From 64f4cb8fb59f6ed996657dec4e1b01625ecf1792 Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Sun, 26 Feb 2023 10:46:02 -0500 Subject: [PATCH] Fixes for 5.15 Signed-off-by: Sasha Levin --- ...potential-deadlock-during-nfit-teard.patch | 75 ++++++++++ ...-add-power-domains-property-to-dp-no.patch | 36 +++++ ...ip-drop-unused-led-mode-property-fro.patch | 45 ++++++ ...fix-clock-stop-prepare-timeout-issue.patch | 36 +++++ ...-number-of-clones-and-allocated-memo.patch | 44 ++++++ ...frm-i-support-for-nested-esp-tunnels.patch | 131 ++++++++++++++++++ ...fix-deadloop-in-hid_apply_multiplier.patch | 63 +++++++++ ...-add-support-for-trackball-056e-011c.patch | 106 ++++++++++++++ .../ib-hfi1-assign-npages-earlier.patch | 64 +++++++++ .../ionic-refactor-use-of-ionic_rx_fill.patch | 95 +++++++++++++ ...e-used-and-confirmed-times-are-valid.patch | 96 +++++++++++++ queue-5.15/series | 12 ++ queue-5.15/x86-cpu-add-lunar-lake-m.patch | 42 ++++++ 13 files changed, 845 insertions(+) create mode 100644 queue-5.15/acpi-nfit-fix-a-potential-deadlock-during-nfit-teard.patch create mode 100644 queue-5.15/arm-dts-rockchip-add-power-domains-property-to-dp-no.patch create mode 100644 queue-5.15/arm64-dts-rockchip-drop-unused-led-mode-property-fro.patch create mode 100644 queue-5.15/asoc-rt715-sdca-fix-clock-stop-prepare-timeout-issue.patch create mode 100644 queue-5.15/btrfs-send-limit-number-of-clones-and-allocated-memo.patch create mode 100644 queue-5.15/fix-xfrm-i-support-for-nested-esp-tunnels.patch create mode 100644 queue-5.15/hid-core-fix-deadloop-in-hid_apply_multiplier.patch create mode 100644 queue-5.15/hid-elecom-add-support-for-trackball-056e-011c.patch create mode 100644 queue-5.15/ib-hfi1-assign-npages-earlier.patch create mode 100644 queue-5.15/ionic-refactor-use-of-ionic_rx_fill.patch create mode 100644 queue-5.15/neigh-make-sure-used-and-confirmed-times-are-valid.patch create mode 100644 queue-5.15/series create mode 100644 queue-5.15/x86-cpu-add-lunar-lake-m.patch diff --git a/queue-5.15/acpi-nfit-fix-a-potential-deadlock-during-nfit-teard.patch b/queue-5.15/acpi-nfit-fix-a-potential-deadlock-during-nfit-teard.patch new file mode 100644 index 00000000000..3a3cdf2f1ca --- /dev/null +++ b/queue-5.15/acpi-nfit-fix-a-potential-deadlock-during-nfit-teard.patch @@ -0,0 +1,75 @@ +From c1c18fcff3ea738260900d2299829e0596933f68 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 Jan 2023 11:34:18 -0700 +Subject: ACPI: NFIT: fix a potential deadlock during NFIT teardown + +From: Vishal Verma + +[ Upstream commit fb6df4366f86dd252bfa3049edffa52d17e7b895 ] + +Lockdep reports that acpi_nfit_shutdown() may deadlock against an +opportune acpi_nfit_scrub(). acpi_nfit_scrub () is run from inside a +'work' and therefore has already acquired workqueue-internal locks. It +also acquiires acpi_desc->init_mutex. acpi_nfit_shutdown() first +acquires init_mutex, and was subsequently attempting to cancel any +pending workqueue items. This reversed locking order causes a potential +deadlock: + + ====================================================== + WARNING: possible circular locking dependency detected + 6.2.0-rc3 #116 Tainted: G O N + ------------------------------------------------------ + libndctl/1958 is trying to acquire lock: + ffff888129b461c0 ((work_completion)(&(&acpi_desc->dwork)->work)){+.+.}-{0:0}, at: __flush_work+0x43/0x450 + + but task is already holding lock: + ffff888129b460e8 (&acpi_desc->init_mutex){+.+.}-{3:3}, at: acpi_nfit_shutdown+0x87/0xd0 [nfit] + + which lock already depends on the new lock. + + ... + + Possible unsafe locking scenario: + + CPU0 CPU1 + ---- ---- + lock(&acpi_desc->init_mutex); + lock((work_completion)(&(&acpi_desc->dwork)->work)); + lock(&acpi_desc->init_mutex); + lock((work_completion)(&(&acpi_desc->dwork)->work)); + + *** DEADLOCK *** + +Since the workqueue manipulation is protected by its own internal locking, +the cancellation of pending work doesn't need to be done under +acpi_desc->init_mutex. Move cancel_delayed_work_sync() outside the +init_mutex to fix the deadlock. Any work that starts after +acpi_nfit_shutdown() drops the lock will see ARS_CANCEL, and the +cancel_delayed_work_sync() will safely flush it out. + +Reported-by: Dan Williams +Signed-off-by: Vishal Verma +Link: https://lore.kernel.org/r/20230112-acpi_nfit_lockdep-v1-1-660be4dd10be@intel.com +Signed-off-by: Dan Williams +Signed-off-by: Sasha Levin +--- + drivers/acpi/nfit/core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c +index 7dd80acf92c78..2575d6c51f898 100644 +--- a/drivers/acpi/nfit/core.c ++++ b/drivers/acpi/nfit/core.c +@@ -3676,8 +3676,8 @@ void acpi_nfit_shutdown(void *data) + + mutex_lock(&acpi_desc->init_mutex); + set_bit(ARS_CANCEL, &acpi_desc->scrub_flags); +- cancel_delayed_work_sync(&acpi_desc->dwork); + mutex_unlock(&acpi_desc->init_mutex); ++ cancel_delayed_work_sync(&acpi_desc->dwork); + + /* + * Bounce the nvdimm bus lock to make sure any in-flight +-- +2.39.0 + diff --git a/queue-5.15/arm-dts-rockchip-add-power-domains-property-to-dp-no.patch b/queue-5.15/arm-dts-rockchip-add-power-domains-property-to-dp-no.patch new file mode 100644 index 00000000000..25213ffd7b1 --- /dev/null +++ b/queue-5.15/arm-dts-rockchip-add-power-domains-property-to-dp-no.patch @@ -0,0 +1,36 @@ +From 515687498204e61900581f8f2ab24f503dae3646 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Dec 2022 21:17:32 +0100 +Subject: ARM: dts: rockchip: add power-domains property to dp node on rk3288 + +From: Johan Jonker + +[ Upstream commit 80422339a75088322b4d3884bd12fa0fe5d11050 ] + +The clocks in the Rockchip rk3288 DisplayPort node are +included in the power-domain@RK3288_PD_VIO logic, but the +power-domains property in the dp node is missing, so fix it. + +Signed-off-by: Johan Jonker +Link: https://lore.kernel.org/r/dab85bfb-9f55-86a1-5cd5-7388c43e0ec5@gmail.com +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/rk3288.dtsi | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm/boot/dts/rk3288.dtsi b/arch/arm/boot/dts/rk3288.dtsi +index 66ff5db53c5a9..8670c948ca8da 100644 +--- a/arch/arm/boot/dts/rk3288.dtsi ++++ b/arch/arm/boot/dts/rk3288.dtsi +@@ -1180,6 +1180,7 @@ edp: dp@ff970000 { + clock-names = "dp", "pclk"; + phys = <&edp_phy>; + phy-names = "dp"; ++ power-domains = <&power RK3288_PD_VIO>; + resets = <&cru SRST_EDP>; + reset-names = "dp"; + rockchip,grf = <&grf>; +-- +2.39.0 + diff --git a/queue-5.15/arm64-dts-rockchip-drop-unused-led-mode-property-fro.patch b/queue-5.15/arm64-dts-rockchip-drop-unused-led-mode-property-fro.patch new file mode 100644 index 00000000000..184819f7068 --- /dev/null +++ b/queue-5.15/arm64-dts-rockchip-drop-unused-led-mode-property-fro.patch @@ -0,0 +1,45 @@ +From bf4ca10cd9b4ff09920429726c762e2885bce657 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Nov 2022 15:41:34 +0100 +Subject: arm64: dts: rockchip: drop unused LED mode property from + rk3328-roc-cc + +From: Krzysztof Kozlowski + +[ Upstream commit 1692bffec674551163a7a4be32f59fdde04ecd27 ] + +GPIO LEDs do not have a 'mode' property: + + rockchip/rk3328-roc-pc.dtb: leds: led-0: Unevaluated properties are not allowed ('mode' was unexpected) + +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20221125144135.477144-1-krzysztof.kozlowski@linaro.org +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts b/arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts +index aa22a0c222655..5d5d9574088ca 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts +@@ -96,7 +96,6 @@ power_led: led-0 { + linux,default-trigger = "heartbeat"; + gpios = <&rk805 1 GPIO_ACTIVE_LOW>; + default-state = "on"; +- mode = <0x23>; + }; + + user_led: led-1 { +@@ -104,7 +103,6 @@ user_led: led-1 { + linux,default-trigger = "mmc1"; + gpios = <&rk805 0 GPIO_ACTIVE_LOW>; + default-state = "off"; +- mode = <0x05>; + }; + }; + }; +-- +2.39.0 + diff --git a/queue-5.15/asoc-rt715-sdca-fix-clock-stop-prepare-timeout-issue.patch b/queue-5.15/asoc-rt715-sdca-fix-clock-stop-prepare-timeout-issue.patch new file mode 100644 index 00000000000..8e6204cfbe1 --- /dev/null +++ b/queue-5.15/asoc-rt715-sdca-fix-clock-stop-prepare-timeout-issue.patch @@ -0,0 +1,36 @@ +From 5ae92506a6e01631d3aee026f2fd1a8d11c1d817 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Jan 2023 02:43:25 +0000 +Subject: ASoC: rt715-sdca: fix clock stop prepare timeout issue + +From: Jack Yu + +[ Upstream commit 2036890282d56bcbf7f915ba9e04bf77967ab231 ] + +Modify clock_stop_timeout value for rt715-sdca according to +the requirement of internal clock trimming. + +Signed-off-by: Jack Yu +Link: https://lore.kernel.org/r/574b6586267a458cac78c5ac4d5b10bd@realtek.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/rt715-sdca-sdw.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/rt715-sdca-sdw.c b/sound/soc/codecs/rt715-sdca-sdw.c +index 0f4354eafef25..85abf8073c278 100644 +--- a/sound/soc/codecs/rt715-sdca-sdw.c ++++ b/sound/soc/codecs/rt715-sdca-sdw.c +@@ -167,7 +167,7 @@ static int rt715_sdca_read_prop(struct sdw_slave *slave) + } + + /* set the timeout values */ +- prop->clk_stop_timeout = 20; ++ prop->clk_stop_timeout = 200; + + return 0; + } +-- +2.39.0 + diff --git a/queue-5.15/btrfs-send-limit-number-of-clones-and-allocated-memo.patch b/queue-5.15/btrfs-send-limit-number-of-clones-and-allocated-memo.patch new file mode 100644 index 00000000000..105c16396f5 --- /dev/null +++ b/queue-5.15/btrfs-send-limit-number-of-clones-and-allocated-memo.patch @@ -0,0 +1,44 @@ +From 58f8e8a803cda8d29806a52ebc14a7fe8c08925a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Jan 2023 20:32:10 +0100 +Subject: btrfs: send: limit number of clones and allocated memory size + +From: David Sterba + +[ Upstream commit 33e17b3f5ab74af12aca58c515bc8424ff69a343 ] + +The arg->clone_sources_count is u64 and can trigger a warning when a +huge value is passed from user space and a huge array is allocated. +Limit the allocated memory to 8MiB (can be increased if needed), which +in turn limits the number of clone sources to 8M / sizeof(struct +clone_root) = 8M / 40 = 209715. Real world number of clones is from +tens to hundreds, so this is future proof. + +Reported-by: syzbot+4376a9a073770c173269@syzkaller.appspotmail.com +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/send.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c +index 9250a17731bdb..692ae2e2f8cc5 100644 +--- a/fs/btrfs/send.c ++++ b/fs/btrfs/send.c +@@ -7549,10 +7549,10 @@ long btrfs_ioctl_send(struct file *mnt_file, struct btrfs_ioctl_send_args *arg) + /* + * Check that we don't overflow at later allocations, we request + * clone_sources_count + 1 items, and compare to unsigned long inside +- * access_ok. ++ * access_ok. Also set an upper limit for allocation size so this can't ++ * easily exhaust memory. Max number of clone sources is about 200K. + */ +- if (arg->clone_sources_count > +- ULONG_MAX / sizeof(struct clone_root) - 1) { ++ if (arg->clone_sources_count > SZ_8M / sizeof(struct clone_root)) { + ret = -EINVAL; + goto out; + } +-- +2.39.0 + diff --git a/queue-5.15/fix-xfrm-i-support-for-nested-esp-tunnels.patch b/queue-5.15/fix-xfrm-i-support-for-nested-esp-tunnels.patch new file mode 100644 index 00000000000..979c5e97ddc --- /dev/null +++ b/queue-5.15/fix-xfrm-i-support-for-nested-esp-tunnels.patch @@ -0,0 +1,131 @@ +From f814b8267ba5c8ada8976b12ce0af0336e9887df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Jan 2023 21:28:12 +0000 +Subject: Fix XFRM-I support for nested ESP tunnels + +From: Benedict Wong + +[ Upstream commit b0355dbbf13c0052931dd14c38c789efed64d3de ] + +This change adds support for nested IPsec tunnels by ensuring that +XFRM-I verifies existing policies before decapsulating a subsequent +policies. Addtionally, this clears the secpath entries after policies +are verified, ensuring that previous tunnels with no-longer-valid +do not pollute subsequent policy checks. + +This is necessary especially for nested tunnels, as the IP addresses, +protocol and ports may all change, thus not matching the previous +policies. In order to ensure that packets match the relevant inbound +templates, the xfrm_policy_check should be done before handing off to +the inner XFRM protocol to decrypt and decapsulate. + +Notably, raw ESP/AH packets did not perform policy checks inherently, +whereas all other encapsulated packets (UDP, TCP encapsulated) do policy +checks after calling xfrm_input handling in the respective encapsulation +layer. + +Test: Verified with additional Android Kernel Unit tests +Signed-off-by: Benedict Wong +Signed-off-by: Steffen Klassert +Signed-off-by: Sasha Levin +--- + net/xfrm/xfrm_interface.c | 54 ++++++++++++++++++++++++++++++++++++--- + net/xfrm/xfrm_policy.c | 3 +++ + 2 files changed, 53 insertions(+), 4 deletions(-) + +diff --git a/net/xfrm/xfrm_interface.c b/net/xfrm/xfrm_interface.c +index 1e8b26eecb3f8..694eec6ca147e 100644 +--- a/net/xfrm/xfrm_interface.c ++++ b/net/xfrm/xfrm_interface.c +@@ -207,6 +207,52 @@ static void xfrmi_scrub_packet(struct sk_buff *skb, bool xnet) + skb->mark = 0; + } + ++static int xfrmi_input(struct sk_buff *skb, int nexthdr, __be32 spi, ++ int encap_type, unsigned short family) ++{ ++ struct sec_path *sp; ++ ++ sp = skb_sec_path(skb); ++ if (sp && (sp->len || sp->olen) && ++ !xfrm_policy_check(NULL, XFRM_POLICY_IN, skb, family)) ++ goto discard; ++ ++ XFRM_SPI_SKB_CB(skb)->family = family; ++ if (family == AF_INET) { ++ XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct iphdr, daddr); ++ XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4 = NULL; ++ } else { ++ XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct ipv6hdr, daddr); ++ XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6 = NULL; ++ } ++ ++ return xfrm_input(skb, nexthdr, spi, encap_type); ++discard: ++ kfree_skb(skb); ++ return 0; ++} ++ ++static int xfrmi4_rcv(struct sk_buff *skb) ++{ ++ return xfrmi_input(skb, ip_hdr(skb)->protocol, 0, 0, AF_INET); ++} ++ ++static int xfrmi6_rcv(struct sk_buff *skb) ++{ ++ return xfrmi_input(skb, skb_network_header(skb)[IP6CB(skb)->nhoff], ++ 0, 0, AF_INET6); ++} ++ ++static int xfrmi4_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type) ++{ ++ return xfrmi_input(skb, nexthdr, spi, encap_type, AF_INET); ++} ++ ++static int xfrmi6_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type) ++{ ++ return xfrmi_input(skb, nexthdr, spi, encap_type, AF_INET6); ++} ++ + static int xfrmi_rcv_cb(struct sk_buff *skb, int err) + { + const struct xfrm_mode *inner_mode; +@@ -774,8 +820,8 @@ static struct pernet_operations xfrmi_net_ops = { + }; + + static struct xfrm6_protocol xfrmi_esp6_protocol __read_mostly = { +- .handler = xfrm6_rcv, +- .input_handler = xfrm_input, ++ .handler = xfrmi6_rcv, ++ .input_handler = xfrmi6_input, + .cb_handler = xfrmi_rcv_cb, + .err_handler = xfrmi6_err, + .priority = 10, +@@ -825,8 +871,8 @@ static struct xfrm6_tunnel xfrmi_ip6ip_handler __read_mostly = { + #endif + + static struct xfrm4_protocol xfrmi_esp4_protocol __read_mostly = { +- .handler = xfrm4_rcv, +- .input_handler = xfrm_input, ++ .handler = xfrmi4_rcv, ++ .input_handler = xfrmi4_input, + .cb_handler = xfrmi_rcv_cb, + .err_handler = xfrmi4_err, + .priority = 10, +diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c +index ba58b963f4827..0540e9f72b2fe 100644 +--- a/net/xfrm/xfrm_policy.c ++++ b/net/xfrm/xfrm_policy.c +@@ -3669,6 +3669,9 @@ int __xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, + goto reject; + } + ++ if (if_id) ++ secpath_reset(skb); ++ + xfrm_pols_put(pols, npols); + return 1; + } +-- +2.39.0 + diff --git a/queue-5.15/hid-core-fix-deadloop-in-hid_apply_multiplier.patch b/queue-5.15/hid-core-fix-deadloop-in-hid_apply_multiplier.patch new file mode 100644 index 00000000000..bb98179281d --- /dev/null +++ b/queue-5.15/hid-core-fix-deadloop-in-hid_apply_multiplier.patch @@ -0,0 +1,63 @@ +From 488c360ccf8d0a4ce86b7434b3d40ec25b2ea1ff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Jan 2023 21:29:47 +0000 +Subject: HID: core: Fix deadloop in hid_apply_multiplier. + +From: Xin Zhao + +[ Upstream commit ea427a222d8bdf2bc1a8a6da3ebe247f7dced70c ] + +The initial value of hid->collection[].parent_idx if 0. When +Report descriptor doesn't contain "HID Collection", the value +remains as 0. + +In the meanwhile, when the Report descriptor fullfill +all following conditions, it will trigger hid_apply_multiplier +function call. +1. Usage page is Generic Desktop Ctrls (0x01) +2. Usage is RESOLUTION_MULTIPLIER (0x48) +3. Contain any FEATURE items + +The while loop in hid_apply_multiplier will search the top-most +collection by searching parent_idx == -1. Because all parent_idx +is 0. The loop will run forever. + +There is a Report Descriptor triggerring the deadloop +0x05, 0x01, // Usage Page (Generic Desktop Ctrls) +0x09, 0x48, // Usage (0x48) +0x95, 0x01, // Report Count (1) +0x75, 0x08, // Report Size (8) +0xB1, 0x01, // Feature + +Signed-off-by: Xin Zhao +Link: https://lore.kernel.org/r/20230130212947.1315941-1-xnzhao@google.com +Signed-off-by: Benjamin Tissoires +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-core.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c +index 2e475bd426b84..f1ea883db5de1 100644 +--- a/drivers/hid/hid-core.c ++++ b/drivers/hid/hid-core.c +@@ -1197,6 +1197,7 @@ int hid_open_report(struct hid_device *device) + __u8 *end; + __u8 *next; + int ret; ++ int i; + static int (*dispatch_type[])(struct hid_parser *parser, + struct hid_item *item) = { + hid_parser_main, +@@ -1247,6 +1248,8 @@ int hid_open_report(struct hid_device *device) + goto err; + } + device->collection_size = HID_DEFAULT_NUM_COLLECTIONS; ++ for (i = 0; i < HID_DEFAULT_NUM_COLLECTIONS; i++) ++ device->collection[i].parent_idx = -1; + + ret = -EINVAL; + while ((next = fetch_item(start, end, &item)) != NULL) { +-- +2.39.0 + diff --git a/queue-5.15/hid-elecom-add-support-for-trackball-056e-011c.patch b/queue-5.15/hid-elecom-add-support-for-trackball-056e-011c.patch new file mode 100644 index 00000000000..293644d9721 --- /dev/null +++ b/queue-5.15/hid-elecom-add-support-for-trackball-056e-011c.patch @@ -0,0 +1,106 @@ +From 5cd207ffed4017e19e957618b8b841ff1ee64c9a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Jan 2023 03:30:02 +0900 +Subject: HID: elecom: add support for TrackBall 056E:011C + +From: Takahiro Fujii + +[ Upstream commit 29f316a1d7e0a570be9a47fa283ece53a67cebb7 ] + +Make function buttons on ELECOM M-HT1DRBK trackball mouse work. This model +has two devices with different device IDs (010D and 011C). Both of +them misreports the number of buttons as 5 in the report descriptor, even +though they have 8 buttons. hid-elecom overwrites the report to fix them, +but supports only on 010D and does not work on 011C. This patch fixes +011C in the similar way but with specialized position parameters. +In fact, it is sufficient to rewrite only 17th byte (05 -> 08). However I +followed the existing way. + +Signed-off-by: Takahiro Fujii +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-elecom.c | 16 ++++++++++++++-- + drivers/hid/hid-ids.h | 3 ++- + drivers/hid/hid-quirks.c | 3 ++- + 3 files changed, 18 insertions(+), 4 deletions(-) + +diff --git a/drivers/hid/hid-elecom.c b/drivers/hid/hid-elecom.c +index e59e9911fc370..4fa45ee77503b 100644 +--- a/drivers/hid/hid-elecom.c ++++ b/drivers/hid/hid-elecom.c +@@ -12,6 +12,7 @@ + * Copyright (c) 2017 Alex Manoussakis + * Copyright (c) 2017 Tomasz Kramkowski + * Copyright (c) 2020 YOSHIOKA Takuma ++ * Copyright (c) 2022 Takahiro Fujii + */ + + /* +@@ -89,7 +90,7 @@ static __u8 *elecom_report_fixup(struct hid_device *hdev, __u8 *rdesc, + case USB_DEVICE_ID_ELECOM_M_DT1URBK: + case USB_DEVICE_ID_ELECOM_M_DT1DRBK: + case USB_DEVICE_ID_ELECOM_M_HT1URBK: +- case USB_DEVICE_ID_ELECOM_M_HT1DRBK: ++ case USB_DEVICE_ID_ELECOM_M_HT1DRBK_010D: + /* + * Report descriptor format: + * 12: button bit count +@@ -99,6 +100,16 @@ static __u8 *elecom_report_fixup(struct hid_device *hdev, __u8 *rdesc, + */ + mouse_button_fixup(hdev, rdesc, *rsize, 12, 30, 14, 20, 8); + break; ++ case USB_DEVICE_ID_ELECOM_M_HT1DRBK_011C: ++ /* ++ * Report descriptor format: ++ * 22: button bit count ++ * 30: padding bit count ++ * 24: button report size ++ * 16: button usage maximum ++ */ ++ mouse_button_fixup(hdev, rdesc, *rsize, 22, 30, 24, 16, 8); ++ break; + } + return rdesc; + } +@@ -112,7 +123,8 @@ static const struct hid_device_id elecom_devices[] = { + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_DT1URBK) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_DT1DRBK) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1URBK) }, +- { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK_010D) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK_011C) }, + { } + }; + MODULE_DEVICE_TABLE(hid, elecom_devices); +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index fa1aa22547ea7..b153ddc3319e8 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -410,7 +410,8 @@ + #define USB_DEVICE_ID_ELECOM_M_DT1URBK 0x00fe + #define USB_DEVICE_ID_ELECOM_M_DT1DRBK 0x00ff + #define USB_DEVICE_ID_ELECOM_M_HT1URBK 0x010c +-#define USB_DEVICE_ID_ELECOM_M_HT1DRBK 0x010d ++#define USB_DEVICE_ID_ELECOM_M_HT1DRBK_010D 0x010d ++#define USB_DEVICE_ID_ELECOM_M_HT1DRBK_011C 0x011c + + #define USB_VENDOR_ID_DREAM_CHEEKY 0x1d34 + #define USB_DEVICE_ID_DREAM_CHEEKY_WN 0x0004 +diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c +index 184029cad014f..4a8c32148e58f 100644 +--- a/drivers/hid/hid-quirks.c ++++ b/drivers/hid/hid-quirks.c +@@ -381,7 +381,8 @@ static const struct hid_device_id hid_have_special_driver[] = { + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_DT1URBK) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_DT1DRBK) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1URBK) }, +- { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK_010D) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_HT1DRBK_011C) }, + #endif + #if IS_ENABLED(CONFIG_HID_ELO) + { HID_USB_DEVICE(USB_VENDOR_ID_ELO, 0x0009) }, +-- +2.39.0 + diff --git a/queue-5.15/ib-hfi1-assign-npages-earlier.patch b/queue-5.15/ib-hfi1-assign-npages-earlier.patch new file mode 100644 index 00000000000..abc58d77c5c --- /dev/null +++ b/queue-5.15/ib-hfi1-assign-npages-earlier.patch @@ -0,0 +1,64 @@ +From b8b1cd22a2fd4fad8e93d862ac39abdc63755486 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Jan 2023 14:04:08 -0500 +Subject: IB/hfi1: Assign npages earlier + +From: Dean Luick + +[ Upstream commit f9c47b2caa7ffc903ec950b454b59c209afe3182 ] + +Improve code clarity and enable earlier use of +tidbuf->npages by moving its assignment to +structure creation time. + +Signed-off-by: Dean Luick +Signed-off-by: Dennis Dalessandro +Link: https://lore.kernel.org/r/167329104884.1472990.4639750192433251493.stgit@awfm-02.cornelisnetworks.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hfi1/user_exp_rcv.c | 9 ++------- + 1 file changed, 2 insertions(+), 7 deletions(-) + +diff --git a/drivers/infiniband/hw/hfi1/user_exp_rcv.c b/drivers/infiniband/hw/hfi1/user_exp_rcv.c +index ba930112c1624..1d2020c30ef3b 100644 +--- a/drivers/infiniband/hw/hfi1/user_exp_rcv.c ++++ b/drivers/infiniband/hw/hfi1/user_exp_rcv.c +@@ -160,16 +160,11 @@ static void unpin_rcv_pages(struct hfi1_filedata *fd, + static int pin_rcv_pages(struct hfi1_filedata *fd, struct tid_user_buf *tidbuf) + { + int pinned; +- unsigned int npages; ++ unsigned int npages = tidbuf->npages; + unsigned long vaddr = tidbuf->vaddr; + struct page **pages = NULL; + struct hfi1_devdata *dd = fd->uctxt->dd; + +- /* Get the number of pages the user buffer spans */ +- npages = num_user_pages(vaddr, tidbuf->length); +- if (!npages) +- return -EINVAL; +- + if (npages > fd->uctxt->expected_count) { + dd_dev_err(dd, "Expected buffer too big\n"); + return -EINVAL; +@@ -196,7 +191,6 @@ static int pin_rcv_pages(struct hfi1_filedata *fd, struct tid_user_buf *tidbuf) + return pinned; + } + tidbuf->pages = pages; +- tidbuf->npages = npages; + fd->tid_n_pinned += pinned; + return pinned; + } +@@ -274,6 +268,7 @@ int hfi1_user_exp_rcv_setup(struct hfi1_filedata *fd, + mutex_init(&tidbuf->cover_mutex); + tidbuf->vaddr = tinfo->vaddr; + tidbuf->length = tinfo->length; ++ tidbuf->npages = num_user_pages(tidbuf->vaddr, tidbuf->length); + tidbuf->psets = kcalloc(uctxt->expected_count, sizeof(*tidbuf->psets), + GFP_KERNEL); + if (!tidbuf->psets) { +-- +2.39.0 + diff --git a/queue-5.15/ionic-refactor-use-of-ionic_rx_fill.patch b/queue-5.15/ionic-refactor-use-of-ionic_rx_fill.patch new file mode 100644 index 00000000000..b4fba9cca61 --- /dev/null +++ b/queue-5.15/ionic-refactor-use-of-ionic_rx_fill.patch @@ -0,0 +1,95 @@ +From e0d74c3f2a5dc03ee4623f83d0dd65e4967e7a1f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Oct 2022 07:37:44 -0700 +Subject: ionic: refactor use of ionic_rx_fill() + +From: Neel Patel + +[ Upstream commit e55f0f5befc26e2ba6bb8c1f945ea8e37ee0e334 ] + +The same pre-work code is used before each call to +ionic_rx_fill(), so bring it in and make it a part of +the routine. + +Signed-off-by: Neel Patel +Signed-off-by: Shannon Nelson +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + .../net/ethernet/pensando/ionic/ionic_txrx.c | 23 ++++++++++--------- + 1 file changed, 12 insertions(+), 11 deletions(-) + +diff --git a/drivers/net/ethernet/pensando/ionic/ionic_txrx.c b/drivers/net/ethernet/pensando/ionic/ionic_txrx.c +index 37c39581b6599..376f97b4008bb 100644 +--- a/drivers/net/ethernet/pensando/ionic/ionic_txrx.c ++++ b/drivers/net/ethernet/pensando/ionic/ionic_txrx.c +@@ -353,16 +353,25 @@ void ionic_rx_fill(struct ionic_queue *q) + struct ionic_rxq_sg_desc *sg_desc; + struct ionic_rxq_sg_elem *sg_elem; + struct ionic_buf_info *buf_info; ++ unsigned int fill_threshold; + struct ionic_rxq_desc *desc; + unsigned int remain_len; + unsigned int frag_len; + unsigned int nfrags; ++ unsigned int n_fill; + unsigned int i, j; + unsigned int len; + ++ n_fill = ionic_q_space_avail(q); ++ ++ fill_threshold = min_t(unsigned int, IONIC_RX_FILL_THRESHOLD, ++ q->num_descs / IONIC_RX_FILL_DIV); ++ if (n_fill < fill_threshold) ++ return; ++ + len = netdev->mtu + ETH_HLEN + VLAN_HLEN; + +- for (i = ionic_q_space_avail(q); i; i--) { ++ for (i = n_fill; i; i--) { + nfrags = 0; + remain_len = len; + desc_info = &q->info[q->head_idx]; +@@ -518,7 +527,6 @@ int ionic_rx_napi(struct napi_struct *napi, int budget) + struct ionic_cq *cq = napi_to_cq(napi); + struct ionic_dev *idev; + struct ionic_lif *lif; +- u16 rx_fill_threshold; + u32 work_done = 0; + u32 flags = 0; + +@@ -528,10 +536,7 @@ int ionic_rx_napi(struct napi_struct *napi, int budget) + work_done = ionic_cq_service(cq, budget, + ionic_rx_service, NULL, NULL); + +- rx_fill_threshold = min_t(u16, IONIC_RX_FILL_THRESHOLD, +- cq->num_descs / IONIC_RX_FILL_DIV); +- if (work_done && ionic_q_space_avail(cq->bound_q) >= rx_fill_threshold) +- ionic_rx_fill(cq->bound_q); ++ ionic_rx_fill(cq->bound_q); + + if (work_done < budget && napi_complete_done(napi, work_done)) { + ionic_dim_update(qcq, IONIC_LIF_F_RX_DIM_INTR); +@@ -559,7 +564,6 @@ int ionic_txrx_napi(struct napi_struct *napi, int budget) + struct ionic_dev *idev; + struct ionic_lif *lif; + struct ionic_cq *txcq; +- u16 rx_fill_threshold; + u32 rx_work_done = 0; + u32 tx_work_done = 0; + u32 flags = 0; +@@ -574,10 +578,7 @@ int ionic_txrx_napi(struct napi_struct *napi, int budget) + rx_work_done = ionic_cq_service(rxcq, budget, + ionic_rx_service, NULL, NULL); + +- rx_fill_threshold = min_t(u16, IONIC_RX_FILL_THRESHOLD, +- rxcq->num_descs / IONIC_RX_FILL_DIV); +- if (rx_work_done && ionic_q_space_avail(rxcq->bound_q) >= rx_fill_threshold) +- ionic_rx_fill(rxcq->bound_q); ++ ionic_rx_fill(rxcq->bound_q); + + if (rx_work_done < budget && napi_complete_done(napi, rx_work_done)) { + ionic_dim_update(qcq, 0); +-- +2.39.0 + diff --git a/queue-5.15/neigh-make-sure-used-and-confirmed-times-are-valid.patch b/queue-5.15/neigh-make-sure-used-and-confirmed-times-are-valid.patch new file mode 100644 index 00000000000..f87dbf49e8e --- /dev/null +++ b/queue-5.15/neigh-make-sure-used-and-confirmed-times-are-valid.patch @@ -0,0 +1,96 @@ +From 85b972b5e7457e8115af3c61af3b888b92271fd1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Feb 2023 17:25:51 +0200 +Subject: neigh: make sure used and confirmed times are valid + +From: Julian Anastasov + +[ Upstream commit c1d2ecdf5e38e3489ce8328238b558b3b2866fe1 ] + +Entries can linger in cache without timer for days, thanks to +the gc_thresh1 limit. As result, without traffic, the confirmed +time can be outdated and to appear to be in the future. Later, +on traffic, NUD_STALE entries can switch to NUD_DELAY and start +the timer which can see the invalid confirmed time and wrongly +switch to NUD_REACHABLE state instead of NUD_PROBE. As result, +timer is set many days in the future. This is more visible on +32-bit platforms, with higher HZ value. + +Why this is a problem? While we expect unused entries to expire, +such entries stay in REACHABLE state for too long, locked in +cache. They are not expired normally, only when cache is full. + +Problem and the wrong state change reported by Zhang Changzhong: + +172.16.1.18 dev bond0 lladdr 0a:0e:0f:01:12:01 ref 1 used 350521/15994171/350520 probes 4 REACHABLE + +350520 seconds have elapsed since this entry was last updated, but it is +still in the REACHABLE state (base_reachable_time_ms is 30000), +preventing lladdr from being updated through probe. + +Fix it by ensuring timer is started with valid used/confirmed +times. Considering the valid time range is LONG_MAX jiffies, +we try not to go too much in the past while we are in +DELAY/PROBE state. There are also places that need +used/updated times to be validated while timer is not running. + +Reported-by: Zhang Changzhong +Signed-off-by: Julian Anastasov +Tested-by: Zhang Changzhong +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/core/neighbour.c | 18 +++++++++++++++--- + 1 file changed, 15 insertions(+), 3 deletions(-) + +diff --git a/net/core/neighbour.c b/net/core/neighbour.c +index 0e22ecb469771..95f588b2fd159 100644 +--- a/net/core/neighbour.c ++++ b/net/core/neighbour.c +@@ -241,7 +241,7 @@ static int neigh_forced_gc(struct neigh_table *tbl) + (n->nud_state == NUD_NOARP) || + (tbl->is_multicast && + tbl->is_multicast(n->primary_key)) || +- time_after(tref, n->updated)) ++ !time_in_range(n->updated, tref, jiffies)) + remove = true; + write_unlock(&n->lock); + +@@ -261,7 +261,17 @@ static int neigh_forced_gc(struct neigh_table *tbl) + + static void neigh_add_timer(struct neighbour *n, unsigned long when) + { ++ /* Use safe distance from the jiffies - LONG_MAX point while timer ++ * is running in DELAY/PROBE state but still show to user space ++ * large times in the past. ++ */ ++ unsigned long mint = jiffies - (LONG_MAX - 86400 * HZ); ++ + neigh_hold(n); ++ if (!time_in_range(n->confirmed, mint, jiffies)) ++ n->confirmed = mint; ++ if (time_before(n->used, n->confirmed)) ++ n->used = n->confirmed; + if (unlikely(mod_timer(&n->timer, when))) { + printk("NEIGH: BUG, double timer add, state is %x\n", + n->nud_state); +@@ -943,12 +953,14 @@ static void neigh_periodic_work(struct work_struct *work) + goto next_elt; + } + +- if (time_before(n->used, n->confirmed)) ++ if (time_before(n->used, n->confirmed) && ++ time_is_before_eq_jiffies(n->confirmed)) + n->used = n->confirmed; + + if (refcount_read(&n->refcnt) == 1 && + (state == NUD_FAILED || +- time_after(jiffies, n->used + NEIGH_VAR(n->parms, GC_STALETIME)))) { ++ !time_in_range_open(jiffies, n->used, ++ n->used + NEIGH_VAR(n->parms, GC_STALETIME)))) { + *np = n->next; + neigh_mark_dead(n); + write_unlock(&n->lock); +-- +2.39.0 + diff --git a/queue-5.15/series b/queue-5.15/series new file mode 100644 index 00000000000..f0dcbdbfb90 --- /dev/null +++ b/queue-5.15/series @@ -0,0 +1,12 @@ +ionic-refactor-use-of-ionic_rx_fill.patch +fix-xfrm-i-support-for-nested-esp-tunnels.patch +arm64-dts-rockchip-drop-unused-led-mode-property-fro.patch +arm-dts-rockchip-add-power-domains-property-to-dp-no.patch +hid-elecom-add-support-for-trackball-056e-011c.patch +acpi-nfit-fix-a-potential-deadlock-during-nfit-teard.patch +btrfs-send-limit-number-of-clones-and-allocated-memo.patch +asoc-rt715-sdca-fix-clock-stop-prepare-timeout-issue.patch +ib-hfi1-assign-npages-earlier.patch +neigh-make-sure-used-and-confirmed-times-are-valid.patch +hid-core-fix-deadloop-in-hid_apply_multiplier.patch +x86-cpu-add-lunar-lake-m.patch diff --git a/queue-5.15/x86-cpu-add-lunar-lake-m.patch b/queue-5.15/x86-cpu-add-lunar-lake-m.patch new file mode 100644 index 00000000000..e9b1f3f2375 --- /dev/null +++ b/queue-5.15/x86-cpu-add-lunar-lake-m.patch @@ -0,0 +1,42 @@ +From cc16c715ae769e4ff7f2691bd6ef023f1b5952ee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Feb 2023 09:23:40 -0800 +Subject: x86/cpu: Add Lunar Lake M + +From: Kan Liang + +[ Upstream commit f545e8831e70065e127f903fc7aca09aa50422c7 ] + +Intel confirmed the existence of this CPU in Q4'2022 +earnings presentation. + +Add the CPU model number. + +[ dhansen: Merging these as soon as possible makes it easier + on all the folks developing model-specific features. ] + +Signed-off-by: Kan Liang +Signed-off-by: Tony Luck +Signed-off-by: Dave Hansen +Link: https://lore.kernel.org/all/20230208172340.158548-1-tony.luck%40intel.com +Signed-off-by: Sasha Levin +--- + arch/x86/include/asm/intel-family.h | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/x86/include/asm/intel-family.h b/arch/x86/include/asm/intel-family.h +index 13922963431a0..b8e7ea9e71e20 100644 +--- a/arch/x86/include/asm/intel-family.h ++++ b/arch/x86/include/asm/intel-family.h +@@ -113,6 +113,8 @@ + #define INTEL_FAM6_ALDERLAKE 0x97 /* Golden Cove / Gracemont */ + #define INTEL_FAM6_ALDERLAKE_L 0x9A /* Golden Cove / Gracemont */ + ++#define INTEL_FAM6_LUNARLAKE_M 0xBD ++ + /* "Small Core" Processors (Atom/E-Core) */ + + #define INTEL_FAM6_ATOM_BONNELL 0x1C /* Diamondville, Pineview */ +-- +2.39.0 + -- 2.47.3