From 5cda3ec2ab212aba5c45fda7de8014ba81244560 Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Sun, 11 Jun 2023 23:51:37 -0400 Subject: [PATCH] Fixes for 6.1 Signed-off-by: Sasha Levin --- ...imbalanced-reference-counter-for-eth.patch | 87 +++++++++ ...a7g5ek-fix-debounce-delay-property-f.patch | 37 ++++ ...s-dma-assign-default-clock-rate-for-.patch | 65 +++++++ ...-dts-imx8mn-beacon-fix-spi-cs-pinmux.patch | 48 +++++ ...-mek-correct-gpios-for-usdhc2-cd-and.patch | 38 ++++ ...c7180-lite-fix-sdram-freq-for-miside.patch | 87 +++++++++ ...-sc8280xp-flush-rsc-sleep-wake-votes.patch | 41 +++++ ...881x-do-not-set-can_multi_write-flag.patch | 39 ++++ ...883x-do-not-set-can_multi_write-flag.patch | 39 ++++ ...8195-afe-pcm-convert-to-platform-rem.patch | 69 +++++++ ...8195-fix-use-after-free-in-driver-re.patch | 173 ++++++++++++++++++ ...-utils-fix-pcm-constraint-error-chec.patch | 47 +++++ ..._mq_hw_ctx-active-request-accounting.patch | 85 +++++++++ .../eeprom-at24-also-select-regmap.patch | 49 +++++ ...-set-handle-field-to-zero-in-memory-.patch | 39 ++++ ...ory-corruption-when-adding-named-lin.patch | 45 +++++ ...reading-invalid-status-value-in-atom.patch | 68 +++++++ ...-i2c-adapter-in-.remove-s-error-path.patch | 53 ++++++ ...-__user-string-arg-print-fault-issue.patch | 68 +++++++ ...prot-of-vm_write-and-vm_exec-must-be.patch | 59 ++++++ queue-6.1/series | 24 +++ ...-add-missing-clear-of-alloc_slave_rt.patch | 42 +++++ ...duse-avoid-empty-string-for-dev-name.patch | 64 +++++++ ...cked-when-setting-getting-vring_base.patch | 85 +++++++++ ...rt-packed-when-setting-getting-vring.patch | 64 +++++++ 25 files changed, 1515 insertions(+) create mode 100644 queue-6.1/arm-at91-pm-fix-imbalanced-reference-counter-for-eth.patch create mode 100644 queue-6.1/arm-dts-at91-sama7g5ek-fix-debounce-delay-property-f.patch create mode 100644 queue-6.1/arm64-dts-imx8-ss-dma-assign-default-clock-rate-for-.patch create mode 100644 queue-6.1/arm64-dts-imx8mn-beacon-fix-spi-cs-pinmux.patch create mode 100644 queue-6.1/arm64-dts-imx8qm-mek-correct-gpios-for-usdhc2-cd-and.patch create mode 100644 queue-6.1/arm64-dts-qcom-sc7180-lite-fix-sdram-freq-for-miside.patch create mode 100644 queue-6.1/arm64-dts-qcom-sc8280xp-flush-rsc-sleep-wake-votes.patch create mode 100644 queue-6.1/asoc-codecs-wsa881x-do-not-set-can_multi_write-flag.patch create mode 100644 queue-6.1/asoc-codecs-wsa883x-do-not-set-can_multi_write-flag.patch create mode 100644 queue-6.1/asoc-mediatek-mt8195-afe-pcm-convert-to-platform-rem.patch create mode 100644 queue-6.1/asoc-mediatek-mt8195-fix-use-after-free-in-driver-re.patch create mode 100644 queue-6.1/asoc-simple-card-utils-fix-pcm-constraint-error-chec.patch create mode 100644 queue-6.1/blk-mq-fix-blk_mq_hw_ctx-active-request-accounting.patch create mode 100644 queue-6.1/eeprom-at24-also-select-regmap.patch create mode 100644 queue-6.1/firmware-arm_ffa-set-handle-field-to-zero-in-memory-.patch create mode 100644 queue-6.1/gpio-sim-fix-memory-corruption-when-adding-named-lin.patch create mode 100644 queue-6.1/i2c-mv64xxx-fix-reading-invalid-status-value-in-atom.patch create mode 100644 queue-6.1/i2c-sprd-delete-i2c-adapter-in-.remove-s-error-path.patch create mode 100644 queue-6.1/riscv-fix-kprobe-__user-string-arg-print-fault-issue.patch create mode 100644 queue-6.1/riscv-mm-ensure-prot-of-vm_write-and-vm_exec-must-be.patch create mode 100644 queue-6.1/soundwire-stream-add-missing-clear-of-alloc_slave_rt.patch create mode 100644 queue-6.1/vduse-avoid-empty-string-for-dev-name.patch create mode 100644 queue-6.1/vhost-support-packed-when-setting-getting-vring_base.patch create mode 100644 queue-6.1/vhost_vdpa-support-packed-when-setting-getting-vring.patch diff --git a/queue-6.1/arm-at91-pm-fix-imbalanced-reference-counter-for-eth.patch b/queue-6.1/arm-at91-pm-fix-imbalanced-reference-counter-for-eth.patch new file mode 100644 index 00000000000..0cd30c0bb9d --- /dev/null +++ b/queue-6.1/arm-at91-pm-fix-imbalanced-reference-counter-for-eth.patch @@ -0,0 +1,87 @@ +From 75f4fa5c26ca33edaf433a9b1a10eb2206612616 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 May 2023 09:25:11 +0300 +Subject: ARM: at91: pm: fix imbalanced reference counter for ethernet devices + +From: Claudiu Beznea + +[ Upstream commit ccd4923d18d5698a5910d516646ce125b9155d47 ] + +The of_find_device_by_node() function is returning a struct platform_device +object with the embedded struct device member's reference counter +incremented. This needs to be dropped when done with the platform device +returned by of_find_device_by_node(). + +at91_pm_eth_quirk_is_valid() calls of_find_device_by_node() on +suspend and resume path. On suspend it calls of_find_device_by_node() and +on resume and failure paths it drops the counter of +struct platform_device::dev. + +In case ethernet device may not wakeup there is a put_device() on +at91_pm_eth_quirk_is_valid() which is wrong as it colides with +put_device() on resume path leading to the reference counter of struct +device embedded in struct platform_device to be messed, stack trace to be +displayed (after 5 consecutive suspend/resume cycles) and execution to +hang. + +Along with this the error path of at91_pm_config_quirks() had been also +adapted to decrement propertly the reference counter of struct device +embedded in struct platform_device. + +Fixes: b7fc72c63399 ("ARM: at91: pm: add quirks for pm") +Signed-off-by: Claudiu Beznea +Acked-by: Nicolas Ferre +Link: https://lore.kernel.org/r/20230518062511.2988500-1-claudiu.beznea@microchip.com +Signed-off-by: Sasha Levin +--- + arch/arm/mach-at91/pm.c | 20 +++++++++----------- + 1 file changed, 9 insertions(+), 11 deletions(-) + +diff --git a/arch/arm/mach-at91/pm.c b/arch/arm/mach-at91/pm.c +index 60dc56d8acfb9..437dd0352fd44 100644 +--- a/arch/arm/mach-at91/pm.c ++++ b/arch/arm/mach-at91/pm.c +@@ -334,16 +334,14 @@ static bool at91_pm_eth_quirk_is_valid(struct at91_pm_quirk_eth *eth) + pdev = of_find_device_by_node(eth->np); + if (!pdev) + return false; ++ /* put_device(eth->dev) is called at the end of suspend. */ + eth->dev = &pdev->dev; + } + + /* No quirks if device isn't a wakeup source. */ +- if (!device_may_wakeup(eth->dev)) { +- put_device(eth->dev); ++ if (!device_may_wakeup(eth->dev)) + return false; +- } + +- /* put_device(eth->dev) is called at the end of suspend. */ + return true; + } + +@@ -439,14 +437,14 @@ static int at91_pm_config_quirks(bool suspend) + pr_err("AT91: PM: failed to enable %s clocks\n", + j == AT91_PM_G_ETH ? "geth" : "eth"); + } +- } else { +- /* +- * Release the reference to eth->dev taken in +- * at91_pm_eth_quirk_is_valid(). +- */ +- put_device(eth->dev); +- eth->dev = NULL; + } ++ ++ /* ++ * Release the reference to eth->dev taken in ++ * at91_pm_eth_quirk_is_valid(). ++ */ ++ put_device(eth->dev); ++ eth->dev = NULL; + } + + return ret; +-- +2.39.2 + diff --git a/queue-6.1/arm-dts-at91-sama7g5ek-fix-debounce-delay-property-f.patch b/queue-6.1/arm-dts-at91-sama7g5ek-fix-debounce-delay-property-f.patch new file mode 100644 index 00000000000..2be7a563dd7 --- /dev/null +++ b/queue-6.1/arm-dts-at91-sama7g5ek-fix-debounce-delay-property-f.patch @@ -0,0 +1,37 @@ +From 7ad196338e20002297b3a33a4969a1e6894f1ef9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 May 2023 08:27:50 +0300 +Subject: ARM: dts: at91: sama7g5ek: fix debounce delay property for shdwc + +From: Claudiu Beznea + +[ Upstream commit 6b0db163ff9200a55dc77a652dad1d4b0a853f63 ] + +There is no atmel,shdwc-debouncer property for SHDWC. The right DT property +is debounce-delay-us. Use it. + +Fixes: 16b161bcf5d4 ("ARM: dts: at91: sama7g5: add shdwc node") +Signed-off-by: Claudiu Beznea +Acked-by: Nicolas Ferre +Link: https://lore.kernel.org/r/20230523052750.184223-1-claudiu.beznea@microchip.com +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/at91-sama7g5ek.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/at91-sama7g5ek.dts b/arch/arm/boot/dts/at91-sama7g5ek.dts +index 3b25c67795ddb..4af8a1c96ed63 100644 +--- a/arch/arm/boot/dts/at91-sama7g5ek.dts ++++ b/arch/arm/boot/dts/at91-sama7g5ek.dts +@@ -789,7 +789,7 @@ &sdmmc2 { + }; + + &shdwc { +- atmel,shdwc-debouncer = <976>; ++ debounce-delay-us = <976>; + status = "okay"; + + input@0 { +-- +2.39.2 + diff --git a/queue-6.1/arm64-dts-imx8-ss-dma-assign-default-clock-rate-for-.patch b/queue-6.1/arm64-dts-imx8-ss-dma-assign-default-clock-rate-for-.patch new file mode 100644 index 00000000000..5e36069f378 --- /dev/null +++ b/queue-6.1/arm64-dts-imx8-ss-dma-assign-default-clock-rate-for-.patch @@ -0,0 +1,65 @@ +From 32cc03b8154f70e240dd229d72b17486b9037917 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 May 2023 10:38:54 -0500 +Subject: arm64: dts: imx8-ss-dma: assign default clock rate for lpuarts + +From: Shenwei Wang + +[ Upstream commit ca50d7765587fe0a8351a6e8d9742cfd4811d925 ] + +Add the assigned-clocks and assigned-clock-rates properties for the +LPUARTx nodes. Without these properties, the default clock rate +used would be 0, which can cause the UART ports to fail when open. + +Fixes: 35f4e9d7530f ("arm64: dts: imx8: split adma ss into dma and audio ss") +Signed-off-by: Shenwei Wang +Reviewed-by: Fabio Estevam +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8-ss-dma.dtsi | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/arch/arm64/boot/dts/freescale/imx8-ss-dma.dtsi b/arch/arm64/boot/dts/freescale/imx8-ss-dma.dtsi +index d7b4229bb4a23..9ad56aaf19b42 100644 +--- a/arch/arm64/boot/dts/freescale/imx8-ss-dma.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8-ss-dma.dtsi +@@ -26,6 +26,8 @@ lpuart0: serial@5a060000 { + clocks = <&uart0_lpcg IMX_LPCG_CLK_4>, + <&uart0_lpcg IMX_LPCG_CLK_0>; + clock-names = "ipg", "baud"; ++ assigned-clocks = <&clk IMX_SC_R_UART_0 IMX_SC_PM_CLK_PER>; ++ assigned-clock-rates = <80000000>; + power-domains = <&pd IMX_SC_R_UART_0>; + status = "disabled"; + }; +@@ -36,6 +38,8 @@ lpuart1: serial@5a070000 { + clocks = <&uart1_lpcg IMX_LPCG_CLK_4>, + <&uart1_lpcg IMX_LPCG_CLK_0>; + clock-names = "ipg", "baud"; ++ assigned-clocks = <&clk IMX_SC_R_UART_1 IMX_SC_PM_CLK_PER>; ++ assigned-clock-rates = <80000000>; + power-domains = <&pd IMX_SC_R_UART_1>; + status = "disabled"; + }; +@@ -46,6 +50,8 @@ lpuart2: serial@5a080000 { + clocks = <&uart2_lpcg IMX_LPCG_CLK_4>, + <&uart2_lpcg IMX_LPCG_CLK_0>; + clock-names = "ipg", "baud"; ++ assigned-clocks = <&clk IMX_SC_R_UART_2 IMX_SC_PM_CLK_PER>; ++ assigned-clock-rates = <80000000>; + power-domains = <&pd IMX_SC_R_UART_2>; + status = "disabled"; + }; +@@ -56,6 +62,8 @@ lpuart3: serial@5a090000 { + clocks = <&uart3_lpcg IMX_LPCG_CLK_4>, + <&uart3_lpcg IMX_LPCG_CLK_0>; + clock-names = "ipg", "baud"; ++ assigned-clocks = <&clk IMX_SC_R_UART_3 IMX_SC_PM_CLK_PER>; ++ assigned-clock-rates = <80000000>; + power-domains = <&pd IMX_SC_R_UART_3>; + status = "disabled"; + }; +-- +2.39.2 + diff --git a/queue-6.1/arm64-dts-imx8mn-beacon-fix-spi-cs-pinmux.patch b/queue-6.1/arm64-dts-imx8mn-beacon-fix-spi-cs-pinmux.patch new file mode 100644 index 00000000000..f3b9edbb453 --- /dev/null +++ b/queue-6.1/arm64-dts-imx8mn-beacon-fix-spi-cs-pinmux.patch @@ -0,0 +1,48 @@ +From 6ebe6a9e9f03619917cb381db8b6a9ece71e04c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 28 May 2023 06:22:54 -0500 +Subject: arm64: dts: imx8mn-beacon: Fix SPI CS pinmux + +From: Adam Ford + +[ Upstream commit 9bf2e534313fcf420367668cc1f30e10469901dc ] + +The final production baseboard had a different chip select than +earlier prototype boards. When the newer board was released, +the SPI stopped working because the wrong pin was used in the device +tree and conflicted with the UART RTS. Fix the pinmux for +production boards. + +Fixes: 36ca3c8ccb53 ("arm64: dts: imx: Add Beacon i.MX8M Nano development kit") +Signed-off-by: Adam Ford +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8mn-beacon-baseboard.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mn-beacon-baseboard.dtsi b/arch/arm64/boot/dts/freescale/imx8mn-beacon-baseboard.dtsi +index 9e82069c941fa..5a1f7c30afe57 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mn-beacon-baseboard.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mn-beacon-baseboard.dtsi +@@ -81,7 +81,7 @@ sound { + &ecspi2 { + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_espi2>; +- cs-gpios = <&gpio5 9 GPIO_ACTIVE_LOW>; ++ cs-gpios = <&gpio5 13 GPIO_ACTIVE_LOW>; + status = "okay"; + + eeprom@0 { +@@ -202,7 +202,7 @@ pinctrl_espi2: espi2grp { + MX8MN_IOMUXC_ECSPI2_SCLK_ECSPI2_SCLK 0x82 + MX8MN_IOMUXC_ECSPI2_MOSI_ECSPI2_MOSI 0x82 + MX8MN_IOMUXC_ECSPI2_MISO_ECSPI2_MISO 0x82 +- MX8MN_IOMUXC_ECSPI1_SS0_GPIO5_IO9 0x41 ++ MX8MN_IOMUXC_ECSPI2_SS0_GPIO5_IO13 0x41 + >; + }; + +-- +2.39.2 + diff --git a/queue-6.1/arm64-dts-imx8qm-mek-correct-gpios-for-usdhc2-cd-and.patch b/queue-6.1/arm64-dts-imx8qm-mek-correct-gpios-for-usdhc2-cd-and.patch new file mode 100644 index 00000000000..ac712b844d1 --- /dev/null +++ b/queue-6.1/arm64-dts-imx8qm-mek-correct-gpios-for-usdhc2-cd-and.patch @@ -0,0 +1,38 @@ +From 77227e3d17137e28299826fbb2e1d0260000e52d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 May 2023 08:54:21 -0500 +Subject: arm64: dts: imx8qm-mek: correct GPIOs for USDHC2 CD and WP signals + +From: Shenwei Wang + +[ Upstream commit 2b28fc688cdff225c41cdd22857500e187453ed7 ] + +The USDHC2 CD and WP sginal should be on LSIO_GPIO5. + +Fixes: 307fd14d4b14 ("arm64: dts: imx: add imx8qm mek support") +Signed-off-by: Shenwei Wang +Reviewed-by: Fabio Estevam +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8qm-mek.dts | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx8qm-mek.dts b/arch/arm64/boot/dts/freescale/imx8qm-mek.dts +index ce9d3f0b98fc0..607cd6b4e9721 100644 +--- a/arch/arm64/boot/dts/freescale/imx8qm-mek.dts ++++ b/arch/arm64/boot/dts/freescale/imx8qm-mek.dts +@@ -82,8 +82,8 @@ &usdhc2 { + pinctrl-0 = <&pinctrl_usdhc2>; + bus-width = <4>; + vmmc-supply = <®_usdhc2_vmmc>; +- cd-gpios = <&lsio_gpio4 22 GPIO_ACTIVE_LOW>; +- wp-gpios = <&lsio_gpio4 21 GPIO_ACTIVE_HIGH>; ++ cd-gpios = <&lsio_gpio5 22 GPIO_ACTIVE_LOW>; ++ wp-gpios = <&lsio_gpio5 21 GPIO_ACTIVE_HIGH>; + status = "okay"; + }; + +-- +2.39.2 + diff --git a/queue-6.1/arm64-dts-qcom-sc7180-lite-fix-sdram-freq-for-miside.patch b/queue-6.1/arm64-dts-qcom-sc7180-lite-fix-sdram-freq-for-miside.patch new file mode 100644 index 00000000000..cc48a84c7ca --- /dev/null +++ b/queue-6.1/arm64-dts-qcom-sc7180-lite-fix-sdram-freq-for-miside.patch @@ -0,0 +1,87 @@ +From 73e5cfc9029fcf5bd8b6fd3239d61fd00a4103cc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 May 2023 17:19:29 -0700 +Subject: arm64: dts: qcom: sc7180-lite: Fix SDRAM freq for misidentified + sc7180-lite boards + +From: Douglas Anderson + +[ Upstream commit 3a735530c159b75e1402c08abe1ba4eb99a1f7a3 ] + +In general, the three SKUs of sc7180 (lite, normal, and pro) are +handled dynamically. + +The cpufreq table in sc7180.dtsi includes the superset of all CPU +frequencies. The "qcom-cpufreq-hw" driver in Linux shows that we can +dynamically detect which frequencies are actually available on the +currently running CPU and then we can just enable those ones. + +The GPU is similarly dynamic. The nvmem has a fuse in it (see +"gpu_speed_bin" in sc7180.dtsi) that the GPU driver can use to figure +out which frequencies to enable. + +There is one part, however, that is not so dynamic. The way SDRAM +frequency works in sc7180 is that it's tied to cpufreq. At the busiest +cpufreq operating points we'll pick the top supported SDRAM frequency. +They ramp down together. + +For the "pro" SKU of sc7180, we only enable one extra cpufreq step. +That extra cpufreq step runs SDRAM at the same speed as the step +below. Thus, for normal and pro things are OK. There is no sc7180-pro +device tree snippet. + +For the "lite" SKU if sc7180, however, things aren't so easy. The +"lite" SKU drops 3 cpufreq entries but can still run SDRAM at max +frequency. That messed things up with the whole scheme. This is why we +added the "sc7180-lite" fragment in commit 8fd01e01fd6f ("arm64: dts: +qcom: sc7180-lite: Tweak DDR/L3 scaling on SC7180-lite"). + +When the lite scheme came about, it was agreed that the WiFi SKUs of +lazor would _always_ be "lite" and would, in fact, be the only "lite" +devices. Unfortunately, this decision changed and folks didn't realize +that it would be a problem. Specifically, some later lazor WiFi-only +devices were built with "pro" CPUs. + +Building WiFi-only lazor with "pro" CPUs isn't the end of the world. +The SDRAM will ramp up a little sooner than it otherwise would, but +aside from a small power hit things work OK. One problem, though, is +that the SDRAM scaling becomes a bit quirky. Specifically, with the +current tables we'll max out SDRAM frequency at 2.1GHz but then +_lower_ it at 2.2GHz / 2.3GHz only to raise it back to max for 2.4GHz +and 2.55GHz. + +Let's at least fix this so that the SDRAM frequency doesn't go down in +that quirky way. On true "lite" SKUs this change will be a no-op +because the operating points we're touching are disabled. This change +is only useful when a board that thinks it has a "lite" CPU actually +has a "normal" or "pro" one stuffed. + +Fixes: 8fd01e01fd6f ("arm64: dts: qcom: sc7180-lite: Tweak DDR/L3 scaling on SC7180-lite") +Signed-off-by: Douglas Anderson +Reviewed-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230515171929.1.Ic8dee2cb79ce39ffc04eab2a344dde47b2f9459f@changeid +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sc7180-lite.dtsi | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/arch/arm64/boot/dts/qcom/sc7180-lite.dtsi b/arch/arm64/boot/dts/qcom/sc7180-lite.dtsi +index d8ed1d7b4ec76..4b306a59d9bec 100644 +--- a/arch/arm64/boot/dts/qcom/sc7180-lite.dtsi ++++ b/arch/arm64/boot/dts/qcom/sc7180-lite.dtsi +@@ -16,3 +16,11 @@ &cpu6_opp11 { + &cpu6_opp12 { + opp-peak-kBps = <8532000 23347200>; + }; ++ ++&cpu6_opp13 { ++ opp-peak-kBps = <8532000 23347200>; ++}; ++ ++&cpu6_opp14 { ++ opp-peak-kBps = <8532000 23347200>; ++}; +-- +2.39.2 + diff --git a/queue-6.1/arm64-dts-qcom-sc8280xp-flush-rsc-sleep-wake-votes.patch b/queue-6.1/arm64-dts-qcom-sc8280xp-flush-rsc-sleep-wake-votes.patch new file mode 100644 index 00000000000..d6b61b35821 --- /dev/null +++ b/queue-6.1/arm64-dts-qcom-sc8280xp-flush-rsc-sleep-wake-votes.patch @@ -0,0 +1,41 @@ +From 801bb11409b7aca0d3eec261dd13ee435e226826 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 May 2023 08:04:25 -0700 +Subject: arm64: dts: qcom: sc8280xp: Flush RSC sleep & wake votes + +From: Bjorn Andersson + +[ Upstream commit ce7c014937c442be677963848c7db62eccd94eac ] + +The rpmh driver will cache sleep and wake votes until the cluster +power-domain is about to enter idle, to avoid unnecessary writes. So +associate the apps_rsc with the cluster pd, so that it can be notified +about this event. + +Without this, only AMC votes are being commited. + +Signed-off-by: Bjorn Andersson +Reviewed-by: Konrad Dybcio +Fixes: 152d1faf1e2f ("arm64: dts: qcom: add SC8280XP platform") +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230512150425.3171122-1-quic_bjorande@quicinc.com +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sc8280xp.dtsi | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi +index ba684d980cf26..1afc960bab5c9 100644 +--- a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi ++++ b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi +@@ -1727,6 +1727,7 @@ apps_rsc: rsc@18200000 { + qcom,tcs-config = , , + , ; + label = "apps_rsc"; ++ power-domains = <&CLUSTER_PD>; + + apps_bcm_voter: bcm-voter { + compatible = "qcom,bcm-voter"; +-- +2.39.2 + diff --git a/queue-6.1/asoc-codecs-wsa881x-do-not-set-can_multi_write-flag.patch b/queue-6.1/asoc-codecs-wsa881x-do-not-set-can_multi_write-flag.patch new file mode 100644 index 00000000000..7ab84974a0a --- /dev/null +++ b/queue-6.1/asoc-codecs-wsa881x-do-not-set-can_multi_write-flag.patch @@ -0,0 +1,39 @@ +From 29560e7f02e542981a145dcb5be260e34152db3b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 May 2023 16:46:05 +0100 +Subject: ASoC: codecs: wsa881x: do not set can_multi_write flag + +From: Srinivas Kandagatla + +[ Upstream commit 6e7a6d4797ef521c0762914610ed682e102b9d36 ] + +regmap-sdw does not support multi register writes, so there is +no point in setting this flag. This also leads to incorrect +programming of WSA codecs with regmap_multi_reg_write() call. + +This invalid configuration should have been rejected by regmap-sdw. + +Fixes: a0aab9e1404a ("ASoC: codecs: add wsa881x amplifier support") +Signed-off-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20230523154605.4284-2-srinivas.kandagatla@linaro.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wsa881x.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/sound/soc/codecs/wsa881x.c b/sound/soc/codecs/wsa881x.c +index 046843b57b038..264ec05a3c675 100644 +--- a/sound/soc/codecs/wsa881x.c ++++ b/sound/soc/codecs/wsa881x.c +@@ -648,7 +648,6 @@ static struct regmap_config wsa881x_regmap_config = { + .readable_reg = wsa881x_readable_register, + .reg_format_endian = REGMAP_ENDIAN_NATIVE, + .val_format_endian = REGMAP_ENDIAN_NATIVE, +- .can_multi_write = true, + }; + + enum { +-- +2.39.2 + diff --git a/queue-6.1/asoc-codecs-wsa883x-do-not-set-can_multi_write-flag.patch b/queue-6.1/asoc-codecs-wsa883x-do-not-set-can_multi_write-flag.patch new file mode 100644 index 00000000000..21d032a4258 --- /dev/null +++ b/queue-6.1/asoc-codecs-wsa883x-do-not-set-can_multi_write-flag.patch @@ -0,0 +1,39 @@ +From 5034435dafc8993b584b590f42c252d83cd4d445 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 May 2023 16:46:04 +0100 +Subject: ASoC: codecs: wsa883x: do not set can_multi_write flag + +From: Srinivas Kandagatla + +[ Upstream commit 40ba0411074485e2cf1bf8ee0f3db27bdff88394 ] + +regmap-sdw does not support multi register writes, so there is +no point in setting this flag. This also leads to incorrect +programming of WSA codecs with regmap_multi_reg_write() call. + +This invalid configuration should have been rejected by regmap-sdw. + +Fixes: 43b8c7dc85a1 ("ASoC: codecs: add wsa883x amplifier support") +Signed-off-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20230523154605.4284-1-srinivas.kandagatla@linaro.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wsa883x.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/sound/soc/codecs/wsa883x.c b/sound/soc/codecs/wsa883x.c +index 6e9a64c5948e2..b152f4e5c4f2b 100644 +--- a/sound/soc/codecs/wsa883x.c ++++ b/sound/soc/codecs/wsa883x.c +@@ -950,7 +950,6 @@ static struct regmap_config wsa883x_regmap_config = { + .writeable_reg = wsa883x_writeable_register, + .reg_format_endian = REGMAP_ENDIAN_NATIVE, + .val_format_endian = REGMAP_ENDIAN_NATIVE, +- .can_multi_write = true, + .use_single_read = true, + }; + +-- +2.39.2 + diff --git a/queue-6.1/asoc-mediatek-mt8195-afe-pcm-convert-to-platform-rem.patch b/queue-6.1/asoc-mediatek-mt8195-afe-pcm-convert-to-platform-rem.patch new file mode 100644 index 00000000000..2e4b557d7fe --- /dev/null +++ b/queue-6.1/asoc-mediatek-mt8195-afe-pcm-convert-to-platform-rem.patch @@ -0,0 +1,69 @@ +From 91b90cd5a268685620c7ccc64a1a98fc1afad8dc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Mar 2023 16:06:45 +0100 +Subject: ASoC: mediatek: mt8195-afe-pcm: Convert to platform remove callback + returning void +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 6461fee68064ba970e3ba90241fe5f5e038aa9d4 ] + +The .remove() callback for a platform driver returns an int which makes +many driver authors wrongly assume it's possible to do error handling by +returning an error code. However the value returned is (mostly) ignored +and this typically results in resource leaks. To improve here there is a +quest to make the remove callback return void. In the first step of this +quest all drivers are converted to .remove_new() which already returns +void. + +Trivially convert this driver from always returning zero in the remove +callback to the void returning variant. + +Signed-off-by: Uwe Kleine-König +Reviewed-by: AngeloGioacchino Del Regno +Acked-by: Takashi Iwai +Acked-by: Nicolas Ferre +Link: https://lore.kernel.org/r/20230315150745.67084-114-u.kleine-koenig@pengutronix.de +Signed-off-by: Mark Brown +Stable-dep-of: dc93f0dcb436 ("ASoC: mediatek: mt8195: fix use-after-free in driver remove path") +Signed-off-by: Sasha Levin +--- + sound/soc/mediatek/mt8195/mt8195-afe-pcm.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/sound/soc/mediatek/mt8195/mt8195-afe-pcm.c b/sound/soc/mediatek/mt8195/mt8195-afe-pcm.c +index 72b2c6d629b93..9e45efeada55c 100644 +--- a/sound/soc/mediatek/mt8195/mt8195-afe-pcm.c ++++ b/sound/soc/mediatek/mt8195/mt8195-afe-pcm.c +@@ -3253,7 +3253,7 @@ static int mt8195_afe_pcm_dev_probe(struct platform_device *pdev) + return ret; + } + +-static int mt8195_afe_pcm_dev_remove(struct platform_device *pdev) ++static void mt8195_afe_pcm_dev_remove(struct platform_device *pdev) + { + struct mtk_base_afe *afe = platform_get_drvdata(pdev); + +@@ -3264,7 +3264,6 @@ static int mt8195_afe_pcm_dev_remove(struct platform_device *pdev) + mt8195_afe_runtime_suspend(&pdev->dev); + + mt8195_afe_deinit_clock(afe); +- return 0; + } + + static const struct of_device_id mt8195_afe_pcm_dt_match[] = { +@@ -3285,7 +3284,7 @@ static struct platform_driver mt8195_afe_pcm_driver = { + .pm = &mt8195_afe_pm_ops, + }, + .probe = mt8195_afe_pcm_dev_probe, +- .remove = mt8195_afe_pcm_dev_remove, ++ .remove_new = mt8195_afe_pcm_dev_remove, + }; + + module_platform_driver(mt8195_afe_pcm_driver); +-- +2.39.2 + diff --git a/queue-6.1/asoc-mediatek-mt8195-fix-use-after-free-in-driver-re.patch b/queue-6.1/asoc-mediatek-mt8195-fix-use-after-free-in-driver-re.patch new file mode 100644 index 00000000000..d1ddab065e6 --- /dev/null +++ b/queue-6.1/asoc-mediatek-mt8195-fix-use-after-free-in-driver-re.patch @@ -0,0 +1,173 @@ +From 6ed1e2b4f6dbaeaf6147e3821b86d25ec5224d7f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Jun 2023 11:33:18 +0800 +Subject: ASoC: mediatek: mt8195: fix use-after-free in driver remove path + +From: Trevor Wu + +[ Upstream commit dc93f0dcb436dfd24a06c5b3c0f4c5cd9296e8e5 ] + +During mt8195_afe_init_clock(), mt8195_audsys_clk_register() was called +followed by several other devm functions. At mt8195_afe_deinit_clock() +located at mt8195_afe_pcm_dev_remove(), mt8195_audsys_clk_unregister() +was called. + +However, there was an issue with the order in which these functions were +called. Specifically, the remove callback of platform_driver was called +before devres released the resource, resulting in a use-after-free issue +during remove time. + +At probe time, the order of calls was: +1. mt8195_audsys_clk_register +2. afe_priv->clk = devm_kcalloc +3. afe_priv->clk[i] = devm_clk_get + +At remove time, the order of calls was: +1. mt8195_audsys_clk_unregister +3. free afe_priv->clk[i] +2. free afe_priv->clk + +To resolve the problem, we can utilize devm_add_action_or_reset() in +mt8195_audsys_clk_register() so that the remove order can be changed to +3->2->1. + +Fixes: 6746cc858259 ("ASoC: mediatek: mt8195: add platform driver") +Signed-off-by: Trevor Wu +Reviewed-by: Douglas Anderson +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20230601033318.10408-3-trevor.wu@mediatek.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/mediatek/mt8195/mt8195-afe-clk.c | 5 -- + sound/soc/mediatek/mt8195/mt8195-afe-clk.h | 1 - + sound/soc/mediatek/mt8195/mt8195-afe-pcm.c | 4 -- + sound/soc/mediatek/mt8195/mt8195-audsys-clk.c | 47 ++++++++++--------- + sound/soc/mediatek/mt8195/mt8195-audsys-clk.h | 1 - + 5 files changed, 24 insertions(+), 34 deletions(-) + +diff --git a/sound/soc/mediatek/mt8195/mt8195-afe-clk.c b/sound/soc/mediatek/mt8195/mt8195-afe-clk.c +index 9ca2cb8c8a9c2..f35318ae07392 100644 +--- a/sound/soc/mediatek/mt8195/mt8195-afe-clk.c ++++ b/sound/soc/mediatek/mt8195/mt8195-afe-clk.c +@@ -410,11 +410,6 @@ int mt8195_afe_init_clock(struct mtk_base_afe *afe) + return 0; + } + +-void mt8195_afe_deinit_clock(struct mtk_base_afe *afe) +-{ +- mt8195_audsys_clk_unregister(afe); +-} +- + int mt8195_afe_enable_clk(struct mtk_base_afe *afe, struct clk *clk) + { + int ret; +diff --git a/sound/soc/mediatek/mt8195/mt8195-afe-clk.h b/sound/soc/mediatek/mt8195/mt8195-afe-clk.h +index 40663e31becd1..a08c0ee6c8602 100644 +--- a/sound/soc/mediatek/mt8195/mt8195-afe-clk.h ++++ b/sound/soc/mediatek/mt8195/mt8195-afe-clk.h +@@ -101,7 +101,6 @@ int mt8195_afe_get_mclk_source_clk_id(int sel); + int mt8195_afe_get_mclk_source_rate(struct mtk_base_afe *afe, int apll); + int mt8195_afe_get_default_mclk_source_by_rate(int rate); + int mt8195_afe_init_clock(struct mtk_base_afe *afe); +-void mt8195_afe_deinit_clock(struct mtk_base_afe *afe); + int mt8195_afe_enable_clk(struct mtk_base_afe *afe, struct clk *clk); + void mt8195_afe_disable_clk(struct mtk_base_afe *afe, struct clk *clk); + int mt8195_afe_prepare_clk(struct mtk_base_afe *afe, struct clk *clk); +diff --git a/sound/soc/mediatek/mt8195/mt8195-afe-pcm.c b/sound/soc/mediatek/mt8195/mt8195-afe-pcm.c +index 9e45efeada55c..03dabc056b916 100644 +--- a/sound/soc/mediatek/mt8195/mt8195-afe-pcm.c ++++ b/sound/soc/mediatek/mt8195/mt8195-afe-pcm.c +@@ -3255,15 +3255,11 @@ static int mt8195_afe_pcm_dev_probe(struct platform_device *pdev) + + static void mt8195_afe_pcm_dev_remove(struct platform_device *pdev) + { +- struct mtk_base_afe *afe = platform_get_drvdata(pdev); +- + snd_soc_unregister_component(&pdev->dev); + + pm_runtime_disable(&pdev->dev); + if (!pm_runtime_status_suspended(&pdev->dev)) + mt8195_afe_runtime_suspend(&pdev->dev); +- +- mt8195_afe_deinit_clock(afe); + } + + static const struct of_device_id mt8195_afe_pcm_dt_match[] = { +diff --git a/sound/soc/mediatek/mt8195/mt8195-audsys-clk.c b/sound/soc/mediatek/mt8195/mt8195-audsys-clk.c +index e0670e0dbd5b0..38594bc3f2f77 100644 +--- a/sound/soc/mediatek/mt8195/mt8195-audsys-clk.c ++++ b/sound/soc/mediatek/mt8195/mt8195-audsys-clk.c +@@ -148,6 +148,29 @@ static const struct afe_gate aud_clks[CLK_AUD_NR_CLK] = { + GATE_AUD6(CLK_AUD_GASRC19, "aud_gasrc19", "top_asm_h", 19), + }; + ++static void mt8195_audsys_clk_unregister(void *data) ++{ ++ struct mtk_base_afe *afe = data; ++ struct mt8195_afe_private *afe_priv = afe->platform_priv; ++ struct clk *clk; ++ struct clk_lookup *cl; ++ int i; ++ ++ if (!afe_priv) ++ return; ++ ++ for (i = 0; i < CLK_AUD_NR_CLK; i++) { ++ cl = afe_priv->lookup[i]; ++ if (!cl) ++ continue; ++ ++ clk = cl->clk; ++ clk_unregister_gate(clk); ++ ++ clkdev_drop(cl); ++ } ++} ++ + int mt8195_audsys_clk_register(struct mtk_base_afe *afe) + { + struct mt8195_afe_private *afe_priv = afe->platform_priv; +@@ -188,27 +211,5 @@ int mt8195_audsys_clk_register(struct mtk_base_afe *afe) + afe_priv->lookup[i] = cl; + } + +- return 0; +-} +- +-void mt8195_audsys_clk_unregister(struct mtk_base_afe *afe) +-{ +- struct mt8195_afe_private *afe_priv = afe->platform_priv; +- struct clk *clk; +- struct clk_lookup *cl; +- int i; +- +- if (!afe_priv) +- return; +- +- for (i = 0; i < CLK_AUD_NR_CLK; i++) { +- cl = afe_priv->lookup[i]; +- if (!cl) +- continue; +- +- clk = cl->clk; +- clk_unregister_gate(clk); +- +- clkdev_drop(cl); +- } ++ return devm_add_action_or_reset(afe->dev, mt8195_audsys_clk_unregister, afe); + } +diff --git a/sound/soc/mediatek/mt8195/mt8195-audsys-clk.h b/sound/soc/mediatek/mt8195/mt8195-audsys-clk.h +index 239d31016ba76..69db2dd1c9e02 100644 +--- a/sound/soc/mediatek/mt8195/mt8195-audsys-clk.h ++++ b/sound/soc/mediatek/mt8195/mt8195-audsys-clk.h +@@ -10,6 +10,5 @@ + #define _MT8195_AUDSYS_CLK_H_ + + int mt8195_audsys_clk_register(struct mtk_base_afe *afe); +-void mt8195_audsys_clk_unregister(struct mtk_base_afe *afe); + + #endif +-- +2.39.2 + diff --git a/queue-6.1/asoc-simple-card-utils-fix-pcm-constraint-error-chec.patch b/queue-6.1/asoc-simple-card-utils-fix-pcm-constraint-error-chec.patch new file mode 100644 index 00000000000..6498fa31fea --- /dev/null +++ b/queue-6.1/asoc-simple-card-utils-fix-pcm-constraint-error-chec.patch @@ -0,0 +1,47 @@ +From d51cbf13da5ede57c4fdda7c31d96afdce889b18 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Jun 2023 19:19:35 -0600 +Subject: ASoC: simple-card-utils: fix PCM constraint error check + +From: Robert Hancock + +[ Upstream commit 635071f5fee31550e921644b2becc42b3ff1036c ] + +The code in asoc_simple_startup was treating any non-zero return from +snd_pcm_hw_constraint_minmax as an error, when this can return 1 in some +normal cases and only negative values indicate an error. + +When this happened, it caused asoc_simple_startup to disable the clocks +it just enabled and return 1, which was not treated as an error by the +calling code which only checks for negative return values. Then when the +PCM is eventually shut down, it causes the clock framework to complain +about disabling clocks that were not enabled. + +Fix the check for snd_pcm_hw_constraint_minmax return value to only +treat negative values as an error. + +Fixes: 5ca2ab459817 ("ASoC: simple-card-utils: Add new system-clock-fixed flag") +Signed-off-by: Robert Hancock +Link: https://lore.kernel.org/r/20230602011936.231931-1-robert.hancock@calian.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/generic/simple-card-utils.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/generic/simple-card-utils.c b/sound/soc/generic/simple-card-utils.c +index be69bbc47f813..8811321717fbb 100644 +--- a/sound/soc/generic/simple-card-utils.c ++++ b/sound/soc/generic/simple-card-utils.c +@@ -335,7 +335,7 @@ int asoc_simple_startup(struct snd_pcm_substream *substream) + } + ret = snd_pcm_hw_constraint_minmax(substream->runtime, SNDRV_PCM_HW_PARAM_RATE, + fixed_rate, fixed_rate); +- if (ret) ++ if (ret < 0) + goto codec_err; + } + +-- +2.39.2 + diff --git a/queue-6.1/blk-mq-fix-blk_mq_hw_ctx-active-request-accounting.patch b/queue-6.1/blk-mq-fix-blk_mq_hw_ctx-active-request-accounting.patch new file mode 100644 index 00000000000..0db31384e9a --- /dev/null +++ b/queue-6.1/blk-mq-fix-blk_mq_hw_ctx-active-request-accounting.patch @@ -0,0 +1,85 @@ +From 8bfcef9c821771662c7d2951bb3bbcc200debe28 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 13 May 2023 18:12:27 -0400 +Subject: blk-mq: fix blk_mq_hw_ctx active request accounting + +From: Tian Lan + +[ Upstream commit ddad59331a4e16088468ca0ad228a9fe32d7955a ] + +The nr_active counter continues to increase over time which causes the +blk_mq_get_tag to hang until the thread is rescheduled to a different +core despite there are still tags available. + +kernel-stack + + INFO: task inboundIOReacto:3014879 blocked for more than 2 seconds + Not tainted 6.1.15-amd64 #1 Debian 6.1.15~debian11 + "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. + task:inboundIOReacto state:D stack:0 pid:3014879 ppid:4557 flags:0x00000000 + Call Trace: + + __schedule+0x351/0xa20 + scheduler+0x5d/0xe0 + io_schedule+0x42/0x70 + blk_mq_get_tag+0x11a/0x2a0 + ? dequeue_task_stop+0x70/0x70 + __blk_mq_alloc_requests+0x191/0x2e0 + +kprobe output showing RQF_MQ_INFLIGHT bit is not cleared before +__blk_mq_free_request being called. + + 320 320 kworker/29:1H __blk_mq_free_request rq_flags 0x220c0 in-flight 1 + b'__blk_mq_free_request+0x1 [kernel]' + b'bt_iter+0x50 [kernel]' + b'blk_mq_queue_tag_busy_iter+0x318 [kernel]' + b'blk_mq_timeout_work+0x7c [kernel]' + b'process_one_work+0x1c4 [kernel]' + b'worker_thread+0x4d [kernel]' + b'kthread+0xe6 [kernel]' + b'ret_from_fork+0x1f [kernel]' + +Signed-off-by: Tian Lan +Fixes: 2e315dc07df0 ("blk-mq: grab rq->refcount before calling ->fn in blk_mq_tagset_busy_iter") +Reviewed-by: Ming Lei +Link: https://lore.kernel.org/r/20230513221227.497327-1-tilan7663@gmail.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-mq.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/block/blk-mq.c b/block/blk-mq.c +index 1ab41fbca0946..add013d5bbdab 100644 +--- a/block/blk-mq.c ++++ b/block/blk-mq.c +@@ -685,6 +685,10 @@ static void __blk_mq_free_request(struct request *rq) + blk_crypto_free_request(rq); + blk_pm_mark_last_busy(rq); + rq->mq_hctx = NULL; ++ ++ if (rq->rq_flags & RQF_MQ_INFLIGHT) ++ __blk_mq_dec_active_requests(hctx); ++ + if (rq->tag != BLK_MQ_NO_TAG) + blk_mq_put_tag(hctx->tags, ctx, rq->tag); + if (sched_tag != BLK_MQ_NO_TAG) +@@ -696,15 +700,11 @@ static void __blk_mq_free_request(struct request *rq) + void blk_mq_free_request(struct request *rq) + { + struct request_queue *q = rq->q; +- struct blk_mq_hw_ctx *hctx = rq->mq_hctx; + + if ((rq->rq_flags & RQF_ELVPRIV) && + q->elevator->type->ops.finish_request) + q->elevator->type->ops.finish_request(rq); + +- if (rq->rq_flags & RQF_MQ_INFLIGHT) +- __blk_mq_dec_active_requests(hctx); +- + if (unlikely(laptop_mode && !blk_rq_is_passthrough(rq))) + laptop_io_completion(q->disk->bdi); + +-- +2.39.2 + diff --git a/queue-6.1/eeprom-at24-also-select-regmap.patch b/queue-6.1/eeprom-at24-also-select-regmap.patch new file mode 100644 index 00000000000..03417fba5ec --- /dev/null +++ b/queue-6.1/eeprom-at24-also-select-regmap.patch @@ -0,0 +1,49 @@ +From 9d52e8050bd700d3b008291910c4eae814507387 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Jun 2023 19:54:24 -0700 +Subject: eeprom: at24: also select REGMAP + +From: Randy Dunlap + +[ Upstream commit 7f3c782b3914e510b646a77aedc3adeac2e4a63b ] + +Selecting only REGMAP_I2C can leave REGMAP unset, causing build errors, +so also select REGMAP to prevent the build errors. + +../drivers/misc/eeprom/at24.c:540:42: warning: 'struct regmap_config' declared inside parameter list will not be visible outside of this definition or declaration + 540 | struct regmap_config *regmap_config) +../drivers/misc/eeprom/at24.c: In function 'at24_make_dummy_client': +../drivers/misc/eeprom/at24.c:552:18: error: implicit declaration of function 'devm_regmap_init_i2c' [-Werror=implicit-function-declaration] + 552 | regmap = devm_regmap_init_i2c(dummy_client, regmap_config); +../drivers/misc/eeprom/at24.c:552:16: warning: assignment to 'struct regmap *' from 'int' makes pointer from integer without a cast [-Wint-conversion] + 552 | regmap = devm_regmap_init_i2c(dummy_client, regmap_config); +../drivers/misc/eeprom/at24.c: In function 'at24_probe': +../drivers/misc/eeprom/at24.c:586:16: error: variable 'regmap_config' has initializer but incomplete type + 586 | struct regmap_config regmap_config = { }; +../drivers/misc/eeprom/at24.c:586:30: error: storage size of 'regmap_config' isn't known + 586 | struct regmap_config regmap_config = { }; +../drivers/misc/eeprom/at24.c:586:30: warning: unused variable 'regmap_config' [-Wunused-variable] + +Fixes: 5c015258478e ("eeprom: at24: add basic regmap_i2c support") +Signed-off-by: Randy Dunlap +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/misc/eeprom/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/misc/eeprom/Kconfig b/drivers/misc/eeprom/Kconfig +index f0a7531f354c1..2d240bfa819f8 100644 +--- a/drivers/misc/eeprom/Kconfig ++++ b/drivers/misc/eeprom/Kconfig +@@ -6,6 +6,7 @@ config EEPROM_AT24 + depends on I2C && SYSFS + select NVMEM + select NVMEM_SYSFS ++ select REGMAP + select REGMAP_I2C + help + Enable this driver to get read/write support to most I2C EEPROMs +-- +2.39.2 + diff --git a/queue-6.1/firmware-arm_ffa-set-handle-field-to-zero-in-memory-.patch b/queue-6.1/firmware-arm_ffa-set-handle-field-to-zero-in-memory-.patch new file mode 100644 index 00000000000..1dcf8551505 --- /dev/null +++ b/queue-6.1/firmware-arm_ffa-set-handle-field-to-zero-in-memory-.patch @@ -0,0 +1,39 @@ +From c458e85e94b7c31a6e370bb07466e3be0b00e22f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Jun 2023 16:07:49 +0200 +Subject: firmware: arm_ffa: Set handle field to zero in memory descriptor + +From: Balint Dobszay + +[ Upstream commit 3aa0519a4780f1b8e11966bd879d4a2934ba455f ] + +As described in the commit 111a833dc5cb ("firmware: arm_ffa: Set +reserved/MBZ fields to zero in the memory descriptors") some fields in +the memory descriptor have to be zeroed explicitly. The handle field is +one of these, but it was left out from that change, fix this now. + +Fixes: 111a833dc5cb ("firmware: arm_ffa: Set reserved/MBZ fields to zero in the memory descriptors") +Reported-by: Imre Kis +Signed-off-by: Balint Dobszay +Link: https://lore.kernel.org/r/20230601140749.93812-1-balint.dobszay@arm.com +Signed-off-by: Sudeep Holla +Signed-off-by: Sasha Levin +--- + drivers/firmware/arm_ffa/driver.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/firmware/arm_ffa/driver.c b/drivers/firmware/arm_ffa/driver.c +index 5904a679d3512..c37e823590055 100644 +--- a/drivers/firmware/arm_ffa/driver.c ++++ b/drivers/firmware/arm_ffa/driver.c +@@ -505,6 +505,7 @@ ffa_setup_and_transmit(u32 func_id, void *buffer, u32 max_fragsize, + ep_mem_access->flag = 0; + ep_mem_access->reserved = 0; + } ++ mem_region->handle = 0; + mem_region->reserved_0 = 0; + mem_region->reserved_1 = 0; + mem_region->ep_count = args->nattrs; +-- +2.39.2 + diff --git a/queue-6.1/gpio-sim-fix-memory-corruption-when-adding-named-lin.patch b/queue-6.1/gpio-sim-fix-memory-corruption-when-adding-named-lin.patch new file mode 100644 index 00000000000..74ec24e3e03 --- /dev/null +++ b/queue-6.1/gpio-sim-fix-memory-corruption-when-adding-named-lin.patch @@ -0,0 +1,45 @@ +From 5629b6671f4eceffbbf5b7190919516547a74c35 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Jun 2023 20:00:34 +0800 +Subject: gpio: sim: fix memory corruption when adding named lines and unnamed + hogs + +From: Kent Gibson + +[ Upstream commit 95ae9979bfe3174c2ee8d64409c44532f2881907 ] + +When constructing the sim, gpio-sim constructs an array of named lines, +sized based on the largest offset of any named line, and then initializes +that array with the names of all lines, including unnamed hogs with higher +offsets. In doing so it writes NULLs beyond the extent of the array. + +Add a check that only named lines are used to initialize the array. + +Fixes: cb8c474e79be ("gpio: sim: new testing module") +Signed-off-by: Kent Gibson +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-sim.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpio/gpio-sim.c b/drivers/gpio/gpio-sim.c +index cff68f31a09fd..803676e307d73 100644 +--- a/drivers/gpio/gpio-sim.c ++++ b/drivers/gpio/gpio-sim.c +@@ -717,8 +717,10 @@ static char **gpio_sim_make_line_names(struct gpio_sim_bank *bank, + if (!line_names) + return ERR_PTR(-ENOMEM); + +- list_for_each_entry(line, &bank->line_list, siblings) +- line_names[line->offset] = line->name; ++ list_for_each_entry(line, &bank->line_list, siblings) { ++ if (line->name && (line->offset <= max_offset)) ++ line_names[line->offset] = line->name; ++ } + + return line_names; + } +-- +2.39.2 + diff --git a/queue-6.1/i2c-mv64xxx-fix-reading-invalid-status-value-in-atom.patch b/queue-6.1/i2c-mv64xxx-fix-reading-invalid-status-value-in-atom.patch new file mode 100644 index 00000000000..9523dc456fc --- /dev/null +++ b/queue-6.1/i2c-mv64xxx-fix-reading-invalid-status-value-in-atom.patch @@ -0,0 +1,68 @@ +From 08a7cfc0087d282d901299b3d086cffbb40b199b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 21 May 2023 14:19:40 +0200 +Subject: i2c: mv64xxx: Fix reading invalid status value in atomic mode +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Marek Behún + +[ Upstream commit 5578d0a79b6430fa1543640dd6f2d397d0886ce7 ] + +There seems to be a bug within the mv64xxx I2C controller, wherein the +status register may not necessarily contain valid value immediately +after the IFLG flag is set in the control register. + +My theory is that the controller: +- first sets the IFLG in control register +- then updates the status register +- then raises an interrupt + +This may sometime cause weird bugs when in atomic mode, since in this +mode we do not wait for an interrupt, but instead we poll the control +register for IFLG and read status register immediately after. + +I encountered -ENXIO from mv64xxx_i2c_fsm() due to this issue when using +this driver in atomic mode. + +Note that I've only seen this issue on Armada 385, I don't know whether +other SOCs with this controller are also affected. Also note that this +fix has been in U-Boot for over 4 years [1] without anybody complaining, +so it should not cause regressions. + +[1] https://source.denx.de/u-boot/u-boot/-/commit/d50e29662f78 + +Fixes: 544a8d75f3d6 ("i2c: mv64xxx: Add atomic_xfer method to driver") +Signed-off-by: Marek Behún +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-mv64xxx.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/drivers/i2c/busses/i2c-mv64xxx.c b/drivers/i2c/busses/i2c-mv64xxx.c +index 047dfef7a6577..878c076ebdc6b 100644 +--- a/drivers/i2c/busses/i2c-mv64xxx.c ++++ b/drivers/i2c/busses/i2c-mv64xxx.c +@@ -520,6 +520,17 @@ mv64xxx_i2c_intr(int irq, void *dev_id) + + while (readl(drv_data->reg_base + drv_data->reg_offsets.control) & + MV64XXX_I2C_REG_CONTROL_IFLG) { ++ /* ++ * It seems that sometime the controller updates the status ++ * register only after it asserts IFLG in control register. ++ * This may result in weird bugs when in atomic mode. A delay ++ * of 100 ns before reading the status register solves this ++ * issue. This bug does not seem to appear when using ++ * interrupts. ++ */ ++ if (drv_data->atomic) ++ ndelay(100); ++ + status = readl(drv_data->reg_base + drv_data->reg_offsets.status); + mv64xxx_i2c_fsm(drv_data, status); + mv64xxx_i2c_do_action(drv_data); +-- +2.39.2 + diff --git a/queue-6.1/i2c-sprd-delete-i2c-adapter-in-.remove-s-error-path.patch b/queue-6.1/i2c-sprd-delete-i2c-adapter-in-.remove-s-error-path.patch new file mode 100644 index 00000000000..8d754d5db93 --- /dev/null +++ b/queue-6.1/i2c-sprd-delete-i2c-adapter-in-.remove-s-error-path.patch @@ -0,0 +1,53 @@ +From 86e962f9f72e94888fb99c116c145be73ae9ce43 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Mar 2023 10:58:19 +0100 +Subject: i2c: sprd: Delete i2c adapter in .remove's error path +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit ca0aa17f2db3468fd017038d23a78e17388e2f67 ] + +If pm runtime resume fails the .remove callback used to exit early. This +resulted in an error message by the driver core but the device gets +removed anyhow. This lets the registered i2c adapter stay around with an +unbound parent device. + +So only skip clk disabling if resume failed, but do delete the adapter. + +Fixes: 8b9ec0719834 ("i2c: Add Spreadtrum I2C controller driver") +Signed-off-by: Uwe Kleine-König +Reviewed-by: Andi Shyti +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-sprd.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-sprd.c b/drivers/i2c/busses/i2c-sprd.c +index 4fe15cd78907e..ffc54fbf814dd 100644 +--- a/drivers/i2c/busses/i2c-sprd.c ++++ b/drivers/i2c/busses/i2c-sprd.c +@@ -576,12 +576,14 @@ static int sprd_i2c_remove(struct platform_device *pdev) + struct sprd_i2c *i2c_dev = platform_get_drvdata(pdev); + int ret; + +- ret = pm_runtime_resume_and_get(i2c_dev->dev); ++ ret = pm_runtime_get_sync(i2c_dev->dev); + if (ret < 0) +- return ret; ++ dev_err(&pdev->dev, "Failed to resume device (%pe)\n", ERR_PTR(ret)); + + i2c_del_adapter(&i2c_dev->adap); +- clk_disable_unprepare(i2c_dev->clk); ++ ++ if (ret >= 0) ++ clk_disable_unprepare(i2c_dev->clk); + + pm_runtime_put_noidle(i2c_dev->dev); + pm_runtime_disable(i2c_dev->dev); +-- +2.39.2 + diff --git a/queue-6.1/riscv-fix-kprobe-__user-string-arg-print-fault-issue.patch b/queue-6.1/riscv-fix-kprobe-__user-string-arg-print-fault-issue.patch new file mode 100644 index 00000000000..b466a7b55bf --- /dev/null +++ b/queue-6.1/riscv-fix-kprobe-__user-string-arg-print-fault-issue.patch @@ -0,0 +1,68 @@ +From 090b219a6a823beabc0db44077c3e202c59997ac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 May 2023 15:29:10 +0800 +Subject: riscv: fix kprobe __user string arg print fault issue +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ruan Jinjie + +[ Upstream commit 99a670b2069c725a7b50318aa681d9cae8f89325 ] + +On riscv qemu platform, when add kprobe event on do_sys_open() to show +filename string arg, it just print fault as follow: + +echo 'p:myprobe do_sys_open dfd=$arg1 filename=+0($arg2):string flags=$arg3 +mode=$arg4' > kprobe_events + +bash-166 [000] ...1. 360.195367: myprobe: (do_sys_open+0x0/0x84) +dfd=0xffffffffffffff9c filename=(fault) flags=0x8241 mode=0x1b6 + +bash-166 [000] ...1. 360.219369: myprobe: (do_sys_open+0x0/0x84) +dfd=0xffffffffffffff9c filename=(fault) flags=0x8241 mode=0x1b6 + +bash-191 [000] ...1. 360.378827: myprobe: (do_sys_open+0x0/0x84) +dfd=0xffffffffffffff9c filename=(fault) flags=0x98800 mode=0x0 + +As riscv do not select ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE, +the +0($arg2) addr is processed as a kernel address though it is a +userspace address, cause the above filename=(fault) print. So select +ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE to avoid the issue, after that the +kprobe trace is ok as below: + +bash-166 [000] ...1. 96.767641: myprobe: (do_sys_open+0x0/0x84) +dfd=0xffffffffffffff9c filename="/dev/null" flags=0x8241 mode=0x1b6 + +bash-166 [000] ...1. 96.793751: myprobe: (do_sys_open+0x0/0x84) +dfd=0xffffffffffffff9c filename="/dev/null" flags=0x8241 mode=0x1b6 + +bash-177 [000] ...1. 96.962354: myprobe: (do_sys_open+0x0/0x84) +dfd=0xffffffffffffff9c filename="/sys/kernel/debug/tracing/events/kprobes/" +flags=0x98800 mode=0x0 + +Signed-off-by: Ruan Jinjie +Acked-by: Björn Töpel +Fixes: 0ebeea8ca8a4 ("bpf: Restrict bpf_probe_read{, str}() only to archs where they work") +Link: https://lore.kernel.org/r/20230504072910.3742842-1-ruanjinjie@huawei.com +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + arch/riscv/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/riscv/Kconfig b/arch/riscv/Kconfig +index 06b9b2f60b9fb..a85bbe28dcf46 100644 +--- a/arch/riscv/Kconfig ++++ b/arch/riscv/Kconfig +@@ -25,6 +25,7 @@ config RISCV + select ARCH_HAS_GIGANTIC_PAGE + select ARCH_HAS_KCOV + select ARCH_HAS_MMIOWB ++ select ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE + select ARCH_HAS_PTE_SPECIAL + select ARCH_HAS_SET_DIRECT_MAP if MMU + select ARCH_HAS_SET_MEMORY if MMU +-- +2.39.2 + diff --git a/queue-6.1/riscv-mm-ensure-prot-of-vm_write-and-vm_exec-must-be.patch b/queue-6.1/riscv-mm-ensure-prot-of-vm_write-and-vm_exec-must-be.patch new file mode 100644 index 00000000000..71bd062e1e6 --- /dev/null +++ b/queue-6.1/riscv-mm-ensure-prot-of-vm_write-and-vm_exec-must-be.patch @@ -0,0 +1,59 @@ +From c642e471302cd61e141a06a5b4d2d1face799abe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Apr 2023 18:28:28 +0800 +Subject: riscv: mm: Ensure prot of VM_WRITE and VM_EXEC must be readable + +From: Hsieh-Tseng Shen + +[ Upstream commit 6569fc12e442ea973d96db39e542aa19a7bc3a79 ] + +Commit 8aeb7b17f04e ("RISC-V: Make mmap() with PROT_WRITE imply PROT_READ") +allows riscv to use mmap with PROT_WRITE only, and meanwhile mmap with w+x +is also permitted. However, when userspace tries to access this page with +PROT_WRITE|PROT_EXEC, which causes infinite loop at load page fault as +well as it triggers soft lockup. According to riscv privileged spec, +"Writable pages must also be marked readable". The fix to drop the +`PAGE_COPY_READ_EXEC` and then `PAGE_COPY_EXEC` would be just used instead. +This aligns the other arches (i.e arm64) for protection_map. + +Fixes: 8aeb7b17f04e ("RISC-V: Make mmap() with PROT_WRITE imply PROT_READ") +Signed-off-by: Hsieh-Tseng Shen +Reviewed-by: Alexandre Ghiti +Link: https://lore.kernel.org/r/20230425102828.1616812-1-woodrow.shen@sifive.com +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + arch/riscv/include/asm/pgtable.h | 3 +-- + arch/riscv/mm/init.c | 2 +- + 2 files changed, 2 insertions(+), 3 deletions(-) + +diff --git a/arch/riscv/include/asm/pgtable.h b/arch/riscv/include/asm/pgtable.h +index 2aeaf8e3a4ab0..59bb53da473dd 100644 +--- a/arch/riscv/include/asm/pgtable.h ++++ b/arch/riscv/include/asm/pgtable.h +@@ -165,8 +165,7 @@ extern struct pt_alloc_ops pt_ops __initdata; + _PAGE_EXEC | _PAGE_WRITE) + + #define PAGE_COPY PAGE_READ +-#define PAGE_COPY_EXEC PAGE_EXEC +-#define PAGE_COPY_READ_EXEC PAGE_READ_EXEC ++#define PAGE_COPY_EXEC PAGE_READ_EXEC + #define PAGE_SHARED PAGE_WRITE + #define PAGE_SHARED_EXEC PAGE_WRITE_EXEC + +diff --git a/arch/riscv/mm/init.c b/arch/riscv/mm/init.c +index 2b9906ed2d1d1..d8d97df801909 100644 +--- a/arch/riscv/mm/init.c ++++ b/arch/riscv/mm/init.c +@@ -286,7 +286,7 @@ static const pgprot_t protection_map[16] = { + [VM_EXEC] = PAGE_EXEC, + [VM_EXEC | VM_READ] = PAGE_READ_EXEC, + [VM_EXEC | VM_WRITE] = PAGE_COPY_EXEC, +- [VM_EXEC | VM_WRITE | VM_READ] = PAGE_COPY_READ_EXEC, ++ [VM_EXEC | VM_WRITE | VM_READ] = PAGE_COPY_EXEC, + [VM_SHARED] = PAGE_NONE, + [VM_SHARED | VM_READ] = PAGE_READ, + [VM_SHARED | VM_WRITE] = PAGE_SHARED, +-- +2.39.2 + diff --git a/queue-6.1/series b/queue-6.1/series index a4d946255ac..3d958ce88ab 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -98,3 +98,27 @@ usb-usbfs-enforce-page-requirements-for-mmap.patch usb-usbfs-use-consistent-mmap-functions.patch mm-page_table_check-make-it-dependent-on-exclusive_system_ram.patch mm-page_table_check-ensure-user-pages-are-not-slab-pages.patch +arm64-dts-qcom-sc8280xp-flush-rsc-sleep-wake-votes.patch +arm-at91-pm-fix-imbalanced-reference-counter-for-eth.patch +arm-dts-at91-sama7g5ek-fix-debounce-delay-property-f.patch +asoc-codecs-wsa883x-do-not-set-can_multi_write-flag.patch +asoc-codecs-wsa881x-do-not-set-can_multi_write-flag.patch +arm64-dts-qcom-sc7180-lite-fix-sdram-freq-for-miside.patch +arm64-dts-imx8qm-mek-correct-gpios-for-usdhc2-cd-and.patch +arm64-dts-imx8-ss-dma-assign-default-clock-rate-for-.patch +asoc-mediatek-mt8195-afe-pcm-convert-to-platform-rem.patch +asoc-mediatek-mt8195-fix-use-after-free-in-driver-re.patch +asoc-simple-card-utils-fix-pcm-constraint-error-chec.patch +blk-mq-fix-blk_mq_hw_ctx-active-request-accounting.patch +arm64-dts-imx8mn-beacon-fix-spi-cs-pinmux.patch +i2c-mv64xxx-fix-reading-invalid-status-value-in-atom.patch +firmware-arm_ffa-set-handle-field-to-zero-in-memory-.patch +gpio-sim-fix-memory-corruption-when-adding-named-lin.patch +i2c-sprd-delete-i2c-adapter-in-.remove-s-error-path.patch +riscv-mm-ensure-prot-of-vm_write-and-vm_exec-must-be.patch +eeprom-at24-also-select-regmap.patch +soundwire-stream-add-missing-clear-of-alloc_slave_rt.patch +riscv-fix-kprobe-__user-string-arg-print-fault-issue.patch +vduse-avoid-empty-string-for-dev-name.patch +vhost-support-packed-when-setting-getting-vring_base.patch +vhost_vdpa-support-packed-when-setting-getting-vring.patch diff --git a/queue-6.1/soundwire-stream-add-missing-clear-of-alloc_slave_rt.patch b/queue-6.1/soundwire-stream-add-missing-clear-of-alloc_slave_rt.patch new file mode 100644 index 00000000000..3e1e0ca5075 --- /dev/null +++ b/queue-6.1/soundwire-stream-add-missing-clear-of-alloc_slave_rt.patch @@ -0,0 +1,42 @@ +From 788e579e86cad36edc50a03e02afdf4c164b6aa4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Jun 2023 11:11:36 +0100 +Subject: soundwire: stream: Add missing clear of alloc_slave_rt + +From: Charles Keepax + +[ Upstream commit 58d95889f3c2064c6139ee94bb0e4d86e1ad4eab ] + +The current path that skips allocating the slave runtime does not clear +the alloc_slave_rt flag, this is clearly incorrect. Add the missing +clear, so the runtime won't be erroneously cleaned up. + +Fixes: f3016b891c8c ("soundwire: stream: sdw_stream_add_ functions can be called multiple times") +Reviewed-by: Pierre-Louis Bossart +Signed-off-by: Charles Keepax +Link: https://lore.kernel.org/r/20230602101140.2040141-1-ckeepax@opensource.cirrus.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/soundwire/stream.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/soundwire/stream.c b/drivers/soundwire/stream.c +index bd502368339e5..b10ea69a638e1 100644 +--- a/drivers/soundwire/stream.c ++++ b/drivers/soundwire/stream.c +@@ -2019,8 +2019,10 @@ int sdw_stream_add_slave(struct sdw_slave *slave, + + skip_alloc_master_rt: + s_rt = sdw_slave_rt_find(slave, stream); +- if (s_rt) ++ if (s_rt) { ++ alloc_slave_rt = false; + goto skip_alloc_slave_rt; ++ } + + s_rt = sdw_slave_rt_alloc(slave, m_rt); + if (!s_rt) { +-- +2.39.2 + diff --git a/queue-6.1/vduse-avoid-empty-string-for-dev-name.patch b/queue-6.1/vduse-avoid-empty-string-for-dev-name.patch new file mode 100644 index 00000000000..d88724b2c7e --- /dev/null +++ b/queue-6.1/vduse-avoid-empty-string-for-dev-name.patch @@ -0,0 +1,64 @@ +From f4199fc856593832e2f4720b325481dde2fff318 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 May 2023 11:36:26 +0800 +Subject: vduse: avoid empty string for dev name + +From: Sheng Zhao + +[ Upstream commit a90e8608eb0ed93d31ac0feb055f77ce59512542 ] + +Syzkaller hits a kernel WARN when the first character of the dev name +provided is NULL. Solution is to add a NULL check before calling +cdev_device_add() in vduse_create_dev(). + +kobject: (0000000072042169): attempted to be registered with empty name! +WARNING: CPU: 0 PID: 112695 at lib/kobject.c:236 +Call Trace: + kobject_add_varg linux/src/lib/kobject.c:390 [inline] + kobject_add+0xf6/0x150 linux/src/lib/kobject.c:442 + device_add+0x28f/0xc20 linux/src/drivers/base/core.c:2167 + cdev_device_add+0x83/0xc0 linux/src/fs/char_dev.c:546 + vduse_create_dev linux/src/drivers/vdpa/vdpa_user/vduse_dev.c:2254 [inline] + vduse_ioctl+0x7b5/0xf30 linux/src/drivers/vdpa/vdpa_user/vduse_dev.c:2316 + vfs_ioctl linux/src/fs/ioctl.c:47 [inline] + file_ioctl linux/src/fs/ioctl.c:510 [inline] + do_vfs_ioctl+0x14b/0xa80 linux/src/fs/ioctl.c:697 + ksys_ioctl+0x7c/0xa0 linux/src/fs/ioctl.c:714 + __do_sys_ioctl linux/src/fs/ioctl.c:721 [inline] + __se_sys_ioctl linux/src/fs/ioctl.c:719 [inline] + __x64_sys_ioctl+0x42/0x50 linux/src/fs/ioctl.c:719 + do_syscall_64+0x94/0x330 linux/src/arch/x86/entry/common.c:291 + entry_SYSCALL_64_after_hwframe+0x44/0xa9 + +Fixes: c8a6153b6c59 ("vduse: Introduce VDUSE - vDPA Device in Userspace") +Cc: "Xie Yongji" +Reported-by: Xianjun Zeng +Signed-off-by: Sheng Zhao +Message-Id: <20230530033626.1266794-1-sheng.zhao@bytedance.com> +Signed-off-by: Michael S. Tsirkin +Acked-by: Jason Wang +Reviewed-by: Xie Yongji +Cc: "Michael S. Tsirkin", "Jason Wang", +Reviewed-by: Xie Yongji +Signed-off-by: Sasha Levin +--- + drivers/vdpa/vdpa_user/vduse_dev.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/vdpa/vdpa_user/vduse_dev.c b/drivers/vdpa/vdpa_user/vduse_dev.c +index 31017ebc4d7c7..72f924ec4658d 100644 +--- a/drivers/vdpa/vdpa_user/vduse_dev.c ++++ b/drivers/vdpa/vdpa_user/vduse_dev.c +@@ -1443,6 +1443,9 @@ static bool vduse_validate_config(struct vduse_dev_config *config) + if (config->vq_num > 0xffff) + return false; + ++ if (!config->name[0]) ++ return false; ++ + if (!device_is_allowed(config->device_id)) + return false; + +-- +2.39.2 + diff --git a/queue-6.1/vhost-support-packed-when-setting-getting-vring_base.patch b/queue-6.1/vhost-support-packed-when-setting-getting-vring_base.patch new file mode 100644 index 00000000000..d16e46f4a5c --- /dev/null +++ b/queue-6.1/vhost-support-packed-when-setting-getting-vring_base.patch @@ -0,0 +1,85 @@ +From 1563881b4f8f20d24fb71a259a5fa4554517fe6b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Apr 2023 15:50:30 -0700 +Subject: vhost: support PACKED when setting-getting vring_base + +From: Shannon Nelson + +[ Upstream commit 55d8122f5cd62d5aaa225d7167dcd14a44c850b9 ] + +Use the right structs for PACKED or split vqs when setting and +getting the vring base. + +Fixes: 4c8cf31885f6 ("vhost: introduce vDPA-based backend") +Signed-off-by: Shannon Nelson +Message-Id: <20230424225031.18947-3-shannon.nelson@amd.com> +Signed-off-by: Michael S. Tsirkin +Acked-by: Jason Wang +Signed-off-by: Sasha Levin +--- + drivers/vhost/vhost.c | 18 +++++++++++++----- + drivers/vhost/vhost.h | 8 ++++++-- + 2 files changed, 19 insertions(+), 7 deletions(-) + +diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c +index 43c9770b86e5a..1a059b028c501 100644 +--- a/drivers/vhost/vhost.c ++++ b/drivers/vhost/vhost.c +@@ -1633,17 +1633,25 @@ long vhost_vring_ioctl(struct vhost_dev *d, unsigned int ioctl, void __user *arg + r = -EFAULT; + break; + } +- if (s.num > 0xffff) { +- r = -EINVAL; +- break; ++ if (vhost_has_feature(vq, VIRTIO_F_RING_PACKED)) { ++ vq->last_avail_idx = s.num & 0xffff; ++ vq->last_used_idx = (s.num >> 16) & 0xffff; ++ } else { ++ if (s.num > 0xffff) { ++ r = -EINVAL; ++ break; ++ } ++ vq->last_avail_idx = s.num; + } +- vq->last_avail_idx = s.num; + /* Forget the cached index value. */ + vq->avail_idx = vq->last_avail_idx; + break; + case VHOST_GET_VRING_BASE: + s.index = idx; +- s.num = vq->last_avail_idx; ++ if (vhost_has_feature(vq, VIRTIO_F_RING_PACKED)) ++ s.num = (u32)vq->last_avail_idx | ((u32)vq->last_used_idx << 16); ++ else ++ s.num = vq->last_avail_idx; + if (copy_to_user(argp, &s, sizeof s)) + r = -EFAULT; + break; +diff --git a/drivers/vhost/vhost.h b/drivers/vhost/vhost.h +index 790b296271f1e..5e17c4aa73745 100644 +--- a/drivers/vhost/vhost.h ++++ b/drivers/vhost/vhost.h +@@ -85,13 +85,17 @@ struct vhost_virtqueue { + /* The routine to call when the Guest pings us, or timeout. */ + vhost_work_fn_t handle_kick; + +- /* Last available index we saw. */ ++ /* Last available index we saw. ++ * Values are limited to 0x7fff, and the high bit is used as ++ * a wrap counter when using VIRTIO_F_RING_PACKED. */ + u16 last_avail_idx; + + /* Caches available index value from user. */ + u16 avail_idx; + +- /* Last index we used. */ ++ /* Last index we used. ++ * Values are limited to 0x7fff, and the high bit is used as ++ * a wrap counter when using VIRTIO_F_RING_PACKED. */ + u16 last_used_idx; + + /* Used flags */ +-- +2.39.2 + diff --git a/queue-6.1/vhost_vdpa-support-packed-when-setting-getting-vring.patch b/queue-6.1/vhost_vdpa-support-packed-when-setting-getting-vring.patch new file mode 100644 index 00000000000..fe52c6b2a33 --- /dev/null +++ b/queue-6.1/vhost_vdpa-support-packed-when-setting-getting-vring.patch @@ -0,0 +1,64 @@ +From cf83147aa3abd0545baa040d7b88e828c03059b2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Apr 2023 15:50:31 -0700 +Subject: vhost_vdpa: support PACKED when setting-getting vring_base + +From: Shannon Nelson + +[ Upstream commit beee7fdb5b56a46415a4992d28dd4c2d06eb52df ] + +Use the right structs for PACKED or split vqs when setting and +getting the vring base. + +Fixes: 4c8cf31885f6 ("vhost: introduce vDPA-based backend") +Signed-off-by: Shannon Nelson +Message-Id: <20230424225031.18947-4-shannon.nelson@amd.com> +Signed-off-by: Michael S. Tsirkin +Acked-by: Jason Wang +Signed-off-by: Sasha Levin +--- + drivers/vhost/vdpa.c | 21 +++++++++++++++++---- + 1 file changed, 17 insertions(+), 4 deletions(-) + +diff --git a/drivers/vhost/vdpa.c b/drivers/vhost/vdpa.c +index 6f532da59e08a..d591f77961aa8 100644 +--- a/drivers/vhost/vdpa.c ++++ b/drivers/vhost/vdpa.c +@@ -549,7 +549,14 @@ static long vhost_vdpa_vring_ioctl(struct vhost_vdpa *v, unsigned int cmd, + if (r) + return r; + +- vq->last_avail_idx = vq_state.split.avail_index; ++ if (vhost_has_feature(vq, VIRTIO_F_RING_PACKED)) { ++ vq->last_avail_idx = vq_state.packed.last_avail_idx | ++ (vq_state.packed.last_avail_counter << 15); ++ vq->last_used_idx = vq_state.packed.last_used_idx | ++ (vq_state.packed.last_used_counter << 15); ++ } else { ++ vq->last_avail_idx = vq_state.split.avail_index; ++ } + break; + } + +@@ -567,9 +574,15 @@ static long vhost_vdpa_vring_ioctl(struct vhost_vdpa *v, unsigned int cmd, + break; + + case VHOST_SET_VRING_BASE: +- vq_state.split.avail_index = vq->last_avail_idx; +- if (ops->set_vq_state(vdpa, idx, &vq_state)) +- r = -EINVAL; ++ if (vhost_has_feature(vq, VIRTIO_F_RING_PACKED)) { ++ vq_state.packed.last_avail_idx = vq->last_avail_idx & 0x7fff; ++ vq_state.packed.last_avail_counter = !!(vq->last_avail_idx & 0x8000); ++ vq_state.packed.last_used_idx = vq->last_used_idx & 0x7fff; ++ vq_state.packed.last_used_counter = !!(vq->last_used_idx & 0x8000); ++ } else { ++ vq_state.split.avail_index = vq->last_avail_idx; ++ } ++ r = ops->set_vq_state(vdpa, idx, &vq_state); + break; + + case VHOST_SET_VRING_CALL: +-- +2.39.2 + -- 2.47.2