From 516585ab642969f6752df2c8eb27ca7363b72cb6 Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Mon, 24 Jun 2024 09:48:20 -0400 Subject: [PATCH] Fixes for 6.1 Signed-off-by: Sasha Levin --- ...pica-avoid-info-mapping-multiple-bar.patch | 84 +++++++++++++++++ ...ale-imx8mm-verdin-enable-hysteresis-.patch | 40 ++++++++ ...11x11-evk-remove-the-no-sdio-propert.patch | 40 ++++++++ ...ix-possible-use-after-free-in-irq_pr.patch | 48 ++++++++++ ...rop-redundant-pci_enable_pcie_error_.patch | 71 ++++++++++++++ ...se-pci-core-macros-for-pcie-capabili.patch | 67 +++++++++++++ ...ma-fix-error-path-in-ioat3_dma_probe.patch | 94 +++++++++++++++++++ ...atdma-fix-kmemleak-in-ioat_pci_probe.patch | 66 +++++++++++++ ...tdma-fix-leaking-on-version-mismatch.patch | 69 ++++++++++++++ ...atdma-fix-missing-kmem_cache_destroy.patch | 46 +++++++++ ...x-return-value-from-psci_system_susp.patch | 49 ++++++++++ ...-add-check-for-srq-max_sge-attribute.patch | 55 +++++++++++ .../regulator-bd71815-fix-ramp-values.patch | 40 ++++++++ ...ix-modpost-error-regulator_get_regma.patch | 38 ++++++++ queue-6.1/series | 14 +++ 15 files changed, 821 insertions(+) create mode 100644 queue-6.1/acpica-revert-acpica-avoid-info-mapping-multiple-bar.patch create mode 100644 queue-6.1/arm64-dts-freescale-imx8mm-verdin-enable-hysteresis-.patch create mode 100644 queue-6.1/arm64-dts-imx93-11x11-evk-remove-the-no-sdio-propert.patch create mode 100644 queue-6.1/dmaengine-idxd-fix-possible-use-after-free-in-irq_pr.patch create mode 100644 queue-6.1/dmaengine-ioat-drop-redundant-pci_enable_pcie_error_.patch create mode 100644 queue-6.1/dmaengine-ioat-use-pci-core-macros-for-pcie-capabili.patch create mode 100644 queue-6.1/dmaengine-ioatdma-fix-error-path-in-ioat3_dma_probe.patch create mode 100644 queue-6.1/dmaengine-ioatdma-fix-kmemleak-in-ioat_pci_probe.patch create mode 100644 queue-6.1/dmaengine-ioatdma-fix-leaking-on-version-mismatch.patch create mode 100644 queue-6.1/dmaengine-ioatdma-fix-missing-kmem_cache_destroy.patch create mode 100644 queue-6.1/firmware-psci-fix-return-value-from-psci_system_susp.patch create mode 100644 queue-6.1/rdma-mlx5-add-check-for-srq-max_sge-attribute.patch create mode 100644 queue-6.1/regulator-bd71815-fix-ramp-values.patch create mode 100644 queue-6.1/regulator-core-fix-modpost-error-regulator_get_regma.patch diff --git a/queue-6.1/acpica-revert-acpica-avoid-info-mapping-multiple-bar.patch b/queue-6.1/acpica-revert-acpica-avoid-info-mapping-multiple-bar.patch new file mode 100644 index 00000000000..9fd1caad08c --- /dev/null +++ b/queue-6.1/acpica-revert-acpica-avoid-info-mapping-multiple-bar.patch @@ -0,0 +1,84 @@ +From abdb8c011178db921705c1739de883380874fc1d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Jun 2024 19:31:49 +0530 +Subject: ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your + kernel is fine." + +From: Raju Rangoju + +[ Upstream commit a83e1385b780d41307433ddbc86e3c528db031f0 ] + +Undo the modifications made in commit d410ee5109a1 ("ACPICA: avoid +"Info: mapping multiple BARs. Your kernel is fine.""). The initial +purpose of this commit was to stop memory mappings for operation +regions from overlapping page boundaries, as it can trigger warnings +if different page attributes are present. + +However, it was found that when this situation arises, mapping +continues until the boundary's end, but there is still an attempt to +read/write the entire length of the map, leading to a NULL pointer +deference. For example, if a four-byte mapping request is made but +only one byte is mapped because it hits the current page boundary's +end, a four-byte read/write attempt is still made, resulting in a NULL +pointer deference. + +Instead, map the entire length, as the ACPI specification does not +mandate that it must be within the same page boundary. It is +permissible for it to be mapped across different regions. + +Link: https://github.com/acpica/acpica/pull/954 +Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218849 +Fixes: d410ee5109a1 ("ACPICA: avoid "Info: mapping multiple BARs. Your kernel is fine."") +Co-developed-by: Sanath S +Signed-off-by: Sanath S +Signed-off-by: Raju Rangoju +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/acpica/exregion.c | 23 ++--------------------- + 1 file changed, 2 insertions(+), 21 deletions(-) + +diff --git a/drivers/acpi/acpica/exregion.c b/drivers/acpi/acpica/exregion.c +index 4ff35852c0b38..8906aa4464054 100644 +--- a/drivers/acpi/acpica/exregion.c ++++ b/drivers/acpi/acpica/exregion.c +@@ -44,7 +44,6 @@ acpi_ex_system_memory_space_handler(u32 function, + struct acpi_mem_mapping *mm = mem_info->cur_mm; + u32 length; + acpi_size map_length; +- acpi_size page_boundary_map_length; + #ifdef ACPI_MISALIGNMENT_NOT_SUPPORTED + u32 remainder; + #endif +@@ -138,26 +137,8 @@ acpi_ex_system_memory_space_handler(u32 function, + map_length = (acpi_size) + ((mem_info->address + mem_info->length) - address); + +- /* +- * If mapping the entire remaining portion of the region will cross +- * a page boundary, just map up to the page boundary, do not cross. +- * On some systems, crossing a page boundary while mapping regions +- * can cause warnings if the pages have different attributes +- * due to resource management. +- * +- * This has the added benefit of constraining a single mapping to +- * one page, which is similar to the original code that used a 4k +- * maximum window. +- */ +- page_boundary_map_length = (acpi_size) +- (ACPI_ROUND_UP(address, ACPI_DEFAULT_PAGE_SIZE) - address); +- if (page_boundary_map_length == 0) { +- page_boundary_map_length = ACPI_DEFAULT_PAGE_SIZE; +- } +- +- if (map_length > page_boundary_map_length) { +- map_length = page_boundary_map_length; +- } ++ if (map_length > ACPI_DEFAULT_PAGE_SIZE) ++ map_length = ACPI_DEFAULT_PAGE_SIZE; + + /* Create a new mapping starting at the address given */ + +-- +2.43.0 + diff --git a/queue-6.1/arm64-dts-freescale-imx8mm-verdin-enable-hysteresis-.patch b/queue-6.1/arm64-dts-freescale-imx8mm-verdin-enable-hysteresis-.patch new file mode 100644 index 00000000000..18b96754c2b --- /dev/null +++ b/queue-6.1/arm64-dts-freescale-imx8mm-verdin-enable-hysteresis-.patch @@ -0,0 +1,40 @@ +From da00985f8554c5c324051281ae8e52a1ec63fed5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Jun 2024 16:00:45 +0200 +Subject: arm64: dts: freescale: imx8mm-verdin: enable hysteresis on slow input + pin + +From: Max Krummenacher + +[ Upstream commit 67cc6125fb39902169707cb6277f010e56d4a40a ] + +SODIMM 17 can be used as an edge triggered interrupt supplied from an +off board source. + +Enable hysteresis on the pinmuxing to increase immunity against noise +on the signal. + +Fixes: 60f01b5b5c7d ("arm64: dts: imx8mm-verdin: update iomux configuration") +Signed-off-by: Max Krummenacher +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi b/arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi +index b4aef79650c69..0dd2f79c4f20f 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi +@@ -930,7 +930,7 @@ + /* Verdin GPIO_9_DSI (pulled-up as active-low) */ + pinctrl_gpio_9_dsi: gpio9dsigrp { + fsl,pins = +- ; /* SODIMM 17 */ ++ ; /* SODIMM 17 */ + }; + + /* Verdin GPIO_10_DSI (pulled-up as active-low) */ +-- +2.43.0 + diff --git a/queue-6.1/arm64-dts-imx93-11x11-evk-remove-the-no-sdio-propert.patch b/queue-6.1/arm64-dts-imx93-11x11-evk-remove-the-no-sdio-propert.patch new file mode 100644 index 00000000000..a8f1239d7f7 --- /dev/null +++ b/queue-6.1/arm64-dts-imx93-11x11-evk-remove-the-no-sdio-propert.patch @@ -0,0 +1,40 @@ +From 9101bf47d0a49333a44d19f075da23d41f9a8786 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 May 2024 00:48:54 -0300 +Subject: arm64: dts: imx93-11x11-evk: Remove the 'no-sdio' property + +From: Fabio Estevam + +[ Upstream commit a5d400b6439ac734a5c0dbb641e26a38736abc17 ] + +The usdhc2 port is connected to the microSD slot. The presence of the +'no-sdio' property prevents Wifi SDIO cards, such as CMP9010-X-EVB [1] +to be detected. + +Remove the 'no-sdio' property so that SDIO cards could also work. + +[1] https://www.nxp.com/products/wireless-connectivity/wi-fi-plus-bluetooth-plus-802-15-4/cmp9010-x-evb-iw416-usd-interface-evaluation-board:CMP9010-X-EVB + +Fixes: e37907bd8294 ("arm64: dts: freescale: add i.MX93 11x11 EVK basic support") +Signed-off-by: Fabio Estevam +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx93-11x11-evk.dts | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx93-11x11-evk.dts b/arch/arm64/boot/dts/freescale/imx93-11x11-evk.dts +index 27f9a9f331346..5a212c05adc67 100644 +--- a/arch/arm64/boot/dts/freescale/imx93-11x11-evk.dts ++++ b/arch/arm64/boot/dts/freescale/imx93-11x11-evk.dts +@@ -60,7 +60,6 @@ + vmmc-supply = <®_usdhc2_vmmc>; + bus-width = <4>; + status = "okay"; +- no-sdio; + no-mmc; + }; + +-- +2.43.0 + diff --git a/queue-6.1/dmaengine-idxd-fix-possible-use-after-free-in-irq_pr.patch b/queue-6.1/dmaengine-idxd-fix-possible-use-after-free-in-irq_pr.patch new file mode 100644 index 00000000000..2eb6ba47c50 --- /dev/null +++ b/queue-6.1/dmaengine-idxd-fix-possible-use-after-free-in-irq_pr.patch @@ -0,0 +1,48 @@ +From aad323b56ecffb6e3fa25c23bfac6bc6aaa97ff6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Jun 2024 09:24:44 +0800 +Subject: dmaengine: idxd: Fix possible Use-After-Free in irq_process_work_list + +From: Li RongQing + +[ Upstream commit e3215deca4520773cd2b155bed164c12365149a7 ] + +Use list_for_each_entry_safe() to allow iterating through the list and +deleting the entry in the iteration process. The descriptor is freed via +idxd_desc_complete() and there's a slight chance may cause issue for +the list iterator when the descriptor is reused by another thread +without it being deleted from the list. + +Fixes: 16e19e11228b ("dmaengine: idxd: Fix list corruption in description completion") +Signed-off-by: Li RongQing +Reviewed-by: Dave Jiang +Reviewed-by: Fenghua Yu +Link: https://lore.kernel.org/r/20240603012444.11902-1-lirongqing@baidu.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/idxd/irq.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/dma/idxd/irq.c b/drivers/dma/idxd/irq.c +index aa314ebec5878..4a3eb96b8199a 100644 +--- a/drivers/dma/idxd/irq.c ++++ b/drivers/dma/idxd/irq.c +@@ -454,11 +454,13 @@ static void irq_process_work_list(struct idxd_irq_entry *irq_entry) + + spin_unlock(&irq_entry->list_lock); + +- list_for_each_entry(desc, &flist, list) { ++ list_for_each_entry_safe(desc, n, &flist, list) { + /* + * Check against the original status as ABORT is software defined + * and 0xff, which DSA_COMP_STATUS_MASK can mask out. + */ ++ list_del(&desc->list); ++ + if (unlikely(desc->completion->status == IDXD_COMP_DESC_ABORT)) { + idxd_dma_complete_txd(desc, IDXD_COMPLETE_ABORT, true); + continue; +-- +2.43.0 + diff --git a/queue-6.1/dmaengine-ioat-drop-redundant-pci_enable_pcie_error_.patch b/queue-6.1/dmaengine-ioat-drop-redundant-pci_enable_pcie_error_.patch new file mode 100644 index 00000000000..4a308ef4960 --- /dev/null +++ b/queue-6.1/dmaengine-ioat-drop-redundant-pci_enable_pcie_error_.patch @@ -0,0 +1,71 @@ +From 143508492fefb9a3914d171a4f2778a415d06364 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Mar 2023 13:26:54 -0600 +Subject: dmaengine: ioat: Drop redundant pci_enable_pcie_error_reporting() + +From: Bjorn Helgaas + +[ Upstream commit e32622f84ae289dc7a04e9f01cd62cb914fdc5c6 ] + +pci_enable_pcie_error_reporting() enables the device to send ERR_* +Messages. Since f26e58bf6f54 ("PCI/AER: Enable error reporting when AER is +native"), the PCI core does this for all devices during enumeration, so the +driver doesn't need to do it itself. + +Remove the redundant pci_enable_pcie_error_reporting() call from the +driver. Also remove the corresponding pci_disable_pcie_error_reporting() +from the driver .remove() path. + +Note that this only controls ERR_* Messages from the device. An ERR_* +Message may cause the Root Port to generate an interrupt, depending on the +AER Root Error Command register managed by the AER service driver. + +Signed-off-by: Bjorn Helgaas +Acked-by: Dave Jiang +Link: https://lore.kernel.org/r/20230307192655.874008-2-helgaas@kernel.org +Signed-off-by: Vinod Koul +Stable-dep-of: 1b11b4ef6bd6 ("dmaengine: ioatdma: Fix leaking on version mismatch") +Signed-off-by: Sasha Levin +--- + drivers/dma/ioat/init.c | 6 ------ + 1 file changed, 6 deletions(-) + +diff --git a/drivers/dma/ioat/init.c b/drivers/dma/ioat/init.c +index 5d707ff635542..6ca62edf47bd7 100644 +--- a/drivers/dma/ioat/init.c ++++ b/drivers/dma/ioat/init.c +@@ -15,7 +15,6 @@ + #include + #include + #include +-#include + #include + #include "dma.h" + #include "registers.h" +@@ -1380,15 +1379,11 @@ static int ioat_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) + if (is_skx_ioat(pdev)) + device->version = IOAT_VER_3_2; + err = ioat3_dma_probe(device, ioat_dca_enabled); +- +- if (device->version >= IOAT_VER_3_3) +- pci_enable_pcie_error_reporting(pdev); + } else + return -ENODEV; + + if (err) { + dev_err(dev, "Intel(R) I/OAT DMA Engine init failed\n"); +- pci_disable_pcie_error_reporting(pdev); + return -ENODEV; + } + +@@ -1411,7 +1406,6 @@ static void ioat_remove(struct pci_dev *pdev) + device->dca = NULL; + } + +- pci_disable_pcie_error_reporting(pdev); + ioat_dma_remove(device); + } + +-- +2.43.0 + diff --git a/queue-6.1/dmaengine-ioat-use-pci-core-macros-for-pcie-capabili.patch b/queue-6.1/dmaengine-ioat-use-pci-core-macros-for-pcie-capabili.patch new file mode 100644 index 00000000000..9a476900557 --- /dev/null +++ b/queue-6.1/dmaengine-ioat-use-pci-core-macros-for-pcie-capabili.patch @@ -0,0 +1,67 @@ +From 7ad57683c5dcfe13e63ec57291a76180375e5953 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Mar 2023 15:46:15 -0600 +Subject: dmaengine: ioat: use PCI core macros for PCIe Capability + +From: Bjorn Helgaas + +[ Upstream commit 8f6707d0773be31972768abd6e0bf7b8515b5b1a ] + +The PCIe Capability is defined by the PCIe spec, so use the PCI_EXP_DEVCTL +macros defined by the PCI core instead of defining copies in IOAT. This +makes it easier to find all uses of the PCIe Device Control register. No +functional change intended. + +Signed-off-by: Bjorn Helgaas +Acked-by: Dave Jiang +Link: https://lore.kernel.org/r/20230307214615.887354-1-helgaas@kernel.org +Signed-off-by: Vinod Koul +Stable-dep-of: f0dc9fda2e0e ("dmaengine: ioatdma: Fix error path in ioat3_dma_probe()") +Signed-off-by: Sasha Levin +--- + drivers/dma/ioat/init.c | 6 +++--- + drivers/dma/ioat/registers.h | 7 ------- + 2 files changed, 3 insertions(+), 10 deletions(-) + +diff --git a/drivers/dma/ioat/init.c b/drivers/dma/ioat/init.c +index 79dcd2061b023..fc9580761825f 100644 +--- a/drivers/dma/ioat/init.c ++++ b/drivers/dma/ioat/init.c +@@ -1190,13 +1190,13 @@ static int ioat3_dma_probe(struct ioatdma_device *ioat_dma, int dca) + ioat_dma->dca = ioat_dca_init(pdev, ioat_dma->reg_base); + + /* disable relaxed ordering */ +- err = pcie_capability_read_word(pdev, IOAT_DEVCTRL_OFFSET, &val16); ++ err = pcie_capability_read_word(pdev, PCI_EXP_DEVCTL, &val16); + if (err) + return pcibios_err_to_errno(err); + + /* clear relaxed ordering enable */ +- val16 &= ~IOAT_DEVCTRL_ROE; +- err = pcie_capability_write_word(pdev, IOAT_DEVCTRL_OFFSET, val16); ++ val16 &= ~PCI_EXP_DEVCTL_RELAX_EN; ++ err = pcie_capability_write_word(pdev, PCI_EXP_DEVCTL, val16); + if (err) + return pcibios_err_to_errno(err); + +diff --git a/drivers/dma/ioat/registers.h b/drivers/dma/ioat/registers.h +index f55a5f92f1857..54cf0ad39887b 100644 +--- a/drivers/dma/ioat/registers.h ++++ b/drivers/dma/ioat/registers.h +@@ -14,13 +14,6 @@ + #define IOAT_PCI_CHANERR_INT_OFFSET 0x180 + #define IOAT_PCI_CHANERRMASK_INT_OFFSET 0x184 + +-/* PCIe config registers */ +- +-/* EXPCAPID + N */ +-#define IOAT_DEVCTRL_OFFSET 0x8 +-/* relaxed ordering enable */ +-#define IOAT_DEVCTRL_ROE 0x10 +- + /* MMIO Device Registers */ + #define IOAT_CHANCNT_OFFSET 0x00 /* 8-bit */ + +-- +2.43.0 + diff --git a/queue-6.1/dmaengine-ioatdma-fix-error-path-in-ioat3_dma_probe.patch b/queue-6.1/dmaengine-ioatdma-fix-error-path-in-ioat3_dma_probe.patch new file mode 100644 index 00000000000..813e2b10482 --- /dev/null +++ b/queue-6.1/dmaengine-ioatdma-fix-error-path-in-ioat3_dma_probe.patch @@ -0,0 +1,94 @@ +From eb047f87f80b949399d80e4ff543c13d1fa954c0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 May 2024 09:09:24 +0300 +Subject: dmaengine: ioatdma: Fix error path in ioat3_dma_probe() + +From: Nikita Shubin + +[ Upstream commit f0dc9fda2e0ee9e01496c2f5aca3a831131fad79 ] + +Make sure we are disabling interrupts and destroying DMA pool if +pcie_capability_read/write_word() call failed. + +Fixes: 511deae0261c ("dmaengine: ioatdma: disable relaxed ordering for ioatdma") +Signed-off-by: Nikita Shubin +Reviewed-by: Dave Jiang +Link: https://lore.kernel.org/r/20240528-ioatdma-fixes-v2-2-a9f2fbe26ab1@yadro.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/ioat/init.c | 33 +++++++++++++++------------------ + 1 file changed, 15 insertions(+), 18 deletions(-) + +diff --git a/drivers/dma/ioat/init.c b/drivers/dma/ioat/init.c +index fc9580761825f..3a4299f695758 100644 +--- a/drivers/dma/ioat/init.c ++++ b/drivers/dma/ioat/init.c +@@ -534,18 +534,6 @@ static int ioat_probe(struct ioatdma_device *ioat_dma) + return err; + } + +-static int ioat_register(struct ioatdma_device *ioat_dma) +-{ +- int err = dma_async_device_register(&ioat_dma->dma_dev); +- +- if (err) { +- ioat_disable_interrupts(ioat_dma); +- dma_pool_destroy(ioat_dma->completion_pool); +- } +- +- return err; +-} +- + static void ioat_dma_remove(struct ioatdma_device *ioat_dma) + { + struct dma_device *dma = &ioat_dma->dma_dev; +@@ -1180,9 +1168,9 @@ static int ioat3_dma_probe(struct ioatdma_device *ioat_dma, int dca) + ioat_chan->reg_base + IOAT_DCACTRL_OFFSET); + } + +- err = ioat_register(ioat_dma); ++ err = dma_async_device_register(&ioat_dma->dma_dev); + if (err) +- return err; ++ goto err_disable_interrupts; + + ioat_kobject_add(ioat_dma, &ioat_ktype); + +@@ -1191,20 +1179,29 @@ static int ioat3_dma_probe(struct ioatdma_device *ioat_dma, int dca) + + /* disable relaxed ordering */ + err = pcie_capability_read_word(pdev, PCI_EXP_DEVCTL, &val16); +- if (err) +- return pcibios_err_to_errno(err); ++ if (err) { ++ err = pcibios_err_to_errno(err); ++ goto err_disable_interrupts; ++ } + + /* clear relaxed ordering enable */ + val16 &= ~PCI_EXP_DEVCTL_RELAX_EN; + err = pcie_capability_write_word(pdev, PCI_EXP_DEVCTL, val16); +- if (err) +- return pcibios_err_to_errno(err); ++ if (err) { ++ err = pcibios_err_to_errno(err); ++ goto err_disable_interrupts; ++ } + + if (ioat_dma->cap & IOAT_CAP_DPS) + writeb(ioat_pending_level + 1, + ioat_dma->reg_base + IOAT_PREFETCH_LIMIT_OFFSET); + + return 0; ++ ++err_disable_interrupts: ++ ioat_disable_interrupts(ioat_dma); ++ dma_pool_destroy(ioat_dma->completion_pool); ++ return err; + } + + static void ioat_shutdown(struct pci_dev *pdev) +-- +2.43.0 + diff --git a/queue-6.1/dmaengine-ioatdma-fix-kmemleak-in-ioat_pci_probe.patch b/queue-6.1/dmaengine-ioatdma-fix-kmemleak-in-ioat_pci_probe.patch new file mode 100644 index 00000000000..34be8a4bf70 --- /dev/null +++ b/queue-6.1/dmaengine-ioatdma-fix-kmemleak-in-ioat_pci_probe.patch @@ -0,0 +1,66 @@ +From 4413db366d8fa7ccc47ddf51f8622fb6471fa7b6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 May 2024 09:09:25 +0300 +Subject: dmaengine: ioatdma: Fix kmemleak in ioat_pci_probe() + +From: Nikita Shubin + +[ Upstream commit 29b7cd255f3628e0d65be33a939d8b5bba10aa62 ] + +If probing fails we end up with leaking ioatdma_device and each +allocated channel. + +Following kmemleak easy to reproduce by injecting an error in +ioat_alloc_chan_resources() when doing ioat_dma_self_test(). + +unreferenced object 0xffff888014ad5800 (size 1024): [..] + [] kmemleak_alloc+0x4a/0x80 + [] kmalloc_trace+0x270/0x2f0 + [] ioat_pci_probe+0xc1/0x1c0 [ioatdma] +[..] + +repeated for each ioatdma channel: + +unreferenced object 0xffff8880148e5c00 (size 512): [..] + [] kmemleak_alloc+0x4a/0x80 + [] kmalloc_trace+0x270/0x2f0 + [] ioat_enumerate_channels+0x101/0x2d0 [ioatdma] + [] ioat3_dma_probe+0x4d6/0x970 [ioatdma] + [] ioat_pci_probe+0x181/0x1c0 [ioatdma] +[..] + +Fixes: bf453a0a18b2 ("dmaengine: ioat: Support in-use unbind") +Signed-off-by: Nikita Shubin +Reviewed-by: Dave Jiang +Link: https://lore.kernel.org/r/20240528-ioatdma-fixes-v2-3-a9f2fbe26ab1@yadro.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/ioat/init.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/dma/ioat/init.c b/drivers/dma/ioat/init.c +index 3a4299f695758..d54b3f120b4dd 100644 +--- a/drivers/dma/ioat/init.c ++++ b/drivers/dma/ioat/init.c +@@ -1346,6 +1346,7 @@ static int ioat_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) + void __iomem * const *iomap; + struct device *dev = &pdev->dev; + struct ioatdma_device *device; ++ unsigned int i; + u8 version; + int err; + +@@ -1383,6 +1384,9 @@ static int ioat_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) + + err = ioat3_dma_probe(device, ioat_dca_enabled); + if (err) { ++ for (i = 0; i < IOAT_MAX_CHANS; i++) ++ kfree(device->idx[i]); ++ kfree(device); + dev_err(dev, "Intel(R) I/OAT DMA Engine init failed\n"); + return -ENODEV; + } +-- +2.43.0 + diff --git a/queue-6.1/dmaengine-ioatdma-fix-leaking-on-version-mismatch.patch b/queue-6.1/dmaengine-ioatdma-fix-leaking-on-version-mismatch.patch new file mode 100644 index 00000000000..1d717671ea9 --- /dev/null +++ b/queue-6.1/dmaengine-ioatdma-fix-leaking-on-version-mismatch.patch @@ -0,0 +1,69 @@ +From 3553d9a5b9678e57bd3720a2489d160e87eb757b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 May 2024 09:09:23 +0300 +Subject: dmaengine: ioatdma: Fix leaking on version mismatch + +From: Nikita Shubin + +[ Upstream commit 1b11b4ef6bd68591dcaf8423c7d05e794e6aec6f ] + +Fix leaking ioatdma_device if I/OAT version is less than IOAT_VER_3_0. + +Fixes: bf453a0a18b2 ("dmaengine: ioat: Support in-use unbind") +Signed-off-by: Nikita Shubin +Reviewed-by: Dave Jiang +Link: https://lore.kernel.org/r/20240528-ioatdma-fixes-v2-1-a9f2fbe26ab1@yadro.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/ioat/init.c | 17 ++++++++++------- + 1 file changed, 10 insertions(+), 7 deletions(-) + +diff --git a/drivers/dma/ioat/init.c b/drivers/dma/ioat/init.c +index 6ca62edf47bd7..79dcd2061b023 100644 +--- a/drivers/dma/ioat/init.c ++++ b/drivers/dma/ioat/init.c +@@ -1349,6 +1349,7 @@ static int ioat_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) + void __iomem * const *iomap; + struct device *dev = &pdev->dev; + struct ioatdma_device *device; ++ u8 version; + int err; + + err = pcim_enable_device(pdev); +@@ -1362,6 +1363,10 @@ static int ioat_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) + if (!iomap) + return -ENOMEM; + ++ version = readb(iomap[IOAT_MMIO_BAR] + IOAT_VER_OFFSET); ++ if (version < IOAT_VER_3_0) ++ return -ENODEV; ++ + err = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(64)); + if (err) + return err; +@@ -1372,16 +1377,14 @@ static int ioat_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) + pci_set_master(pdev); + pci_set_drvdata(pdev, device); + +- device->version = readb(device->reg_base + IOAT_VER_OFFSET); ++ device->version = version; + if (device->version >= IOAT_VER_3_4) + ioat_dca_enabled = 0; +- if (device->version >= IOAT_VER_3_0) { +- if (is_skx_ioat(pdev)) +- device->version = IOAT_VER_3_2; +- err = ioat3_dma_probe(device, ioat_dca_enabled); +- } else +- return -ENODEV; + ++ if (is_skx_ioat(pdev)) ++ device->version = IOAT_VER_3_2; ++ ++ err = ioat3_dma_probe(device, ioat_dca_enabled); + if (err) { + dev_err(dev, "Intel(R) I/OAT DMA Engine init failed\n"); + return -ENODEV; +-- +2.43.0 + diff --git a/queue-6.1/dmaengine-ioatdma-fix-missing-kmem_cache_destroy.patch b/queue-6.1/dmaengine-ioatdma-fix-missing-kmem_cache_destroy.patch new file mode 100644 index 00000000000..f3613128546 --- /dev/null +++ b/queue-6.1/dmaengine-ioatdma-fix-missing-kmem_cache_destroy.patch @@ -0,0 +1,46 @@ +From 0ffd9f54499e75eea337b59c2b0ea097d148b6c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 May 2024 13:52:31 +0300 +Subject: dmaengine: ioatdma: Fix missing kmem_cache_destroy() + +From: Nikita Shubin + +[ Upstream commit 5422145d0b749ad554ada772133b9b20f9fb0ec8 ] + +Fix missing kmem_cache_destroy() for ioat_sed_cache in +ioat_exit_module(). + +Noticed via: + +``` +modprobe ioatdma +rmmod ioatdma +modprobe ioatdma +debugfs: Directory 'ioat_sed_ent' with parent 'slab' already present! +``` + +Fixes: c0f28ce66ecf ("dmaengine: ioatdma: move all the init routines") +Signed-off-by: Nikita Shubin +Acked-by: Dave Jiang +Link: https://lore.kernel.org/r/20240514-ioatdma_fixes-v1-1-2776a0913254@yadro.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/ioat/init.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/dma/ioat/init.c b/drivers/dma/ioat/init.c +index d54b3f120b4dd..ec8b2b5e4ef00 100644 +--- a/drivers/dma/ioat/init.c ++++ b/drivers/dma/ioat/init.c +@@ -1448,6 +1448,7 @@ module_init(ioat_init_module); + static void __exit ioat_exit_module(void) + { + pci_unregister_driver(&ioat_pci_driver); ++ kmem_cache_destroy(ioat_sed_cache); + kmem_cache_destroy(ioat_cache); + } + module_exit(ioat_exit_module); +-- +2.43.0 + diff --git a/queue-6.1/firmware-psci-fix-return-value-from-psci_system_susp.patch b/queue-6.1/firmware-psci-fix-return-value-from-psci_system_susp.patch new file mode 100644 index 00000000000..05394b38562 --- /dev/null +++ b/queue-6.1/firmware-psci-fix-return-value-from-psci_system_susp.patch @@ -0,0 +1,49 @@ +From f2808dd9ef5bff963aeb807c19bf2c71cdaab471 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 May 2024 10:55:28 +0100 +Subject: firmware: psci: Fix return value from psci_system_suspend() + +From: Sudeep Holla + +[ Upstream commit e7c3696d4692e8046d25f6e63f983e934e12f2c5 ] + +Currently we return the value from invoke_psci_fn() directly as return +value from psci_system_suspend(). It is wrong to send the PSCI interface +return value directly. psci_to_linux_errno() provide the mapping from +PSCI return value to the one that can be returned to the callers within +the kernel. + +Use psci_to_linux_errno() to convert and return the correct value from +psci_system_suspend(). + +Fixes: faf7ec4a92c0 ("drivers: firmware: psci: add system suspend support") +Acked-by: Mark Rutland +Signed-off-by: Sudeep Holla +Link: https://lore.kernel.org/r/20240515095528.1949992-1-sudeep.holla@arm.com +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + drivers/firmware/psci/psci.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/firmware/psci/psci.c b/drivers/firmware/psci/psci.c +index f78249fe2512a..a44ba09e49d9c 100644 +--- a/drivers/firmware/psci/psci.c ++++ b/drivers/firmware/psci/psci.c +@@ -485,10 +485,12 @@ int psci_cpu_suspend_enter(u32 state) + + static int psci_system_suspend(unsigned long unused) + { ++ int err; + phys_addr_t pa_cpu_resume = __pa_symbol(cpu_resume); + +- return invoke_psci_fn(PSCI_FN_NATIVE(1_0, SYSTEM_SUSPEND), ++ err = invoke_psci_fn(PSCI_FN_NATIVE(1_0, SYSTEM_SUSPEND), + pa_cpu_resume, 0, 0); ++ return psci_to_linux_errno(err); + } + + static int psci_system_suspend_enter(suspend_state_t state) +-- +2.43.0 + diff --git a/queue-6.1/rdma-mlx5-add-check-for-srq-max_sge-attribute.patch b/queue-6.1/rdma-mlx5-add-check-for-srq-max_sge-attribute.patch new file mode 100644 index 00000000000..2de47cb912c --- /dev/null +++ b/queue-6.1/rdma-mlx5-add-check-for-srq-max_sge-attribute.patch @@ -0,0 +1,55 @@ +From e57f7a5d1c5a4245ad81963779554d0b8fb1734e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 May 2024 15:52:56 +0300 +Subject: RDMA/mlx5: Add check for srq max_sge attribute + +From: Patrisious Haddad + +[ Upstream commit 36ab7ada64caf08f10ee5a114d39964d1f91e81d ] + +max_sge attribute is passed by the user, and is inserted and used +unchecked, so verify that the value doesn't exceed maximum allowed value +before using it. + +Fixes: e126ba97dba9 ("mlx5: Add driver for Mellanox Connect-IB adapters") +Signed-off-by: Patrisious Haddad +Link: https://lore.kernel.org/r/277ccc29e8d57bfd53ddeb2ac633f2760cf8cdd0.1716900410.git.leon@kernel.org +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mlx5/srq.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +diff --git a/drivers/infiniband/hw/mlx5/srq.c b/drivers/infiniband/hw/mlx5/srq.c +index 09b365a98bbf3..731e6721a82bc 100644 +--- a/drivers/infiniband/hw/mlx5/srq.c ++++ b/drivers/infiniband/hw/mlx5/srq.c +@@ -199,17 +199,20 @@ int mlx5_ib_create_srq(struct ib_srq *ib_srq, + int err; + struct mlx5_srq_attr in = {}; + __u32 max_srq_wqes = 1 << MLX5_CAP_GEN(dev->mdev, log_max_srq_sz); ++ __u32 max_sge_sz = MLX5_CAP_GEN(dev->mdev, max_wqe_sz_rq) / ++ sizeof(struct mlx5_wqe_data_seg); + + if (init_attr->srq_type != IB_SRQT_BASIC && + init_attr->srq_type != IB_SRQT_XRC && + init_attr->srq_type != IB_SRQT_TM) + return -EOPNOTSUPP; + +- /* Sanity check SRQ size before proceeding */ +- if (init_attr->attr.max_wr >= max_srq_wqes) { +- mlx5_ib_dbg(dev, "max_wr %d, cap %d\n", +- init_attr->attr.max_wr, +- max_srq_wqes); ++ /* Sanity check SRQ and sge size before proceeding */ ++ if (init_attr->attr.max_wr >= max_srq_wqes || ++ init_attr->attr.max_sge > max_sge_sz) { ++ mlx5_ib_dbg(dev, "max_wr %d,wr_cap %d,max_sge %d, sge_cap:%d\n", ++ init_attr->attr.max_wr, max_srq_wqes, ++ init_attr->attr.max_sge, max_sge_sz); + return -EINVAL; + } + +-- +2.43.0 + diff --git a/queue-6.1/regulator-bd71815-fix-ramp-values.patch b/queue-6.1/regulator-bd71815-fix-ramp-values.patch new file mode 100644 index 00000000000..4bd1a1457b5 --- /dev/null +++ b/queue-6.1/regulator-bd71815-fix-ramp-values.patch @@ -0,0 +1,40 @@ +From 04089244bceeaa99409d7bd68140dcecbf528adc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Jun 2024 14:42:34 +0300 +Subject: regulator: bd71815: fix ramp values + +From: Kalle Niemi + +[ Upstream commit 4cac29b846f38d5f0654cdfff5c5bfc37305081c ] + +Ramp values are inverted. This caused wrong values written to register +when ramp values were defined in device tree. + +Invert values in table to fix this. + +Signed-off-by: Kalle Niemi +Fixes: 1aad39001e85 ("regulator: Support ROHM BD71815 regulators") +Reviewed-by: Matti Vaittinen +Link: https://lore.kernel.org/r/ZmmJXtuVJU6RgQAH@latitude5580 +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/bd71815-regulator.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/regulator/bd71815-regulator.c b/drivers/regulator/bd71815-regulator.c +index c2b8b8be78242..4696255fca5d7 100644 +--- a/drivers/regulator/bd71815-regulator.c ++++ b/drivers/regulator/bd71815-regulator.c +@@ -257,7 +257,7 @@ static int buck12_set_hw_dvs_levels(struct device_node *np, + * 10: 2.50mV/usec 10mV 4uS + * 11: 1.25mV/usec 10mV 8uS + */ +-static const unsigned int bd7181x_ramp_table[] = { 1250, 2500, 5000, 10000 }; ++static const unsigned int bd7181x_ramp_table[] = { 10000, 5000, 2500, 1250 }; + + static int bd7181x_led_set_current_limit(struct regulator_dev *rdev, + int min_uA, int max_uA) +-- +2.43.0 + diff --git a/queue-6.1/regulator-core-fix-modpost-error-regulator_get_regma.patch b/queue-6.1/regulator-core-fix-modpost-error-regulator_get_regma.patch new file mode 100644 index 00000000000..93c99716032 --- /dev/null +++ b/queue-6.1/regulator-core-fix-modpost-error-regulator_get_regma.patch @@ -0,0 +1,38 @@ +From 999c2197f098c3b0e9e4c6978f4616eafb5cda67 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Jun 2024 20:55:32 +0100 +Subject: regulator: core: Fix modpost error "regulator_get_regmap" undefined + +From: Biju Das + +[ Upstream commit 3f60497c658d2072714d097a177612d34b34aa3d ] + +Fix the modpost error "regulator_get_regmap" undefined by adding export +symbol. + +Fixes: 04eca28cde52 ("regulator: Add helpers for low-level register access") +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202406110117.mk5UR3VZ-lkp@intel.com +Signed-off-by: Biju Das +Link: https://lore.kernel.org/r/20240610195532.175942-1-biju.das.jz@bp.renesas.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/core.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c +index ff11f37e28c71..518b64b2d69bc 100644 +--- a/drivers/regulator/core.c ++++ b/drivers/regulator/core.c +@@ -3341,6 +3341,7 @@ struct regmap *regulator_get_regmap(struct regulator *regulator) + + return map ? map : ERR_PTR(-EOPNOTSUPP); + } ++EXPORT_SYMBOL_GPL(regulator_get_regmap); + + /** + * regulator_get_hardware_vsel_register - get the HW voltage selector register +-- +2.43.0 + diff --git a/queue-6.1/series b/queue-6.1/series index 5f29e1b74c1..bad610cddb3 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -75,3 +75,17 @@ seg6-fix-parameter-passing-when-calling-nf_hook-in-e.patch ice-fix-vsi-list-rule-with-ice_sw_lkup_last-type.patch bnxt_en-restore-ptp-tx_avail-count-in-case-of-skb_pa.patch net-usb-rtl8150-fix-unintiatilzed-variables-in-rtl81.patch +regulator-core-fix-modpost-error-regulator_get_regma.patch +dmaengine-idxd-fix-possible-use-after-free-in-irq_pr.patch +dmaengine-ioat-drop-redundant-pci_enable_pcie_error_.patch +dmaengine-ioatdma-fix-leaking-on-version-mismatch.patch +dmaengine-ioat-use-pci-core-macros-for-pcie-capabili.patch +dmaengine-ioatdma-fix-error-path-in-ioat3_dma_probe.patch +dmaengine-ioatdma-fix-kmemleak-in-ioat_pci_probe.patch +dmaengine-ioatdma-fix-missing-kmem_cache_destroy.patch +regulator-bd71815-fix-ramp-values.patch +arm64-dts-imx93-11x11-evk-remove-the-no-sdio-propert.patch +arm64-dts-freescale-imx8mm-verdin-enable-hysteresis-.patch +acpica-revert-acpica-avoid-info-mapping-multiple-bar.patch +firmware-psci-fix-return-value-from-psci_system_susp.patch +rdma-mlx5-add-check-for-srq-max_sge-attribute.patch -- 2.47.3