From f08668f5872f56449eebfa2bd21de74c34f17a2f Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 16 May 2022 10:23:25 +0200 Subject: [PATCH] 5.17-stable patches added patches: arm-memremap-don-t-abuse-pfn_valid-to-ensure-presence-of-linear-map.patch ath11k-reduce-the-wait-time-of-11d-scan-and-hw-scan-while-add-interface.patch ceph-fix-setting-of-xattrs-on-async-created-inodes.patch cgroup-cpuset-remove-cpus_allowed-mems_allowed-setup-in-cpuset_init_smp.patch drm-nouveau-tegra-stop-using-iommu_present.patch drm-vmwgfx-disable-command-buffers-on-svga3-without-gbobjects.patch fsl_lpuart-don-t-enable-interrupts-too-early.patch genirq-remove-warn_on_once-in-generic_handle_domain_irq.patch i40e-i40e_main-fix-a-missing-check-on-list-iterator.patch mm-huge_memory-do-not-overkill-when-splitting-huge_zero_page.patch mm-mremap-fix-sign-for-efault-error-return-value.patch net-atlantic-always-deep-reset-on-pm-op-fixing-up-my-null-deref-regression.patch net-phy-fix-race-condition-on-link-status-change.patch net-phy-micrel-do-not-use-kszphy_suspend-resume-for-ksz8061.patch net-phy-micrel-pass-.probe-for-ks8737.patch ping-fix-address-binding-wrt-vrf.patch revert-mm-memory-failure.c-skip-huge_zero_page-in-memory_failure.patch serial-8250_mtk-fix-register-address-for-xon-xoff-character.patch serial-8250_mtk-fix-uart_efr-register-address.patch serial-8250_mtk-make-sure-to-select-the-right-feature_sel.patch slimbus-qcom-fix-irq-check-in-qcom_slim_probe.patch sunrpc-ensure-that-the-gssproxy-client-can-start-in-a-connected-state.patch usb-serial-option-add-fibocom-l610-modem.patch usb-serial-option-add-fibocom-ma510-modem.patch usb-serial-pl2303-add-device-id-for-hp-lm930-display.patch usb-serial-qcserial-add-support-for-sierra-wireless-em7590.patch usb-typec-tcpci-don-t-skip-cleanup-in-.remove-on-error.patch usb-typec-tcpci_mt6360-update-for-bmc-phy-setting.patch writeback-avoid-skipping-inode-writeback.patch --- ...lid-to-ensure-presence-of-linear-map.patch | 117 +++++ ...scan-and-hw-scan-while-add-interface.patch | 410 ++++++++++++++++++ ...ng-of-xattrs-on-async-created-inodes.patch | 62 +++ ...ems_allowed-setup-in-cpuset_init_smp.patch | 73 ++++ ...uveau-tegra-stop-using-iommu_present.patch | 35 ++ ...d-buffers-on-svga3-without-gbobjects.patch | 51 +++ ...rt-don-t-enable-interrupts-too-early.patch | 72 +++ ...on_once-in-generic_handle_domain_irq.patch | 65 +++ ...fix-a-missing-check-on-list-iterator.patch | 92 ++++ ...erkill-when-splitting-huge_zero_page.patch | 94 ++++ ...x-sign-for-efault-error-return-value.patch | 39 ++ ...p-fixing-up-my-null-deref-regression.patch | 62 +++ ...race-condition-on-link-status-change.patch | 99 +++++ ...se-kszphy_suspend-resume-for-ksz8061.patch | 62 +++ ...et-phy-micrel-pass-.probe-for-ks8737.patch | 41 ++ .../ping-fix-address-binding-wrt-vrf.patch | 71 +++ ...kip-huge_zero_page-in-memory_failure.patch | 83 ++++ ...ister-address-for-xon-xoff-character.patch | 44 ++ ...50_mtk-fix-uart_efr-register-address.patch | 92 ++++ ...sure-to-select-the-right-feature_sel.patch | 44 ++ queue-5.17/series | 29 ++ ...com-fix-irq-check-in-qcom_slim_probe.patch | 43 ++ ...lient-can-start-in-a-connected-state.patch | 106 +++++ ...serial-option-add-fibocom-l610-modem.patch | 141 ++++++ ...erial-option-add-fibocom-ma510-modem.patch | 117 +++++ ...3-add-device-id-for-hp-lm930-display.patch | 41 ++ ...d-support-for-sierra-wireless-em7590.patch | 31 ++ ...n-t-skip-cleanup-in-.remove-on-error.patch | 53 +++ ...ci_mt6360-update-for-bmc-phy-setting.patch | 106 +++++ ...eback-avoid-skipping-inode-writeback.patch | 68 +++ 30 files changed, 2443 insertions(+) create mode 100644 queue-5.17/arm-memremap-don-t-abuse-pfn_valid-to-ensure-presence-of-linear-map.patch create mode 100644 queue-5.17/ath11k-reduce-the-wait-time-of-11d-scan-and-hw-scan-while-add-interface.patch create mode 100644 queue-5.17/ceph-fix-setting-of-xattrs-on-async-created-inodes.patch create mode 100644 queue-5.17/cgroup-cpuset-remove-cpus_allowed-mems_allowed-setup-in-cpuset_init_smp.patch create mode 100644 queue-5.17/drm-nouveau-tegra-stop-using-iommu_present.patch create mode 100644 queue-5.17/drm-vmwgfx-disable-command-buffers-on-svga3-without-gbobjects.patch create mode 100644 queue-5.17/fsl_lpuart-don-t-enable-interrupts-too-early.patch create mode 100644 queue-5.17/genirq-remove-warn_on_once-in-generic_handle_domain_irq.patch create mode 100644 queue-5.17/i40e-i40e_main-fix-a-missing-check-on-list-iterator.patch create mode 100644 queue-5.17/mm-huge_memory-do-not-overkill-when-splitting-huge_zero_page.patch create mode 100644 queue-5.17/mm-mremap-fix-sign-for-efault-error-return-value.patch create mode 100644 queue-5.17/net-atlantic-always-deep-reset-on-pm-op-fixing-up-my-null-deref-regression.patch create mode 100644 queue-5.17/net-phy-fix-race-condition-on-link-status-change.patch create mode 100644 queue-5.17/net-phy-micrel-do-not-use-kszphy_suspend-resume-for-ksz8061.patch create mode 100644 queue-5.17/net-phy-micrel-pass-.probe-for-ks8737.patch create mode 100644 queue-5.17/ping-fix-address-binding-wrt-vrf.patch create mode 100644 queue-5.17/revert-mm-memory-failure.c-skip-huge_zero_page-in-memory_failure.patch create mode 100644 queue-5.17/serial-8250_mtk-fix-register-address-for-xon-xoff-character.patch create mode 100644 queue-5.17/serial-8250_mtk-fix-uart_efr-register-address.patch create mode 100644 queue-5.17/serial-8250_mtk-make-sure-to-select-the-right-feature_sel.patch create mode 100644 queue-5.17/slimbus-qcom-fix-irq-check-in-qcom_slim_probe.patch create mode 100644 queue-5.17/sunrpc-ensure-that-the-gssproxy-client-can-start-in-a-connected-state.patch create mode 100644 queue-5.17/usb-serial-option-add-fibocom-l610-modem.patch create mode 100644 queue-5.17/usb-serial-option-add-fibocom-ma510-modem.patch create mode 100644 queue-5.17/usb-serial-pl2303-add-device-id-for-hp-lm930-display.patch create mode 100644 queue-5.17/usb-serial-qcserial-add-support-for-sierra-wireless-em7590.patch create mode 100644 queue-5.17/usb-typec-tcpci-don-t-skip-cleanup-in-.remove-on-error.patch create mode 100644 queue-5.17/usb-typec-tcpci_mt6360-update-for-bmc-phy-setting.patch create mode 100644 queue-5.17/writeback-avoid-skipping-inode-writeback.patch diff --git a/queue-5.17/arm-memremap-don-t-abuse-pfn_valid-to-ensure-presence-of-linear-map.patch b/queue-5.17/arm-memremap-don-t-abuse-pfn_valid-to-ensure-presence-of-linear-map.patch new file mode 100644 index 00000000000..7ba4b7f2fd6 --- /dev/null +++ b/queue-5.17/arm-memremap-don-t-abuse-pfn_valid-to-ensure-presence-of-linear-map.patch @@ -0,0 +1,117 @@ +From 260364d112bc822005224667c0c9b1b17a53eafd Mon Sep 17 00:00:00 2001 +From: Mike Rapoport +Date: Mon, 9 May 2022 17:34:28 -0700 +Subject: arm[64]/memremap: don't abuse pfn_valid() to ensure presence of linear map + +From: Mike Rapoport + +commit 260364d112bc822005224667c0c9b1b17a53eafd upstream. + +The semantics of pfn_valid() is to check presence of the memory map for a +PFN and not whether a PFN is covered by the linear map. The memory map +may be present for NOMAP memory regions, but they won't be mapped in the +linear mapping. Accessing such regions via __va() when they are +memremap()'ed will cause a crash. + +On v5.4.y the crash happens on qemu-arm with UEFI [1]: + +<1>[ 0.084476] 8<--- cut here --- +<1>[ 0.084595] Unable to handle kernel paging request at virtual address dfb76000 +<1>[ 0.084938] pgd = (ptrval) +<1>[ 0.085038] [dfb76000] *pgd=5f7fe801, *pte=00000000, *ppte=00000000 + +... + +<4>[ 0.093923] [] (memcpy) from [] (dmi_setup+0x60/0x418) +<4>[ 0.094204] [] (dmi_setup) from [] (arm_dmi_init+0x8/0x10) +<4>[ 0.094408] [] (arm_dmi_init) from [] (do_one_initcall+0x50/0x228) +<4>[ 0.094619] [] (do_one_initcall) from [] (kernel_init_freeable+0x15c/0x1f8) +<4>[ 0.094841] [] (kernel_init_freeable) from [] (kernel_init+0x8/0x10c) +<4>[ 0.095057] [] (kernel_init) from [] (ret_from_fork+0x14/0x2c) + +On kernels v5.10.y and newer the same crash won't reproduce on ARM because +commit b10d6bca8720 ("arch, drivers: replace for_each_membock() with +for_each_mem_range()") changed the way memory regions are registered in +the resource tree, but that merely covers up the problem. + +On ARM64 memory resources registered in yet another way and there the +issue of wrong usage of pfn_valid() to ensure availability of the linear +map is also covered. + +Implement arch_memremap_can_ram_remap() on ARM and ARM64 to prevent access +to NOMAP regions via the linear mapping in memremap(). + +Link: https://lore.kernel.org/all/Yl65zxGgFzF1Okac@sirena.org.uk +Link: https://lkml.kernel.org/r/20220426060107.7618-1-rppt@kernel.org +Signed-off-by: Mike Rapoport +Reported-by: "kernelci.org bot" +Tested-by: Mark Brown +Reviewed-by: Ard Biesheuvel +Acked-by: Catalin Marinas +Cc: Greg Kroah-Hartman +Cc: Mark Brown +Cc: Mark-PK Tsai +Cc: Russell King +Cc: Tony Lindgren +Cc: Will Deacon +Cc: [5.4+] +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/include/asm/io.h | 3 +++ + arch/arm/mm/ioremap.c | 8 ++++++++ + arch/arm64/include/asm/io.h | 4 ++++ + arch/arm64/mm/ioremap.c | 8 ++++++++ + 4 files changed, 23 insertions(+) + +--- a/arch/arm/include/asm/io.h ++++ b/arch/arm/include/asm/io.h +@@ -440,6 +440,9 @@ extern void pci_iounmap(struct pci_dev * + #define ARCH_HAS_VALID_PHYS_ADDR_RANGE + extern int valid_phys_addr_range(phys_addr_t addr, size_t size); + extern int valid_mmap_phys_addr_range(unsigned long pfn, size_t size); ++extern bool arch_memremap_can_ram_remap(resource_size_t offset, size_t size, ++ unsigned long flags); ++#define arch_memremap_can_ram_remap arch_memremap_can_ram_remap + #endif + + /* +--- a/arch/arm/mm/ioremap.c ++++ b/arch/arm/mm/ioremap.c +@@ -489,3 +489,11 @@ void __init early_ioremap_init(void) + { + early_ioremap_setup(); + } ++ ++bool arch_memremap_can_ram_remap(resource_size_t offset, size_t size, ++ unsigned long flags) ++{ ++ unsigned long pfn = PHYS_PFN(offset); ++ ++ return memblock_is_map_memory(pfn); ++} +--- a/arch/arm64/include/asm/io.h ++++ b/arch/arm64/include/asm/io.h +@@ -192,4 +192,8 @@ extern void __iomem *ioremap_cache(phys_ + extern int valid_phys_addr_range(phys_addr_t addr, size_t size); + extern int valid_mmap_phys_addr_range(unsigned long pfn, size_t size); + ++extern bool arch_memremap_can_ram_remap(resource_size_t offset, size_t size, ++ unsigned long flags); ++#define arch_memremap_can_ram_remap arch_memremap_can_ram_remap ++ + #endif /* __ASM_IO_H */ +--- a/arch/arm64/mm/ioremap.c ++++ b/arch/arm64/mm/ioremap.c +@@ -99,3 +99,11 @@ void __init early_ioremap_init(void) + { + early_ioremap_setup(); + } ++ ++bool arch_memremap_can_ram_remap(resource_size_t offset, size_t size, ++ unsigned long flags) ++{ ++ unsigned long pfn = PHYS_PFN(offset); ++ ++ return pfn_is_map_memory(pfn); ++} diff --git a/queue-5.17/ath11k-reduce-the-wait-time-of-11d-scan-and-hw-scan-while-add-interface.patch b/queue-5.17/ath11k-reduce-the-wait-time-of-11d-scan-and-hw-scan-while-add-interface.patch new file mode 100644 index 00000000000..2de7b5f34b7 --- /dev/null +++ b/queue-5.17/ath11k-reduce-the-wait-time-of-11d-scan-and-hw-scan-while-add-interface.patch @@ -0,0 +1,410 @@ +From bb300130e47fcefbe938f06dbacaef0312e28416 Mon Sep 17 00:00:00 2001 +From: Wen Gong +Date: Wed, 27 Apr 2022 14:16:19 +0300 +Subject: ath11k: reduce the wait time of 11d scan and hw scan while add interface + +From: Wen Gong + +commit bb300130e47fcefbe938f06dbacaef0312e28416 upstream. + +(cherry picked from commit 1f682dc9fb3790aa7ec27d3d122ff32b1eda1365 in wireless-next) + +Currently ath11k will wait 11d scan complete while add interface in +ath11k_mac_op_add_interface(), when system resume without enable +wowlan, ath11k_mac_op_add_interface() is called for each resume, thus +it increase the resume time of system. And ath11k_mac_op_hw_scan() +after ath11k_mac_op_add_interface() also needs some time cost because +the previous 11d scan need more than 5 seconds when 6 GHz is enabled, +then the scan started event will indicated to ath11k after the 11d +scan completed. + +While 11d scan/hw scan is running in firmware, if ath11k update channel +list to firmware by WMI_SCAN_CHAN_LIST_CMDID, then firmware will cancel +the current scan which is running, it lead the scan failed. The patch +commit 9dcf6808b253 ("ath11k: add 11d scan offload support") used +finish_11d_scan/finish_11d_ch_list/pending_11d to synchronize the 11d +scan/hw scan/channel list between ath11k/firmware/mac80211 and to avoid +the scan fail. + +Add wait operation before ath11k update channel list, function +ath11k_reg_update_chan_list() will wait until the current 11d scan/hw +scan completed. And remove the wait operation of start 11d scan and +waiting channel list complete in hw scan. After these changes, resume +time cost reduce about 5 seconds and also hw scan time cost reduced +obviously, and scan failed not seen. + +The 11d scan is sent to firmware only one time for each interface added +in mac.c, and it is moved after the 1st hw scan because 11d scan will +cost some time and thus leads the AP scan result update to UI delay. +Currently priority of ath11k's hw scan is WMI_SCAN_PRIORITY_LOW, and +priority of 11d scan in firmware is WMI_SCAN_PRIORITY_MEDIUM, then the +11d scan which sent after hw scan will cancel the hw scan in firmware, +so change the priority to WMI_SCAN_PRIORITY_MEDIUM for the hw scan which +is in front of the 11d scan, thus it will not happen scan cancel in +firmware. + +Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3 + +Fixes: 9dcf6808b253 ("ath11k: add 11d scan offload support") +Link: https://bugzilla.kernel.org/show_bug.cgi?id=215777 +Cc: +Signed-off-by: Wen Gong +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20220328035832.14122-1-quic_wgong@quicinc.com +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20220427111619.9758-1-kvalo@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/ath/ath11k/core.c | 1 + drivers/net/wireless/ath/ath11k/core.h | 13 ++++-- + drivers/net/wireless/ath/ath11k/mac.c | 71 +++++++++++++-------------------- + drivers/net/wireless/ath/ath11k/mac.h | 2 + drivers/net/wireless/ath/ath11k/reg.c | 43 +++++++++++++------ + drivers/net/wireless/ath/ath11k/reg.h | 2 + drivers/net/wireless/ath/ath11k/wmi.c | 16 ++++++- + 7 files changed, 84 insertions(+), 64 deletions(-) + +--- a/drivers/net/wireless/ath/ath11k/core.c ++++ b/drivers/net/wireless/ath/ath11k/core.c +@@ -1275,6 +1275,7 @@ static void ath11k_core_restart(struct w + + ieee80211_stop_queues(ar->hw); + ath11k_mac_drain_tx(ar); ++ complete(&ar->completed_11d_scan); + complete(&ar->scan.started); + complete(&ar->scan.completed); + complete(&ar->peer_assoc_done); +--- a/drivers/net/wireless/ath/ath11k/core.h ++++ b/drivers/net/wireless/ath/ath11k/core.h +@@ -38,6 +38,8 @@ + + extern unsigned int ath11k_frame_mode; + ++#define ATH11K_SCAN_TIMEOUT_HZ (20 * HZ) ++ + #define ATH11K_MON_TIMER_INTERVAL 10 + + enum ath11k_supported_bw { +@@ -189,6 +191,12 @@ enum ath11k_scan_state { + ATH11K_SCAN_ABORTING, + }; + ++enum ath11k_11d_state { ++ ATH11K_11D_IDLE, ++ ATH11K_11D_PREPARING, ++ ATH11K_11D_RUNNING, ++}; ++ + enum ath11k_dev_flags { + ATH11K_CAC_RUNNING, + ATH11K_FLAG_CORE_REGISTERED, +@@ -599,9 +607,8 @@ struct ath11k { + bool dfs_block_radar_events; + struct ath11k_thermal thermal; + u32 vdev_id_11d_scan; +- struct completion finish_11d_scan; +- struct completion finish_11d_ch_list; +- bool pending_11d; ++ struct completion completed_11d_scan; ++ enum ath11k_11d_state state_11d; + bool regdom_set_by_user; + }; + +--- a/drivers/net/wireless/ath/ath11k/mac.c ++++ b/drivers/net/wireless/ath/ath11k/mac.c +@@ -3596,26 +3596,6 @@ static int ath11k_mac_op_hw_scan(struct + if (ret) + goto exit; + +- /* Currently the pending_11d=true only happened 1 time while +- * wlan interface up in ath11k_mac_11d_scan_start(), it is called by +- * ath11k_mac_op_add_interface(), after wlan interface up, +- * pending_11d=false always. +- * If remove below wait, it always happened scan fail and lead connect +- * fail while wlan interface up, because it has a 11d scan which is running +- * in firmware, and lead this scan failed. +- */ +- if (ar->pending_11d) { +- long time_left; +- unsigned long timeout = 5 * HZ; +- +- if (ar->supports_6ghz) +- timeout += 5 * HZ; +- +- time_left = wait_for_completion_timeout(&ar->finish_11d_ch_list, timeout); +- ath11k_dbg(ar->ab, ATH11K_DBG_MAC, +- "mac wait 11d channel list time left %ld\n", time_left); +- } +- + memset(&arg, 0, sizeof(arg)); + ath11k_wmi_start_scan_init(ar, &arg); + arg.vdev_id = arvif->vdev_id; +@@ -3681,6 +3661,10 @@ exit: + kfree(arg.extraie.ptr); + + mutex_unlock(&ar->conf_mutex); ++ ++ if (ar->state_11d == ATH11K_11D_PREPARING) ++ ath11k_mac_11d_scan_start(ar, arvif->vdev_id); ++ + return ret; + } + +@@ -5809,7 +5793,7 @@ static int ath11k_mac_op_start(struct ie + + /* TODO: Do we need to enable ANI? */ + +- ath11k_reg_update_chan_list(ar); ++ ath11k_reg_update_chan_list(ar, false); + + ar->num_started_vdevs = 0; + ar->num_created_vdevs = 0; +@@ -5876,6 +5860,11 @@ static void ath11k_mac_op_stop(struct ie + cancel_work_sync(&ar->ab->update_11d_work); + cancel_work_sync(&ar->ab->rfkill_work); + ++ if (ar->state_11d == ATH11K_11D_PREPARING) { ++ ar->state_11d = ATH11K_11D_IDLE; ++ complete(&ar->completed_11d_scan); ++ } ++ + spin_lock_bh(&ar->data_lock); + list_for_each_entry_safe(ppdu_stats, tmp, &ar->ppdu_stats_info, list) { + list_del(&ppdu_stats->list); +@@ -6046,7 +6035,7 @@ static bool ath11k_mac_vif_ap_active_any + return false; + } + +-void ath11k_mac_11d_scan_start(struct ath11k *ar, u32 vdev_id, bool wait) ++void ath11k_mac_11d_scan_start(struct ath11k *ar, u32 vdev_id) + { + struct wmi_11d_scan_start_params param; + int ret; +@@ -6074,28 +6063,22 @@ void ath11k_mac_11d_scan_start(struct at + + ath11k_dbg(ar->ab, ATH11K_DBG_MAC, "mac start 11d scan\n"); + +- if (wait) +- reinit_completion(&ar->finish_11d_scan); +- + ret = ath11k_wmi_send_11d_scan_start_cmd(ar, ¶m); + if (ret) { + ath11k_warn(ar->ab, "failed to start 11d scan vdev %d ret: %d\n", + vdev_id, ret); + } else { + ar->vdev_id_11d_scan = vdev_id; +- if (wait) { +- ar->pending_11d = true; +- ret = wait_for_completion_timeout(&ar->finish_11d_scan, +- 5 * HZ); +- ath11k_dbg(ar->ab, ATH11K_DBG_MAC, +- "mac 11d scan left time %d\n", ret); +- +- if (!ret) +- ar->pending_11d = false; +- } ++ if (ar->state_11d == ATH11K_11D_PREPARING) ++ ar->state_11d = ATH11K_11D_RUNNING; + } + + fin: ++ if (ar->state_11d == ATH11K_11D_PREPARING) { ++ ar->state_11d = ATH11K_11D_IDLE; ++ complete(&ar->completed_11d_scan); ++ } ++ + mutex_unlock(&ar->ab->vdev_id_11d_lock); + } + +@@ -6118,12 +6101,15 @@ void ath11k_mac_11d_scan_stop(struct ath + vdev_id = ar->vdev_id_11d_scan; + + ret = ath11k_wmi_send_11d_scan_stop_cmd(ar, vdev_id); +- if (ret) ++ if (ret) { + ath11k_warn(ar->ab, + "failed to stopt 11d scan vdev %d ret: %d\n", + vdev_id, ret); +- else ++ } else { + ar->vdev_id_11d_scan = ATH11K_11D_INVALID_VDEV_ID; ++ ar->state_11d = ATH11K_11D_IDLE; ++ complete(&ar->completed_11d_scan); ++ } + } + mutex_unlock(&ar->ab->vdev_id_11d_lock); + } +@@ -6319,8 +6305,10 @@ static int ath11k_mac_op_add_interface(s + goto err_peer_del; + } + +- ath11k_mac_11d_scan_start(ar, arvif->vdev_id, true); +- ++ if (test_bit(WMI_TLV_SERVICE_11D_OFFLOAD, ab->wmi_ab.svc_map)) { ++ reinit_completion(&ar->completed_11d_scan); ++ ar->state_11d = ATH11K_11D_PREPARING; ++ } + break; + case WMI_VDEV_TYPE_MONITOR: + set_bit(ATH11K_FLAG_MONITOR_VDEV_CREATED, &ar->monitor_flags); +@@ -7144,7 +7132,7 @@ ath11k_mac_op_unassign_vif_chanctx(struc + } + + if (arvif->vdev_type == WMI_VDEV_TYPE_STA) +- ath11k_mac_11d_scan_start(ar, arvif->vdev_id, false); ++ ath11k_mac_11d_scan_start(ar, arvif->vdev_id); + + mutex_unlock(&ar->conf_mutex); + } +@@ -8625,8 +8613,7 @@ int ath11k_mac_allocate(struct ath11k_ba + ar->monitor_vdev_id = -1; + clear_bit(ATH11K_FLAG_MONITOR_VDEV_CREATED, &ar->monitor_flags); + ar->vdev_id_11d_scan = ATH11K_11D_INVALID_VDEV_ID; +- init_completion(&ar->finish_11d_scan); +- init_completion(&ar->finish_11d_ch_list); ++ init_completion(&ar->completed_11d_scan); + } + + return 0; +--- a/drivers/net/wireless/ath/ath11k/mac.h ++++ b/drivers/net/wireless/ath/ath11k/mac.h +@@ -130,7 +130,7 @@ extern const struct htt_rx_ring_tlv_filt + #define ATH11K_SCAN_11D_INTERVAL 600000 + #define ATH11K_11D_INVALID_VDEV_ID 0xFFFF + +-void ath11k_mac_11d_scan_start(struct ath11k *ar, u32 vdev_id, bool wait); ++void ath11k_mac_11d_scan_start(struct ath11k *ar, u32 vdev_id); + void ath11k_mac_11d_scan_stop(struct ath11k *ar); + void ath11k_mac_11d_scan_stop_all(struct ath11k_base *ab); + +--- a/drivers/net/wireless/ath/ath11k/reg.c ++++ b/drivers/net/wireless/ath/ath11k/reg.c +@@ -93,7 +93,7 @@ ath11k_reg_notifier(struct wiphy *wiphy, + ar->regdom_set_by_user = true; + } + +-int ath11k_reg_update_chan_list(struct ath11k *ar) ++int ath11k_reg_update_chan_list(struct ath11k *ar, bool wait) + { + struct ieee80211_supported_band **bands; + struct scan_chan_list_params *params; +@@ -102,7 +102,32 @@ int ath11k_reg_update_chan_list(struct a + struct channel_param *ch; + enum nl80211_band band; + int num_channels = 0; +- int i, ret; ++ int i, ret, left; ++ ++ if (wait && ar->state_11d != ATH11K_11D_IDLE) { ++ left = wait_for_completion_timeout(&ar->completed_11d_scan, ++ ATH11K_SCAN_TIMEOUT_HZ); ++ if (!left) { ++ ath11k_dbg(ar->ab, ATH11K_DBG_REG, ++ "failed to receive 11d scan complete: timed out\n"); ++ ar->state_11d = ATH11K_11D_IDLE; ++ } ++ ath11k_dbg(ar->ab, ATH11K_DBG_REG, ++ "reg 11d scan wait left time %d\n", left); ++ } ++ ++ if (wait && ++ (ar->scan.state == ATH11K_SCAN_STARTING || ++ ar->scan.state == ATH11K_SCAN_RUNNING)) { ++ left = wait_for_completion_timeout(&ar->scan.completed, ++ ATH11K_SCAN_TIMEOUT_HZ); ++ if (!left) ++ ath11k_dbg(ar->ab, ATH11K_DBG_REG, ++ "failed to receive hw scan complete: timed out\n"); ++ ++ ath11k_dbg(ar->ab, ATH11K_DBG_REG, ++ "reg hw scan wait left time %d\n", left); ++ } + + bands = hw->wiphy->bands; + for (band = 0; band < NUM_NL80211_BANDS; band++) { +@@ -184,11 +209,6 @@ int ath11k_reg_update_chan_list(struct a + ret = ath11k_wmi_send_scan_chan_list_cmd(ar, params); + kfree(params); + +- if (ar->pending_11d) { +- complete(&ar->finish_11d_ch_list); +- ar->pending_11d = false; +- } +- + return ret; + } + +@@ -254,15 +274,8 @@ int ath11k_regd_update(struct ath11k *ar + goto err; + } + +- if (ar->pending_11d) +- complete(&ar->finish_11d_scan); +- + rtnl_lock(); + wiphy_lock(ar->hw->wiphy); +- +- if (ar->pending_11d) +- reinit_completion(&ar->finish_11d_ch_list); +- + ret = regulatory_set_wiphy_regd_sync(ar->hw->wiphy, regd_copy); + wiphy_unlock(ar->hw->wiphy); + rtnl_unlock(); +@@ -273,7 +286,7 @@ int ath11k_regd_update(struct ath11k *ar + goto err; + + if (ar->state == ATH11K_STATE_ON) { +- ret = ath11k_reg_update_chan_list(ar); ++ ret = ath11k_reg_update_chan_list(ar, true); + if (ret) + goto err; + } +--- a/drivers/net/wireless/ath/ath11k/reg.h ++++ b/drivers/net/wireless/ath/ath11k/reg.h +@@ -32,5 +32,5 @@ struct ieee80211_regdomain * + ath11k_reg_build_regd(struct ath11k_base *ab, + struct cur_regulatory_info *reg_info, bool intersect); + int ath11k_regd_update(struct ath11k *ar); +-int ath11k_reg_update_chan_list(struct ath11k *ar); ++int ath11k_reg_update_chan_list(struct ath11k *ar, bool wait); + #endif +--- a/drivers/net/wireless/ath/ath11k/wmi.c ++++ b/drivers/net/wireless/ath/ath11k/wmi.c +@@ -2013,7 +2013,10 @@ void ath11k_wmi_start_scan_init(struct a + { + /* setup commonly used values */ + arg->scan_req_id = 1; +- arg->scan_priority = WMI_SCAN_PRIORITY_LOW; ++ if (ar->state_11d == ATH11K_11D_PREPARING) ++ arg->scan_priority = WMI_SCAN_PRIORITY_MEDIUM; ++ else ++ arg->scan_priority = WMI_SCAN_PRIORITY_LOW; + arg->dwell_time_active = 50; + arg->dwell_time_active_2g = 0; + arg->dwell_time_passive = 150; +@@ -6177,8 +6180,10 @@ static void ath11k_wmi_op_ep_tx_credits( + static int ath11k_reg_11d_new_cc_event(struct ath11k_base *ab, struct sk_buff *skb) + { + const struct wmi_11d_new_cc_ev *ev; ++ struct ath11k *ar; ++ struct ath11k_pdev *pdev; + const void **tb; +- int ret; ++ int ret, i; + + tb = ath11k_wmi_tlv_parse_alloc(ab, skb->data, skb->len, GFP_ATOMIC); + if (IS_ERR(tb)) { +@@ -6204,6 +6209,13 @@ static int ath11k_reg_11d_new_cc_event(s + + kfree(tb); + ++ for (i = 0; i < ab->num_radios; i++) { ++ pdev = &ab->pdevs[i]; ++ ar = pdev->ar; ++ ar->state_11d = ATH11K_11D_IDLE; ++ complete(&ar->completed_11d_scan); ++ } ++ + queue_work(ab->workqueue, &ab->update_11d_work); + + return 0; diff --git a/queue-5.17/ceph-fix-setting-of-xattrs-on-async-created-inodes.patch b/queue-5.17/ceph-fix-setting-of-xattrs-on-async-created-inodes.patch new file mode 100644 index 00000000000..363ccacd86b --- /dev/null +++ b/queue-5.17/ceph-fix-setting-of-xattrs-on-async-created-inodes.patch @@ -0,0 +1,62 @@ +From 620239d9a32e9fe27c9204ec11e40058671aeeb6 Mon Sep 17 00:00:00 2001 +From: Jeff Layton +Date: Mon, 25 Apr 2022 15:54:27 -0400 +Subject: ceph: fix setting of xattrs on async created inodes + +From: Jeff Layton + +commit 620239d9a32e9fe27c9204ec11e40058671aeeb6 upstream. + +Currently when we create a file, we spin up an xattr buffer to send +along with the create request. If we end up doing an async create +however, then we currently pass down a zero-length xattr buffer. + +Fix the code to send down the xattr buffer in req->r_pagelist. If the +xattrs span more than a page, however give up and don't try to do an +async create. + +Cc: stable@vger.kernel.org +URL: https://bugzilla.redhat.com/show_bug.cgi?id=2063929 +Fixes: 9a8d03ca2e2c ("ceph: attempt to do async create when possible") +Reported-by: John Fortin +Reported-by: Sri Ramanujam +Signed-off-by: Jeff Layton +Reviewed-by: Xiubo Li +Signed-off-by: Ilya Dryomov +Signed-off-by: Greg Kroah-Hartman +--- + fs/ceph/file.c | 16 +++++++++++++--- + 1 file changed, 13 insertions(+), 3 deletions(-) + +--- a/fs/ceph/file.c ++++ b/fs/ceph/file.c +@@ -598,9 +598,15 @@ static int ceph_finish_async_create(stru + iinfo.change_attr = 1; + ceph_encode_timespec64(&iinfo.btime, &now); + +- iinfo.xattr_len = ARRAY_SIZE(xattr_buf); +- iinfo.xattr_data = xattr_buf; +- memset(iinfo.xattr_data, 0, iinfo.xattr_len); ++ if (req->r_pagelist) { ++ iinfo.xattr_len = req->r_pagelist->length; ++ iinfo.xattr_data = req->r_pagelist->mapped_tail; ++ } else { ++ /* fake it */ ++ iinfo.xattr_len = ARRAY_SIZE(xattr_buf); ++ iinfo.xattr_data = xattr_buf; ++ memset(iinfo.xattr_data, 0, iinfo.xattr_len); ++ } + + in.ino = cpu_to_le64(vino.ino); + in.snapid = cpu_to_le64(CEPH_NOSNAP); +@@ -712,6 +718,10 @@ int ceph_atomic_open(struct inode *dir, + err = ceph_security_init_secctx(dentry, mode, &as_ctx); + if (err < 0) + goto out_ctx; ++ /* Async create can't handle more than a page of xattrs */ ++ if (as_ctx.pagelist && ++ !list_is_singular(&as_ctx.pagelist->head)) ++ try_async = false; + } else if (!d_in_lookup(dentry)) { + /* If it's not being looked up, it's negative */ + return -ENOENT; diff --git a/queue-5.17/cgroup-cpuset-remove-cpus_allowed-mems_allowed-setup-in-cpuset_init_smp.patch b/queue-5.17/cgroup-cpuset-remove-cpus_allowed-mems_allowed-setup-in-cpuset_init_smp.patch new file mode 100644 index 00000000000..aa135335d1d --- /dev/null +++ b/queue-5.17/cgroup-cpuset-remove-cpus_allowed-mems_allowed-setup-in-cpuset_init_smp.patch @@ -0,0 +1,73 @@ +From 2685027fca387b602ae565bff17895188b803988 Mon Sep 17 00:00:00 2001 +From: Waiman Long +Date: Wed, 27 Apr 2022 10:54:28 -0400 +Subject: cgroup/cpuset: Remove cpus_allowed/mems_allowed setup in cpuset_init_smp() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Waiman Long + +commit 2685027fca387b602ae565bff17895188b803988 upstream. + +There are 3 places where the cpu and node masks of the top cpuset can +be initialized in the order they are executed: + 1) start_kernel -> cpuset_init() + 2) start_kernel -> cgroup_init() -> cpuset_bind() + 3) kernel_init_freeable() -> do_basic_setup() -> cpuset_init_smp() + +The first cpuset_init() call just sets all the bits in the masks. +The second cpuset_bind() call sets cpus_allowed and mems_allowed to the +default v2 values. The third cpuset_init_smp() call sets them back to +v1 values. + +For systems with cgroup v2 setup, cpuset_bind() is called once. As a +result, cpu and memory node hot add may fail to update the cpu and node +masks of the top cpuset to include the newly added cpu or node in a +cgroup v2 environment. + +For systems with cgroup v1 setup, cpuset_bind() is called again by +rebind_subsystem() when the v1 cpuset filesystem is mounted as shown +in the dmesg log below with an instrumented kernel. + + [ 2.609781] cpuset_bind() called - v2 = 1 + [ 3.079473] cpuset_init_smp() called + [ 7.103710] cpuset_bind() called - v2 = 0 + +smp_init() is called after the first two init functions. So we don't +have a complete list of active cpus and memory nodes until later in +cpuset_init_smp() which is the right time to set up effective_cpus +and effective_mems. + +To fix this cgroup v2 mask setup problem, the potentially incorrect +cpus_allowed & mems_allowed setting in cpuset_init_smp() are removed. +For cgroup v2 systems, the initial cpuset_bind() call will set the masks +correctly. For cgroup v1 systems, the second call to cpuset_bind() +will do the right setup. + +cc: stable@vger.kernel.org +Signed-off-by: Waiman Long +Tested-by: Feng Tang +Reviewed-by: Michal Koutný +Signed-off-by: Tejun Heo +Signed-off-by: Greg Kroah-Hartman +--- + kernel/cgroup/cpuset.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/kernel/cgroup/cpuset.c ++++ b/kernel/cgroup/cpuset.c +@@ -3390,8 +3390,11 @@ static struct notifier_block cpuset_trac + */ + void __init cpuset_init_smp(void) + { +- cpumask_copy(top_cpuset.cpus_allowed, cpu_active_mask); +- top_cpuset.mems_allowed = node_states[N_MEMORY]; ++ /* ++ * cpus_allowd/mems_allowed set to v2 values in the initial ++ * cpuset_bind() call will be reset to v1 values in another ++ * cpuset_bind() call when v1 cpuset is mounted. ++ */ + top_cpuset.old_mems_allowed = top_cpuset.mems_allowed; + + cpumask_copy(top_cpuset.effective_cpus, cpu_active_mask); diff --git a/queue-5.17/drm-nouveau-tegra-stop-using-iommu_present.patch b/queue-5.17/drm-nouveau-tegra-stop-using-iommu_present.patch new file mode 100644 index 00000000000..209d6b7ee77 --- /dev/null +++ b/queue-5.17/drm-nouveau-tegra-stop-using-iommu_present.patch @@ -0,0 +1,35 @@ +From 87fd2b091fb33871a7f812658a0971e8e26f903f Mon Sep 17 00:00:00 2001 +From: Robin Murphy +Date: Tue, 5 Apr 2022 15:21:34 +0100 +Subject: drm/nouveau/tegra: Stop using iommu_present() + +From: Robin Murphy + +commit 87fd2b091fb33871a7f812658a0971e8e26f903f upstream. + +Even if some IOMMU has registered itself on the platform "bus", that +doesn't necessarily mean it provides translation for the device we +care about. Replace iommu_present() with a more appropriate check. + +Signed-off-by: Robin Murphy +Reviewed-by: Lyude Paul +[added cc for stable] +Signed-off-by: Lyude Paul +Cc: stable@vger.kernel.org # v5.0+ +Link: https://patchwork.freedesktop.org/patch/msgid/70d40ea441da3663c2824d54102b471e9a621f8a.1649168494.git.robin.murphy@arm.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/nouveau/nvkm/engine/device/tegra.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/nouveau/nvkm/engine/device/tegra.c ++++ b/drivers/gpu/drm/nouveau/nvkm/engine/device/tegra.c +@@ -123,7 +123,7 @@ nvkm_device_tegra_probe_iommu(struct nvk + + mutex_init(&tdev->iommu.mutex); + +- if (iommu_present(&platform_bus_type)) { ++ if (device_iommu_mapped(dev)) { + tdev->iommu.domain = iommu_domain_alloc(&platform_bus_type); + if (!tdev->iommu.domain) + goto error; diff --git a/queue-5.17/drm-vmwgfx-disable-command-buffers-on-svga3-without-gbobjects.patch b/queue-5.17/drm-vmwgfx-disable-command-buffers-on-svga3-without-gbobjects.patch new file mode 100644 index 00000000000..91a64303e8d --- /dev/null +++ b/queue-5.17/drm-vmwgfx-disable-command-buffers-on-svga3-without-gbobjects.patch @@ -0,0 +1,51 @@ +From 21d1d192890ced87f2f04f8f4dea92406e0b162a Mon Sep 17 00:00:00 2001 +From: Zack Rusin +Date: Fri, 18 Mar 2022 13:43:31 -0400 +Subject: drm/vmwgfx: Disable command buffers on svga3 without gbobjects + +From: Zack Rusin + +commit 21d1d192890ced87f2f04f8f4dea92406e0b162a upstream. + +With very limited vram on svga3 it's difficult to handle all the surface +migrations. Without gbobjects, i.e. the ability to store surfaces in +guest mobs, there's no reason to support intermediate svga2 features, +especially because we can fall back to fb traces and svga3 will never +support those in-between features. + +On svga3 we wither want to use fb traces or screen targets +(i.e. gbobjects), nothing in between. This fixes presentation on a lot +of fusion/esxi tech previews where the exposed svga3 caps haven't been +finalized yet. + +Signed-off-by: Zack Rusin +Fixes: 2cd80dbd3551 ("drm/vmwgfx: Add basic support for SVGA3") +Cc: # v5.14+ +Reviewed-by: Martin Krastev +Link: https://patchwork.freedesktop.org/patch/msgid/20220318174332.440068-5-zack@kde.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/vmwgfx/vmwgfx_cmd.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_cmd.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_cmd.c +@@ -675,11 +675,14 @@ int vmw_cmd_emit_dummy_query(struct vmw_ + */ + bool vmw_cmd_supported(struct vmw_private *vmw) + { +- if ((vmw->capabilities & (SVGA_CAP_COMMAND_BUFFERS | +- SVGA_CAP_CMD_BUFFERS_2)) != 0) +- return true; ++ bool has_cmdbufs = ++ (vmw->capabilities & (SVGA_CAP_COMMAND_BUFFERS | ++ SVGA_CAP_CMD_BUFFERS_2)) != 0; ++ if (vmw_is_svga_v3(vmw)) ++ return (has_cmdbufs && ++ (vmw->capabilities & SVGA_CAP_GBOBJECTS) != 0); + /* + * We have FIFO cmd's + */ +- return vmw->fifo_mem != NULL; ++ return has_cmdbufs || vmw->fifo_mem != NULL; + } diff --git a/queue-5.17/fsl_lpuart-don-t-enable-interrupts-too-early.patch b/queue-5.17/fsl_lpuart-don-t-enable-interrupts-too-early.patch new file mode 100644 index 00000000000..c4b2e280694 --- /dev/null +++ b/queue-5.17/fsl_lpuart-don-t-enable-interrupts-too-early.patch @@ -0,0 +1,72 @@ +From 401fb66a355eb0f22096cf26864324f8e63c7d78 Mon Sep 17 00:00:00 2001 +From: Indan Zupancic +Date: Thu, 5 May 2022 13:47:50 +0200 +Subject: fsl_lpuart: Don't enable interrupts too early + +From: Indan Zupancic + +commit 401fb66a355eb0f22096cf26864324f8e63c7d78 upstream. + +If an irq is pending when devm_request_irq() is called, the irq +handler will cause a NULL pointer access because initialisation +is not done yet. + +Fixes: 9d7ee0e28da59 ("tty: serial: lpuart: avoid report NULL interrupt") +Cc: stable +Signed-off-by: Indan Zupancic +Link: https://lore.kernel.org/r/20220505114750.45423-1-Indan.Zupancic@mep-info.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/serial/fsl_lpuart.c | 18 +++++++++--------- + 1 file changed, 9 insertions(+), 9 deletions(-) + +--- a/drivers/tty/serial/fsl_lpuart.c ++++ b/drivers/tty/serial/fsl_lpuart.c +@@ -2658,6 +2658,7 @@ static int lpuart_probe(struct platform_ + struct device_node *np = pdev->dev.of_node; + struct lpuart_port *sport; + struct resource *res; ++ irq_handler_t handler; + int ret; + + sport = devm_kzalloc(&pdev->dev, sizeof(*sport), GFP_KERNEL); +@@ -2735,17 +2736,11 @@ static int lpuart_probe(struct platform_ + + if (lpuart_is_32(sport)) { + lpuart_reg.cons = LPUART32_CONSOLE; +- ret = devm_request_irq(&pdev->dev, sport->port.irq, lpuart32_int, 0, +- DRIVER_NAME, sport); ++ handler = lpuart32_int; + } else { + lpuart_reg.cons = LPUART_CONSOLE; +- ret = devm_request_irq(&pdev->dev, sport->port.irq, lpuart_int, 0, +- DRIVER_NAME, sport); ++ handler = lpuart_int; + } +- +- if (ret) +- goto failed_irq_request; +- + ret = uart_add_one_port(&lpuart_reg, &sport->port); + if (ret) + goto failed_attach_port; +@@ -2767,13 +2762,18 @@ static int lpuart_probe(struct platform_ + + sport->port.rs485_config(&sport->port, &sport->port.rs485); + ++ ret = devm_request_irq(&pdev->dev, sport->port.irq, handler, 0, ++ DRIVER_NAME, sport); ++ if (ret) ++ goto failed_irq_request; ++ + return 0; + ++failed_irq_request: + failed_get_rs485: + failed_reset: + uart_remove_one_port(&lpuart_reg, &sport->port); + failed_attach_port: +-failed_irq_request: + lpuart_disable_clks(sport); + failed_clock_enable: + failed_out_of_range: diff --git a/queue-5.17/genirq-remove-warn_on_once-in-generic_handle_domain_irq.patch b/queue-5.17/genirq-remove-warn_on_once-in-generic_handle_domain_irq.patch new file mode 100644 index 00000000000..c21d11f4d43 --- /dev/null +++ b/queue-5.17/genirq-remove-warn_on_once-in-generic_handle_domain_irq.patch @@ -0,0 +1,65 @@ +From 792ea6a074ae7ea5ab6f1b8b31f76bb0297de66c Mon Sep 17 00:00:00 2001 +From: Lukas Wunner +Date: Tue, 10 May 2022 09:56:05 +0200 +Subject: genirq: Remove WARN_ON_ONCE() in generic_handle_domain_irq() + +From: Lukas Wunner + +commit 792ea6a074ae7ea5ab6f1b8b31f76bb0297de66c upstream. + +Since commit 0953fb263714 ("irq: remove handle_domain_{irq,nmi}()"), +generic_handle_domain_irq() warns if called outside hardirq context, even +though the function calls down to handle_irq_desc(), which warns about the +same, but conditionally on handle_enforce_irqctx(). + +The newly added warning is a false positive if the interrupt originates +from any other irqchip than x86 APIC or ARM GIC/GICv3. Those are the only +ones for which handle_enforce_irqctx() returns true. Per commit +c16816acd086 ("genirq: Add protection against unsafe usage of +generic_handle_irq()"): + + "In general calling generic_handle_irq() with interrupts disabled from non + interrupt context is harmless. For some interrupt controllers like the + x86 trainwrecks this is outright dangerous as it might corrupt state if + an interrupt affinity change is pending." + +Examples for interrupt chips where the warning is a false positive are +USB-attached GPIO controllers such as drivers/gpio/gpio-dln2.c: + + USB gadgets are incapable of directly signaling an interrupt because they + cannot initiate a bus transaction by themselves. All communication on + the bus is initiated by the host controller, which polls a gadget's + Interrupt Endpoint in regular intervals. If an interrupt is pending, + that information is passed up the stack in softirq context, from which a + hardirq is synthesized via generic_handle_domain_irq(). + +Remove the warning to eliminate such false positives. + +Fixes: 0953fb263714 ("irq: remove handle_domain_{irq,nmi}()") +Signed-off-by: Lukas Wunner +Signed-off-by: Thomas Gleixner +Cc: Marc Zyngier +Cc: Mark Rutland +Cc: Jakub Kicinski +CC: Linus Walleij +Cc: Bartosz Golaszewski +Cc: Octavian Purdila +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20220505113207.487861b2@kernel.org +Link: https://lore.kernel.org/r/20220506203242.GA1855@wunner.de +Link: https://lore.kernel.org/r/c3caf60bfa78e5fdbdf483096b7174da65d1813a.1652168866.git.lukas@wunner.de +Signed-off-by: Greg Kroah-Hartman +--- + kernel/irq/irqdesc.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/kernel/irq/irqdesc.c ++++ b/kernel/irq/irqdesc.c +@@ -678,7 +678,6 @@ EXPORT_SYMBOL_GPL(generic_handle_irq); + */ + int generic_handle_domain_irq(struct irq_domain *domain, unsigned int hwirq) + { +- WARN_ON_ONCE(!in_irq()); + return handle_irq_desc(irq_resolve_mapping(domain, hwirq)); + } + EXPORT_SYMBOL_GPL(generic_handle_domain_irq); diff --git a/queue-5.17/i40e-i40e_main-fix-a-missing-check-on-list-iterator.patch b/queue-5.17/i40e-i40e_main-fix-a-missing-check-on-list-iterator.patch new file mode 100644 index 00000000000..2104cf661cb --- /dev/null +++ b/queue-5.17/i40e-i40e_main-fix-a-missing-check-on-list-iterator.patch @@ -0,0 +1,92 @@ +From 3f95a7472d14abef284d8968734fe2ae7ff4845f Mon Sep 17 00:00:00 2001 +From: Xiaomeng Tong +Date: Tue, 10 May 2022 13:48:46 -0700 +Subject: i40e: i40e_main: fix a missing check on list iterator + +From: Xiaomeng Tong + +commit 3f95a7472d14abef284d8968734fe2ae7ff4845f upstream. + +The bug is here: + ret = i40e_add_macvlan_filter(hw, ch->seid, vdev->dev_addr, &aq_err); + +The list iterator 'ch' will point to a bogus position containing +HEAD if the list is empty or no element is found. This case must +be checked before any use of the iterator, otherwise it will +lead to a invalid memory access. + +To fix this bug, use a new variable 'iter' as the list iterator, +while use the origin variable 'ch' as a dedicated pointer to +point to the found element. + +Cc: stable@vger.kernel.org +Fixes: 1d8d80b4e4ff6 ("i40e: Add macvlan support on i40e") +Signed-off-by: Xiaomeng Tong +Tested-by: Gurucharan (A Contingent worker at Intel) +Signed-off-by: Tony Nguyen +Link: https://lore.kernel.org/r/20220510204846.2166999-1-anthony.l.nguyen@intel.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/i40e/i40e_main.c | 27 ++++++++++++++------------- + 1 file changed, 14 insertions(+), 13 deletions(-) + +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -7535,42 +7535,43 @@ static void i40e_free_macvlan_channels(s + static int i40e_fwd_ring_up(struct i40e_vsi *vsi, struct net_device *vdev, + struct i40e_fwd_adapter *fwd) + { ++ struct i40e_channel *ch = NULL, *ch_tmp, *iter; + int ret = 0, num_tc = 1, i, aq_err; +- struct i40e_channel *ch, *ch_tmp; + struct i40e_pf *pf = vsi->back; + struct i40e_hw *hw = &pf->hw; + +- if (list_empty(&vsi->macvlan_list)) +- return -EINVAL; +- + /* Go through the list and find an available channel */ +- list_for_each_entry_safe(ch, ch_tmp, &vsi->macvlan_list, list) { +- if (!i40e_is_channel_macvlan(ch)) { +- ch->fwd = fwd; ++ list_for_each_entry_safe(iter, ch_tmp, &vsi->macvlan_list, list) { ++ if (!i40e_is_channel_macvlan(iter)) { ++ iter->fwd = fwd; + /* record configuration for macvlan interface in vdev */ + for (i = 0; i < num_tc; i++) + netdev_bind_sb_channel_queue(vsi->netdev, vdev, + i, +- ch->num_queue_pairs, +- ch->base_queue); +- for (i = 0; i < ch->num_queue_pairs; i++) { ++ iter->num_queue_pairs, ++ iter->base_queue); ++ for (i = 0; i < iter->num_queue_pairs; i++) { + struct i40e_ring *tx_ring, *rx_ring; + u16 pf_q; + +- pf_q = ch->base_queue + i; ++ pf_q = iter->base_queue + i; + + /* Get to TX ring ptr */ + tx_ring = vsi->tx_rings[pf_q]; +- tx_ring->ch = ch; ++ tx_ring->ch = iter; + + /* Get the RX ring ptr */ + rx_ring = vsi->rx_rings[pf_q]; +- rx_ring->ch = ch; ++ rx_ring->ch = iter; + } ++ ch = iter; + break; + } + } + ++ if (!ch) ++ return -EINVAL; ++ + /* Guarantee all rings are updated before we update the + * MAC address filter. + */ diff --git a/queue-5.17/mm-huge_memory-do-not-overkill-when-splitting-huge_zero_page.patch b/queue-5.17/mm-huge_memory-do-not-overkill-when-splitting-huge_zero_page.patch new file mode 100644 index 00000000000..692af581649 --- /dev/null +++ b/queue-5.17/mm-huge_memory-do-not-overkill-when-splitting-huge_zero_page.patch @@ -0,0 +1,94 @@ +From 478d134e9506c7e9bfe2830ed03dd85e97966313 Mon Sep 17 00:00:00 2001 +From: Xu Yu +Date: Thu, 28 Apr 2022 23:14:43 -0700 +Subject: mm/huge_memory: do not overkill when splitting huge_zero_page + +From: Xu Yu + +commit 478d134e9506c7e9bfe2830ed03dd85e97966313 upstream. + +Kernel panic when injecting memory_failure for the global huge_zero_page, +when CONFIG_DEBUG_VM is enabled, as follows. + + Injecting memory failure for pfn 0x109ff9 at process virtual address 0x20ff9000 + page:00000000fb053fc3 refcount:2 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x109e00 + head:00000000fb053fc3 order:9 compound_mapcount:0 compound_pincount:0 + flags: 0x17fffc000010001(locked|head|node=0|zone=2|lastcpupid=0x1ffff) + raw: 017fffc000010001 0000000000000000 dead000000000122 0000000000000000 + raw: 0000000000000000 0000000000000000 00000002ffffffff 0000000000000000 + page dumped because: VM_BUG_ON_PAGE(is_huge_zero_page(head)) + ------------[ cut here ]------------ + kernel BUG at mm/huge_memory.c:2499! + invalid opcode: 0000 [#1] PREEMPT SMP PTI + CPU: 6 PID: 553 Comm: split_bug Not tainted 5.18.0-rc1+ #11 + Hardware name: Alibaba Cloud Alibaba Cloud ECS, BIOS 3288b3c 04/01/2014 + RIP: 0010:split_huge_page_to_list+0x66a/0x880 + Code: 84 9b fb ff ff 48 8b 7c 24 08 31 f6 e8 9f 5d 2a 00 b8 b8 02 00 00 e9 e8 fb ff ff 48 c7 c6 e8 47 3c 82 4c b + RSP: 0018:ffffc90000dcbdf8 EFLAGS: 00010246 + RAX: 000000000000003c RBX: 0000000000000001 RCX: 0000000000000000 + RDX: 0000000000000000 RSI: ffffffff823e4c4f RDI: 00000000ffffffff + RBP: ffff88843fffdb40 R08: 0000000000000000 R09: 00000000fffeffff + R10: ffffc90000dcbc48 R11: ffffffff82d68448 R12: ffffea0004278000 + R13: ffffffff823c6203 R14: 0000000000109ff9 R15: ffffea000427fe40 + FS: 00007fc375a26740(0000) GS:ffff88842fd80000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 00007fc3757c9290 CR3: 0000000102174006 CR4: 00000000003706e0 + DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 + DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 + Call Trace: + try_to_split_thp_page+0x3a/0x130 + memory_failure+0x128/0x800 + madvise_inject_error.cold+0x8b/0xa1 + __x64_sys_madvise+0x54/0x60 + do_syscall_64+0x35/0x80 + entry_SYSCALL_64_after_hwframe+0x44/0xae + RIP: 0033:0x7fc3754f8bf9 + Code: 01 00 48 81 c4 80 00 00 00 e9 f1 fe ff ff 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 8 + RSP: 002b:00007ffeda93a1d8 EFLAGS: 00000217 ORIG_RAX: 000000000000001c + RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc3754f8bf9 + RDX: 0000000000000064 RSI: 0000000000003000 RDI: 0000000020ff9000 + RBP: 00007ffeda93a200 R08: 0000000000000000 R09: 0000000000000000 + R10: 00000000ffffffff R11: 0000000000000217 R12: 0000000000400490 + R13: 00007ffeda93a2e0 R14: 0000000000000000 R15: 0000000000000000 + +We think that raising BUG is overkilling for splitting huge_zero_page, the +huge_zero_page can't be met from normal paths other than memory failure, +but memory failure is a valid caller. So we tend to replace the BUG to +WARN + returning -EBUSY, and thus the panic above won't happen again. + +Link: https://lkml.kernel.org/r/f35f8b97377d5d3ede1bc5ac3114da888c57cbce.1651052574.git.xuyu@linux.alibaba.com +Fixes: d173d5417fb6 ("mm/memory-failure.c: skip huge_zero_page in memory_failure()") +Fixes: 6a46079cf57a ("HWPOISON: The high level memory error handler in the VM v7") +Signed-off-by: Xu Yu +Suggested-by: Yang Shi +Reported-by: kernel test robot +Reviewed-by: Naoya Horiguchi +Reviewed-by: Yang Shi +Reviewed-by: Miaohe Lin +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + mm/huge_memory.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/mm/huge_memory.c ++++ b/mm/huge_memory.c +@@ -2609,11 +2609,16 @@ int split_huge_page_to_list(struct page + struct address_space *mapping = NULL; + int extra_pins, ret; + pgoff_t end; ++ bool is_hzp; + +- VM_BUG_ON_PAGE(is_huge_zero_page(head), head); + VM_BUG_ON_PAGE(!PageLocked(head), head); + VM_BUG_ON_PAGE(!PageCompound(head), head); + ++ is_hzp = is_huge_zero_page(head); ++ VM_WARN_ON_ONCE_PAGE(is_hzp, head); ++ if (is_hzp) ++ return -EBUSY; ++ + if (PageWriteback(head)) + return -EBUSY; + diff --git a/queue-5.17/mm-mremap-fix-sign-for-efault-error-return-value.patch b/queue-5.17/mm-mremap-fix-sign-for-efault-error-return-value.patch new file mode 100644 index 00000000000..af95d1be5f8 --- /dev/null +++ b/queue-5.17/mm-mremap-fix-sign-for-efault-error-return-value.patch @@ -0,0 +1,39 @@ +From 7d1e6496616275f3830e2f2f91fa69a66953e95b Mon Sep 17 00:00:00 2001 +From: Niels Dossche +Date: Mon, 9 May 2022 17:34:28 -0700 +Subject: mm: mremap: fix sign for EFAULT error return value + +From: Niels Dossche + +commit 7d1e6496616275f3830e2f2f91fa69a66953e95b upstream. + +The mremap syscall is supposed to return a pointer to the new virtual +memory area on success, and a negative value of the error code in case of +failure. Currently, EFAULT is returned when the VMA is not found, instead +of -EFAULT. The users of this syscall will therefore believe the syscall +succeeded in case the VMA didn't exist, as it returns a pointer to address +0xe (0xe being the value of EFAULT). Fix the sign of the error value. + +Link: https://lkml.kernel.org/r/20220427224439.23828-2-dossche.niels@gmail.com +Fixes: 550a7d60bd5e ("mm, hugepages: add mremap() support for hugepage backed vma") +Signed-off-by: Niels Dossche +Cc: Mina Almasry +Cc: Mike Kravetz +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + mm/mremap.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/mm/mremap.c ++++ b/mm/mremap.c +@@ -947,7 +947,7 @@ SYSCALL_DEFINE5(mremap, unsigned long, a + return -EINTR; + vma = find_vma(mm, addr); + if (!vma || vma->vm_start > addr) { +- ret = EFAULT; ++ ret = -EFAULT; + goto out; + } + diff --git a/queue-5.17/net-atlantic-always-deep-reset-on-pm-op-fixing-up-my-null-deref-regression.patch b/queue-5.17/net-atlantic-always-deep-reset-on-pm-op-fixing-up-my-null-deref-regression.patch new file mode 100644 index 00000000000..877da4d8c56 --- /dev/null +++ b/queue-5.17/net-atlantic-always-deep-reset-on-pm-op-fixing-up-my-null-deref-regression.patch @@ -0,0 +1,62 @@ +From 1809c30b6e5a83a1de1435fe01aaa4de4d626a7c Mon Sep 17 00:00:00 2001 +From: Manuel Ullmann +Date: Wed, 4 May 2022 21:30:44 +0200 +Subject: net: atlantic: always deep reset on pm op, fixing up my null deref regression + +From: Manuel Ullmann + +commit 1809c30b6e5a83a1de1435fe01aaa4de4d626a7c upstream. + +The impact of this regression is the same for resume that I saw on +thaw: the kernel hangs and nothing except SysRq rebooting can be done. + +Fixes regression in commit cbe6c3a8f8f4 ("net: atlantic: invert deep +par in pm functions, preventing null derefs"), where I disabled deep +pm resets in suspend and resume, trying to make sense of the +atl_resume_common() deep parameter in the first place. + +It turns out, that atlantic always has to deep reset on pm +operations. Even though I expected that and tested resume, I screwed +up by kexec-rebooting into an unpatched kernel, thus missing the +breakage. + +This fixup obsoletes the deep parameter of atl_resume_common, but I +leave the cleanup for the maintainers to post to mainline. + +Suspend and hibernation were successfully tested by the reporters. + +Fixes: cbe6c3a8f8f4 ("net: atlantic: invert deep par in pm functions, preventing null derefs") +Link: https://lore.kernel.org/regressions/9-Ehc_xXSwdXcvZqKD5aSqsqeNj5Izco4MYEwnx5cySXVEc9-x_WC4C3kAoCqNTi-H38frroUK17iobNVnkLtW36V6VWGSQEOHXhmVMm5iQ=@protonmail.com/ +Reported-by: Jordan Leppert +Reported-by: Holger Hoffstaette +Tested-by: Jordan Leppert +Tested-by: Holger Hoffstaette +CC: # 5.10+ +Signed-off-by: Manuel Ullmann +Link: https://lore.kernel.org/r/87bkw8dfmp.fsf@posteo.de +Signed-off-by: Paolo Abeni +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c ++++ b/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c +@@ -449,7 +449,7 @@ static int aq_pm_freeze(struct device *d + + static int aq_pm_suspend_poweroff(struct device *dev) + { +- return aq_suspend_common(dev, false); ++ return aq_suspend_common(dev, true); + } + + static int aq_pm_thaw(struct device *dev) +@@ -459,7 +459,7 @@ static int aq_pm_thaw(struct device *dev + + static int aq_pm_resume_restore(struct device *dev) + { +- return atl_resume_common(dev, false); ++ return atl_resume_common(dev, true); + } + + static const struct dev_pm_ops aq_pm_ops = { diff --git a/queue-5.17/net-phy-fix-race-condition-on-link-status-change.patch b/queue-5.17/net-phy-fix-race-condition-on-link-status-change.patch new file mode 100644 index 00000000000..52cc735f9a5 --- /dev/null +++ b/queue-5.17/net-phy-fix-race-condition-on-link-status-change.patch @@ -0,0 +1,99 @@ +From 91a7cda1f4b8bdf770000a3b60640576dafe0cec Mon Sep 17 00:00:00 2001 +From: Francesco Dolcini +Date: Fri, 6 May 2022 08:08:15 +0200 +Subject: net: phy: Fix race condition on link status change + +From: Francesco Dolcini + +commit 91a7cda1f4b8bdf770000a3b60640576dafe0cec upstream. + +This fixes the following error caused by a race condition between +phydev->adjust_link() and a MDIO transaction in the phy interrupt +handler. The issue was reproduced with the ethernet FEC driver and a +micrel KSZ9031 phy. + +[ 146.195696] fec 2188000.ethernet eth0: MDIO read timeout +[ 146.201779] ------------[ cut here ]------------ +[ 146.206671] WARNING: CPU: 0 PID: 571 at drivers/net/phy/phy.c:942 phy_error+0x24/0x6c +[ 146.214744] Modules linked in: bnep imx_vdoa imx_sdma evbug +[ 146.220640] CPU: 0 PID: 571 Comm: irq/128-2188000 Not tainted 5.18.0-rc3-00080-gd569e86915b7 #9 +[ 146.229563] Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree) +[ 146.236257] unwind_backtrace from show_stack+0x10/0x14 +[ 146.241640] show_stack from dump_stack_lvl+0x58/0x70 +[ 146.246841] dump_stack_lvl from __warn+0xb4/0x24c +[ 146.251772] __warn from warn_slowpath_fmt+0x5c/0xd4 +[ 146.256873] warn_slowpath_fmt from phy_error+0x24/0x6c +[ 146.262249] phy_error from kszphy_handle_interrupt+0x40/0x48 +[ 146.268159] kszphy_handle_interrupt from irq_thread_fn+0x1c/0x78 +[ 146.274417] irq_thread_fn from irq_thread+0xf0/0x1dc +[ 146.279605] irq_thread from kthread+0xe4/0x104 +[ 146.284267] kthread from ret_from_fork+0x14/0x28 +[ 146.289164] Exception stack(0xe6fa1fb0 to 0xe6fa1ff8) +[ 146.294448] 1fa0: 00000000 00000000 00000000 00000000 +[ 146.302842] 1fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 +[ 146.311281] 1fe0: 00000000 00000000 00000000 00000000 00000013 00000000 +[ 146.318262] irq event stamp: 12325 +[ 146.321780] hardirqs last enabled at (12333): [] __up_console_sem+0x50/0x60 +[ 146.330013] hardirqs last disabled at (12342): [] __up_console_sem+0x3c/0x60 +[ 146.338259] softirqs last enabled at (12324): [] __do_softirq+0x2c0/0x624 +[ 146.346311] softirqs last disabled at (12319): [] __irq_exit_rcu+0x138/0x178 +[ 146.354447] ---[ end trace 0000000000000000 ]--- + +With the FEC driver phydev->adjust_link() calls fec_enet_adjust_link() +calls fec_stop()/fec_restart() and both these function reset and +temporary disable the FEC disrupting any MII transaction that +could be happening at the same time. + +fec_enet_adjust_link() and phy_read() can be running at the same time +when we have one additional interrupt before the phy_state_machine() is +able to terminate. + +Thread 1 (phylib WQ) | Thread 2 (phy interrupt) + | + | phy_interrupt() <-- PHY IRQ + | handle_interrupt() + | phy_read() + | phy_trigger_machine() + | --> schedule phylib WQ + | + | +phy_state_machine() | + phy_check_link_status() | + phy_link_change() | + phydev->adjust_link() | + fec_enet_adjust_link() | + --> FEC reset | phy_interrupt() <-- PHY IRQ + | phy_read() + | + +Fix this by acquiring the phydev lock in phy_interrupt(). + +Link: https://lore.kernel.org/all/20220422152612.GA510015@francesco-nb.int.toradex.com/ +Fixes: c974bdbc3e77 ("net: phy: Use threaded IRQ, to allow IRQ from sleeping devices") +cc: +Signed-off-by: Francesco Dolcini +Reviewed-by: Andrew Lunn +Link: https://lore.kernel.org/r/20220506060815.327382-1-francesco.dolcini@toradex.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/phy/phy.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/drivers/net/phy/phy.c ++++ b/drivers/net/phy/phy.c +@@ -970,8 +970,13 @@ static irqreturn_t phy_interrupt(int irq + { + struct phy_device *phydev = phy_dat; + struct phy_driver *drv = phydev->drv; ++ irqreturn_t ret; + +- return drv->handle_interrupt(phydev); ++ mutex_lock(&phydev->lock); ++ ret = drv->handle_interrupt(phydev); ++ mutex_unlock(&phydev->lock); ++ ++ return ret; + } + + /** diff --git a/queue-5.17/net-phy-micrel-do-not-use-kszphy_suspend-resume-for-ksz8061.patch b/queue-5.17/net-phy-micrel-do-not-use-kszphy_suspend-resume-for-ksz8061.patch new file mode 100644 index 00000000000..aa2f37035a7 --- /dev/null +++ b/queue-5.17/net-phy-micrel-do-not-use-kszphy_suspend-resume-for-ksz8061.patch @@ -0,0 +1,62 @@ +From e333eed63a091a09bd0db191b7710c594c6e995b Mon Sep 17 00:00:00 2001 +From: Fabio Estevam +Date: Wed, 4 May 2022 11:31:03 -0300 +Subject: net: phy: micrel: Do not use kszphy_suspend/resume for KSZ8061 + +From: Fabio Estevam + +commit e333eed63a091a09bd0db191b7710c594c6e995b upstream. + +Since commit f1131b9c23fb ("net: phy: micrel: use +kszphy_suspend()/kszphy_resume for irq aware devices") the following +NULL pointer dereference is observed on a board with KSZ8061: + + # udhcpc -i eth0 +udhcpc: started, v1.35.0 +8<--- cut here --- +Unable to handle kernel NULL pointer dereference at virtual address 00000008 +pgd = f73cef4e +[00000008] *pgd=00000000 +Internal error: Oops: 5 [#1] SMP ARM +Modules linked in: +CPU: 0 PID: 196 Comm: ifconfig Not tainted 5.15.37-dirty #94 +Hardware name: Freescale i.MX6 SoloX (Device Tree) +PC is at kszphy_config_reset+0x10/0x114 +LR is at kszphy_resume+0x24/0x64 +... + +The KSZ8061 phy_driver structure does not have the .probe/..driver_data +fields, which means that priv is not allocated. + +This causes the NULL pointer dereference inside kszphy_config_reset(). + +Fix the problem by using the generic suspend/resume functions as before. + +Another alternative would be to provide the .probe and .driver_data +information into the structure, but to be on the safe side, let's +just restore Ethernet functionality by using the generic suspend/resume. + +Cc: stable@vger.kernel.org +Fixes: f1131b9c23fb ("net: phy: micrel: use kszphy_suspend()/kszphy_resume for irq aware devices") +Signed-off-by: Fabio Estevam +Reviewed-by: Andrew Lunn +Link: https://lore.kernel.org/r/20220504143104.1286960-1-festevam@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/phy/micrel.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/phy/micrel.c ++++ b/drivers/net/phy/micrel.c +@@ -1850,8 +1850,8 @@ static struct phy_driver ksphy_driver[] + .config_init = ksz8061_config_init, + .config_intr = kszphy_config_intr, + .handle_interrupt = kszphy_handle_interrupt, +- .suspend = kszphy_suspend, +- .resume = kszphy_resume, ++ .suspend = genphy_suspend, ++ .resume = genphy_resume, + }, { + .phy_id = PHY_ID_KSZ9021, + .phy_id_mask = 0x000ffffe, diff --git a/queue-5.17/net-phy-micrel-pass-.probe-for-ks8737.patch b/queue-5.17/net-phy-micrel-pass-.probe-for-ks8737.patch new file mode 100644 index 00000000000..d409d609ac6 --- /dev/null +++ b/queue-5.17/net-phy-micrel-pass-.probe-for-ks8737.patch @@ -0,0 +1,41 @@ +From 15f03ffe4bb951e982457f44b6cf6b06ef4cbb93 Mon Sep 17 00:00:00 2001 +From: Fabio Estevam +Date: Wed, 4 May 2022 11:31:04 -0300 +Subject: net: phy: micrel: Pass .probe for KS8737 + +From: Fabio Estevam + +commit 15f03ffe4bb951e982457f44b6cf6b06ef4cbb93 upstream. + +Since commit f1131b9c23fb ("net: phy: micrel: use +kszphy_suspend()/kszphy_resume for irq aware devices") the kszphy_suspend/ +resume hooks are used. + +These functions require the probe function to be called so that +priv can be allocated. + +Otherwise, a NULL pointer dereference happens inside +kszphy_config_reset(). + +Cc: stable@vger.kernel.org +Fixes: f1131b9c23fb ("net: phy: micrel: use kszphy_suspend()/kszphy_resume for irq aware devices") +Reported-by: Andrew Lunn +Signed-off-by: Fabio Estevam +Reviewed-by: Andrew Lunn +Link: https://lore.kernel.org/r/20220504143104.1286960-2-festevam@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/phy/micrel.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/phy/micrel.c ++++ b/drivers/net/phy/micrel.c +@@ -1725,6 +1725,7 @@ static struct phy_driver ksphy_driver[] + .name = "Micrel KS8737", + /* PHY_BASIC_FEATURES */ + .driver_data = &ks8737_type, ++ .probe = kszphy_probe, + .config_init = kszphy_config_init, + .config_intr = kszphy_config_intr, + .handle_interrupt = kszphy_handle_interrupt, diff --git a/queue-5.17/ping-fix-address-binding-wrt-vrf.patch b/queue-5.17/ping-fix-address-binding-wrt-vrf.patch new file mode 100644 index 00000000000..8f2a7025643 --- /dev/null +++ b/queue-5.17/ping-fix-address-binding-wrt-vrf.patch @@ -0,0 +1,71 @@ +From e1a7ac6f3ba6e157adcd0ca94d92a401f1943f56 Mon Sep 17 00:00:00 2001 +From: Nicolas Dichtel +Date: Wed, 4 May 2022 11:07:38 +0200 +Subject: ping: fix address binding wrt vrf + +From: Nicolas Dichtel + +commit e1a7ac6f3ba6e157adcd0ca94d92a401f1943f56 upstream. + +When ping_group_range is updated, 'ping' uses the DGRAM ICMP socket, +instead of an IP raw socket. In this case, 'ping' is unable to bind its +socket to a local address owned by a vrflite. + +Before the patch: +$ sysctl -w net.ipv4.ping_group_range='0 2147483647' +$ ip link add blue type vrf table 10 +$ ip link add foo type dummy +$ ip link set foo master blue +$ ip link set foo up +$ ip addr add 192.168.1.1/24 dev foo +$ ip addr add 2001::1/64 dev foo +$ ip vrf exec blue ping -c1 -I 192.168.1.1 192.168.1.2 +ping: bind: Cannot assign requested address +$ ip vrf exec blue ping6 -c1 -I 2001::1 2001::2 +ping6: bind icmp socket: Cannot assign requested address + +CC: stable@vger.kernel.org +Fixes: 1b69c6d0ae90 ("net: Introduce L3 Master device abstraction") +Signed-off-by: Nicolas Dichtel +Reviewed-by: David Ahern +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/ping.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +--- a/net/ipv4/ping.c ++++ b/net/ipv4/ping.c +@@ -305,6 +305,7 @@ static int ping_check_bind_addr(struct s + struct net *net = sock_net(sk); + if (sk->sk_family == AF_INET) { + struct sockaddr_in *addr = (struct sockaddr_in *) uaddr; ++ u32 tb_id = RT_TABLE_LOCAL; + int chk_addr_ret; + + if (addr_len < sizeof(*addr)) +@@ -318,7 +319,8 @@ static int ping_check_bind_addr(struct s + pr_debug("ping_check_bind_addr(sk=%p,addr=%pI4,port=%d)\n", + sk, &addr->sin_addr.s_addr, ntohs(addr->sin_port)); + +- chk_addr_ret = inet_addr_type(net, addr->sin_addr.s_addr); ++ tb_id = l3mdev_fib_table_by_index(net, sk->sk_bound_dev_if) ? : tb_id; ++ chk_addr_ret = inet_addr_type_table(net, addr->sin_addr.s_addr, tb_id); + + if (!inet_addr_valid_or_nonlocal(net, inet_sk(sk), + addr->sin_addr.s_addr, +@@ -353,6 +355,14 @@ static int ping_check_bind_addr(struct s + if (!dev) { + rcu_read_unlock(); + return -ENODEV; ++ } ++ } ++ ++ if (!dev && sk->sk_bound_dev_if) { ++ dev = dev_get_by_index_rcu(net, sk->sk_bound_dev_if); ++ if (!dev) { ++ rcu_read_unlock(); ++ return -ENODEV; + } + } + has_addr = pingv6_ops.ipv6_chk_addr(net, &addr->sin6_addr, dev, diff --git a/queue-5.17/revert-mm-memory-failure.c-skip-huge_zero_page-in-memory_failure.patch b/queue-5.17/revert-mm-memory-failure.c-skip-huge_zero_page-in-memory_failure.patch new file mode 100644 index 00000000000..bc709af9f55 --- /dev/null +++ b/queue-5.17/revert-mm-memory-failure.c-skip-huge_zero_page-in-memory_failure.patch @@ -0,0 +1,83 @@ +From b4e61fc031b11dd807dffc46cebbf0e25966d3d1 Mon Sep 17 00:00:00 2001 +From: Xu Yu +Date: Thu, 28 Apr 2022 23:14:43 -0700 +Subject: Revert "mm/memory-failure.c: skip huge_zero_page in memory_failure()" + +From: Xu Yu + +commit b4e61fc031b11dd807dffc46cebbf0e25966d3d1 upstream. + +Patch series "mm/memory-failure: rework fix on huge_zero_page splitting". + + +This patch (of 2): + +This reverts commit d173d5417fb67411e623d394aab986d847e47dad. + +The commit d173d5417fb6 ("mm/memory-failure.c: skip huge_zero_page in +memory_failure()") explicitly skips huge_zero_page in memory_failure(), in +order to avoid triggering VM_BUG_ON_PAGE on huge_zero_page in +split_huge_page_to_list(). + +This works, but Yang Shi thinks that, + + Raising BUG is overkilling for splitting huge_zero_page. The + huge_zero_page can't be met from normal paths other than memory + failure, but memory failure is a valid caller. So I tend to replace + the BUG to WARN + returning -EBUSY. If we don't care about the + reason code in memory failure, we don't have to touch memory + failure. + +And for the issue that huge_zero_page will be set PG_has_hwpoisoned, +Yang Shi comments that, + + The anonymous page fault doesn't check if the page is poisoned or + not since it typically gets a fresh allocated page and assumes the + poisoned page (isolated successfully) can't be reallocated again. + But huge zero page and base zero page are reused every time. So no + matter what fix we pick, the issue is always there. + +Finally, Yang, David, Anshuman and Naoya all agree to fix the bug, i.e., +to split huge_zero_page, in split_huge_page_to_list(). + +This reverts the commit d173d5417fb6 ("mm/memory-failure.c: skip +huge_zero_page in memory_failure()"), and the original bug will be fixed +by the next patch. + +Link: https://lkml.kernel.org/r/872cefb182ba1dd686b0e7db1e6b2ebe5a4fff87.1651039624.git.xuyu@linux.alibaba.com +Fixes: d173d5417fb6 ("mm/memory-failure.c: skip huge_zero_page in memory_failure()") +Fixes: 6a46079cf57a ("HWPOISON: The high level memory error handler in the VM v7") +Signed-off-by: Xu Yu +Suggested-by: Yang Shi +Reviewed-by: Yang Shi +Reviewed-by: Miaohe Lin +Cc: Naoya Horiguchi +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + mm/memory-failure.c | 13 ------------- + 1 file changed, 13 deletions(-) + +--- a/mm/memory-failure.c ++++ b/mm/memory-failure.c +@@ -1782,19 +1782,6 @@ try_again: + + if (PageTransHuge(hpage)) { + /* +- * Bail out before SetPageHasHWPoisoned() if hpage is +- * huge_zero_page, although PG_has_hwpoisoned is not +- * checked in set_huge_zero_page(). +- * +- * TODO: Handle memory failure of huge_zero_page thoroughly. +- */ +- if (is_huge_zero_page(hpage)) { +- action_result(pfn, MF_MSG_UNSPLIT_THP, MF_IGNORED); +- res = -EBUSY; +- goto unlock_mutex; +- } +- +- /* + * The flag must be set after the refcount is bumped + * otherwise it may race with THP split. + * And the flag can't be set in get_hwpoison_page() since diff --git a/queue-5.17/serial-8250_mtk-fix-register-address-for-xon-xoff-character.patch b/queue-5.17/serial-8250_mtk-fix-register-address-for-xon-xoff-character.patch new file mode 100644 index 00000000000..975d2e1b360 --- /dev/null +++ b/queue-5.17/serial-8250_mtk-fix-register-address-for-xon-xoff-character.patch @@ -0,0 +1,44 @@ +From e1bfdbc7daca171c74a577b3dd0b36d76bb0ffcc Mon Sep 17 00:00:00 2001 +From: AngeloGioacchino Del Regno +Date: Wed, 27 Apr 2022 15:23:28 +0200 +Subject: serial: 8250_mtk: Fix register address for XON/XOFF character + +From: AngeloGioacchino Del Regno + +commit e1bfdbc7daca171c74a577b3dd0b36d76bb0ffcc upstream. + +The XON1/XOFF1 character registers are at offset 0xa0 and 0xa8 +respectively, so we cannot use the definition in serial_port.h. + +Fixes: bdbd0a7f8f03 ("serial: 8250-mtk: modify baudrate setting") +Signed-off-by: AngeloGioacchino Del Regno +Cc: stable +Link: https://lore.kernel.org/r/20220427132328.228297-4-angelogioacchino.delregno@collabora.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/serial/8250/8250_mtk.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/tty/serial/8250/8250_mtk.c ++++ b/drivers/tty/serial/8250/8250_mtk.c +@@ -54,6 +54,9 @@ + #define MTK_UART_TX_TRIGGER 1 + #define MTK_UART_RX_TRIGGER MTK_UART_RX_SIZE + ++#define MTK_UART_XON1 40 /* I/O: Xon character 1 */ ++#define MTK_UART_XOFF1 42 /* I/O: Xoff character 1 */ ++ + #ifdef CONFIG_SERIAL_8250_DMA + enum dma_rx_status { + DMA_RX_START = 0, +@@ -275,8 +278,8 @@ static void mtk8250_set_flow_ctrl(struct + (serial_in(up, MTK_UART_EFR) & + (~(MTK_UART_EFR_HW_FC | MTK_UART_EFR_SW_FC_MASK)))); + +- serial_out(up, UART_XON1, START_CHAR(port->state->port.tty)); +- serial_out(up, UART_XOFF1, STOP_CHAR(port->state->port.tty)); ++ serial_out(up, MTK_UART_XON1, START_CHAR(port->state->port.tty)); ++ serial_out(up, MTK_UART_XOFF1, STOP_CHAR(port->state->port.tty)); + serial_out(up, UART_LCR, lcr); + mtk8250_disable_intrs(up, MTK_UART_IER_CTSI|MTK_UART_IER_RTSI); + mtk8250_enable_intrs(up, MTK_UART_IER_XOFFI); diff --git a/queue-5.17/serial-8250_mtk-fix-uart_efr-register-address.patch b/queue-5.17/serial-8250_mtk-fix-uart_efr-register-address.patch new file mode 100644 index 00000000000..60702d14d8d --- /dev/null +++ b/queue-5.17/serial-8250_mtk-fix-uart_efr-register-address.patch @@ -0,0 +1,92 @@ +From bb0b197aadd928f52ce6f01f0ee977f0a08cf1be Mon Sep 17 00:00:00 2001 +From: AngeloGioacchino Del Regno +Date: Wed, 27 Apr 2022 15:23:26 +0200 +Subject: serial: 8250_mtk: Fix UART_EFR register address + +From: AngeloGioacchino Del Regno + +commit bb0b197aadd928f52ce6f01f0ee977f0a08cf1be upstream. + +On MediaTek SoCs, the UART IP is 16550A compatible, but there are some +specific quirks: we are declaring a register shift of 2, but this is +only valid for the majority of the registers, as there are some that +are out of the standard layout. + +Specifically, this driver is using definitions from serial_reg.h, where +we have a UART_EFR register defined as 2: this results in a 0x8 offset, +but there we have the FCR register instead. + +The right offset for the EFR register on MediaTek UART is at 0x98, +so, following the decimal definition convention in serial_reg.h and +accounting for the register left shift of two, add and use the correct +register address for this IP, defined as decimal 38, so that the final +calculation results in (0x26 << 2) = 0x98. + +Fixes: bdbd0a7f8f03 ("serial: 8250-mtk: modify baudrate setting") +Signed-off-by: AngeloGioacchino Del Regno +Cc: stable +Link: https://lore.kernel.org/r/20220427132328.228297-2-angelogioacchino.delregno@collabora.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/serial/8250/8250_mtk.c | 15 ++++++++------- + 1 file changed, 8 insertions(+), 7 deletions(-) + +--- a/drivers/tty/serial/8250/8250_mtk.c ++++ b/drivers/tty/serial/8250/8250_mtk.c +@@ -37,6 +37,7 @@ + #define MTK_UART_IER_RTSI 0x40 /* Enable RTS Modem status interrupt */ + #define MTK_UART_IER_CTSI 0x80 /* Enable CTS Modem status interrupt */ + ++#define MTK_UART_EFR 38 /* I/O: Extended Features Register */ + #define MTK_UART_EFR_EN 0x10 /* Enable enhancement feature */ + #define MTK_UART_EFR_RTS 0x40 /* Enable hardware rx flow control */ + #define MTK_UART_EFR_CTS 0x80 /* Enable hardware tx flow control */ +@@ -169,7 +170,7 @@ static void mtk8250_dma_enable(struct ua + MTK_UART_DMA_EN_RX | MTK_UART_DMA_EN_TX); + + serial_out(up, UART_LCR, UART_LCR_CONF_MODE_B); +- serial_out(up, UART_EFR, UART_EFR_ECB); ++ serial_out(up, MTK_UART_EFR, UART_EFR_ECB); + serial_out(up, UART_LCR, lcr); + + if (dmaengine_slave_config(dma->rxchan, &dma->rxconf) != 0) +@@ -232,7 +233,7 @@ static void mtk8250_set_flow_ctrl(struct + int lcr = serial_in(up, UART_LCR); + + serial_out(up, UART_LCR, UART_LCR_CONF_MODE_B); +- serial_out(up, UART_EFR, UART_EFR_ECB); ++ serial_out(up, MTK_UART_EFR, UART_EFR_ECB); + serial_out(up, UART_LCR, lcr); + lcr = serial_in(up, UART_LCR); + +@@ -241,7 +242,7 @@ static void mtk8250_set_flow_ctrl(struct + serial_out(up, MTK_UART_ESCAPE_DAT, MTK_UART_ESCAPE_CHAR); + serial_out(up, MTK_UART_ESCAPE_EN, 0x00); + serial_out(up, UART_LCR, UART_LCR_CONF_MODE_B); +- serial_out(up, UART_EFR, serial_in(up, UART_EFR) & ++ serial_out(up, MTK_UART_EFR, serial_in(up, MTK_UART_EFR) & + (~(MTK_UART_EFR_HW_FC | MTK_UART_EFR_SW_FC_MASK))); + serial_out(up, UART_LCR, lcr); + mtk8250_disable_intrs(up, MTK_UART_IER_XOFFI | +@@ -255,8 +256,8 @@ static void mtk8250_set_flow_ctrl(struct + serial_out(up, UART_LCR, UART_LCR_CONF_MODE_B); + + /*enable hw flow control*/ +- serial_out(up, UART_EFR, MTK_UART_EFR_HW_FC | +- (serial_in(up, UART_EFR) & ++ serial_out(up, MTK_UART_EFR, MTK_UART_EFR_HW_FC | ++ (serial_in(up, MTK_UART_EFR) & + (~(MTK_UART_EFR_HW_FC | MTK_UART_EFR_SW_FC_MASK)))); + + serial_out(up, UART_LCR, lcr); +@@ -270,8 +271,8 @@ static void mtk8250_set_flow_ctrl(struct + serial_out(up, UART_LCR, UART_LCR_CONF_MODE_B); + + /*enable sw flow control */ +- serial_out(up, UART_EFR, MTK_UART_EFR_XON1_XOFF1 | +- (serial_in(up, UART_EFR) & ++ serial_out(up, MTK_UART_EFR, MTK_UART_EFR_XON1_XOFF1 | ++ (serial_in(up, MTK_UART_EFR) & + (~(MTK_UART_EFR_HW_FC | MTK_UART_EFR_SW_FC_MASK)))); + + serial_out(up, UART_XON1, START_CHAR(port->state->port.tty)); diff --git a/queue-5.17/serial-8250_mtk-make-sure-to-select-the-right-feature_sel.patch b/queue-5.17/serial-8250_mtk-make-sure-to-select-the-right-feature_sel.patch new file mode 100644 index 00000000000..39f1eff0621 --- /dev/null +++ b/queue-5.17/serial-8250_mtk-make-sure-to-select-the-right-feature_sel.patch @@ -0,0 +1,44 @@ +From 6f81fdded0d024c7d4084d434764f30bca1cd6b1 Mon Sep 17 00:00:00 2001 +From: AngeloGioacchino Del Regno +Date: Wed, 27 Apr 2022 15:23:27 +0200 +Subject: serial: 8250_mtk: Make sure to select the right FEATURE_SEL + +From: AngeloGioacchino Del Regno + +commit 6f81fdded0d024c7d4084d434764f30bca1cd6b1 upstream. + +Set the FEATURE_SEL at probe time to make sure that BIT(0) is enabled: +this guarantees that when the port is configured as AP UART, the +right register layout is interpreted by the UART IP. + +Signed-off-by: AngeloGioacchino Del Regno +Cc: stable +Link: https://lore.kernel.org/r/20220427132328.228297-3-angelogioacchino.delregno@collabora.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/serial/8250/8250_mtk.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/tty/serial/8250/8250_mtk.c ++++ b/drivers/tty/serial/8250/8250_mtk.c +@@ -57,6 +57,9 @@ + #define MTK_UART_XON1 40 /* I/O: Xon character 1 */ + #define MTK_UART_XOFF1 42 /* I/O: Xoff character 1 */ + ++#define MTK_UART_FEATURE_SEL 39 /* Feature Selection register */ ++#define MTK_UART_FEAT_NEWRMAP BIT(0) /* Use new register map */ ++ + #ifdef CONFIG_SERIAL_8250_DMA + enum dma_rx_status { + DMA_RX_START = 0, +@@ -572,6 +575,10 @@ static int mtk8250_probe(struct platform + uart.dma = data->dma; + #endif + ++ /* Set AP UART new register map */ ++ writel(MTK_UART_FEAT_NEWRMAP, uart.port.membase + ++ (MTK_UART_FEATURE_SEL << uart.port.regshift)); ++ + /* Disable Rate Fix function */ + writel(0x0, uart.port.membase + + (MTK_UART_RATE_FIX << uart.port.regshift)); diff --git a/queue-5.17/series b/queue-5.17/series index 055ad47e998..be6fea4af91 100644 --- a/queue-5.17/series +++ b/queue-5.17/series @@ -78,3 +78,32 @@ tty-n_gsm-fix-mux-activation-issues-in-gsm_config.patch tty-n_gsm-fix-invalid-gsmtty_write_room-result.patch usb-gadget-uvc-allow-for-application-to-cleanly-shutdown.patch usb-cdc-wdm-fix-reading-stuck-on-device-close.patch +usb-typec-tcpci-don-t-skip-cleanup-in-.remove-on-error.patch +usb-typec-tcpci_mt6360-update-for-bmc-phy-setting.patch +usb-serial-pl2303-add-device-id-for-hp-lm930-display.patch +usb-serial-qcserial-add-support-for-sierra-wireless-em7590.patch +usb-serial-option-add-fibocom-l610-modem.patch +usb-serial-option-add-fibocom-ma510-modem.patch +slimbus-qcom-fix-irq-check-in-qcom_slim_probe.patch +fsl_lpuart-don-t-enable-interrupts-too-early.patch +genirq-remove-warn_on_once-in-generic_handle_domain_irq.patch +serial-8250_mtk-fix-uart_efr-register-address.patch +serial-8250_mtk-fix-register-address-for-xon-xoff-character.patch +serial-8250_mtk-make-sure-to-select-the-right-feature_sel.patch +ceph-fix-setting-of-xattrs-on-async-created-inodes.patch +revert-mm-memory-failure.c-skip-huge_zero_page-in-memory_failure.patch +mm-huge_memory-do-not-overkill-when-splitting-huge_zero_page.patch +mm-mremap-fix-sign-for-efault-error-return-value.patch +drm-vmwgfx-disable-command-buffers-on-svga3-without-gbobjects.patch +drm-nouveau-tegra-stop-using-iommu_present.patch +i40e-i40e_main-fix-a-missing-check-on-list-iterator.patch +net-atlantic-always-deep-reset-on-pm-op-fixing-up-my-null-deref-regression.patch +net-phy-fix-race-condition-on-link-status-change.patch +writeback-avoid-skipping-inode-writeback.patch +cgroup-cpuset-remove-cpus_allowed-mems_allowed-setup-in-cpuset_init_smp.patch +ping-fix-address-binding-wrt-vrf.patch +ath11k-reduce-the-wait-time-of-11d-scan-and-hw-scan-while-add-interface.patch +arm-memremap-don-t-abuse-pfn_valid-to-ensure-presence-of-linear-map.patch +net-phy-micrel-do-not-use-kszphy_suspend-resume-for-ksz8061.patch +net-phy-micrel-pass-.probe-for-ks8737.patch +sunrpc-ensure-that-the-gssproxy-client-can-start-in-a-connected-state.patch diff --git a/queue-5.17/slimbus-qcom-fix-irq-check-in-qcom_slim_probe.patch b/queue-5.17/slimbus-qcom-fix-irq-check-in-qcom_slim_probe.patch new file mode 100644 index 00000000000..1e8600cd908 --- /dev/null +++ b/queue-5.17/slimbus-qcom-fix-irq-check-in-qcom_slim_probe.patch @@ -0,0 +1,43 @@ +From fe503887eed6ea528e144ec8dacfa1d47aa701ac Mon Sep 17 00:00:00 2001 +From: Miaoqian Lin +Date: Fri, 29 Apr 2022 17:49:17 +0100 +Subject: slimbus: qcom: Fix IRQ check in qcom_slim_probe + +From: Miaoqian Lin + +commit fe503887eed6ea528e144ec8dacfa1d47aa701ac upstream. + +platform_get_irq() returns non-zero IRQ number on success, +negative error number on failure. +And the doc of platform_get_irq() provides a usage example: + + int irq = platform_get_irq(pdev, 0); + if (irq < 0) + return irq; + +Fix the check of return value to catch errors correctly. + +Fixes: ad7fcbc308b0 ("slimbus: qcom: Add Qualcomm Slimbus controller driver") +Cc: stable@vger.kernel.org +Signed-off-by: Miaoqian Lin +Signed-off-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20220429164917.5202-2-srinivas.kandagatla@linaro.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/slimbus/qcom-ctrl.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/slimbus/qcom-ctrl.c ++++ b/drivers/slimbus/qcom-ctrl.c +@@ -510,9 +510,9 @@ static int qcom_slim_probe(struct platfo + } + + ctrl->irq = platform_get_irq(pdev, 0); +- if (!ctrl->irq) { ++ if (ctrl->irq < 0) { + dev_err(&pdev->dev, "no slimbus IRQ\n"); +- return -ENODEV; ++ return ctrl->irq; + } + + sctrl = &ctrl->ctrl; diff --git a/queue-5.17/sunrpc-ensure-that-the-gssproxy-client-can-start-in-a-connected-state.patch b/queue-5.17/sunrpc-ensure-that-the-gssproxy-client-can-start-in-a-connected-state.patch new file mode 100644 index 00000000000..1004e3341be --- /dev/null +++ b/queue-5.17/sunrpc-ensure-that-the-gssproxy-client-can-start-in-a-connected-state.patch @@ -0,0 +1,106 @@ +From fd13359f54ee854f00134abc6be32da94ec53dbf Mon Sep 17 00:00:00 2001 +From: Trond Myklebust +Date: Sat, 7 May 2022 13:53:59 -0400 +Subject: SUNRPC: Ensure that the gssproxy client can start in a connected state + +From: Trond Myklebust + +commit fd13359f54ee854f00134abc6be32da94ec53dbf upstream. + +Ensure that the gssproxy client connects to the server from the gssproxy +daemon process context so that the AF_LOCAL socket connection is done +using the correct path and namespaces. + +Fixes: 1d658336b05f ("SUNRPC: Add RPC based upcall mechanism for RPCGSS auth") +Cc: stable@vger.kernel.org +Signed-off-by: Trond Myklebust +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/sunrpc/clnt.h | 1 + + net/sunrpc/auth_gss/gss_rpc_upcall.c | 1 + + net/sunrpc/clnt.c | 33 +++++++++++++++++++++++++++++++++ + 3 files changed, 35 insertions(+) + +--- a/include/linux/sunrpc/clnt.h ++++ b/include/linux/sunrpc/clnt.h +@@ -160,6 +160,7 @@ struct rpc_add_xprt_test { + #define RPC_CLNT_CREATE_NO_RETRANS_TIMEOUT (1UL << 9) + #define RPC_CLNT_CREATE_SOFTERR (1UL << 10) + #define RPC_CLNT_CREATE_REUSEPORT (1UL << 11) ++#define RPC_CLNT_CREATE_CONNECTED (1UL << 12) + + struct rpc_clnt *rpc_create(struct rpc_create_args *args); + struct rpc_clnt *rpc_bind_new_program(struct rpc_clnt *, +--- a/net/sunrpc/auth_gss/gss_rpc_upcall.c ++++ b/net/sunrpc/auth_gss/gss_rpc_upcall.c +@@ -98,6 +98,7 @@ static int gssp_rpc_create(struct net *n + * done without the correct namespace: + */ + .flags = RPC_CLNT_CREATE_NOPING | ++ RPC_CLNT_CREATE_CONNECTED | + RPC_CLNT_CREATE_NO_IDLE_TIMEOUT + }; + struct rpc_clnt *clnt; +--- a/net/sunrpc/clnt.c ++++ b/net/sunrpc/clnt.c +@@ -76,6 +76,7 @@ static int rpc_encode_header(struct rpc_ + static int rpc_decode_header(struct rpc_task *task, + struct xdr_stream *xdr); + static int rpc_ping(struct rpc_clnt *clnt); ++static int rpc_ping_noreply(struct rpc_clnt *clnt); + static void rpc_check_timeout(struct rpc_task *task); + + static void rpc_register_client(struct rpc_clnt *clnt) +@@ -483,6 +484,12 @@ static struct rpc_clnt *rpc_create_xprt( + rpc_shutdown_client(clnt); + return ERR_PTR(err); + } ++ } else if (args->flags & RPC_CLNT_CREATE_CONNECTED) { ++ int err = rpc_ping_noreply(clnt); ++ if (err != 0) { ++ rpc_shutdown_client(clnt); ++ return ERR_PTR(err); ++ } + } + + clnt->cl_softrtry = 1; +@@ -2699,6 +2706,10 @@ static const struct rpc_procinfo rpcproc + .p_decode = rpcproc_decode_null, + }; + ++static const struct rpc_procinfo rpcproc_null_noreply = { ++ .p_encode = rpcproc_encode_null, ++}; ++ + static void + rpc_null_call_prepare(struct rpc_task *task, void *data) + { +@@ -2748,6 +2759,28 @@ static int rpc_ping(struct rpc_clnt *cln + if (IS_ERR(task)) + return PTR_ERR(task); + status = task->tk_status; ++ rpc_put_task(task); ++ return status; ++} ++ ++static int rpc_ping_noreply(struct rpc_clnt *clnt) ++{ ++ struct rpc_message msg = { ++ .rpc_proc = &rpcproc_null_noreply, ++ }; ++ struct rpc_task_setup task_setup_data = { ++ .rpc_client = clnt, ++ .rpc_message = &msg, ++ .callback_ops = &rpc_null_ops, ++ .flags = RPC_TASK_SOFT | RPC_TASK_SOFTCONN | RPC_TASK_NULLCREDS, ++ }; ++ struct rpc_task *task; ++ int status; ++ ++ task = rpc_run_task(&task_setup_data); ++ if (IS_ERR(task)) ++ return PTR_ERR(task); ++ status = task->tk_status; + rpc_put_task(task); + return status; + } diff --git a/queue-5.17/usb-serial-option-add-fibocom-l610-modem.patch b/queue-5.17/usb-serial-option-add-fibocom-l610-modem.patch new file mode 100644 index 00000000000..bc3010c7c2e --- /dev/null +++ b/queue-5.17/usb-serial-option-add-fibocom-l610-modem.patch @@ -0,0 +1,141 @@ +From 714adff9a6271b5f1664b04c944b598141ebfe73 Mon Sep 17 00:00:00 2001 +From: Sven Schwermer +Date: Mon, 25 Apr 2022 16:34:49 +0200 +Subject: USB: serial: option: add Fibocom L610 modem + +From: Sven Schwermer + +commit 714adff9a6271b5f1664b04c944b598141ebfe73 upstream. + +The L610 modem has 3 USB configurations that are configurable via the AT +command AT+GTUSBMODE={31,32,33} which make the modem enumerate with the +following interfaces, respectively: + +31: Modem + NV + MOS + Diag + LOG + AT + AT +32: ECM + Modem + NV + MOS + Diag + LOG + AT + AT +33: RNDIS + Modem + NV + MOS + Diag + LOG + AT + AT + +A detailed description of the USB configuration for each mode follows: + ++GTUSBMODE: 31 +-------------- +T: Bus=03 Lev=01 Prnt=01 Port=06 Cnt=04 Dev#=124 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=1782 ProdID=4d10 Rev= 0.00 +S: Manufacturer=FIBOCOM +S: Product=L610 +C:* #Ifs= 7 Cfg#= 1 Atr=e0 MxPwr=400mA +I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms + ++GTUSBMODE: 32 +-------------- +T: Bus=03 Lev=01 Prnt=01 Port=06 Cnt=04 Dev#=122 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=1782 ProdID=4d11 Rev= 0.00 +S: Manufacturer=FIBOCOM +S: Product=L610 +C:* #Ifs= 9 Cfg#= 1 Atr=e0 MxPwr=400mA +A: FirstIf#= 0 IfCount= 2 Cls=02(comm.) Sub=06 Prot=00 +I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=06 Prot=00 Driver=cdc_ether +E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=32ms +I: If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether +I:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether +E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 7 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 8 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=08(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms + ++GTUSBMODE: 33 +-------------- +T: Bus=03 Lev=01 Prnt=01 Port=06 Cnt=04 Dev#=126 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=1782 ProdID=4d11 Rev= 0.00 +S: Manufacturer=FIBOCOM +S: Product=L610 +C:* #Ifs= 9 Cfg#= 1 Atr=e0 MxPwr=400mA +A: FirstIf#= 0 IfCount= 2 Cls=e0(wlcon) Sub=01 Prot=03 +I:* If#= 0 Alt= 0 #EPs= 1 Cls=e0(wlcon) Sub=01 Prot=03 Driver=rndis_host +E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=4096ms +I:* If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 7 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 8 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=08(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +Signed-off-by: Sven Schwermer +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -2123,6 +2123,8 @@ static const struct usb_device_id option + .driver_info = RSVD(3) }, + { USB_DEVICE(0x1508, 0x1001), /* Fibocom NL668 (IOT version) */ + .driver_info = RSVD(4) | RSVD(5) | RSVD(6) }, ++ { USB_DEVICE(0x1782, 0x4d10) }, /* Fibocom L610 (AT mode) */ ++ { USB_DEVICE_INTERFACE_CLASS(0x1782, 0x4d11, 0xff) }, /* Fibocom L610 (ECM/RNDIS mode) */ + { USB_DEVICE(0x2cb7, 0x0104), /* Fibocom NL678 series */ + .driver_info = RSVD(4) | RSVD(5) }, + { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0105, 0xff), /* Fibocom NL678 series */ diff --git a/queue-5.17/usb-serial-option-add-fibocom-ma510-modem.patch b/queue-5.17/usb-serial-option-add-fibocom-ma510-modem.patch new file mode 100644 index 00000000000..eeed75f04a6 --- /dev/null +++ b/queue-5.17/usb-serial-option-add-fibocom-ma510-modem.patch @@ -0,0 +1,117 @@ +From 07989eb981d862f7f2be68d233d753f2e7ccc119 Mon Sep 17 00:00:00 2001 +From: Sven Schwermer +Date: Mon, 25 Apr 2022 16:34:50 +0200 +Subject: USB: serial: option: add Fibocom MA510 modem + +From: Sven Schwermer + +commit 07989eb981d862f7f2be68d233d753f2e7ccc119 upstream. + +The MA510 modem has 3 USB configurations that are configurable via the AT +command AT+GTUSBMODE={30,31,32} which make the modem enumerate with the +following interfaces, respectively: + +30: Diag + QDSS + Modem + RMNET +31: Diag + Modem + AT + ECM +32: Modem + AT + ECM + +The first configuration (30) reuses u-blox R410M's VID/PID with +identical interface configuration. + +A detailed description of the USB configuration for each mode follows: + ++GTUSBMODE: 30 +-------------- +T: Bus=03 Lev=01 Prnt=01 Port=06 Cnt=04 Dev#= 19 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=05c6 ProdID=90b2 Rev= 0.00 +S: Manufacturer=Fibocom MA510 Modem +S: Product=Fibocom MA510 Modem +S: SerialNumber=55e2695b +C:* #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=500mA +I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) +E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +E: Ad=83(I) Atr=03(Int.) MxPS= 64 Ivl=2ms +E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan +E: Ad=85(I) Atr=03(Int.) MxPS= 64 Ivl=2ms +E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms + ++GTUSBMODE: 31 +-------------- +T: Bus=03 Lev=01 Prnt=01 Port=06 Cnt=04 Dev#= 99 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=2cb7 ProdID=0106 Rev= 0.00 +S: Manufacturer=Fibocom MA510 Modem +S: Product=Fibocom MA510 Modem +S: SerialNumber=55e2695b +C:* #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA +A: FirstIf#= 3 IfCount= 2 Cls=02(comm.) Sub=00 Prot=00 +I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=2ms +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=fe Prot=ff Driver=option +E: Ad=84(I) Atr=03(Int.) MxPS= 64 Ivl=2ms +E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 3 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=06 Prot=00 Driver=cdc_ether +E: Ad=86(I) Atr=03(Int.) MxPS= 64 Ivl=2ms +I: If#= 4 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether +I:* If#= 4 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether +E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms + ++GTUSBMODE: 32 +-------------- +T: Bus=03 Lev=01 Prnt=01 Port=06 Cnt=04 Dev#=100 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=2cb7 ProdID=010a Rev= 0.00 +S: Manufacturer=Fibocom MA510 Modem +S: Product=Fibocom MA510 Modem +S: SerialNumber=55e2695b +C:* #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=500mA +A: FirstIf#= 2 IfCount= 2 Cls=02(comm.) Sub=00 Prot=00 +I:* If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +E: Ad=81(I) Atr=03(Int.) MxPS= 64 Ivl=2ms +E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=fe Prot=ff Driver=option +E: Ad=83(I) Atr=03(Int.) MxPS= 64 Ivl=2ms +E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 2 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=06 Prot=00 Driver=cdc_ether +E: Ad=85(I) Atr=03(Int.) MxPS= 64 Ivl=2ms +I: If#= 3 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether +I:* If#= 3 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether +E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +Signed-off-by: Sven Schwermer +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -2129,6 +2129,8 @@ static const struct usb_device_id option + .driver_info = RSVD(4) | RSVD(5) }, + { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0105, 0xff), /* Fibocom NL678 series */ + .driver_info = RSVD(6) }, ++ { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0106, 0xff) }, /* Fibocom MA510 (ECM mode w/ diag intf.) */ ++ { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x010a, 0xff) }, /* Fibocom MA510 (ECM mode) */ + { USB_DEVICE_AND_INTERFACE_INFO(0x2cb7, 0x010b, 0xff, 0xff, 0x30) }, /* Fibocom FG150 Diag */ + { USB_DEVICE_AND_INTERFACE_INFO(0x2cb7, 0x010b, 0xff, 0, 0) }, /* Fibocom FG150 AT */ + { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a0, 0xff) }, /* Fibocom NL668-AM/NL652-EU (laptop MBIM) */ diff --git a/queue-5.17/usb-serial-pl2303-add-device-id-for-hp-lm930-display.patch b/queue-5.17/usb-serial-pl2303-add-device-id-for-hp-lm930-display.patch new file mode 100644 index 00000000000..74b11a3a60c --- /dev/null +++ b/queue-5.17/usb-serial-pl2303-add-device-id-for-hp-lm930-display.patch @@ -0,0 +1,41 @@ +From 26a08f8bad3e1f98d3153f939fb8cd330da4cb26 Mon Sep 17 00:00:00 2001 +From: Scott Chen +Date: Mon, 25 Apr 2022 17:00:20 +0800 +Subject: USB: serial: pl2303: add device id for HP LM930 Display + +From: Scott Chen + +commit 26a08f8bad3e1f98d3153f939fb8cd330da4cb26 upstream. + +Add the device id for the HPLM930Display which is a PL2303GC based +device. + +Signed-off-by: Scott Chen +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/pl2303.c | 1 + + drivers/usb/serial/pl2303.h | 1 + + 2 files changed, 2 insertions(+) + +--- a/drivers/usb/serial/pl2303.c ++++ b/drivers/usb/serial/pl2303.c +@@ -106,6 +106,7 @@ static const struct usb_device_id id_tab + { USB_DEVICE(HP_VENDOR_ID, HP_LCM220_PRODUCT_ID) }, + { USB_DEVICE(HP_VENDOR_ID, HP_LCM960_PRODUCT_ID) }, + { USB_DEVICE(HP_VENDOR_ID, HP_LM920_PRODUCT_ID) }, ++ { USB_DEVICE(HP_VENDOR_ID, HP_LM930_PRODUCT_ID) }, + { USB_DEVICE(HP_VENDOR_ID, HP_LM940_PRODUCT_ID) }, + { USB_DEVICE(HP_VENDOR_ID, HP_TD620_PRODUCT_ID) }, + { USB_DEVICE(CRESSI_VENDOR_ID, CRESSI_EDY_PRODUCT_ID) }, +--- a/drivers/usb/serial/pl2303.h ++++ b/drivers/usb/serial/pl2303.h +@@ -135,6 +135,7 @@ + #define HP_TD620_PRODUCT_ID 0x0956 + #define HP_LD960_PRODUCT_ID 0x0b39 + #define HP_LD381_PRODUCT_ID 0x0f7f ++#define HP_LM930_PRODUCT_ID 0x0f9b + #define HP_LCM220_PRODUCT_ID 0x3139 + #define HP_LCM960_PRODUCT_ID 0x3239 + #define HP_LD220_PRODUCT_ID 0x3524 diff --git a/queue-5.17/usb-serial-qcserial-add-support-for-sierra-wireless-em7590.patch b/queue-5.17/usb-serial-qcserial-add-support-for-sierra-wireless-em7590.patch new file mode 100644 index 00000000000..1abb3aae781 --- /dev/null +++ b/queue-5.17/usb-serial-qcserial-add-support-for-sierra-wireless-em7590.patch @@ -0,0 +1,31 @@ +From 870b1eee2d844727b06e238c121d260bc5645580 Mon Sep 17 00:00:00 2001 +From: Ethan Yang +Date: Mon, 25 Apr 2022 13:58:40 +0800 +Subject: USB: serial: qcserial: add support for Sierra Wireless EM7590 + +From: Ethan Yang + +commit 870b1eee2d844727b06e238c121d260bc5645580 upstream. + +Add support for Sierra Wireless EM7590 0xc080/0xc081 compositions. + +Signed-off-by: Ethan Yang +Link: https://lore.kernel.org/r/20220425055840.5693-1-etyang@sierrawireless.com +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/qcserial.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/serial/qcserial.c ++++ b/drivers/usb/serial/qcserial.c +@@ -166,6 +166,8 @@ static const struct usb_device_id id_tab + {DEVICE_SWI(0x1199, 0x9090)}, /* Sierra Wireless EM7565 QDL */ + {DEVICE_SWI(0x1199, 0x9091)}, /* Sierra Wireless EM7565 */ + {DEVICE_SWI(0x1199, 0x90d2)}, /* Sierra Wireless EM9191 QDL */ ++ {DEVICE_SWI(0x1199, 0xc080)}, /* Sierra Wireless EM7590 QDL */ ++ {DEVICE_SWI(0x1199, 0xc081)}, /* Sierra Wireless EM7590 */ + {DEVICE_SWI(0x413c, 0x81a2)}, /* Dell Wireless 5806 Gobi(TM) 4G LTE Mobile Broadband Card */ + {DEVICE_SWI(0x413c, 0x81a3)}, /* Dell Wireless 5570 HSPA+ (42Mbps) Mobile Broadband Card */ + {DEVICE_SWI(0x413c, 0x81a4)}, /* Dell Wireless 5570e HSPA+ (42Mbps) Mobile Broadband Card */ diff --git a/queue-5.17/usb-typec-tcpci-don-t-skip-cleanup-in-.remove-on-error.patch b/queue-5.17/usb-typec-tcpci-don-t-skip-cleanup-in-.remove-on-error.patch new file mode 100644 index 00000000000..6aee066983a --- /dev/null +++ b/queue-5.17/usb-typec-tcpci-don-t-skip-cleanup-in-.remove-on-error.patch @@ -0,0 +1,53 @@ +From bbc126ae381cf0a27822c1f822d0aeed74cc40d9 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= +Date: Mon, 2 May 2022 10:04:56 +0200 +Subject: usb: typec: tcpci: Don't skip cleanup in .remove() on error +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +commit bbc126ae381cf0a27822c1f822d0aeed74cc40d9 upstream. + +Returning an error value in an i2c remove callback results in an error +message being emitted by the i2c core, but otherwise it doesn't make a +difference. The device goes away anyhow and the devm cleanups are +called. + +In this case the remove callback even returns early without stopping the +tcpm worker thread and various timers. A work scheduled on the work +queue, or a firing timer after tcpci_remove() returned probably results +in a use-after-free situation because the regmap and driver data were +freed. So better make sure that tcpci_unregister_port() is called even +if disabling the irq failed. + +Also emit a more specific error message instead of the i2c core's +"remove failed (EIO), will be ignored" and return 0 to suppress the +core's warning. + +This patch is (also) a preparation for making i2c remove callbacks +return void. + +Fixes: 3ba76256fc4e ("usb: typec: tcpci: mask event interrupts when remove driver") +Signed-off-by: Uwe Kleine-König +Cc: stable +Acked-by: Heikki Krogerus +Reviewed-by: Guenter Roeck +Link: https://lore.kernel.org/r/20220502080456.21568-1-u.kleine-koenig@pengutronix.de +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/typec/tcpm/tcpci.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/typec/tcpm/tcpci.c ++++ b/drivers/usb/typec/tcpm/tcpci.c +@@ -877,7 +877,7 @@ static int tcpci_remove(struct i2c_clien + /* Disable chip interrupts before unregistering port */ + err = tcpci_write16(chip->tcpci, TCPC_ALERT_MASK, 0); + if (err < 0) +- return err; ++ dev_warn(&client->dev, "Failed to disable irqs (%pe)\n", ERR_PTR(err)); + + tcpci_unregister_port(chip->tcpci); + diff --git a/queue-5.17/usb-typec-tcpci_mt6360-update-for-bmc-phy-setting.patch b/queue-5.17/usb-typec-tcpci_mt6360-update-for-bmc-phy-setting.patch new file mode 100644 index 00000000000..10c6e7dfe45 --- /dev/null +++ b/queue-5.17/usb-typec-tcpci_mt6360-update-for-bmc-phy-setting.patch @@ -0,0 +1,106 @@ +From 4031cd95cba70c72e4cadc2d46624bcd31e5a6c0 Mon Sep 17 00:00:00 2001 +From: ChiYuan Huang +Date: Tue, 10 May 2022 13:13:00 +0800 +Subject: usb: typec: tcpci_mt6360: Update for BMC PHY setting + +From: ChiYuan Huang + +commit 4031cd95cba70c72e4cadc2d46624bcd31e5a6c0 upstream. + +Update MT6360 BMC PHY Tx/Rx setting for the compatibility. + +Macpaul reported this CtoDP cable attention message cannot be received from +MT6360 TCPC. But actually, attention message really sent from UFP_D +device. + +After RD's comment, there may be BMC PHY Tx/Rx setting causes this issue. + +Below's the detailed TCPM log and DP attention message didn't received from 6360 +TCPCI. +[ 1206.367775] Identity: 0000:0000.0000 +[ 1206.416570] Alternate mode 0: SVID 0xff01, VDO 1: 0x00000405 +[ 1206.447378] AMS DFP_TO_UFP_ENTER_MODE start +[ 1206.447383] PD TX, header: 0x1d6f +[ 1206.449393] PD TX complete, status: 0 +[ 1206.454110] PD RX, header: 0x184f [1] +[ 1206.456867] Rx VDM cmd 0xff018144 type 1 cmd 4 len 1 +[ 1206.456872] AMS DFP_TO_UFP_ENTER_MODE finished +[ 1206.456873] cc:=4 +[ 1206.473100] AMS STRUCTURED_VDMS start +[ 1206.473103] PD TX, header: 0x2f6f +[ 1206.475397] PD TX complete, status: 0 +[ 1206.480442] PD RX, header: 0x2a4f [1] +[ 1206.483145] Rx VDM cmd 0xff018150 type 1 cmd 16 len 2 +[ 1206.483150] AMS STRUCTURED_VDMS finished +[ 1206.483151] cc:=4 +[ 1206.505643] AMS STRUCTURED_VDMS start +[ 1206.505646] PD TX, header: 0x216f +[ 1206.507933] PD TX complete, status: 0 +[ 1206.512664] PD RX, header: 0x1c4f [1] +[ 1206.515456] Rx VDM cmd 0xff018151 type 1 cmd 17 len 1 +[ 1206.515460] AMS STRUCTURED_VDMS finished +[ 1206.515461] cc:=4 + +Fixes: e1aefcdd394fd ("usb typec: mt6360: Add support for mt6360 Type-C driver") +Cc: stable +Reported-by: Macpaul Lin +Tested-by: Macpaul Lin +Reviewed-by: Guenter Roeck +Acked-by: Heikki Krogerus +Signed-off-by: ChiYuan Huang +Signed-off-by: Fabien Parent +Link: https://lore.kernel.org/r/1652159580-30959-1-git-send-email-u0084500@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/typec/tcpm/tcpci_mt6360.c | 26 ++++++++++++++++++++++++++ + 1 file changed, 26 insertions(+) + +--- a/drivers/usb/typec/tcpm/tcpci_mt6360.c ++++ b/drivers/usb/typec/tcpm/tcpci_mt6360.c +@@ -15,6 +15,9 @@ + + #include "tcpci.h" + ++#define MT6360_REG_PHYCTRL1 0x80 ++#define MT6360_REG_PHYCTRL3 0x82 ++#define MT6360_REG_PHYCTRL7 0x86 + #define MT6360_REG_VCONNCTRL1 0x8C + #define MT6360_REG_MODECTRL2 0x8F + #define MT6360_REG_SWRESET 0xA0 +@@ -22,6 +25,8 @@ + #define MT6360_REG_DRPCTRL1 0xA2 + #define MT6360_REG_DRPCTRL2 0xA3 + #define MT6360_REG_I2CTORST 0xBF ++#define MT6360_REG_PHYCTRL11 0xCA ++#define MT6360_REG_RXCTRL1 0xCE + #define MT6360_REG_RXCTRL2 0xCF + #define MT6360_REG_CTDCTRL2 0xEC + +@@ -106,6 +111,27 @@ static int mt6360_tcpc_init(struct tcpci + if (ret) + return ret; + ++ /* BMC PHY */ ++ ret = mt6360_tcpc_write16(regmap, MT6360_REG_PHYCTRL1, 0x3A70); ++ if (ret) ++ return ret; ++ ++ ret = regmap_write(regmap, MT6360_REG_PHYCTRL3, 0x82); ++ if (ret) ++ return ret; ++ ++ ret = regmap_write(regmap, MT6360_REG_PHYCTRL7, 0x36); ++ if (ret) ++ return ret; ++ ++ ret = mt6360_tcpc_write16(regmap, MT6360_REG_PHYCTRL11, 0x3C60); ++ if (ret) ++ return ret; ++ ++ ret = regmap_write(regmap, MT6360_REG_RXCTRL1, 0xE8); ++ if (ret) ++ return ret; ++ + /* Set shipping mode off, AUTOIDLE on */ + return regmap_write(regmap, MT6360_REG_MODECTRL2, 0x7A); + } diff --git a/queue-5.17/writeback-avoid-skipping-inode-writeback.patch b/queue-5.17/writeback-avoid-skipping-inode-writeback.patch new file mode 100644 index 00000000000..16c1ed13b40 --- /dev/null +++ b/queue-5.17/writeback-avoid-skipping-inode-writeback.patch @@ -0,0 +1,68 @@ +From 846a3351ddfe4a86eede4bb26a205c3f38ef84d3 Mon Sep 17 00:00:00 2001 +From: Jing Xia +Date: Tue, 10 May 2022 10:35:14 +0800 +Subject: writeback: Avoid skipping inode writeback + +From: Jing Xia + +commit 846a3351ddfe4a86eede4bb26a205c3f38ef84d3 upstream. + +We have run into an issue that a task gets stuck in +balance_dirty_pages_ratelimited() when perform I/O stress testing. +The reason we observed is that an I_DIRTY_PAGES inode with lots +of dirty pages is in b_dirty_time list and standard background +writeback cannot writeback the inode. +After studing the relevant code, the following scenario may lead +to the issue: + +task1 task2 +----- ----- +fuse_flush + write_inode_now //in b_dirty_time + writeback_single_inode + __writeback_single_inode + fuse_write_end + filemap_dirty_folio + __xa_set_mark:PAGECACHE_TAG_DIRTY + lock inode->i_lock + if mapping tagged PAGECACHE_TAG_DIRTY + inode->i_state |= I_DIRTY_PAGES + unlock inode->i_lock + __mark_inode_dirty:I_DIRTY_PAGES + lock inode->i_lock + -was dirty,inode stays in + -b_dirty_time + unlock inode->i_lock + + if(!(inode->i_state & I_DIRTY_All)) + -not true,so nothing done + +This patch moves the dirty inode to b_dirty list when the inode +currently is not queued in b_io or b_more_io list at the end of +writeback_single_inode. + +Reviewed-by: Jan Kara +Reviewed-by: Christoph Hellwig +CC: stable@vger.kernel.org +Fixes: 0ae45f63d4ef ("vfs: add support for a lazytime mount option") +Signed-off-by: Jing Xia +Signed-off-by: Jan Kara +Link: https://lore.kernel.org/r/20220510023514.27399-1-jing.xia@unisoc.com +Signed-off-by: Greg Kroah-Hartman +--- + fs/fs-writeback.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/fs/fs-writeback.c ++++ b/fs/fs-writeback.c +@@ -1749,6 +1749,10 @@ static int writeback_single_inode(struct + */ + if (!(inode->i_state & I_DIRTY_ALL)) + inode_cgwb_move_to_attached(inode, wb); ++ else if (!(inode->i_state & I_SYNC_QUEUED) && ++ (inode->i_state & I_DIRTY)) ++ redirty_tail_locked(inode, wb); ++ + spin_unlock(&wb->list_lock); + inode_sync_complete(inode); + out: -- 2.47.3