From a90c91edbeca3429044e9b84b2a7d510b4a9cffc Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Sat, 18 Jun 2022 13:07:50 -0400 Subject: [PATCH] Fixes for 5.15 Signed-off-by: Sasha Levin --- .../alsa-hda-realtek-add-hw8326-support.patch | 152 +++++++++++++ ...oc-cs35l36-update-digital-volume-tlv.patch | 37 ++++ ...rect-minimum-value-for-sx-volume-con.patch | 39 ++++ ...s42l52-correct-tlv-for-bypass-volume.patch | 45 ++++ ...52-fix-tlv-scales-for-mixer-controls.patch | 45 ++++ ...rect-typo-in-minimum-level-for-sx-vo.patch | 41 ++++ ...rect-number-of-volume-levels-on-sx-c.patch | 59 ++++++ ...event-generation-for-deemphasis-cont.patch | 47 ++++ ...-operation-for-internal-pll-off-and-.patch | 72 +++++++ ...8962-fix-suspend-while-playing-music.patch | 42 ++++ ...-event-generation-for-wm_adsp_fw_put.patch | 39 ++++ ...fix-null-pointer-deref-in-ata_host_a.patch | 50 +++++ ...hings-less-spammy-under-memory-press.patch | 38 ++++ ...lay-fix-dmub-outbox-trace-in-s4-4465.patch | 149 +++++++++++++ ...read-golden-settings-table-from-vbio.patch | 46 ++++ ...amdkfd-add-pinned-bos-to-kfd_bo_list.patch | 77 +++++++ ...d-use-mmget_not_zero-in-mmu-notifier.patch | 45 ++++ ...le-wdangling-pointer-warning-for-now.patch | 69 ++++++ ...pb-don-t-print-error-on-eprobe_defer.patch | 47 ++++ ..._array-also-add-lenovo-yoga-tablet2-.patch | 50 +++++ ...integer-overflow-in-l2tp_ip6_sendmsg.patch | 46 ++++ ...oid-uninitialized-variable-warning-w.patch | 52 +++++ ...fix-compile-mips-cpu_hwmon-as-module.patch | 55 +++++ ..._eth_soc-fix-misuse-of-mem-alloc-int.patch | 74 +++++++ ...porarily-disable-wattribute-warning-.patch | 110 ++++++++++ ...memory-leak-in-nfcmrvl_play_deferred.patch | 66 ++++++ ...abyte-wmi-add-support-for-b450m-ds3h.patch | 34 +++ ...abyte-wmi-add-z690m-aorus-elite-ax-d.patch | 35 +++ ...el-hid-add-surface-go-to-vgbs-allow-.patch | 44 ++++ ...ilence-kasan-warnings-in-__get_wchan.patch | 91 ++++++++ ...mory-allocation-recursion-while-hold.patch | 97 +++++++++ ...-cpu-and-bootloader-seeds-by-default.patch | 200 ++++++++++++++++++ ...sing-incorrect-resource-cleanup-in-e.patch | 49 +++++ ...reduced-polling-rate-for-nvme_admin_.patch | 74 +++++++ ...rt-stuck-in-bypassed-state-after-lip.patch | 50 +++++ ...e-null-ptr-dereference-after-an-els-.patch | 78 +++++++ ...s-fix-out-of-bounds-compiler-warning.patch | 94 ++++++++ ...-missing-resource-cleanup-in-error-c.patch | 37 ++++ ...mw_pvscsi-expand-vcpuhint-to-16-bits.patch | 40 ++++ queue-5.15/series | 40 ++++ ...missing-put_device-when-vm_cmdline_p.patch | 37 ++++ 41 files changed, 2592 insertions(+) create mode 100644 queue-5.15/alsa-hda-realtek-add-hw8326-support.patch create mode 100644 queue-5.15/asoc-cs35l36-update-digital-volume-tlv.patch create mode 100644 queue-5.15/asoc-cs42l51-correct-minimum-value-for-sx-volume-con.patch create mode 100644 queue-5.15/asoc-cs42l52-correct-tlv-for-bypass-volume.patch create mode 100644 queue-5.15/asoc-cs42l52-fix-tlv-scales-for-mixer-controls.patch create mode 100644 queue-5.15/asoc-cs42l56-correct-typo-in-minimum-level-for-sx-vo.patch create mode 100644 queue-5.15/asoc-cs53l30-correct-number-of-volume-levels-on-sx-c.patch create mode 100644 queue-5.15/asoc-es8328-fix-event-generation-for-deemphasis-cont.patch create mode 100644 queue-5.15/asoc-nau8822-add-operation-for-internal-pll-off-and-.patch create mode 100644 queue-5.15/asoc-wm8962-fix-suspend-while-playing-music.patch create mode 100644 queue-5.15/asoc-wm_adsp-fix-event-generation-for-wm_adsp_fw_put.patch create mode 100644 queue-5.15/ata-libata-core-fix-null-pointer-deref-in-ata_host_a.patch create mode 100644 queue-5.15/dma-debug-make-things-less-spammy-under-memory-press.patch create mode 100644 queue-5.15/drm-amd-display-fix-dmub-outbox-trace-in-s4-4465.patch create mode 100644 queue-5.15/drm-amd-display-read-golden-settings-table-from-vbio.patch create mode 100644 queue-5.15/drm-amdkfd-add-pinned-bos-to-kfd_bo_list.patch create mode 100644 queue-5.15/drm-amdkfd-use-mmget_not_zero-in-mmu-notifier.patch create mode 100644 queue-5.15/gcc-12-disable-wdangling-pointer-warning-for-now.patch create mode 100644 queue-5.15/gpio-dwapb-don-t-print-error-on-eprobe_defer.patch create mode 100644 queue-5.15/input-soc_button_array-also-add-lenovo-yoga-tablet2-.patch create mode 100644 queue-5.15/ipv6-fix-signed-integer-overflow-in-l2tp_ip6_sendmsg.patch create mode 100644 queue-5.15/mellanox-mlx5-avoid-uninitialized-variable-warning-w.patch create mode 100644 queue-5.15/mips-loongson-3-fix-compile-mips-cpu_hwmon-as-module.patch create mode 100644 queue-5.15/net-ethernet-mtk_eth_soc-fix-misuse-of-mem-alloc-int.patch create mode 100644 queue-5.15/netfs-gcc-12-temporarily-disable-wattribute-warning-.patch create mode 100644 queue-5.15/nfc-nfcmrvl-fix-memory-leak-in-nfcmrvl_play_deferred.patch create mode 100644 queue-5.15/platform-x86-gigabyte-wmi-add-support-for-b450m-ds3h.patch create mode 100644 queue-5.15/platform-x86-gigabyte-wmi-add-z690m-aorus-elite-ax-d.patch create mode 100644 queue-5.15/platform-x86-intel-hid-add-surface-go-to-vgbs-allow-.patch create mode 100644 queue-5.15/powerpc-kasan-silence-kasan-warnings-in-__get_wchan.patch create mode 100644 queue-5.15/quota-prevent-memory-allocation-recursion-while-hold.patch create mode 100644 queue-5.15/random-credit-cpu-and-bootloader-seeds-by-default.patch create mode 100644 queue-5.15/scsi-ipr-fix-missing-incorrect-resource-cleanup-in-e.patch create mode 100644 queue-5.15/scsi-lpfc-allow-reduced-polling-rate-for-nvme_admin_.patch create mode 100644 queue-5.15/scsi-lpfc-fix-port-stuck-in-bypassed-state-after-lip.patch create mode 100644 queue-5.15/scsi-lpfc-resolve-null-ptr-dereference-after-an-els-.patch create mode 100644 queue-5.15/scsi-mpt3sas-fix-out-of-bounds-compiler-warning.patch create mode 100644 queue-5.15/scsi-pmcraid-fix-missing-resource-cleanup-in-error-c.patch create mode 100644 queue-5.15/scsi-vmw_pvscsi-expand-vcpuhint-to-16-bits.patch create mode 100644 queue-5.15/virtio-mmio-fix-missing-put_device-when-vm_cmdline_p.patch diff --git a/queue-5.15/alsa-hda-realtek-add-hw8326-support.patch b/queue-5.15/alsa-hda-realtek-add-hw8326-support.patch new file mode 100644 index 00000000000..899e57f46a3 --- /dev/null +++ b/queue-5.15/alsa-hda-realtek-add-hw8326-support.patch @@ -0,0 +1,152 @@ +From 13c5dc8c2dd3af99be022b6d4a3e0dc05a9caf7c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Jun 2022 16:23:57 +0800 +Subject: ALSA: hda/realtek - Add HW8326 support + +From: huangwenhui + +[ Upstream commit 527f4643e03c298c1e3321cfa27866b1374a55e1 ] + +Added the support of new Huawei codec HW8326. The HW8326 is developed +by Huawei with Realtek's IP Core, and it's compatible with ALC256. + +Signed-off-by: huangwenhui +Link: https://lore.kernel.org/r/20220608082357.26898-1-huangwenhuia@uniontech.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/hda/hdac_device.c | 1 + + sound/pci/hda/patch_realtek.c | 14 ++++++++++++++ + 2 files changed, 15 insertions(+) + +diff --git a/sound/hda/hdac_device.c b/sound/hda/hdac_device.c +index 3e9e9ac804f6..b7e5032b61c9 100644 +--- a/sound/hda/hdac_device.c ++++ b/sound/hda/hdac_device.c +@@ -660,6 +660,7 @@ static const struct hda_vendor_id hda_vendor_ids[] = { + { 0x14f1, "Conexant" }, + { 0x17e8, "Chrontel" }, + { 0x1854, "LG" }, ++ { 0x19e5, "Huawei" }, + { 0x1aec, "Wolfson Microelectronics" }, + { 0x1af4, "QEMU" }, + { 0x434d, "C-Media" }, +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 0ff43964a986..982292185b6a 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -438,6 +438,7 @@ static void alc_fill_eapd_coef(struct hda_codec *codec) + case 0x10ec0245: + case 0x10ec0255: + case 0x10ec0256: ++ case 0x19e58326: + case 0x10ec0257: + case 0x10ec0282: + case 0x10ec0283: +@@ -575,6 +576,7 @@ static void alc_shutup_pins(struct hda_codec *codec) + switch (codec->core.vendor_id) { + case 0x10ec0236: + case 0x10ec0256: ++ case 0x19e58326: + case 0x10ec0283: + case 0x10ec0286: + case 0x10ec0288: +@@ -3242,6 +3244,7 @@ static void alc_disable_headset_jack_key(struct hda_codec *codec) + case 0x10ec0230: + case 0x10ec0236: + case 0x10ec0256: ++ case 0x19e58326: + alc_write_coef_idx(codec, 0x48, 0x0); + alc_update_coef_idx(codec, 0x49, 0x0045, 0x0); + break; +@@ -3270,6 +3273,7 @@ static void alc_enable_headset_jack_key(struct hda_codec *codec) + case 0x10ec0230: + case 0x10ec0236: + case 0x10ec0256: ++ case 0x19e58326: + alc_write_coef_idx(codec, 0x48, 0xd011); + alc_update_coef_idx(codec, 0x49, 0x007f, 0x0045); + break; +@@ -4905,6 +4909,7 @@ static void alc_headset_mode_unplugged(struct hda_codec *codec) + case 0x10ec0230: + case 0x10ec0236: + case 0x10ec0256: ++ case 0x19e58326: + alc_process_coef_fw(codec, coef0256); + break; + case 0x10ec0234: +@@ -5020,6 +5025,7 @@ static void alc_headset_mode_mic_in(struct hda_codec *codec, hda_nid_t hp_pin, + case 0x10ec0230: + case 0x10ec0236: + case 0x10ec0256: ++ case 0x19e58326: + alc_write_coef_idx(codec, 0x45, 0xc489); + snd_hda_set_pin_ctl_cache(codec, hp_pin, 0); + alc_process_coef_fw(codec, coef0256); +@@ -5170,6 +5176,7 @@ static void alc_headset_mode_default(struct hda_codec *codec) + case 0x10ec0230: + case 0x10ec0236: + case 0x10ec0256: ++ case 0x19e58326: + alc_write_coef_idx(codec, 0x1b, 0x0e4b); + alc_write_coef_idx(codec, 0x45, 0xc089); + msleep(50); +@@ -5269,6 +5276,7 @@ static void alc_headset_mode_ctia(struct hda_codec *codec) + case 0x10ec0230: + case 0x10ec0236: + case 0x10ec0256: ++ case 0x19e58326: + alc_process_coef_fw(codec, coef0256); + break; + case 0x10ec0234: +@@ -5383,6 +5391,7 @@ static void alc_headset_mode_omtp(struct hda_codec *codec) + case 0x10ec0230: + case 0x10ec0236: + case 0x10ec0256: ++ case 0x19e58326: + alc_process_coef_fw(codec, coef0256); + break; + case 0x10ec0234: +@@ -5484,6 +5493,7 @@ static void alc_determine_headset_type(struct hda_codec *codec) + case 0x10ec0230: + case 0x10ec0236: + case 0x10ec0256: ++ case 0x19e58326: + alc_write_coef_idx(codec, 0x1b, 0x0e4b); + alc_write_coef_idx(codec, 0x06, 0x6104); + alc_write_coefex_idx(codec, 0x57, 0x3, 0x09a3); +@@ -5778,6 +5788,7 @@ static void alc255_set_default_jack_type(struct hda_codec *codec) + case 0x10ec0230: + case 0x10ec0236: + case 0x10ec0256: ++ case 0x19e58326: + alc_process_coef_fw(codec, alc256fw); + break; + } +@@ -6380,6 +6391,7 @@ static void alc_combo_jack_hp_jd_restart(struct hda_codec *codec) + case 0x10ec0236: + case 0x10ec0255: + case 0x10ec0256: ++ case 0x19e58326: + alc_update_coef_idx(codec, 0x1b, 0x8000, 1 << 15); /* Reset HP JD */ + alc_update_coef_idx(codec, 0x1b, 0x8000, 0 << 15); + break; +@@ -9880,6 +9892,7 @@ static int patch_alc269(struct hda_codec *codec) + case 0x10ec0230: + case 0x10ec0236: + case 0x10ec0256: ++ case 0x19e58326: + spec->codec_variant = ALC269_TYPE_ALC256; + spec->shutup = alc256_shutup; + spec->init_hook = alc256_init; +@@ -11330,6 +11343,7 @@ static const struct hda_device_id snd_hda_id_realtek[] = { + HDA_CODEC_ENTRY(0x10ec0b00, "ALCS1200A", patch_alc882), + HDA_CODEC_ENTRY(0x10ec1168, "ALC1220", patch_alc882), + HDA_CODEC_ENTRY(0x10ec1220, "ALC1220", patch_alc882), ++ HDA_CODEC_ENTRY(0x19e58326, "HW8326", patch_alc269), + {} /* terminator */ + }; + MODULE_DEVICE_TABLE(hdaudio, snd_hda_id_realtek); +-- +2.35.1 + diff --git a/queue-5.15/asoc-cs35l36-update-digital-volume-tlv.patch b/queue-5.15/asoc-cs35l36-update-digital-volume-tlv.patch new file mode 100644 index 00000000000..5d84390b7da --- /dev/null +++ b/queue-5.15/asoc-cs35l36-update-digital-volume-tlv.patch @@ -0,0 +1,37 @@ +From bb8bc13ddd8e9371e7e26f3d173d1e6fc4173903 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Jun 2022 17:21:15 +0100 +Subject: ASoC: cs35l36: Update digital volume TLV + +From: Charles Keepax + +[ Upstream commit 5005a2345825eb8346546d99bfe669f73111b5c5 ] + +The digital volume TLV specifies the step as 0.25dB but the actual step +of the control is 0.125dB. Update the TLV to correct this. + +Signed-off-by: Charles Keepax +Link: https://lore.kernel.org/r/20220602162119.3393857-3-ckeepax@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/cs35l36.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/cs35l36.c b/sound/soc/codecs/cs35l36.c +index d83c1b318c1c..0accdb45ed72 100644 +--- a/sound/soc/codecs/cs35l36.c ++++ b/sound/soc/codecs/cs35l36.c +@@ -444,7 +444,8 @@ static bool cs35l36_volatile_reg(struct device *dev, unsigned int reg) + } + } + +-static DECLARE_TLV_DB_SCALE(dig_vol_tlv, -10200, 25, 0); ++static const DECLARE_TLV_DB_RANGE(dig_vol_tlv, 0, 912, ++ TLV_DB_MINMAX_ITEM(-10200, 1200)); + static DECLARE_TLV_DB_SCALE(amp_gain_tlv, 0, 1, 1); + + static const char * const cs35l36_pcm_sftramp_text[] = { +-- +2.35.1 + diff --git a/queue-5.15/asoc-cs42l51-correct-minimum-value-for-sx-volume-con.patch b/queue-5.15/asoc-cs42l51-correct-minimum-value-for-sx-volume-con.patch new file mode 100644 index 00000000000..f73b1ccf54c --- /dev/null +++ b/queue-5.15/asoc-cs42l51-correct-minimum-value-for-sx-volume-con.patch @@ -0,0 +1,39 @@ +From dea9b0be7365ce87d6d10916acf4035f80b0f800 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Jun 2022 17:21:19 +0100 +Subject: ASoC: cs42l51: Correct minimum value for SX volume control + +From: Charles Keepax + +[ Upstream commit fcb3b5a58926d16d9a338841b74af06d4c29be15 ] + +The minimum value for the PGA Volume is given as 0x1A, however the +values from there to 0x19 are all the same volume and this is not +represented in the TLV structure. The number of volumes given is correct +so this leads to all the volumes being shifted. Move the minimum value +up to 0x19 to fix this. + +Signed-off-by: Charles Keepax +Link: https://lore.kernel.org/r/20220602162119.3393857-7-ckeepax@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/cs42l51.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/cs42l51.c b/sound/soc/codecs/cs42l51.c +index c61b17dc2af8..fc6a2bc311b4 100644 +--- a/sound/soc/codecs/cs42l51.c ++++ b/sound/soc/codecs/cs42l51.c +@@ -146,7 +146,7 @@ static const struct snd_kcontrol_new cs42l51_snd_controls[] = { + 0, 0xA0, 96, adc_att_tlv), + SOC_DOUBLE_R_SX_TLV("PGA Volume", + CS42L51_ALC_PGA_CTL, CS42L51_ALC_PGB_CTL, +- 0, 0x1A, 30, pga_tlv), ++ 0, 0x19, 30, pga_tlv), + SOC_SINGLE("Playback Deemphasis Switch", CS42L51_DAC_CTL, 3, 1, 0), + SOC_SINGLE("Auto-Mute Switch", CS42L51_DAC_CTL, 2, 1, 0), + SOC_SINGLE("Soft Ramp Switch", CS42L51_DAC_CTL, 1, 1, 0), +-- +2.35.1 + diff --git a/queue-5.15/asoc-cs42l52-correct-tlv-for-bypass-volume.patch b/queue-5.15/asoc-cs42l52-correct-tlv-for-bypass-volume.patch new file mode 100644 index 00000000000..2ce0832c845 --- /dev/null +++ b/queue-5.15/asoc-cs42l52-correct-tlv-for-bypass-volume.patch @@ -0,0 +1,45 @@ +From 477a4eda87eb176ecad19e11fef4d18825654614 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Jun 2022 17:21:17 +0100 +Subject: ASoC: cs42l52: Correct TLV for Bypass Volume + +From: Charles Keepax + +[ Upstream commit 91e90c712fade0b69cdff7cc6512f6099bd18ae5 ] + +The Bypass Volume is accidentally using a -6dB minimum TLV rather than +the correct -60dB minimum. Add a new TLV to correct this. + +Signed-off-by: Charles Keepax +Link: https://lore.kernel.org/r/20220602162119.3393857-5-ckeepax@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/cs42l52.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/cs42l52.c b/sound/soc/codecs/cs42l52.c +index 785caba3f653..c19ad3c24702 100644 +--- a/sound/soc/codecs/cs42l52.c ++++ b/sound/soc/codecs/cs42l52.c +@@ -137,6 +137,8 @@ static DECLARE_TLV_DB_SCALE(mic_tlv, 1600, 100, 0); + + static DECLARE_TLV_DB_SCALE(pga_tlv, -600, 50, 0); + ++static DECLARE_TLV_DB_SCALE(pass_tlv, -6000, 50, 0); ++ + static DECLARE_TLV_DB_SCALE(mix_tlv, -5150, 50, 0); + + static DECLARE_TLV_DB_SCALE(beep_tlv, -56, 200, 0); +@@ -351,7 +353,7 @@ static const struct snd_kcontrol_new cs42l52_snd_controls[] = { + CS42L52_SPKB_VOL, 0, 0x40, 0xC0, hl_tlv), + + SOC_DOUBLE_R_SX_TLV("Bypass Volume", CS42L52_PASSTHRUA_VOL, +- CS42L52_PASSTHRUB_VOL, 0, 0x88, 0x90, pga_tlv), ++ CS42L52_PASSTHRUB_VOL, 0, 0x88, 0x90, pass_tlv), + + SOC_DOUBLE("Bypass Mute", CS42L52_MISC_CTL, 4, 5, 1, 0), + +-- +2.35.1 + diff --git a/queue-5.15/asoc-cs42l52-fix-tlv-scales-for-mixer-controls.patch b/queue-5.15/asoc-cs42l52-fix-tlv-scales-for-mixer-controls.patch new file mode 100644 index 00000000000..c4c521df221 --- /dev/null +++ b/queue-5.15/asoc-cs42l52-fix-tlv-scales-for-mixer-controls.patch @@ -0,0 +1,45 @@ +From 80f487e32e2b0c3bc73099d0954874f9dd4e97bd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Jun 2022 17:21:14 +0100 +Subject: ASoC: cs42l52: Fix TLV scales for mixer controls + +From: Charles Keepax + +[ Upstream commit 8bf5aabf524eec61013e506f764a0b2652dc5665 ] + +The datasheet specifies the range of the mixer volumes as between +-51.5dB and 12dB with a 0.5dB step. Update the TLVs for this. + +Signed-off-by: Charles Keepax +Link: https://lore.kernel.org/r/20220602162119.3393857-2-ckeepax@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/cs42l52.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/cs42l52.c b/sound/soc/codecs/cs42l52.c +index 80161151b3f2..785caba3f653 100644 +--- a/sound/soc/codecs/cs42l52.c ++++ b/sound/soc/codecs/cs42l52.c +@@ -137,7 +137,7 @@ static DECLARE_TLV_DB_SCALE(mic_tlv, 1600, 100, 0); + + static DECLARE_TLV_DB_SCALE(pga_tlv, -600, 50, 0); + +-static DECLARE_TLV_DB_SCALE(mix_tlv, -50, 50, 0); ++static DECLARE_TLV_DB_SCALE(mix_tlv, -5150, 50, 0); + + static DECLARE_TLV_DB_SCALE(beep_tlv, -56, 200, 0); + +@@ -364,7 +364,7 @@ static const struct snd_kcontrol_new cs42l52_snd_controls[] = { + CS42L52_ADCB_VOL, 0, 0xA0, 0x78, ipd_tlv), + SOC_DOUBLE_R_SX_TLV("ADC Mixer Volume", + CS42L52_ADCA_MIXER_VOL, CS42L52_ADCB_MIXER_VOL, +- 0, 0x19, 0x7F, ipd_tlv), ++ 0, 0x19, 0x7F, mix_tlv), + + SOC_DOUBLE("ADC Switch", CS42L52_ADC_MISC_CTL, 0, 1, 1, 0), + +-- +2.35.1 + diff --git a/queue-5.15/asoc-cs42l56-correct-typo-in-minimum-level-for-sx-vo.patch b/queue-5.15/asoc-cs42l56-correct-typo-in-minimum-level-for-sx-vo.patch new file mode 100644 index 00000000000..e5d3982dcd8 --- /dev/null +++ b/queue-5.15/asoc-cs42l56-correct-typo-in-minimum-level-for-sx-vo.patch @@ -0,0 +1,41 @@ +From 0dc762fe82d832480633412f018bda6ae6fd8973 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Jun 2022 17:21:18 +0100 +Subject: ASoC: cs42l56: Correct typo in minimum level for SX volume controls + +From: Charles Keepax + +[ Upstream commit a8928ada9b96944cadd8b65d191e33199fd38782 ] + +A couple of the SX volume controls specify 0x84 as the lowest volume +value, however the correct value from the datasheet is 0x44. The +datasheet don't include spaces in the value it displays as binary so +this was almost certainly just a typo reading 1000100. + +Signed-off-by: Charles Keepax +Link: https://lore.kernel.org/r/20220602162119.3393857-6-ckeepax@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/cs42l56.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/cs42l56.c b/sound/soc/codecs/cs42l56.c +index 3cf8a0b4478c..b39c25409c23 100644 +--- a/sound/soc/codecs/cs42l56.c ++++ b/sound/soc/codecs/cs42l56.c +@@ -391,9 +391,9 @@ static const struct snd_kcontrol_new cs42l56_snd_controls[] = { + SOC_DOUBLE("ADC Boost Switch", CS42L56_GAIN_BIAS_CTL, 3, 2, 1, 1), + + SOC_DOUBLE_R_SX_TLV("Headphone Volume", CS42L56_HPA_VOLUME, +- CS42L56_HPB_VOLUME, 0, 0x84, 0x48, hl_tlv), ++ CS42L56_HPB_VOLUME, 0, 0x44, 0x48, hl_tlv), + SOC_DOUBLE_R_SX_TLV("LineOut Volume", CS42L56_LOA_VOLUME, +- CS42L56_LOB_VOLUME, 0, 0x84, 0x48, hl_tlv), ++ CS42L56_LOB_VOLUME, 0, 0x44, 0x48, hl_tlv), + + SOC_SINGLE_TLV("Bass Shelving Volume", CS42L56_TONE_CTL, + 0, 0x00, 1, tone_tlv), +-- +2.35.1 + diff --git a/queue-5.15/asoc-cs53l30-correct-number-of-volume-levels-on-sx-c.patch b/queue-5.15/asoc-cs53l30-correct-number-of-volume-levels-on-sx-c.patch new file mode 100644 index 00000000000..6b274cea617 --- /dev/null +++ b/queue-5.15/asoc-cs53l30-correct-number-of-volume-levels-on-sx-c.patch @@ -0,0 +1,59 @@ +From c1c6c060df376a33ae9a414bfca44a1933eec022 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Jun 2022 17:21:16 +0100 +Subject: ASoC: cs53l30: Correct number of volume levels on SX controls + +From: Charles Keepax + +[ Upstream commit 7fbd6dd68127927e844912a16741016d432a0737 ] + +This driver specified the maximum value rather than the number of volume +levels on the SX controls, this is incorrect, so correct them. + +Reported-by: David Rhodes +Signed-off-by: Charles Keepax +Link: https://lore.kernel.org/r/20220602162119.3393857-4-ckeepax@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/cs53l30.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/sound/soc/codecs/cs53l30.c b/sound/soc/codecs/cs53l30.c +index f2087bd38dbc..c2912ad3851b 100644 +--- a/sound/soc/codecs/cs53l30.c ++++ b/sound/soc/codecs/cs53l30.c +@@ -348,22 +348,22 @@ static const struct snd_kcontrol_new cs53l30_snd_controls[] = { + SOC_ENUM("ADC2 NG Delay", adc2_ng_delay_enum), + + SOC_SINGLE_SX_TLV("ADC1A PGA Volume", +- CS53L30_ADC1A_AFE_CTL, 0, 0x34, 0x18, pga_tlv), ++ CS53L30_ADC1A_AFE_CTL, 0, 0x34, 0x24, pga_tlv), + SOC_SINGLE_SX_TLV("ADC1B PGA Volume", +- CS53L30_ADC1B_AFE_CTL, 0, 0x34, 0x18, pga_tlv), ++ CS53L30_ADC1B_AFE_CTL, 0, 0x34, 0x24, pga_tlv), + SOC_SINGLE_SX_TLV("ADC2A PGA Volume", +- CS53L30_ADC2A_AFE_CTL, 0, 0x34, 0x18, pga_tlv), ++ CS53L30_ADC2A_AFE_CTL, 0, 0x34, 0x24, pga_tlv), + SOC_SINGLE_SX_TLV("ADC2B PGA Volume", +- CS53L30_ADC2B_AFE_CTL, 0, 0x34, 0x18, pga_tlv), ++ CS53L30_ADC2B_AFE_CTL, 0, 0x34, 0x24, pga_tlv), + + SOC_SINGLE_SX_TLV("ADC1A Digital Volume", +- CS53L30_ADC1A_DIG_VOL, 0, 0xA0, 0x0C, dig_tlv), ++ CS53L30_ADC1A_DIG_VOL, 0, 0xA0, 0x6C, dig_tlv), + SOC_SINGLE_SX_TLV("ADC1B Digital Volume", +- CS53L30_ADC1B_DIG_VOL, 0, 0xA0, 0x0C, dig_tlv), ++ CS53L30_ADC1B_DIG_VOL, 0, 0xA0, 0x6C, dig_tlv), + SOC_SINGLE_SX_TLV("ADC2A Digital Volume", +- CS53L30_ADC2A_DIG_VOL, 0, 0xA0, 0x0C, dig_tlv), ++ CS53L30_ADC2A_DIG_VOL, 0, 0xA0, 0x6C, dig_tlv), + SOC_SINGLE_SX_TLV("ADC2B Digital Volume", +- CS53L30_ADC2B_DIG_VOL, 0, 0xA0, 0x0C, dig_tlv), ++ CS53L30_ADC2B_DIG_VOL, 0, 0xA0, 0x6C, dig_tlv), + }; + + static const struct snd_soc_dapm_widget cs53l30_dapm_widgets[] = { +-- +2.35.1 + diff --git a/queue-5.15/asoc-es8328-fix-event-generation-for-deemphasis-cont.patch b/queue-5.15/asoc-es8328-fix-event-generation-for-deemphasis-cont.patch new file mode 100644 index 00000000000..4ebb06a94cd --- /dev/null +++ b/queue-5.15/asoc-es8328-fix-event-generation-for-deemphasis-cont.patch @@ -0,0 +1,47 @@ +From f339b3118412c9bfe01e5159f5988d28d528bd11 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Jun 2022 14:39:37 +0200 +Subject: ASoC: es8328: Fix event generation for deemphasis control + +From: Mark Brown + +[ Upstream commit 8259610c2ec01c5cbfb61882ae176aabacac9c19 ] + +Currently the put() method for the deemphasis control returns 0 when a new +value is written to the control even if the value changed, meaning events +are not generated. Fix this, skip the work of updating the value when it is +unchanged and then return 1 after having done so. + +Signed-off-by: Mark Brown +Link: https://lore.kernel.org/r/20220603123937.4013603-1-broonie@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/es8328.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/es8328.c b/sound/soc/codecs/es8328.c +index 9632afc2d4d6..ca3b1c00fa78 100644 +--- a/sound/soc/codecs/es8328.c ++++ b/sound/soc/codecs/es8328.c +@@ -161,13 +161,16 @@ static int es8328_put_deemph(struct snd_kcontrol *kcontrol, + if (deemph > 1) + return -EINVAL; + ++ if (es8328->deemph == deemph) ++ return 0; ++ + ret = es8328_set_deemph(component); + if (ret < 0) + return ret; + + es8328->deemph = deemph; + +- return 0; ++ return 1; + } + + +-- +2.35.1 + diff --git a/queue-5.15/asoc-nau8822-add-operation-for-internal-pll-off-and-.patch b/queue-5.15/asoc-nau8822-add-operation-for-internal-pll-off-and-.patch new file mode 100644 index 00000000000..96add3d8361 --- /dev/null +++ b/queue-5.15/asoc-nau8822-add-operation-for-internal-pll-off-and-.patch @@ -0,0 +1,72 @@ +From 87e16d00e0f9a302f26ecc095a6bd38aa45c857b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 May 2022 12:01:50 +0800 +Subject: ASoC: nau8822: Add operation for internal PLL off and on + +From: Hui Wang + +[ Upstream commit aeca8a3295022bcec46697f16e098140423d8463 ] + +We tried to enable the audio on an imx6sx EVB with the codec nau8822, +after setting the internal PLL fractional parameters, the audio still +couldn't work and the there was no sdma irq at all. + +After checking with the section "8.1.1 Phase Locked Loop (PLL) Design +Example" of "NAU88C22 Datasheet Rev 0.6", we found we need to +turn off the PLL before programming fractional parameters and turn on +the PLL after programming. + +After this change, the audio driver could record and play sound and +the sdma's irq is triggered when playing or recording. + +Cc: David Lin +Cc: John Hsu +Cc: Seven Li +Signed-off-by: Hui Wang +Link: https://lore.kernel.org/r/20220530040151.95221-2-hui.wang@canonical.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/nau8822.c | 4 ++++ + sound/soc/codecs/nau8822.h | 3 +++ + 2 files changed, 7 insertions(+) + +diff --git a/sound/soc/codecs/nau8822.c b/sound/soc/codecs/nau8822.c +index 58123390c7a3..b436e532993d 100644 +--- a/sound/soc/codecs/nau8822.c ++++ b/sound/soc/codecs/nau8822.c +@@ -740,6 +740,8 @@ static int nau8822_set_pll(struct snd_soc_dai *dai, int pll_id, int source, + pll_param->pll_int, pll_param->pll_frac, + pll_param->mclk_scaler, pll_param->pre_factor); + ++ snd_soc_component_update_bits(component, ++ NAU8822_REG_POWER_MANAGEMENT_1, NAU8822_PLL_EN_MASK, NAU8822_PLL_OFF); + snd_soc_component_update_bits(component, + NAU8822_REG_PLL_N, NAU8822_PLLMCLK_DIV2 | NAU8822_PLLN_MASK, + (pll_param->pre_factor ? NAU8822_PLLMCLK_DIV2 : 0) | +@@ -757,6 +759,8 @@ static int nau8822_set_pll(struct snd_soc_dai *dai, int pll_id, int source, + pll_param->mclk_scaler << NAU8822_MCLKSEL_SFT); + snd_soc_component_update_bits(component, + NAU8822_REG_CLOCKING, NAU8822_CLKM_MASK, NAU8822_CLKM_PLL); ++ snd_soc_component_update_bits(component, ++ NAU8822_REG_POWER_MANAGEMENT_1, NAU8822_PLL_EN_MASK, NAU8822_PLL_ON); + + return 0; + } +diff --git a/sound/soc/codecs/nau8822.h b/sound/soc/codecs/nau8822.h +index 489191ff187e..b45d42c15de6 100644 +--- a/sound/soc/codecs/nau8822.h ++++ b/sound/soc/codecs/nau8822.h +@@ -90,6 +90,9 @@ + #define NAU8822_REFIMP_3K 0x3 + #define NAU8822_IOBUF_EN (0x1 << 2) + #define NAU8822_ABIAS_EN (0x1 << 3) ++#define NAU8822_PLL_EN_MASK (0x1 << 5) ++#define NAU8822_PLL_ON (0x1 << 5) ++#define NAU8822_PLL_OFF (0x0 << 5) + + /* NAU8822_REG_AUDIO_INTERFACE (0x4) */ + #define NAU8822_AIFMT_MASK (0x3 << 3) +-- +2.35.1 + diff --git a/queue-5.15/asoc-wm8962-fix-suspend-while-playing-music.patch b/queue-5.15/asoc-wm8962-fix-suspend-while-playing-music.patch new file mode 100644 index 00000000000..2795d41cf3a --- /dev/null +++ b/queue-5.15/asoc-wm8962-fix-suspend-while-playing-music.patch @@ -0,0 +1,42 @@ +From 21d201d4f90efa5275994ac20939d5f756eb2027 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 May 2022 13:21:28 -0500 +Subject: ASoC: wm8962: Fix suspend while playing music + +From: Adam Ford + +[ Upstream commit d1f5272c0f7d2e53c6f2480f46725442776f5f78 ] + +If the audio CODEC is playing sound when the system is suspended, +it can be left in a state which throws the following error: + +wm8962 3-001a: ASoC: error at soc_component_read_no_lock on wm8962.3-001a: -16 + +Once this error has occurred, the audio will not work again until rebooted. + +Fix this by configuring SET_SYSTEM_SLEEP_PM_OPS. + +Signed-off-by: Adam Ford +Acked-by: Charles Keepax +Link: https://lore.kernel.org/r/20220526182129.538472-1-aford173@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wm8962.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c +index ba16bdf9e478..a5a4ae4440cc 100644 +--- a/sound/soc/codecs/wm8962.c ++++ b/sound/soc/codecs/wm8962.c +@@ -3867,6 +3867,7 @@ static int wm8962_runtime_suspend(struct device *dev) + #endif + + static const struct dev_pm_ops wm8962_pm = { ++ SET_SYSTEM_SLEEP_PM_OPS(pm_runtime_force_suspend, pm_runtime_force_resume) + SET_RUNTIME_PM_OPS(wm8962_runtime_suspend, wm8962_runtime_resume, NULL) + }; + +-- +2.35.1 + diff --git a/queue-5.15/asoc-wm_adsp-fix-event-generation-for-wm_adsp_fw_put.patch b/queue-5.15/asoc-wm_adsp-fix-event-generation-for-wm_adsp_fw_put.patch new file mode 100644 index 00000000000..9f2c46fed40 --- /dev/null +++ b/queue-5.15/asoc-wm_adsp-fix-event-generation-for-wm_adsp_fw_put.patch @@ -0,0 +1,39 @@ +From 270e45a8f7adb12d3ba38298abefa1ed500b3102 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Jun 2022 13:50:03 +0200 +Subject: ASoC: wm_adsp: Fix event generation for wm_adsp_fw_put() + +From: Mark Brown + +[ Upstream commit 2abdf9f80019e8244d3806ed0e1c9f725e50b452 ] + +Currently wm_adsp_fw_put() returns 0 rather than 1 when updating the value +of the control, meaning that no event is generated to userspace. Fix this +by setting the default return value to 1, the code already exits early with +a return value of 0 if the value is unchanged. + +Signed-off-by: Mark Brown +Reviewed-by: Richard Fitzgerald +Link: https://lore.kernel.org/r/20220603115003.3865834-1-broonie@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wm_adsp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/wm_adsp.c b/sound/soc/codecs/wm_adsp.c +index f7c800927cb2..08fc1a025b1a 100644 +--- a/sound/soc/codecs/wm_adsp.c ++++ b/sound/soc/codecs/wm_adsp.c +@@ -794,7 +794,7 @@ int wm_adsp_fw_put(struct snd_kcontrol *kcontrol, + struct snd_soc_component *component = snd_soc_kcontrol_component(kcontrol); + struct soc_enum *e = (struct soc_enum *)kcontrol->private_value; + struct wm_adsp *dsp = snd_soc_component_get_drvdata(component); +- int ret = 0; ++ int ret = 1; + + if (ucontrol->value.enumerated.item[0] == dsp[e->shift_l].fw) + return 0; +-- +2.35.1 + diff --git a/queue-5.15/ata-libata-core-fix-null-pointer-deref-in-ata_host_a.patch b/queue-5.15/ata-libata-core-fix-null-pointer-deref-in-ata_host_a.patch new file mode 100644 index 00000000000..2fae5222d86 --- /dev/null +++ b/queue-5.15/ata-libata-core-fix-null-pointer-deref-in-ata_host_a.patch @@ -0,0 +1,50 @@ +From adbabe6d7ae46ac47ea6f3cb3e1eb1e17fdd0cb8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 21 May 2022 23:34:10 +0300 +Subject: ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo() + +From: Sergey Shtylyov + +[ Upstream commit bf476fe22aa1851bab4728e0c49025a6a0bea307 ] + +In an unlikely (and probably wrong?) case that the 'ppi' parameter of +ata_host_alloc_pinfo() points to an array starting with a NULL pointer, +there's going to be a kernel oops as the 'pi' local variable won't get +reassigned from the initial value of NULL. Initialize 'pi' instead to +'&ata_dummy_port_info' to fix the possible kernel oops for good... + +Found by Linux Verification Center (linuxtesting.org) with the SVACE static +analysis tool. + +Signed-off-by: Sergey Shtylyov +Signed-off-by: Damien Le Moal +Signed-off-by: Sasha Levin +--- + drivers/ata/libata-core.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c +index a0343b7c9add..413faa9330b2 100644 +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -5500,7 +5500,7 @@ struct ata_host *ata_host_alloc_pinfo(struct device *dev, + const struct ata_port_info * const * ppi, + int n_ports) + { +- const struct ata_port_info *pi; ++ const struct ata_port_info *pi = &ata_dummy_port_info; + struct ata_host *host; + int i, j; + +@@ -5508,7 +5508,7 @@ struct ata_host *ata_host_alloc_pinfo(struct device *dev, + if (!host) + return NULL; + +- for (i = 0, j = 0, pi = NULL; i < host->n_ports; i++) { ++ for (i = 0, j = 0; i < host->n_ports; i++) { + struct ata_port *ap = host->ports[i]; + + if (ppi[j]) +-- +2.35.1 + diff --git a/queue-5.15/dma-debug-make-things-less-spammy-under-memory-press.patch b/queue-5.15/dma-debug-make-things-less-spammy-under-memory-press.patch new file mode 100644 index 00000000000..a5bb0eed6a8 --- /dev/null +++ b/queue-5.15/dma-debug-make-things-less-spammy-under-memory-press.patch @@ -0,0 +1,38 @@ +From 96e1c0ad81ce991324ca2fd74e7230d4d66c1269 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Jun 2022 07:51:16 -0700 +Subject: dma-debug: make things less spammy under memory pressure + +From: Rob Clark + +[ Upstream commit e19f8fa6ce1ca9b8b934ba7d2e8f34c95abc6e60 ] + +Limit the error msg to avoid flooding the console. If you have a lot of +threads hitting this at once, they could have already gotten passed the +dma_debug_disabled() check before they get to the point of allocation +failure, resulting in quite a lot of this error message spamming the +log. Use pr_err_once() to limit that. + +Signed-off-by: Rob Clark +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + kernel/dma/debug.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/dma/debug.c b/kernel/dma/debug.c +index ac740630c79c..2caafd13f8aa 100644 +--- a/kernel/dma/debug.c ++++ b/kernel/dma/debug.c +@@ -564,7 +564,7 @@ static void add_dma_entry(struct dma_debug_entry *entry, unsigned long attrs) + + rc = active_cacheline_insert(entry); + if (rc == -ENOMEM) { +- pr_err("cacheline tracking ENOMEM, dma-debug disabled\n"); ++ pr_err_once("cacheline tracking ENOMEM, dma-debug disabled\n"); + global_disable = true; + } else if (rc == -EEXIST && !(attrs & DMA_ATTR_SKIP_CPU_SYNC)) { + err_printk(entry->dev, entry, +-- +2.35.1 + diff --git a/queue-5.15/drm-amd-display-fix-dmub-outbox-trace-in-s4-4465.patch b/queue-5.15/drm-amd-display-fix-dmub-outbox-trace-in-s4-4465.patch new file mode 100644 index 00000000000..c1e2fa0c5c3 --- /dev/null +++ b/queue-5.15/drm-amd-display-fix-dmub-outbox-trace-in-s4-4465.patch @@ -0,0 +1,149 @@ +From 95594423bc0fa99a46d5f0544a193d6c8acaded1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 May 2022 09:16:42 +0800 +Subject: drm/amd/display: Fix DMUB outbox trace in S4 (#4465) + +From: Hung, Cruise + +[ Upstream commit 6ecf9773a5030aa4932096754bacff20e1b944b8 ] + +[Why] +DMUB Outbox0 read/write pointer not sync after resumed from S4. +And that caused old traces were sent to outbox. + +[How] +Disable DMUB Outbox0 interrupt +and clear DMUB Outbox0 read/write pointer when resumes from S4. +And then enable Outbox0 interrupt before starts DMCUB. + +Reviewed-by: Nicholas Kazlauskas +Acked-by: Jasdeep Dhillon +Tested-by: Daniel Wheeler +Signed-off-by: Cruise Hung +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../gpu/drm/amd/display/dc/dcn31/dcn31_dccg.c | 61 +++++++++---------- + .../gpu/drm/amd/display/dmub/src/dmub_dcn31.c | 2 + + 2 files changed, 31 insertions(+), 32 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_dccg.c b/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_dccg.c +index 696c9307715d..f0dc680377be 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_dccg.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_dccg.c +@@ -111,12 +111,10 @@ void dccg31_set_physymclk( + /* Controls the generation of pixel valid for OTG in (OTG -> HPO case) */ + void dccg31_set_dtbclk_dto( + struct dccg *dccg, +- int dtbclk_inst, +- int req_dtbclk_khz, +- int num_odm_segments, +- const struct dc_crtc_timing *timing) ++ struct dtbclk_dto_params *params) + { + struct dcn_dccg *dccg_dcn = TO_DCN_DCCG(dccg); ++ int req_dtbclk_khz = params->pixclk_khz; + uint32_t dtbdto_div; + + /* Mode DTBDTO Rate DTBCLK_DTO_DIV Register +@@ -127,57 +125,56 @@ void dccg31_set_dtbclk_dto( + * DSC native 4:2:2 pixel rate/2 4 + * Other modes pixel rate 8 + */ +- if (num_odm_segments == 4) { ++ if (params->num_odm_segments == 4) { + dtbdto_div = 2; +- req_dtbclk_khz = req_dtbclk_khz / 4; +- } else if ((num_odm_segments == 2) || +- (timing->pixel_encoding == PIXEL_ENCODING_YCBCR420) || +- (timing->flags.DSC && timing->pixel_encoding == PIXEL_ENCODING_YCBCR422 +- && !timing->dsc_cfg.ycbcr422_simple)) { ++ req_dtbclk_khz = params->pixclk_khz / 4; ++ } else if ((params->num_odm_segments == 2) || ++ (params->timing->pixel_encoding == PIXEL_ENCODING_YCBCR420) || ++ (params->timing->flags.DSC && params->timing->pixel_encoding == PIXEL_ENCODING_YCBCR422 ++ && !params->timing->dsc_cfg.ycbcr422_simple)) { + dtbdto_div = 4; +- req_dtbclk_khz = req_dtbclk_khz / 2; ++ req_dtbclk_khz = params->pixclk_khz / 2; + } else + dtbdto_div = 8; + +- if (dccg->ref_dtbclk_khz && req_dtbclk_khz) { ++ if (params->ref_dtbclk_khz && req_dtbclk_khz) { + uint32_t modulo, phase; + + // phase / modulo = dtbclk / dtbclk ref +- modulo = dccg->ref_dtbclk_khz * 1000; +- phase = div_u64((((unsigned long long)modulo * req_dtbclk_khz) + dccg->ref_dtbclk_khz - 1), +- dccg->ref_dtbclk_khz); ++ modulo = params->ref_dtbclk_khz * 1000; ++ phase = div_u64((((unsigned long long)modulo * req_dtbclk_khz) + params->ref_dtbclk_khz - 1), ++ params->ref_dtbclk_khz); + +- REG_UPDATE(OTG_PIXEL_RATE_CNTL[dtbclk_inst], +- DTBCLK_DTO_DIV[dtbclk_inst], dtbdto_div); ++ REG_UPDATE(OTG_PIXEL_RATE_CNTL[params->otg_inst], ++ DTBCLK_DTO_DIV[params->otg_inst], dtbdto_div); + +- REG_WRITE(DTBCLK_DTO_MODULO[dtbclk_inst], modulo); +- REG_WRITE(DTBCLK_DTO_PHASE[dtbclk_inst], phase); ++ REG_WRITE(DTBCLK_DTO_MODULO[params->otg_inst], modulo); ++ REG_WRITE(DTBCLK_DTO_PHASE[params->otg_inst], phase); + +- REG_UPDATE(OTG_PIXEL_RATE_CNTL[dtbclk_inst], +- DTBCLK_DTO_ENABLE[dtbclk_inst], 1); ++ REG_UPDATE(OTG_PIXEL_RATE_CNTL[params->otg_inst], ++ DTBCLK_DTO_ENABLE[params->otg_inst], 1); + +- REG_WAIT(OTG_PIXEL_RATE_CNTL[dtbclk_inst], +- DTBCLKDTO_ENABLE_STATUS[dtbclk_inst], 1, ++ REG_WAIT(OTG_PIXEL_RATE_CNTL[params->otg_inst], ++ DTBCLKDTO_ENABLE_STATUS[params->otg_inst], 1, + 1, 100); + + /* The recommended programming sequence to enable DTBCLK DTO to generate + * valid pixel HPO DPSTREAM ENCODER, specifies that DTO source select should + * be set only after DTO is enabled + */ +- REG_UPDATE(OTG_PIXEL_RATE_CNTL[dtbclk_inst], +- PIPE_DTO_SRC_SEL[dtbclk_inst], 1); +- +- dccg->dtbclk_khz[dtbclk_inst] = req_dtbclk_khz; ++ REG_UPDATE(OTG_PIXEL_RATE_CNTL[params->otg_inst], ++ PIPE_DTO_SRC_SEL[params->otg_inst], 1); + } else { +- REG_UPDATE_3(OTG_PIXEL_RATE_CNTL[dtbclk_inst], +- DTBCLK_DTO_ENABLE[dtbclk_inst], 0, +- PIPE_DTO_SRC_SEL[dtbclk_inst], 0, +- DTBCLK_DTO_DIV[dtbclk_inst], dtbdto_div); ++ REG_UPDATE_3(OTG_PIXEL_RATE_CNTL[params->otg_inst], ++ DTBCLK_DTO_ENABLE[params->otg_inst], 0, ++ PIPE_DTO_SRC_SEL[params->otg_inst], 0, ++ DTBCLK_DTO_DIV[params->otg_inst], dtbdto_div); + + REG_WRITE(DTBCLK_DTO_MODULO[dtbclk_inst], 0); + REG_WRITE(DTBCLK_DTO_PHASE[dtbclk_inst], 0); + +- dccg->dtbclk_khz[dtbclk_inst] = 0; ++ REG_WRITE(DTBCLK_DTO_MODULO[params->otg_inst], 0); ++ REG_WRITE(DTBCLK_DTO_PHASE[params->otg_inst], 0); + } + } + +diff --git a/drivers/gpu/drm/amd/display/dmub/src/dmub_dcn31.c b/drivers/gpu/drm/amd/display/dmub/src/dmub_dcn31.c +index fc667cb17eb0..08fa747a7c7d 100644 +--- a/drivers/gpu/drm/amd/display/dmub/src/dmub_dcn31.c ++++ b/drivers/gpu/drm/amd/display/dmub/src/dmub_dcn31.c +@@ -125,6 +125,8 @@ void dmub_dcn31_reset(struct dmub_srv *dmub) + REG_WRITE(DMCUB_INBOX1_WPTR, 0); + REG_WRITE(DMCUB_OUTBOX1_RPTR, 0); + REG_WRITE(DMCUB_OUTBOX1_WPTR, 0); ++ REG_WRITE(DMCUB_OUTBOX0_RPTR, 0); ++ REG_WRITE(DMCUB_OUTBOX0_WPTR, 0); + REG_WRITE(DMCUB_SCRATCH0, 0); + + /* Clear the GPINT command manually so we don't send anything during boot. */ +-- +2.35.1 + diff --git a/queue-5.15/drm-amd-display-read-golden-settings-table-from-vbio.patch b/queue-5.15/drm-amd-display-read-golden-settings-table-from-vbio.patch new file mode 100644 index 00000000000..930a8e01149 --- /dev/null +++ b/queue-5.15/drm-amd-display-read-golden-settings-table-from-vbio.patch @@ -0,0 +1,46 @@ +From c2717960b21329df3729603d1e9630016cfec021 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 May 2022 18:42:18 +0800 +Subject: drm/amd/display: Read Golden Settings Table from VBIOS + +From: Sherry Wang + +[ Upstream commit 4b81dd2cc6f4f4e8cea0ed6ee8d5193a8ae14a72 ] + +[Why] +Dmub read AUX_DPHY_RX_CONTROL0 from Golden Setting Table, +but driver will set it to default value 0x103d1110, which +causes issue in some case + +[How] +Remove the driver code, use the value set by dmub in +dp_aux_init + +Reviewed-by: Nicholas Kazlauskas +Acked-by: Jasdeep Dhillon +Tested-by: Daniel Wheeler +Signed-off-by: Sherry Wang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dcn31/dcn31_dio_link_encoder.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_dio_link_encoder.c b/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_dio_link_encoder.c +index b0892443fbd5..c7c27a605f15 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_dio_link_encoder.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_dio_link_encoder.c +@@ -168,9 +168,7 @@ void enc31_hw_init(struct link_encoder *enc) + AUX_RX_PHASE_DETECT_LEN, [21,20] = 0x3 default is 3 + AUX_RX_DETECTION_THRESHOLD [30:28] = 1 + */ +- AUX_REG_WRITE(AUX_DPHY_RX_CONTROL0, 0x103d1110); +- +- AUX_REG_WRITE(AUX_DPHY_TX_CONTROL, 0x21c7a); ++ // dmub will read AUX_DPHY_RX_CONTROL0/AUX_DPHY_TX_CONTROL from vbios table in dp_aux_init + + //AUX_DPHY_TX_REF_CONTROL'AUX_TX_REF_DIV HW default is 0x32; + // Set AUX_TX_REF_DIV Divider to generate 2 MHz reference from refclk +-- +2.35.1 + diff --git a/queue-5.15/drm-amdkfd-add-pinned-bos-to-kfd_bo_list.patch b/queue-5.15/drm-amdkfd-add-pinned-bos-to-kfd_bo_list.patch new file mode 100644 index 00000000000..4334825e85c --- /dev/null +++ b/queue-5.15/drm-amdkfd-add-pinned-bos-to-kfd_bo_list.patch @@ -0,0 +1,77 @@ +From f2d414dfa70fbf50a28c3b54200d7e2ee7e966a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 May 2022 09:19:43 +0800 +Subject: drm/amdkfd: add pinned BOs to kfd_bo_list +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Lang Yu + +[ Upstream commit 4fac4fcf4500bce515b0f32195e7bb86aa0246c6 ] + +The kfd_bo_list is used to restore process BOs after +evictions. As page tables could be destroyed during +evictions, we should also update pinned BOs' page tables +during restoring to make sure they are valid. + +So for pinned BOs, +1, Validate them and update their page tables. +2, Don't add eviction fence for them. + +v2: + - Don't handle pinned ones specially in BO validation.(Felix) + +Signed-off-by: Lang Yu +Acked-by: Christian König +Reviewed-by: Felix Kuehling +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 13 ++++++------- + 1 file changed, 6 insertions(+), 7 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c +index ab36cce59d2e..21c02f817a84 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c +@@ -1828,9 +1828,6 @@ int amdgpu_amdkfd_gpuvm_map_gtt_bo_to_kernel(struct kgd_dev *kgd, + return -EINVAL; + } + +- /* delete kgd_mem from kfd_bo_list to avoid re-validating +- * this BO in BO's restoring after eviction. +- */ + mutex_lock(&mem->process_info->lock); + + ret = amdgpu_bo_reserve(bo, true); +@@ -1853,7 +1850,6 @@ int amdgpu_amdkfd_gpuvm_map_gtt_bo_to_kernel(struct kgd_dev *kgd, + + amdgpu_amdkfd_remove_eviction_fence( + bo, mem->process_info->eviction_fence); +- list_del_init(&mem->validate_list.head); + + if (size) + *size = amdgpu_bo_size(bo); +@@ -2399,12 +2395,15 @@ int amdgpu_amdkfd_gpuvm_restore_process_bos(void *info, struct dma_fence **ef) + process_info->eviction_fence = new_fence; + *ef = dma_fence_get(&new_fence->base); + +- /* Attach new eviction fence to all BOs */ ++ /* Attach new eviction fence to all BOs except pinned ones */ + list_for_each_entry(mem, &process_info->kfd_bo_list, +- validate_list.head) ++ validate_list.head) { ++ if (mem->bo->tbo.pin_count) ++ continue; ++ + amdgpu_bo_fence(mem->bo, + &process_info->eviction_fence->base, true); +- ++ } + /* Attach eviction fence to PD / PT BOs */ + list_for_each_entry(peer_vm, &process_info->vm_list_head, + vm_list_node) { +-- +2.35.1 + diff --git a/queue-5.15/drm-amdkfd-use-mmget_not_zero-in-mmu-notifier.patch b/queue-5.15/drm-amdkfd-use-mmget_not_zero-in-mmu-notifier.patch new file mode 100644 index 00000000000..6e4f19fe919 --- /dev/null +++ b/queue-5.15/drm-amdkfd-use-mmget_not_zero-in-mmu-notifier.patch @@ -0,0 +1,45 @@ +From 3ae12da9a7c348724d988b67583954cad857b6d1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 May 2022 16:15:38 -0400 +Subject: drm/amdkfd: Use mmget_not_zero in MMU notifier + +From: Philip Yang + +[ Upstream commit fa582c6f3684ac0098a9d02ddf0ed52a02b37127 ] + +MMU notifier callback may pass in mm with mm->mm_users==0 when process +is exiting, use mmget_no_zero to avoid accessing invalid mm in deferred +list work after mm is gone. + +Signed-off-by: Philip Yang +Reviewed-by: Felix Kuehling +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c +index 830809b694dd..74e6f613be02 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c +@@ -2181,6 +2181,8 @@ svm_range_cpu_invalidate_pagetables(struct mmu_interval_notifier *mni, + + if (range->event == MMU_NOTIFY_RELEASE) + return true; ++ if (!mmget_not_zero(mni->mm)) ++ return true; + + start = mni->interval_tree.start; + last = mni->interval_tree.last; +@@ -2207,6 +2209,7 @@ svm_range_cpu_invalidate_pagetables(struct mmu_interval_notifier *mni, + } + + svm_range_unlock(prange); ++ mmput(mni->mm); + + return true; + } +-- +2.35.1 + diff --git a/queue-5.15/gcc-12-disable-wdangling-pointer-warning-for-now.patch b/queue-5.15/gcc-12-disable-wdangling-pointer-warning-for-now.patch new file mode 100644 index 00000000000..f19cdab8005 --- /dev/null +++ b/queue-5.15/gcc-12-disable-wdangling-pointer-warning-for-now.patch @@ -0,0 +1,69 @@ +From 49e213897d873c555cbb30bd41a23d993dd3b9ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Jun 2022 09:41:42 -0700 +Subject: gcc-12: disable '-Wdangling-pointer' warning for now +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Linus Torvalds + +[ Upstream commit 49beadbd47c270a00754c107a837b4f29df4c822 ] + +While the concept of checking for dangling pointers to local variables +at function exit is really interesting, the gcc-12 implementation is not +compatible with reality, and results in false positives. + +For example, gcc sees us putting things on a local list head allocated +on the stack, which involves exactly those kinds of pointers to the +local stack entry: + + In function ‘__list_add’, + inlined from ‘list_add_tail’ at include/linux/list.h:102:2, + inlined from ‘rebuild_snap_realms’ at fs/ceph/snap.c:434:2: + include/linux/list.h:74:19: warning: storing the address of local variable ‘realm_queue’ in ‘*&realm_27(D)->rebuild_item.prev’ [-Wdangling-pointer=] + 74 | new->prev = prev; + | ~~~~~~~~~~^~~~~~ + +But then gcc - understandably - doesn't really understand the big +picture how the doubly linked list works, so doesn't see how we then end +up emptying said list head in a loop and the pointer we added has been +removed. + +Gcc also complains about us (intentionally) using this as a way to store +a kind of fake stack trace, eg + + drivers/acpi/acpica/utdebug.c:40:38: warning: storing the address of local variable ‘current_sp’ in ‘acpi_gbl_entry_stack_pointer’ [-Wdangling-pointer=] + 40 | acpi_gbl_entry_stack_pointer = ¤t_sp; + | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~ + +which is entirely reasonable from a compiler standpoint, and we may want +to change those kinds of patterns, but not not. + +So this is one of those "it would be lovely if the compiler were to +complain about us leaving dangling pointers to the stack", but not this +way. + +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + Makefile | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/Makefile b/Makefile +index 8d7d65bd8efb..3f19b55e9958 100644 +--- a/Makefile ++++ b/Makefile +@@ -811,6 +811,9 @@ endif + KBUILD_CFLAGS += $(call cc-disable-warning, unused-but-set-variable) + KBUILD_CFLAGS += $(call cc-disable-warning, unused-const-variable) + ++# These result in bogus false positives ++KBUILD_CFLAGS += $(call cc-disable-warning, dangling-pointer) ++ + ifdef CONFIG_FRAME_POINTER + KBUILD_CFLAGS += -fno-omit-frame-pointer -fno-optimize-sibling-calls + else +-- +2.35.1 + diff --git a/queue-5.15/gpio-dwapb-don-t-print-error-on-eprobe_defer.patch b/queue-5.15/gpio-dwapb-don-t-print-error-on-eprobe_defer.patch new file mode 100644 index 00000000000..e3cb2278e94 --- /dev/null +++ b/queue-5.15/gpio-dwapb-don-t-print-error-on-eprobe_defer.patch @@ -0,0 +1,47 @@ +From 72f88213231ce2141cb0c5b16be6cbd2e66e9b71 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Jun 2022 13:45:00 +0300 +Subject: gpio: dwapb: Don't print error on -EPROBE_DEFER + +From: Serge Semin + +[ Upstream commit 77006f6edc0e0f58617eb25e53731f78641e820d ] + +Currently if the APB or Debounce clocks aren't yet ready to be requested +the DW GPIO driver will correctly handle that by deferring the probe +procedure, but the error is still printed to the system log. It needlessly +pollutes the log since there was no real error but a request to postpone +the clock request procedure since the clocks subsystem hasn't been fully +initialized yet. Let's fix that by using the dev_err_probe method to print +the APB/clock request error status. It will correctly handle the deferred +probe situation and print the error if it actually happens. + +Signed-off-by: Serge Semin +Reviewed-by: Andy Shevchenko +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-dwapb.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpio/gpio-dwapb.c b/drivers/gpio/gpio-dwapb.c +index f98fa33e1679..e981e7a46fc1 100644 +--- a/drivers/gpio/gpio-dwapb.c ++++ b/drivers/gpio/gpio-dwapb.c +@@ -653,10 +653,9 @@ static int dwapb_get_clks(struct dwapb_gpio *gpio) + gpio->clks[1].id = "db"; + err = devm_clk_bulk_get_optional(gpio->dev, DWAPB_NR_CLOCKS, + gpio->clks); +- if (err) { +- dev_err(gpio->dev, "Cannot get APB/Debounce clocks\n"); +- return err; +- } ++ if (err) ++ return dev_err_probe(gpio->dev, err, ++ "Cannot get APB/Debounce clocks\n"); + + err = clk_bulk_prepare_enable(DWAPB_NR_CLOCKS, gpio->clks); + if (err) { +-- +2.35.1 + diff --git a/queue-5.15/input-soc_button_array-also-add-lenovo-yoga-tablet2-.patch b/queue-5.15/input-soc_button_array-also-add-lenovo-yoga-tablet2-.patch new file mode 100644 index 00000000000..9fd600b961d --- /dev/null +++ b/queue-5.15/input-soc_button_array-also-add-lenovo-yoga-tablet2-.patch @@ -0,0 +1,50 @@ +From c3bc13e29bb19ca96e9a447253196776eaeec9e0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Jun 2022 12:10:52 -0700 +Subject: Input: soc_button_array - also add Lenovo Yoga Tablet2 1051F to + dmi_use_low_level_irq + +From: Marius Hoch + +[ Upstream commit 6ab2e51898cd4343bbdf8587af8ce8fbabddbcb5 ] + +Commit 223f61b8c5ad ("Input: soc_button_array - add Lenovo Yoga Tablet2 +1051L to the dmi_use_low_level_irq list") added the 1051L to this list +already, but the same problem applies to the 1051F. As there are no +further 1051 variants (just the F/L), we can just DMI match 1051. + +Tested on a Lenovo Yoga Tablet2 1051F: Without this patch the +home-button stops working after a wakeup from suspend. + +Signed-off-by: Marius Hoch +Reviewed-by: Hans de Goede +Link: https://lore.kernel.org/r/20220603120246.3065-1-mail@mariushoch.de +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/misc/soc_button_array.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/input/misc/soc_button_array.c b/drivers/input/misc/soc_button_array.c +index cb6ec59a045d..efffcf0ebd3b 100644 +--- a/drivers/input/misc/soc_button_array.c ++++ b/drivers/input/misc/soc_button_array.c +@@ -85,13 +85,13 @@ static const struct dmi_system_id dmi_use_low_level_irq[] = { + }, + { + /* +- * Lenovo Yoga Tab2 1051L, something messes with the home-button ++ * Lenovo Yoga Tab2 1051F/1051L, something messes with the home-button + * IRQ settings, leading to a non working home-button. + */ + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), + DMI_MATCH(DMI_PRODUCT_NAME, "60073"), +- DMI_MATCH(DMI_PRODUCT_VERSION, "1051L"), ++ DMI_MATCH(DMI_PRODUCT_VERSION, "1051"), + }, + }, + {} /* Terminating entry */ +-- +2.35.1 + diff --git a/queue-5.15/ipv6-fix-signed-integer-overflow-in-l2tp_ip6_sendmsg.patch b/queue-5.15/ipv6-fix-signed-integer-overflow-in-l2tp_ip6_sendmsg.patch new file mode 100644 index 00000000000..75b10a1c93a --- /dev/null +++ b/queue-5.15/ipv6-fix-signed-integer-overflow-in-l2tp_ip6_sendmsg.patch @@ -0,0 +1,46 @@ +From d97530dff1ebde44ae0746a604b68d84e46050e7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Jun 2022 20:00:28 +0800 +Subject: ipv6: Fix signed integer overflow in l2tp_ip6_sendmsg + +From: Wang Yufen + +[ Upstream commit f638a84afef3dfe10554c51820c16e39a278c915 ] + +When len >= INT_MAX - transhdrlen, ulen = len + transhdrlen will be +overflow. To fix, we can follow what udpv6 does and subtract the +transhdrlen from the max. + +Signed-off-by: Wang Yufen +Link: https://lore.kernel.org/r/20220607120028.845916-2-wangyufen@huawei.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/l2tp/l2tp_ip6.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c +index 96f975777438..d54dbd01d86f 100644 +--- a/net/l2tp/l2tp_ip6.c ++++ b/net/l2tp/l2tp_ip6.c +@@ -502,14 +502,15 @@ static int l2tp_ip6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) + struct ipcm6_cookie ipc6; + int addr_len = msg->msg_namelen; + int transhdrlen = 4; /* zero session-id */ +- int ulen = len + transhdrlen; ++ int ulen; + int err; + + /* Rough check on arithmetic overflow, + * better check is made in ip6_append_data(). + */ +- if (len > INT_MAX) ++ if (len > INT_MAX - transhdrlen) + return -EMSGSIZE; ++ ulen = len + transhdrlen; + + /* Mirror BSD error message compatibility */ + if (msg->msg_flags & MSG_OOB) +-- +2.35.1 + diff --git a/queue-5.15/mellanox-mlx5-avoid-uninitialized-variable-warning-w.patch b/queue-5.15/mellanox-mlx5-avoid-uninitialized-variable-warning-w.patch new file mode 100644 index 00000000000..c0dbdac3e8c --- /dev/null +++ b/queue-5.15/mellanox-mlx5-avoid-uninitialized-variable-warning-w.patch @@ -0,0 +1,52 @@ +From 6f60bf4c6bbe2e6817b3a342498304851a13b8de Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Jun 2022 10:03:28 -0700 +Subject: mellanox: mlx5: avoid uninitialized variable warning with gcc-12 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Linus Torvalds + +[ Upstream commit 842c3b3ddc5f4d17275edbaa09e23d712bf8b915 ] + +gcc-12 started warning about 'tracker' being used uninitialized: + + drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c: In function ‘mlx5_do_bond’: + drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c:786:28: warning: ‘tracker’ is used uninitialized [-Wuninitialized] + 786 | struct lag_tracker tracker; + | ^~~~~~~ + +which seems to be because it doesn't track how the use (and +initialization) is bound by the 'do_bond' flag. + +But admittedly that 'do_bond' usage is fairly complicated, and involves +passing it around as an argument to helper functions, so it's somewhat +understandable that gcc doesn't see how that all works. + +This function could be rewritten to make the use of that tracker +variable more obviously safe, but for now I'm just adding the forced +initialization of it. + +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/lag.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lag.c b/drivers/net/ethernet/mellanox/mlx5/core/lag.c +index 57d86d47ec2a..0fbb239559f3 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/lag.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/lag.c +@@ -435,7 +435,7 @@ static void mlx5_do_bond(struct mlx5_lag *ldev) + { + struct mlx5_core_dev *dev0 = ldev->pf[MLX5_LAG_P1].dev; + struct mlx5_core_dev *dev1 = ldev->pf[MLX5_LAG_P2].dev; +- struct lag_tracker tracker; ++ struct lag_tracker tracker = { }; + bool do_bond, roce_lag; + int err; + +-- +2.35.1 + diff --git a/queue-5.15/mips-loongson-3-fix-compile-mips-cpu_hwmon-as-module.patch b/queue-5.15/mips-loongson-3-fix-compile-mips-cpu_hwmon-as-module.patch new file mode 100644 index 00000000000..744a9065084 --- /dev/null +++ b/queue-5.15/mips-loongson-3-fix-compile-mips-cpu_hwmon-as-module.patch @@ -0,0 +1,55 @@ +From 0f5e5b555e413b6678474b93f5755b64965b84e4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Jun 2022 09:12:29 +0800 +Subject: MIPS: Loongson-3: fix compile mips cpu_hwmon as module build error. +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Yupeng Li + +[ Upstream commit 41e456400212803704e82691716e1d7b0865114a ] + + set cpu_hwmon as a module build with loongson_sysconf, loongson_chiptemp + undefined error,fix cpu_hwmon compile options to be bool.Some kernel + compilation error information is as follows: + + Checking missing-syscalls for N32 + CALL scripts/checksyscalls.sh + Checking missing-syscalls for O32 + CALL scripts/checksyscalls.sh + CALL scripts/checksyscalls.sh + CHK include/generated/compile.h + CC [M] drivers/platform/mips/cpu_hwmon.o + Building modules, stage 2. + MODPOST 200 modules +ERROR: "loongson_sysconf" [drivers/platform/mips/cpu_hwmon.ko] undefined! +ERROR: "loongson_chiptemp" [drivers/platform/mips/cpu_hwmon.ko] undefined! +make[1]: *** [scripts/Makefile.modpost:92：__modpost] 错误 1 +make: *** [Makefile:1261：modules] 错误 2 + +Signed-off-by: Yupeng Li +Reviewed-by: Guenter Roeck +Reviewed-by: Huacai Chen +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + drivers/platform/mips/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/platform/mips/Kconfig b/drivers/platform/mips/Kconfig +index 8ac149173c64..495da331ca2d 100644 +--- a/drivers/platform/mips/Kconfig ++++ b/drivers/platform/mips/Kconfig +@@ -17,7 +17,7 @@ menuconfig MIPS_PLATFORM_DEVICES + if MIPS_PLATFORM_DEVICES + + config CPU_HWMON +- tristate "Loongson-3 CPU HWMon Driver" ++ bool "Loongson-3 CPU HWMon Driver" + depends on MACH_LOONGSON64 + select HWMON + default y +-- +2.35.1 + diff --git a/queue-5.15/net-ethernet-mtk_eth_soc-fix-misuse-of-mem-alloc-int.patch b/queue-5.15/net-ethernet-mtk_eth_soc-fix-misuse-of-mem-alloc-int.patch new file mode 100644 index 00000000000..19054e05c7f --- /dev/null +++ b/queue-5.15/net-ethernet-mtk_eth_soc-fix-misuse-of-mem-alloc-int.patch @@ -0,0 +1,74 @@ +From 707e4ef5a6a647e87a1512c064c4ac1a9b939a3c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Jun 2022 20:46:53 +0800 +Subject: net: ethernet: mtk_eth_soc: fix misuse of mem alloc interface + netdev[napi]_alloc_frag + +From: Chen Lin + +[ Upstream commit 2f2c0d2919a14002760f89f4e02960c735a316d2 ] + +When rx_flag == MTK_RX_FLAGS_HWLRO, +rx_data_len = MTK_MAX_LRO_RX_LENGTH(4096 * 3) > PAGE_SIZE. +netdev_alloc_frag is for alloction of page fragment only. +Reference to other drivers and Documentation/vm/page_frags.rst + +Branch to use __get_free_pages when ring->frag_size > PAGE_SIZE. + +Signed-off-by: Chen Lin +Link: https://lore.kernel.org/r/1654692413-2598-1-git-send-email-chen45464546@163.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mediatek/mtk_eth_soc.c | 21 +++++++++++++++++++-- + 1 file changed, 19 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c +index d2d7160b789c..8601ef26c260 100644 +--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c ++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c +@@ -820,6 +820,17 @@ static inline bool mtk_rx_get_desc(struct mtk_rx_dma *rxd, + return true; + } + ++static void *mtk_max_lro_buf_alloc(gfp_t gfp_mask) ++{ ++ unsigned int size = mtk_max_frag_size(MTK_MAX_LRO_RX_LENGTH); ++ unsigned long data; ++ ++ data = __get_free_pages(gfp_mask | __GFP_COMP | __GFP_NOWARN, ++ get_order(size)); ++ ++ return (void *)data; ++} ++ + /* the qdma core needs scratch memory to be setup */ + static int mtk_init_fq_dma(struct mtk_eth *eth) + { +@@ -1311,7 +1322,10 @@ static int mtk_poll_rx(struct napi_struct *napi, int budget, + goto release_desc; + + /* alloc new buffer */ +- new_data = napi_alloc_frag(ring->frag_size); ++ if (ring->frag_size <= PAGE_SIZE) ++ new_data = napi_alloc_frag(ring->frag_size); ++ else ++ new_data = mtk_max_lro_buf_alloc(GFP_ATOMIC); + if (unlikely(!new_data)) { + netdev->stats.rx_dropped++; + goto release_desc; +@@ -1725,7 +1739,10 @@ static int mtk_rx_alloc(struct mtk_eth *eth, int ring_no, int rx_flag) + return -ENOMEM; + + for (i = 0; i < rx_dma_size; i++) { +- ring->data[i] = netdev_alloc_frag(ring->frag_size); ++ if (ring->frag_size <= PAGE_SIZE) ++ ring->data[i] = netdev_alloc_frag(ring->frag_size); ++ else ++ ring->data[i] = mtk_max_lro_buf_alloc(GFP_KERNEL); + if (!ring->data[i]) + return -ENOMEM; + } +-- +2.35.1 + diff --git a/queue-5.15/netfs-gcc-12-temporarily-disable-wattribute-warning-.patch b/queue-5.15/netfs-gcc-12-temporarily-disable-wattribute-warning-.patch new file mode 100644 index 00000000000..a0b0bf0f72b --- /dev/null +++ b/queue-5.15/netfs-gcc-12-temporarily-disable-wattribute-warning-.patch @@ -0,0 +1,110 @@ +From 1fe2d432f71b31f159707aa4542efd1ada85431e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Jun 2022 11:29:36 -0700 +Subject: netfs: gcc-12: temporarily disable '-Wattribute-warning' for now +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Linus Torvalds + +[ Upstream commit 507160f46c55913955d272ebf559d63809a8e560 ] + +This is a pure band-aid so that I can continue merging stuff from people +while some of the gcc-12 fallout gets sorted out. + +In particular, gcc-12 is very unhappy about the kinds of pointer +arithmetic tricks that netfs does, and that makes the fortify checks +trigger in afs and ceph: + + In function ‘fortify_memset_chk’, + inlined from ‘netfs_i_context_init’ at include/linux/netfs.h:327:2, + inlined from ‘afs_set_netfs_context’ at fs/afs/inode.c:61:2, + inlined from ‘afs_root_iget’ at fs/afs/inode.c:543:2: + include/linux/fortify-string.h:258:25: warning: call to ‘__write_overflow_field’ declared with attribute warning: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Wattribute-warning] + 258 | __write_overflow_field(p_size_field, size); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +and the reason is that netfs_i_context_init() is passed a 'struct inode' +pointer, and then it does + + struct netfs_i_context *ctx = netfs_i_context(inode); + + memset(ctx, 0, sizeof(*ctx)); + +where that netfs_i_context() function just does pointer arithmetic on +the inode pointer, knowing that the netfs_i_context is laid out +immediately after it in memory. + +This is all truly disgusting, since the whole "netfs_i_context is laid +out immediately after it in memory" is not actually remotely true in +general, but is just made to be that way for afs and ceph. + +See for example fs/cifs/cifsglob.h: + + struct cifsInodeInfo { + struct { + /* These must be contiguous */ + struct inode vfs_inode; /* the VFS's inode record */ + struct netfs_i_context netfs_ctx; /* Netfslib context */ + }; + [...] + +and realize that this is all entirely wrong, and the pointer arithmetic +that netfs_i_context() is doing is also very very wrong and wouldn't +give the right answer if netfs_ctx had different alignment rules from a +'struct inode', for example). + +Anyway, that's just a long-winded way to say "the gcc-12 warning is +actually quite reasonable, and our code happens to work but is pretty +disgusting". + +This is getting fixed properly, but for now I made the mistake of +thinking "the week right after the merge window tends to be calm for me +as people take a breather" and I did a sustem upgrade. And I got gcc-12 +as a result, so to continue merging fixes from people and not have the +end result drown in warnings, I am fixing all these gcc-12 issues I hit. + +Including with these kinds of temporary fixes. + +Cc: Kees Cook +Cc: David Howells +Link: https://lore.kernel.org/all/AEEBCF5D-8402-441D-940B-105AA718C71F@chromium.org/ +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + fs/afs/inode.c | 3 +++ + fs/ceph/inode.c | 3 +++ + 2 files changed, 6 insertions(+) + +diff --git a/fs/afs/inode.c b/fs/afs/inode.c +index a47666ba48f5..5c5b3cb05a5f 100644 +--- a/fs/afs/inode.c ++++ b/fs/afs/inode.c +@@ -25,6 +25,9 @@ + #include "internal.h" + #include "afs_fs.h" + ++// Temporary: netfs does disgusting things with inode pointers ++#pragma GCC diagnostic ignored "-Wattribute-warning" ++ + static const struct inode_operations afs_symlink_inode_operations = { + .get_link = page_get_link, + }; +diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c +index 42e449d3f18b..2fc5ea85f08d 100644 +--- a/fs/ceph/inode.c ++++ b/fs/ceph/inode.c +@@ -20,6 +20,9 @@ + #include "cache.h" + #include + ++// Temporary: netfs does disgusting things with inode pointers ++#pragma GCC diagnostic ignored "-Wattribute-warning" ++ + /* + * Ceph inode operations + * +-- +2.35.1 + diff --git a/queue-5.15/nfc-nfcmrvl-fix-memory-leak-in-nfcmrvl_play_deferred.patch b/queue-5.15/nfc-nfcmrvl-fix-memory-leak-in-nfcmrvl_play_deferred.patch new file mode 100644 index 00000000000..c65fe656bdc --- /dev/null +++ b/queue-5.15/nfc-nfcmrvl-fix-memory-leak-in-nfcmrvl_play_deferred.patch @@ -0,0 +1,66 @@ +From 73c3f9d6572c9fb7253130af8427615ebfb88e61 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Jun 2022 16:32:30 +0800 +Subject: nfc: nfcmrvl: Fix memory leak in nfcmrvl_play_deferred + +From: Xiaohui Zhang + +[ Upstream commit 8a4d480702b71184fabcf379b80bf7539716752e ] + +Similar to the handling of play_deferred in commit 19cfe912c37b +("Bluetooth: btusb: Fix memory leak in play_deferred"), we thought +a patch might be needed here as well. + +Currently usb_submit_urb is called directly to submit deferred tx +urbs after unanchor them. + +So the usb_giveback_urb_bh would failed to unref it in usb_unanchor_urb +and cause memory leak. + +Put those urbs in tx_anchor to avoid the leak, and also fix the error +handling. + +Signed-off-by: Xiaohui Zhang +Acked-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20220607083230.6182-1-xiaohuizhang@ruc.edu.cn +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/nfc/nfcmrvl/usb.c | 16 ++++++++++++++-- + 1 file changed, 14 insertions(+), 2 deletions(-) + +diff --git a/drivers/nfc/nfcmrvl/usb.c b/drivers/nfc/nfcmrvl/usb.c +index a99aedff795d..ea7309453096 100644 +--- a/drivers/nfc/nfcmrvl/usb.c ++++ b/drivers/nfc/nfcmrvl/usb.c +@@ -388,13 +388,25 @@ static void nfcmrvl_play_deferred(struct nfcmrvl_usb_drv_data *drv_data) + int err; + + while ((urb = usb_get_from_anchor(&drv_data->deferred))) { ++ usb_anchor_urb(urb, &drv_data->tx_anchor); ++ + err = usb_submit_urb(urb, GFP_ATOMIC); +- if (err) ++ if (err) { ++ kfree(urb->setup_packet); ++ usb_unanchor_urb(urb); ++ usb_free_urb(urb); + break; ++ } + + drv_data->tx_in_flight++; ++ usb_free_urb(urb); ++ } ++ ++ /* Cleanup the rest deferred urbs. */ ++ while ((urb = usb_get_from_anchor(&drv_data->deferred))) { ++ kfree(urb->setup_packet); ++ usb_free_urb(urb); + } +- usb_scuttle_anchored_urbs(&drv_data->deferred); + } + + static int nfcmrvl_resume(struct usb_interface *intf) +-- +2.35.1 + diff --git a/queue-5.15/platform-x86-gigabyte-wmi-add-support-for-b450m-ds3h.patch b/queue-5.15/platform-x86-gigabyte-wmi-add-support-for-b450m-ds3h.patch new file mode 100644 index 00000000000..0fa08cd8119 --- /dev/null +++ b/queue-5.15/platform-x86-gigabyte-wmi-add-support-for-b450m-ds3h.patch @@ -0,0 +1,34 @@ +From 45ee84e8f6d5a1d67edcd9827bfeac855b021e9b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Jun 2022 23:20:28 +0200 +Subject: platform/x86: gigabyte-wmi: Add support for B450M DS3H-CF + +From: August Wikerfors + +[ Upstream commit c6bc7e8ee90845556a90faf8b043cbefd77b8903 ] + +Tested and works on my system. + +Signed-off-by: August Wikerfors +Link: https://lore.kernel.org/r/20220608212028.28307-1-git@augustwikerfors.se +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/gigabyte-wmi.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/platform/x86/gigabyte-wmi.c b/drivers/platform/x86/gigabyte-wmi.c +index ad4f789309d6..ebd15c1d13ec 100644 +--- a/drivers/platform/x86/gigabyte-wmi.c ++++ b/drivers/platform/x86/gigabyte-wmi.c +@@ -140,6 +140,7 @@ static u8 gigabyte_wmi_detect_sensor_usability(struct wmi_device *wdev) + }} + + static const struct dmi_system_id gigabyte_wmi_known_working_platforms[] = { ++ DMI_EXACT_MATCH_GIGABYTE_BOARD_NAME("B450M DS3H-CF"), + DMI_EXACT_MATCH_GIGABYTE_BOARD_NAME("B450M S2H V2"), + DMI_EXACT_MATCH_GIGABYTE_BOARD_NAME("B550 AORUS ELITE AX V2"), + DMI_EXACT_MATCH_GIGABYTE_BOARD_NAME("B550 AORUS ELITE"), +-- +2.35.1 + diff --git a/queue-5.15/platform-x86-gigabyte-wmi-add-z690m-aorus-elite-ax-d.patch b/queue-5.15/platform-x86-gigabyte-wmi-add-z690m-aorus-elite-ax-d.patch new file mode 100644 index 00000000000..77641a56e74 --- /dev/null +++ b/queue-5.15/platform-x86-gigabyte-wmi-add-z690m-aorus-elite-ax-d.patch @@ -0,0 +1,35 @@ +From b095b6d2ebe800e1b348471ad44dda6ffe9abaca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Jun 2022 19:15:13 +0200 +Subject: platform/x86: gigabyte-wmi: Add Z690M AORUS ELITE AX DDR4 support + +From: Piotr Chmura + +[ Upstream commit 8a041afe3e774bedd3e0a9b96f65e48a1299a595 ] + +Add dmi_system_id of Gigabyte Z690M AORUS ELITE AX DDR4 board. +Tested on my PC. + +Signed-off-by: Piotr Chmura +Link: https://lore.kernel.org/r/bd83567e-ebf5-0b31-074b-5f6dc7f7c147@gmail.com +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/gigabyte-wmi.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/platform/x86/gigabyte-wmi.c b/drivers/platform/x86/gigabyte-wmi.c +index 658bab4b7964..ad4f789309d6 100644 +--- a/drivers/platform/x86/gigabyte-wmi.c ++++ b/drivers/platform/x86/gigabyte-wmi.c +@@ -153,6 +153,7 @@ static const struct dmi_system_id gigabyte_wmi_known_working_platforms[] = { + DMI_EXACT_MATCH_GIGABYTE_BOARD_NAME("X570 GAMING X"), + DMI_EXACT_MATCH_GIGABYTE_BOARD_NAME("X570 I AORUS PRO WIFI"), + DMI_EXACT_MATCH_GIGABYTE_BOARD_NAME("X570 UD"), ++ DMI_EXACT_MATCH_GIGABYTE_BOARD_NAME("Z690M AORUS ELITE AX DDR4"), + { } + }; + +-- +2.35.1 + diff --git a/queue-5.15/platform-x86-intel-hid-add-surface-go-to-vgbs-allow-.patch b/queue-5.15/platform-x86-intel-hid-add-surface-go-to-vgbs-allow-.patch new file mode 100644 index 00000000000..488197f7e4f --- /dev/null +++ b/queue-5.15/platform-x86-intel-hid-add-surface-go-to-vgbs-allow-.patch @@ -0,0 +1,44 @@ +From a16bf5daa61b05cd0426c4dc3b0c402812dd1a48 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Jun 2022 14:36:54 -0700 +Subject: platform/x86/intel: hid: Add Surface Go to VGBS allow list + +From: Duke Lee + +[ Upstream commit d4fe9cc4ff8656704b58cfd9363d7c3c9d65e519 ] + +The Surface Go reports Chassis Type 9 (Laptop,) so the device needs to be +added to dmi_vgbs_allow_list to enable tablet mode when an attached Type +Cover is folded back. + +BugLink: https://github.com/linux-surface/linux-surface/issues/837 +Signed-off-by: Duke Lee +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20220607213654.5567-1-krnhotwings@gmail.com +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/intel/hid.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/platform/x86/intel/hid.c b/drivers/platform/x86/intel/hid.c +index e9e8554147e0..d7d6782c40c2 100644 +--- a/drivers/platform/x86/intel/hid.c ++++ b/drivers/platform/x86/intel/hid.c +@@ -129,6 +129,12 @@ static const struct dmi_system_id dmi_vgbs_allow_list[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "HP Spectre x360 Convertible 15-df0xxx"), + }, + }, ++ { ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Microsoft Corporation"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Surface Go"), ++ }, ++ }, + { } + }; + +-- +2.35.1 + diff --git a/queue-5.15/powerpc-kasan-silence-kasan-warnings-in-__get_wchan.patch b/queue-5.15/powerpc-kasan-silence-kasan-warnings-in-__get_wchan.patch new file mode 100644 index 00000000000..e6fc7428b8b --- /dev/null +++ b/queue-5.15/powerpc-kasan-silence-kasan-warnings-in-__get_wchan.patch @@ -0,0 +1,91 @@ +From 20bcfc54ba73dd257f6cf2ef851d3eb1302c5196 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jan 2022 20:44:18 -0500 +Subject: powerpc/kasan: Silence KASAN warnings in __get_wchan() + +From: He Ying + +[ Upstream commit a1b29ba2f2c171b9bea73be993bfdf0a62d37d15 ] + +The following KASAN warning was reported in our kernel. + + BUG: KASAN: stack-out-of-bounds in get_wchan+0x188/0x250 + Read of size 4 at addr d216f958 by task ps/14437 + + CPU: 3 PID: 14437 Comm: ps Tainted: G O 5.10.0 #1 + Call Trace: + [daa63858] [c0654348] dump_stack+0x9c/0xe4 (unreliable) + [daa63888] [c035cf0c] print_address_description.constprop.3+0x8c/0x570 + [daa63908] [c035d6bc] kasan_report+0x1ac/0x218 + [daa63948] [c00496e8] get_wchan+0x188/0x250 + [daa63978] [c0461ec8] do_task_stat+0xce8/0xe60 + [daa63b98] [c0455ac8] proc_single_show+0x98/0x170 + [daa63bc8] [c03cab8c] seq_read_iter+0x1ec/0x900 + [daa63c38] [c03cb47c] seq_read+0x1dc/0x290 + [daa63d68] [c037fc94] vfs_read+0x164/0x510 + [daa63ea8] [c03808e4] ksys_read+0x144/0x1d0 + [daa63f38] [c005b1dc] ret_from_syscall+0x0/0x38 + --- interrupt: c00 at 0x8fa8f4 + LR = 0x8fa8cc + + The buggy address belongs to the page: + page:98ebcdd2 refcount:0 mapcount:0 mapping:00000000 index:0x2 pfn:0x1216f + flags: 0x0() + raw: 00000000 00000000 01010122 00000000 00000002 00000000 ffffffff 00000000 + raw: 00000000 + page dumped because: kasan: bad access detected + + Memory state around the buggy address: + d216f800: 00 00 00 00 00 f1 f1 f1 f1 00 00 00 00 00 00 00 + d216f880: f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + >d216f900: 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 + ^ + d216f980: f2 f2 f2 f2 f2 f2 f2 00 00 00 00 00 00 00 00 00 + d216fa00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + +After looking into this issue, I find the buggy address belongs +to the task stack region. It seems KASAN has something wrong. +I look into the code of __get_wchan in x86 architecture and +find the same issue has been resolved by the commit +f7d27c35ddff ("x86/mm, kasan: Silence KASAN warnings in get_wchan()"). +The solution could be applied to powerpc architecture too. + +As Andrey Ryabinin said, get_wchan() is racy by design, it may +access volatile stack of running task, thus it may access +redzone in a stack frame and cause KASAN to warn about this. + +Use READ_ONCE_NOCHECK() to silence these warnings. + +Reported-by: Wanming Hu +Signed-off-by: He Ying +Signed-off-by: Chen Jingwen +Reviewed-by: Kees Cook +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20220121014418.155675-1-heying24@huawei.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/process.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c +index 50436b52c213..39a0a13a3a27 100644 +--- a/arch/powerpc/kernel/process.c ++++ b/arch/powerpc/kernel/process.c +@@ -2124,12 +2124,12 @@ static unsigned long __get_wchan(struct task_struct *p) + return 0; + + do { +- sp = *(unsigned long *)sp; ++ sp = READ_ONCE_NOCHECK(*(unsigned long *)sp); + if (!validate_sp(sp, p, STACK_FRAME_OVERHEAD) || + task_is_running(p)) + return 0; + if (count > 0) { +- ip = ((unsigned long *)sp)[STACK_FRAME_LR_SAVE]; ++ ip = READ_ONCE_NOCHECK(((unsigned long *)sp)[STACK_FRAME_LR_SAVE]); + if (!in_sched_functions(ip)) + return ip; + } +-- +2.35.1 + diff --git a/queue-5.15/quota-prevent-memory-allocation-recursion-while-hold.patch b/queue-5.15/quota-prevent-memory-allocation-recursion-while-hold.patch new file mode 100644 index 00000000000..7e6323a3913 --- /dev/null +++ b/queue-5.15/quota-prevent-memory-allocation-recursion-while-hold.patch @@ -0,0 +1,97 @@ +From ed8ac6ae19572eeb46f79a9eee6cfe6e4c6b2928 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 5 Jun 2022 15:38:13 +0100 +Subject: quota: Prevent memory allocation recursion while holding dq_lock + +From: Matthew Wilcox (Oracle) + +[ Upstream commit 537e11cdc7a6b3ce94fa25ed41306193df9677b7 ] + +As described in commit 02117b8ae9c0 ("f2fs: Set GF_NOFS in +read_cache_page_gfp while doing f2fs_quota_read"), we must not enter +filesystem reclaim while holding the dq_lock. Prevent this more generally +by using memalloc_nofs_save() while holding the lock. + +Link: https://lore.kernel.org/r/20220605143815.2330891-2-willy@infradead.org +Signed-off-by: Matthew Wilcox (Oracle) +Signed-off-by: Jan Kara +Signed-off-by: Sasha Levin +--- + fs/quota/dquot.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c +index a74aef99bd3d..09d1307959d0 100644 +--- a/fs/quota/dquot.c ++++ b/fs/quota/dquot.c +@@ -79,6 +79,7 @@ + #include + #include + #include ++#include + #include "../internal.h" /* ugh */ + + #include +@@ -425,9 +426,11 @@ EXPORT_SYMBOL(mark_info_dirty); + int dquot_acquire(struct dquot *dquot) + { + int ret = 0, ret2 = 0; ++ unsigned int memalloc; + struct quota_info *dqopt = sb_dqopt(dquot->dq_sb); + + mutex_lock(&dquot->dq_lock); ++ memalloc = memalloc_nofs_save(); + if (!test_bit(DQ_READ_B, &dquot->dq_flags)) { + ret = dqopt->ops[dquot->dq_id.type]->read_dqblk(dquot); + if (ret < 0) +@@ -458,6 +461,7 @@ int dquot_acquire(struct dquot *dquot) + smp_mb__before_atomic(); + set_bit(DQ_ACTIVE_B, &dquot->dq_flags); + out_iolock: ++ memalloc_nofs_restore(memalloc); + mutex_unlock(&dquot->dq_lock); + return ret; + } +@@ -469,9 +473,11 @@ EXPORT_SYMBOL(dquot_acquire); + int dquot_commit(struct dquot *dquot) + { + int ret = 0; ++ unsigned int memalloc; + struct quota_info *dqopt = sb_dqopt(dquot->dq_sb); + + mutex_lock(&dquot->dq_lock); ++ memalloc = memalloc_nofs_save(); + if (!clear_dquot_dirty(dquot)) + goto out_lock; + /* Inactive dquot can be only if there was error during read/init +@@ -481,6 +487,7 @@ int dquot_commit(struct dquot *dquot) + else + ret = -EIO; + out_lock: ++ memalloc_nofs_restore(memalloc); + mutex_unlock(&dquot->dq_lock); + return ret; + } +@@ -492,9 +499,11 @@ EXPORT_SYMBOL(dquot_commit); + int dquot_release(struct dquot *dquot) + { + int ret = 0, ret2 = 0; ++ unsigned int memalloc; + struct quota_info *dqopt = sb_dqopt(dquot->dq_sb); + + mutex_lock(&dquot->dq_lock); ++ memalloc = memalloc_nofs_save(); + /* Check whether we are not racing with some other dqget() */ + if (dquot_is_busy(dquot)) + goto out_dqlock; +@@ -510,6 +519,7 @@ int dquot_release(struct dquot *dquot) + } + clear_bit(DQ_ACTIVE_B, &dquot->dq_flags); + out_dqlock: ++ memalloc_nofs_restore(memalloc); + mutex_unlock(&dquot->dq_lock); + return ret; + } +-- +2.35.1 + diff --git a/queue-5.15/random-credit-cpu-and-bootloader-seeds-by-default.patch b/queue-5.15/random-credit-cpu-and-bootloader-seeds-by-default.patch new file mode 100644 index 00000000000..97069b2f478 --- /dev/null +++ b/queue-5.15/random-credit-cpu-and-bootloader-seeds-by-default.patch @@ -0,0 +1,200 @@ +From 1151b9ef9e06642ba3aeab2ebffdaadb584a0029 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 5 Jun 2022 18:30:46 +0200 +Subject: random: credit cpu and bootloader seeds by default + +From: Jason A. Donenfeld + +[ Upstream commit 846bb97e131d7938847963cca00657c995b1fce1 ] + +This commit changes the default Kconfig values of RANDOM_TRUST_CPU and +RANDOM_TRUST_BOOTLOADER to be Y by default. It does not change any +existing configs or change any kernel behavior. The reason for this is +several fold. + +As background, I recently had an email thread with the kernel +maintainers of Fedora/RHEL, Debian, Ubuntu, Gentoo, Arch, NixOS, Alpine, +SUSE, and Void as recipients. I noted that some distros trust RDRAND, +some trust EFI, and some trust both, and I asked why or why not. There +wasn't really much of a "debate" but rather an interesting discussion of +what the historical reasons have been for this, and it came up that some +distros just missed the introduction of the bootloader Kconfig knob, +while another didn't want to enable it until there was a boot time +switch to turn it off for more concerned users (which has since been +added). The result of the rather uneventful discussion is that every +major Linux distro enables these two options by default. + +While I didn't have really too strong of an opinion going into this +thread -- and I mostly wanted to learn what the distros' thinking was +one way or another -- ultimately I think their choice was a decent +enough one for a default option (which can be disabled at boot time). +I'll try to summarize the pros and cons: + +Pros: + +- The RNG machinery gets initialized super quickly, and there's no + messing around with subsequent blocking behavior. + +- The bootloader mechanism is used by kexec in order for the prior + kernel to initialize the RNG of the next kernel, which increases + the entropy available to early boot daemons of the next kernel. + +- Previous objections related to backdoors centered around + Dual_EC_DRBG-like kleptographic systems, in which observing some + amount of the output stream enables an adversary holding the right key + to determine the entire output stream. + + This used to be a partially justified concern, because RDRAND output + was mixed into the output stream in varying ways, some of which may + have lacked pre-image resistance (e.g. XOR or an LFSR). + + But this is no longer the case. Now, all usage of RDRAND and + bootloader seeds go through a cryptographic hash function. This means + that the CPU would have to compute a hash pre-image, which is not + considered to be feasible (otherwise the hash function would be + terribly broken). + +- More generally, if the CPU is backdoored, the RNG is probably not the + realistic vector of choice for an attacker. + +- These CPU or bootloader seeds are far from being the only source of + entropy. Rather, there is generally a pretty huge amount of entropy, + not all of which is credited, especially on CPUs that support + instructions like RDRAND. In other words, assuming RDRAND outputs all + zeros, an attacker would *still* have to accurately model every single + other entropy source also in use. + +- The RNG now reseeds itself quite rapidly during boot, starting at 2 + seconds, then 4, then 8, then 16, and so forth, so that other sources + of entropy get used without much delay. + +- Paranoid users can set random.trust_{cpu,bootloader}=no in the kernel + command line, and paranoid system builders can set the Kconfig options + to N, so there's no reduction or restriction of optionality. + +- It's a practical default. + +- All the distros have it set this way. Microsoft and Apple trust it + too. Bandwagon. + +Cons: + +- RDRAND *could* still be backdoored with something like a fixed key or + limited space serial number seed or another indexable scheme like + that. (However, it's hard to imagine threat models where the CPU is + backdoored like this, yet people are still okay making *any* + computations with it or connecting it to networks, etc.) + +- RDRAND *could* be defective, rather than backdoored, and produce + garbage that is in one way or another insufficient for crypto. + +- Suggesting a *reduction* in paranoia, as this commit effectively does, + may cause some to question my personal integrity as a "security + person". + +- Bootloader seeds and RDRAND are generally very difficult if not all + together impossible to audit. + +Keep in mind that this doesn't actually change any behavior. This +is just a change in the default Kconfig value. The distros already are +shipping kernels that set things this way. + +Ard made an additional argument in [1]: + + We're at the mercy of firmware and micro-architecture anyway, given + that we are also relying on it to ensure that every instruction in + the kernel's executable image has been faithfully copied to memory, + and that the CPU implements those instructions as documented. So I + don't think firmware or ISA bugs related to RNGs deserve special + treatment - if they are broken, we should quirk around them like we + usually do. So enabling these by default is a step in the right + direction IMHO. + +In [2], Phil pointed out that having this disabled masked a bug that CI +otherwise would have caught: + + A clean 5.15.45 boots cleanly, whereas a downstream kernel shows the + static key warning (but it does go on to boot). The significant + difference is that our defconfigs set CONFIG_RANDOM_TRUST_BOOTLOADER=y + defining that on top of multi_v7_defconfig demonstrates the issue on + a clean 5.15.45. Conversely, not setting that option in a + downstream kernel build avoids the warning + +[1] https://lore.kernel.org/lkml/CAMj1kXGi+ieviFjXv9zQBSaGyyzeGW_VpMpTLJK8PJb2QHEQ-w@mail.gmail.com/ +[2] https://lore.kernel.org/lkml/c47c42e3-1d56-5859-a6ad-976a1a3381c6@raspberrypi.com/ + +Cc: Theodore Ts'o +Reviewed-by: Ard Biesheuvel +Signed-off-by: Jason A. Donenfeld +Signed-off-by: Sasha Levin +--- + drivers/char/Kconfig | 50 +++++++++++++++++++++++++++----------------- + 1 file changed, 31 insertions(+), 19 deletions(-) + +diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig +index 55f48375e3fe..d454428f4981 100644 +--- a/drivers/char/Kconfig ++++ b/drivers/char/Kconfig +@@ -428,28 +428,40 @@ config ADI + driver include crash and makedumpfile. + + config RANDOM_TRUST_CPU +- bool "Trust the CPU manufacturer to initialize Linux's CRNG" ++ bool "Initialize RNG using CPU RNG instructions" ++ default y + depends on ARCH_RANDOM +- default n + help +- Assume that CPU manufacturer (e.g., Intel or AMD for RDSEED or +- RDRAND, IBM for the S390 and Power PC architectures) is trustworthy +- for the purposes of initializing Linux's CRNG. Since this is not +- something that can be independently audited, this amounts to trusting +- that CPU manufacturer (perhaps with the insistence or mandate +- of a Nation State's intelligence or law enforcement agencies) +- has not installed a hidden back door to compromise the CPU's +- random number generation facilities. This can also be configured +- at boot with "random.trust_cpu=on/off". ++ Initialize the RNG using random numbers supplied by the CPU's ++ RNG instructions (e.g. RDRAND), if supported and available. These ++ random numbers are never used directly, but are rather hashed into ++ the main input pool, and this happens regardless of whether or not ++ this option is enabled. Instead, this option controls whether the ++ they are credited and hence can initialize the RNG. Additionally, ++ other sources of randomness are always used, regardless of this ++ setting. Enabling this implies trusting that the CPU can supply high ++ quality and non-backdoored random numbers. ++ ++ Say Y here unless you have reason to mistrust your CPU or believe ++ its RNG facilities may be faulty. This may also be configured at ++ boot time with "random.trust_cpu=on/off". + + config RANDOM_TRUST_BOOTLOADER +- bool "Trust the bootloader to initialize Linux's CRNG" +- help +- Some bootloaders can provide entropy to increase the kernel's initial +- device randomness. Say Y here to assume the entropy provided by the +- booloader is trustworthy so it will be added to the kernel's entropy +- pool. Otherwise, say N here so it will be regarded as device input that +- only mixes the entropy pool. This can also be configured at boot with +- "random.trust_bootloader=on/off". ++ bool "Initialize RNG using bootloader-supplied seed" ++ default y ++ help ++ Initialize the RNG using a seed supplied by the bootloader or boot ++ environment (e.g. EFI or a bootloader-generated device tree). This ++ seed is not used directly, but is rather hashed into the main input ++ pool, and this happens regardless of whether or not this option is ++ enabled. Instead, this option controls whether the seed is credited ++ and hence can initialize the RNG. Additionally, other sources of ++ randomness are always used, regardless of this setting. Enabling ++ this implies trusting that the bootloader can supply high quality and ++ non-backdoored seeds. ++ ++ Say Y here unless you have reason to mistrust your bootloader or ++ believe its RNG facilities may be faulty. This may also be configured ++ at boot time with "random.trust_bootloader=on/off". + + endmenu +-- +2.35.1 + diff --git a/queue-5.15/scsi-ipr-fix-missing-incorrect-resource-cleanup-in-e.patch b/queue-5.15/scsi-ipr-fix-missing-incorrect-resource-cleanup-in-e.patch new file mode 100644 index 00000000000..d777bbcf0ba --- /dev/null +++ b/queue-5.15/scsi-ipr-fix-missing-incorrect-resource-cleanup-in-e.patch @@ -0,0 +1,49 @@ +From ae5a90f80c7715359bf1216ee51a85fe71989b65 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 29 May 2022 23:34:53 +0800 +Subject: scsi: ipr: Fix missing/incorrect resource cleanup in error case + +From: Chengguang Xu + +[ Upstream commit d64c491911322af1dcada98e5b9ee0d87e8c8fee ] + +Fix missing resource cleanup (when '(--i) == 0') for error case in +ipr_alloc_mem() and skip incorrect resource cleanup (when '(--i) == 0') for +error case in ipr_request_other_msi_irqs() because variable i started from +1. + +Link: https://lore.kernel.org/r/20220529153456.4183738-4-cgxu519@mykernel.net +Reviewed-by: Dan Carpenter +Acked-by: Brian King +Signed-off-by: Chengguang Xu +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/ipr.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c +index 5d78f7e939a3..56b8a2d6ffe4 100644 +--- a/drivers/scsi/ipr.c ++++ b/drivers/scsi/ipr.c +@@ -9791,7 +9791,7 @@ static int ipr_alloc_mem(struct ipr_ioa_cfg *ioa_cfg) + GFP_KERNEL); + + if (!ioa_cfg->hrrq[i].host_rrq) { +- while (--i > 0) ++ while (--i >= 0) + dma_free_coherent(&pdev->dev, + sizeof(u32) * ioa_cfg->hrrq[i].size, + ioa_cfg->hrrq[i].host_rrq, +@@ -10064,7 +10064,7 @@ static int ipr_request_other_msi_irqs(struct ipr_ioa_cfg *ioa_cfg, + ioa_cfg->vectors_info[i].desc, + &ioa_cfg->hrrq[i]); + if (rc) { +- while (--i >= 0) ++ while (--i > 0) + free_irq(pci_irq_vector(pdev, i), + &ioa_cfg->hrrq[i]); + return rc; +-- +2.35.1 + diff --git a/queue-5.15/scsi-lpfc-allow-reduced-polling-rate-for-nvme_admin_.patch b/queue-5.15/scsi-lpfc-allow-reduced-polling-rate-for-nvme_admin_.patch new file mode 100644 index 00000000000..209f069dff0 --- /dev/null +++ b/queue-5.15/scsi-lpfc-allow-reduced-polling-rate-for-nvme_admin_.patch @@ -0,0 +1,74 @@ +From f4c530cb22ba6c7ce462f810723c82ef602ee6de Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Jun 2022 10:43:28 -0700 +Subject: scsi: lpfc: Allow reduced polling rate for nvme_admin_async_event cmd + completion + +From: James Smart + +[ Upstream commit 2e7e9c0c1ec05f18d320ecc8a31eec59d2af1af9 ] + +NVMe Asynchronous Event Request commands have no command timeout value per +specifications. + +Set WQE option to allow a reduced FLUSH polling rate for I/O error +detection specifically for nvme_admin_async_event commands. + +Link: https://lore.kernel.org/r/20220603174329.63777-9-jsmart2021@gmail.com +Co-developed-by: Justin Tee +Signed-off-by: Justin Tee +Signed-off-by: James Smart +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/lpfc/lpfc_hw4.h | 3 +++ + drivers/scsi/lpfc/lpfc_nvme.c | 11 +++++++++-- + 2 files changed, 12 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/lpfc/lpfc_hw4.h b/drivers/scsi/lpfc/lpfc_hw4.h +index 7359505e6041..824fc8c08840 100644 +--- a/drivers/scsi/lpfc/lpfc_hw4.h ++++ b/drivers/scsi/lpfc/lpfc_hw4.h +@@ -4448,6 +4448,9 @@ struct wqe_common { + #define wqe_sup_SHIFT 6 + #define wqe_sup_MASK 0x00000001 + #define wqe_sup_WORD word11 ++#define wqe_ffrq_SHIFT 6 ++#define wqe_ffrq_MASK 0x00000001 ++#define wqe_ffrq_WORD word11 + #define wqe_wqec_SHIFT 7 + #define wqe_wqec_MASK 0x00000001 + #define wqe_wqec_WORD word11 +diff --git a/drivers/scsi/lpfc/lpfc_nvme.c b/drivers/scsi/lpfc/lpfc_nvme.c +index 66cb66aea2cf..4fb3dc5092f5 100644 +--- a/drivers/scsi/lpfc/lpfc_nvme.c ++++ b/drivers/scsi/lpfc/lpfc_nvme.c +@@ -1182,7 +1182,8 @@ lpfc_nvme_prep_io_cmd(struct lpfc_vport *vport, + { + struct lpfc_hba *phba = vport->phba; + struct nvmefc_fcp_req *nCmd = lpfc_ncmd->nvmeCmd; +- struct lpfc_iocbq *pwqeq = &(lpfc_ncmd->cur_iocbq); ++ struct nvme_common_command *sqe; ++ struct lpfc_iocbq *pwqeq = &lpfc_ncmd->cur_iocbq; + union lpfc_wqe128 *wqe = &pwqeq->wqe; + uint32_t req_len; + +@@ -1239,8 +1240,14 @@ lpfc_nvme_prep_io_cmd(struct lpfc_vport *vport, + cstat->control_requests++; + } + +- if (pnode->nlp_nvme_info & NLP_NVME_NSLER) ++ if (pnode->nlp_nvme_info & NLP_NVME_NSLER) { + bf_set(wqe_erp, &wqe->generic.wqe_com, 1); ++ sqe = &((struct nvme_fc_cmd_iu *) ++ nCmd->cmdaddr)->sqe.common; ++ if (sqe->opcode == nvme_admin_async_event) ++ bf_set(wqe_ffrq, &wqe->generic.wqe_com, 1); ++ } ++ + /* + * Finish initializing those WQE fields that are independent + * of the nvme_cmnd request_buffer +-- +2.35.1 + diff --git a/queue-5.15/scsi-lpfc-fix-port-stuck-in-bypassed-state-after-lip.patch b/queue-5.15/scsi-lpfc-fix-port-stuck-in-bypassed-state-after-lip.patch new file mode 100644 index 00000000000..ed5e9ee8fe4 --- /dev/null +++ b/queue-5.15/scsi-lpfc-fix-port-stuck-in-bypassed-state-after-lip.patch @@ -0,0 +1,50 @@ +From 69907021770e217eaad652746a52243f10722b04 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Jun 2022 10:43:26 -0700 +Subject: scsi: lpfc: Fix port stuck in bypassed state after LIP in PT2PT + topology + +From: James Smart + +[ Upstream commit 336d63615466b4c06b9401c987813fd19bdde39b ] + +After issuing a LIP, a specific target vendor does not ACC the FLOGI that +lpfc sends. However, it does send its own FLOGI that lpfc ACCs. The +target then establishes the port IDs by sending a PLOGI. lpfc PLOGI_ACCs +and starts the RPI registration for DID 0x000001. The target then sends a +LOGO to the fabric DID. lpfc is currently treating the LOGO from the +fabric DID as a link down and cleans up all the ndlps. The ndlp for DID +0x000001 is put back into NPR and discovery stops, leaving the port in +stuck in bypassed mode. + +Change lpfc behavior such that if a LOGO is received for the fabric DID in +PT2PT topology skip the lpfc_linkdown_port() routine and just move the +fabric DID back to NPR. + +Link: https://lore.kernel.org/r/20220603174329.63777-7-jsmart2021@gmail.com +Co-developed-by: Justin Tee +Signed-off-by: Justin Tee +Signed-off-by: James Smart +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/lpfc/lpfc_nportdisc.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/lpfc/lpfc_nportdisc.c b/drivers/scsi/lpfc/lpfc_nportdisc.c +index fdf5e777bf11..2bd35a7424c2 100644 +--- a/drivers/scsi/lpfc/lpfc_nportdisc.c ++++ b/drivers/scsi/lpfc/lpfc_nportdisc.c +@@ -810,7 +810,8 @@ lpfc_rcv_logo(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp, + lpfc_nvmet_invalidate_host(phba, ndlp); + + if (ndlp->nlp_DID == Fabric_DID) { +- if (vport->port_state <= LPFC_FDISC) ++ if (vport->port_state <= LPFC_FDISC || ++ vport->fc_flag & FC_PT2PT) + goto out; + lpfc_linkdown_port(vport); + spin_lock_irq(shost->host_lock); +-- +2.35.1 + diff --git a/queue-5.15/scsi-lpfc-resolve-null-ptr-dereference-after-an-els-.patch b/queue-5.15/scsi-lpfc-resolve-null-ptr-dereference-after-an-els-.patch new file mode 100644 index 00000000000..fc79b642fb5 --- /dev/null +++ b/queue-5.15/scsi-lpfc-resolve-null-ptr-dereference-after-an-els-.patch @@ -0,0 +1,78 @@ +From 735e7cbb8dbfe3db07354a2af4ce3bea9598e293 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Jun 2022 10:43:25 -0700 +Subject: scsi: lpfc: Resolve NULL ptr dereference after an ELS LOGO is aborted + +From: James Smart + +[ Upstream commit b1b3440f437b75fb2a9b0cfe58df461e40eca474 ] + +A use-after-free crash can occur after an ELS LOGO is aborted. + +Specifically, a nodelist structure is freed and then +ndlp->vport->cfg_log_verbose is dereferenced in lpfc_nlp_get() when the +discovery state machine is mistakenly called a second time with +NLP_EVT_DEVICE_RM argument. + +Rework lpfc_cmpl_els_logo() to prevent the duplicate calls to release a +nodelist structure. + +Link: https://lore.kernel.org/r/20220603174329.63777-6-jsmart2021@gmail.com +Co-developed-by: Justin Tee +Signed-off-by: Justin Tee +Signed-off-by: James Smart +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/lpfc/lpfc_els.c | 18 +++++++++--------- + 1 file changed, 9 insertions(+), 9 deletions(-) + +diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c +index ce28c4a30460..5f44a0763f37 100644 +--- a/drivers/scsi/lpfc/lpfc_els.c ++++ b/drivers/scsi/lpfc/lpfc_els.c +@@ -2955,18 +2955,10 @@ lpfc_cmpl_els_logo(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, + spin_unlock_irq(&ndlp->lock); + lpfc_disc_state_machine(vport, ndlp, cmdiocb, + NLP_EVT_DEVICE_RM); +- lpfc_els_free_iocb(phba, cmdiocb); +- lpfc_nlp_put(ndlp); +- +- /* Presume the node was released. */ +- return; ++ goto out_rsrc_free; + } + + out: +- /* Driver is done with the IO. */ +- lpfc_els_free_iocb(phba, cmdiocb); +- lpfc_nlp_put(ndlp); +- + /* At this point, the LOGO processing is complete. NOTE: For a + * pt2pt topology, we are assuming the NPortID will only change + * on link up processing. For a LOGO / PLOGI initiated by the +@@ -2993,6 +2985,10 @@ lpfc_cmpl_els_logo(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, + ndlp->nlp_DID, irsp->ulpStatus, + irsp->un.ulpWord[4], irsp->ulpTimeout, + vport->num_disc_nodes); ++ ++ lpfc_els_free_iocb(phba, cmdiocb); ++ lpfc_nlp_put(ndlp); ++ + lpfc_disc_start(vport); + return; + } +@@ -3009,6 +3005,10 @@ lpfc_cmpl_els_logo(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, + lpfc_disc_state_machine(vport, ndlp, cmdiocb, + NLP_EVT_DEVICE_RM); + } ++out_rsrc_free: ++ /* Driver is done with the I/O. */ ++ lpfc_els_free_iocb(phba, cmdiocb); ++ lpfc_nlp_put(ndlp); + } + + /** +-- +2.35.1 + diff --git a/queue-5.15/scsi-mpt3sas-fix-out-of-bounds-compiler-warning.patch b/queue-5.15/scsi-mpt3sas-fix-out-of-bounds-compiler-warning.patch new file mode 100644 index 00000000000..72b9d9c590c --- /dev/null +++ b/queue-5.15/scsi-mpt3sas-fix-out-of-bounds-compiler-warning.patch @@ -0,0 +1,94 @@ +From 96cf0dd7b7fc3a07f88d15262a18d7b63fa9f4ac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 May 2022 22:09:27 +0200 +Subject: scsi: mpt3sas: Fix out-of-bounds compiler warning +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Helge Deller + +[ Upstream commit 120f1d95efb1cdb6fe023c84e38ba06d8f78cd03 ] + +I'm facing this warning when building for the parisc64 architecture: + +drivers/scsi/mpt3sas/mpt3sas_base.c: In function ‘_base_make_ioc_operational’: +drivers/scsi/mpt3sas/mpt3sas_base.c:5396:40: warning: array subscript ‘Mpi2SasIOUnitPage1_t {aka struct _MPI2_CONFIG_PAGE_SASIOUNIT_1}[0]’ is partly outside array bounds of ‘unsigned char[20]’ [-Warray-bounds] + 5396 | (le16_to_cpu(sas_iounit_pg1->SASWideMaxQueueDepth)) ? +drivers/scsi/mpt3sas/mpt3sas_base.c:5382:26: note: referencing an object of size 20 allocated by ‘kzalloc’ + 5382 | sas_iounit_pg1 = kzalloc(sz, GFP_KERNEL); + | ^~~~~~~~~~~~~~~~~~~~~~~ + +The problem is, that only 20 bytes are allocated with kmalloc(), which is +sufficient to hold the bytes which are needed. Nevertheless, gcc complains +because the whole Mpi2SasIOUnitPage1_t struct is 32 bytes in size and thus +doesn't fit into those 20 bytes. + +This patch simply allocates all 32 bytes (instead of 20) and thus avoids +the warning. There is no functional change introduced by this patch. + +While touching the code I cleaned up to calculation of max_wideport_qd, +max_narrowport_qd and max_sata_qd to make it easier readable. + +Test successfully tested on a HP C8000 PA-RISC workstation with 64-bit +kernel. + +Link: https://lore.kernel.org/r/YpZ197iZdDZSCzrT@p100 +Signed-off-by: Helge Deller +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/mpt3sas/mpt3sas_base.c | 23 ++++++++++++----------- + 1 file changed, 12 insertions(+), 11 deletions(-) + +diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c +index c38e68943205..fafa9fbf3b10 100644 +--- a/drivers/scsi/mpt3sas/mpt3sas_base.c ++++ b/drivers/scsi/mpt3sas/mpt3sas_base.c +@@ -5381,6 +5381,7 @@ static int _base_assign_fw_reported_qd(struct MPT3SAS_ADAPTER *ioc) + Mpi2ConfigReply_t mpi_reply; + Mpi2SasIOUnitPage1_t *sas_iounit_pg1 = NULL; + Mpi26PCIeIOUnitPage1_t pcie_iounit_pg1; ++ u16 depth; + int sz; + int rc = 0; + +@@ -5392,7 +5393,7 @@ static int _base_assign_fw_reported_qd(struct MPT3SAS_ADAPTER *ioc) + goto out; + /* sas iounit page 1 */ + sz = offsetof(Mpi2SasIOUnitPage1_t, PhyData); +- sas_iounit_pg1 = kzalloc(sz, GFP_KERNEL); ++ sas_iounit_pg1 = kzalloc(sizeof(Mpi2SasIOUnitPage1_t), GFP_KERNEL); + if (!sas_iounit_pg1) { + pr_err("%s: failure at %s:%d/%s()!\n", + ioc->name, __FILE__, __LINE__, __func__); +@@ -5405,16 +5406,16 @@ static int _base_assign_fw_reported_qd(struct MPT3SAS_ADAPTER *ioc) + ioc->name, __FILE__, __LINE__, __func__); + goto out; + } +- ioc->max_wideport_qd = +- (le16_to_cpu(sas_iounit_pg1->SASWideMaxQueueDepth)) ? +- le16_to_cpu(sas_iounit_pg1->SASWideMaxQueueDepth) : +- MPT3SAS_SAS_QUEUE_DEPTH; +- ioc->max_narrowport_qd = +- (le16_to_cpu(sas_iounit_pg1->SASNarrowMaxQueueDepth)) ? +- le16_to_cpu(sas_iounit_pg1->SASNarrowMaxQueueDepth) : +- MPT3SAS_SAS_QUEUE_DEPTH; +- ioc->max_sata_qd = (sas_iounit_pg1->SATAMaxQDepth) ? +- sas_iounit_pg1->SATAMaxQDepth : MPT3SAS_SATA_QUEUE_DEPTH; ++ ++ depth = le16_to_cpu(sas_iounit_pg1->SASWideMaxQueueDepth); ++ ioc->max_wideport_qd = (depth ? depth : MPT3SAS_SAS_QUEUE_DEPTH); ++ ++ depth = le16_to_cpu(sas_iounit_pg1->SASNarrowMaxQueueDepth); ++ ioc->max_narrowport_qd = (depth ? depth : MPT3SAS_SAS_QUEUE_DEPTH); ++ ++ depth = sas_iounit_pg1->SATAMaxQDepth; ++ ioc->max_sata_qd = (depth ? depth : MPT3SAS_SATA_QUEUE_DEPTH); ++ + /* pcie iounit page 1 */ + rc = mpt3sas_config_get_pcie_iounit_pg1(ioc, &mpi_reply, + &pcie_iounit_pg1, sizeof(Mpi26PCIeIOUnitPage1_t)); +-- +2.35.1 + diff --git a/queue-5.15/scsi-pmcraid-fix-missing-resource-cleanup-in-error-c.patch b/queue-5.15/scsi-pmcraid-fix-missing-resource-cleanup-in-error-c.patch new file mode 100644 index 00000000000..56b84004fec --- /dev/null +++ b/queue-5.15/scsi-pmcraid-fix-missing-resource-cleanup-in-error-c.patch @@ -0,0 +1,37 @@ +From c9d4da787754db95cadf174b184d6122e424590a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 29 May 2022 23:34:55 +0800 +Subject: scsi: pmcraid: Fix missing resource cleanup in error case + +From: Chengguang Xu + +[ Upstream commit ec1e8adcbdf661c57c395bca342945f4f815add7 ] + +Fix missing resource cleanup (when '(--i) == 0') for error case in +pmcraid_register_interrupt_handler(). + +Link: https://lore.kernel.org/r/20220529153456.4183738-6-cgxu519@mykernel.net +Reviewed-by: Dan Carpenter +Signed-off-by: Chengguang Xu +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/pmcraid.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/pmcraid.c b/drivers/scsi/pmcraid.c +index bffd9a9349e7..9660c4f4de40 100644 +--- a/drivers/scsi/pmcraid.c ++++ b/drivers/scsi/pmcraid.c +@@ -4526,7 +4526,7 @@ pmcraid_register_interrupt_handler(struct pmcraid_instance *pinstance) + return 0; + + out_unwind: +- while (--i > 0) ++ while (--i >= 0) + free_irq(pci_irq_vector(pdev, i), &pinstance->hrrq_vector[i]); + pci_free_irq_vectors(pdev); + return rc; +-- +2.35.1 + diff --git a/queue-5.15/scsi-vmw_pvscsi-expand-vcpuhint-to-16-bits.patch b/queue-5.15/scsi-vmw_pvscsi-expand-vcpuhint-to-16-bits.patch new file mode 100644 index 00000000000..520e41c4bca --- /dev/null +++ b/queue-5.15/scsi-vmw_pvscsi-expand-vcpuhint-to-16-bits.patch @@ -0,0 +1,40 @@ +From 9e7a479d5828e3239a4862fdd71ecdccd894cbd2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Jun 2022 08:57:00 +0000 +Subject: scsi: vmw_pvscsi: Expand vcpuHint to 16 bits + +From: Wentao Wang + +[ Upstream commit cf71d59c2eceadfcde0fb52e237990a0909880d7 ] + +vcpuHint has been expanded to 16 bit on host to enable routing to more +CPUs. Guest side should align with the change. This change has been tested +with hosts with 8-bit and 16-bit vcpuHint, on both platforms host side can +get correct value. + +Link: https://lore.kernel.org/r/EF35F4D5-5DCC-42C5-BCC4-29DF1729B24C@vmware.com +Signed-off-by: Wentao Wang +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/vmw_pvscsi.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/vmw_pvscsi.h b/drivers/scsi/vmw_pvscsi.h +index 51a82f7803d3..9d16cf925483 100644 +--- a/drivers/scsi/vmw_pvscsi.h ++++ b/drivers/scsi/vmw_pvscsi.h +@@ -331,8 +331,8 @@ struct PVSCSIRingReqDesc { + u8 tag; + u8 bus; + u8 target; +- u8 vcpuHint; +- u8 unused[59]; ++ u16 vcpuHint; ++ u8 unused[58]; + } __packed; + + /* +-- +2.35.1 + diff --git a/queue-5.15/series b/queue-5.15/series index 1909e677826..0943f39fd77 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -2,3 +2,43 @@ revert-drm-amd-display-fix-dcn3-b0-dp-alt-mapping.patch nfsd-replace-use-of-rwsem-with-errseq_t.patch arm64-dts-imx8mm-beacon-enable-rts-cts-on-uart3.patch arm64-dts-imx8mn-beacon-enable-rts-cts-on-uart3.patch +powerpc-kasan-silence-kasan-warnings-in-__get_wchan.patch +asoc-nau8822-add-operation-for-internal-pll-off-and-.patch +drm-amd-display-read-golden-settings-table-from-vbio.patch +drm-amd-display-fix-dmub-outbox-trace-in-s4-4465.patch +drm-amdkfd-use-mmget_not_zero-in-mmu-notifier.patch +dma-debug-make-things-less-spammy-under-memory-press.patch +asoc-cs42l52-fix-tlv-scales-for-mixer-controls.patch +asoc-cs35l36-update-digital-volume-tlv.patch +asoc-cs53l30-correct-number-of-volume-levels-on-sx-c.patch +asoc-cs42l52-correct-tlv-for-bypass-volume.patch +asoc-cs42l56-correct-typo-in-minimum-level-for-sx-vo.patch +asoc-cs42l51-correct-minimum-value-for-sx-volume-con.patch +drm-amdkfd-add-pinned-bos-to-kfd_bo_list.patch +ata-libata-core-fix-null-pointer-deref-in-ata_host_a.patch +quota-prevent-memory-allocation-recursion-while-hold.patch +asoc-wm8962-fix-suspend-while-playing-music.patch +asoc-es8328-fix-event-generation-for-deemphasis-cont.patch +asoc-wm_adsp-fix-event-generation-for-wm_adsp_fw_put.patch +input-soc_button_array-also-add-lenovo-yoga-tablet2-.patch +scsi-vmw_pvscsi-expand-vcpuhint-to-16-bits.patch +scsi-lpfc-resolve-null-ptr-dereference-after-an-els-.patch +scsi-lpfc-fix-port-stuck-in-bypassed-state-after-lip.patch +scsi-lpfc-allow-reduced-polling-rate-for-nvme_admin_.patch +scsi-mpt3sas-fix-out-of-bounds-compiler-warning.patch +scsi-ipr-fix-missing-incorrect-resource-cleanup-in-e.patch +scsi-pmcraid-fix-missing-resource-cleanup-in-error-c.patch +alsa-hda-realtek-add-hw8326-support.patch +virtio-mmio-fix-missing-put_device-when-vm_cmdline_p.patch +nfc-nfcmrvl-fix-memory-leak-in-nfcmrvl_play_deferred.patch +ipv6-fix-signed-integer-overflow-in-l2tp_ip6_sendmsg.patch +net-ethernet-mtk_eth_soc-fix-misuse-of-mem-alloc-int.patch +gcc-12-disable-wdangling-pointer-warning-for-now.patch +mellanox-mlx5-avoid-uninitialized-variable-warning-w.patch +netfs-gcc-12-temporarily-disable-wattribute-warning-.patch +mips-loongson-3-fix-compile-mips-cpu_hwmon-as-module.patch +random-credit-cpu-and-bootloader-seeds-by-default.patch +gpio-dwapb-don-t-print-error-on-eprobe_defer.patch +platform-x86-gigabyte-wmi-add-z690m-aorus-elite-ax-d.patch +platform-x86-gigabyte-wmi-add-support-for-b450m-ds3h.patch +platform-x86-intel-hid-add-surface-go-to-vgbs-allow-.patch diff --git a/queue-5.15/virtio-mmio-fix-missing-put_device-when-vm_cmdline_p.patch b/queue-5.15/virtio-mmio-fix-missing-put_device-when-vm_cmdline_p.patch new file mode 100644 index 00000000000..df4a76f4e80 --- /dev/null +++ b/queue-5.15/virtio-mmio-fix-missing-put_device-when-vm_cmdline_p.patch @@ -0,0 +1,37 @@ +From 2f324a9e0128106351f84965ad98911abae79f9f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Jun 2022 08:55:42 +0800 +Subject: virtio-mmio: fix missing put_device() when vm_cmdline_parent + registration failed + +From: chengkaitao + +[ Upstream commit a58a7f97ba11391d2d0d408e0b24f38d86ae748e ] + +The reference must be released when device_register(&vm_cmdline_parent) +failed. Add the corresponding 'put_device()' in the error handling path. + +Signed-off-by: chengkaitao +Message-Id: <20220602005542.16489-1-chengkaitao@didiglobal.com> +Signed-off-by: Michael S. Tsirkin +Acked-by: Jason Wang +Signed-off-by: Sasha Levin +--- + drivers/virtio/virtio_mmio.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/virtio/virtio_mmio.c b/drivers/virtio/virtio_mmio.c +index 56128b9c46eb..1dd396d4bebb 100644 +--- a/drivers/virtio/virtio_mmio.c ++++ b/drivers/virtio/virtio_mmio.c +@@ -688,6 +688,7 @@ static int vm_cmdline_set(const char *device, + if (!vm_cmdline_parent_registered) { + err = device_register(&vm_cmdline_parent); + if (err) { ++ put_device(&vm_cmdline_parent); + pr_err("Failed to register parent device!\n"); + return err; + } +-- +2.35.1 + -- 2.47.3