From ec13a1924eab6da8717ea839d29e92b3b5f73909 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 16 May 2022 10:23:39 +0200 Subject: [PATCH] 5.15-stable patches added patches: arm-memremap-don-t-abuse-pfn_valid-to-ensure-presence-of-linear-map.patch ceph-fix-setting-of-xattrs-on-async-created-inodes.patch cgroup-cpuset-remove-cpus_allowed-mems_allowed-setup-in-cpuset_init_smp.patch drm-nouveau-tegra-stop-using-iommu_present.patch drm-vmwgfx-disable-command-buffers-on-svga3-without-gbobjects.patch fsl_lpuart-don-t-enable-interrupts-too-early.patch i40e-i40e_main-fix-a-missing-check-on-list-iterator.patch mm-huge_memory-do-not-overkill-when-splitting-huge_zero_page.patch net-atlantic-always-deep-reset-on-pm-op-fixing-up-my-null-deref-regression.patch net-phy-fix-race-condition-on-link-status-change.patch net-phy-micrel-do-not-use-kszphy_suspend-resume-for-ksz8061.patch net-phy-micrel-pass-.probe-for-ks8737.patch revert-mm-memory-failure.c-skip-huge_zero_page-in-memory_failure.patch serial-8250_mtk-fix-register-address-for-xon-xoff-character.patch serial-8250_mtk-fix-uart_efr-register-address.patch serial-8250_mtk-make-sure-to-select-the-right-feature_sel.patch slimbus-qcom-fix-irq-check-in-qcom_slim_probe.patch sunrpc-ensure-that-the-gssproxy-client-can-start-in-a-connected-state.patch usb-serial-option-add-fibocom-l610-modem.patch usb-serial-option-add-fibocom-ma510-modem.patch usb-serial-pl2303-add-device-id-for-hp-lm930-display.patch usb-serial-qcserial-add-support-for-sierra-wireless-em7590.patch usb-typec-tcpci-don-t-skip-cleanup-in-.remove-on-error.patch usb-typec-tcpci_mt6360-update-for-bmc-phy-setting.patch writeback-avoid-skipping-inode-writeback.patch --- ...lid-to-ensure-presence-of-linear-map.patch | 117 +++++++++++++++ ...ng-of-xattrs-on-async-created-inodes.patch | 62 ++++++++ ...ems_allowed-setup-in-cpuset_init_smp.patch | 73 +++++++++ ...uveau-tegra-stop-using-iommu_present.patch | 35 +++++ ...d-buffers-on-svga3-without-gbobjects.patch | 51 +++++++ ...rt-don-t-enable-interrupts-too-early.patch | 72 +++++++++ ...fix-a-missing-check-on-list-iterator.patch | 92 ++++++++++++ ...erkill-when-splitting-huge_zero_page.patch | 94 ++++++++++++ ...p-fixing-up-my-null-deref-regression.patch | 62 ++++++++ ...race-condition-on-link-status-change.patch | 99 ++++++++++++ ...se-kszphy_suspend-resume-for-ksz8061.patch | 62 ++++++++ ...et-phy-micrel-pass-.probe-for-ks8737.patch | 41 +++++ ...kip-huge_zero_page-in-memory_failure.patch | 83 +++++++++++ ...ister-address-for-xon-xoff-character.patch | 44 ++++++ ...50_mtk-fix-uart_efr-register-address.patch | 92 ++++++++++++ ...sure-to-select-the-right-feature_sel.patch | 44 ++++++ queue-5.15/series | 25 ++++ ...com-fix-irq-check-in-qcom_slim_probe.patch | 43 ++++++ ...lient-can-start-in-a-connected-state.patch | 106 +++++++++++++ ...serial-option-add-fibocom-l610-modem.patch | 141 ++++++++++++++++++ ...erial-option-add-fibocom-ma510-modem.patch | 117 +++++++++++++++ ...3-add-device-id-for-hp-lm930-display.patch | 41 +++++ ...d-support-for-sierra-wireless-em7590.patch | 31 ++++ ...n-t-skip-cleanup-in-.remove-on-error.patch | 53 +++++++ ...ci_mt6360-update-for-bmc-phy-setting.patch | 106 +++++++++++++ ...eback-avoid-skipping-inode-writeback.patch | 68 +++++++++ 26 files changed, 1854 insertions(+) create mode 100644 queue-5.15/arm-memremap-don-t-abuse-pfn_valid-to-ensure-presence-of-linear-map.patch create mode 100644 queue-5.15/ceph-fix-setting-of-xattrs-on-async-created-inodes.patch create mode 100644 queue-5.15/cgroup-cpuset-remove-cpus_allowed-mems_allowed-setup-in-cpuset_init_smp.patch create mode 100644 queue-5.15/drm-nouveau-tegra-stop-using-iommu_present.patch create mode 100644 queue-5.15/drm-vmwgfx-disable-command-buffers-on-svga3-without-gbobjects.patch create mode 100644 queue-5.15/fsl_lpuart-don-t-enable-interrupts-too-early.patch create mode 100644 queue-5.15/i40e-i40e_main-fix-a-missing-check-on-list-iterator.patch create mode 100644 queue-5.15/mm-huge_memory-do-not-overkill-when-splitting-huge_zero_page.patch create mode 100644 queue-5.15/net-atlantic-always-deep-reset-on-pm-op-fixing-up-my-null-deref-regression.patch create mode 100644 queue-5.15/net-phy-fix-race-condition-on-link-status-change.patch create mode 100644 queue-5.15/net-phy-micrel-do-not-use-kszphy_suspend-resume-for-ksz8061.patch create mode 100644 queue-5.15/net-phy-micrel-pass-.probe-for-ks8737.patch create mode 100644 queue-5.15/revert-mm-memory-failure.c-skip-huge_zero_page-in-memory_failure.patch create mode 100644 queue-5.15/serial-8250_mtk-fix-register-address-for-xon-xoff-character.patch create mode 100644 queue-5.15/serial-8250_mtk-fix-uart_efr-register-address.patch create mode 100644 queue-5.15/serial-8250_mtk-make-sure-to-select-the-right-feature_sel.patch create mode 100644 queue-5.15/slimbus-qcom-fix-irq-check-in-qcom_slim_probe.patch create mode 100644 queue-5.15/sunrpc-ensure-that-the-gssproxy-client-can-start-in-a-connected-state.patch create mode 100644 queue-5.15/usb-serial-option-add-fibocom-l610-modem.patch create mode 100644 queue-5.15/usb-serial-option-add-fibocom-ma510-modem.patch create mode 100644 queue-5.15/usb-serial-pl2303-add-device-id-for-hp-lm930-display.patch create mode 100644 queue-5.15/usb-serial-qcserial-add-support-for-sierra-wireless-em7590.patch create mode 100644 queue-5.15/usb-typec-tcpci-don-t-skip-cleanup-in-.remove-on-error.patch create mode 100644 queue-5.15/usb-typec-tcpci_mt6360-update-for-bmc-phy-setting.patch create mode 100644 queue-5.15/writeback-avoid-skipping-inode-writeback.patch diff --git a/queue-5.15/arm-memremap-don-t-abuse-pfn_valid-to-ensure-presence-of-linear-map.patch b/queue-5.15/arm-memremap-don-t-abuse-pfn_valid-to-ensure-presence-of-linear-map.patch new file mode 100644 index 00000000000..ca526bda47f --- /dev/null +++ b/queue-5.15/arm-memremap-don-t-abuse-pfn_valid-to-ensure-presence-of-linear-map.patch @@ -0,0 +1,117 @@ +From 260364d112bc822005224667c0c9b1b17a53eafd Mon Sep 17 00:00:00 2001 +From: Mike Rapoport +Date: Mon, 9 May 2022 17:34:28 -0700 +Subject: arm[64]/memremap: don't abuse pfn_valid() to ensure presence of linear map + +From: Mike Rapoport + +commit 260364d112bc822005224667c0c9b1b17a53eafd upstream. + +The semantics of pfn_valid() is to check presence of the memory map for a +PFN and not whether a PFN is covered by the linear map. The memory map +may be present for NOMAP memory regions, but they won't be mapped in the +linear mapping. Accessing such regions via __va() when they are +memremap()'ed will cause a crash. + +On v5.4.y the crash happens on qemu-arm with UEFI [1]: + +<1>[ 0.084476] 8<--- cut here --- +<1>[ 0.084595] Unable to handle kernel paging request at virtual address dfb76000 +<1>[ 0.084938] pgd = (ptrval) +<1>[ 0.085038] [dfb76000] *pgd=5f7fe801, *pte=00000000, *ppte=00000000 + +... + +<4>[ 0.093923] [] (memcpy) from [] (dmi_setup+0x60/0x418) +<4>[ 0.094204] [] (dmi_setup) from [] (arm_dmi_init+0x8/0x10) +<4>[ 0.094408] [] (arm_dmi_init) from [] (do_one_initcall+0x50/0x228) +<4>[ 0.094619] [] (do_one_initcall) from [] (kernel_init_freeable+0x15c/0x1f8) +<4>[ 0.094841] [] (kernel_init_freeable) from [] (kernel_init+0x8/0x10c) +<4>[ 0.095057] [] (kernel_init) from [] (ret_from_fork+0x14/0x2c) + +On kernels v5.10.y and newer the same crash won't reproduce on ARM because +commit b10d6bca8720 ("arch, drivers: replace for_each_membock() with +for_each_mem_range()") changed the way memory regions are registered in +the resource tree, but that merely covers up the problem. + +On ARM64 memory resources registered in yet another way and there the +issue of wrong usage of pfn_valid() to ensure availability of the linear +map is also covered. + +Implement arch_memremap_can_ram_remap() on ARM and ARM64 to prevent access +to NOMAP regions via the linear mapping in memremap(). + +Link: https://lore.kernel.org/all/Yl65zxGgFzF1Okac@sirena.org.uk +Link: https://lkml.kernel.org/r/20220426060107.7618-1-rppt@kernel.org +Signed-off-by: Mike Rapoport +Reported-by: "kernelci.org bot" +Tested-by: Mark Brown +Reviewed-by: Ard Biesheuvel +Acked-by: Catalin Marinas +Cc: Greg Kroah-Hartman +Cc: Mark Brown +Cc: Mark-PK Tsai +Cc: Russell King +Cc: Tony Lindgren +Cc: Will Deacon +Cc: [5.4+] +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/include/asm/io.h | 3 +++ + arch/arm/mm/ioremap.c | 8 ++++++++ + arch/arm64/include/asm/io.h | 4 ++++ + arch/arm64/mm/ioremap.c | 8 ++++++++ + 4 files changed, 23 insertions(+) + +--- a/arch/arm/include/asm/io.h ++++ b/arch/arm/include/asm/io.h +@@ -436,6 +436,9 @@ extern void pci_iounmap(struct pci_dev * + #define ARCH_HAS_VALID_PHYS_ADDR_RANGE + extern int valid_phys_addr_range(phys_addr_t addr, size_t size); + extern int valid_mmap_phys_addr_range(unsigned long pfn, size_t size); ++extern bool arch_memremap_can_ram_remap(resource_size_t offset, size_t size, ++ unsigned long flags); ++#define arch_memremap_can_ram_remap arch_memremap_can_ram_remap + #endif + + /* +--- a/arch/arm/mm/ioremap.c ++++ b/arch/arm/mm/ioremap.c +@@ -479,3 +479,11 @@ void __init early_ioremap_init(void) + { + early_ioremap_setup(); + } ++ ++bool arch_memremap_can_ram_remap(resource_size_t offset, size_t size, ++ unsigned long flags) ++{ ++ unsigned long pfn = PHYS_PFN(offset); ++ ++ return memblock_is_map_memory(pfn); ++} +--- a/arch/arm64/include/asm/io.h ++++ b/arch/arm64/include/asm/io.h +@@ -192,4 +192,8 @@ extern void __iomem *ioremap_cache(phys_ + extern int valid_phys_addr_range(phys_addr_t addr, size_t size); + extern int valid_mmap_phys_addr_range(unsigned long pfn, size_t size); + ++extern bool arch_memremap_can_ram_remap(resource_size_t offset, size_t size, ++ unsigned long flags); ++#define arch_memremap_can_ram_remap arch_memremap_can_ram_remap ++ + #endif /* __ASM_IO_H */ +--- a/arch/arm64/mm/ioremap.c ++++ b/arch/arm64/mm/ioremap.c +@@ -99,3 +99,11 @@ void __init early_ioremap_init(void) + { + early_ioremap_setup(); + } ++ ++bool arch_memremap_can_ram_remap(resource_size_t offset, size_t size, ++ unsigned long flags) ++{ ++ unsigned long pfn = PHYS_PFN(offset); ++ ++ return pfn_is_map_memory(pfn); ++} diff --git a/queue-5.15/ceph-fix-setting-of-xattrs-on-async-created-inodes.patch b/queue-5.15/ceph-fix-setting-of-xattrs-on-async-created-inodes.patch new file mode 100644 index 00000000000..5b818cbc4ee --- /dev/null +++ b/queue-5.15/ceph-fix-setting-of-xattrs-on-async-created-inodes.patch @@ -0,0 +1,62 @@ +From 620239d9a32e9fe27c9204ec11e40058671aeeb6 Mon Sep 17 00:00:00 2001 +From: Jeff Layton +Date: Mon, 25 Apr 2022 15:54:27 -0400 +Subject: ceph: fix setting of xattrs on async created inodes + +From: Jeff Layton + +commit 620239d9a32e9fe27c9204ec11e40058671aeeb6 upstream. + +Currently when we create a file, we spin up an xattr buffer to send +along with the create request. If we end up doing an async create +however, then we currently pass down a zero-length xattr buffer. + +Fix the code to send down the xattr buffer in req->r_pagelist. If the +xattrs span more than a page, however give up and don't try to do an +async create. + +Cc: stable@vger.kernel.org +URL: https://bugzilla.redhat.com/show_bug.cgi?id=2063929 +Fixes: 9a8d03ca2e2c ("ceph: attempt to do async create when possible") +Reported-by: John Fortin +Reported-by: Sri Ramanujam +Signed-off-by: Jeff Layton +Reviewed-by: Xiubo Li +Signed-off-by: Ilya Dryomov +Signed-off-by: Greg Kroah-Hartman +--- + fs/ceph/file.c | 16 +++++++++++++--- + 1 file changed, 13 insertions(+), 3 deletions(-) + +--- a/fs/ceph/file.c ++++ b/fs/ceph/file.c +@@ -592,9 +592,15 @@ static int ceph_finish_async_create(stru + iinfo.change_attr = 1; + ceph_encode_timespec64(&iinfo.btime, &now); + +- iinfo.xattr_len = ARRAY_SIZE(xattr_buf); +- iinfo.xattr_data = xattr_buf; +- memset(iinfo.xattr_data, 0, iinfo.xattr_len); ++ if (req->r_pagelist) { ++ iinfo.xattr_len = req->r_pagelist->length; ++ iinfo.xattr_data = req->r_pagelist->mapped_tail; ++ } else { ++ /* fake it */ ++ iinfo.xattr_len = ARRAY_SIZE(xattr_buf); ++ iinfo.xattr_data = xattr_buf; ++ memset(iinfo.xattr_data, 0, iinfo.xattr_len); ++ } + + in.ino = cpu_to_le64(vino.ino); + in.snapid = cpu_to_le64(CEPH_NOSNAP); +@@ -706,6 +712,10 @@ int ceph_atomic_open(struct inode *dir, + err = ceph_security_init_secctx(dentry, mode, &as_ctx); + if (err < 0) + goto out_ctx; ++ /* Async create can't handle more than a page of xattrs */ ++ if (as_ctx.pagelist && ++ !list_is_singular(&as_ctx.pagelist->head)) ++ try_async = false; + } else if (!d_in_lookup(dentry)) { + /* If it's not being looked up, it's negative */ + return -ENOENT; diff --git a/queue-5.15/cgroup-cpuset-remove-cpus_allowed-mems_allowed-setup-in-cpuset_init_smp.patch b/queue-5.15/cgroup-cpuset-remove-cpus_allowed-mems_allowed-setup-in-cpuset_init_smp.patch new file mode 100644 index 00000000000..a664484160a --- /dev/null +++ b/queue-5.15/cgroup-cpuset-remove-cpus_allowed-mems_allowed-setup-in-cpuset_init_smp.patch @@ -0,0 +1,73 @@ +From 2685027fca387b602ae565bff17895188b803988 Mon Sep 17 00:00:00 2001 +From: Waiman Long +Date: Wed, 27 Apr 2022 10:54:28 -0400 +Subject: cgroup/cpuset: Remove cpus_allowed/mems_allowed setup in cpuset_init_smp() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Waiman Long + +commit 2685027fca387b602ae565bff17895188b803988 upstream. + +There are 3 places where the cpu and node masks of the top cpuset can +be initialized in the order they are executed: + 1) start_kernel -> cpuset_init() + 2) start_kernel -> cgroup_init() -> cpuset_bind() + 3) kernel_init_freeable() -> do_basic_setup() -> cpuset_init_smp() + +The first cpuset_init() call just sets all the bits in the masks. +The second cpuset_bind() call sets cpus_allowed and mems_allowed to the +default v2 values. The third cpuset_init_smp() call sets them back to +v1 values. + +For systems with cgroup v2 setup, cpuset_bind() is called once. As a +result, cpu and memory node hot add may fail to update the cpu and node +masks of the top cpuset to include the newly added cpu or node in a +cgroup v2 environment. + +For systems with cgroup v1 setup, cpuset_bind() is called again by +rebind_subsystem() when the v1 cpuset filesystem is mounted as shown +in the dmesg log below with an instrumented kernel. + + [ 2.609781] cpuset_bind() called - v2 = 1 + [ 3.079473] cpuset_init_smp() called + [ 7.103710] cpuset_bind() called - v2 = 0 + +smp_init() is called after the first two init functions. So we don't +have a complete list of active cpus and memory nodes until later in +cpuset_init_smp() which is the right time to set up effective_cpus +and effective_mems. + +To fix this cgroup v2 mask setup problem, the potentially incorrect +cpus_allowed & mems_allowed setting in cpuset_init_smp() are removed. +For cgroup v2 systems, the initial cpuset_bind() call will set the masks +correctly. For cgroup v1 systems, the second call to cpuset_bind() +will do the right setup. + +cc: stable@vger.kernel.org +Signed-off-by: Waiman Long +Tested-by: Feng Tang +Reviewed-by: Michal Koutný +Signed-off-by: Tejun Heo +Signed-off-by: Greg Kroah-Hartman +--- + kernel/cgroup/cpuset.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/kernel/cgroup/cpuset.c ++++ b/kernel/cgroup/cpuset.c +@@ -3347,8 +3347,11 @@ static struct notifier_block cpuset_trac + */ + void __init cpuset_init_smp(void) + { +- cpumask_copy(top_cpuset.cpus_allowed, cpu_active_mask); +- top_cpuset.mems_allowed = node_states[N_MEMORY]; ++ /* ++ * cpus_allowd/mems_allowed set to v2 values in the initial ++ * cpuset_bind() call will be reset to v1 values in another ++ * cpuset_bind() call when v1 cpuset is mounted. ++ */ + top_cpuset.old_mems_allowed = top_cpuset.mems_allowed; + + cpumask_copy(top_cpuset.effective_cpus, cpu_active_mask); diff --git a/queue-5.15/drm-nouveau-tegra-stop-using-iommu_present.patch b/queue-5.15/drm-nouveau-tegra-stop-using-iommu_present.patch new file mode 100644 index 00000000000..209d6b7ee77 --- /dev/null +++ b/queue-5.15/drm-nouveau-tegra-stop-using-iommu_present.patch @@ -0,0 +1,35 @@ +From 87fd2b091fb33871a7f812658a0971e8e26f903f Mon Sep 17 00:00:00 2001 +From: Robin Murphy +Date: Tue, 5 Apr 2022 15:21:34 +0100 +Subject: drm/nouveau/tegra: Stop using iommu_present() + +From: Robin Murphy + +commit 87fd2b091fb33871a7f812658a0971e8e26f903f upstream. + +Even if some IOMMU has registered itself on the platform "bus", that +doesn't necessarily mean it provides translation for the device we +care about. Replace iommu_present() with a more appropriate check. + +Signed-off-by: Robin Murphy +Reviewed-by: Lyude Paul +[added cc for stable] +Signed-off-by: Lyude Paul +Cc: stable@vger.kernel.org # v5.0+ +Link: https://patchwork.freedesktop.org/patch/msgid/70d40ea441da3663c2824d54102b471e9a621f8a.1649168494.git.robin.murphy@arm.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/nouveau/nvkm/engine/device/tegra.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/nouveau/nvkm/engine/device/tegra.c ++++ b/drivers/gpu/drm/nouveau/nvkm/engine/device/tegra.c +@@ -123,7 +123,7 @@ nvkm_device_tegra_probe_iommu(struct nvk + + mutex_init(&tdev->iommu.mutex); + +- if (iommu_present(&platform_bus_type)) { ++ if (device_iommu_mapped(dev)) { + tdev->iommu.domain = iommu_domain_alloc(&platform_bus_type); + if (!tdev->iommu.domain) + goto error; diff --git a/queue-5.15/drm-vmwgfx-disable-command-buffers-on-svga3-without-gbobjects.patch b/queue-5.15/drm-vmwgfx-disable-command-buffers-on-svga3-without-gbobjects.patch new file mode 100644 index 00000000000..91a64303e8d --- /dev/null +++ b/queue-5.15/drm-vmwgfx-disable-command-buffers-on-svga3-without-gbobjects.patch @@ -0,0 +1,51 @@ +From 21d1d192890ced87f2f04f8f4dea92406e0b162a Mon Sep 17 00:00:00 2001 +From: Zack Rusin +Date: Fri, 18 Mar 2022 13:43:31 -0400 +Subject: drm/vmwgfx: Disable command buffers on svga3 without gbobjects + +From: Zack Rusin + +commit 21d1d192890ced87f2f04f8f4dea92406e0b162a upstream. + +With very limited vram on svga3 it's difficult to handle all the surface +migrations. Without gbobjects, i.e. the ability to store surfaces in +guest mobs, there's no reason to support intermediate svga2 features, +especially because we can fall back to fb traces and svga3 will never +support those in-between features. + +On svga3 we wither want to use fb traces or screen targets +(i.e. gbobjects), nothing in between. This fixes presentation on a lot +of fusion/esxi tech previews where the exposed svga3 caps haven't been +finalized yet. + +Signed-off-by: Zack Rusin +Fixes: 2cd80dbd3551 ("drm/vmwgfx: Add basic support for SVGA3") +Cc: # v5.14+ +Reviewed-by: Martin Krastev +Link: https://patchwork.freedesktop.org/patch/msgid/20220318174332.440068-5-zack@kde.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/vmwgfx/vmwgfx_cmd.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_cmd.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_cmd.c +@@ -675,11 +675,14 @@ int vmw_cmd_emit_dummy_query(struct vmw_ + */ + bool vmw_cmd_supported(struct vmw_private *vmw) + { +- if ((vmw->capabilities & (SVGA_CAP_COMMAND_BUFFERS | +- SVGA_CAP_CMD_BUFFERS_2)) != 0) +- return true; ++ bool has_cmdbufs = ++ (vmw->capabilities & (SVGA_CAP_COMMAND_BUFFERS | ++ SVGA_CAP_CMD_BUFFERS_2)) != 0; ++ if (vmw_is_svga_v3(vmw)) ++ return (has_cmdbufs && ++ (vmw->capabilities & SVGA_CAP_GBOBJECTS) != 0); + /* + * We have FIFO cmd's + */ +- return vmw->fifo_mem != NULL; ++ return has_cmdbufs || vmw->fifo_mem != NULL; + } diff --git a/queue-5.15/fsl_lpuart-don-t-enable-interrupts-too-early.patch b/queue-5.15/fsl_lpuart-don-t-enable-interrupts-too-early.patch new file mode 100644 index 00000000000..e5a0d14d4f9 --- /dev/null +++ b/queue-5.15/fsl_lpuart-don-t-enable-interrupts-too-early.patch @@ -0,0 +1,72 @@ +From 401fb66a355eb0f22096cf26864324f8e63c7d78 Mon Sep 17 00:00:00 2001 +From: Indan Zupancic +Date: Thu, 5 May 2022 13:47:50 +0200 +Subject: fsl_lpuart: Don't enable interrupts too early + +From: Indan Zupancic + +commit 401fb66a355eb0f22096cf26864324f8e63c7d78 upstream. + +If an irq is pending when devm_request_irq() is called, the irq +handler will cause a NULL pointer access because initialisation +is not done yet. + +Fixes: 9d7ee0e28da59 ("tty: serial: lpuart: avoid report NULL interrupt") +Cc: stable +Signed-off-by: Indan Zupancic +Link: https://lore.kernel.org/r/20220505114750.45423-1-Indan.Zupancic@mep-info.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/serial/fsl_lpuart.c | 18 +++++++++--------- + 1 file changed, 9 insertions(+), 9 deletions(-) + +--- a/drivers/tty/serial/fsl_lpuart.c ++++ b/drivers/tty/serial/fsl_lpuart.c +@@ -2650,6 +2650,7 @@ static int lpuart_probe(struct platform_ + struct device_node *np = pdev->dev.of_node; + struct lpuart_port *sport; + struct resource *res; ++ irq_handler_t handler; + int ret; + + sport = devm_kzalloc(&pdev->dev, sizeof(*sport), GFP_KERNEL); +@@ -2727,17 +2728,11 @@ static int lpuart_probe(struct platform_ + + if (lpuart_is_32(sport)) { + lpuart_reg.cons = LPUART32_CONSOLE; +- ret = devm_request_irq(&pdev->dev, sport->port.irq, lpuart32_int, 0, +- DRIVER_NAME, sport); ++ handler = lpuart32_int; + } else { + lpuart_reg.cons = LPUART_CONSOLE; +- ret = devm_request_irq(&pdev->dev, sport->port.irq, lpuart_int, 0, +- DRIVER_NAME, sport); ++ handler = lpuart_int; + } +- +- if (ret) +- goto failed_irq_request; +- + ret = uart_add_one_port(&lpuart_reg, &sport->port); + if (ret) + goto failed_attach_port; +@@ -2759,13 +2754,18 @@ static int lpuart_probe(struct platform_ + + sport->port.rs485_config(&sport->port, &sport->port.rs485); + ++ ret = devm_request_irq(&pdev->dev, sport->port.irq, handler, 0, ++ DRIVER_NAME, sport); ++ if (ret) ++ goto failed_irq_request; ++ + return 0; + ++failed_irq_request: + failed_get_rs485: + failed_reset: + uart_remove_one_port(&lpuart_reg, &sport->port); + failed_attach_port: +-failed_irq_request: + lpuart_disable_clks(sport); + failed_clock_enable: + failed_out_of_range: diff --git a/queue-5.15/i40e-i40e_main-fix-a-missing-check-on-list-iterator.patch b/queue-5.15/i40e-i40e_main-fix-a-missing-check-on-list-iterator.patch new file mode 100644 index 00000000000..2104cf661cb --- /dev/null +++ b/queue-5.15/i40e-i40e_main-fix-a-missing-check-on-list-iterator.patch @@ -0,0 +1,92 @@ +From 3f95a7472d14abef284d8968734fe2ae7ff4845f Mon Sep 17 00:00:00 2001 +From: Xiaomeng Tong +Date: Tue, 10 May 2022 13:48:46 -0700 +Subject: i40e: i40e_main: fix a missing check on list iterator + +From: Xiaomeng Tong + +commit 3f95a7472d14abef284d8968734fe2ae7ff4845f upstream. + +The bug is here: + ret = i40e_add_macvlan_filter(hw, ch->seid, vdev->dev_addr, &aq_err); + +The list iterator 'ch' will point to a bogus position containing +HEAD if the list is empty or no element is found. This case must +be checked before any use of the iterator, otherwise it will +lead to a invalid memory access. + +To fix this bug, use a new variable 'iter' as the list iterator, +while use the origin variable 'ch' as a dedicated pointer to +point to the found element. + +Cc: stable@vger.kernel.org +Fixes: 1d8d80b4e4ff6 ("i40e: Add macvlan support on i40e") +Signed-off-by: Xiaomeng Tong +Tested-by: Gurucharan (A Contingent worker at Intel) +Signed-off-by: Tony Nguyen +Link: https://lore.kernel.org/r/20220510204846.2166999-1-anthony.l.nguyen@intel.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/i40e/i40e_main.c | 27 ++++++++++++++------------- + 1 file changed, 14 insertions(+), 13 deletions(-) + +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -7535,42 +7535,43 @@ static void i40e_free_macvlan_channels(s + static int i40e_fwd_ring_up(struct i40e_vsi *vsi, struct net_device *vdev, + struct i40e_fwd_adapter *fwd) + { ++ struct i40e_channel *ch = NULL, *ch_tmp, *iter; + int ret = 0, num_tc = 1, i, aq_err; +- struct i40e_channel *ch, *ch_tmp; + struct i40e_pf *pf = vsi->back; + struct i40e_hw *hw = &pf->hw; + +- if (list_empty(&vsi->macvlan_list)) +- return -EINVAL; +- + /* Go through the list and find an available channel */ +- list_for_each_entry_safe(ch, ch_tmp, &vsi->macvlan_list, list) { +- if (!i40e_is_channel_macvlan(ch)) { +- ch->fwd = fwd; ++ list_for_each_entry_safe(iter, ch_tmp, &vsi->macvlan_list, list) { ++ if (!i40e_is_channel_macvlan(iter)) { ++ iter->fwd = fwd; + /* record configuration for macvlan interface in vdev */ + for (i = 0; i < num_tc; i++) + netdev_bind_sb_channel_queue(vsi->netdev, vdev, + i, +- ch->num_queue_pairs, +- ch->base_queue); +- for (i = 0; i < ch->num_queue_pairs; i++) { ++ iter->num_queue_pairs, ++ iter->base_queue); ++ for (i = 0; i < iter->num_queue_pairs; i++) { + struct i40e_ring *tx_ring, *rx_ring; + u16 pf_q; + +- pf_q = ch->base_queue + i; ++ pf_q = iter->base_queue + i; + + /* Get to TX ring ptr */ + tx_ring = vsi->tx_rings[pf_q]; +- tx_ring->ch = ch; ++ tx_ring->ch = iter; + + /* Get the RX ring ptr */ + rx_ring = vsi->rx_rings[pf_q]; +- rx_ring->ch = ch; ++ rx_ring->ch = iter; + } ++ ch = iter; + break; + } + } + ++ if (!ch) ++ return -EINVAL; ++ + /* Guarantee all rings are updated before we update the + * MAC address filter. + */ diff --git a/queue-5.15/mm-huge_memory-do-not-overkill-when-splitting-huge_zero_page.patch b/queue-5.15/mm-huge_memory-do-not-overkill-when-splitting-huge_zero_page.patch new file mode 100644 index 00000000000..0ce123162ad --- /dev/null +++ b/queue-5.15/mm-huge_memory-do-not-overkill-when-splitting-huge_zero_page.patch @@ -0,0 +1,94 @@ +From 478d134e9506c7e9bfe2830ed03dd85e97966313 Mon Sep 17 00:00:00 2001 +From: Xu Yu +Date: Thu, 28 Apr 2022 23:14:43 -0700 +Subject: mm/huge_memory: do not overkill when splitting huge_zero_page + +From: Xu Yu + +commit 478d134e9506c7e9bfe2830ed03dd85e97966313 upstream. + +Kernel panic when injecting memory_failure for the global huge_zero_page, +when CONFIG_DEBUG_VM is enabled, as follows. + + Injecting memory failure for pfn 0x109ff9 at process virtual address 0x20ff9000 + page:00000000fb053fc3 refcount:2 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x109e00 + head:00000000fb053fc3 order:9 compound_mapcount:0 compound_pincount:0 + flags: 0x17fffc000010001(locked|head|node=0|zone=2|lastcpupid=0x1ffff) + raw: 017fffc000010001 0000000000000000 dead000000000122 0000000000000000 + raw: 0000000000000000 0000000000000000 00000002ffffffff 0000000000000000 + page dumped because: VM_BUG_ON_PAGE(is_huge_zero_page(head)) + ------------[ cut here ]------------ + kernel BUG at mm/huge_memory.c:2499! + invalid opcode: 0000 [#1] PREEMPT SMP PTI + CPU: 6 PID: 553 Comm: split_bug Not tainted 5.18.0-rc1+ #11 + Hardware name: Alibaba Cloud Alibaba Cloud ECS, BIOS 3288b3c 04/01/2014 + RIP: 0010:split_huge_page_to_list+0x66a/0x880 + Code: 84 9b fb ff ff 48 8b 7c 24 08 31 f6 e8 9f 5d 2a 00 b8 b8 02 00 00 e9 e8 fb ff ff 48 c7 c6 e8 47 3c 82 4c b + RSP: 0018:ffffc90000dcbdf8 EFLAGS: 00010246 + RAX: 000000000000003c RBX: 0000000000000001 RCX: 0000000000000000 + RDX: 0000000000000000 RSI: ffffffff823e4c4f RDI: 00000000ffffffff + RBP: ffff88843fffdb40 R08: 0000000000000000 R09: 00000000fffeffff + R10: ffffc90000dcbc48 R11: ffffffff82d68448 R12: ffffea0004278000 + R13: ffffffff823c6203 R14: 0000000000109ff9 R15: ffffea000427fe40 + FS: 00007fc375a26740(0000) GS:ffff88842fd80000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 00007fc3757c9290 CR3: 0000000102174006 CR4: 00000000003706e0 + DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 + DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 + Call Trace: + try_to_split_thp_page+0x3a/0x130 + memory_failure+0x128/0x800 + madvise_inject_error.cold+0x8b/0xa1 + __x64_sys_madvise+0x54/0x60 + do_syscall_64+0x35/0x80 + entry_SYSCALL_64_after_hwframe+0x44/0xae + RIP: 0033:0x7fc3754f8bf9 + Code: 01 00 48 81 c4 80 00 00 00 e9 f1 fe ff ff 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 8 + RSP: 002b:00007ffeda93a1d8 EFLAGS: 00000217 ORIG_RAX: 000000000000001c + RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc3754f8bf9 + RDX: 0000000000000064 RSI: 0000000000003000 RDI: 0000000020ff9000 + RBP: 00007ffeda93a200 R08: 0000000000000000 R09: 0000000000000000 + R10: 00000000ffffffff R11: 0000000000000217 R12: 0000000000400490 + R13: 00007ffeda93a2e0 R14: 0000000000000000 R15: 0000000000000000 + +We think that raising BUG is overkilling for splitting huge_zero_page, the +huge_zero_page can't be met from normal paths other than memory failure, +but memory failure is a valid caller. So we tend to replace the BUG to +WARN + returning -EBUSY, and thus the panic above won't happen again. + +Link: https://lkml.kernel.org/r/f35f8b97377d5d3ede1bc5ac3114da888c57cbce.1651052574.git.xuyu@linux.alibaba.com +Fixes: d173d5417fb6 ("mm/memory-failure.c: skip huge_zero_page in memory_failure()") +Fixes: 6a46079cf57a ("HWPOISON: The high level memory error handler in the VM v7") +Signed-off-by: Xu Yu +Suggested-by: Yang Shi +Reported-by: kernel test robot +Reviewed-by: Naoya Horiguchi +Reviewed-by: Yang Shi +Reviewed-by: Miaohe Lin +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + mm/huge_memory.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/mm/huge_memory.c ++++ b/mm/huge_memory.c +@@ -2617,11 +2617,16 @@ int split_huge_page_to_list(struct page + struct address_space *mapping = NULL; + int extra_pins, ret; + pgoff_t end; ++ bool is_hzp; + +- VM_BUG_ON_PAGE(is_huge_zero_page(head), head); + VM_BUG_ON_PAGE(!PageLocked(head), head); + VM_BUG_ON_PAGE(!PageCompound(head), head); + ++ is_hzp = is_huge_zero_page(head); ++ VM_WARN_ON_ONCE_PAGE(is_hzp, head); ++ if (is_hzp) ++ return -EBUSY; ++ + if (PageWriteback(head)) + return -EBUSY; + diff --git a/queue-5.15/net-atlantic-always-deep-reset-on-pm-op-fixing-up-my-null-deref-regression.patch b/queue-5.15/net-atlantic-always-deep-reset-on-pm-op-fixing-up-my-null-deref-regression.patch new file mode 100644 index 00000000000..877da4d8c56 --- /dev/null +++ b/queue-5.15/net-atlantic-always-deep-reset-on-pm-op-fixing-up-my-null-deref-regression.patch @@ -0,0 +1,62 @@ +From 1809c30b6e5a83a1de1435fe01aaa4de4d626a7c Mon Sep 17 00:00:00 2001 +From: Manuel Ullmann +Date: Wed, 4 May 2022 21:30:44 +0200 +Subject: net: atlantic: always deep reset on pm op, fixing up my null deref regression + +From: Manuel Ullmann + +commit 1809c30b6e5a83a1de1435fe01aaa4de4d626a7c upstream. + +The impact of this regression is the same for resume that I saw on +thaw: the kernel hangs and nothing except SysRq rebooting can be done. + +Fixes regression in commit cbe6c3a8f8f4 ("net: atlantic: invert deep +par in pm functions, preventing null derefs"), where I disabled deep +pm resets in suspend and resume, trying to make sense of the +atl_resume_common() deep parameter in the first place. + +It turns out, that atlantic always has to deep reset on pm +operations. Even though I expected that and tested resume, I screwed +up by kexec-rebooting into an unpatched kernel, thus missing the +breakage. + +This fixup obsoletes the deep parameter of atl_resume_common, but I +leave the cleanup for the maintainers to post to mainline. + +Suspend and hibernation were successfully tested by the reporters. + +Fixes: cbe6c3a8f8f4 ("net: atlantic: invert deep par in pm functions, preventing null derefs") +Link: https://lore.kernel.org/regressions/9-Ehc_xXSwdXcvZqKD5aSqsqeNj5Izco4MYEwnx5cySXVEc9-x_WC4C3kAoCqNTi-H38frroUK17iobNVnkLtW36V6VWGSQEOHXhmVMm5iQ=@protonmail.com/ +Reported-by: Jordan Leppert +Reported-by: Holger Hoffstaette +Tested-by: Jordan Leppert +Tested-by: Holger Hoffstaette +CC: # 5.10+ +Signed-off-by: Manuel Ullmann +Link: https://lore.kernel.org/r/87bkw8dfmp.fsf@posteo.de +Signed-off-by: Paolo Abeni +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c ++++ b/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c +@@ -449,7 +449,7 @@ static int aq_pm_freeze(struct device *d + + static int aq_pm_suspend_poweroff(struct device *dev) + { +- return aq_suspend_common(dev, false); ++ return aq_suspend_common(dev, true); + } + + static int aq_pm_thaw(struct device *dev) +@@ -459,7 +459,7 @@ static int aq_pm_thaw(struct device *dev + + static int aq_pm_resume_restore(struct device *dev) + { +- return atl_resume_common(dev, false); ++ return atl_resume_common(dev, true); + } + + static const struct dev_pm_ops aq_pm_ops = { diff --git a/queue-5.15/net-phy-fix-race-condition-on-link-status-change.patch b/queue-5.15/net-phy-fix-race-condition-on-link-status-change.patch new file mode 100644 index 00000000000..52cc735f9a5 --- /dev/null +++ b/queue-5.15/net-phy-fix-race-condition-on-link-status-change.patch @@ -0,0 +1,99 @@ +From 91a7cda1f4b8bdf770000a3b60640576dafe0cec Mon Sep 17 00:00:00 2001 +From: Francesco Dolcini +Date: Fri, 6 May 2022 08:08:15 +0200 +Subject: net: phy: Fix race condition on link status change + +From: Francesco Dolcini + +commit 91a7cda1f4b8bdf770000a3b60640576dafe0cec upstream. + +This fixes the following error caused by a race condition between +phydev->adjust_link() and a MDIO transaction in the phy interrupt +handler. The issue was reproduced with the ethernet FEC driver and a +micrel KSZ9031 phy. + +[ 146.195696] fec 2188000.ethernet eth0: MDIO read timeout +[ 146.201779] ------------[ cut here ]------------ +[ 146.206671] WARNING: CPU: 0 PID: 571 at drivers/net/phy/phy.c:942 phy_error+0x24/0x6c +[ 146.214744] Modules linked in: bnep imx_vdoa imx_sdma evbug +[ 146.220640] CPU: 0 PID: 571 Comm: irq/128-2188000 Not tainted 5.18.0-rc3-00080-gd569e86915b7 #9 +[ 146.229563] Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree) +[ 146.236257] unwind_backtrace from show_stack+0x10/0x14 +[ 146.241640] show_stack from dump_stack_lvl+0x58/0x70 +[ 146.246841] dump_stack_lvl from __warn+0xb4/0x24c +[ 146.251772] __warn from warn_slowpath_fmt+0x5c/0xd4 +[ 146.256873] warn_slowpath_fmt from phy_error+0x24/0x6c +[ 146.262249] phy_error from kszphy_handle_interrupt+0x40/0x48 +[ 146.268159] kszphy_handle_interrupt from irq_thread_fn+0x1c/0x78 +[ 146.274417] irq_thread_fn from irq_thread+0xf0/0x1dc +[ 146.279605] irq_thread from kthread+0xe4/0x104 +[ 146.284267] kthread from ret_from_fork+0x14/0x28 +[ 146.289164] Exception stack(0xe6fa1fb0 to 0xe6fa1ff8) +[ 146.294448] 1fa0: 00000000 00000000 00000000 00000000 +[ 146.302842] 1fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 +[ 146.311281] 1fe0: 00000000 00000000 00000000 00000000 00000013 00000000 +[ 146.318262] irq event stamp: 12325 +[ 146.321780] hardirqs last enabled at (12333): [] __up_console_sem+0x50/0x60 +[ 146.330013] hardirqs last disabled at (12342): [] __up_console_sem+0x3c/0x60 +[ 146.338259] softirqs last enabled at (12324): [] __do_softirq+0x2c0/0x624 +[ 146.346311] softirqs last disabled at (12319): [] __irq_exit_rcu+0x138/0x178 +[ 146.354447] ---[ end trace 0000000000000000 ]--- + +With the FEC driver phydev->adjust_link() calls fec_enet_adjust_link() +calls fec_stop()/fec_restart() and both these function reset and +temporary disable the FEC disrupting any MII transaction that +could be happening at the same time. + +fec_enet_adjust_link() and phy_read() can be running at the same time +when we have one additional interrupt before the phy_state_machine() is +able to terminate. + +Thread 1 (phylib WQ) | Thread 2 (phy interrupt) + | + | phy_interrupt() <-- PHY IRQ + | handle_interrupt() + | phy_read() + | phy_trigger_machine() + | --> schedule phylib WQ + | + | +phy_state_machine() | + phy_check_link_status() | + phy_link_change() | + phydev->adjust_link() | + fec_enet_adjust_link() | + --> FEC reset | phy_interrupt() <-- PHY IRQ + | phy_read() + | + +Fix this by acquiring the phydev lock in phy_interrupt(). + +Link: https://lore.kernel.org/all/20220422152612.GA510015@francesco-nb.int.toradex.com/ +Fixes: c974bdbc3e77 ("net: phy: Use threaded IRQ, to allow IRQ from sleeping devices") +cc: +Signed-off-by: Francesco Dolcini +Reviewed-by: Andrew Lunn +Link: https://lore.kernel.org/r/20220506060815.327382-1-francesco.dolcini@toradex.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/phy/phy.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/drivers/net/phy/phy.c ++++ b/drivers/net/phy/phy.c +@@ -970,8 +970,13 @@ static irqreturn_t phy_interrupt(int irq + { + struct phy_device *phydev = phy_dat; + struct phy_driver *drv = phydev->drv; ++ irqreturn_t ret; + +- return drv->handle_interrupt(phydev); ++ mutex_lock(&phydev->lock); ++ ret = drv->handle_interrupt(phydev); ++ mutex_unlock(&phydev->lock); ++ ++ return ret; + } + + /** diff --git a/queue-5.15/net-phy-micrel-do-not-use-kszphy_suspend-resume-for-ksz8061.patch b/queue-5.15/net-phy-micrel-do-not-use-kszphy_suspend-resume-for-ksz8061.patch new file mode 100644 index 00000000000..b9f063d8aca --- /dev/null +++ b/queue-5.15/net-phy-micrel-do-not-use-kszphy_suspend-resume-for-ksz8061.patch @@ -0,0 +1,62 @@ +From e333eed63a091a09bd0db191b7710c594c6e995b Mon Sep 17 00:00:00 2001 +From: Fabio Estevam +Date: Wed, 4 May 2022 11:31:03 -0300 +Subject: net: phy: micrel: Do not use kszphy_suspend/resume for KSZ8061 + +From: Fabio Estevam + +commit e333eed63a091a09bd0db191b7710c594c6e995b upstream. + +Since commit f1131b9c23fb ("net: phy: micrel: use +kszphy_suspend()/kszphy_resume for irq aware devices") the following +NULL pointer dereference is observed on a board with KSZ8061: + + # udhcpc -i eth0 +udhcpc: started, v1.35.0 +8<--- cut here --- +Unable to handle kernel NULL pointer dereference at virtual address 00000008 +pgd = f73cef4e +[00000008] *pgd=00000000 +Internal error: Oops: 5 [#1] SMP ARM +Modules linked in: +CPU: 0 PID: 196 Comm: ifconfig Not tainted 5.15.37-dirty #94 +Hardware name: Freescale i.MX6 SoloX (Device Tree) +PC is at kszphy_config_reset+0x10/0x114 +LR is at kszphy_resume+0x24/0x64 +... + +The KSZ8061 phy_driver structure does not have the .probe/..driver_data +fields, which means that priv is not allocated. + +This causes the NULL pointer dereference inside kszphy_config_reset(). + +Fix the problem by using the generic suspend/resume functions as before. + +Another alternative would be to provide the .probe and .driver_data +information into the structure, but to be on the safe side, let's +just restore Ethernet functionality by using the generic suspend/resume. + +Cc: stable@vger.kernel.org +Fixes: f1131b9c23fb ("net: phy: micrel: use kszphy_suspend()/kszphy_resume for irq aware devices") +Signed-off-by: Fabio Estevam +Reviewed-by: Andrew Lunn +Link: https://lore.kernel.org/r/20220504143104.1286960-1-festevam@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/phy/micrel.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/phy/micrel.c ++++ b/drivers/net/phy/micrel.c +@@ -1669,8 +1669,8 @@ static struct phy_driver ksphy_driver[] + .config_init = ksz8061_config_init, + .config_intr = kszphy_config_intr, + .handle_interrupt = kszphy_handle_interrupt, +- .suspend = kszphy_suspend, +- .resume = kszphy_resume, ++ .suspend = genphy_suspend, ++ .resume = genphy_resume, + }, { + .phy_id = PHY_ID_KSZ9021, + .phy_id_mask = 0x000ffffe, diff --git a/queue-5.15/net-phy-micrel-pass-.probe-for-ks8737.patch b/queue-5.15/net-phy-micrel-pass-.probe-for-ks8737.patch new file mode 100644 index 00000000000..0162019ae25 --- /dev/null +++ b/queue-5.15/net-phy-micrel-pass-.probe-for-ks8737.patch @@ -0,0 +1,41 @@ +From 15f03ffe4bb951e982457f44b6cf6b06ef4cbb93 Mon Sep 17 00:00:00 2001 +From: Fabio Estevam +Date: Wed, 4 May 2022 11:31:04 -0300 +Subject: net: phy: micrel: Pass .probe for KS8737 + +From: Fabio Estevam + +commit 15f03ffe4bb951e982457f44b6cf6b06ef4cbb93 upstream. + +Since commit f1131b9c23fb ("net: phy: micrel: use +kszphy_suspend()/kszphy_resume for irq aware devices") the kszphy_suspend/ +resume hooks are used. + +These functions require the probe function to be called so that +priv can be allocated. + +Otherwise, a NULL pointer dereference happens inside +kszphy_config_reset(). + +Cc: stable@vger.kernel.org +Fixes: f1131b9c23fb ("net: phy: micrel: use kszphy_suspend()/kszphy_resume for irq aware devices") +Reported-by: Andrew Lunn +Signed-off-by: Fabio Estevam +Reviewed-by: Andrew Lunn +Link: https://lore.kernel.org/r/20220504143104.1286960-2-festevam@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/phy/micrel.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/phy/micrel.c ++++ b/drivers/net/phy/micrel.c +@@ -1544,6 +1544,7 @@ static struct phy_driver ksphy_driver[] + .name = "Micrel KS8737", + /* PHY_BASIC_FEATURES */ + .driver_data = &ks8737_type, ++ .probe = kszphy_probe, + .config_init = kszphy_config_init, + .config_intr = kszphy_config_intr, + .handle_interrupt = kszphy_handle_interrupt, diff --git a/queue-5.15/revert-mm-memory-failure.c-skip-huge_zero_page-in-memory_failure.patch b/queue-5.15/revert-mm-memory-failure.c-skip-huge_zero_page-in-memory_failure.patch new file mode 100644 index 00000000000..7deca2370f5 --- /dev/null +++ b/queue-5.15/revert-mm-memory-failure.c-skip-huge_zero_page-in-memory_failure.patch @@ -0,0 +1,83 @@ +From b4e61fc031b11dd807dffc46cebbf0e25966d3d1 Mon Sep 17 00:00:00 2001 +From: Xu Yu +Date: Thu, 28 Apr 2022 23:14:43 -0700 +Subject: Revert "mm/memory-failure.c: skip huge_zero_page in memory_failure()" + +From: Xu Yu + +commit b4e61fc031b11dd807dffc46cebbf0e25966d3d1 upstream. + +Patch series "mm/memory-failure: rework fix on huge_zero_page splitting". + + +This patch (of 2): + +This reverts commit d173d5417fb67411e623d394aab986d847e47dad. + +The commit d173d5417fb6 ("mm/memory-failure.c: skip huge_zero_page in +memory_failure()") explicitly skips huge_zero_page in memory_failure(), in +order to avoid triggering VM_BUG_ON_PAGE on huge_zero_page in +split_huge_page_to_list(). + +This works, but Yang Shi thinks that, + + Raising BUG is overkilling for splitting huge_zero_page. The + huge_zero_page can't be met from normal paths other than memory + failure, but memory failure is a valid caller. So I tend to replace + the BUG to WARN + returning -EBUSY. If we don't care about the + reason code in memory failure, we don't have to touch memory + failure. + +And for the issue that huge_zero_page will be set PG_has_hwpoisoned, +Yang Shi comments that, + + The anonymous page fault doesn't check if the page is poisoned or + not since it typically gets a fresh allocated page and assumes the + poisoned page (isolated successfully) can't be reallocated again. + But huge zero page and base zero page are reused every time. So no + matter what fix we pick, the issue is always there. + +Finally, Yang, David, Anshuman and Naoya all agree to fix the bug, i.e., +to split huge_zero_page, in split_huge_page_to_list(). + +This reverts the commit d173d5417fb6 ("mm/memory-failure.c: skip +huge_zero_page in memory_failure()"), and the original bug will be fixed +by the next patch. + +Link: https://lkml.kernel.org/r/872cefb182ba1dd686b0e7db1e6b2ebe5a4fff87.1651039624.git.xuyu@linux.alibaba.com +Fixes: d173d5417fb6 ("mm/memory-failure.c: skip huge_zero_page in memory_failure()") +Fixes: 6a46079cf57a ("HWPOISON: The high level memory error handler in the VM v7") +Signed-off-by: Xu Yu +Suggested-by: Yang Shi +Reviewed-by: Yang Shi +Reviewed-by: Miaohe Lin +Cc: Naoya Horiguchi +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + mm/memory-failure.c | 13 ------------- + 1 file changed, 13 deletions(-) + +--- a/mm/memory-failure.c ++++ b/mm/memory-failure.c +@@ -1692,19 +1692,6 @@ try_again: + + if (PageTransHuge(hpage)) { + /* +- * Bail out before SetPageHasHWPoisoned() if hpage is +- * huge_zero_page, although PG_has_hwpoisoned is not +- * checked in set_huge_zero_page(). +- * +- * TODO: Handle memory failure of huge_zero_page thoroughly. +- */ +- if (is_huge_zero_page(hpage)) { +- action_result(pfn, MF_MSG_UNSPLIT_THP, MF_IGNORED); +- res = -EBUSY; +- goto unlock_mutex; +- } +- +- /* + * The flag must be set after the refcount is bumped + * otherwise it may race with THP split. + * And the flag can't be set in get_hwpoison_page() since diff --git a/queue-5.15/serial-8250_mtk-fix-register-address-for-xon-xoff-character.patch b/queue-5.15/serial-8250_mtk-fix-register-address-for-xon-xoff-character.patch new file mode 100644 index 00000000000..975d2e1b360 --- /dev/null +++ b/queue-5.15/serial-8250_mtk-fix-register-address-for-xon-xoff-character.patch @@ -0,0 +1,44 @@ +From e1bfdbc7daca171c74a577b3dd0b36d76bb0ffcc Mon Sep 17 00:00:00 2001 +From: AngeloGioacchino Del Regno +Date: Wed, 27 Apr 2022 15:23:28 +0200 +Subject: serial: 8250_mtk: Fix register address for XON/XOFF character + +From: AngeloGioacchino Del Regno + +commit e1bfdbc7daca171c74a577b3dd0b36d76bb0ffcc upstream. + +The XON1/XOFF1 character registers are at offset 0xa0 and 0xa8 +respectively, so we cannot use the definition in serial_port.h. + +Fixes: bdbd0a7f8f03 ("serial: 8250-mtk: modify baudrate setting") +Signed-off-by: AngeloGioacchino Del Regno +Cc: stable +Link: https://lore.kernel.org/r/20220427132328.228297-4-angelogioacchino.delregno@collabora.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/serial/8250/8250_mtk.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/tty/serial/8250/8250_mtk.c ++++ b/drivers/tty/serial/8250/8250_mtk.c +@@ -54,6 +54,9 @@ + #define MTK_UART_TX_TRIGGER 1 + #define MTK_UART_RX_TRIGGER MTK_UART_RX_SIZE + ++#define MTK_UART_XON1 40 /* I/O: Xon character 1 */ ++#define MTK_UART_XOFF1 42 /* I/O: Xoff character 1 */ ++ + #ifdef CONFIG_SERIAL_8250_DMA + enum dma_rx_status { + DMA_RX_START = 0, +@@ -275,8 +278,8 @@ static void mtk8250_set_flow_ctrl(struct + (serial_in(up, MTK_UART_EFR) & + (~(MTK_UART_EFR_HW_FC | MTK_UART_EFR_SW_FC_MASK)))); + +- serial_out(up, UART_XON1, START_CHAR(port->state->port.tty)); +- serial_out(up, UART_XOFF1, STOP_CHAR(port->state->port.tty)); ++ serial_out(up, MTK_UART_XON1, START_CHAR(port->state->port.tty)); ++ serial_out(up, MTK_UART_XOFF1, STOP_CHAR(port->state->port.tty)); + serial_out(up, UART_LCR, lcr); + mtk8250_disable_intrs(up, MTK_UART_IER_CTSI|MTK_UART_IER_RTSI); + mtk8250_enable_intrs(up, MTK_UART_IER_XOFFI); diff --git a/queue-5.15/serial-8250_mtk-fix-uart_efr-register-address.patch b/queue-5.15/serial-8250_mtk-fix-uart_efr-register-address.patch new file mode 100644 index 00000000000..60702d14d8d --- /dev/null +++ b/queue-5.15/serial-8250_mtk-fix-uart_efr-register-address.patch @@ -0,0 +1,92 @@ +From bb0b197aadd928f52ce6f01f0ee977f0a08cf1be Mon Sep 17 00:00:00 2001 +From: AngeloGioacchino Del Regno +Date: Wed, 27 Apr 2022 15:23:26 +0200 +Subject: serial: 8250_mtk: Fix UART_EFR register address + +From: AngeloGioacchino Del Regno + +commit bb0b197aadd928f52ce6f01f0ee977f0a08cf1be upstream. + +On MediaTek SoCs, the UART IP is 16550A compatible, but there are some +specific quirks: we are declaring a register shift of 2, but this is +only valid for the majority of the registers, as there are some that +are out of the standard layout. + +Specifically, this driver is using definitions from serial_reg.h, where +we have a UART_EFR register defined as 2: this results in a 0x8 offset, +but there we have the FCR register instead. + +The right offset for the EFR register on MediaTek UART is at 0x98, +so, following the decimal definition convention in serial_reg.h and +accounting for the register left shift of two, add and use the correct +register address for this IP, defined as decimal 38, so that the final +calculation results in (0x26 << 2) = 0x98. + +Fixes: bdbd0a7f8f03 ("serial: 8250-mtk: modify baudrate setting") +Signed-off-by: AngeloGioacchino Del Regno +Cc: stable +Link: https://lore.kernel.org/r/20220427132328.228297-2-angelogioacchino.delregno@collabora.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/serial/8250/8250_mtk.c | 15 ++++++++------- + 1 file changed, 8 insertions(+), 7 deletions(-) + +--- a/drivers/tty/serial/8250/8250_mtk.c ++++ b/drivers/tty/serial/8250/8250_mtk.c +@@ -37,6 +37,7 @@ + #define MTK_UART_IER_RTSI 0x40 /* Enable RTS Modem status interrupt */ + #define MTK_UART_IER_CTSI 0x80 /* Enable CTS Modem status interrupt */ + ++#define MTK_UART_EFR 38 /* I/O: Extended Features Register */ + #define MTK_UART_EFR_EN 0x10 /* Enable enhancement feature */ + #define MTK_UART_EFR_RTS 0x40 /* Enable hardware rx flow control */ + #define MTK_UART_EFR_CTS 0x80 /* Enable hardware tx flow control */ +@@ -169,7 +170,7 @@ static void mtk8250_dma_enable(struct ua + MTK_UART_DMA_EN_RX | MTK_UART_DMA_EN_TX); + + serial_out(up, UART_LCR, UART_LCR_CONF_MODE_B); +- serial_out(up, UART_EFR, UART_EFR_ECB); ++ serial_out(up, MTK_UART_EFR, UART_EFR_ECB); + serial_out(up, UART_LCR, lcr); + + if (dmaengine_slave_config(dma->rxchan, &dma->rxconf) != 0) +@@ -232,7 +233,7 @@ static void mtk8250_set_flow_ctrl(struct + int lcr = serial_in(up, UART_LCR); + + serial_out(up, UART_LCR, UART_LCR_CONF_MODE_B); +- serial_out(up, UART_EFR, UART_EFR_ECB); ++ serial_out(up, MTK_UART_EFR, UART_EFR_ECB); + serial_out(up, UART_LCR, lcr); + lcr = serial_in(up, UART_LCR); + +@@ -241,7 +242,7 @@ static void mtk8250_set_flow_ctrl(struct + serial_out(up, MTK_UART_ESCAPE_DAT, MTK_UART_ESCAPE_CHAR); + serial_out(up, MTK_UART_ESCAPE_EN, 0x00); + serial_out(up, UART_LCR, UART_LCR_CONF_MODE_B); +- serial_out(up, UART_EFR, serial_in(up, UART_EFR) & ++ serial_out(up, MTK_UART_EFR, serial_in(up, MTK_UART_EFR) & + (~(MTK_UART_EFR_HW_FC | MTK_UART_EFR_SW_FC_MASK))); + serial_out(up, UART_LCR, lcr); + mtk8250_disable_intrs(up, MTK_UART_IER_XOFFI | +@@ -255,8 +256,8 @@ static void mtk8250_set_flow_ctrl(struct + serial_out(up, UART_LCR, UART_LCR_CONF_MODE_B); + + /*enable hw flow control*/ +- serial_out(up, UART_EFR, MTK_UART_EFR_HW_FC | +- (serial_in(up, UART_EFR) & ++ serial_out(up, MTK_UART_EFR, MTK_UART_EFR_HW_FC | ++ (serial_in(up, MTK_UART_EFR) & + (~(MTK_UART_EFR_HW_FC | MTK_UART_EFR_SW_FC_MASK)))); + + serial_out(up, UART_LCR, lcr); +@@ -270,8 +271,8 @@ static void mtk8250_set_flow_ctrl(struct + serial_out(up, UART_LCR, UART_LCR_CONF_MODE_B); + + /*enable sw flow control */ +- serial_out(up, UART_EFR, MTK_UART_EFR_XON1_XOFF1 | +- (serial_in(up, UART_EFR) & ++ serial_out(up, MTK_UART_EFR, MTK_UART_EFR_XON1_XOFF1 | ++ (serial_in(up, MTK_UART_EFR) & + (~(MTK_UART_EFR_HW_FC | MTK_UART_EFR_SW_FC_MASK)))); + + serial_out(up, UART_XON1, START_CHAR(port->state->port.tty)); diff --git a/queue-5.15/serial-8250_mtk-make-sure-to-select-the-right-feature_sel.patch b/queue-5.15/serial-8250_mtk-make-sure-to-select-the-right-feature_sel.patch new file mode 100644 index 00000000000..39f1eff0621 --- /dev/null +++ b/queue-5.15/serial-8250_mtk-make-sure-to-select-the-right-feature_sel.patch @@ -0,0 +1,44 @@ +From 6f81fdded0d024c7d4084d434764f30bca1cd6b1 Mon Sep 17 00:00:00 2001 +From: AngeloGioacchino Del Regno +Date: Wed, 27 Apr 2022 15:23:27 +0200 +Subject: serial: 8250_mtk: Make sure to select the right FEATURE_SEL + +From: AngeloGioacchino Del Regno + +commit 6f81fdded0d024c7d4084d434764f30bca1cd6b1 upstream. + +Set the FEATURE_SEL at probe time to make sure that BIT(0) is enabled: +this guarantees that when the port is configured as AP UART, the +right register layout is interpreted by the UART IP. + +Signed-off-by: AngeloGioacchino Del Regno +Cc: stable +Link: https://lore.kernel.org/r/20220427132328.228297-3-angelogioacchino.delregno@collabora.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/serial/8250/8250_mtk.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/tty/serial/8250/8250_mtk.c ++++ b/drivers/tty/serial/8250/8250_mtk.c +@@ -57,6 +57,9 @@ + #define MTK_UART_XON1 40 /* I/O: Xon character 1 */ + #define MTK_UART_XOFF1 42 /* I/O: Xoff character 1 */ + ++#define MTK_UART_FEATURE_SEL 39 /* Feature Selection register */ ++#define MTK_UART_FEAT_NEWRMAP BIT(0) /* Use new register map */ ++ + #ifdef CONFIG_SERIAL_8250_DMA + enum dma_rx_status { + DMA_RX_START = 0, +@@ -572,6 +575,10 @@ static int mtk8250_probe(struct platform + uart.dma = data->dma; + #endif + ++ /* Set AP UART new register map */ ++ writel(MTK_UART_FEAT_NEWRMAP, uart.port.membase + ++ (MTK_UART_FEATURE_SEL << uart.port.regshift)); ++ + /* Disable Rate Fix function */ + writel(0x0, uart.port.membase + + (MTK_UART_RATE_FIX << uart.port.regshift)); diff --git a/queue-5.15/series b/queue-5.15/series index 47a31f5c3af..547b97ec06d 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -68,3 +68,28 @@ tty-serial-digicolor-fix-possible-null-ptr-deref-in-digicolor_uart_probe.patch tty-n_gsm-fix-buffer-over-read-in-gsm_dlci_data.patch tty-n_gsm-fix-mux-activation-issues-in-gsm_config.patch usb-cdc-wdm-fix-reading-stuck-on-device-close.patch +usb-typec-tcpci-don-t-skip-cleanup-in-.remove-on-error.patch +usb-typec-tcpci_mt6360-update-for-bmc-phy-setting.patch +usb-serial-pl2303-add-device-id-for-hp-lm930-display.patch +usb-serial-qcserial-add-support-for-sierra-wireless-em7590.patch +usb-serial-option-add-fibocom-l610-modem.patch +usb-serial-option-add-fibocom-ma510-modem.patch +slimbus-qcom-fix-irq-check-in-qcom_slim_probe.patch +fsl_lpuart-don-t-enable-interrupts-too-early.patch +serial-8250_mtk-fix-uart_efr-register-address.patch +serial-8250_mtk-fix-register-address-for-xon-xoff-character.patch +serial-8250_mtk-make-sure-to-select-the-right-feature_sel.patch +ceph-fix-setting-of-xattrs-on-async-created-inodes.patch +revert-mm-memory-failure.c-skip-huge_zero_page-in-memory_failure.patch +mm-huge_memory-do-not-overkill-when-splitting-huge_zero_page.patch +drm-vmwgfx-disable-command-buffers-on-svga3-without-gbobjects.patch +drm-nouveau-tegra-stop-using-iommu_present.patch +i40e-i40e_main-fix-a-missing-check-on-list-iterator.patch +net-atlantic-always-deep-reset-on-pm-op-fixing-up-my-null-deref-regression.patch +net-phy-fix-race-condition-on-link-status-change.patch +writeback-avoid-skipping-inode-writeback.patch +cgroup-cpuset-remove-cpus_allowed-mems_allowed-setup-in-cpuset_init_smp.patch +arm-memremap-don-t-abuse-pfn_valid-to-ensure-presence-of-linear-map.patch +net-phy-micrel-do-not-use-kszphy_suspend-resume-for-ksz8061.patch +net-phy-micrel-pass-.probe-for-ks8737.patch +sunrpc-ensure-that-the-gssproxy-client-can-start-in-a-connected-state.patch diff --git a/queue-5.15/slimbus-qcom-fix-irq-check-in-qcom_slim_probe.patch b/queue-5.15/slimbus-qcom-fix-irq-check-in-qcom_slim_probe.patch new file mode 100644 index 00000000000..1e8600cd908 --- /dev/null +++ b/queue-5.15/slimbus-qcom-fix-irq-check-in-qcom_slim_probe.patch @@ -0,0 +1,43 @@ +From fe503887eed6ea528e144ec8dacfa1d47aa701ac Mon Sep 17 00:00:00 2001 +From: Miaoqian Lin +Date: Fri, 29 Apr 2022 17:49:17 +0100 +Subject: slimbus: qcom: Fix IRQ check in qcom_slim_probe + +From: Miaoqian Lin + +commit fe503887eed6ea528e144ec8dacfa1d47aa701ac upstream. + +platform_get_irq() returns non-zero IRQ number on success, +negative error number on failure. +And the doc of platform_get_irq() provides a usage example: + + int irq = platform_get_irq(pdev, 0); + if (irq < 0) + return irq; + +Fix the check of return value to catch errors correctly. + +Fixes: ad7fcbc308b0 ("slimbus: qcom: Add Qualcomm Slimbus controller driver") +Cc: stable@vger.kernel.org +Signed-off-by: Miaoqian Lin +Signed-off-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20220429164917.5202-2-srinivas.kandagatla@linaro.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/slimbus/qcom-ctrl.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/slimbus/qcom-ctrl.c ++++ b/drivers/slimbus/qcom-ctrl.c +@@ -510,9 +510,9 @@ static int qcom_slim_probe(struct platfo + } + + ctrl->irq = platform_get_irq(pdev, 0); +- if (!ctrl->irq) { ++ if (ctrl->irq < 0) { + dev_err(&pdev->dev, "no slimbus IRQ\n"); +- return -ENODEV; ++ return ctrl->irq; + } + + sctrl = &ctrl->ctrl; diff --git a/queue-5.15/sunrpc-ensure-that-the-gssproxy-client-can-start-in-a-connected-state.patch b/queue-5.15/sunrpc-ensure-that-the-gssproxy-client-can-start-in-a-connected-state.patch new file mode 100644 index 00000000000..51d70d9f1cc --- /dev/null +++ b/queue-5.15/sunrpc-ensure-that-the-gssproxy-client-can-start-in-a-connected-state.patch @@ -0,0 +1,106 @@ +From fd13359f54ee854f00134abc6be32da94ec53dbf Mon Sep 17 00:00:00 2001 +From: Trond Myklebust +Date: Sat, 7 May 2022 13:53:59 -0400 +Subject: SUNRPC: Ensure that the gssproxy client can start in a connected state + +From: Trond Myklebust + +commit fd13359f54ee854f00134abc6be32da94ec53dbf upstream. + +Ensure that the gssproxy client connects to the server from the gssproxy +daemon process context so that the AF_LOCAL socket connection is done +using the correct path and namespaces. + +Fixes: 1d658336b05f ("SUNRPC: Add RPC based upcall mechanism for RPCGSS auth") +Cc: stable@vger.kernel.org +Signed-off-by: Trond Myklebust +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/sunrpc/clnt.h | 1 + + net/sunrpc/auth_gss/gss_rpc_upcall.c | 1 + + net/sunrpc/clnt.c | 33 +++++++++++++++++++++++++++++++++ + 3 files changed, 35 insertions(+) + +--- a/include/linux/sunrpc/clnt.h ++++ b/include/linux/sunrpc/clnt.h +@@ -159,6 +159,7 @@ struct rpc_add_xprt_test { + #define RPC_CLNT_CREATE_NO_RETRANS_TIMEOUT (1UL << 9) + #define RPC_CLNT_CREATE_SOFTERR (1UL << 10) + #define RPC_CLNT_CREATE_REUSEPORT (1UL << 11) ++#define RPC_CLNT_CREATE_CONNECTED (1UL << 12) + + struct rpc_clnt *rpc_create(struct rpc_create_args *args); + struct rpc_clnt *rpc_bind_new_program(struct rpc_clnt *, +--- a/net/sunrpc/auth_gss/gss_rpc_upcall.c ++++ b/net/sunrpc/auth_gss/gss_rpc_upcall.c +@@ -98,6 +98,7 @@ static int gssp_rpc_create(struct net *n + * done without the correct namespace: + */ + .flags = RPC_CLNT_CREATE_NOPING | ++ RPC_CLNT_CREATE_CONNECTED | + RPC_CLNT_CREATE_NO_IDLE_TIMEOUT + }; + struct rpc_clnt *clnt; +--- a/net/sunrpc/clnt.c ++++ b/net/sunrpc/clnt.c +@@ -76,6 +76,7 @@ static int rpc_encode_header(struct rpc_ + static int rpc_decode_header(struct rpc_task *task, + struct xdr_stream *xdr); + static int rpc_ping(struct rpc_clnt *clnt); ++static int rpc_ping_noreply(struct rpc_clnt *clnt); + static void rpc_check_timeout(struct rpc_task *task); + + static void rpc_register_client(struct rpc_clnt *clnt) +@@ -483,6 +484,12 @@ static struct rpc_clnt *rpc_create_xprt( + rpc_shutdown_client(clnt); + return ERR_PTR(err); + } ++ } else if (args->flags & RPC_CLNT_CREATE_CONNECTED) { ++ int err = rpc_ping_noreply(clnt); ++ if (err != 0) { ++ rpc_shutdown_client(clnt); ++ return ERR_PTR(err); ++ } + } + + clnt->cl_softrtry = 1; +@@ -2704,6 +2711,10 @@ static const struct rpc_procinfo rpcproc + .p_decode = rpcproc_decode_null, + }; + ++static const struct rpc_procinfo rpcproc_null_noreply = { ++ .p_encode = rpcproc_encode_null, ++}; ++ + static void + rpc_null_call_prepare(struct rpc_task *task, void *data) + { +@@ -2753,6 +2764,28 @@ static int rpc_ping(struct rpc_clnt *cln + if (IS_ERR(task)) + return PTR_ERR(task); + status = task->tk_status; ++ rpc_put_task(task); ++ return status; ++} ++ ++static int rpc_ping_noreply(struct rpc_clnt *clnt) ++{ ++ struct rpc_message msg = { ++ .rpc_proc = &rpcproc_null_noreply, ++ }; ++ struct rpc_task_setup task_setup_data = { ++ .rpc_client = clnt, ++ .rpc_message = &msg, ++ .callback_ops = &rpc_null_ops, ++ .flags = RPC_TASK_SOFT | RPC_TASK_SOFTCONN | RPC_TASK_NULLCREDS, ++ }; ++ struct rpc_task *task; ++ int status; ++ ++ task = rpc_run_task(&task_setup_data); ++ if (IS_ERR(task)) ++ return PTR_ERR(task); ++ status = task->tk_status; + rpc_put_task(task); + return status; + } diff --git a/queue-5.15/usb-serial-option-add-fibocom-l610-modem.patch b/queue-5.15/usb-serial-option-add-fibocom-l610-modem.patch new file mode 100644 index 00000000000..bc3010c7c2e --- /dev/null +++ b/queue-5.15/usb-serial-option-add-fibocom-l610-modem.patch @@ -0,0 +1,141 @@ +From 714adff9a6271b5f1664b04c944b598141ebfe73 Mon Sep 17 00:00:00 2001 +From: Sven Schwermer +Date: Mon, 25 Apr 2022 16:34:49 +0200 +Subject: USB: serial: option: add Fibocom L610 modem + +From: Sven Schwermer + +commit 714adff9a6271b5f1664b04c944b598141ebfe73 upstream. + +The L610 modem has 3 USB configurations that are configurable via the AT +command AT+GTUSBMODE={31,32,33} which make the modem enumerate with the +following interfaces, respectively: + +31: Modem + NV + MOS + Diag + LOG + AT + AT +32: ECM + Modem + NV + MOS + Diag + LOG + AT + AT +33: RNDIS + Modem + NV + MOS + Diag + LOG + AT + AT + +A detailed description of the USB configuration for each mode follows: + ++GTUSBMODE: 31 +-------------- +T: Bus=03 Lev=01 Prnt=01 Port=06 Cnt=04 Dev#=124 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=1782 ProdID=4d10 Rev= 0.00 +S: Manufacturer=FIBOCOM +S: Product=L610 +C:* #Ifs= 7 Cfg#= 1 Atr=e0 MxPwr=400mA +I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms + ++GTUSBMODE: 32 +-------------- +T: Bus=03 Lev=01 Prnt=01 Port=06 Cnt=04 Dev#=122 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=1782 ProdID=4d11 Rev= 0.00 +S: Manufacturer=FIBOCOM +S: Product=L610 +C:* #Ifs= 9 Cfg#= 1 Atr=e0 MxPwr=400mA +A: FirstIf#= 0 IfCount= 2 Cls=02(comm.) Sub=06 Prot=00 +I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=06 Prot=00 Driver=cdc_ether +E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=32ms +I: If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether +I:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether +E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 7 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 8 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=08(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms + ++GTUSBMODE: 33 +-------------- +T: Bus=03 Lev=01 Prnt=01 Port=06 Cnt=04 Dev#=126 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=1782 ProdID=4d11 Rev= 0.00 +S: Manufacturer=FIBOCOM +S: Product=L610 +C:* #Ifs= 9 Cfg#= 1 Atr=e0 MxPwr=400mA +A: FirstIf#= 0 IfCount= 2 Cls=e0(wlcon) Sub=01 Prot=03 +I:* If#= 0 Alt= 0 #EPs= 1 Cls=e0(wlcon) Sub=01 Prot=03 Driver=rndis_host +E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=4096ms +I:* If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 7 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 8 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=08(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +Signed-off-by: Sven Schwermer +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -2123,6 +2123,8 @@ static const struct usb_device_id option + .driver_info = RSVD(3) }, + { USB_DEVICE(0x1508, 0x1001), /* Fibocom NL668 (IOT version) */ + .driver_info = RSVD(4) | RSVD(5) | RSVD(6) }, ++ { USB_DEVICE(0x1782, 0x4d10) }, /* Fibocom L610 (AT mode) */ ++ { USB_DEVICE_INTERFACE_CLASS(0x1782, 0x4d11, 0xff) }, /* Fibocom L610 (ECM/RNDIS mode) */ + { USB_DEVICE(0x2cb7, 0x0104), /* Fibocom NL678 series */ + .driver_info = RSVD(4) | RSVD(5) }, + { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0105, 0xff), /* Fibocom NL678 series */ diff --git a/queue-5.15/usb-serial-option-add-fibocom-ma510-modem.patch b/queue-5.15/usb-serial-option-add-fibocom-ma510-modem.patch new file mode 100644 index 00000000000..eeed75f04a6 --- /dev/null +++ b/queue-5.15/usb-serial-option-add-fibocom-ma510-modem.patch @@ -0,0 +1,117 @@ +From 07989eb981d862f7f2be68d233d753f2e7ccc119 Mon Sep 17 00:00:00 2001 +From: Sven Schwermer +Date: Mon, 25 Apr 2022 16:34:50 +0200 +Subject: USB: serial: option: add Fibocom MA510 modem + +From: Sven Schwermer + +commit 07989eb981d862f7f2be68d233d753f2e7ccc119 upstream. + +The MA510 modem has 3 USB configurations that are configurable via the AT +command AT+GTUSBMODE={30,31,32} which make the modem enumerate with the +following interfaces, respectively: + +30: Diag + QDSS + Modem + RMNET +31: Diag + Modem + AT + ECM +32: Modem + AT + ECM + +The first configuration (30) reuses u-blox R410M's VID/PID with +identical interface configuration. + +A detailed description of the USB configuration for each mode follows: + ++GTUSBMODE: 30 +-------------- +T: Bus=03 Lev=01 Prnt=01 Port=06 Cnt=04 Dev#= 19 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=05c6 ProdID=90b2 Rev= 0.00 +S: Manufacturer=Fibocom MA510 Modem +S: Product=Fibocom MA510 Modem +S: SerialNumber=55e2695b +C:* #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=500mA +I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) +E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +E: Ad=83(I) Atr=03(Int.) MxPS= 64 Ivl=2ms +E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan +E: Ad=85(I) Atr=03(Int.) MxPS= 64 Ivl=2ms +E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms + ++GTUSBMODE: 31 +-------------- +T: Bus=03 Lev=01 Prnt=01 Port=06 Cnt=04 Dev#= 99 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=2cb7 ProdID=0106 Rev= 0.00 +S: Manufacturer=Fibocom MA510 Modem +S: Product=Fibocom MA510 Modem +S: SerialNumber=55e2695b +C:* #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA +A: FirstIf#= 3 IfCount= 2 Cls=02(comm.) Sub=00 Prot=00 +I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=2ms +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=fe Prot=ff Driver=option +E: Ad=84(I) Atr=03(Int.) MxPS= 64 Ivl=2ms +E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 3 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=06 Prot=00 Driver=cdc_ether +E: Ad=86(I) Atr=03(Int.) MxPS= 64 Ivl=2ms +I: If#= 4 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether +I:* If#= 4 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether +E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms + ++GTUSBMODE: 32 +-------------- +T: Bus=03 Lev=01 Prnt=01 Port=06 Cnt=04 Dev#=100 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=2cb7 ProdID=010a Rev= 0.00 +S: Manufacturer=Fibocom MA510 Modem +S: Product=Fibocom MA510 Modem +S: SerialNumber=55e2695b +C:* #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=500mA +A: FirstIf#= 2 IfCount= 2 Cls=02(comm.) Sub=00 Prot=00 +I:* If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +E: Ad=81(I) Atr=03(Int.) MxPS= 64 Ivl=2ms +E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=fe Prot=ff Driver=option +E: Ad=83(I) Atr=03(Int.) MxPS= 64 Ivl=2ms +E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 2 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=06 Prot=00 Driver=cdc_ether +E: Ad=85(I) Atr=03(Int.) MxPS= 64 Ivl=2ms +I: If#= 3 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether +I:* If#= 3 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether +E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +Signed-off-by: Sven Schwermer +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -2129,6 +2129,8 @@ static const struct usb_device_id option + .driver_info = RSVD(4) | RSVD(5) }, + { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0105, 0xff), /* Fibocom NL678 series */ + .driver_info = RSVD(6) }, ++ { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0106, 0xff) }, /* Fibocom MA510 (ECM mode w/ diag intf.) */ ++ { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x010a, 0xff) }, /* Fibocom MA510 (ECM mode) */ + { USB_DEVICE_AND_INTERFACE_INFO(0x2cb7, 0x010b, 0xff, 0xff, 0x30) }, /* Fibocom FG150 Diag */ + { USB_DEVICE_AND_INTERFACE_INFO(0x2cb7, 0x010b, 0xff, 0, 0) }, /* Fibocom FG150 AT */ + { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a0, 0xff) }, /* Fibocom NL668-AM/NL652-EU (laptop MBIM) */ diff --git a/queue-5.15/usb-serial-pl2303-add-device-id-for-hp-lm930-display.patch b/queue-5.15/usb-serial-pl2303-add-device-id-for-hp-lm930-display.patch new file mode 100644 index 00000000000..74b11a3a60c --- /dev/null +++ b/queue-5.15/usb-serial-pl2303-add-device-id-for-hp-lm930-display.patch @@ -0,0 +1,41 @@ +From 26a08f8bad3e1f98d3153f939fb8cd330da4cb26 Mon Sep 17 00:00:00 2001 +From: Scott Chen +Date: Mon, 25 Apr 2022 17:00:20 +0800 +Subject: USB: serial: pl2303: add device id for HP LM930 Display + +From: Scott Chen + +commit 26a08f8bad3e1f98d3153f939fb8cd330da4cb26 upstream. + +Add the device id for the HPLM930Display which is a PL2303GC based +device. + +Signed-off-by: Scott Chen +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/pl2303.c | 1 + + drivers/usb/serial/pl2303.h | 1 + + 2 files changed, 2 insertions(+) + +--- a/drivers/usb/serial/pl2303.c ++++ b/drivers/usb/serial/pl2303.c +@@ -106,6 +106,7 @@ static const struct usb_device_id id_tab + { USB_DEVICE(HP_VENDOR_ID, HP_LCM220_PRODUCT_ID) }, + { USB_DEVICE(HP_VENDOR_ID, HP_LCM960_PRODUCT_ID) }, + { USB_DEVICE(HP_VENDOR_ID, HP_LM920_PRODUCT_ID) }, ++ { USB_DEVICE(HP_VENDOR_ID, HP_LM930_PRODUCT_ID) }, + { USB_DEVICE(HP_VENDOR_ID, HP_LM940_PRODUCT_ID) }, + { USB_DEVICE(HP_VENDOR_ID, HP_TD620_PRODUCT_ID) }, + { USB_DEVICE(CRESSI_VENDOR_ID, CRESSI_EDY_PRODUCT_ID) }, +--- a/drivers/usb/serial/pl2303.h ++++ b/drivers/usb/serial/pl2303.h +@@ -135,6 +135,7 @@ + #define HP_TD620_PRODUCT_ID 0x0956 + #define HP_LD960_PRODUCT_ID 0x0b39 + #define HP_LD381_PRODUCT_ID 0x0f7f ++#define HP_LM930_PRODUCT_ID 0x0f9b + #define HP_LCM220_PRODUCT_ID 0x3139 + #define HP_LCM960_PRODUCT_ID 0x3239 + #define HP_LD220_PRODUCT_ID 0x3524 diff --git a/queue-5.15/usb-serial-qcserial-add-support-for-sierra-wireless-em7590.patch b/queue-5.15/usb-serial-qcserial-add-support-for-sierra-wireless-em7590.patch new file mode 100644 index 00000000000..1abb3aae781 --- /dev/null +++ b/queue-5.15/usb-serial-qcserial-add-support-for-sierra-wireless-em7590.patch @@ -0,0 +1,31 @@ +From 870b1eee2d844727b06e238c121d260bc5645580 Mon Sep 17 00:00:00 2001 +From: Ethan Yang +Date: Mon, 25 Apr 2022 13:58:40 +0800 +Subject: USB: serial: qcserial: add support for Sierra Wireless EM7590 + +From: Ethan Yang + +commit 870b1eee2d844727b06e238c121d260bc5645580 upstream. + +Add support for Sierra Wireless EM7590 0xc080/0xc081 compositions. + +Signed-off-by: Ethan Yang +Link: https://lore.kernel.org/r/20220425055840.5693-1-etyang@sierrawireless.com +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/qcserial.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/serial/qcserial.c ++++ b/drivers/usb/serial/qcserial.c +@@ -166,6 +166,8 @@ static const struct usb_device_id id_tab + {DEVICE_SWI(0x1199, 0x9090)}, /* Sierra Wireless EM7565 QDL */ + {DEVICE_SWI(0x1199, 0x9091)}, /* Sierra Wireless EM7565 */ + {DEVICE_SWI(0x1199, 0x90d2)}, /* Sierra Wireless EM9191 QDL */ ++ {DEVICE_SWI(0x1199, 0xc080)}, /* Sierra Wireless EM7590 QDL */ ++ {DEVICE_SWI(0x1199, 0xc081)}, /* Sierra Wireless EM7590 */ + {DEVICE_SWI(0x413c, 0x81a2)}, /* Dell Wireless 5806 Gobi(TM) 4G LTE Mobile Broadband Card */ + {DEVICE_SWI(0x413c, 0x81a3)}, /* Dell Wireless 5570 HSPA+ (42Mbps) Mobile Broadband Card */ + {DEVICE_SWI(0x413c, 0x81a4)}, /* Dell Wireless 5570e HSPA+ (42Mbps) Mobile Broadband Card */ diff --git a/queue-5.15/usb-typec-tcpci-don-t-skip-cleanup-in-.remove-on-error.patch b/queue-5.15/usb-typec-tcpci-don-t-skip-cleanup-in-.remove-on-error.patch new file mode 100644 index 00000000000..6aee066983a --- /dev/null +++ b/queue-5.15/usb-typec-tcpci-don-t-skip-cleanup-in-.remove-on-error.patch @@ -0,0 +1,53 @@ +From bbc126ae381cf0a27822c1f822d0aeed74cc40d9 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= +Date: Mon, 2 May 2022 10:04:56 +0200 +Subject: usb: typec: tcpci: Don't skip cleanup in .remove() on error +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +commit bbc126ae381cf0a27822c1f822d0aeed74cc40d9 upstream. + +Returning an error value in an i2c remove callback results in an error +message being emitted by the i2c core, but otherwise it doesn't make a +difference. The device goes away anyhow and the devm cleanups are +called. + +In this case the remove callback even returns early without stopping the +tcpm worker thread and various timers. A work scheduled on the work +queue, or a firing timer after tcpci_remove() returned probably results +in a use-after-free situation because the regmap and driver data were +freed. So better make sure that tcpci_unregister_port() is called even +if disabling the irq failed. + +Also emit a more specific error message instead of the i2c core's +"remove failed (EIO), will be ignored" and return 0 to suppress the +core's warning. + +This patch is (also) a preparation for making i2c remove callbacks +return void. + +Fixes: 3ba76256fc4e ("usb: typec: tcpci: mask event interrupts when remove driver") +Signed-off-by: Uwe Kleine-König +Cc: stable +Acked-by: Heikki Krogerus +Reviewed-by: Guenter Roeck +Link: https://lore.kernel.org/r/20220502080456.21568-1-u.kleine-koenig@pengutronix.de +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/typec/tcpm/tcpci.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/typec/tcpm/tcpci.c ++++ b/drivers/usb/typec/tcpm/tcpci.c +@@ -877,7 +877,7 @@ static int tcpci_remove(struct i2c_clien + /* Disable chip interrupts before unregistering port */ + err = tcpci_write16(chip->tcpci, TCPC_ALERT_MASK, 0); + if (err < 0) +- return err; ++ dev_warn(&client->dev, "Failed to disable irqs (%pe)\n", ERR_PTR(err)); + + tcpci_unregister_port(chip->tcpci); + diff --git a/queue-5.15/usb-typec-tcpci_mt6360-update-for-bmc-phy-setting.patch b/queue-5.15/usb-typec-tcpci_mt6360-update-for-bmc-phy-setting.patch new file mode 100644 index 00000000000..10c6e7dfe45 --- /dev/null +++ b/queue-5.15/usb-typec-tcpci_mt6360-update-for-bmc-phy-setting.patch @@ -0,0 +1,106 @@ +From 4031cd95cba70c72e4cadc2d46624bcd31e5a6c0 Mon Sep 17 00:00:00 2001 +From: ChiYuan Huang +Date: Tue, 10 May 2022 13:13:00 +0800 +Subject: usb: typec: tcpci_mt6360: Update for BMC PHY setting + +From: ChiYuan Huang + +commit 4031cd95cba70c72e4cadc2d46624bcd31e5a6c0 upstream. + +Update MT6360 BMC PHY Tx/Rx setting for the compatibility. + +Macpaul reported this CtoDP cable attention message cannot be received from +MT6360 TCPC. But actually, attention message really sent from UFP_D +device. + +After RD's comment, there may be BMC PHY Tx/Rx setting causes this issue. + +Below's the detailed TCPM log and DP attention message didn't received from 6360 +TCPCI. +[ 1206.367775] Identity: 0000:0000.0000 +[ 1206.416570] Alternate mode 0: SVID 0xff01, VDO 1: 0x00000405 +[ 1206.447378] AMS DFP_TO_UFP_ENTER_MODE start +[ 1206.447383] PD TX, header: 0x1d6f +[ 1206.449393] PD TX complete, status: 0 +[ 1206.454110] PD RX, header: 0x184f [1] +[ 1206.456867] Rx VDM cmd 0xff018144 type 1 cmd 4 len 1 +[ 1206.456872] AMS DFP_TO_UFP_ENTER_MODE finished +[ 1206.456873] cc:=4 +[ 1206.473100] AMS STRUCTURED_VDMS start +[ 1206.473103] PD TX, header: 0x2f6f +[ 1206.475397] PD TX complete, status: 0 +[ 1206.480442] PD RX, header: 0x2a4f [1] +[ 1206.483145] Rx VDM cmd 0xff018150 type 1 cmd 16 len 2 +[ 1206.483150] AMS STRUCTURED_VDMS finished +[ 1206.483151] cc:=4 +[ 1206.505643] AMS STRUCTURED_VDMS start +[ 1206.505646] PD TX, header: 0x216f +[ 1206.507933] PD TX complete, status: 0 +[ 1206.512664] PD RX, header: 0x1c4f [1] +[ 1206.515456] Rx VDM cmd 0xff018151 type 1 cmd 17 len 1 +[ 1206.515460] AMS STRUCTURED_VDMS finished +[ 1206.515461] cc:=4 + +Fixes: e1aefcdd394fd ("usb typec: mt6360: Add support for mt6360 Type-C driver") +Cc: stable +Reported-by: Macpaul Lin +Tested-by: Macpaul Lin +Reviewed-by: Guenter Roeck +Acked-by: Heikki Krogerus +Signed-off-by: ChiYuan Huang +Signed-off-by: Fabien Parent +Link: https://lore.kernel.org/r/1652159580-30959-1-git-send-email-u0084500@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/typec/tcpm/tcpci_mt6360.c | 26 ++++++++++++++++++++++++++ + 1 file changed, 26 insertions(+) + +--- a/drivers/usb/typec/tcpm/tcpci_mt6360.c ++++ b/drivers/usb/typec/tcpm/tcpci_mt6360.c +@@ -15,6 +15,9 @@ + + #include "tcpci.h" + ++#define MT6360_REG_PHYCTRL1 0x80 ++#define MT6360_REG_PHYCTRL3 0x82 ++#define MT6360_REG_PHYCTRL7 0x86 + #define MT6360_REG_VCONNCTRL1 0x8C + #define MT6360_REG_MODECTRL2 0x8F + #define MT6360_REG_SWRESET 0xA0 +@@ -22,6 +25,8 @@ + #define MT6360_REG_DRPCTRL1 0xA2 + #define MT6360_REG_DRPCTRL2 0xA3 + #define MT6360_REG_I2CTORST 0xBF ++#define MT6360_REG_PHYCTRL11 0xCA ++#define MT6360_REG_RXCTRL1 0xCE + #define MT6360_REG_RXCTRL2 0xCF + #define MT6360_REG_CTDCTRL2 0xEC + +@@ -106,6 +111,27 @@ static int mt6360_tcpc_init(struct tcpci + if (ret) + return ret; + ++ /* BMC PHY */ ++ ret = mt6360_tcpc_write16(regmap, MT6360_REG_PHYCTRL1, 0x3A70); ++ if (ret) ++ return ret; ++ ++ ret = regmap_write(regmap, MT6360_REG_PHYCTRL3, 0x82); ++ if (ret) ++ return ret; ++ ++ ret = regmap_write(regmap, MT6360_REG_PHYCTRL7, 0x36); ++ if (ret) ++ return ret; ++ ++ ret = mt6360_tcpc_write16(regmap, MT6360_REG_PHYCTRL11, 0x3C60); ++ if (ret) ++ return ret; ++ ++ ret = regmap_write(regmap, MT6360_REG_RXCTRL1, 0xE8); ++ if (ret) ++ return ret; ++ + /* Set shipping mode off, AUTOIDLE on */ + return regmap_write(regmap, MT6360_REG_MODECTRL2, 0x7A); + } diff --git a/queue-5.15/writeback-avoid-skipping-inode-writeback.patch b/queue-5.15/writeback-avoid-skipping-inode-writeback.patch new file mode 100644 index 00000000000..8a1d594944e --- /dev/null +++ b/queue-5.15/writeback-avoid-skipping-inode-writeback.patch @@ -0,0 +1,68 @@ +From 846a3351ddfe4a86eede4bb26a205c3f38ef84d3 Mon Sep 17 00:00:00 2001 +From: Jing Xia +Date: Tue, 10 May 2022 10:35:14 +0800 +Subject: writeback: Avoid skipping inode writeback + +From: Jing Xia + +commit 846a3351ddfe4a86eede4bb26a205c3f38ef84d3 upstream. + +We have run into an issue that a task gets stuck in +balance_dirty_pages_ratelimited() when perform I/O stress testing. +The reason we observed is that an I_DIRTY_PAGES inode with lots +of dirty pages is in b_dirty_time list and standard background +writeback cannot writeback the inode. +After studing the relevant code, the following scenario may lead +to the issue: + +task1 task2 +----- ----- +fuse_flush + write_inode_now //in b_dirty_time + writeback_single_inode + __writeback_single_inode + fuse_write_end + filemap_dirty_folio + __xa_set_mark:PAGECACHE_TAG_DIRTY + lock inode->i_lock + if mapping tagged PAGECACHE_TAG_DIRTY + inode->i_state |= I_DIRTY_PAGES + unlock inode->i_lock + __mark_inode_dirty:I_DIRTY_PAGES + lock inode->i_lock + -was dirty,inode stays in + -b_dirty_time + unlock inode->i_lock + + if(!(inode->i_state & I_DIRTY_All)) + -not true,so nothing done + +This patch moves the dirty inode to b_dirty list when the inode +currently is not queued in b_io or b_more_io list at the end of +writeback_single_inode. + +Reviewed-by: Jan Kara +Reviewed-by: Christoph Hellwig +CC: stable@vger.kernel.org +Fixes: 0ae45f63d4ef ("vfs: add support for a lazytime mount option") +Signed-off-by: Jing Xia +Signed-off-by: Jan Kara +Link: https://lore.kernel.org/r/20220510023514.27399-1-jing.xia@unisoc.com +Signed-off-by: Greg Kroah-Hartman +--- + fs/fs-writeback.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/fs/fs-writeback.c ++++ b/fs/fs-writeback.c +@@ -1739,6 +1739,10 @@ static int writeback_single_inode(struct + */ + if (!(inode->i_state & I_DIRTY_ALL)) + inode_cgwb_move_to_attached(inode, wb); ++ else if (!(inode->i_state & I_SYNC_QUEUED) && ++ (inode->i_state & I_DIRTY)) ++ redirty_tail_locked(inode, wb); ++ + spin_unlock(&wb->list_lock); + inode_sync_complete(inode); + out: -- 2.47.3