/arp.c:1016 [inline] + arp_req_set+0x430/0x10a0 net/ipv4/arp.c:1032 + arp_ioctl+0x8d4/0xb60 net/ipv4/arp.c:1232 + inet_ioctl+0x4ef/0x820 net/ipv4/af_inet.c:947 + sock_do_ioctl net/socket.c:1118 [inline] + sock_ioctl+0xa3f/0x13e0 net/socket.c:1235 + vfs_ioctl fs/ioctl.c:51 [inline] + __do_sys_ioctl fs/ioctl.c:874 [inline] + __se_sys_ioctl+0x2df/0x4a0 fs/ioctl.c:860 + __x64_sys_ioctl+0xd8/0x110 fs/ioctl.c:860 + do_syscall_x64 arch/x86/entry/common.c:51 [inline] + do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 + entry_SYSCALL_64_after_hwframe+0x44/0xae + +CPU: 1 PID: 20001 Comm: syz-executor.0 Not tainted 5.16.0-rc3-syzkaller #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 + +Fixes: 62dd93181aaa ("[IPV6] NDISC: Set per-entry is_router flag in Proxy NA.") +Signed-off-by: Eric Dumazet +Cc: Roopa Prabhu +Reviewed-by: David Ahern +Link: https://lore.kernel.org/r/20211206165329.1049835-1-eric.dumazet@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/core/neighbour.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/net/core/neighbour.c ++++ b/net/core/neighbour.c +@@ -733,11 +733,10 @@ struct pneigh_entry * pneigh_lookup(stru + + ASSERT_RTNL(); + +- n = kmalloc(sizeof(*n) + key_len, GFP_KERNEL); ++ n = kzalloc(sizeof(*n) + key_len, GFP_KERNEL); + if (!n) + goto out; + +- n->protocol = 0; + write_pnet(&n->net, net); + memcpy(n->key, pkey, key_len); + n->dev = dev; diff --git a/queue-5.15/net-qla3xxx-fix-an-error-code-in-ql_adapter_up.patch b/queue-5.15/net-qla3xxx-fix-an-error-code-in-ql_adapter_up.patch new file mode 100644 index 00000000000..d576727d62d --- /dev/null +++ b/queue-5.15/net-qla3xxx-fix-an-error-code-in-ql_adapter_up.patch @@ -0,0 +1,57 @@ +From d17b9737c2bc09b4ac6caf469826e5a7ce3ffab7 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Tue, 7 Dec 2021 11:24:16 +0300 +Subject: net/qla3xxx: fix an error code in ql_adapter_up() + +From: Dan Carpenter + +commit d17b9737c2bc09b4ac6caf469826e5a7ce3ffab7 upstream. + +The ql_wait_for_drvr_lock() fails and returns false, then this +function should return an error code instead of returning success. + +The other problem is that the success path prints an error message +netdev_err(ndev, "Releasing driver lock\n"); Delete that and +re-order the code a little to make it more clear. + +Fixes: 5a4faa873782 ("[PATCH] qla3xxx NIC driver") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/20211207082416.GA16110@kili +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/qlogic/qla3xxx.c | 19 +++++++++---------- + 1 file changed, 9 insertions(+), 10 deletions(-) + +--- a/drivers/net/ethernet/qlogic/qla3xxx.c ++++ b/drivers/net/ethernet/qlogic/qla3xxx.c +@@ -3478,20 +3478,19 @@ static int ql_adapter_up(struct ql3_adap + + spin_lock_irqsave(&qdev->hw_lock, hw_flags); + +- err = ql_wait_for_drvr_lock(qdev); +- if (err) { +- err = ql_adapter_initialize(qdev); +- if (err) { +- netdev_err(ndev, "Unable to initialize adapter\n"); +- goto err_init; +- } +- netdev_err(ndev, "Releasing driver lock\n"); +- ql_sem_unlock(qdev, QL_DRVR_SEM_MASK); +- } else { ++ if (!ql_wait_for_drvr_lock(qdev)) { + netdev_err(ndev, "Could not acquire driver lock\n"); ++ err = -ENODEV; + goto err_lock; + } + ++ err = ql_adapter_initialize(qdev); ++ if (err) { ++ netdev_err(ndev, "Unable to initialize adapter\n"); ++ goto err_init; ++ } ++ ql_sem_unlock(qdev, QL_DRVR_SEM_MASK); ++ + spin_unlock_irqrestore(&qdev->hw_lock, hw_flags); + + set_bit(QL_ADAPTER_UP, &qdev->flags); diff --git a/queue-5.15/perf-tools-fix-smt-detection-fast-read-path.patch b/queue-5.15/perf-tools-fix-smt-detection-fast-read-path.patch new file mode 100644 index 00000000000..21bda2e9ca5 --- /dev/null +++ b/queue-5.15/perf-tools-fix-smt-detection-fast-read-path.patch @@ -0,0 +1,44 @@ +From 4ffbe87e2d5b53bcb0213d8650bbe70bf942de6a Mon Sep 17 00:00:00 2001 +From: Ian Rogers +Date: Tue, 23 Nov 2021 16:12:29 -0800 +Subject: perf tools: Fix SMT detection fast read path + +From: Ian Rogers + +commit 4ffbe87e2d5b53bcb0213d8650bbe70bf942de6a upstream. + +sysfs__read_int() returns 0 on success, and so the fast read path was +always failing. + +Fixes: bb629484d924118e ("perf tools: Simplify checking if SMT is active.") +Signed-off-by: Ian Rogers +Cc: Alexander Shishkin +Cc: Andi Kleen +Cc: Jiri Olsa +Cc: John Garry +Cc: Kajol Jain +Cc: Kan Liang +Cc: Konstantin Khlebnikov +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Paul Clarke +Cc: Peter Zijlstra +Cc: Stephane Eranian +Link: http://lore.kernel.org/lkml/20211124001231.3277836-2-irogers@google.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Greg Kroah-Hartman +--- + tools/perf/util/smt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/tools/perf/util/smt.c ++++ b/tools/perf/util/smt.c +@@ -15,7 +15,7 @@ int smt_on(void) + if (cached) + return cached_result; + +- if (sysfs__read_int("devices/system/cpu/smt/active", &cached_result) > 0) ++ if (sysfs__read_int("devices/system/cpu/smt/active", &cached_result) >= 0) + goto done; + + ncpu = sysconf(_SC_NPROCESSORS_CONF); diff --git a/queue-5.15/pm-runtime-fix-pm_runtime_active-kerneldoc-comment.patch b/queue-5.15/pm-runtime-fix-pm_runtime_active-kerneldoc-comment.patch new file mode 100644 index 00000000000..2f900c991d3 --- /dev/null +++ b/queue-5.15/pm-runtime-fix-pm_runtime_active-kerneldoc-comment.patch @@ -0,0 +1,31 @@ +From 444dd878e85fb33fcfb2682cfdab4c236f33ea3e Mon Sep 17 00:00:00 2001 +From: "Rafael J. Wysocki" +Date: Fri, 3 Dec 2021 17:19:47 +0100 +Subject: PM: runtime: Fix pm_runtime_active() kerneldoc comment + +From: Rafael J. Wysocki + +commit 444dd878e85fb33fcfb2682cfdab4c236f33ea3e upstream. + +The kerneldoc comment of pm_runtime_active() does not reflect the +behavior of the function, so update it accordingly. + +Fixes: 403d2d116ec0 ("PM: runtime: Add kerneldoc comments to multiple helpers") +Signed-off-by: Rafael J. Wysocki +Reviewed-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/pm_runtime.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/include/linux/pm_runtime.h ++++ b/include/linux/pm_runtime.h +@@ -129,7 +129,7 @@ static inline bool pm_runtime_suspended( + * pm_runtime_active - Check whether or not a device is runtime-active. + * @dev: Target device. + * +- * Return %true if runtime PM is enabled for @dev and its runtime PM status is ++ * Return %true if runtime PM is disabled for @dev or its runtime PM status is + * %RPM_ACTIVE, or %false otherwise. + * + * Note that the return value of this function can only be trusted if it is diff --git a/queue-5.15/qede-validate-non-lso-skb-length.patch b/queue-5.15/qede-validate-non-lso-skb-length.patch new file mode 100644 index 00000000000..112b686df1a --- /dev/null +++ b/queue-5.15/qede-validate-non-lso-skb-length.patch @@ -0,0 +1,50 @@ +From 8e227b198a55859bf790dc7f4b1e30c0859c6756 Mon Sep 17 00:00:00 2001 +From: Manish Chopra +Date: Fri, 3 Dec 2021 09:44:13 -0800 +Subject: qede: validate non LSO skb length + +From: Manish Chopra + +commit 8e227b198a55859bf790dc7f4b1e30c0859c6756 upstream. + +Although it is unlikely that stack could transmit a non LSO +skb with length > MTU, however in some cases or environment such +occurrences actually resulted into firmware asserts due to packet +length being greater than the max supported by the device (~9700B). + +This patch adds the safeguard for such odd cases to avoid firmware +asserts. + +v2: Added "Fixes" tag with one of the initial driver commit + which enabled the TX traffic actually (as this was probably + day1 issue which was discovered recently by some customer + environment) + +Fixes: a2ec6172d29c ("qede: Add support for link") +Signed-off-by: Manish Chopra +Signed-off-by: Alok Prasad +Signed-off-by: Prabhakar Kushwaha +Signed-off-by: Ariel Elior +Link: https://lore.kernel.org/r/20211203174413.13090-1-manishc@marvell.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/qlogic/qede/qede_fp.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/net/ethernet/qlogic/qede/qede_fp.c ++++ b/drivers/net/ethernet/qlogic/qede/qede_fp.c +@@ -1643,6 +1643,13 @@ netdev_tx_t qede_start_xmit(struct sk_bu + data_split = true; + } + } else { ++ if (unlikely(skb->len > ETH_TX_MAX_NON_LSO_PKT_LEN)) { ++ DP_ERR(edev, "Unexpected non LSO skb length = 0x%x\n", skb->len); ++ qede_free_failed_tx_pkt(txq, first_bd, 0, false); ++ qede_update_tx_producer(txq); ++ return NETDEV_TX_OK; ++ } ++ + val |= ((skb->len & ETH_TX_DATA_1ST_BD_PKT_LEN_MASK) << + ETH_TX_DATA_1ST_BD_PKT_LEN_SHIFT); + } diff --git a/queue-5.15/rdma-hns-do-not-destroy-qp-resources-in-the-hw-resetting-phase.patch b/queue-5.15/rdma-hns-do-not-destroy-qp-resources-in-the-hw-resetting-phase.patch new file mode 100644 index 00000000000..4603abbdded --- /dev/null +++ b/queue-5.15/rdma-hns-do-not-destroy-qp-resources-in-the-hw-resetting-phase.patch @@ -0,0 +1,86 @@ +From b0969f83890bf8b47f5c8bd42539599b2b52fdeb Mon Sep 17 00:00:00 2001 +From: Yangyang Li +Date: Tue, 23 Nov 2021 22:24:02 +0800 +Subject: RDMA/hns: Do not destroy QP resources in the hw resetting phase + +From: Yangyang Li + +commit b0969f83890bf8b47f5c8bd42539599b2b52fdeb upstream. + +When hns_roce_v2_destroy_qp() is called, the brief calling process of the +driver is as follows: + + ...... + hns_roce_v2_destroy_qp + hns_roce_v2_qp_modify + hns_roce_cmd_mbox + hns_roce_qp_destroy + +If hns_roce_cmd_mbox() detects that the hardware is being reset during the +execution of the hns_roce_cmd_mbox(), the driver will not be able to get +the return value from the hardware (the firmware cannot respond to the +driver's mailbox during the hardware reset phase). + +The driver needs to wait for the hardware reset to complete before +continuing to execute hns_roce_qp_destroy(), otherwise it may happen that +the driver releases the resources but the hardware is still accessing. In +order to fix this problem, HNS RoCE needs to add a piece of code to wait +for the hardware reset to complete. + +The original interface get_hw_reset_stat() is the instantaneous state of +the hardware reset, which cannot accurately reflect whether the hardware +reset is completed, so it needs to be replaced with the ae_dev_reset_cnt +interface. + +The sign that the hardware reset is complete is that the return value of +the ae_dev_reset_cnt interface is greater than the original value +reset_cnt recorded by the driver. + +Fixes: 6a04aed6afae ("RDMA/hns: Fix the chip hanging caused by sending mailbox&CMQ during reset") +Link: https://lore.kernel.org/r/20211123142402.26936-1-liangwenpeng@huawei.com +Signed-off-by: Yangyang Li +Signed-off-by: Wenpeng Liang +Signed-off-by: Jason Gunthorpe +Signed-off-by: Greg Kroah-Hartman +--- + drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c ++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +@@ -33,6 +33,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -1050,9 +1051,14 @@ static u32 hns_roce_v2_cmd_hw_resetting( + unsigned long instance_stage, + unsigned long reset_stage) + { ++#define HW_RESET_TIMEOUT_US 1000000 ++#define HW_RESET_SLEEP_US 1000 ++ + struct hns_roce_v2_priv *priv = hr_dev->priv; + struct hnae3_handle *handle = priv->handle; + const struct hnae3_ae_ops *ops = handle->ae_algo->ops; ++ unsigned long val; ++ int ret; + + /* When hardware reset is detected, we should stop sending mailbox&cmq& + * doorbell to hardware. If now in .init_instance() function, we should +@@ -1064,7 +1070,11 @@ static u32 hns_roce_v2_cmd_hw_resetting( + * again. + */ + hr_dev->dis_db = true; +- if (!ops->get_hw_reset_stat(handle)) ++ ++ ret = read_poll_timeout(ops->ae_dev_reset_cnt, val, ++ val > hr_dev->reset_cnt, HW_RESET_SLEEP_US, ++ HW_RESET_TIMEOUT_US, false, handle); ++ if (!ret) + hr_dev->is_reset = true; + + if (!hr_dev->is_reset || reset_stage == HNS_ROCE_STATE_RST_INIT || diff --git a/queue-5.15/rdma-hns-do-not-halt-commands-during-reset-until-later.patch b/queue-5.15/rdma-hns-do-not-halt-commands-during-reset-until-later.patch new file mode 100644 index 00000000000..bfd8d08bed5 --- /dev/null +++ b/queue-5.15/rdma-hns-do-not-halt-commands-during-reset-until-later.patch @@ -0,0 +1,68 @@ +From 52414e27d6b568120b087d1fbafbb4482b0ccaab Mon Sep 17 00:00:00 2001 +From: Yangyang Li +Date: Tue, 23 Nov 2021 16:48:09 +0800 +Subject: RDMA/hns: Do not halt commands during reset until later + +From: Yangyang Li + +commit 52414e27d6b568120b087d1fbafbb4482b0ccaab upstream. + +is_reset is used to indicate whether the hardware starts to reset. When +hns_roce_hw_v2_reset_notify_down() is called, the hardware has not yet +started to reset. If is_reset is set at this time, all mailbox operations +of resource destroy actions will be intercepted by driver. When the driver +cleans up resources, but the hardware is still accessed, the following +errors will appear: + + arm-smmu-v3 arm-smmu-v3.2.auto: event 0x10 received: + arm-smmu-v3 arm-smmu-v3.2.auto: 0x0000350100000010 + arm-smmu-v3 arm-smmu-v3.2.auto: 0x000002088000003f + arm-smmu-v3 arm-smmu-v3.2.auto: 0x00000000a50e0800 + arm-smmu-v3 arm-smmu-v3.2.auto: 0x0000000000000000 + arm-smmu-v3 arm-smmu-v3.2.auto: event 0x10 received: + arm-smmu-v3 arm-smmu-v3.2.auto: 0x0000350100000010 + arm-smmu-v3 arm-smmu-v3.2.auto: 0x000002088000043e + arm-smmu-v3 arm-smmu-v3.2.auto: 0x00000000a50a0800 + arm-smmu-v3 arm-smmu-v3.2.auto: 0x0000000000000000 + arm-smmu-v3 arm-smmu-v3.2.auto: event 0x10 received: + arm-smmu-v3 arm-smmu-v3.2.auto: 0x0000350100000010 + arm-smmu-v3 arm-smmu-v3.2.auto: 0x0000020880000436 + arm-smmu-v3 arm-smmu-v3.2.auto: 0x00000000a50a0880 + arm-smmu-v3 arm-smmu-v3.2.auto: 0x0000000000000000 + arm-smmu-v3 arm-smmu-v3.2.auto: event 0x10 received: + arm-smmu-v3 arm-smmu-v3.2.auto: 0x0000350100000010 + arm-smmu-v3 arm-smmu-v3.2.auto: 0x000002088000043a + arm-smmu-v3 arm-smmu-v3.2.auto: 0x00000000a50e0840 + hns3 0000:35:00.0: INT status: CMDQ(0x0) HW errors(0x0) other(0x0) + arm-smmu-v3 arm-smmu-v3.2.auto: 0x0000000000000000 + hns3 0000:35:00.0: received unknown or unhandled event of vector0 + arm-smmu-v3 arm-smmu-v3.2.auto: event 0x10 received: + arm-smmu-v3 arm-smmu-v3.2.auto: 0x0000350100000010 + {34}[Hardware Error]: Hardware error from APEI Generic Hardware Error Source: 7 + +is_reset will be set correctly in check_aedev_reset_status(), so the +setting in hns_roce_hw_v2_reset_notify_down() should be deleted. + +Fixes: 726be12f5ca0 ("RDMA/hns: Set reset flag when hw resetting") +Link: https://lore.kernel.org/r/20211123084809.37318-1-liangwenpeng@huawei.com +Signed-off-by: Yangyang Li +Signed-off-by: Wenpeng Liang +Signed-off-by: Jason Gunthorpe +Signed-off-by: Greg Kroah-Hartman +--- + drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 2 -- + 1 file changed, 2 deletions(-) + +--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c ++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +@@ -6397,10 +6397,8 @@ static int hns_roce_hw_v2_reset_notify_d + if (!hr_dev) + return 0; + +- hr_dev->is_reset = true; + hr_dev->active = false; + hr_dev->dis_db = true; +- + hr_dev->state = HNS_ROCE_DEVICE_STATE_RST_DOWN; + + return 0; diff --git a/queue-5.15/revert-pci-aardvark-fix-support-for-pci_rom_address1-on-emulated-bridge.patch b/queue-5.15/revert-pci-aardvark-fix-support-for-pci_rom_address1-on-emulated-bridge.patch new file mode 100644 index 00000000000..b7f658b7b3f --- /dev/null +++ b/queue-5.15/revert-pci-aardvark-fix-support-for-pci_rom_address1-on-emulated-bridge.patch @@ -0,0 +1,100 @@ +From 39bd54d43b3f8b3c7b3a75f5d868d8bb858860e7 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Marek=20Beh=C3=BAn?= +Date: Thu, 25 Nov 2021 17:01:48 +0100 +Subject: Revert "PCI: aardvark: Fix support for PCI_ROM_ADDRESS1 on emulated bridge" +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Marek Behún + +commit 39bd54d43b3f8b3c7b3a75f5d868d8bb858860e7 upstream. + +This reverts commit 239edf686c14a9ff926dec2f350289ed7adfefe2. + +239edf686c14 ("PCI: aardvark: Fix support for PCI_ROM_ADDRESS1 on emulated +bridge") added support for the Type 1 Expansion ROM BAR at config offset +0x38, based on the register being listed in the Marvell Armada A3720 spec. +But the spec doesn't document it at all for RC mode, and there is no ROM in +the SOC, so remove this emulation for now. + +The PCI bridge which represents aardvark's PCIe Root Port has an Expansion +ROM Base Address register at offset 0x30, but its meaning is different than +PCI's Expansion ROM BAR register, although the layout is the same. (This +is why we thought it does the same thing.) + +First: there is no ROM (or part of BootROM) in the A3720 SOC dedicated for +PCIe Root Port (or controller in RC mode) containing executable code that +would initialize the Root Port, suitable for execution in bootloader (this +is how Expansion ROM BAR is used on x86). + +Second: in A3720 spec the register (address 0xD0070030) is not documented +at all for Root Complex mode, but similar to other BAR registers, it has an +"entangled partner" in register 0xD0075920, which does address translation +for the BAR in 0xD0070030: + + - the BAR register sets the address from the view of PCIe bus + + - the translation register sets the address from the view of the CPU + +The other BAR registers also have this entangled partner, and they can be +used to: + + - in RC mode: address-checking on the receive side of the RC (they can + define address ranges for memory accesses from remote Endpoints to the + RC) + + - in Endpoint mode: allow the remote CPU to access memory on A3720 + +The Expansion ROM BAR has only the Endpoint part documented, but from the +similarities we think that it can also be used in RC mode in that way. + +So either Expansion ROM BAR has different meaning (if the hypothesis above +is true), or we don't know it's meaning (since it is not documented for RC +mode). + +Remove the register from the emulated bridge accessing functions. + +[bhelgaas: summarize reason for removal (first paragraph)] +Fixes: 239edf686c14 ("PCI: aardvark: Fix support for PCI_ROM_ADDRESS1 on emulated bridge") +Link: https://lore.kernel.org/r/20211125160148.26029-3-kabel@kernel.org +Signed-off-by: Marek Behún +Signed-off-by: Bjorn Helgaas +Reviewed-by: Pali Rohár +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pci/controller/pci-aardvark.c | 9 --------- + 1 file changed, 9 deletions(-) + +--- a/drivers/pci/controller/pci-aardvark.c ++++ b/drivers/pci/controller/pci-aardvark.c +@@ -32,7 +32,6 @@ + #define PCIE_CORE_DEV_ID_REG 0x0 + #define PCIE_CORE_CMD_STATUS_REG 0x4 + #define PCIE_CORE_DEV_REV_REG 0x8 +-#define PCIE_CORE_EXP_ROM_BAR_REG 0x30 + #define PCIE_CORE_PCIEXP_CAP 0xc0 + #define PCIE_CORE_ERR_CAPCTL_REG 0x118 + #define PCIE_CORE_ERR_CAPCTL_ECRC_CHK_TX BIT(5) +@@ -774,10 +773,6 @@ advk_pci_bridge_emul_base_conf_read(stru + *value = advk_readl(pcie, PCIE_CORE_CMD_STATUS_REG); + return PCI_BRIDGE_EMUL_HANDLED; + +- case PCI_ROM_ADDRESS1: +- *value = advk_readl(pcie, PCIE_CORE_EXP_ROM_BAR_REG); +- return PCI_BRIDGE_EMUL_HANDLED; +- + case PCI_INTERRUPT_LINE: { + /* + * From the whole 32bit register we support reading from HW only +@@ -810,10 +805,6 @@ advk_pci_bridge_emul_base_conf_write(str + advk_writel(pcie, new, PCIE_CORE_CMD_STATUS_REG); + break; + +- case PCI_ROM_ADDRESS1: +- advk_writel(pcie, new, PCIE_CORE_EXP_ROM_BAR_REG); +- break; +- + case PCI_INTERRUPT_LINE: + if (mask & (PCI_BRIDGE_CTL_BUS_RESET << 16)) { + u32 val = advk_readl(pcie, PCIE_CORE_CTRL1_REG); diff --git a/queue-5.15/scsi-pm80xx-do-not-call-scsi_remove_host-in-pm8001_alloc.patch b/queue-5.15/scsi-pm80xx-do-not-call-scsi_remove_host-in-pm8001_alloc.patch new file mode 100644 index 00000000000..cc3bf4c38bf --- /dev/null +++ b/queue-5.15/scsi-pm80xx-do-not-call-scsi_remove_host-in-pm8001_alloc.patch @@ -0,0 +1,71 @@ +From 653926205741add87a6cf452e21950eebc6ac10b Mon Sep 17 00:00:00 2001 +From: Igor Pylypiv +Date: Tue, 30 Nov 2021 20:16:27 -0800 +Subject: scsi: pm80xx: Do not call scsi_remove_host() in pm8001_alloc() + +From: Igor Pylypiv + +commit 653926205741add87a6cf452e21950eebc6ac10b upstream. + +Calling scsi_remove_host() before scsi_add_host() results in a crash: + + BUG: kernel NULL pointer dereference, address: 0000000000000108 + RIP: 0010:device_del+0x63/0x440 + Call Trace: + device_unregister+0x17/0x60 + scsi_remove_host+0xee/0x2a0 + pm8001_pci_probe+0x6ef/0x1b90 [pm80xx] + local_pci_probe+0x3f/0x90 + +We cannot call scsi_remove_host() in pm8001_alloc() because scsi_add_host() +has not been called yet at that point in time. + +Function call tree: + + pm8001_pci_probe() + | + `- pm8001_pci_alloc() + | | + | `- pm8001_alloc() + | | + | `- scsi_remove_host() + | + `- scsi_add_host() + +Link: https://lore.kernel.org/r/20211201041627.1592487-1-ipylypiv@google.com +Fixes: 05c6c029a44d ("scsi: pm80xx: Increase number of supported queues") +Reviewed-by: Vishakha Channapattan +Acked-by: Jack Wang +Signed-off-by: Igor Pylypiv +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/pm8001/pm8001_init.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +--- a/drivers/scsi/pm8001/pm8001_init.c ++++ b/drivers/scsi/pm8001/pm8001_init.c +@@ -281,12 +281,12 @@ static int pm8001_alloc(struct pm8001_hb + if (rc) { + pm8001_dbg(pm8001_ha, FAIL, + "pm8001_setup_irq failed [ret: %d]\n", rc); +- goto err_out_shost; ++ goto err_out; + } + /* Request Interrupt */ + rc = pm8001_request_irq(pm8001_ha); + if (rc) +- goto err_out_shost; ++ goto err_out; + + count = pm8001_ha->max_q_num; + /* Queues are chosen based on the number of cores/msix availability */ +@@ -422,8 +422,6 @@ static int pm8001_alloc(struct pm8001_hb + pm8001_tag_init(pm8001_ha); + return 0; + +-err_out_shost: +- scsi_remove_host(pm8001_ha->shost); + err_out_nodev: + for (i = 0; i < pm8001_ha->max_memcnt; i++) { + if (pm8001_ha->memoryMap.region[i].virt_ptr != NULL) { diff --git a/queue-5.15/scsi-scsi_debug-fix-buffer-size-of-report-zones-command.patch b/queue-5.15/scsi-scsi_debug-fix-buffer-size-of-report-zones-command.patch new file mode 100644 index 00000000000..ed7d3dec176 --- /dev/null +++ b/queue-5.15/scsi-scsi_debug-fix-buffer-size-of-report-zones-command.patch @@ -0,0 +1,37 @@ +From 7db0e0c8190a086ef92ce5bb960836cde49540aa Mon Sep 17 00:00:00 2001 +From: Shin'ichiro Kawasaki +Date: Tue, 7 Dec 2021 10:06:38 +0900 +Subject: scsi: scsi_debug: Fix buffer size of REPORT ZONES command + +From: Shin'ichiro Kawasaki + +commit 7db0e0c8190a086ef92ce5bb960836cde49540aa upstream. + +According to ZBC and SPC specifications, the unit of ALLOCATION LENGTH +field of REPORT ZONES command is byte. However, current scsi_debug +implementation handles it as number of zones to calculate buffer size to +report zones. When the ALLOCATION LENGTH has a large number, this results +in too large buffer size and causes memory allocation failure. Fix the +failure by handling ALLOCATION LENGTH as byte unit. + +Link: https://lore.kernel.org/r/20211207010638.124280-1-shinichiro.kawasaki@wdc.com +Fixes: f0d1cf9378bd ("scsi: scsi_debug: Add ZBC zone commands") +Reviewed-by: Damien Le Moal +Signed-off-by: Shin'ichiro Kawasaki +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/scsi_debug.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/scsi/scsi_debug.c ++++ b/drivers/scsi/scsi_debug.c +@@ -4334,7 +4334,7 @@ static int resp_report_zones(struct scsi + rep_max_zones = min((alloc_len - 64) >> ilog2(RZONES_DESC_HD), + max_zones); + +- arr = kcalloc(RZONES_DESC_HD, alloc_len, GFP_ATOMIC); ++ arr = kzalloc(alloc_len, GFP_ATOMIC); + if (!arr) { + mk_sense_buffer(scp, ILLEGAL_REQUEST, INSUFF_RES_ASC, + INSUFF_RES_ASCQ); diff --git a/queue-5.15/selftests-fib_tests-rework-fib_rp_filter_test.patch b/queue-5.15/selftests-fib_tests-rework-fib_rp_filter_test.patch new file mode 100644 index 00000000000..8792afc70ee --- /dev/null +++ b/queue-5.15/selftests-fib_tests-rework-fib_rp_filter_test.patch @@ -0,0 +1,170 @@ +From f6071e5e3961eeb5300bd0901c9e128598730ae3 Mon Sep 17 00:00:00 2001 +From: Peilin Ye +Date: Tue, 30 Nov 2021 16:47:20 -0800 +Subject: selftests/fib_tests: Rework fib_rp_filter_test() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Peilin Ye + +commit f6071e5e3961eeb5300bd0901c9e128598730ae3 upstream. + +Currently rp_filter tests in fib_tests.sh:fib_rp_filter_test() are +failing. ping sockets are bound to dummy1 using the "-I" option +(SO_BINDTODEVICE), but socket lookup is failing when receiving ping +replies, since the routing table thinks they belong to dummy0. + +For example, suppose ping is using a SOCK_RAW socket for ICMP messages. +When receiving ping replies, in __raw_v4_lookup(), sk->sk_bound_dev_if +is 3 (dummy1), but dif (skb_rtable(skb)->rt_iif) says 2 (dummy0), so the +raw_sk_bound_dev_eq() check fails. Similar things happen in +ping_lookup() for SOCK_DGRAM sockets. + +These tests used to pass due to a bug [1] in iputils, where "ping -I" +actually did not bind ICMP message sockets to device. The bug has been +fixed by iputils commit f455fee41c07 ("ping: also bind the ICMP socket +to the specific device") in 2016, which is why our rp_filter tests +started to fail. See [2] . + +Fixing the tests while keeping everything in one netns turns out to be +nontrivial. Rework the tests and build the following topology: + + ┌─────────────────────────────┐ ┌─────────────────────────────┐ + │ network namespace 1 (ns1) │ │ network namespace 2 (ns2) │ + │ │ │ │ + │ ┌────┐ ┌─────┐ │ │ ┌─────┐ ┌────┐ │ + │ │ lo │<───>│veth1│<────────┼────┼─>│veth2│<──────────>│ lo │ │ + │ └────┘ ├─────┴──────┐ │ │ ├─────┴──────┐ └────┘ │ + │ │192.0.2.1/24│ │ │ │192.0.2.1/24│ │ + │ └────────────┘ │ │ └────────────┘ │ + └─────────────────────────────┘ └─────────────────────────────┘ + +Consider sending an ICMP_ECHO packet A in ns2. Both source and +destination IP addresses are 192.0.2.1, and we use strict mode rp_filter +in both ns1 and ns2: + + 1. A is routed to lo since its destination IP address is one of ns2's + local addresses (veth2); + 2. A is redirected from lo's egress to veth2's egress using mirred; + 3. A arrives at veth1's ingress in ns1; + 4. A is redirected from veth1's ingress to lo's ingress, again, using + mirred; + 5. In __fib_validate_source(), fib_info_nh_uses_dev() returns false, + since A was received on lo, but reverse path lookup says veth1; + 6. However A is not dropped since we have relaxed this check for lo in + commit 66f8209547cc ("fib: relax source validation check for loopback + packets"); + +Making sure A is not dropped here in this corner case is the whole point +of having this test. + + 7. As A reaches the ICMP layer, an ICMP_ECHOREPLY packet, B, is + generated; + 8. Similarly, B is redirected from lo's egress to veth1's egress (in + ns1), then redirected once again from veth2's ingress to lo's + ingress (in ns2), using mirred. + +Also test "ping 127.0.0.1" from ns2. It does not trigger the relaxed +check in __fib_validate_source(), but just to make sure the topology +works with loopback addresses. + +Tested with ping from iputils 20210722-41-gf9fb573: + +$ ./fib_tests.sh -t rp_filter + +IPv4 rp_filter tests + TEST: rp_filter passes local packets [ OK ] + TEST: rp_filter passes loopback packets [ OK ] + +[1] https://github.com/iputils/iputils/issues/55 +[2] https://github.com/iputils/iputils/commit/f455fee41c077d4b700a473b2f5b3487b8febc1d + +Reported-by: Hangbin Liu +Fixes: adb701d6cfa4 ("selftests: add a test case for rp_filter") +Reviewed-by: Cong Wang +Signed-off-by: Peilin Ye +Acked-by: David Ahern +Link: https://lore.kernel.org/r/20211201004720.6357-1-yepeilin.cs@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/net/fib_tests.sh | 59 +++++++++++++++++++++++++------ + 1 file changed, 49 insertions(+), 10 deletions(-) + +--- a/tools/testing/selftests/net/fib_tests.sh ++++ b/tools/testing/selftests/net/fib_tests.sh +@@ -444,24 +444,63 @@ fib_rp_filter_test() + setup + + set -e ++ ip netns add ns2 ++ ip netns set ns2 auto ++ ++ ip -netns ns2 link set dev lo up ++ ++ $IP link add name veth1 type veth peer name veth2 ++ $IP link set dev veth2 netns ns2 ++ $IP address add 192.0.2.1/24 dev veth1 ++ ip -netns ns2 address add 192.0.2.1/24 dev veth2 ++ $IP link set dev veth1 up ++ ip -netns ns2 link set dev veth2 up ++ + $IP link set dev lo address 52:54:00:6a:c7:5e +- $IP link set dummy0 address 52:54:00:6a:c7:5e +- $IP link add dummy1 type dummy +- $IP link set dummy1 address 52:54:00:6a:c7:5e +- $IP link set dev dummy1 up ++ $IP link set dev veth1 address 52:54:00:6a:c7:5e ++ ip -netns ns2 link set dev lo address 52:54:00:6a:c7:5e ++ ip -netns ns2 link set dev veth2 address 52:54:00:6a:c7:5e ++ ++ # 1. (ns2) redirect lo's egress to veth2's egress ++ ip netns exec ns2 tc qdisc add dev lo parent root handle 1: fq_codel ++ ip netns exec ns2 tc filter add dev lo parent 1: protocol arp basic \ ++ action mirred egress redirect dev veth2 ++ ip netns exec ns2 tc filter add dev lo parent 1: protocol ip basic \ ++ action mirred egress redirect dev veth2 ++ ++ # 2. (ns1) redirect veth1's ingress to lo's ingress ++ $NS_EXEC tc qdisc add dev veth1 ingress ++ $NS_EXEC tc filter add dev veth1 ingress protocol arp basic \ ++ action mirred ingress redirect dev lo ++ $NS_EXEC tc filter add dev veth1 ingress protocol ip basic \ ++ action mirred ingress redirect dev lo ++ ++ # 3. (ns1) redirect lo's egress to veth1's egress ++ $NS_EXEC tc qdisc add dev lo parent root handle 1: fq_codel ++ $NS_EXEC tc filter add dev lo parent 1: protocol arp basic \ ++ action mirred egress redirect dev veth1 ++ $NS_EXEC tc filter add dev lo parent 1: protocol ip basic \ ++ action mirred egress redirect dev veth1 ++ ++ # 4. (ns2) redirect veth2's ingress to lo's ingress ++ ip netns exec ns2 tc qdisc add dev veth2 ingress ++ ip netns exec ns2 tc filter add dev veth2 ingress protocol arp basic \ ++ action mirred ingress redirect dev lo ++ ip netns exec ns2 tc filter add dev veth2 ingress protocol ip basic \ ++ action mirred ingress redirect dev lo ++ + $NS_EXEC sysctl -qw net.ipv4.conf.all.rp_filter=1 + $NS_EXEC sysctl -qw net.ipv4.conf.all.accept_local=1 + $NS_EXEC sysctl -qw net.ipv4.conf.all.route_localnet=1 +- +- $NS_EXEC tc qd add dev dummy1 parent root handle 1: fq_codel +- $NS_EXEC tc filter add dev dummy1 parent 1: protocol arp basic action mirred egress redirect dev lo +- $NS_EXEC tc filter add dev dummy1 parent 1: protocol ip basic action mirred egress redirect dev lo ++ ip netns exec ns2 sysctl -qw net.ipv4.conf.all.rp_filter=1 ++ ip netns exec ns2 sysctl -qw net.ipv4.conf.all.accept_local=1 ++ ip netns exec ns2 sysctl -qw net.ipv4.conf.all.route_localnet=1 + set +e + +- run_cmd "ip netns exec ns1 ping -I dummy1 -w1 -c1 198.51.100.1" ++ run_cmd "ip netns exec ns2 ping -w1 -c1 192.0.2.1" + log_test $? 0 "rp_filter passes local packets" + +- run_cmd "ip netns exec ns1 ping -I dummy1 -w1 -c1 127.0.0.1" ++ run_cmd "ip netns exec ns2 ping -w1 -c1 127.0.0.1" + log_test $? 0 "rp_filter passes loopback packets" + + cleanup diff --git a/queue-5.15/series b/queue-5.15/series index 25e0fb29fe2..2308ea8f64e 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -97,3 +97,39 @@ binder-use-wake_up_pollfree.patch signalfd-use-wake_up_pollfree.patch aio-keep-poll-requests-on-waitqueue-until-completed.patch aio-fix-use-after-free-due-to-missing-pollfree-handling.patch +tracefs-set-all-files-to-the-same-group-ownership-as-the-mount-option.patch +i2c-mpc-use-atomic-read-and-fix-break-condition.patch +block-fix-ioprio_get-ioprio_who_pgrp-vs-setuid-2.patch +scsi-pm80xx-do-not-call-scsi_remove_host-in-pm8001_alloc.patch +scsi-scsi_debug-fix-buffer-size-of-report-zones-command.patch +alsa-usb-audio-reorder-snd_djm_devices-entries.patch +qede-validate-non-lso-skb-length.patch +pm-runtime-fix-pm_runtime_active-kerneldoc-comment.patch +asoc-rt5682-fix-crash-due-to-out-of-scope-stack-vars.patch +asoc-qdsp6-q6routing-fix-return-value-from-msm_routing_put_audio_mixer.patch +asoc-codecs-wsa881x-fix-return-values-from-kcontrol-put.patch +asoc-codecs-wcd934x-handle-channel-mappping-list-correctly.patch +asoc-codecs-wcd934x-return-correct-value-from-mixer-put.patch +rdma-hns-do-not-halt-commands-during-reset-until-later.patch +rdma-hns-do-not-destroy-qp-resources-in-the-hw-resetting-phase.patch +hwmon-dell-smm-fix-warning-on-proc-i8k-creation-error.patch +clk-imx-use-module_platform_driver.patch +clk-qcom-clk-alpha-pll-don-t-reconfigure-running-trion.patch +i40e-fix-failed-opcode-appearing-if-handling-messages-from-vf.patch +i40e-fix-pre-set-max-number-of-queues-for-vf.patch +mtd-rawnand-fsmc-take-instruction-delay-into-account.patch +mtd-rawnand-fsmc-fix-timing-computation.patch +bpf-sockmap-re-evaluate-proto-ops-when-psock-is-removed-from-sockmap.patch +i40e-fix-null-pointer-dereference-in-i40e_dbg_dump_desc.patch +revert-pci-aardvark-fix-support-for-pci_rom_address1-on-emulated-bridge.patch +drm-amd-display-fix-dpia-outbox-timeout-after-s3-s4-reset.patch +perf-tools-fix-smt-detection-fast-read-path.patch +documentation-locking-locktypes-update-migrate_disable-bits.patch +dt-bindings-net-reintroduce-phy-no-lane-swap-binding.patch +tools-build-remove-needless-libpython-version-feature-check-that-breaks-test-all-fast-path.patch +net-cdc_ncm-allow-for-dwntboutmaxsize-to-be-unset-or-zero.patch +net-altera-set-a-couple-error-code-in-probe.patch +net-fec-only-clear-interrupt-of-handling-queue-in-fec_enet_rx_queue.patch +net-neigh-clear-whole-pneigh_entry-at-alloc-time.patch +net-qla3xxx-fix-an-error-code-in-ql_adapter_up.patch +selftests-fib_tests-rework-fib_rp_filter_test.patch diff --git a/queue-5.15/tools-build-remove-needless-libpython-version-feature-check-that-breaks-test-all-fast-path.patch b/queue-5.15/tools-build-remove-needless-libpython-version-feature-check-that-breaks-test-all-fast-path.patch new file mode 100644 index 00000000000..9abaef25d1b --- /dev/null +++ b/queue-5.15/tools-build-remove-needless-libpython-version-feature-check-that-breaks-test-all-fast-path.patch @@ -0,0 +1,183 @@ +From 3d1d57debee2d342a47615707588b96658fabb85 Mon Sep 17 00:00:00 2001 +From: Arnaldo Carvalho de Melo +Date: Tue, 30 Nov 2021 10:12:41 -0300 +Subject: tools build: Remove needless libpython-version feature check that breaks test-all fast path +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Arnaldo Carvalho de Melo + +commit 3d1d57debee2d342a47615707588b96658fabb85 upstream. + +Since 66dfdff03d196e51 ("perf tools: Add Python 3 support") we don't use +the tools/build/feature/test-libpython-version.c version in any Makefile +feature check: + + $ find tools/ -type f | xargs grep feature-libpython-version + $ + +The only place where this was used was removed in 66dfdff03d196e51: + + - ifneq ($(feature-libpython-version), 1) + - $(warning Python 3 is not yet supported; please set) + - $(warning PYTHON and/or PYTHON_CONFIG appropriately.) + - $(warning If you also have Python 2 installed, then) + - $(warning try something like:) + - $(warning $(and ,)) + - $(warning $(and ,) make PYTHON=python2) + - $(warning $(and ,)) + - $(warning Otherwise, disable Python support entirely:) + - $(warning $(and ,)) + - $(warning $(and ,) make NO_LIBPYTHON=1) + - $(warning $(and ,)) + - $(error $(and ,)) + - else + - LDFLAGS += $(PYTHON_EMBED_LDFLAGS) + - EXTLIBS += $(PYTHON_EMBED_LIBADD) + - LANG_BINDINGS += $(obj-perf)python/perf.so + - $(call detected,CONFIG_LIBPYTHON) + - endif + +And nowadays we either build with PYTHON=python3 or just install the +python3 devel packages and perf will build against it. + +But the leftover feature-libpython-version check made the fast path +feature detection to break in all cases except when python2 devel files +were installed: + + $ rpm -qa | grep python.*devel + python3-devel-3.9.7-1.fc34.x86_64 + $ rm -rf /tmp/build/perf ; mkdir -p /tmp/build/perf ; + $ make -C tools/perf O=/tmp/build/perf install-bin + make: Entering directory '/var/home/acme/git/perf/tools/perf' + BUILD: Doing 'make -j32' parallel build + HOSTCC /tmp/build/perf/fixdep.o + + $ cat /tmp/build/perf/feature/test-all.make.output + In file included from test-all.c:18: + test-libpython-version.c:5:10: error: #error + 5 | #error + | ^~~~~ + $ ldd ~/bin/perf | grep python + libpython3.9.so.1.0 => /lib64/libpython3.9.so.1.0 (0x00007fda6dbcf000) + $ + +As python3 is the norm these days, fix this by just removing the unused +feature-libpython-version feature check, making the test-all fast path +to work with the common case. + +With this: + + $ rm -rf /tmp/build/perf ; mkdir -p /tmp/build/perf ; + $ make -C tools/perf O=/tmp/build/perf install-bin |& head + make: Entering directory '/var/home/acme/git/perf/tools/perf' + BUILD: Doing 'make -j32' parallel build + HOSTCC /tmp/build/perf/fixdep.o + HOSTLD /tmp/build/perf/fixdep-in.o + LINK /tmp/build/perf/fixdep + + Auto-detecting system features: + ... dwarf: [ on ] + ... dwarf_getlocations: [ on ] + ... glibc: [ on ] + $ ldd ~/bin/perf | grep python + libpython3.9.so.1.0 => /lib64/libpython3.9.so.1.0 (0x00007f58800b0000) + $ cat /tmp/build/perf/feature/test-all.make.output + $ + +Reviewed-by: James Clark +Fixes: 66dfdff03d196e51 ("perf tools: Add Python 3 support") +Cc: Adrian Hunter +Cc: Ian Rogers +Cc: Jaroslav Škarvada +Cc: Jiri Olsa +Cc: Namhyung Kim +Link: https://lore.kernel.org/lkml/YaYmeeC6CS2b8OSz@kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Greg Kroah-Hartman +--- + tools/build/Makefile.feature | 1 - + tools/build/feature/Makefile | 4 ---- + tools/build/feature/test-all.c | 5 ----- + tools/build/feature/test-libpython-version.c | 11 ----------- + tools/perf/Makefile.config | 2 -- + 5 files changed, 23 deletions(-) + delete mode 100644 tools/build/feature/test-libpython-version.c + +--- a/tools/build/Makefile.feature ++++ b/tools/build/Makefile.feature +@@ -48,7 +48,6 @@ FEATURE_TESTS_BASIC := + numa_num_possible_cpus \ + libperl \ + libpython \ +- libpython-version \ + libslang \ + libslang-include-subdir \ + libtraceevent \ +--- a/tools/build/feature/Makefile ++++ b/tools/build/feature/Makefile +@@ -32,7 +32,6 @@ FILES= + test-numa_num_possible_cpus.bin \ + test-libperl.bin \ + test-libpython.bin \ +- test-libpython-version.bin \ + test-libslang.bin \ + test-libslang-include-subdir.bin \ + test-libtraceevent.bin \ +@@ -223,9 +222,6 @@ $(OUTPUT)test-libperl.bin: + $(OUTPUT)test-libpython.bin: + $(BUILD) $(FLAGS_PYTHON_EMBED) + +-$(OUTPUT)test-libpython-version.bin: +- $(BUILD) +- + $(OUTPUT)test-libbfd.bin: + $(BUILD) -DPACKAGE='"perf"' -lbfd -ldl + +--- a/tools/build/feature/test-all.c ++++ b/tools/build/feature/test-all.c +@@ -14,10 +14,6 @@ + # include "test-libpython.c" + #undef main + +-#define main main_test_libpython_version +-# include "test-libpython-version.c" +-#undef main +- + #define main main_test_libperl + # include "test-libperl.c" + #undef main +@@ -177,7 +173,6 @@ + int main(int argc, char *argv[]) + { + main_test_libpython(); +- main_test_libpython_version(); + main_test_libperl(); + main_test_hello(); + main_test_libelf(); +--- a/tools/build/feature/test-libpython-version.c ++++ /dev/null +@@ -1,11 +0,0 @@ +-// SPDX-License-Identifier: GPL-2.0 +-#include +- +-#if PY_VERSION_HEX >= 0x03000000 +- #error +-#endif +- +-int main(void) +-{ +- return 0; +-} +--- a/tools/perf/Makefile.config ++++ b/tools/perf/Makefile.config +@@ -271,8 +271,6 @@ endif + + FEATURE_CHECK_CFLAGS-libpython := $(PYTHON_EMBED_CCOPTS) + FEATURE_CHECK_LDFLAGS-libpython := $(PYTHON_EMBED_LDOPTS) +-FEATURE_CHECK_CFLAGS-libpython-version := $(PYTHON_EMBED_CCOPTS) +-FEATURE_CHECK_LDFLAGS-libpython-version := $(PYTHON_EMBED_LDOPTS) + + FEATURE_CHECK_LDFLAGS-libaio = -lrt + diff --git a/queue-5.15/tracefs-set-all-files-to-the-same-group-ownership-as-the-mount-option.patch b/queue-5.15/tracefs-set-all-files-to-the-same-group-ownership-as-the-mount-option.patch new file mode 100644 index 00000000000..ccd82f20540 --- /dev/null +++ b/queue-5.15/tracefs-set-all-files-to-the-same-group-ownership-as-the-mount-option.patch @@ -0,0 +1,146 @@ +From 48b27b6b5191e2e1f2798cd80877b6e4ef47c351 Mon Sep 17 00:00:00 2001 +From: "Steven Rostedt (VMware)" +Date: Tue, 7 Dec 2021 17:17:29 -0500 +Subject: tracefs: Set all files to the same group ownership as the mount option + +From: Steven Rostedt (VMware) + +commit 48b27b6b5191e2e1f2798cd80877b6e4ef47c351 upstream. + +As people have been asking to allow non-root processes to have access to +the tracefs directory, it was considered best to only allow groups to have +access to the directory, where it is easier to just set the tracefs file +system to a specific group (as other would be too dangerous), and that way +the admins could pick which processes would have access to tracefs. + +Unfortunately, this broke tooling on Android that expected the other bit +to be set. For some special cases, for non-root tools to trace the system, +tracefs would be mounted and change the permissions of the top level +directory which gave access to all running tasks permission to the +tracing directory. Even though this would be dangerous to do in a +production environment, for testing environments this can be useful. + +Now with the new changes to not allow other (which is still the proper +thing to do), it breaks the testing tooling. Now more code needs to be +loaded on the system to change ownership of the tracing directory. + +The real solution is to have tracefs honor the gid=xxx option when +mounting. That is, + +(tracing group tracing has value 1003) + + mount -t tracefs -o gid=1003 tracefs /sys/kernel/tracing + +should have it that all files in the tracing directory should be of the +given group. + +Copy the logic from d_walk() from dcache.c and simplify it for the mount +case of tracefs if gid is set. All the files in tracefs will be walked and +their group will be set to the value passed in. + +Link: https://lkml.kernel.org/r/20211207171729.2a54e1b3@gandalf.local.home + +Cc: Ingo Molnar +Cc: Kees Cook +Cc: Andrew Morton +Cc: Linus Torvalds +Cc: linux-fsdevel@vger.kernel.org +Cc: Al Viro +Cc: Greg Kroah-Hartman +Reported-by: Kalesh Singh +Reported-by: Yabin Cui +Fixes: 49d67e445742 ("tracefs: Have tracefs directories not set OTH permission bits by default") +Signed-off-by: Steven Rostedt (VMware) +Signed-off-by: Greg Kroah-Hartman +--- + fs/tracefs/inode.c | 72 +++++++++++++++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 72 insertions(+) + +--- a/fs/tracefs/inode.c ++++ b/fs/tracefs/inode.c +@@ -161,6 +161,77 @@ struct tracefs_fs_info { + struct tracefs_mount_opts mount_opts; + }; + ++static void change_gid(struct dentry *dentry, kgid_t gid) ++{ ++ if (!dentry->d_inode) ++ return; ++ dentry->d_inode->i_gid = gid; ++} ++ ++/* ++ * Taken from d_walk, but without he need for handling renames. ++ * Nothing can be renamed while walking the list, as tracefs ++ * does not support renames. This is only called when mounting ++ * or remounting the file system, to set all the files to ++ * the given gid. ++ */ ++static void set_gid(struct dentry *parent, kgid_t gid) ++{ ++ struct dentry *this_parent; ++ struct list_head *next; ++ ++ this_parent = parent; ++ spin_lock(&this_parent->d_lock); ++ ++ change_gid(this_parent, gid); ++repeat: ++ next = this_parent->d_subdirs.next; ++resume: ++ while (next != &this_parent->d_subdirs) { ++ struct list_head *tmp = next; ++ struct dentry *dentry = list_entry(tmp, struct dentry, d_child); ++ next = tmp->next; ++ ++ spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED); ++ ++ change_gid(dentry, gid); ++ ++ if (!list_empty(&dentry->d_subdirs)) { ++ spin_unlock(&this_parent->d_lock); ++ spin_release(&dentry->d_lock.dep_map, _RET_IP_); ++ this_parent = dentry; ++ spin_acquire(&this_parent->d_lock.dep_map, 0, 1, _RET_IP_); ++ goto repeat; ++ } ++ spin_unlock(&dentry->d_lock); ++ } ++ /* ++ * All done at this level ... ascend and resume the search. ++ */ ++ rcu_read_lock(); ++ascend: ++ if (this_parent != parent) { ++ struct dentry *child = this_parent; ++ this_parent = child->d_parent; ++ ++ spin_unlock(&child->d_lock); ++ spin_lock(&this_parent->d_lock); ++ ++ /* go into the first sibling still alive */ ++ do { ++ next = child->d_child.next; ++ if (next == &this_parent->d_subdirs) ++ goto ascend; ++ child = list_entry(next, struct dentry, d_child); ++ } while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED)); ++ rcu_read_unlock(); ++ goto resume; ++ } ++ rcu_read_unlock(); ++ spin_unlock(&this_parent->d_lock); ++ return; ++} ++ + static int tracefs_parse_options(char *data, struct tracefs_mount_opts *opts) + { + substring_t args[MAX_OPT_ARGS]; +@@ -193,6 +264,7 @@ static int tracefs_parse_options(char *d + if (!gid_valid(gid)) + return -EINVAL; + opts->gid = gid; ++ set_gid(tracefs_mount->mnt_root, gid); + break; + case Opt_mode: + if (match_octal(&args[0], &option)) -- 2.47.2