From: Sasha Levin Date: Sun, 21 Jan 2024 00:19:16 +0000 (-0500) Subject: Fixes for 5.15 X-Git-Tag: v4.19.306~130 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=453312f47e92f4a215145b237818d94e97d072c1;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.15 Signed-off-by: Sasha Levin --- diff --git a/queue-5.15/acpi-extlog-clear-extended-error-log-status-when-ras.patch b/queue-5.15/acpi-extlog-clear-extended-error-log-status-when-ras.patch new file mode 100644 index 00000000000..385816c7c2e --- /dev/null +++ b/queue-5.15/acpi-extlog-clear-extended-error-log-status-when-ras.patch @@ -0,0 +1,48 @@ +From bc8f55be5d4060537d414286957013fd3cbd1999 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Dec 2023 13:22:39 -0800 +Subject: ACPI: extlog: Clear Extended Error Log status when RAS_CEC handled + the error + +From: Tony Luck + +[ Upstream commit 38c872a9e96f72f2947affc0526cc05659367d3d ] + +When both CONFIG_RAS_CEC and CONFIG_ACPI_EXTLOG are enabled, Linux does +not clear the status word of the BIOS supplied error record for corrected +errors. This may prevent logging of subsequent uncorrected errors. + +Fix by clearing the status. + +Fixes: 23ba710a0864 ("x86/mce: Fix all mce notifiers to update the mce->kflags bitmask") +Reported-by: Erwin Tsaur +Signed-off-by: Tony Luck +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/acpi_extlog.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/acpi/acpi_extlog.c b/drivers/acpi/acpi_extlog.c +index e648158368a7..088db2356998 100644 +--- a/drivers/acpi/acpi_extlog.c ++++ b/drivers/acpi/acpi_extlog.c +@@ -145,9 +145,14 @@ static int extlog_print(struct notifier_block *nb, unsigned long val, + static u32 err_seq; + + estatus = extlog_elog_entry_check(cpu, bank); +- if (estatus == NULL || (mce->kflags & MCE_HANDLED_CEC)) ++ if (!estatus) + return NOTIFY_DONE; + ++ if (mce->kflags & MCE_HANDLED_CEC) { ++ estatus->block_status = 0; ++ return NOTIFY_DONE; ++ } ++ + memcpy(elog_buf, (void *)estatus, ELOG_ENTRY_LEN); + /* clear record status to enable BIOS to update it again */ + estatus->block_status = 0; +-- +2.43.0 + diff --git a/queue-5.15/acpi-lpit-avoid-u32-multiplication-overflow.patch b/queue-5.15/acpi-lpit-avoid-u32-multiplication-overflow.patch new file mode 100644 index 00000000000..0065f355c58 --- /dev/null +++ b/queue-5.15/acpi-lpit-avoid-u32-multiplication-overflow.patch @@ -0,0 +1,40 @@ +From 7b348c6b2e4dd7766c189c44852589ae227b3203 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Nov 2023 21:08:59 +0300 +Subject: ACPI: LPIT: Avoid u32 multiplication overflow + +From: Nikita Kiryushin + +[ Upstream commit 56d2eeda87995245300836ee4dbd13b002311782 ] + +In lpit_update_residency() there is a possibility of overflow +in multiplication, if tsc_khz is large enough (> UINT_MAX/1000). + +Change multiplication to mul_u32_u32(). + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: eeb2d80d502a ("ACPI / LPIT: Add Low Power Idle Table (LPIT) support") +Signed-off-by: Nikita Kiryushin +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/acpi_lpit.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/acpi/acpi_lpit.c b/drivers/acpi/acpi_lpit.c +index 48e5059d67ca..7de59730030c 100644 +--- a/drivers/acpi/acpi_lpit.c ++++ b/drivers/acpi/acpi_lpit.c +@@ -98,7 +98,7 @@ static void lpit_update_residency(struct lpit_residency_info *info, + struct acpi_lpit_native *lpit_native) + { + info->frequency = lpit_native->counter_frequency ? +- lpit_native->counter_frequency : tsc_khz * 1000; ++ lpit_native->counter_frequency : mul_u32_u32(tsc_khz, 1000U); + if (!info->frequency) + info->frequency = 1; + +-- +2.43.0 + diff --git a/queue-5.15/acpi-lpss-fix-the-fractional-clock-divider-flags.patch b/queue-5.15/acpi-lpss-fix-the-fractional-clock-divider-flags.patch new file mode 100644 index 00000000000..71a0515e843 --- /dev/null +++ b/queue-5.15/acpi-lpss-fix-the-fractional-clock-divider-flags.patch @@ -0,0 +1,40 @@ +From 348a022133d762d771d9088696f96643e60264fd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Dec 2023 13:14:29 +0200 +Subject: ACPI: LPSS: Fix the fractional clock divider flags + +From: Andy Shevchenko + +[ Upstream commit 3ebccf1d1ca74bbb78e6f8c38d1d172e468d91f8 ] + +The conversion to CLK_FRAC_DIVIDER_POWER_OF_TWO_PS uses wrong flags +in the parameters and hence miscalculates the values in the clock +divider. Fix this by applying the flag to the proper parameter. + +Fixes: 82f53f9ee577 ("clk: fractional-divider: Introduce POWER_OF_TWO_PS flag") +Reported-by: Alex Vinarskis +Signed-off-by: Andy Shevchenko +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/acpi_lpss.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/acpi/acpi_lpss.c b/drivers/acpi/acpi_lpss.c +index f609f9d62efd..332befb5f579 100644 +--- a/drivers/acpi/acpi_lpss.c ++++ b/drivers/acpi/acpi_lpss.c +@@ -439,8 +439,9 @@ static int register_device_clock(struct acpi_device *adev, + if (!clk_name) + return -ENOMEM; + clk = clk_register_fractional_divider(NULL, clk_name, parent, ++ 0, prv_base, 1, 15, 16, 15, + CLK_FRAC_DIVIDER_POWER_OF_TWO_PS, +- prv_base, 1, 15, 16, 15, 0, NULL); ++ NULL); + parent = clk_name; + + clk_name = kasprintf(GFP_KERNEL, "%s-update", devname); +-- +2.43.0 + diff --git a/queue-5.15/acpi-video-check-for-error-while-searching-for-backl.patch b/queue-5.15/acpi-video-check-for-error-while-searching-for-backl.patch new file mode 100644 index 00000000000..e0d000c1594 --- /dev/null +++ b/queue-5.15/acpi-video-check-for-error-while-searching-for-backl.patch @@ -0,0 +1,54 @@ +From fe787123f118a307e1f708bc81988e4faeef4847 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Nov 2023 16:49:25 +0300 +Subject: ACPI: video: check for error while searching for backlight device + parent + +From: Nikita Kiryushin + +[ Upstream commit ccd45faf4973746c4f30ea41eec864e5cf191099 ] + +If acpi_get_parent() called in acpi_video_dev_register_backlight() +fails, for example, because acpi_ut_acquire_mutex() fails inside +acpi_get_parent), this can lead to incorrect (uninitialized) +acpi_parent handle being passed to acpi_get_pci_dev() for detecting +the parent pci device. + +Check acpi_get_parent() result and set parent device only in case of success. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 9661e92c10a9 ("acpi: tie ACPI backlight devices to PCI devices if possible") +Signed-off-by: Nikita Kiryushin +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/acpi_video.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/drivers/acpi/acpi_video.c b/drivers/acpi/acpi_video.c +index 2b18b51f6351..61bcdc75bee7 100644 +--- a/drivers/acpi/acpi_video.c ++++ b/drivers/acpi/acpi_video.c +@@ -1793,12 +1793,12 @@ static void acpi_video_dev_register_backlight(struct acpi_video_device *device) + return; + count++; + +- acpi_get_parent(device->dev->handle, &acpi_parent); +- +- pdev = acpi_get_pci_dev(acpi_parent); +- if (pdev) { +- parent = &pdev->dev; +- pci_dev_put(pdev); ++ if (ACPI_SUCCESS(acpi_get_parent(device->dev->handle, &acpi_parent))) { ++ pdev = acpi_get_pci_dev(acpi_parent); ++ if (pdev) { ++ parent = &pdev->dev; ++ pci_dev_put(pdev); ++ } + } + + memset(&props, 0, sizeof(struct backlight_properties)); +-- +2.43.0 + diff --git a/queue-5.15/alsa-scarlett2-add-clamp-in-scarlett2_mixer_ctl_put.patch b/queue-5.15/alsa-scarlett2-add-clamp-in-scarlett2_mixer_ctl_put.patch new file mode 100644 index 00000000000..d207161cf63 --- /dev/null +++ b/queue-5.15/alsa-scarlett2-add-clamp-in-scarlett2_mixer_ctl_put.patch @@ -0,0 +1,39 @@ +From 2e8473b579d6aafba7ecc476e1edd55e42dc1982 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Dec 2023 04:07:52 +1030 +Subject: ALSA: scarlett2: Add clamp() in scarlett2_mixer_ctl_put() + +From: Geoffrey D. Bennett + +[ Upstream commit 04f8f053252b86c7583895c962d66747ecdc61b7 ] + +Ensure the value passed to scarlett2_mixer_ctl_put() is between 0 and +SCARLETT2_MIXER_MAX_VALUE so we don't attempt to access outside +scarlett2_mixer_values[]. + +Signed-off-by: Geoffrey D. Bennett +Fixes: 9e4d5c1be21f ("ALSA: usb-audio: Scarlett Gen 2 mixer interface") +Link: https://lore.kernel.org/r/3b19fb3da641b587749b85fe1daa1b4e696c0c1b.1703001053.git.g@b4.vu +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/usb/mixer_scarlett_gen2.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/sound/usb/mixer_scarlett_gen2.c b/sound/usb/mixer_scarlett_gen2.c +index 9302f45b62ac..0a9025e3c867 100644 +--- a/sound/usb/mixer_scarlett_gen2.c ++++ b/sound/usb/mixer_scarlett_gen2.c +@@ -3237,7 +3237,8 @@ static int scarlett2_mixer_ctl_put(struct snd_kcontrol *kctl, + mutex_lock(&private->data_mutex); + + oval = private->mix[index]; +- val = ucontrol->value.integer.value[0]; ++ val = clamp(ucontrol->value.integer.value[0], ++ 0L, (long)SCARLETT2_MIXER_MAX_VALUE); + num_mixer_in = port_count[SCARLETT2_PORT_TYPE_MIX][SCARLETT2_PORT_OUT]; + mix_num = index / num_mixer_in; + +-- +2.43.0 + diff --git a/queue-5.15/alsa-scarlett2-add-missing-error-check-to-scarlett2_.patch b/queue-5.15/alsa-scarlett2-add-missing-error-check-to-scarlett2_.patch new file mode 100644 index 00000000000..3396721fc8a --- /dev/null +++ b/queue-5.15/alsa-scarlett2-add-missing-error-check-to-scarlett2_.patch @@ -0,0 +1,44 @@ +From df643308fc3d05a44db2e6c69be0615e0caa8f8f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Dec 2023 04:07:00 +1030 +Subject: ALSA: scarlett2: Add missing error check to scarlett2_config_save() + +From: Geoffrey D. Bennett + +[ Upstream commit 5f6ff6931a1c0065a55448108940371e1ac8075f ] + +scarlett2_config_save() was ignoring the return value from +scarlett2_usb(). As this function is not called from user-space we +can't return the error, so call usb_audio_err() instead. + +Signed-off-by: Geoffrey D. Bennett +Fixes: 9e4d5c1be21f ("ALSA: usb-audio: Scarlett Gen 2 mixer interface") +Link: https://lore.kernel.org/r/bf0a15332d852d7825fa6da87d2a0d9c0b702053.1703001053.git.g@b4.vu +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/usb/mixer_scarlett_gen2.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/sound/usb/mixer_scarlett_gen2.c b/sound/usb/mixer_scarlett_gen2.c +index 53ebabf42472..6e79872e68c4 100644 +--- a/sound/usb/mixer_scarlett_gen2.c ++++ b/sound/usb/mixer_scarlett_gen2.c +@@ -1213,9 +1213,11 @@ static void scarlett2_config_save(struct usb_mixer_interface *mixer) + { + __le32 req = cpu_to_le32(SCARLETT2_USB_CONFIG_SAVE); + +- scarlett2_usb(mixer, SCARLETT2_USB_DATA_CMD, +- &req, sizeof(u32), +- NULL, 0); ++ int err = scarlett2_usb(mixer, SCARLETT2_USB_DATA_CMD, ++ &req, sizeof(u32), ++ NULL, 0); ++ if (err < 0) ++ usb_audio_err(mixer->chip, "config save failed: %d\n", err); + } + + /* Delayed work to save config */ +-- +2.43.0 + diff --git a/queue-5.15/alsa-scarlett2-add-missing-error-check-to-scarlett2_.patch-9803 b/queue-5.15/alsa-scarlett2-add-missing-error-check-to-scarlett2_.patch-9803 new file mode 100644 index 00000000000..3c8f6e56602 --- /dev/null +++ b/queue-5.15/alsa-scarlett2-add-missing-error-check-to-scarlett2_.patch-9803 @@ -0,0 +1,42 @@ +From 290128a17927cc3157acb28188f4fda5fc7717e5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Dec 2023 04:07:21 +1030 +Subject: ALSA: scarlett2: Add missing error check to + scarlett2_usb_set_config() + +From: Geoffrey D. Bennett + +[ Upstream commit ca459dfa7d4ed9098fcf13e410963be6ae9b6bf3 ] + +scarlett2_usb_set_config() calls scarlett2_usb_get() but was not +checking the result. Return the error if it fails rather than +continuing with an invalid value. + +Signed-off-by: Geoffrey D. Bennett +Fixes: 9e15fae6c51a ("ALSA: usb-audio: scarlett2: Allow bit-level access to config") +Link: https://lore.kernel.org/r/def110c5c31dbdf0a7414d258838a0a31c0fab67.1703001053.git.g@b4.vu +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/usb/mixer_scarlett_gen2.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/sound/usb/mixer_scarlett_gen2.c b/sound/usb/mixer_scarlett_gen2.c +index 6e79872e68c4..f8787a4b1e13 100644 +--- a/sound/usb/mixer_scarlett_gen2.c ++++ b/sound/usb/mixer_scarlett_gen2.c +@@ -1266,7 +1266,10 @@ static int scarlett2_usb_set_config( + size = 1; + offset = config_item->offset; + +- scarlett2_usb_get(mixer, offset, &tmp, 1); ++ err = scarlett2_usb_get(mixer, offset, &tmp, 1); ++ if (err < 0) ++ return err; ++ + if (value) + tmp |= (1 << index); + else +-- +2.43.0 + diff --git a/queue-5.15/alsa-scarlett2-add-missing-error-checks-to-_ctl_get.patch b/queue-5.15/alsa-scarlett2-add-missing-error-checks-to-_ctl_get.patch new file mode 100644 index 00000000000..6075d2ad24b --- /dev/null +++ b/queue-5.15/alsa-scarlett2-add-missing-error-checks-to-_ctl_get.patch @@ -0,0 +1,356 @@ +From b2bc1aa44173ef80c21a5e28890c2dd6a9db0337 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Dec 2023 04:07:37 +1030 +Subject: ALSA: scarlett2: Add missing error checks to *_ctl_get() + +From: Geoffrey D. Bennett + +[ Upstream commit 50603a67daef161c78c814580d57f7f0be57167e ] + +The *_ctl_get() functions which call scarlett2_update_*() were not +checking the return value. Fix to check the return value and pass to +the caller. + +Signed-off-by: Geoffrey D. Bennett +Fixes: 9e4d5c1be21f ("ALSA: usb-audio: Scarlett Gen 2 mixer interface") +Link: https://lore.kernel.org/r/32a5fdc83b05fa74e0fcdd672fbf71d75c5f0a6d.1703001053.git.g@b4.vu +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/usb/mixer_scarlett_gen2.c | 182 +++++++++++++++++++++++--------- + 1 file changed, 130 insertions(+), 52 deletions(-) + +diff --git a/sound/usb/mixer_scarlett_gen2.c b/sound/usb/mixer_scarlett_gen2.c +index ad46a0d3e33b..9302f45b62ac 100644 +--- a/sound/usb/mixer_scarlett_gen2.c ++++ b/sound/usb/mixer_scarlett_gen2.c +@@ -1674,14 +1674,20 @@ static int scarlett2_sync_ctl_get(struct snd_kcontrol *kctl, + struct usb_mixer_elem_info *elem = kctl->private_data; + struct usb_mixer_interface *mixer = elem->head.mixer; + struct scarlett2_data *private = mixer->private_data; ++ int err = 0; + + mutex_lock(&private->data_mutex); +- if (private->sync_updated) +- scarlett2_update_sync(mixer); ++ ++ if (private->sync_updated) { ++ err = scarlett2_update_sync(mixer); ++ if (err < 0) ++ goto unlock; ++ } + ucontrol->value.enumerated.item[0] = private->sync; +- mutex_unlock(&private->data_mutex); + +- return 0; ++unlock: ++ mutex_unlock(&private->data_mutex); ++ return err; + } + + static const struct snd_kcontrol_new scarlett2_sync_ctl = { +@@ -1764,14 +1770,20 @@ static int scarlett2_master_volume_ctl_get(struct snd_kcontrol *kctl, + struct usb_mixer_elem_info *elem = kctl->private_data; + struct usb_mixer_interface *mixer = elem->head.mixer; + struct scarlett2_data *private = mixer->private_data; ++ int err = 0; + + mutex_lock(&private->data_mutex); +- if (private->vol_updated) +- scarlett2_update_volumes(mixer); +- mutex_unlock(&private->data_mutex); + ++ if (private->vol_updated) { ++ err = scarlett2_update_volumes(mixer); ++ if (err < 0) ++ goto unlock; ++ } + ucontrol->value.integer.value[0] = private->master_vol; +- return 0; ++ ++unlock: ++ mutex_unlock(&private->data_mutex); ++ return err; + } + + static int line_out_remap(struct scarlett2_data *private, int index) +@@ -1797,14 +1809,20 @@ static int scarlett2_volume_ctl_get(struct snd_kcontrol *kctl, + struct usb_mixer_interface *mixer = elem->head.mixer; + struct scarlett2_data *private = mixer->private_data; + int index = line_out_remap(private, elem->control); ++ int err = 0; + + mutex_lock(&private->data_mutex); +- if (private->vol_updated) +- scarlett2_update_volumes(mixer); +- mutex_unlock(&private->data_mutex); + ++ if (private->vol_updated) { ++ err = scarlett2_update_volumes(mixer); ++ if (err < 0) ++ goto unlock; ++ } + ucontrol->value.integer.value[0] = private->vol[index]; +- return 0; ++ ++unlock: ++ mutex_unlock(&private->data_mutex); ++ return err; + } + + static int scarlett2_volume_ctl_put(struct snd_kcontrol *kctl, +@@ -1871,14 +1889,20 @@ static int scarlett2_mute_ctl_get(struct snd_kcontrol *kctl, + struct usb_mixer_interface *mixer = elem->head.mixer; + struct scarlett2_data *private = mixer->private_data; + int index = line_out_remap(private, elem->control); ++ int err = 0; + + mutex_lock(&private->data_mutex); +- if (private->vol_updated) +- scarlett2_update_volumes(mixer); +- mutex_unlock(&private->data_mutex); + ++ if (private->vol_updated) { ++ err = scarlett2_update_volumes(mixer); ++ if (err < 0) ++ goto unlock; ++ } + ucontrol->value.integer.value[0] = private->mute_switch[index]; +- return 0; ++ ++unlock: ++ mutex_unlock(&private->data_mutex); ++ return err; + } + + static int scarlett2_mute_ctl_put(struct snd_kcontrol *kctl, +@@ -2124,14 +2148,20 @@ static int scarlett2_level_enum_ctl_get(struct snd_kcontrol *kctl, + const struct scarlett2_device_info *info = private->info; + + int index = elem->control + info->level_input_first; ++ int err = 0; + + mutex_lock(&private->data_mutex); +- if (private->input_other_updated) +- scarlett2_update_input_other(mixer); ++ ++ if (private->input_other_updated) { ++ err = scarlett2_update_input_other(mixer); ++ if (err < 0) ++ goto unlock; ++ } + ucontrol->value.enumerated.item[0] = private->level_switch[index]; +- mutex_unlock(&private->data_mutex); + +- return 0; ++unlock: ++ mutex_unlock(&private->data_mutex); ++ return err; + } + + static int scarlett2_level_enum_ctl_put(struct snd_kcontrol *kctl, +@@ -2182,15 +2212,21 @@ static int scarlett2_pad_ctl_get(struct snd_kcontrol *kctl, + struct usb_mixer_elem_info *elem = kctl->private_data; + struct usb_mixer_interface *mixer = elem->head.mixer; + struct scarlett2_data *private = mixer->private_data; ++ int err = 0; + + mutex_lock(&private->data_mutex); +- if (private->input_other_updated) +- scarlett2_update_input_other(mixer); ++ ++ if (private->input_other_updated) { ++ err = scarlett2_update_input_other(mixer); ++ if (err < 0) ++ goto unlock; ++ } + ucontrol->value.integer.value[0] = + private->pad_switch[elem->control]; +- mutex_unlock(&private->data_mutex); + +- return 0; ++unlock: ++ mutex_unlock(&private->data_mutex); ++ return err; + } + + static int scarlett2_pad_ctl_put(struct snd_kcontrol *kctl, +@@ -2240,14 +2276,20 @@ static int scarlett2_air_ctl_get(struct snd_kcontrol *kctl, + struct usb_mixer_elem_info *elem = kctl->private_data; + struct usb_mixer_interface *mixer = elem->head.mixer; + struct scarlett2_data *private = mixer->private_data; ++ int err = 0; + + mutex_lock(&private->data_mutex); +- if (private->input_other_updated) +- scarlett2_update_input_other(mixer); ++ ++ if (private->input_other_updated) { ++ err = scarlett2_update_input_other(mixer); ++ if (err < 0) ++ goto unlock; ++ } + ucontrol->value.integer.value[0] = private->air_switch[elem->control]; +- mutex_unlock(&private->data_mutex); + +- return 0; ++unlock: ++ mutex_unlock(&private->data_mutex); ++ return err; + } + + static int scarlett2_air_ctl_put(struct snd_kcontrol *kctl, +@@ -2297,15 +2339,21 @@ static int scarlett2_phantom_ctl_get(struct snd_kcontrol *kctl, + struct usb_mixer_elem_info *elem = kctl->private_data; + struct usb_mixer_interface *mixer = elem->head.mixer; + struct scarlett2_data *private = mixer->private_data; ++ int err = 0; + + mutex_lock(&private->data_mutex); +- if (private->input_other_updated) +- scarlett2_update_input_other(mixer); ++ ++ if (private->input_other_updated) { ++ err = scarlett2_update_input_other(mixer); ++ if (err < 0) ++ goto unlock; ++ } + ucontrol->value.integer.value[0] = + private->phantom_switch[elem->control]; +- mutex_unlock(&private->data_mutex); + +- return 0; ++unlock: ++ mutex_unlock(&private->data_mutex); ++ return err; + } + + static int scarlett2_phantom_ctl_put(struct snd_kcontrol *kctl, +@@ -2477,14 +2525,20 @@ static int scarlett2_direct_monitor_ctl_get( + struct usb_mixer_elem_info *elem = kctl->private_data; + struct usb_mixer_interface *mixer = elem->head.mixer; + struct scarlett2_data *private = elem->head.mixer->private_data; ++ int err = 0; + + mutex_lock(&private->data_mutex); +- if (private->monitor_other_updated) +- scarlett2_update_monitor_other(mixer); ++ ++ if (private->monitor_other_updated) { ++ err = scarlett2_update_monitor_other(mixer); ++ if (err < 0) ++ goto unlock; ++ } + ucontrol->value.enumerated.item[0] = private->direct_monitor_switch; +- mutex_unlock(&private->data_mutex); + +- return 0; ++unlock: ++ mutex_unlock(&private->data_mutex); ++ return err; + } + + static int scarlett2_direct_monitor_ctl_put( +@@ -2584,14 +2638,20 @@ static int scarlett2_speaker_switch_enum_ctl_get( + struct usb_mixer_elem_info *elem = kctl->private_data; + struct usb_mixer_interface *mixer = elem->head.mixer; + struct scarlett2_data *private = mixer->private_data; ++ int err = 0; + + mutex_lock(&private->data_mutex); +- if (private->monitor_other_updated) +- scarlett2_update_monitor_other(mixer); ++ ++ if (private->monitor_other_updated) { ++ err = scarlett2_update_monitor_other(mixer); ++ if (err < 0) ++ goto unlock; ++ } + ucontrol->value.enumerated.item[0] = private->speaker_switching_switch; +- mutex_unlock(&private->data_mutex); + +- return 0; ++unlock: ++ mutex_unlock(&private->data_mutex); ++ return err; + } + + /* when speaker switching gets enabled, switch the main/alt speakers +@@ -2739,14 +2799,20 @@ static int scarlett2_talkback_enum_ctl_get( + struct usb_mixer_elem_info *elem = kctl->private_data; + struct usb_mixer_interface *mixer = elem->head.mixer; + struct scarlett2_data *private = mixer->private_data; ++ int err = 0; + + mutex_lock(&private->data_mutex); +- if (private->monitor_other_updated) +- scarlett2_update_monitor_other(mixer); ++ ++ if (private->monitor_other_updated) { ++ err = scarlett2_update_monitor_other(mixer); ++ if (err < 0) ++ goto unlock; ++ } + ucontrol->value.enumerated.item[0] = private->talkback_switch; +- mutex_unlock(&private->data_mutex); + +- return 0; ++unlock: ++ mutex_unlock(&private->data_mutex); ++ return err; + } + + static int scarlett2_talkback_enum_ctl_put( +@@ -2894,14 +2960,20 @@ static int scarlett2_dim_mute_ctl_get(struct snd_kcontrol *kctl, + struct usb_mixer_elem_info *elem = kctl->private_data; + struct usb_mixer_interface *mixer = elem->head.mixer; + struct scarlett2_data *private = mixer->private_data; ++ int err = 0; + + mutex_lock(&private->data_mutex); +- if (private->vol_updated) +- scarlett2_update_volumes(mixer); +- mutex_unlock(&private->data_mutex); + ++ if (private->vol_updated) { ++ err = scarlett2_update_volumes(mixer); ++ if (err < 0) ++ goto unlock; ++ } + ucontrol->value.integer.value[0] = private->dim_mute[elem->control]; +- return 0; ++ ++unlock: ++ mutex_unlock(&private->data_mutex); ++ return err; + } + + static int scarlett2_dim_mute_ctl_put(struct snd_kcontrol *kctl, +@@ -3272,14 +3344,20 @@ static int scarlett2_mux_src_enum_ctl_get(struct snd_kcontrol *kctl, + struct usb_mixer_interface *mixer = elem->head.mixer; + struct scarlett2_data *private = mixer->private_data; + int index = line_out_remap(private, elem->control); ++ int err = 0; + + mutex_lock(&private->data_mutex); +- if (private->mux_updated) +- scarlett2_usb_get_mux(mixer); ++ ++ if (private->mux_updated) { ++ err = scarlett2_usb_get_mux(mixer); ++ if (err < 0) ++ goto unlock; ++ } + ucontrol->value.enumerated.item[0] = private->mux[index]; +- mutex_unlock(&private->data_mutex); + +- return 0; ++unlock: ++ mutex_unlock(&private->data_mutex); ++ return err; + } + + static int scarlett2_mux_src_enum_ctl_put(struct snd_kcontrol *kctl, +-- +2.43.0 + diff --git a/queue-5.15/alsa-scarlett2-allow-passing-any-output-to-line_out_.patch b/queue-5.15/alsa-scarlett2-allow-passing-any-output-to-line_out_.patch new file mode 100644 index 00000000000..eac8c2e66f3 --- /dev/null +++ b/queue-5.15/alsa-scarlett2-allow-passing-any-output-to-line_out_.patch @@ -0,0 +1,83 @@ +From b8ef774514a435180ba583e1c91b063315ff5ca6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Oct 2023 04:36:16 +1030 +Subject: ALSA: scarlett2: Allow passing any output to line_out_remap() + +From: Geoffrey D. Bennett + +[ Upstream commit 2190b9aea4eb92ccf3176e35c17c959e40f1a81b ] + +Line outputs 3 & 4 on the Gen 3 18i8 are internally the analogue 7 and +8 outputs, and this renumbering is hidden from the user by +line_out_remap(). By allowing higher values (representing non-analogue +outputs) to be passed to line_out_remap(), repeated code from +scarlett2_mux_src_enum_ctl_get() and scarlett2_mux_src_enum_ctl_put() +can be removed. + +Signed-off-by: Geoffrey D. Bennett +Link: https://lore.kernel.org/r/3b70267931f5994628ab27306c73cddd17b93c8f.1698342632.git.g@b4.vu +Signed-off-by: Takashi Iwai +Stable-dep-of: 50603a67daef ("ALSA: scarlett2: Add missing error checks to *_ctl_get()") +Signed-off-by: Sasha Levin +--- + sound/usb/mixer_scarlett_gen2.c | 25 +++++++++---------------- + 1 file changed, 9 insertions(+), 16 deletions(-) + +diff --git a/sound/usb/mixer_scarlett_gen2.c b/sound/usb/mixer_scarlett_gen2.c +index f8787a4b1e13..ad46a0d3e33b 100644 +--- a/sound/usb/mixer_scarlett_gen2.c ++++ b/sound/usb/mixer_scarlett_gen2.c +@@ -1777,9 +1777,16 @@ static int scarlett2_master_volume_ctl_get(struct snd_kcontrol *kctl, + static int line_out_remap(struct scarlett2_data *private, int index) + { + const struct scarlett2_device_info *info = private->info; ++ const int (*port_count)[SCARLETT2_PORT_DIRNS] = info->port_count; ++ int line_out_count = ++ port_count[SCARLETT2_PORT_TYPE_ANALOGUE][SCARLETT2_PORT_OUT]; + + if (!info->line_out_remap_enable) + return index; ++ ++ if (index >= line_out_count) ++ return index; ++ + return info->line_out_remap[index]; + } + +@@ -3264,14 +3271,7 @@ static int scarlett2_mux_src_enum_ctl_get(struct snd_kcontrol *kctl, + struct usb_mixer_elem_info *elem = kctl->private_data; + struct usb_mixer_interface *mixer = elem->head.mixer; + struct scarlett2_data *private = mixer->private_data; +- const struct scarlett2_device_info *info = private->info; +- const int (*port_count)[SCARLETT2_PORT_DIRNS] = info->port_count; +- int line_out_count = +- port_count[SCARLETT2_PORT_TYPE_ANALOGUE][SCARLETT2_PORT_OUT]; +- int index = elem->control; +- +- if (index < line_out_count) +- index = line_out_remap(private, index); ++ int index = line_out_remap(private, elem->control); + + mutex_lock(&private->data_mutex); + if (private->mux_updated) +@@ -3288,16 +3288,9 @@ static int scarlett2_mux_src_enum_ctl_put(struct snd_kcontrol *kctl, + struct usb_mixer_elem_info *elem = kctl->private_data; + struct usb_mixer_interface *mixer = elem->head.mixer; + struct scarlett2_data *private = mixer->private_data; +- const struct scarlett2_device_info *info = private->info; +- const int (*port_count)[SCARLETT2_PORT_DIRNS] = info->port_count; +- int line_out_count = +- port_count[SCARLETT2_PORT_TYPE_ANALOGUE][SCARLETT2_PORT_OUT]; +- int index = elem->control; ++ int index = line_out_remap(private, elem->control); + int oval, val, err = 0; + +- if (index < line_out_count) +- index = line_out_remap(private, index); +- + mutex_lock(&private->data_mutex); + + oval = private->mux[index]; +-- +2.43.0 + diff --git a/queue-5.15/arm-davinci-always-select-config_cpu_arm926t.patch b/queue-5.15/arm-davinci-always-select-config_cpu_arm926t.patch new file mode 100644 index 00000000000..ba8f1b1d185 --- /dev/null +++ b/queue-5.15/arm-davinci-always-select-config_cpu_arm926t.patch @@ -0,0 +1,39 @@ +From 30a2fb91c94088887445cf25880759010d007e7b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Jan 2024 12:00:36 +0100 +Subject: ARM: davinci: always select CONFIG_CPU_ARM926T + +From: Arnd Bergmann + +[ Upstream commit 40974ee421b4d1fc74ac733d86899ce1b83d8f65 ] + +The select was lost by accident during the multiplatform conversion. +Any davinci-only + +arm-linux-gnueabi-ld: arch/arm/mach-davinci/sleep.o: in function `CACHE_FLUSH': +(.text+0x168): undefined reference to `arm926_flush_kern_cache_all' + +Fixes: f962396ce292 ("ARM: davinci: support multiplatform build for ARM v5") +Acked-by: Bartosz Golaszewski +Link: https://lore.kernel.org/r/20240108110055.1531153-1-arnd@kernel.org +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + arch/arm/mach-davinci/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm/mach-davinci/Kconfig b/arch/arm/mach-davinci/Kconfig +index 1d3aef84287d..01684347da9b 100644 +--- a/arch/arm/mach-davinci/Kconfig ++++ b/arch/arm/mach-davinci/Kconfig +@@ -3,6 +3,7 @@ + menuconfig ARCH_DAVINCI + bool "TI DaVinci" + depends on ARCH_MULTI_V5 ++ select CPU_ARM926T + select DAVINCI_TIMER + select ZONE_DMA + select PM_GENERIC_DOMAINS if PM +-- +2.43.0 + diff --git a/queue-5.15/arm-dts-qcom-apq8064-correct-xoadc-register-address.patch b/queue-5.15/arm-dts-qcom-apq8064-correct-xoadc-register-address.patch new file mode 100644 index 00000000000..0dd605e6612 --- /dev/null +++ b/queue-5.15/arm-dts-qcom-apq8064-correct-xoadc-register-address.patch @@ -0,0 +1,40 @@ +From 1f2692ada2ece69d5d41623a03443beba8c70103 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Sep 2023 14:02:35 +0300 +Subject: ARM: dts: qcom: apq8064: correct XOADC register address + +From: Dmitry Baryshkov + +[ Upstream commit 554557542e709e190eff8a598f0cde02647d533a ] + +The XOADC is present at the address 0x197 rather than just 197. It +doesn't change a lot (since the driver hardcodes all register +addresses), but the DT should present correct address anyway. + +Fixes: c4b70883ee33 ("ARM: dts: add XOADC and IIO HWMON to APQ8064") +Reviewed-by: Konrad Dybcio +Reviewed-by: Krzysztof Kozlowski +Signed-off-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20230928110309.1212221-3-dmitry.baryshkov@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/qcom-apq8064.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/qcom-apq8064.dtsi b/arch/arm/boot/dts/qcom-apq8064.dtsi +index 0e830476fefd..d70f071fd830 100644 +--- a/arch/arm/boot/dts/qcom-apq8064.dtsi ++++ b/arch/arm/boot/dts/qcom-apq8064.dtsi +@@ -760,7 +760,7 @@ pwrkey@1c { + + xoadc: xoadc@197 { + compatible = "qcom,pm8921-adc"; +- reg = <197>; ++ reg = <0x197>; + interrupts-extended = <&pmicintc 78 IRQ_TYPE_EDGE_RISING>; + #address-cells = <2>; + #size-cells = <0>; +-- +2.43.0 + diff --git a/queue-5.15/arm-dts-qcom-sdx65-correct-spmi-node-name.patch b/queue-5.15/arm-dts-qcom-sdx65-correct-spmi-node-name.patch new file mode 100644 index 00000000000..c20a5d3ab64 --- /dev/null +++ b/queue-5.15/arm-dts-qcom-sdx65-correct-spmi-node-name.patch @@ -0,0 +1,39 @@ +From b6b6b716ff4b5d53f5f9e1f3fdb59cef43bd9f99 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 24 Sep 2023 20:31:03 +0200 +Subject: ARM: dts: qcom: sdx65: correct SPMI node name + +From: Krzysztof Kozlowski + +[ Upstream commit a900ad783f507cb396e402827052e70c0c565ae9 ] + +Node names should not have vendor prefixes: + + qcom-sdx65-mtp.dtb: qcom,spmi@c440000: $nodename:0: 'qcom,spmi@c440000' does not match '^spmi@.* + +Reviewed-by: Konrad Dybcio +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20230924183103.49487-3-krzysztof.kozlowski@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/qcom-sdx55.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/qcom-sdx55.dtsi b/arch/arm/boot/dts/qcom-sdx55.dtsi +index 9d62487f6c8f..73fa0ef6b69e 100644 +--- a/arch/arm/boot/dts/qcom-sdx55.dtsi ++++ b/arch/arm/boot/dts/qcom-sdx55.dtsi +@@ -457,7 +457,7 @@ restart@c264000 { + reg = <0x0c264000 0x1000>; + }; + +- spmi_bus: qcom,spmi@c440000 { ++ spmi_bus: spmi@c440000 { + compatible = "qcom,spmi-pmic-arb"; + reg = <0x0c440000 0x0000d00>, + <0x0c600000 0x2000000>, +-- +2.43.0 + diff --git a/queue-5.15/arm64-dts-qcom-qrb5165-rb5-correct-led-panic-indicat.patch b/queue-5.15/arm64-dts-qcom-qrb5165-rb5-correct-led-panic-indicat.patch new file mode 100644 index 00000000000..165fa839017 --- /dev/null +++ b/queue-5.15/arm64-dts-qcom-qrb5165-rb5-correct-led-panic-indicat.patch @@ -0,0 +1,42 @@ +From 6e57fe2a6923b6167e4e17333fcc10152a579458 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 11 Nov 2023 10:46:23 +0100 +Subject: arm64: dts: qcom: qrb5165-rb5: correct LED panic indicator + +From: Krzysztof Kozlowski + +[ Upstream commit dc6b5562acbac0285ab3b2dad23930b6434bdfc6 ] + +There is no "panic-indicator" default trigger but a property with that +name: + + qrb5165-rb5.dtb: leds: led-user4: Unevaluated properties are not allowed ('linux,default-trigger' was unexpected) + +Fixes: b5cbd84e499a ("arm64: dts: qcom: qrb5165-rb5: Add onboard LED support") +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Manivannan Sadhasivam +Reviewed-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20231111094623.12476-1-krzysztof.kozlowski@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/qrb5165-rb5.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/qrb5165-rb5.dts b/arch/arm64/boot/dts/qcom/qrb5165-rb5.dts +index d3449cb52def..9ef0afdae148 100644 +--- a/arch/arm64/boot/dts/qcom/qrb5165-rb5.dts ++++ b/arch/arm64/boot/dts/qcom/qrb5165-rb5.dts +@@ -58,8 +58,8 @@ leds { + user4 { + label = "green:user4"; + gpios = <&pm8150_gpios 10 GPIO_ACTIVE_HIGH>; +- linux,default-trigger = "panic-indicator"; + default-state = "off"; ++ panic-indicator; + }; + + wlan { +-- +2.43.0 + diff --git a/queue-5.15/arm64-dts-qcom-sc7180-make-watchdog-bark-interrupt-e.patch b/queue-5.15/arm64-dts-qcom-sc7180-make-watchdog-bark-interrupt-e.patch new file mode 100644 index 00000000000..bf3f95cd00b --- /dev/null +++ b/queue-5.15/arm64-dts-qcom-sc7180-make-watchdog-bark-interrupt-e.patch @@ -0,0 +1,58 @@ +From b1976d5b34f5d7c1a291a97b5669de9c9d7249de Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Nov 2023 14:43:28 -0800 +Subject: arm64: dts: qcom: sc7180: Make watchdog bark interrupt edge triggered + +From: Douglas Anderson + +[ Upstream commit 7ac90b4cf107a3999b30844d7899e0331686b33b ] + +On sc7180 when the watchdog timer fires your logs get filled with: + watchdog0: pretimeout event + watchdog0: pretimeout event + watchdog0: pretimeout event + ... + watchdog0: pretimeout event + +If you're using console-ramoops to debug crashes the above gets quite +annoying since it blows away any other log messages that might have +been there. + +The issue is that the "bark" interrupt (AKA the "pretimeout" +interrupt) remains high until the watchdog is pet. Since we've got +things configured as "level" triggered we'll keep getting interrupted +over and over. + +Let's switch to edge triggered. Now we'll get one interrupt when the +"bark" interrupt goes off and won't get another one until the "bark" +interrupt is cleared and asserts again. + +This matches how many older Qualcomm SoCs have things configured. + +Fixes: 28cc13e4060c ("arm64: dts: qcom: sc7180: Add watchdog bark interrupt") +Reviewed-by: Guenter Roeck +Reviewed-by: Stephen Boyd +Signed-off-by: Douglas Anderson +Link: https://lore.kernel.org/r/20231106144335.v2.1.Ic7577567baff921347d423b722de8b857602efb1@changeid +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sc7180.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/sc7180.dtsi b/arch/arm64/boot/dts/qcom/sc7180.dtsi +index 12816d60e249..410e0305eb51 100644 +--- a/arch/arm64/boot/dts/qcom/sc7180.dtsi ++++ b/arch/arm64/boot/dts/qcom/sc7180.dtsi +@@ -3366,7 +3366,7 @@ watchdog@17c10000 { + compatible = "qcom,apss-wdt-sc7180", "qcom,kpss-wdt"; + reg = <0 0x17c10000 0 0x1000>; + clocks = <&sleep_clk>; +- interrupts = ; ++ interrupts = ; + }; + + timer@17c20000{ +-- +2.43.0 + diff --git a/queue-5.15/arm64-dts-qcom-sc7280-fix-usb_2-wakeup-interrupt-typ.patch b/queue-5.15/arm64-dts-qcom-sc7280-fix-usb_2-wakeup-interrupt-typ.patch new file mode 100644 index 00000000000..5e6c0facaaa --- /dev/null +++ b/queue-5.15/arm64-dts-qcom-sc7280-fix-usb_2-wakeup-interrupt-typ.patch @@ -0,0 +1,43 @@ +From caef158b3b9ca996b1cb9b1955cfb0879b8a1ca2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Nov 2023 17:43:25 +0100 +Subject: arm64: dts: qcom: sc7280: fix usb_2 wakeup interrupt types + +From: Johan Hovold + +[ Upstream commit 24f8aba9a7c77c7e9d814a5754798e8346c7dd28 ] + +The DP/DM wakeup interrupts are edge triggered and which edge to trigger +on depends on use-case and whether a Low speed or Full/High speed device +is connected. + +Note that only triggering on rising edges can be used to detect resume +events but not disconnect events. + +Fixes: bb9efa59c665 ("arm64: dts: qcom: sc7280: Add USB related nodes") +Signed-off-by: Johan Hovold +Link: https://lore.kernel.org/r/20231120164331.8116-6-johan+linaro@kernel.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sc7280.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sc7280.dtsi b/arch/arm64/boot/dts/qcom/sc7280.dtsi +index 9971b8763e08..e0c7f72773d6 100644 +--- a/arch/arm64/boot/dts/qcom/sc7280.dtsi ++++ b/arch/arm64/boot/dts/qcom/sc7280.dtsi +@@ -1290,8 +1290,8 @@ usb_2: usb@8cf8800 { + assigned-clock-rates = <19200000>, <200000000>; + + interrupts-extended = <&intc GIC_SPI 240 IRQ_TYPE_LEVEL_HIGH>, +- <&pdc 13 IRQ_TYPE_EDGE_RISING>, +- <&pdc 12 IRQ_TYPE_EDGE_RISING>; ++ <&pdc 12 IRQ_TYPE_EDGE_BOTH>, ++ <&pdc 13 IRQ_TYPE_EDGE_BOTH>; + interrupt-names = "hs_phy_irq", + "dm_hs_phy_irq", "dp_hs_phy_irq"; + +-- +2.43.0 + diff --git a/queue-5.15/arm64-dts-qcom-sc7280-make-watchdog-bark-interrupt-e.patch b/queue-5.15/arm64-dts-qcom-sc7280-make-watchdog-bark-interrupt-e.patch new file mode 100644 index 00000000000..5eee08b701a --- /dev/null +++ b/queue-5.15/arm64-dts-qcom-sc7280-make-watchdog-bark-interrupt-e.patch @@ -0,0 +1,40 @@ +From f0704290ed46aa7b30c804fca63ab3abea2019d9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Nov 2023 14:43:29 -0800 +Subject: arm64: dts: qcom: sc7280: Make watchdog bark interrupt edge triggered + +From: Douglas Anderson + +[ Upstream commit 6897fac411db7b43243f67d4fd4d3f95abf7f656 ] + +As described in the patch ("arm64: dts: qcom: sc7180: Make watchdog +bark interrupt edge triggered"), the Qualcomm watchdog timer's bark +interrupt should be configured as edge triggered. Make the change. + +Fixes: 0e51f883daa9 ("arm64: dts: qcom: sc7280: Add APSS watchdog node") +Reviewed-by: Guenter Roeck +Reviewed-by: Stephen Boyd +Signed-off-by: Douglas Anderson +Link: https://lore.kernel.org/r/20231106144335.v2.2.I11f77956d2492c88aca0ef5462123f225caf4fb4@changeid +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sc7280.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/sc7280.dtsi b/arch/arm64/boot/dts/qcom/sc7280.dtsi +index dc4aab258ff6..9971b8763e08 100644 +--- a/arch/arm64/boot/dts/qcom/sc7280.dtsi ++++ b/arch/arm64/boot/dts/qcom/sc7280.dtsi +@@ -1711,7 +1711,7 @@ watchdog@17c10000 { + compatible = "qcom,apss-wdt-sc7280", "qcom,kpss-wdt"; + reg = <0 0x17c10000 0 0x1000>; + clocks = <&sleep_clk>; +- interrupts = ; ++ interrupts = ; + }; + + timer@17c20000 { +-- +2.43.0 + diff --git a/queue-5.15/arm64-dts-qcom-sc7280-mark-sdhci-hosts-as-cache-cohe.patch b/queue-5.15/arm64-dts-qcom-sc7280-mark-sdhci-hosts-as-cache-cohe.patch new file mode 100644 index 00000000000..34fa9e9fd71 --- /dev/null +++ b/queue-5.15/arm64-dts-qcom-sc7280-mark-sdhci-hosts-as-cache-cohe.patch @@ -0,0 +1,44 @@ +From 98afcf18c7c01165d84c4642ab8d53a2fe73ce0d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Dec 2023 15:38:33 +0100 +Subject: arm64: dts: qcom: sc7280: Mark SDHCI hosts as cache-coherent + +From: Konrad Dybcio + +[ Upstream commit 827f5fc8d912203c1f971e47d61130b13c6820ba ] + +The SDHCI hosts on SC7280 are cache-coherent, just like on most fairly +recent Qualcomm SoCs. Mark them as such. + +Fixes: 298c81a7d44f ("arm64: dts: qcom: sc7280: Add nodes for eMMC and SD card") +Signed-off-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20231218-topic-7280_dmac_sdhci-v1-1-97af7efd64a1@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sc7280.dtsi | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/arm64/boot/dts/qcom/sc7280.dtsi b/arch/arm64/boot/dts/qcom/sc7280.dtsi +index e0c7f72773d6..929fc0667e98 100644 +--- a/arch/arm64/boot/dts/qcom/sc7280.dtsi ++++ b/arch/arm64/boot/dts/qcom/sc7280.dtsi +@@ -485,6 +485,7 @@ sdhc_1: sdhci@7c4000 { + + bus-width = <8>; + supports-cqe; ++ dma-coherent; + + qcom,dll-config = <0x0007642c>; + qcom,ddr-config = <0x80040868>; +@@ -1174,6 +1175,7 @@ sdhc_2: sdhci@8804000 { + operating-points-v2 = <&sdhc2_opp_table>; + + bus-width = <4>; ++ dma-coherent; + + qcom,dll-config = <0x0007642c>; + +-- +2.43.0 + diff --git a/queue-5.15/arm64-dts-qcom-sdm845-db845c-correct-led-panic-indic.patch b/queue-5.15/arm64-dts-qcom-sdm845-db845c-correct-led-panic-indic.patch new file mode 100644 index 00000000000..eacb53be8b1 --- /dev/null +++ b/queue-5.15/arm64-dts-qcom-sdm845-db845c-correct-led-panic-indic.patch @@ -0,0 +1,41 @@ +From 85ed43321fd46a5c637eccada4934d3c1ad0d8a7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 11 Nov 2023 10:56:16 +0100 +Subject: arm64: dts: qcom: sdm845-db845c: correct LED panic indicator + +From: Krzysztof Kozlowski + +[ Upstream commit 0c90c75e663246203a2b7f6dd9e08a110f4c3c43 ] + +There is no "panic-indicator" default trigger but a property with that +name: + + sdm845-db845c.dtb: leds: led-0: Unevaluated properties are not allowed ('linux,default-trigger' was unexpected) + +Fixes: 3f72e2d3e682 ("arm64: dts: qcom: Add Dragonboard 845c") +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20231111095617.16496-1-krzysztof.kozlowski@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sdm845-db845c.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/sdm845-db845c.dts b/arch/arm64/boot/dts/qcom/sdm845-db845c.dts +index 5ce270f0b2ec..62877311e5c2 100644 +--- a/arch/arm64/boot/dts/qcom/sdm845-db845c.dts ++++ b/arch/arm64/boot/dts/qcom/sdm845-db845c.dts +@@ -55,8 +55,8 @@ leds { + user4 { + label = "green:user4"; + gpios = <&pm8998_gpio 13 GPIO_ACTIVE_HIGH>; +- linux,default-trigger = "panic-indicator"; + default-state = "off"; ++ panic-indicator; + }; + + wlan { +-- +2.43.0 + diff --git a/queue-5.15/arm64-dts-qcom-sdm845-make-watchdog-bark-interrupt-e.patch b/queue-5.15/arm64-dts-qcom-sdm845-make-watchdog-bark-interrupt-e.patch new file mode 100644 index 00000000000..23d4564bf28 --- /dev/null +++ b/queue-5.15/arm64-dts-qcom-sdm845-make-watchdog-bark-interrupt-e.patch @@ -0,0 +1,40 @@ +From dccfda0fd26cbd137832ad05665f4f42f44706fb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Nov 2023 14:43:30 -0800 +Subject: arm64: dts: qcom: sdm845: Make watchdog bark interrupt edge triggered + +From: Douglas Anderson + +[ Upstream commit 263b348499454f38d36b9442c3cf9279c571bb54 ] + +As described in the patch ("arm64: dts: qcom: sc7180: Make watchdog +bark interrupt edge triggered"), the Qualcomm watchdog timer's bark +interrupt should be configured as edge triggered. Make the change. + +Fixes: 36c436b03c58 ("arm64: dts: qcom: sdm845: Add watchdog bark interrupt") +Reviewed-by: Guenter Roeck +Reviewed-by: Stephen Boyd +Signed-off-by: Douglas Anderson +Link: https://lore.kernel.org/r/20231106144335.v2.3.I16675ebe5517c68453a1bd7f4334ff885f806c03@changeid +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sdm845.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/sdm845.dtsi b/arch/arm64/boot/dts/qcom/sdm845.dtsi +index 6a0e30cbf88f..5a78ee8622c9 100644 +--- a/arch/arm64/boot/dts/qcom/sdm845.dtsi ++++ b/arch/arm64/boot/dts/qcom/sdm845.dtsi +@@ -4725,7 +4725,7 @@ watchdog@17980000 { + compatible = "qcom,apss-wdt-sdm845", "qcom,kpss-wdt"; + reg = <0 0x17980000 0 0x1000>; + clocks = <&sleep_clk>; +- interrupts = ; ++ interrupts = ; + }; + + apss_shared: mailbox@17990000 { +-- +2.43.0 + diff --git a/queue-5.15/arm64-dts-qcom-sm8150-hdk-fix-ss-usb-regulators.patch b/queue-5.15/arm64-dts-qcom-sm8150-hdk-fix-ss-usb-regulators.patch new file mode 100644 index 00000000000..9d5de178f44 --- /dev/null +++ b/queue-5.15/arm64-dts-qcom-sm8150-hdk-fix-ss-usb-regulators.patch @@ -0,0 +1,70 @@ +From 5a69760a8ff0e433c36c60b8de0541a30e821df5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Dec 2023 19:40:35 +0200 +Subject: arm64: dts: qcom: sm8150-hdk: fix SS USB regulators + +From: Dmitry Baryshkov + +[ Upstream commit a509adf05b2aac31b22781f5aa09e4768a5b6c39 ] + +The SM8150-HDK uses two different regulators to power up SuperSpeed USB +PHYs. The L5A regulator is used for the second USB host, while the first +(OTG) USB host uses different regulator, L18A. Fix the regulator for the +usb_1 QMPPHY and (to remove possible confusion) drop the +usb_ss_dp_core_1/_2 labels. + +Fixes: 0ab1b2d10afe ("arm64: dts: qcom: add sm8150 hdk dts") +Reviewed-by: Konrad Dybcio +Signed-off-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20231215174152.315403-4-dmitry.baryshkov@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sm8150-hdk.dts | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sm8150-hdk.dts b/arch/arm64/boot/dts/qcom/sm8150-hdk.dts +index 335aa0753fc0..716e964946ed 100644 +--- a/arch/arm64/boot/dts/qcom/sm8150-hdk.dts ++++ b/arch/arm64/boot/dts/qcom/sm8150-hdk.dts +@@ -126,8 +126,6 @@ vdda_qrefs_0p875_5: + vdda_sp_sensor: + vdda_ufs_2ln_core_1: + vdda_ufs_2ln_core_2: +- vdda_usb_ss_dp_core_1: +- vdda_usb_ss_dp_core_2: + vdda_qlink_lv: + vdda_qlink_lv_ck: + vreg_l5a_0p875: ldo5 { +@@ -209,6 +207,12 @@ vreg_l17a_3p0: ldo17 { + regulator-max-microvolt = <3008000>; + regulator-initial-mode = ; + }; ++ ++ vreg_l18a_0p8: ldo18 { ++ regulator-min-microvolt = <880000>; ++ regulator-max-microvolt = <880000>; ++ regulator-initial-mode = ; ++ }; + }; + + pm8150l-rpmh-regulators { +@@ -441,13 +445,13 @@ &usb_2_hsphy { + &usb_1_qmpphy { + status = "okay"; + vdda-phy-supply = <&vreg_l3c_1p2>; +- vdda-pll-supply = <&vdda_usb_ss_dp_core_1>; ++ vdda-pll-supply = <&vreg_l18a_0p8>; + }; + + &usb_2_qmpphy { + status = "okay"; + vdda-phy-supply = <&vreg_l3c_1p2>; +- vdda-pll-supply = <&vdda_usb_ss_dp_core_1>; ++ vdda-pll-supply = <&vreg_l5a_0p875>; + }; + + &usb_1 { +-- +2.43.0 + diff --git a/queue-5.15/arm64-dts-qcom-sm8150-make-watchdog-bark-interrupt-e.patch b/queue-5.15/arm64-dts-qcom-sm8150-make-watchdog-bark-interrupt-e.patch new file mode 100644 index 00000000000..6d3da133d4e --- /dev/null +++ b/queue-5.15/arm64-dts-qcom-sm8150-make-watchdog-bark-interrupt-e.patch @@ -0,0 +1,40 @@ +From 026a64c2bd8f58dd2846c1b261989efaccc29131 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Nov 2023 14:43:31 -0800 +Subject: arm64: dts: qcom: sm8150: Make watchdog bark interrupt edge triggered + +From: Douglas Anderson + +[ Upstream commit 9204e9a4099212c850e1703c374ef4538080825b ] + +As described in the patch ("arm64: dts: qcom: sc7180: Make watchdog +bark interrupt edge triggered"), the Qualcomm watchdog timer's bark +interrupt should be configured as edge triggered. Make the change. + +Fixes: b094c8f8dd2a ("arm64: dts: qcom: sm8150: Add watchdog bark interrupt") +Reviewed-by: Guenter Roeck +Reviewed-by: Stephen Boyd +Signed-off-by: Douglas Anderson +Link: https://lore.kernel.org/r/20231106144335.v2.4.I23d0aa6c8f1fec5c26ad9b3c610df6f4c5392850@changeid +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sm8150.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/sm8150.dtsi b/arch/arm64/boot/dts/qcom/sm8150.dtsi +index e8cb20c4cbf2..c6b6064e6b12 100644 +--- a/arch/arm64/boot/dts/qcom/sm8150.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm8150.dtsi +@@ -3359,7 +3359,7 @@ watchdog@17c10000 { + compatible = "qcom,apss-wdt-sm8150", "qcom,kpss-wdt"; + reg = <0 0x17c10000 0 0x1000>; + clocks = <&sleep_clk>; +- interrupts = ; ++ interrupts = ; + }; + + timer@17c20000 { +-- +2.43.0 + diff --git a/queue-5.15/arm64-dts-qcom-sm8250-make-watchdog-bark-interrupt-e.patch b/queue-5.15/arm64-dts-qcom-sm8250-make-watchdog-bark-interrupt-e.patch new file mode 100644 index 00000000000..0029b86188e --- /dev/null +++ b/queue-5.15/arm64-dts-qcom-sm8250-make-watchdog-bark-interrupt-e.patch @@ -0,0 +1,40 @@ +From 42c0fca98ae8ce8d20e78565ad8cbc8bcaa95758 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Nov 2023 14:43:32 -0800 +Subject: arm64: dts: qcom: sm8250: Make watchdog bark interrupt edge triggered + +From: Douglas Anderson + +[ Upstream commit 735d80e2e8e5d073ae8b1fff8b1589ea284aa5af ] + +As described in the patch ("arm64: dts: qcom: sc7180: Make watchdog +bark interrupt edge triggered"), the Qualcomm watchdog timer's bark +interrupt should be configured as edge triggered. Make the change. + +Fixes: 46a4359f9156 ("arm64: dts: qcom: sm8250: Add watchdog bark interrupt") +Reviewed-by: Guenter Roeck +Reviewed-by: Stephen Boyd +Signed-off-by: Douglas Anderson +Link: https://lore.kernel.org/r/20231106144335.v2.5.I2910e7c10493d896841e9785c1817df9b9a58701@changeid +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sm8250.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/sm8250.dtsi b/arch/arm64/boot/dts/qcom/sm8250.dtsi +index 5d6551e1fcd8..8880e9cbc974 100644 +--- a/arch/arm64/boot/dts/qcom/sm8250.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm8250.dtsi +@@ -3947,7 +3947,7 @@ watchdog@17c10000 { + compatible = "qcom,apss-wdt-sm8250", "qcom,kpss-wdt"; + reg = <0 0x17c10000 0 0x1000>; + clocks = <&sleep_clk>; +- interrupts = ; ++ interrupts = ; + }; + + timer@17c20000 { +-- +2.43.0 + diff --git a/queue-5.15/arm64-dts-ti-k3-am65-main-fix-dss-irq-trigger-type.patch b/queue-5.15/arm64-dts-ti-k3-am65-main-fix-dss-irq-trigger-type.patch new file mode 100644 index 00000000000..db0e801fadd --- /dev/null +++ b/queue-5.15/arm64-dts-ti-k3-am65-main-fix-dss-irq-trigger-type.patch @@ -0,0 +1,47 @@ +From 268ed50368164578252269385ce67583272c457f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Nov 2023 11:57:48 +0200 +Subject: arm64: dts: ti: k3-am65-main: Fix DSS irq trigger type + +From: Tomi Valkeinen + +[ Upstream commit b57160859263c083c49482b0d083a586b1517f78 ] + +DSS irq trigger type is set to IRQ_TYPE_EDGE_RISING in the DT file, but +the TRM says it is level triggered. + +For some reason triggering on rising edge results in double the amount +of expected interrupts, e.g. for normal page flipping test the number of +interrupts per second is 2 * fps. It is as if the IRQ triggers on both +edges. There are no other side effects to this issue than slightly +increased CPU & power consumption due to the extra interrupt. + +Switching to IRQ_TYPE_LEVEL_HIGH is correct and fixes the issue, so +let's do that. + +Fixes: fc539b90eda2 ("arm64: dts: ti: am654: Add DSS node") +Signed-off-by: Tomi Valkeinen +Reviewed-by: Aradhya Bhatia +Link: https://lore.kernel.org/r/20231106-am65-dss-clk-edge-v1-1-4a959fec0e1e@ideasonboard.com +Signed-off-by: Nishanth Menon +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/ti/k3-am65-main.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/ti/k3-am65-main.dtsi b/arch/arm64/boot/dts/ti/k3-am65-main.dtsi +index 4f232f575ab2..b729d2dee209 100644 +--- a/arch/arm64/boot/dts/ti/k3-am65-main.dtsi ++++ b/arch/arm64/boot/dts/ti/k3-am65-main.dtsi +@@ -855,7 +855,7 @@ dss: dss@4a00000 { + assigned-clocks = <&k3_clks 67 2>; + assigned-clock-parents = <&k3_clks 67 5>; + +- interrupts = ; ++ interrupts = ; + + dma-coherent; + +-- +2.43.0 + diff --git a/queue-5.15/asoc-cs35l33-fix-gpio-name-and-drop-legacy-include.patch b/queue-5.15/asoc-cs35l33-fix-gpio-name-and-drop-legacy-include.patch new file mode 100644 index 00000000000..f436fd28129 --- /dev/null +++ b/queue-5.15/asoc-cs35l33-fix-gpio-name-and-drop-legacy-include.patch @@ -0,0 +1,64 @@ +From 9419119c9c67b1c6fc51d3765f3b685cc1a9e029 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Dec 2023 14:20:31 +0100 +Subject: ASoC: cs35l33: Fix GPIO name and drop legacy include + +From: Linus Walleij + +[ Upstream commit 50678d339d670a92658e5538ebee30447c88ccb3 ] + +This driver includes the legacy GPIO APIs and + but does not use any symbols from any of +them. + +Drop the includes. + +Further the driver is requesting "reset-gpios" rather than +just "reset" from the GPIO framework. This is wrong because +the gpiolib core will add "-gpios" before processing the +request from e.g. device tree. Drop the suffix. + +The last problem means that the optional RESET GPIO has +never been properly retrieved and used even if it existed, +but nobody noticed. + +Fixes: 3333cb7187b9 ("ASoC: cs35l33: Initial commit of the cs35l33 CODEC driver.") +Acked-by: Charles Keepax +Signed-off-by: Linus Walleij +Link: https://lore.kernel.org/r/20231201-descriptors-sound-cirrus-v2-2-ee9f9d4655eb@linaro.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/cs35l33.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/sound/soc/codecs/cs35l33.c b/sound/soc/codecs/cs35l33.c +index 2a6f5e46d031..3ea311fda98f 100644 +--- a/sound/soc/codecs/cs35l33.c ++++ b/sound/soc/codecs/cs35l33.c +@@ -22,13 +22,11 @@ + #include + #include + #include +-#include + #include + #include + #include + #include + #include +-#include + #include + #include + #include +@@ -1169,7 +1167,7 @@ static int cs35l33_i2c_probe(struct i2c_client *i2c_client, + + /* We could issue !RST or skip it based on AMP topology */ + cs35l33->reset_gpio = devm_gpiod_get_optional(&i2c_client->dev, +- "reset-gpios", GPIOD_OUT_HIGH); ++ "reset", GPIOD_OUT_HIGH); + if (IS_ERR(cs35l33->reset_gpio)) { + dev_err(&i2c_client->dev, "%s ERROR: Can't get reset GPIO\n", + __func__); +-- +2.43.0 + diff --git a/queue-5.15/asoc-cs35l34-fix-gpio-name-and-drop-legacy-include.patch b/queue-5.15/asoc-cs35l34-fix-gpio-name-and-drop-legacy-include.patch new file mode 100644 index 00000000000..f9456d12f5f --- /dev/null +++ b/queue-5.15/asoc-cs35l34-fix-gpio-name-and-drop-legacy-include.patch @@ -0,0 +1,65 @@ +From c1be81884ce306ef1ecd1c24c1c8ca3b74d86073 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Dec 2023 14:20:32 +0100 +Subject: ASoC: cs35l34: Fix GPIO name and drop legacy include + +From: Linus Walleij + +[ Upstream commit a6122b0b4211d132934ef99e7b737910e6d54d2f ] + +This driver includes the legacy GPIO APIs and + but does not use any symbols from any of +them. + +Drop the includes. + +Further the driver is requesting "reset-gpios" rather than +just "reset" from the GPIO framework. This is wrong because +the gpiolib core will add "-gpios" before processing the +request from e.g. device tree. Drop the suffix. + +The last problem means that the optional RESET GPIO has +never been properly retrieved and used even if it existed, +but nobody noticed. + +Fixes: c1124c09e103 ("ASoC: cs35l34: Initial commit of the cs35l34 CODEC driver.") +Acked-by: Charles Keepax +Signed-off-by: Linus Walleij +Link: https://lore.kernel.org/r/20231201-descriptors-sound-cirrus-v2-3-ee9f9d4655eb@linaro.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/cs35l34.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/sound/soc/codecs/cs35l34.c b/sound/soc/codecs/cs35l34.c +index ed678241c22b..be0edeebddfe 100644 +--- a/sound/soc/codecs/cs35l34.c ++++ b/sound/soc/codecs/cs35l34.c +@@ -20,14 +20,12 @@ + #include + #include + #include +-#include + #include + #include + #include + #include + #include + #include +-#include + #include + #include + #include +@@ -1063,7 +1061,7 @@ static int cs35l34_i2c_probe(struct i2c_client *i2c_client, + dev_err(&i2c_client->dev, "Failed to request IRQ: %d\n", ret); + + cs35l34->reset_gpio = devm_gpiod_get_optional(&i2c_client->dev, +- "reset-gpios", GPIOD_OUT_LOW); ++ "reset", GPIOD_OUT_LOW); + if (IS_ERR(cs35l34->reset_gpio)) { + ret = PTR_ERR(cs35l34->reset_gpio); + goto err_regulator; +-- +2.43.0 + diff --git a/queue-5.15/asoc-rt5645-drop-double-ef20-entry-from-dmi_platform.patch b/queue-5.15/asoc-rt5645-drop-double-ef20-entry-from-dmi_platform.patch new file mode 100644 index 00000000000..62ace621ba2 --- /dev/null +++ b/queue-5.15/asoc-rt5645-drop-double-ef20-entry-from-dmi_platform.patch @@ -0,0 +1,53 @@ +From 4dc18b31e434425eaaa92ada59023649e8f43753 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 26 Nov 2023 22:40:18 +0100 +Subject: ASoC: rt5645: Drop double EF20 entry from dmi_platform_data[] + +From: Hans de Goede + +[ Upstream commit 51add1687f39292af626ac3c2046f49241713273 ] + +dmi_platform_data[] first contains a DMI entry matching: + + DMI_MATCH(DMI_PRODUCT_NAME, "EF20"), + +and then contains an identical entry except for the match being: + + DMI_MATCH(DMI_PRODUCT_NAME, "EF20EA"), + +Since these are partial (non exact) DMI matches the first match +will also match any board with "EF20EA" in their DMI product-name, +drop the second, redundant, entry. + +Fixes: a4dae468cfdd ("ASoC: rt5645: Add ACPI-defined GPIO for ECS EF20 series") +Cc: Chris Chiu +Signed-off-by: Hans de Goede +Link: https://msgid.link/r/20231126214024.300505-2-hdegoede@redhat.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/rt5645.c | 8 -------- + 1 file changed, 8 deletions(-) + +diff --git a/sound/soc/codecs/rt5645.c b/sound/soc/codecs/rt5645.c +index e7009f704b99..2fdfec505192 100644 +--- a/sound/soc/codecs/rt5645.c ++++ b/sound/soc/codecs/rt5645.c +@@ -3828,14 +3828,6 @@ static const struct dmi_system_id dmi_platform_data[] = { + }, + .driver_data = (void *)&ecs_ef20_platform_data, + }, +- { +- .ident = "EF20EA", +- .callback = cht_rt5645_ef20_quirk_cb, +- .matches = { +- DMI_MATCH(DMI_PRODUCT_NAME, "EF20EA"), +- }, +- .driver_data = (void *)&ecs_ef20_platform_data, +- }, + { } + }; + +-- +2.43.0 + diff --git a/queue-5.15/block-add-check-of-minors-and-first_minor-in-device_.patch b/queue-5.15/block-add-check-of-minors-and-first_minor-in-device_.patch new file mode 100644 index 00000000000..e92b4dd1aeb --- /dev/null +++ b/queue-5.15/block-add-check-of-minors-and-first_minor-in-device_.patch @@ -0,0 +1,45 @@ +From 2e7ea35199c93dd109d423d01df89db12efc1732 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Dec 2023 15:59:42 +0800 +Subject: block: add check of 'minors' and 'first_minor' in device_add_disk() + +From: Li Nan + +[ Upstream commit 4c434392c4777881d01beada6701eff8c76b43fe ] + +'first_minor' represents the starting minor number of disks, and +'minors' represents the number of partitions in the device. Neither +of them can be greater than MINORMASK + 1. + +Commit e338924bd05d ("block: check minor range in device_add_disk()") +only added the check of 'first_minor + minors'. However, their sum might +be less than MINORMASK but their values are wrong. Complete the checks now. + +Fixes: e338924bd05d ("block: check minor range in device_add_disk()") +Signed-off-by: Li Nan +Reviewed-by: Christoph Hellwig +Link: https://lore.kernel.org/r/20231219075942.840255-1-linan666@huaweicloud.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/genhd.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/block/genhd.c b/block/genhd.c +index 6aef540bbacf..84f5ac627e79 100644 +--- a/block/genhd.c ++++ b/block/genhd.c +@@ -421,7 +421,9 @@ int device_add_disk(struct device *parent, struct gendisk *disk, + DISK_MAX_PARTS); + disk->minors = DISK_MAX_PARTS; + } +- if (disk->first_minor + disk->minors > MINORMASK + 1) ++ if (disk->first_minor > MINORMASK || ++ disk->minors > MINORMASK + 1 || ++ disk->first_minor + disk->minors > MINORMASK + 1) + return -EINVAL; + } else { + if (WARN_ON(disk->minors)) +-- +2.43.0 + diff --git a/queue-5.15/block-make-blk_def_max_sectors-unsigned.patch b/queue-5.15/block-make-blk_def_max_sectors-unsigned.patch new file mode 100644 index 00000000000..a558133d82e --- /dev/null +++ b/queue-5.15/block-make-blk_def_max_sectors-unsigned.patch @@ -0,0 +1,75 @@ +From 68a2488888605f15f5040f4e5e3cc083580bd74b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Jan 2023 12:51:45 -0800 +Subject: block: make BLK_DEF_MAX_SECTORS unsigned + +From: Keith Busch + +[ Upstream commit 0a26f327e46c203229e72c823dfec71a2b405ec5 ] + +This is used as an unsigned value, so define it that way to avoid +having to cast it. + +Suggested-by: Christoph Hellwig +Signed-off-by: Keith Busch +Reviewed-by: Christoph Hellwig +Reviewed-by: Bart Van Assche +Reviewed-by: Martin K. Petersen +Link: https://lore.kernel.org/r/20230105205146.3610282-2-kbusch@meta.com +Signed-off-by: Jens Axboe +Stable-dep-of: 9a9525de8654 ("null_blk: don't cap max_hw_sectors to BLK_DEF_MAX_SECTORS") +Signed-off-by: Sasha Levin +--- + block/blk-settings.c | 2 +- + drivers/block/null_blk/main.c | 3 +-- + include/linux/blkdev.h | 3 ++- + 3 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/block/blk-settings.c b/block/blk-settings.c +index 73a80895e3ae..959b5c1e6d3b 100644 +--- a/block/blk-settings.c ++++ b/block/blk-settings.c +@@ -136,7 +136,7 @@ void blk_queue_max_hw_sectors(struct request_queue *q, unsigned int max_hw_secto + limits->max_hw_sectors = max_hw_sectors; + + max_sectors = min_not_zero(max_hw_sectors, limits->max_dev_sectors); +- max_sectors = min_t(unsigned int, max_sectors, BLK_DEF_MAX_SECTORS); ++ max_sectors = min(max_sectors, BLK_DEF_MAX_SECTORS); + max_sectors = round_down(max_sectors, + limits->logical_block_size >> SECTOR_SHIFT); + limits->max_sectors = max_sectors; +diff --git a/drivers/block/null_blk/main.c b/drivers/block/null_blk/main.c +index 686ec6bcdef3..4a867233b14a 100644 +--- a/drivers/block/null_blk/main.c ++++ b/drivers/block/null_blk/main.c +@@ -1902,8 +1902,7 @@ static int null_add_dev(struct nullb_device *dev) + blk_queue_physical_block_size(nullb->q, dev->blocksize); + if (!dev->max_sectors) + dev->max_sectors = queue_max_hw_sectors(nullb->q); +- dev->max_sectors = min_t(unsigned int, dev->max_sectors, +- BLK_DEF_MAX_SECTORS); ++ dev->max_sectors = min(dev->max_sectors, BLK_DEF_MAX_SECTORS); + blk_queue_max_hw_sectors(nullb->q, dev->max_sectors); + + if (dev->virt_boundary) +diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h +index 67344dfe07a7..905844172cfd 100644 +--- a/include/linux/blkdev.h ++++ b/include/linux/blkdev.h +@@ -1334,11 +1334,12 @@ static inline bool bdev_is_partition(struct block_device *bdev) + enum blk_default_limits { + BLK_MAX_SEGMENTS = 128, + BLK_SAFE_MAX_SECTORS = 255, +- BLK_DEF_MAX_SECTORS = 2560, + BLK_MAX_SEGMENT_SIZE = 65536, + BLK_SEG_BOUNDARY_MASK = 0xFFFFFFFFUL, + }; + ++#define BLK_DEF_MAX_SECTORS 2560u ++ + static inline unsigned long queue_segment_boundary(const struct request_queue *q) + { + return q->limits.seg_boundary_mask; +-- +2.43.0 + diff --git a/queue-5.15/block-set-memalloc_noio-to-false-on-device_add_disk-.patch b/queue-5.15/block-set-memalloc_noio-to-false-on-device_add_disk-.patch new file mode 100644 index 00000000000..f83ceabda3e --- /dev/null +++ b/queue-5.15/block-set-memalloc_noio-to-false-on-device_add_disk-.patch @@ -0,0 +1,39 @@ +From 81505f29b0c1c4f14750259834f7b268d49127d8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Dec 2023 15:53:56 +0800 +Subject: block: Set memalloc_noio to false on device_add_disk() error path + +From: Li Nan + +[ Upstream commit 5fa3d1a00c2d4ba14f1300371ad39d5456e890d7 ] + +On the error path of device_add_disk(), device's memalloc_noio flag was +set but not cleared. As the comment of pm_runtime_set_memalloc_noio(), +"The function should be called between device_add() and device_del()". +Clear this flag before device_del() now. + +Fixes: 25e823c8c37d ("block/genhd.c: apply pm_runtime_set_memalloc_noio on block devices") +Signed-off-by: Li Nan +Reviewed-by: Christoph Hellwig +Link: https://lore.kernel.org/r/20231211075356.1839282-1-linan666@huaweicloud.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/genhd.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/block/genhd.c b/block/genhd.c +index 62dd331db639..6aef540bbacf 100644 +--- a/block/genhd.c ++++ b/block/genhd.c +@@ -535,6 +535,7 @@ int device_add_disk(struct device *parent, struct gendisk *disk, + blk_integrity_del(disk); + out_del_block_link: + sysfs_remove_link(block_depr, dev_name(ddev)); ++ pm_runtime_set_memalloc_noio(ddev, false); + out_device_del: + device_del(ddev); + out_free_ext_minor: +-- +2.43.0 + diff --git a/queue-5.15/blocklayoutdriver-fix-reference-leak-of-pnfs_device_.patch b/queue-5.15/blocklayoutdriver-fix-reference-leak-of-pnfs_device_.patch new file mode 100644 index 00000000000..410454f20d6 --- /dev/null +++ b/queue-5.15/blocklayoutdriver-fix-reference-leak-of-pnfs_device_.patch @@ -0,0 +1,37 @@ +From 968a42988322a3b2f716d65227e9dcdbbb39732d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Dec 2023 10:05:01 -0500 +Subject: blocklayoutdriver: Fix reference leak of pnfs_device_node + +From: Benjamin Coddington + +[ Upstream commit 1530827b90025cdf80c9b0d07a166d045a0a7b81 ] + +The error path for blocklayout's device lookup is missing a reference drop +for the case where a lookup finds the device, but the device is marked with +NFS_DEVICEID_UNAVAILABLE. + +Fixes: b3dce6a2f060 ("pnfs/blocklayout: handle transient devices") +Signed-off-by: Benjamin Coddington +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + fs/nfs/blocklayout/blocklayout.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/fs/nfs/blocklayout/blocklayout.c b/fs/nfs/blocklayout/blocklayout.c +index fe860c538747..dc657b12822d 100644 +--- a/fs/nfs/blocklayout/blocklayout.c ++++ b/fs/nfs/blocklayout/blocklayout.c +@@ -599,6 +599,8 @@ bl_find_get_deviceid(struct nfs_server *server, + nfs4_delete_deviceid(node->ld, node->nfs_client, id); + goto retry; + } ++ ++ nfs4_put_deviceid_node(node); + return ERR_PTR(-ENODEV); + } + +-- +2.43.0 + diff --git a/queue-5.15/bluetooth-btmtkuart-fix-recv_buf-return-value.patch b/queue-5.15/bluetooth-btmtkuart-fix-recv_buf-return-value.patch new file mode 100644 index 00000000000..1bb25e3ab62 --- /dev/null +++ b/queue-5.15/bluetooth-btmtkuart-fix-recv_buf-return-value.patch @@ -0,0 +1,68 @@ +From 183dca72d628d50a6ae7862b9559e5b8bf9b83de Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Dec 2023 17:40:19 +0100 +Subject: Bluetooth: btmtkuart: fix recv_buf() return value + +From: Francesco Dolcini + +[ Upstream commit 64057f051f20c2a2184b9db7f8037d928d68a4f4 ] + +Serdev recv_buf() callback is supposed to return the amount of bytes +consumed, therefore an int in between 0 and count. + +Do not return negative number in case of issue, just print an error and +return count. This fixes a WARN in ttyport_receive_buf(). + +Link: https://lore.kernel.org/all/087be419-ec6b-47ad-851a-5e1e3ea5cfcc@kernel.org/ +Fixes: 7237c4c9ec92 ("Bluetooth: mediatek: Add protocol support for MediaTek serial devices") +Signed-off-by: Francesco Dolcini +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/btmtkuart.c | 11 +++-------- + 1 file changed, 3 insertions(+), 8 deletions(-) + +diff --git a/drivers/bluetooth/btmtkuart.c b/drivers/bluetooth/btmtkuart.c +index 9ba22b13b4fa..a831d734cd9e 100644 +--- a/drivers/bluetooth/btmtkuart.c ++++ b/drivers/bluetooth/btmtkuart.c +@@ -471,7 +471,7 @@ mtk_stp_split(struct btmtkuart_dev *bdev, const unsigned char *data, int count, + return data; + } + +-static int btmtkuart_recv(struct hci_dev *hdev, const u8 *data, size_t count) ++static void btmtkuart_recv(struct hci_dev *hdev, const u8 *data, size_t count) + { + struct btmtkuart_dev *bdev = hci_get_drvdata(hdev); + const unsigned char *p_left = data, *p_h4; +@@ -510,25 +510,20 @@ static int btmtkuart_recv(struct hci_dev *hdev, const u8 *data, size_t count) + bt_dev_err(bdev->hdev, + "Frame reassembly failed (%d)", err); + bdev->rx_skb = NULL; +- return err; ++ return; + } + + sz_left -= sz_h4; + p_left += sz_h4; + } +- +- return 0; + } + + static int btmtkuart_receive_buf(struct serdev_device *serdev, const u8 *data, + size_t count) + { + struct btmtkuart_dev *bdev = serdev_device_get_drvdata(serdev); +- int err; + +- err = btmtkuart_recv(bdev->hdev, data, count); +- if (err < 0) +- return err; ++ btmtkuart_recv(bdev->hdev, data, count); + + bdev->hdev->stat.byte_rx += count; + +-- +2.43.0 + diff --git a/queue-5.15/bluetooth-fix-bogus-check-for-re-auth-no-supported-w.patch b/queue-5.15/bluetooth-fix-bogus-check-for-re-auth-no-supported-w.patch new file mode 100644 index 00000000000..66698dc29b1 --- /dev/null +++ b/queue-5.15/bluetooth-fix-bogus-check-for-re-auth-no-supported-w.patch @@ -0,0 +1,88 @@ +From 966381dc71dec0908873ecf50aac8800ed71a023 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Nov 2023 14:58:03 +0100 +Subject: Bluetooth: Fix bogus check for re-auth no supported with non-ssp + +From: Luiz Augusto von Dentz + +[ Upstream commit d03376c185926098cb4d668d6458801eb785c0a5 ] + +This reverts 19f8def031bfa50c579149b200bfeeb919727b27 +"Bluetooth: Fix auth_complete_evt for legacy units" which seems to be +working around a bug on a broken controller rather then any limitation +imposed by the Bluetooth spec, in fact if there ws not possible to +re-auth the command shall fail not succeed. + +Fixes: 19f8def031bf ("Bluetooth: Fix auth_complete_evt for legacy units") +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + include/net/bluetooth/hci_core.h | 1 - + net/bluetooth/hci_conn.c | 8 +++----- + net/bluetooth/hci_event.c | 11 ++--------- + 3 files changed, 5 insertions(+), 15 deletions(-) + +diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h +index 9a21ccbb5b5c..b6114bc0dd0f 100644 +--- a/include/net/bluetooth/hci_core.h ++++ b/include/net/bluetooth/hci_core.h +@@ -852,7 +852,6 @@ void hci_inquiry_cache_flush(struct hci_dev *hdev); + /* ----- HCI Connections ----- */ + enum { + HCI_CONN_AUTH_PEND, +- HCI_CONN_REAUTH_PEND, + HCI_CONN_ENCRYPT_PEND, + HCI_CONN_RSWITCH_PEND, + HCI_CONN_MODE_CHANGE_PEND, +diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c +index ce538dbe89d1..700920aea39e 100644 +--- a/net/bluetooth/hci_conn.c ++++ b/net/bluetooth/hci_conn.c +@@ -1436,12 +1436,10 @@ static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type) + hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED, + sizeof(cp), &cp); + +- /* If we're already encrypted set the REAUTH_PEND flag, +- * otherwise set the ENCRYPT_PEND. ++ /* Set the ENCRYPT_PEND to trigger encryption after ++ * authentication. + */ +- if (test_bit(HCI_CONN_ENCRYPT, &conn->flags)) +- set_bit(HCI_CONN_REAUTH_PEND, &conn->flags); +- else ++ if (!test_bit(HCI_CONN_ENCRYPT, &conn->flags)) + set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags); + } + +diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c +index edf5132b5dc9..2ad2f4647847 100644 +--- a/net/bluetooth/hci_event.c ++++ b/net/bluetooth/hci_event.c +@@ -3017,14 +3017,8 @@ static void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb) + + if (!ev->status) { + clear_bit(HCI_CONN_AUTH_FAILURE, &conn->flags); +- +- if (!hci_conn_ssp_enabled(conn) && +- test_bit(HCI_CONN_REAUTH_PEND, &conn->flags)) { +- bt_dev_info(hdev, "re-auth of legacy device is not possible."); +- } else { +- set_bit(HCI_CONN_AUTH, &conn->flags); +- conn->sec_level = conn->pending_sec_level; +- } ++ set_bit(HCI_CONN_AUTH, &conn->flags); ++ conn->sec_level = conn->pending_sec_level; + } else { + if (ev->status == HCI_ERROR_PIN_OR_KEY_MISSING) + set_bit(HCI_CONN_AUTH_FAILURE, &conn->flags); +@@ -3033,7 +3027,6 @@ static void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb) + } + + clear_bit(HCI_CONN_AUTH_PEND, &conn->flags); +- clear_bit(HCI_CONN_REAUTH_PEND, &conn->flags); + + if (conn->state == BT_CONFIG) { + if (!ev->status && hci_conn_ssp_enabled(conn)) { +-- +2.43.0 + diff --git a/queue-5.15/bpf-add-crosstask-check-to-__bpf_get_stack.patch b/queue-5.15/bpf-add-crosstask-check-to-__bpf_get_stack.patch new file mode 100644 index 00000000000..dea99c1fa0b --- /dev/null +++ b/queue-5.15/bpf-add-crosstask-check-to-__bpf_get_stack.patch @@ -0,0 +1,121 @@ +From 239cbcc53f2b4ddea86a502c12a7c3d3b135d5b0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Nov 2023 03:23:34 -0800 +Subject: bpf: Add crosstask check to __bpf_get_stack + +From: Jordan Rome + +[ Upstream commit b8e3a87a627b575896e448021e5c2f8a3bc19931 ] + +Currently get_perf_callchain only supports user stack walking for +the current task. Passing the correct *crosstask* param will return +0 frames if the task passed to __bpf_get_stack isn't the current +one instead of a single incorrect frame/address. This change +passes the correct *crosstask* param but also does a preemptive +check in __bpf_get_stack if the task is current and returns +-EOPNOTSUPP if it is not. + +This issue was found using bpf_get_task_stack inside a BPF +iterator ("iter/task"), which iterates over all tasks. +bpf_get_task_stack works fine for fetching kernel stacks +but because get_perf_callchain relies on the caller to know +if the requested *task* is the current one (via *crosstask*) +it was failing in a confusing way. + +It might be possible to get user stacks for all tasks utilizing +something like access_process_vm but that requires the bpf +program calling bpf_get_task_stack to be sleepable and would +therefore be a breaking change. + +Fixes: fa28dcb82a38 ("bpf: Introduce helper bpf_get_task_stack()") +Signed-off-by: Jordan Rome +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20231108112334.3433136-1-jordalgo@meta.com +Signed-off-by: Sasha Levin +--- + include/uapi/linux/bpf.h | 3 +++ + kernel/bpf/stackmap.c | 11 ++++++++++- + tools/include/uapi/linux/bpf.h | 3 +++ + 3 files changed, 16 insertions(+), 1 deletion(-) + +diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h +index 9fb06a511250..1da082a8c4ec 100644 +--- a/include/uapi/linux/bpf.h ++++ b/include/uapi/linux/bpf.h +@@ -4245,6 +4245,8 @@ union bpf_attr { + * long bpf_get_task_stack(struct task_struct *task, void *buf, u32 size, u64 flags) + * Description + * Return a user or a kernel stack in bpf program provided buffer. ++ * Note: the user stack will only be populated if the *task* is ++ * the current task; all other tasks will return -EOPNOTSUPP. + * To achieve this, the helper needs *task*, which is a valid + * pointer to **struct task_struct**. To store the stacktrace, the + * bpf program provides *buf* with a nonnegative *size*. +@@ -4256,6 +4258,7 @@ union bpf_attr { + * + * **BPF_F_USER_STACK** + * Collect a user space stack instead of a kernel stack. ++ * The *task* must be the current task. + * **BPF_F_USER_BUILD_ID** + * Collect buildid+offset instead of ips for user stack, + * only valid if **BPF_F_USER_STACK** is also specified. +diff --git a/kernel/bpf/stackmap.c b/kernel/bpf/stackmap.c +index 7efae3af6201..f8587abef73c 100644 +--- a/kernel/bpf/stackmap.c ++++ b/kernel/bpf/stackmap.c +@@ -435,6 +435,7 @@ static long __bpf_get_stack(struct pt_regs *regs, struct task_struct *task, + { + u32 trace_nr, copy_len, elem_size, num_elem, max_depth; + bool user_build_id = flags & BPF_F_USER_BUILD_ID; ++ bool crosstask = task && task != current; + u32 skip = flags & BPF_F_SKIP_FIELD_MASK; + bool user = flags & BPF_F_USER_STACK; + struct perf_callchain_entry *trace; +@@ -457,6 +458,14 @@ static long __bpf_get_stack(struct pt_regs *regs, struct task_struct *task, + if (task && user && !user_mode(regs)) + goto err_fault; + ++ /* get_perf_callchain does not support crosstask user stack walking ++ * but returns an empty stack instead of NULL. ++ */ ++ if (crosstask && user) { ++ err = -EOPNOTSUPP; ++ goto clear; ++ } ++ + num_elem = size / elem_size; + max_depth = num_elem + skip; + if (sysctl_perf_event_max_stack < max_depth) +@@ -468,7 +477,7 @@ static long __bpf_get_stack(struct pt_regs *regs, struct task_struct *task, + trace = get_callchain_entry_for_task(task, max_depth); + else + trace = get_perf_callchain(regs, 0, kernel, user, max_depth, +- false, false); ++ crosstask, false); + if (unlikely(!trace)) + goto err_fault; + +diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h +index 1e3e3f16eabc..d83eaa35c581 100644 +--- a/tools/include/uapi/linux/bpf.h ++++ b/tools/include/uapi/linux/bpf.h +@@ -4245,6 +4245,8 @@ union bpf_attr { + * long bpf_get_task_stack(struct task_struct *task, void *buf, u32 size, u64 flags) + * Description + * Return a user or a kernel stack in bpf program provided buffer. ++ * Note: the user stack will only be populated if the *task* is ++ * the current task; all other tasks will return -EOPNOTSUPP. + * To achieve this, the helper needs *task*, which is a valid + * pointer to **struct task_struct**. To store the stacktrace, the + * bpf program provides *buf* with a nonnegative *size*. +@@ -4256,6 +4258,7 @@ union bpf_attr { + * + * **BPF_F_USER_STACK** + * Collect a user space stack instead of a kernel stack. ++ * The *task* must be the current task. + * **BPF_F_USER_BUILD_ID** + * Collect buildid+offset instead of ips for user stack, + * only valid if **BPF_F_USER_STACK** is also specified. +-- +2.43.0 + diff --git a/queue-5.15/bpf-enforce-precision-of-r0-on-callback-return.patch b/queue-5.15/bpf-enforce-precision-of-r0-on-callback-return.patch new file mode 100644 index 00000000000..274b4b3e12b --- /dev/null +++ b/queue-5.15/bpf-enforce-precision-of-r0-on-callback-return.patch @@ -0,0 +1,46 @@ +From d40659e734a1f74fd493d0405eb18533622913a6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 2 Dec 2023 09:56:57 -0800 +Subject: bpf: enforce precision of R0 on callback return + +From: Andrii Nakryiko + +[ Upstream commit 0acd03a5bd188b0c501d285d938439618bd855c4 ] + +Given verifier checks actual value, r0 has to be precise, so we need to +propagate precision properly. r0 also has to be marked as read, +otherwise subsequent state comparisons will ignore such register as +unimportant and precision won't really help here. + +Fixes: 69c087ba6225 ("bpf: Add bpf_for_each_map_elem() helper") +Acked-by: Eduard Zingerman +Acked-by: Shung-Hsi Yu +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/r/20231202175705.885270-4-andrii@kernel.org +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + kernel/bpf/verifier.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index 5d8f352faebd..7318a5d44859 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -6244,6 +6244,13 @@ static int prepare_func_exit(struct bpf_verifier_env *env, int *insn_idx) + verbose(env, "R0 not a scalar value\n"); + return -EACCES; + } ++ ++ /* we are going to rely on register's precise value */ ++ err = mark_reg_read(env, r0, r0->parent, REG_LIVE_READ64); ++ err = err ?: mark_chain_precision(env, BPF_REG_0); ++ if (err) ++ return err; ++ + if (!tnum_in(range, r0->var_off)) { + verbose_invalid_scalar(env, r0, &range, "callback return", "R0"); + return -EINVAL; +-- +2.43.0 + diff --git a/queue-5.15/bpf-fix-check-for-attempt-to-corrupt-spilled-pointer.patch b/queue-5.15/bpf-fix-check-for-attempt-to-corrupt-spilled-pointer.patch new file mode 100644 index 00000000000..bf398a31378 --- /dev/null +++ b/queue-5.15/bpf-fix-check-for-attempt-to-corrupt-spilled-pointer.patch @@ -0,0 +1,42 @@ +From 21766b76da85d5866779ada9b33661b230475e30 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Dec 2023 10:42:41 -0800 +Subject: bpf: fix check for attempt to corrupt spilled pointer + +From: Andrii Nakryiko + +[ Upstream commit ab125ed3ec1c10ccc36bc98c7a4256ad114a3dae ] + +When register is spilled onto a stack as a 1/2/4-byte register, we set +slot_type[BPF_REG_SIZE - 1] (plus potentially few more below it, +depending on actual spill size). So to check if some stack slot has +spilled register we need to consult slot_type[7], not slot_type[0]. + +To avoid the need to remember and double-check this in the future, just +use is_spilled_reg() helper. + +Fixes: 27113c59b6d0 ("bpf: Check the other end of slot_type for STACK_SPILL") +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/r/20231205184248.1502704-4-andrii@kernel.org +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + kernel/bpf/verifier.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index 7318a5d44859..cc284371eea0 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -2844,7 +2844,7 @@ static int check_stack_write_fixed_off(struct bpf_verifier_env *env, + * so it's aligned access and [off, off + size) are within stack limits + */ + if (!env->allow_ptr_leaks && +- state->stack[spi].slot_type[0] == STACK_SPILL && ++ is_spilled_reg(&state->stack[spi]) && + size != BPF_REG_SIZE) { + verbose(env, "attempt to corrupt spilled pointer on stack\n"); + return -EACCES; +-- +2.43.0 + diff --git a/queue-5.15/bpf-fix-verification-of-indirect-var-off-stack-acces.patch b/queue-5.15/bpf-fix-verification-of-indirect-var-off-stack-acces.patch new file mode 100644 index 00000000000..a75712be00b --- /dev/null +++ b/queue-5.15/bpf-fix-verification-of-indirect-var-off-stack-acces.patch @@ -0,0 +1,83 @@ +From 72aa083b999bea9017d176a8903aa5afef994dae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Dec 2023 23:11:48 -0500 +Subject: bpf: Fix verification of indirect var-off stack access + +From: Andrei Matei + +[ Upstream commit a833a17aeac73b33f79433d7cee68d5cafd71e4f ] + +This patch fixes a bug around the verification of possibly-zero-sized +stack accesses. When the access was done through a var-offset stack +pointer, check_stack_access_within_bounds was incorrectly computing the +maximum-offset of a zero-sized read to be the same as the register's min +offset. Instead, we have to take in account the register's maximum +possible value. The patch also simplifies how the max offset is checked; +the check is now simpler than for min offset. + +The bug was allowing accesses to erroneously pass the +check_stack_access_within_bounds() checks, only to later crash in +check_stack_range_initialized() when all the possibly-affected stack +slots are iterated (this time with a correct max offset). +check_stack_range_initialized() is relying on +check_stack_access_within_bounds() for its accesses to the +stack-tracking vector to be within bounds; in the case of zero-sized +accesses, we were essentially only verifying that the lowest possible +slot was within bounds. We would crash when the max-offset of the stack +pointer was >= 0 (which shouldn't pass verification, and hopefully is +not something anyone's code attempts to do in practice). + +Thanks Hao for reporting! + +Fixes: 01f810ace9ed3 ("bpf: Allow variable-offset stack access") +Reported-by: Hao Sun +Signed-off-by: Andrei Matei +Signed-off-by: Andrii Nakryiko +Acked-by: Eduard Zingerman +Acked-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20231207041150.229139-2-andreimatei1@gmail.com + +Closes: https://lore.kernel.org/bpf/CACkBjsZGEUaRCHsmaX=h-efVogsRfK1FPxmkgb0Os_frnHiNdw@mail.gmail.com/ +Signed-off-by: Sasha Levin +--- + kernel/bpf/verifier.c | 14 ++++---------- + 1 file changed, 4 insertions(+), 10 deletions(-) + +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index cc284371eea0..c2ecf349523d 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -4305,10 +4305,7 @@ static int check_stack_access_within_bounds( + + if (tnum_is_const(reg->var_off)) { + min_off = reg->var_off.value + off; +- if (access_size > 0) +- max_off = min_off + access_size - 1; +- else +- max_off = min_off; ++ max_off = min_off + access_size; + } else { + if (reg->smax_value >= BPF_MAX_VAR_OFF || + reg->smin_value <= -BPF_MAX_VAR_OFF) { +@@ -4317,15 +4314,12 @@ static int check_stack_access_within_bounds( + return -EACCES; + } + min_off = reg->smin_value + off; +- if (access_size > 0) +- max_off = reg->smax_value + off + access_size - 1; +- else +- max_off = min_off; ++ max_off = reg->smax_value + off + access_size; + } + + err = check_stack_slot_within_bounds(min_off, state, type); +- if (!err) +- err = check_stack_slot_within_bounds(max_off, state, type); ++ if (!err && max_off > 0) ++ err = -EINVAL; /* out of stack access into non-negative offsets */ + + if (err) { + if (tnum_is_const(reg->var_off)) { +-- +2.43.0 + diff --git a/queue-5.15/bpf-lpm-fix-check-prefixlen-before-walking-trie.patch b/queue-5.15/bpf-lpm-fix-check-prefixlen-before-walking-trie.patch new file mode 100644 index 00000000000..ec3c4ec0fd6 --- /dev/null +++ b/queue-5.15/bpf-lpm-fix-check-prefixlen-before-walking-trie.patch @@ -0,0 +1,43 @@ +From 0ce09e247776e179a005b8736e8d63e67e66082c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 5 Nov 2023 09:58:01 +0100 +Subject: bpf, lpm: Fix check prefixlen before walking trie + +From: Florian Lehner + +[ Upstream commit 9b75dbeb36fcd9fc7ed51d370310d0518a387769 ] + +When looking up an element in LPM trie, the condition 'matchlen == +trie->max_prefixlen' will never return true, if key->prefixlen is larger +than trie->max_prefixlen. Consequently all elements in the LPM trie will +be visited and no element is returned in the end. + +To resolve this, check key->prefixlen first before walking the LPM trie. + +Fixes: b95a5c4db09b ("bpf: add a longest prefix match trie map implementation") +Signed-off-by: Florian Lehner +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20231105085801.3742-1-dev@der-flo.net +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + kernel/bpf/lpm_trie.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/kernel/bpf/lpm_trie.c b/kernel/bpf/lpm_trie.c +index 423549d2c52e..4ea7fb0ca1ad 100644 +--- a/kernel/bpf/lpm_trie.c ++++ b/kernel/bpf/lpm_trie.c +@@ -230,6 +230,9 @@ static void *trie_lookup_elem(struct bpf_map *map, void *_key) + struct lpm_trie_node *node, *found = NULL; + struct bpf_lpm_trie_key *key = _key; + ++ if (key->prefixlen > trie->max_prefixlen) ++ return NULL; ++ + /* Start walking the trie from the root node ... */ + + for (node = rcu_dereference_check(trie->root, rcu_read_lock_bh_held()); +-- +2.43.0 + diff --git a/queue-5.15/calipso-fix-memory-leak-in-netlbl_calipso_add_pass.patch b/queue-5.15/calipso-fix-memory-leak-in-netlbl_calipso_add_pass.patch new file mode 100644 index 00000000000..b13d2fa1e33 --- /dev/null +++ b/queue-5.15/calipso-fix-memory-leak-in-netlbl_calipso_add_pass.patch @@ -0,0 +1,138 @@ +From 695649ee6bb7bc656cf22049089b529720ca3053 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Nov 2023 09:25:54 +0000 +Subject: calipso: fix memory leak in netlbl_calipso_add_pass() + +From: Gavrilov Ilia + +[ Upstream commit ec4e9d630a64df500641892f4e259e8149594a99 ] + +If IPv6 support is disabled at boot (ipv6.disable=1), +the calipso_init() -> netlbl_calipso_ops_register() function isn't called, +and the netlbl_calipso_ops_get() function always returns NULL. +In this case, the netlbl_calipso_add_pass() function allocates memory +for the doi_def variable but doesn't free it with the calipso_doi_free(). + +BUG: memory leak +unreferenced object 0xffff888011d68180 (size 64): + comm "syz-executor.1", pid 10746, jiffies 4295410986 (age 17.928s) + hex dump (first 32 bytes): + 00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 ................ + 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + backtrace: + [<...>] kmalloc include/linux/slab.h:552 [inline] + [<...>] netlbl_calipso_add_pass net/netlabel/netlabel_calipso.c:76 [inline] + [<...>] netlbl_calipso_add+0x22e/0x4f0 net/netlabel/netlabel_calipso.c:111 + [<...>] genl_family_rcv_msg_doit+0x22f/0x330 net/netlink/genetlink.c:739 + [<...>] genl_family_rcv_msg net/netlink/genetlink.c:783 [inline] + [<...>] genl_rcv_msg+0x341/0x5a0 net/netlink/genetlink.c:800 + [<...>] netlink_rcv_skb+0x14d/0x440 net/netlink/af_netlink.c:2515 + [<...>] genl_rcv+0x29/0x40 net/netlink/genetlink.c:811 + [<...>] netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline] + [<...>] netlink_unicast+0x54b/0x800 net/netlink/af_netlink.c:1339 + [<...>] netlink_sendmsg+0x90a/0xdf0 net/netlink/af_netlink.c:1934 + [<...>] sock_sendmsg_nosec net/socket.c:651 [inline] + [<...>] sock_sendmsg+0x157/0x190 net/socket.c:671 + [<...>] ____sys_sendmsg+0x712/0x870 net/socket.c:2342 + [<...>] ___sys_sendmsg+0xf8/0x170 net/socket.c:2396 + [<...>] __sys_sendmsg+0xea/0x1b0 net/socket.c:2429 + [<...>] do_syscall_64+0x30/0x40 arch/x86/entry/common.c:46 + [<...>] entry_SYSCALL_64_after_hwframe+0x61/0xc6 + +Found by InfoTeCS on behalf of Linux Verification Center +(linuxtesting.org) with Syzkaller + +Fixes: cb72d38211ea ("netlabel: Initial support for the CALIPSO netlink protocol.") +Signed-off-by: Gavrilov Ilia +[PM: merged via the LSM tree at Jakub Kicinski request] +Signed-off-by: Paul Moore +Signed-off-by: Sasha Levin +--- + net/netlabel/netlabel_calipso.c | 49 +++++++++++++++++---------------- + 1 file changed, 26 insertions(+), 23 deletions(-) + +diff --git a/net/netlabel/netlabel_calipso.c b/net/netlabel/netlabel_calipso.c +index 91a19c3ea1a3..84ef4a29864b 100644 +--- a/net/netlabel/netlabel_calipso.c ++++ b/net/netlabel/netlabel_calipso.c +@@ -54,6 +54,28 @@ static const struct nla_policy calipso_genl_policy[NLBL_CALIPSO_A_MAX + 1] = { + [NLBL_CALIPSO_A_MTYPE] = { .type = NLA_U32 }, + }; + ++static const struct netlbl_calipso_ops *calipso_ops; ++ ++/** ++ * netlbl_calipso_ops_register - Register the CALIPSO operations ++ * @ops: ops to register ++ * ++ * Description: ++ * Register the CALIPSO packet engine operations. ++ * ++ */ ++const struct netlbl_calipso_ops * ++netlbl_calipso_ops_register(const struct netlbl_calipso_ops *ops) ++{ ++ return xchg(&calipso_ops, ops); ++} ++EXPORT_SYMBOL(netlbl_calipso_ops_register); ++ ++static const struct netlbl_calipso_ops *netlbl_calipso_ops_get(void) ++{ ++ return READ_ONCE(calipso_ops); ++} ++ + /* NetLabel Command Handlers + */ + /** +@@ -96,15 +118,18 @@ static int netlbl_calipso_add_pass(struct genl_info *info, + * + */ + static int netlbl_calipso_add(struct sk_buff *skb, struct genl_info *info) +- + { + int ret_val = -EINVAL; + struct netlbl_audit audit_info; ++ const struct netlbl_calipso_ops *ops = netlbl_calipso_ops_get(); + + if (!info->attrs[NLBL_CALIPSO_A_DOI] || + !info->attrs[NLBL_CALIPSO_A_MTYPE]) + return -EINVAL; + ++ if (!ops) ++ return -EOPNOTSUPP; ++ + netlbl_netlink_auditinfo(&audit_info); + switch (nla_get_u32(info->attrs[NLBL_CALIPSO_A_MTYPE])) { + case CALIPSO_MAP_PASS: +@@ -362,28 +387,6 @@ int __init netlbl_calipso_genl_init(void) + return genl_register_family(&netlbl_calipso_gnl_family); + } + +-static const struct netlbl_calipso_ops *calipso_ops; +- +-/** +- * netlbl_calipso_ops_register - Register the CALIPSO operations +- * @ops: ops to register +- * +- * Description: +- * Register the CALIPSO packet engine operations. +- * +- */ +-const struct netlbl_calipso_ops * +-netlbl_calipso_ops_register(const struct netlbl_calipso_ops *ops) +-{ +- return xchg(&calipso_ops, ops); +-} +-EXPORT_SYMBOL(netlbl_calipso_ops_register); +- +-static const struct netlbl_calipso_ops *netlbl_calipso_ops_get(void) +-{ +- return READ_ONCE(calipso_ops); +-} +- + /** + * calipso_doi_add - Add a new DOI to the CALIPSO protocol engine + * @doi_def: the DOI structure +-- +2.43.0 + diff --git a/queue-5.15/clk-asm9260-use-parent-index-to-link-the-reference-c.patch b/queue-5.15/clk-asm9260-use-parent-index-to-link-the-reference-c.patch new file mode 100644 index 00000000000..899cf25fd8a --- /dev/null +++ b/queue-5.15/clk-asm9260-use-parent-index-to-link-the-reference-c.patch @@ -0,0 +1,139 @@ +From 095bead6dc0dea376c561c3f3992ec1cd1f1c526 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Sep 2022 09:17:38 +0300 +Subject: clk: asm9260: use parent index to link the reference clock + +From: Dmitry Baryshkov + +[ Upstream commit f5290d8e4f0caa81a491448a27dd70e726095d07 ] + +Rewrite clk-asm9260 to use parent index to use the reference clock. +During this rework two helpers are added: + +- clk_hw_register_mux_table_parent_data() to supplement + clk_hw_register_mux_table() but using parent_data instead of + parent_names + +- clk_hw_register_fixed_rate_parent_accuracy() to be used instead of + directly calling __clk_hw_register_fixed_rate(). The later function is + an internal API, which is better not to be called directly. + +Signed-off-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20220916061740.87167-2-dmitry.baryshkov@linaro.org +Signed-off-by: Stephen Boyd +Stable-dep-of: ee0cf5e07f44 ("clk: fixed-rate: fix clk_hw_register_fixed_rate_with_accuracy_parent_hw") +Signed-off-by: Sasha Levin +--- + drivers/clk/clk-asm9260.c | 29 ++++++++++++----------------- + include/linux/clk-provider.h | 21 +++++++++++++++++++++ + 2 files changed, 33 insertions(+), 17 deletions(-) + +diff --git a/drivers/clk/clk-asm9260.c b/drivers/clk/clk-asm9260.c +index bacebd457e6f..8b3c059e19a1 100644 +--- a/drivers/clk/clk-asm9260.c ++++ b/drivers/clk/clk-asm9260.c +@@ -80,7 +80,7 @@ struct asm9260_mux_clock { + u8 mask; + u32 *table; + const char *name; +- const char **parent_names; ++ const struct clk_parent_data *parent_data; + u8 num_parents; + unsigned long offset; + unsigned long flags; +@@ -232,10 +232,10 @@ static const struct asm9260_gate_data asm9260_ahb_gates[] __initconst = { + HW_AHBCLKCTRL1, 16 }, + }; + +-static const char __initdata *main_mux_p[] = { NULL, NULL }; +-static const char __initdata *i2s0_mux_p[] = { NULL, NULL, "i2s0m_div"}; +-static const char __initdata *i2s1_mux_p[] = { NULL, NULL, "i2s1m_div"}; +-static const char __initdata *clkout_mux_p[] = { NULL, NULL, "rtc"}; ++static struct clk_parent_data __initdata main_mux_p[] = { { .index = 0, }, { .name = "pll" } }; ++static struct clk_parent_data __initdata i2s0_mux_p[] = { { .index = 0, }, { .name = "pll" }, { .name = "i2s0m_div"} }; ++static struct clk_parent_data __initdata i2s1_mux_p[] = { { .index = 0, }, { .name = "pll" }, { .name = "i2s1m_div"} }; ++static struct clk_parent_data __initdata clkout_mux_p[] = { { .index = 0, }, { .name = "pll" }, { .name = "rtc"} }; + static u32 three_mux_table[] = {0, 1, 3}; + + static struct asm9260_mux_clock asm9260_mux_clks[] __initdata = { +@@ -255,9 +255,10 @@ static struct asm9260_mux_clock asm9260_mux_clks[] __initdata = { + + static void __init asm9260_acc_init(struct device_node *np) + { +- struct clk_hw *hw; ++ struct clk_hw *hw, *pll_hw; + struct clk_hw **hws; +- const char *ref_clk, *pll_clk = "pll"; ++ const char *pll_clk = "pll"; ++ struct clk_parent_data pll_parent_data = { .index = 0 }; + u32 rate; + int n; + +@@ -274,21 +275,15 @@ static void __init asm9260_acc_init(struct device_node *np) + /* register pll */ + rate = (ioread32(base + HW_SYSPLLCTRL) & 0xffff) * 1000000; + +- /* TODO: Convert to DT parent scheme */ +- ref_clk = of_clk_get_parent_name(np, 0); +- hw = __clk_hw_register_fixed_rate(NULL, NULL, pll_clk, +- ref_clk, NULL, NULL, 0, rate, 0, +- CLK_FIXED_RATE_PARENT_ACCURACY); +- +- if (IS_ERR(hw)) ++ pll_hw = clk_hw_register_fixed_rate_parent_accuracy(NULL, pll_clk, &pll_parent_data, ++ 0, rate); ++ if (IS_ERR(pll_hw)) + panic("%pOFn: can't register REFCLK. Check DT!", np); + + for (n = 0; n < ARRAY_SIZE(asm9260_mux_clks); n++) { + const struct asm9260_mux_clock *mc = &asm9260_mux_clks[n]; + +- mc->parent_names[0] = ref_clk; +- mc->parent_names[1] = pll_clk; +- hw = clk_hw_register_mux_table(NULL, mc->name, mc->parent_names, ++ hw = clk_hw_register_mux_table_parent_data(NULL, mc->name, mc->parent_data, + mc->num_parents, mc->flags, base + mc->offset, + 0, mc->mask, 0, mc->table, &asm9260_clk_lock); + } +diff --git a/include/linux/clk-provider.h b/include/linux/clk-provider.h +index f59c875271a0..e2a802d9cf51 100644 +--- a/include/linux/clk-provider.h ++++ b/include/linux/clk-provider.h +@@ -439,6 +439,20 @@ struct clk *clk_register_fixed_rate(struct device *dev, const char *name, + __clk_hw_register_fixed_rate((dev), NULL, (name), NULL, NULL, \ + (parent_data), NULL, (flags), \ + (fixed_rate), (fixed_accuracy), 0) ++/** ++ * clk_hw_register_fixed_rate_parent_accuracy - register fixed-rate clock with ++ * the clock framework ++ * @dev: device that is registering this clock ++ * @name: name of this clock ++ * @parent_name: name of clock's parent ++ * @flags: framework-specific flags ++ * @fixed_rate: non-adjustable clock rate ++ */ ++#define clk_hw_register_fixed_rate_parent_accuracy(dev, name, parent_data, \ ++ flags, fixed_rate) \ ++ __clk_hw_register_fixed_rate((dev), NULL, (name), NULL, NULL, \ ++ (parent_data), (flags), (fixed_rate), 0, \ ++ CLK_FIXED_RATE_PARENT_ACCURACY) + + void clk_unregister_fixed_rate(struct clk *clk); + void clk_hw_unregister_fixed_rate(struct clk_hw *hw); +@@ -915,6 +929,13 @@ struct clk *clk_register_mux_table(struct device *dev, const char *name, + (parent_names), NULL, NULL, (flags), (reg), \ + (shift), (mask), (clk_mux_flags), (table), \ + (lock)) ++#define clk_hw_register_mux_table_parent_data(dev, name, parent_data, \ ++ num_parents, flags, reg, shift, mask, \ ++ clk_mux_flags, table, lock) \ ++ __clk_hw_register_mux((dev), NULL, (name), (num_parents), \ ++ NULL, NULL, (parent_data), (flags), (reg), \ ++ (shift), (mask), (clk_mux_flags), (table), \ ++ (lock)) + #define clk_hw_register_mux(dev, name, parent_names, num_parents, flags, reg, \ + shift, width, clk_mux_flags, lock) \ + __clk_hw_register_mux((dev), NULL, (name), (num_parents), \ +-- +2.43.0 + diff --git a/queue-5.15/clk-fixed-rate-add-devm_clk_hw_register_fixed_rate.patch b/queue-5.15/clk-fixed-rate-add-devm_clk_hw_register_fixed_rate.patch new file mode 100644 index 00000000000..2ab6583ed40 --- /dev/null +++ b/queue-5.15/clk-fixed-rate-add-devm_clk_hw_register_fixed_rate.patch @@ -0,0 +1,173 @@ +From 3c8e7c39bd622d8e61e69698de23f04b294a87cf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Sep 2022 09:17:39 +0300 +Subject: clk: fixed-rate: add devm_clk_hw_register_fixed_rate + +From: Dmitry Baryshkov + +[ Upstream commit 1d7d20658534c7d36fe6f4252f6f1a27d9631a99 ] + +Add devm_clk_hw_register_fixed_rate(), devres-managed helper to register +fixed-rate clock. + +Signed-off-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20220916061740.87167-3-dmitry.baryshkov@linaro.org +Signed-off-by: Stephen Boyd +Stable-dep-of: ee0cf5e07f44 ("clk: fixed-rate: fix clk_hw_register_fixed_rate_with_accuracy_parent_hw") +Signed-off-by: Sasha Levin +--- + drivers/clk/clk-fixed-rate.c | 28 ++++++++++++++++++++++++---- + include/linux/clk-provider.h | 29 +++++++++++++++++++++-------- + 2 files changed, 45 insertions(+), 12 deletions(-) + +diff --git a/drivers/clk/clk-fixed-rate.c b/drivers/clk/clk-fixed-rate.c +index 45501637705c..62e994d18fe2 100644 +--- a/drivers/clk/clk-fixed-rate.c ++++ b/drivers/clk/clk-fixed-rate.c +@@ -49,12 +49,24 @@ const struct clk_ops clk_fixed_rate_ops = { + }; + EXPORT_SYMBOL_GPL(clk_fixed_rate_ops); + ++static void devm_clk_hw_register_fixed_rate_release(struct device *dev, void *res) ++{ ++ struct clk_fixed_rate *fix = res; ++ ++ /* ++ * We can not use clk_hw_unregister_fixed_rate, since it will kfree() ++ * the hw, resulting in double free. Just unregister the hw and let ++ * devres code kfree() it. ++ */ ++ clk_hw_unregister(&fix->hw); ++} ++ + struct clk_hw *__clk_hw_register_fixed_rate(struct device *dev, + struct device_node *np, const char *name, + const char *parent_name, const struct clk_hw *parent_hw, + const struct clk_parent_data *parent_data, unsigned long flags, + unsigned long fixed_rate, unsigned long fixed_accuracy, +- unsigned long clk_fixed_flags) ++ unsigned long clk_fixed_flags, bool devm) + { + struct clk_fixed_rate *fixed; + struct clk_hw *hw; +@@ -62,7 +74,11 @@ struct clk_hw *__clk_hw_register_fixed_rate(struct device *dev, + int ret = -EINVAL; + + /* allocate fixed-rate clock */ +- fixed = kzalloc(sizeof(*fixed), GFP_KERNEL); ++ if (devm) ++ fixed = devres_alloc(devm_clk_hw_register_fixed_rate_release, ++ sizeof(*fixed), GFP_KERNEL); ++ else ++ fixed = kzalloc(sizeof(*fixed), GFP_KERNEL); + if (!fixed) + return ERR_PTR(-ENOMEM); + +@@ -90,9 +106,13 @@ struct clk_hw *__clk_hw_register_fixed_rate(struct device *dev, + else if (np) + ret = of_clk_hw_register(np, hw); + if (ret) { +- kfree(fixed); ++ if (devm) ++ devres_free(fixed); ++ else ++ kfree(fixed); + hw = ERR_PTR(ret); +- } ++ } else if (devm) ++ devres_add(dev, fixed); + + return hw; + } +diff --git a/include/linux/clk-provider.h b/include/linux/clk-provider.h +index e2a802d9cf51..43e177b3a4d3 100644 +--- a/include/linux/clk-provider.h ++++ b/include/linux/clk-provider.h +@@ -350,7 +350,7 @@ struct clk_hw *__clk_hw_register_fixed_rate(struct device *dev, + const char *parent_name, const struct clk_hw *parent_hw, + const struct clk_parent_data *parent_data, unsigned long flags, + unsigned long fixed_rate, unsigned long fixed_accuracy, +- unsigned long clk_fixed_flags); ++ unsigned long clk_fixed_flags, bool devm); + struct clk *clk_register_fixed_rate(struct device *dev, const char *name, + const char *parent_name, unsigned long flags, + unsigned long fixed_rate); +@@ -365,7 +365,20 @@ struct clk *clk_register_fixed_rate(struct device *dev, const char *name, + */ + #define clk_hw_register_fixed_rate(dev, name, parent_name, flags, fixed_rate) \ + __clk_hw_register_fixed_rate((dev), NULL, (name), (parent_name), NULL, \ +- NULL, (flags), (fixed_rate), 0, 0) ++ NULL, (flags), (fixed_rate), 0, 0, false) ++ ++/** ++ * devm_clk_hw_register_fixed_rate - register fixed-rate clock with the clock ++ * framework ++ * @dev: device that is registering this clock ++ * @name: name of this clock ++ * @parent_name: name of clock's parent ++ * @flags: framework-specific flags ++ * @fixed_rate: non-adjustable clock rate ++ */ ++#define devm_clk_hw_register_fixed_rate(dev, name, parent_name, flags, fixed_rate) \ ++ __clk_hw_register_fixed_rate((dev), NULL, (name), (parent_name), NULL, \ ++ NULL, (flags), (fixed_rate), 0, 0, true) + /** + * clk_hw_register_fixed_rate_parent_hw - register fixed-rate clock with + * the clock framework +@@ -378,7 +391,7 @@ struct clk *clk_register_fixed_rate(struct device *dev, const char *name, + #define clk_hw_register_fixed_rate_parent_hw(dev, name, parent_hw, flags, \ + fixed_rate) \ + __clk_hw_register_fixed_rate((dev), NULL, (name), NULL, (parent_hw), \ +- NULL, (flags), (fixed_rate), 0, 0) ++ NULL, (flags), (fixed_rate), 0, 0, false) + /** + * clk_hw_register_fixed_rate_parent_data - register fixed-rate clock with + * the clock framework +@@ -392,7 +405,7 @@ struct clk *clk_register_fixed_rate(struct device *dev, const char *name, + fixed_rate) \ + __clk_hw_register_fixed_rate((dev), NULL, (name), NULL, NULL, \ + (parent_data), (flags), (fixed_rate), 0, \ +- 0) ++ 0, false) + /** + * clk_hw_register_fixed_rate_with_accuracy - register fixed-rate clock with + * the clock framework +@@ -408,7 +421,7 @@ struct clk *clk_register_fixed_rate(struct device *dev, const char *name, + fixed_accuracy) \ + __clk_hw_register_fixed_rate((dev), NULL, (name), (parent_name), \ + NULL, NULL, (flags), (fixed_rate), \ +- (fixed_accuracy), 0) ++ (fixed_accuracy), 0, false) + /** + * clk_hw_register_fixed_rate_with_accuracy_parent_hw - register fixed-rate + * clock with the clock framework +@@ -423,7 +436,7 @@ struct clk *clk_register_fixed_rate(struct device *dev, const char *name, + parent_hw, flags, fixed_rate, fixed_accuracy) \ + __clk_hw_register_fixed_rate((dev), NULL, (name), NULL, (parent_hw) \ + NULL, NULL, (flags), (fixed_rate), \ +- (fixed_accuracy), 0) ++ (fixed_accuracy), 0, false) + /** + * clk_hw_register_fixed_rate_with_accuracy_parent_data - register fixed-rate + * clock with the clock framework +@@ -438,7 +451,7 @@ struct clk *clk_register_fixed_rate(struct device *dev, const char *name, + parent_data, flags, fixed_rate, fixed_accuracy) \ + __clk_hw_register_fixed_rate((dev), NULL, (name), NULL, NULL, \ + (parent_data), NULL, (flags), \ +- (fixed_rate), (fixed_accuracy), 0) ++ (fixed_rate), (fixed_accuracy), 0, false) + /** + * clk_hw_register_fixed_rate_parent_accuracy - register fixed-rate clock with + * the clock framework +@@ -452,7 +465,7 @@ struct clk *clk_register_fixed_rate(struct device *dev, const char *name, + flags, fixed_rate) \ + __clk_hw_register_fixed_rate((dev), NULL, (name), NULL, NULL, \ + (parent_data), (flags), (fixed_rate), 0, \ +- CLK_FIXED_RATE_PARENT_ACCURACY) ++ CLK_FIXED_RATE_PARENT_ACCURACY, false) + + void clk_unregister_fixed_rate(struct clk *clk); + void clk_hw_unregister_fixed_rate(struct clk_hw *hw); +-- +2.43.0 + diff --git a/queue-5.15/clk-fixed-rate-fix-clk_hw_register_fixed_rate_with_a.patch b/queue-5.15/clk-fixed-rate-fix-clk_hw_register_fixed_rate_with_a.patch new file mode 100644 index 00000000000..ee776a9b972 --- /dev/null +++ b/queue-5.15/clk-fixed-rate-fix-clk_hw_register_fixed_rate_with_a.patch @@ -0,0 +1,43 @@ +From 0de3c0416483258e1b16b1023fcc831b1889846d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Dec 2023 18:14:16 +0100 +Subject: clk: fixed-rate: fix + clk_hw_register_fixed_rate_with_accuracy_parent_hw +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Théo Lebrun + +[ Upstream commit ee0cf5e07f44a10fce8f1bfa9db226c0b5ecf880 ] + +Add missing comma and remove extraneous NULL argument. The macro is +currently used by no one which explains why the typo slipped by. + +Fixes: 2d34f09e79c9 ("clk: fixed-rate: Add support for specifying parents via DT/pointers") +Signed-off-by: Théo Lebrun +Link: https://lore.kernel.org/r/20231218-mbly-clk-v1-1-44ce54108f06@bootlin.com +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + include/linux/clk-provider.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/include/linux/clk-provider.h b/include/linux/clk-provider.h +index 43e177b3a4d3..6cace09ba63d 100644 +--- a/include/linux/clk-provider.h ++++ b/include/linux/clk-provider.h +@@ -434,8 +434,8 @@ struct clk *clk_register_fixed_rate(struct device *dev, const char *name, + */ + #define clk_hw_register_fixed_rate_with_accuracy_parent_hw(dev, name, \ + parent_hw, flags, fixed_rate, fixed_accuracy) \ +- __clk_hw_register_fixed_rate((dev), NULL, (name), NULL, (parent_hw) \ +- NULL, NULL, (flags), (fixed_rate), \ ++ __clk_hw_register_fixed_rate((dev), NULL, (name), NULL, (parent_hw), \ ++ NULL, (flags), (fixed_rate), \ + (fixed_accuracy), 0, false) + /** + * clk_hw_register_fixed_rate_with_accuracy_parent_data - register fixed-rate +-- +2.43.0 + diff --git a/queue-5.15/clk-qcom-gpucc-sm8150-update-the-gpu_cc_pll1-config.patch b/queue-5.15/clk-qcom-gpucc-sm8150-update-the-gpu_cc_pll1-config.patch new file mode 100644 index 00000000000..ac1c9f1331d --- /dev/null +++ b/queue-5.15/clk-qcom-gpucc-sm8150-update-the-gpu_cc_pll1-config.patch @@ -0,0 +1,40 @@ +From 6df97bc9c94d06344ff68b46e98cbe6ea91100c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Nov 2023 09:58:14 +0530 +Subject: clk: qcom: gpucc-sm8150: Update the gpu_cc_pll1 config + +From: Satya Priya Kakitapalli + +[ Upstream commit 6ebd9a4f8b8d2b35cf965a04849c4ba763722f13 ] + +Update the test_ctl_hi_val and test_ctl_hi1_val of gpu_cc_pll1 +as per latest HW recommendation. + +Fixes: 0cef71f2ccc8 ("clk: qcom: Add graphics clock controller driver for SM8150") +Signed-off-by: Satya Priya Kakitapalli +Reviewed-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20231122042814.4158076-1-quic_skakitap@quicinc.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/gpucc-sm8150.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/clk/qcom/gpucc-sm8150.c b/drivers/clk/qcom/gpucc-sm8150.c +index 8422fd047493..c89a5b59ddb7 100644 +--- a/drivers/clk/qcom/gpucc-sm8150.c ++++ b/drivers/clk/qcom/gpucc-sm8150.c +@@ -37,8 +37,8 @@ static struct alpha_pll_config gpu_cc_pll1_config = { + .config_ctl_hi_val = 0x00002267, + .config_ctl_hi1_val = 0x00000024, + .test_ctl_val = 0x00000000, +- .test_ctl_hi_val = 0x00000002, +- .test_ctl_hi1_val = 0x00000000, ++ .test_ctl_hi_val = 0x00000000, ++ .test_ctl_hi1_val = 0x00000020, + .user_ctl_val = 0x00000000, + .user_ctl_hi_val = 0x00000805, + .user_ctl_hi1_val = 0x000000d0, +-- +2.43.0 + diff --git a/queue-5.15/clk-qcom-videocc-sm8150-add-missing-pll-config-prope.patch b/queue-5.15/clk-qcom-videocc-sm8150-add-missing-pll-config-prope.patch new file mode 100644 index 00000000000..b1b8940bc91 --- /dev/null +++ b/queue-5.15/clk-qcom-videocc-sm8150-add-missing-pll-config-prope.patch @@ -0,0 +1,37 @@ +From e9376537e8e26a1769eef162acc5ef4280057a83 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Dec 2023 15:20:26 +0530 +Subject: clk: qcom: videocc-sm8150: Add missing PLL config property + +From: Satya Priya Kakitapalli + +[ Upstream commit 71f130c9193f613d497f7245365ed05ffdb0a401 ] + +When the driver was ported upstream, PLL test_ctl_hi1 register value +was omitted. Add it to ensure the PLLs are fully configured. + +Fixes: 5658e8cf1a8a ("clk: qcom: add video clock controller driver for SM8150") +Signed-off-by: Satya Priya Kakitapalli +Reviewed-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20231201-videocc-8150-v3-3-56bec3a5e443@quicinc.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/videocc-sm8150.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/clk/qcom/videocc-sm8150.c b/drivers/clk/qcom/videocc-sm8150.c +index 6a5f89f53da8..52a9a453a143 100644 +--- a/drivers/clk/qcom/videocc-sm8150.c ++++ b/drivers/clk/qcom/videocc-sm8150.c +@@ -33,6 +33,7 @@ static struct alpha_pll_config video_pll0_config = { + .config_ctl_val = 0x20485699, + .config_ctl_hi_val = 0x00002267, + .config_ctl_hi1_val = 0x00000024, ++ .test_ctl_hi1_val = 0x00000020, + .user_ctl_val = 0x00000000, + .user_ctl_hi_val = 0x00000805, + .user_ctl_hi1_val = 0x000000D0, +-- +2.43.0 + diff --git a/queue-5.15/clk-qcom-videocc-sm8150-update-the-videocc-resets.patch b/queue-5.15/clk-qcom-videocc-sm8150-update-the-videocc-resets.patch new file mode 100644 index 00000000000..95e1e71b458 --- /dev/null +++ b/queue-5.15/clk-qcom-videocc-sm8150-update-the-videocc-resets.patch @@ -0,0 +1,41 @@ +From 7478b5684a5be9981fc8eddb1639a383b6fe9560 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Dec 2023 15:20:25 +0530 +Subject: clk: qcom: videocc-sm8150: Update the videocc resets + +From: Satya Priya Kakitapalli + +[ Upstream commit 1fd9a939db24d2f66e48f8bca3e3654add3fa205 ] + +Add all the available resets for the video clock controller +on sm8150. + +Fixes: 5658e8cf1a8a ("clk: qcom: add video clock controller driver for SM8150") +Signed-off-by: Satya Priya Kakitapalli +Reviewed-by: Bryan O'Donoghue +Reviewed-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20231201-videocc-8150-v3-2-56bec3a5e443@quicinc.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/videocc-sm8150.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/clk/qcom/videocc-sm8150.c b/drivers/clk/qcom/videocc-sm8150.c +index 1afdbe4a249d..6a5f89f53da8 100644 +--- a/drivers/clk/qcom/videocc-sm8150.c ++++ b/drivers/clk/qcom/videocc-sm8150.c +@@ -214,6 +214,10 @@ static const struct regmap_config video_cc_sm8150_regmap_config = { + + static const struct qcom_reset_map video_cc_sm8150_resets[] = { + [VIDEO_CC_MVSC_CORE_CLK_BCR] = { 0x850, 2 }, ++ [VIDEO_CC_INTERFACE_BCR] = { 0x8f0 }, ++ [VIDEO_CC_MVS0_BCR] = { 0x870 }, ++ [VIDEO_CC_MVS1_BCR] = { 0x8b0 }, ++ [VIDEO_CC_MVSC_BCR] = { 0x810 }, + }; + + static const struct qcom_cc_desc video_cc_sm8150_desc = { +-- +2.43.0 + diff --git a/queue-5.15/clk-si5341-fix-an-error-code-problem-in-si5341_outpu.patch b/queue-5.15/clk-si5341-fix-an-error-code-problem-in-si5341_outpu.patch new file mode 100644 index 00000000000..818447c333f --- /dev/null +++ b/queue-5.15/clk-si5341-fix-an-error-code-problem-in-si5341_outpu.patch @@ -0,0 +1,41 @@ +From d7e8feb9206ce4083ec08744b9f98ff222ca5fca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Nov 2023 11:16:36 +0800 +Subject: clk: si5341: fix an error code problem in si5341_output_clk_set_rate + +From: Su Hui + +[ Upstream commit 5607068ae5ab02c3ac9cabc6859d36e98004c341 ] + +regmap_bulk_write() return zero or negative error code, return the value +of regmap_bulk_write() rather than '0'. + +Fixes: 3044a860fd09 ("clk: Add Si5341/Si5340 driver") +Acked-by: Mike Looijmans +Signed-off-by: Su Hui +Link: https://lore.kernel.org/r/20231101031633.996124-1-suhui@nfschina.com +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/clk-si5341.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/clk/clk-si5341.c b/drivers/clk/clk-si5341.c +index 91a6bc74ebd5..cda5a0f4d9df 100644 +--- a/drivers/clk/clk-si5341.c ++++ b/drivers/clk/clk-si5341.c +@@ -892,10 +892,8 @@ static int si5341_output_clk_set_rate(struct clk_hw *hw, unsigned long rate, + r[0] = r_div ? (r_div & 0xff) : 1; + r[1] = (r_div >> 8) & 0xff; + r[2] = (r_div >> 16) & 0xff; +- err = regmap_bulk_write(output->data->regmap, ++ return regmap_bulk_write(output->data->regmap, + SI5341_OUT_R_REG(output), r, 3); +- +- return 0; + } + + static int si5341_output_reparent(struct clk_si5341_output *output, u8 index) +-- +2.43.0 + diff --git a/queue-5.15/clk-zynqmp-add-a-check-for-null-pointer.patch b/queue-5.15/clk-zynqmp-add-a-check-for-null-pointer.patch new file mode 100644 index 00000000000..762c27d3626 --- /dev/null +++ b/queue-5.15/clk-zynqmp-add-a-check-for-null-pointer.patch @@ -0,0 +1,44 @@ +From 47c264c3f4093ce6009093e20050ef315da4e2fb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 May 2022 11:23:14 +0530 +Subject: clk: zynqmp: Add a check for NULL pointer + +From: Shubhrajyoti Datta + +[ Upstream commit 6ab9810cfe6c8f3d8b8750c827d7870abd3751b9 ] + +Add a NULL pointer check as clk_hw_get_parent can return NULL. + +Signed-off-by: Shubhrajyoti Datta +Link: https://lore.kernel.org/r/20220518055314.2486-1-shubhrajyoti.datta@xilinx.com +Acked-by: Michal Simek +Signed-off-by: Stephen Boyd +Stable-dep-of: 1fe15be1fb61 ("drivers: clk: zynqmp: update divider round rate logic") +Signed-off-by: Sasha Levin +--- + drivers/clk/zynqmp/divider.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/clk/zynqmp/divider.c b/drivers/clk/zynqmp/divider.c +index 9e535d3e1c0c..47a199346ddf 100644 +--- a/drivers/clk/zynqmp/divider.c ++++ b/drivers/clk/zynqmp/divider.c +@@ -120,10 +120,13 @@ static void zynqmp_get_divider2_val(struct clk_hw *hw, + long error = LONG_MAX; + unsigned long div1_prate; + struct clk_hw *div1_parent_hw; ++ struct zynqmp_clk_divider *pdivider; + struct clk_hw *div2_parent_hw = clk_hw_get_parent(hw); +- struct zynqmp_clk_divider *pdivider = +- to_zynqmp_clk_divider(div2_parent_hw); + ++ if (!div2_parent_hw) ++ return; ++ ++ pdivider = to_zynqmp_clk_divider(div2_parent_hw); + if (!pdivider) + return; + +-- +2.43.0 + diff --git a/queue-5.15/clk-zynqmp-make-bestdiv-unsigned.patch b/queue-5.15/clk-zynqmp-make-bestdiv-unsigned.patch new file mode 100644 index 00000000000..504274bd95d --- /dev/null +++ b/queue-5.15/clk-zynqmp-make-bestdiv-unsigned.patch @@ -0,0 +1,37 @@ +From 2aa90501738e0f86fa6ba73fce388e723d73247b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Aug 2022 17:01:53 +0530 +Subject: clk: zynqmp: make bestdiv unsigned + +From: Shubhrajyoti Datta + +[ Upstream commit d3954b51b475c4848179cd90b24ac73684cdc76b ] + +Divisor is always positive make it u32 *. +Also the arguments passed are currently of u32 pointers. + +Signed-off-by: Shubhrajyoti Datta +Link: https://lore.kernel.org/r/20220818113153.14431-1-shubhrajyoti.datta@amd.com +Signed-off-by: Stephen Boyd +Stable-dep-of: 1fe15be1fb61 ("drivers: clk: zynqmp: update divider round rate logic") +Signed-off-by: Sasha Levin +--- + drivers/clk/zynqmp/divider.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/zynqmp/divider.c b/drivers/clk/zynqmp/divider.c +index cb49281f9cf9..9e535d3e1c0c 100644 +--- a/drivers/clk/zynqmp/divider.c ++++ b/drivers/clk/zynqmp/divider.c +@@ -113,7 +113,7 @@ static unsigned long zynqmp_clk_divider_recalc_rate(struct clk_hw *hw, + static void zynqmp_get_divider2_val(struct clk_hw *hw, + unsigned long rate, + struct zynqmp_clk_divider *divider, +- int *bestdiv) ++ u32 *bestdiv) + { + int div1; + int div2; +-- +2.43.0 + diff --git a/queue-5.15/cpufreq-scmi-process-the-result-of-devm_of_clk_add_h.patch b/queue-5.15/cpufreq-scmi-process-the-result-of-devm_of_clk_add_h.patch new file mode 100644 index 00000000000..83c702085f1 --- /dev/null +++ b/queue-5.15/cpufreq-scmi-process-the-result-of-devm_of_clk_add_h.patch @@ -0,0 +1,43 @@ +From acceff7eda377dc368c7e3f1cd0ae3f96a0f1e69 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Dec 2023 18:12:20 +0300 +Subject: cpufreq: scmi: process the result of devm_of_clk_add_hw_provider() + +From: Alexandra Diupina + +[ Upstream commit c4a5118a3ae1eadc687d84eef9431f9e13eb015c ] + +devm_of_clk_add_hw_provider() may return an errno, so +add a return value check + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 8410e7f3b31e ("cpufreq: scmi: Fix OPP addition failure with a dummy clock provider") +Signed-off-by: Alexandra Diupina +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/scmi-cpufreq.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/cpufreq/scmi-cpufreq.c b/drivers/cpufreq/scmi-cpufreq.c +index 82e588c3c57b..c24e6373d341 100644 +--- a/drivers/cpufreq/scmi-cpufreq.c ++++ b/drivers/cpufreq/scmi-cpufreq.c +@@ -299,8 +299,11 @@ static int scmi_cpufreq_probe(struct scmi_device *sdev) + + #ifdef CONFIG_COMMON_CLK + /* dummy clock provider as needed by OPP if clocks property is used */ +- if (of_property_present(dev->of_node, "#clock-cells")) +- devm_of_clk_add_hw_provider(dev, of_clk_hw_simple_get, NULL); ++ if (of_property_present(dev->of_node, "#clock-cells")) { ++ ret = devm_of_clk_add_hw_provider(dev, of_clk_hw_simple_get, NULL); ++ if (ret) ++ return dev_err_probe(dev, ret, "%s: registering clock provider failed\n", __func__); ++ } + #endif + + ret = cpufreq_register_driver(&scmi_cpufreq_driver); +-- +2.43.0 + diff --git a/queue-5.15/cpufreq-use-of_property_present-for-testing-dt-prope.patch b/queue-5.15/cpufreq-use-of_property_present-for-testing-dt-prope.patch new file mode 100644 index 00000000000..87535de1791 --- /dev/null +++ b/queue-5.15/cpufreq-use-of_property_present-for-testing-dt-prope.patch @@ -0,0 +1,105 @@ +From da728dd2efd961e59fb1f4817da8f41bd9838db0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Mar 2023 08:47:02 -0600 +Subject: cpufreq: Use of_property_present() for testing DT property presence + +From: Rob Herring + +[ Upstream commit b8f3a396a7ee43e6079176cc0fb8de2b95a23681 ] + +It is preferred to use typed property access functions (i.e. +of_property_read_ functions) rather than low-level +of_get_property/of_find_property functions for reading properties. As +part of this, convert of_get_property/of_find_property calls to the +recently added of_property_present() helper when we just want to test +for presence of a property and nothing more. + +Signed-off-by: Rob Herring +Signed-off-by: Viresh Kumar +Stable-dep-of: c4a5118a3ae1 ("cpufreq: scmi: process the result of devm_of_clk_add_hw_provider()") +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/cpufreq-dt-platdev.c | 2 +- + drivers/cpufreq/imx-cpufreq-dt.c | 2 +- + drivers/cpufreq/imx6q-cpufreq.c | 4 ++-- + drivers/cpufreq/scmi-cpufreq.c | 2 +- + drivers/cpufreq/tegra20-cpufreq.c | 2 +- + 5 files changed, 6 insertions(+), 6 deletions(-) + +diff --git a/drivers/cpufreq/cpufreq-dt-platdev.c b/drivers/cpufreq/cpufreq-dt-platdev.c +index e1b5975c7daa..48ca7189a73b 100644 +--- a/drivers/cpufreq/cpufreq-dt-platdev.c ++++ b/drivers/cpufreq/cpufreq-dt-platdev.c +@@ -171,7 +171,7 @@ static bool __init cpu0_node_has_opp_v2_prop(void) + struct device_node *np = of_cpu_device_node_get(0); + bool ret = false; + +- if (of_get_property(np, "operating-points-v2", NULL)) ++ if (of_property_present(np, "operating-points-v2")) + ret = true; + + of_node_put(np); +diff --git a/drivers/cpufreq/imx-cpufreq-dt.c b/drivers/cpufreq/imx-cpufreq-dt.c +index 3fe9125156b4..0942498b348c 100644 +--- a/drivers/cpufreq/imx-cpufreq-dt.c ++++ b/drivers/cpufreq/imx-cpufreq-dt.c +@@ -89,7 +89,7 @@ static int imx_cpufreq_dt_probe(struct platform_device *pdev) + + cpu_dev = get_cpu_device(0); + +- if (!of_find_property(cpu_dev->of_node, "cpu-supply", NULL)) ++ if (!of_property_present(cpu_dev->of_node, "cpu-supply")) + return -ENODEV; + + if (of_machine_is_compatible("fsl,imx7ulp")) { +diff --git a/drivers/cpufreq/imx6q-cpufreq.c b/drivers/cpufreq/imx6q-cpufreq.c +index 67f98a083d22..ae9ef99f7d86 100644 +--- a/drivers/cpufreq/imx6q-cpufreq.c ++++ b/drivers/cpufreq/imx6q-cpufreq.c +@@ -230,7 +230,7 @@ static int imx6q_opp_check_speed_grading(struct device *dev) + u32 val; + int ret; + +- if (of_find_property(dev->of_node, "nvmem-cells", NULL)) { ++ if (of_property_present(dev->of_node, "nvmem-cells")) { + ret = nvmem_cell_read_u32(dev, "speed_grade", &val); + if (ret) + return ret; +@@ -285,7 +285,7 @@ static int imx6ul_opp_check_speed_grading(struct device *dev) + u32 val; + int ret = 0; + +- if (of_find_property(dev->of_node, "nvmem-cells", NULL)) { ++ if (of_property_present(dev->of_node, "nvmem-cells")) { + ret = nvmem_cell_read_u32(dev, "speed_grade", &val); + if (ret) + return ret; +diff --git a/drivers/cpufreq/scmi-cpufreq.c b/drivers/cpufreq/scmi-cpufreq.c +index 1e0cd4d165f0..82e588c3c57b 100644 +--- a/drivers/cpufreq/scmi-cpufreq.c ++++ b/drivers/cpufreq/scmi-cpufreq.c +@@ -299,7 +299,7 @@ static int scmi_cpufreq_probe(struct scmi_device *sdev) + + #ifdef CONFIG_COMMON_CLK + /* dummy clock provider as needed by OPP if clocks property is used */ +- if (of_find_property(dev->of_node, "#clock-cells", NULL)) ++ if (of_property_present(dev->of_node, "#clock-cells")) + devm_of_clk_add_hw_provider(dev, of_clk_hw_simple_get, NULL); + #endif + +diff --git a/drivers/cpufreq/tegra20-cpufreq.c b/drivers/cpufreq/tegra20-cpufreq.c +index e8db3d75be25..72b9c2d5f375 100644 +--- a/drivers/cpufreq/tegra20-cpufreq.c ++++ b/drivers/cpufreq/tegra20-cpufreq.c +@@ -25,7 +25,7 @@ static bool cpu0_node_has_opp_v2_prop(void) + struct device_node *np = of_cpu_device_node_get(0); + bool ret = false; + +- if (of_get_property(np, "operating-points-v2", NULL)) ++ if (of_property_present(np, "operating-points-v2")) + ret = true; + + of_node_put(np); +-- +2.43.0 + diff --git a/queue-5.15/crypto-af_alg-disallow-multiple-in-flight-aio-reques.patch b/queue-5.15/crypto-af_alg-disallow-multiple-in-flight-aio-reques.patch new file mode 100644 index 00000000000..325761b1577 --- /dev/null +++ b/queue-5.15/crypto-af_alg-disallow-multiple-in-flight-aio-reques.patch @@ -0,0 +1,85 @@ +From a9bbb5444295baf319939d0e61ba990f97218eac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Nov 2023 16:25:49 +0800 +Subject: crypto: af_alg - Disallow multiple in-flight AIO requests + +From: Herbert Xu + +[ Upstream commit 67b164a871af1d736f131fd6fe78a610909f06f3 ] + +Having multiple in-flight AIO requests results in unpredictable +output because they all share the same IV. Fix this by only allowing +one request at a time. + +Fixes: 83094e5e9e49 ("crypto: af_alg - add async support to algif_aead") +Fixes: a596999b7ddf ("crypto: algif - change algif_skcipher to be asynchronous") +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + crypto/af_alg.c | 14 +++++++++++++- + include/crypto/if_alg.h | 3 +++ + 2 files changed, 16 insertions(+), 1 deletion(-) + +diff --git a/crypto/af_alg.c b/crypto/af_alg.c +index 8bd288d2b089..aa93501e27b9 100644 +--- a/crypto/af_alg.c ++++ b/crypto/af_alg.c +@@ -1045,9 +1045,13 @@ EXPORT_SYMBOL_GPL(af_alg_sendpage); + void af_alg_free_resources(struct af_alg_async_req *areq) + { + struct sock *sk = areq->sk; ++ struct af_alg_ctx *ctx; + + af_alg_free_areq_sgls(areq); + sock_kfree_s(sk, areq, areq->areqlen); ++ ++ ctx = alg_sk(sk)->private; ++ ctx->inflight = false; + } + EXPORT_SYMBOL_GPL(af_alg_free_resources); + +@@ -1117,11 +1121,19 @@ EXPORT_SYMBOL_GPL(af_alg_poll); + struct af_alg_async_req *af_alg_alloc_areq(struct sock *sk, + unsigned int areqlen) + { +- struct af_alg_async_req *areq = sock_kmalloc(sk, areqlen, GFP_KERNEL); ++ struct af_alg_ctx *ctx = alg_sk(sk)->private; ++ struct af_alg_async_req *areq; ++ ++ /* Only one AIO request can be in flight. */ ++ if (ctx->inflight) ++ return ERR_PTR(-EBUSY); + ++ areq = sock_kmalloc(sk, areqlen, GFP_KERNEL); + if (unlikely(!areq)) + return ERR_PTR(-ENOMEM); + ++ ctx->inflight = true; ++ + areq->areqlen = areqlen; + areq->sk = sk; + areq->last_rsgl = NULL; +diff --git a/include/crypto/if_alg.h b/include/crypto/if_alg.h +index a5db86670bdf..a406e281ae57 100644 +--- a/include/crypto/if_alg.h ++++ b/include/crypto/if_alg.h +@@ -138,6 +138,7 @@ struct af_alg_async_req { + * recvmsg is invoked. + * @init: True if metadata has been sent. + * @len: Length of memory allocated for this data structure. ++ * @inflight: Non-zero when AIO requests are in flight. + */ + struct af_alg_ctx { + struct list_head tsgl_list; +@@ -156,6 +157,8 @@ struct af_alg_ctx { + bool init; + + unsigned int len; ++ ++ unsigned int inflight; + }; + + int af_alg_register_type(const struct af_alg_type *type); +-- +2.43.0 + diff --git a/queue-5.15/crypto-ccp-fix-memleak-in-ccp_init_dm_workarea.patch b/queue-5.15/crypto-ccp-fix-memleak-in-ccp_init_dm_workarea.patch new file mode 100644 index 00000000000..29d3bb8b55d --- /dev/null +++ b/queue-5.15/crypto-ccp-fix-memleak-in-ccp_init_dm_workarea.patch @@ -0,0 +1,45 @@ +From 77ecf9313350861ebae819419b0a771fdd273b3b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Nov 2023 11:47:10 +0800 +Subject: crypto: ccp - fix memleak in ccp_init_dm_workarea + +From: Dinghao Liu + +[ Upstream commit a1c95dd5bc1d6a5d7a75a376c2107421b7d6240d ] + +When dma_map_single() fails, wa->address is supposed to be freed +by the callers of ccp_init_dm_workarea() through ccp_dm_free(). +However, many of the call spots don't expect to have to call +ccp_dm_free() on failure of ccp_init_dm_workarea(), which may +lead to a memleak. Let's free wa->address in ccp_init_dm_workarea() +when dma_map_single() fails. + +Fixes: 63b945091a07 ("crypto: ccp - CCP device driver and interface support") +Signed-off-by: Dinghao Liu +Acked-by: Tom Lendacky +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/ccp/ccp-ops.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/crypto/ccp/ccp-ops.c b/drivers/crypto/ccp/ccp-ops.c +index aa4e1a500691..cb8e99936abb 100644 +--- a/drivers/crypto/ccp/ccp-ops.c ++++ b/drivers/crypto/ccp/ccp-ops.c +@@ -179,8 +179,11 @@ static int ccp_init_dm_workarea(struct ccp_dm_workarea *wa, + + wa->dma.address = dma_map_single(wa->dev, wa->address, len, + dir); +- if (dma_mapping_error(wa->dev, wa->dma.address)) ++ if (dma_mapping_error(wa->dev, wa->dma.address)) { ++ kfree(wa->address); ++ wa->address = NULL; + return -ENOMEM; ++ } + + wa->dma.length = len; + } +-- +2.43.0 + diff --git a/queue-5.15/crypto-sa2ul-return-crypto_aead_setkey-to-transfer-t.patch b/queue-5.15/crypto-sa2ul-return-crypto_aead_setkey-to-transfer-t.patch new file mode 100644 index 00000000000..945d028aaa6 --- /dev/null +++ b/queue-5.15/crypto-sa2ul-return-crypto_aead_setkey-to-transfer-t.patch @@ -0,0 +1,38 @@ +From 514635764775855b835c8b317baa3f5ff4c1486d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Nov 2023 02:03:01 +0000 +Subject: crypto: sa2ul - Return crypto_aead_setkey to transfer the error + +From: Chen Ni + +[ Upstream commit ce852f1308ac738e61c5b2502517deea593a1554 ] + +Return crypto_aead_setkey() in order to transfer the error if +it fails. + +Fixes: d2c8ac187fc9 ("crypto: sa2ul - Add AEAD algorithm support") +Signed-off-by: Chen Ni +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/sa2ul.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/crypto/sa2ul.c b/drivers/crypto/sa2ul.c +index 544d7040cfc5..91ab33690ccf 100644 +--- a/drivers/crypto/sa2ul.c ++++ b/drivers/crypto/sa2ul.c +@@ -1868,9 +1868,8 @@ static int sa_aead_setkey(struct crypto_aead *authenc, + crypto_aead_set_flags(ctx->fallback.aead, + crypto_aead_get_flags(authenc) & + CRYPTO_TFM_REQ_MASK); +- crypto_aead_setkey(ctx->fallback.aead, key, keylen); + +- return 0; ++ return crypto_aead_setkey(ctx->fallback.aead, key, keylen); + } + + static int sa_aead_setauthsize(struct crypto_aead *tfm, unsigned int authsize) +-- +2.43.0 + diff --git a/queue-5.15/crypto-sahara-avoid-skcipher-fallback-code-duplicati.patch b/queue-5.15/crypto-sahara-avoid-skcipher-fallback-code-duplicati.patch new file mode 100644 index 00000000000..b845484833b --- /dev/null +++ b/queue-5.15/crypto-sahara-avoid-skcipher-fallback-code-duplicati.patch @@ -0,0 +1,148 @@ +From 314b641e40c2bdd9982fa507d6f9b6649412a95d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Dec 2023 19:06:25 +0200 +Subject: crypto: sahara - avoid skcipher fallback code duplication + +From: Ovidiu Panait + +[ Upstream commit 01d70a4bbff20ea05cadb4c208841985a7cc6596 ] + +Factor out duplicated skcipher fallback handling code to a helper function +sahara_aes_fallback(). Also, keep a single check if fallback is required in +sahara_aes_crypt(). + +Signed-off-by: Ovidiu Panait +Signed-off-by: Herbert Xu +Stable-dep-of: d1d6351e37aa ("crypto: sahara - handle zero-length aes requests") +Signed-off-by: Sasha Levin +--- + drivers/crypto/sahara.c | 85 ++++++++++++----------------------------- + 1 file changed, 25 insertions(+), 60 deletions(-) + +diff --git a/drivers/crypto/sahara.c b/drivers/crypto/sahara.c +index f9fd64178a59..bbd2c6474b50 100644 +--- a/drivers/crypto/sahara.c ++++ b/drivers/crypto/sahara.c +@@ -649,12 +649,37 @@ static int sahara_aes_setkey(struct crypto_skcipher *tfm, const u8 *key, + return crypto_skcipher_setkey(ctx->fallback, key, keylen); + } + ++static int sahara_aes_fallback(struct skcipher_request *req, unsigned long mode) ++{ ++ struct sahara_aes_reqctx *rctx = skcipher_request_ctx(req); ++ struct sahara_ctx *ctx = crypto_skcipher_ctx( ++ crypto_skcipher_reqtfm(req)); ++ ++ skcipher_request_set_tfm(&rctx->fallback_req, ctx->fallback); ++ skcipher_request_set_callback(&rctx->fallback_req, ++ req->base.flags, ++ req->base.complete, ++ req->base.data); ++ skcipher_request_set_crypt(&rctx->fallback_req, req->src, ++ req->dst, req->cryptlen, req->iv); ++ ++ if (mode & FLAGS_ENCRYPT) ++ return crypto_skcipher_encrypt(&rctx->fallback_req); ++ ++ return crypto_skcipher_decrypt(&rctx->fallback_req); ++} ++ + static int sahara_aes_crypt(struct skcipher_request *req, unsigned long mode) + { + struct sahara_aes_reqctx *rctx = skcipher_request_ctx(req); ++ struct sahara_ctx *ctx = crypto_skcipher_ctx( ++ crypto_skcipher_reqtfm(req)); + struct sahara_dev *dev = dev_ptr; + int err = 0; + ++ if (unlikely(ctx->keylen != AES_KEYSIZE_128)) ++ return sahara_aes_fallback(req, mode); ++ + dev_dbg(dev->device, "nbytes: %d, enc: %d, cbc: %d\n", + req->cryptlen, !!(mode & FLAGS_ENCRYPT), !!(mode & FLAGS_CBC)); + +@@ -677,81 +702,21 @@ static int sahara_aes_crypt(struct skcipher_request *req, unsigned long mode) + + static int sahara_aes_ecb_encrypt(struct skcipher_request *req) + { +- struct sahara_aes_reqctx *rctx = skcipher_request_ctx(req); +- struct sahara_ctx *ctx = crypto_skcipher_ctx( +- crypto_skcipher_reqtfm(req)); +- +- if (unlikely(ctx->keylen != AES_KEYSIZE_128)) { +- skcipher_request_set_tfm(&rctx->fallback_req, ctx->fallback); +- skcipher_request_set_callback(&rctx->fallback_req, +- req->base.flags, +- req->base.complete, +- req->base.data); +- skcipher_request_set_crypt(&rctx->fallback_req, req->src, +- req->dst, req->cryptlen, req->iv); +- return crypto_skcipher_encrypt(&rctx->fallback_req); +- } +- + return sahara_aes_crypt(req, FLAGS_ENCRYPT); + } + + static int sahara_aes_ecb_decrypt(struct skcipher_request *req) + { +- struct sahara_aes_reqctx *rctx = skcipher_request_ctx(req); +- struct sahara_ctx *ctx = crypto_skcipher_ctx( +- crypto_skcipher_reqtfm(req)); +- +- if (unlikely(ctx->keylen != AES_KEYSIZE_128)) { +- skcipher_request_set_tfm(&rctx->fallback_req, ctx->fallback); +- skcipher_request_set_callback(&rctx->fallback_req, +- req->base.flags, +- req->base.complete, +- req->base.data); +- skcipher_request_set_crypt(&rctx->fallback_req, req->src, +- req->dst, req->cryptlen, req->iv); +- return crypto_skcipher_decrypt(&rctx->fallback_req); +- } +- + return sahara_aes_crypt(req, 0); + } + + static int sahara_aes_cbc_encrypt(struct skcipher_request *req) + { +- struct sahara_aes_reqctx *rctx = skcipher_request_ctx(req); +- struct sahara_ctx *ctx = crypto_skcipher_ctx( +- crypto_skcipher_reqtfm(req)); +- +- if (unlikely(ctx->keylen != AES_KEYSIZE_128)) { +- skcipher_request_set_tfm(&rctx->fallback_req, ctx->fallback); +- skcipher_request_set_callback(&rctx->fallback_req, +- req->base.flags, +- req->base.complete, +- req->base.data); +- skcipher_request_set_crypt(&rctx->fallback_req, req->src, +- req->dst, req->cryptlen, req->iv); +- return crypto_skcipher_encrypt(&rctx->fallback_req); +- } +- + return sahara_aes_crypt(req, FLAGS_ENCRYPT | FLAGS_CBC); + } + + static int sahara_aes_cbc_decrypt(struct skcipher_request *req) + { +- struct sahara_aes_reqctx *rctx = skcipher_request_ctx(req); +- struct sahara_ctx *ctx = crypto_skcipher_ctx( +- crypto_skcipher_reqtfm(req)); +- +- if (unlikely(ctx->keylen != AES_KEYSIZE_128)) { +- skcipher_request_set_tfm(&rctx->fallback_req, ctx->fallback); +- skcipher_request_set_callback(&rctx->fallback_req, +- req->base.flags, +- req->base.complete, +- req->base.data); +- skcipher_request_set_crypt(&rctx->fallback_req, req->src, +- req->dst, req->cryptlen, req->iv); +- return crypto_skcipher_decrypt(&rctx->fallback_req); +- } +- + return sahara_aes_crypt(req, FLAGS_CBC); + } + +-- +2.43.0 + diff --git a/queue-5.15/crypto-sahara-do-not-resize-req-src-when-doing-hash-.patch b/queue-5.15/crypto-sahara-do-not-resize-req-src-when-doing-hash-.patch new file mode 100644 index 00000000000..bbd3ef573c6 --- /dev/null +++ b/queue-5.15/crypto-sahara-do-not-resize-req-src-when-doing-hash-.patch @@ -0,0 +1,99 @@ +From 7d3c3ef555ebed2b50d45c2e90cb20e9e9956bc6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 24 Dec 2023 10:21:36 +0200 +Subject: crypto: sahara - do not resize req->src when doing hash operations + +From: Ovidiu Panait + +[ Upstream commit a3c6f4f4d249cecaf2f34471aadbfb4f4ef57298 ] + +When testing sahara sha256 speed performance with tcrypt (mode=404) on +imx53-qsrb board, multiple "Invalid numbers of src SG." errors are +reported. This was traced to sahara_walk_and_recalc() resizing req->src +and causing the subsequent dma_map_sg() call to fail. + +Now that the previous commit fixed sahara_sha_hw_links_create() to take +into account the actual request size, rather than relying on sg->length +values, the resize operation is no longer necessary. + +Therefore, remove sahara_walk_and_recalc() and simplify associated logic. + +Fixes: 5a2bb93f5992 ("crypto: sahara - add support for SHA1/256") +Signed-off-by: Ovidiu Panait +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/sahara.c | 38 ++------------------------------------ + 1 file changed, 2 insertions(+), 36 deletions(-) + +diff --git a/drivers/crypto/sahara.c b/drivers/crypto/sahara.c +index 538beec3b062..b9832978b935 100644 +--- a/drivers/crypto/sahara.c ++++ b/drivers/crypto/sahara.c +@@ -887,24 +887,6 @@ static int sahara_sha_hw_context_descriptor_create(struct sahara_dev *dev, + return 0; + } + +-static int sahara_walk_and_recalc(struct scatterlist *sg, unsigned int nbytes) +-{ +- if (!sg || !sg->length) +- return nbytes; +- +- while (nbytes && sg) { +- if (nbytes <= sg->length) { +- sg->length = nbytes; +- sg_mark_end(sg); +- break; +- } +- nbytes -= sg->length; +- sg = sg_next(sg); +- } +- +- return nbytes; +-} +- + static int sahara_sha_prepare_request(struct ahash_request *req) + { + struct crypto_ahash *tfm = crypto_ahash_reqtfm(req); +@@ -941,36 +923,20 @@ static int sahara_sha_prepare_request(struct ahash_request *req) + hash_later, 0); + } + +- /* nbytes should now be multiple of blocksize */ +- req->nbytes = req->nbytes - hash_later; +- +- sahara_walk_and_recalc(req->src, req->nbytes); +- ++ rctx->total = len - hash_later; + /* have data from previous operation and current */ + if (rctx->buf_cnt && req->nbytes) { + sg_init_table(rctx->in_sg_chain, 2); + sg_set_buf(rctx->in_sg_chain, rctx->rembuf, rctx->buf_cnt); +- + sg_chain(rctx->in_sg_chain, 2, req->src); +- +- rctx->total = req->nbytes + rctx->buf_cnt; + rctx->in_sg = rctx->in_sg_chain; +- +- req->src = rctx->in_sg_chain; + /* only data from previous operation */ + } else if (rctx->buf_cnt) { +- if (req->src) +- rctx->in_sg = req->src; +- else +- rctx->in_sg = rctx->in_sg_chain; +- /* buf was copied into rembuf above */ ++ rctx->in_sg = rctx->in_sg_chain; + sg_init_one(rctx->in_sg, rctx->rembuf, rctx->buf_cnt); +- rctx->total = rctx->buf_cnt; + /* no data from previous operation */ + } else { + rctx->in_sg = req->src; +- rctx->total = req->nbytes; +- req->src = rctx->in_sg; + } + + /* on next call, we only have the remaining data in the buffer */ +-- +2.43.0 + diff --git a/queue-5.15/crypto-sahara-fix-ahash-reqsize.patch b/queue-5.15/crypto-sahara-fix-ahash-reqsize.patch new file mode 100644 index 00000000000..fffefe64b2c --- /dev/null +++ b/queue-5.15/crypto-sahara-fix-ahash-reqsize.patch @@ -0,0 +1,37 @@ +From 50f772d0bd7baa6947b83a99908bb39140f0c0b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 24 Dec 2023 10:21:32 +0200 +Subject: crypto: sahara - fix ahash reqsize + +From: Ovidiu Panait + +[ Upstream commit efcb50f41740ac55e6ccc4986c1a7740e21c62b4 ] + +Set the reqsize for sha algorithms to sizeof(struct sahara_sha_reqctx), the +extra space is not needed. + +Fixes: 5a2bb93f5992 ("crypto: sahara - add support for SHA1/256") +Signed-off-by: Ovidiu Panait +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/sahara.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/crypto/sahara.c b/drivers/crypto/sahara.c +index 3229dd180d0c..d31ccaffebb8 100644 +--- a/drivers/crypto/sahara.c ++++ b/drivers/crypto/sahara.c +@@ -1163,8 +1163,7 @@ static int sahara_sha_import(struct ahash_request *req, const void *in) + static int sahara_sha_cra_init(struct crypto_tfm *tfm) + { + crypto_ahash_set_reqsize(__crypto_ahash_cast(tfm), +- sizeof(struct sahara_sha_reqctx) + +- SHA_BUFFER_LEN + SHA256_BLOCK_SIZE); ++ sizeof(struct sahara_sha_reqctx)); + + return 0; + } +-- +2.43.0 + diff --git a/queue-5.15/crypto-sahara-fix-ahash-selftest-failure.patch b/queue-5.15/crypto-sahara-fix-ahash-selftest-failure.patch new file mode 100644 index 00000000000..79d274e9d13 --- /dev/null +++ b/queue-5.15/crypto-sahara-fix-ahash-selftest-failure.patch @@ -0,0 +1,41 @@ +From ec62afca6ed88176c4873f7ef6721f33a68e54b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Dec 2023 19:06:21 +0200 +Subject: crypto: sahara - fix ahash selftest failure + +From: Ovidiu Panait + +[ Upstream commit afffcf3db98b9495114b79d5381f8cc3f69476fb ] + +update() calls should not modify the result buffer, so add an additional +check for "rctx->last" to make sure that only the final hash value is +copied into the buffer. + +Fixes the following selftest failure: +alg: ahash: sahara-sha256 update() used result buffer on test vector 3, +cfg="init+update+final aligned buffer" + +Fixes: 5a2bb93f5992 ("crypto: sahara - add support for SHA1/256") +Signed-off-by: Ovidiu Panait +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/sahara.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/crypto/sahara.c b/drivers/crypto/sahara.c +index 1f41c8eeb8fc..2b20d1767ef9 100644 +--- a/drivers/crypto/sahara.c ++++ b/drivers/crypto/sahara.c +@@ -1048,7 +1048,7 @@ static int sahara_sha_process(struct ahash_request *req) + + memcpy(rctx->context, dev->context_base, rctx->context_size); + +- if (req->result) ++ if (req->result && rctx->last) + memcpy(req->result, rctx->context, rctx->digest_size); + + return 0; +-- +2.43.0 + diff --git a/queue-5.15/crypto-sahara-fix-cbc-selftest-failure.patch b/queue-5.15/crypto-sahara-fix-cbc-selftest-failure.patch new file mode 100644 index 00000000000..4f18d42b754 --- /dev/null +++ b/queue-5.15/crypto-sahara-fix-cbc-selftest-failure.patch @@ -0,0 +1,94 @@ +From a7902d3d3f5ce2fcb8982bed3c284b13aae7397e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Dec 2023 19:06:20 +0200 +Subject: crypto: sahara - fix cbc selftest failure + +From: Ovidiu Panait + +[ Upstream commit 9f10bc28c0fb676ae58aa3bfa358db8f5de124bb ] + +The kernel crypto API requires that all CBC implementations update the IV +buffer to contain the last ciphertext block. + +This fixes the following cbc selftest error: +alg: skcipher: sahara-cbc-aes encryption test failed (wrong output IV) on +test vector 0, cfg="in-place (one sglist)" + +Fixes: 5de8875281e1 ("crypto: sahara - Add driver for SAHARA2 accelerator.") +Signed-off-by: Ovidiu Panait +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/sahara.c | 33 +++++++++++++++++++++++++++++++-- + 1 file changed, 31 insertions(+), 2 deletions(-) + +diff --git a/drivers/crypto/sahara.c b/drivers/crypto/sahara.c +index 84a7c4de537a..1f41c8eeb8fc 100644 +--- a/drivers/crypto/sahara.c ++++ b/drivers/crypto/sahara.c +@@ -149,6 +149,7 @@ struct sahara_ctx { + + struct sahara_aes_reqctx { + unsigned long mode; ++ u8 iv_out[AES_BLOCK_SIZE]; + struct skcipher_request fallback_req; // keep at the end + }; + +@@ -542,8 +543,24 @@ static int sahara_hw_descriptor_create(struct sahara_dev *dev) + return -EINVAL; + } + ++static void sahara_aes_cbc_update_iv(struct skcipher_request *req) ++{ ++ struct crypto_skcipher *skcipher = crypto_skcipher_reqtfm(req); ++ struct sahara_aes_reqctx *rctx = skcipher_request_ctx(req); ++ unsigned int ivsize = crypto_skcipher_ivsize(skcipher); ++ ++ /* Update IV buffer to contain the last ciphertext block */ ++ if (rctx->mode & FLAGS_ENCRYPT) { ++ sg_pcopy_to_buffer(req->dst, sg_nents(req->dst), req->iv, ++ ivsize, req->cryptlen - ivsize); ++ } else { ++ memcpy(req->iv, rctx->iv_out, ivsize); ++ } ++} ++ + static int sahara_aes_process(struct skcipher_request *req) + { ++ struct crypto_skcipher *skcipher = crypto_skcipher_reqtfm(req); + struct sahara_dev *dev = dev_ptr; + struct sahara_ctx *ctx; + struct sahara_aes_reqctx *rctx; +@@ -565,8 +582,17 @@ static int sahara_aes_process(struct skcipher_request *req) + rctx->mode &= FLAGS_MODE_MASK; + dev->flags = (dev->flags & ~FLAGS_MODE_MASK) | rctx->mode; + +- if ((dev->flags & FLAGS_CBC) && req->iv) +- memcpy(dev->iv_base, req->iv, AES_KEYSIZE_128); ++ if ((dev->flags & FLAGS_CBC) && req->iv) { ++ unsigned int ivsize = crypto_skcipher_ivsize(skcipher); ++ ++ memcpy(dev->iv_base, req->iv, ivsize); ++ ++ if (!(dev->flags & FLAGS_ENCRYPT)) { ++ sg_pcopy_to_buffer(req->src, sg_nents(req->src), ++ rctx->iv_out, ivsize, ++ req->cryptlen - ivsize); ++ } ++ } + + /* assign new context to device */ + dev->ctx = ctx; +@@ -589,6 +615,9 @@ static int sahara_aes_process(struct skcipher_request *req) + dma_unmap_sg(dev->device, dev->in_sg, dev->nb_in_sg, + DMA_TO_DEVICE); + ++ if ((dev->flags & FLAGS_CBC) && req->iv) ++ sahara_aes_cbc_update_iv(req); ++ + return 0; + } + +-- +2.43.0 + diff --git a/queue-5.15/crypto-sahara-fix-error-handling-in-sahara_hw_descri.patch b/queue-5.15/crypto-sahara-fix-error-handling-in-sahara_hw_descri.patch new file mode 100644 index 00000000000..5b02cb77059 --- /dev/null +++ b/queue-5.15/crypto-sahara-fix-error-handling-in-sahara_hw_descri.patch @@ -0,0 +1,54 @@ +From 0c48d0efdf84647b26faedf47b2d5bce910a6c5a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Dec 2023 19:06:23 +0200 +Subject: crypto: sahara - fix error handling in sahara_hw_descriptor_create() + +From: Ovidiu Panait + +[ Upstream commit ee6e6f0a7f5b39d50a5ef5fcc006f4f693db18a7 ] + +Do not call dma_unmap_sg() for scatterlists that were not mapped +successfully. + +Fixes: 5de8875281e1 ("crypto: sahara - Add driver for SAHARA2 accelerator.") +Signed-off-by: Ovidiu Panait +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/sahara.c | 8 +++----- + 1 file changed, 3 insertions(+), 5 deletions(-) + +diff --git a/drivers/crypto/sahara.c b/drivers/crypto/sahara.c +index caa54d5312e9..f9fd64178a59 100644 +--- a/drivers/crypto/sahara.c ++++ b/drivers/crypto/sahara.c +@@ -484,13 +484,14 @@ static int sahara_hw_descriptor_create(struct sahara_dev *dev) + DMA_TO_DEVICE); + if (ret != dev->nb_in_sg) { + dev_err(dev->device, "couldn't map in sg\n"); +- goto unmap_in; ++ return -EINVAL; + } ++ + ret = dma_map_sg(dev->device, dev->out_sg, dev->nb_out_sg, + DMA_FROM_DEVICE); + if (ret != dev->nb_out_sg) { + dev_err(dev->device, "couldn't map out sg\n"); +- goto unmap_out; ++ goto unmap_in; + } + + /* Create input links */ +@@ -538,9 +539,6 @@ static int sahara_hw_descriptor_create(struct sahara_dev *dev) + + return 0; + +-unmap_out: +- dma_unmap_sg(dev->device, dev->out_sg, dev->nb_out_sg, +- DMA_FROM_DEVICE); + unmap_in: + dma_unmap_sg(dev->device, dev->in_sg, dev->nb_in_sg, + DMA_TO_DEVICE); +-- +2.43.0 + diff --git a/queue-5.15/crypto-sahara-fix-processing-hash-requests-with-req-.patch b/queue-5.15/crypto-sahara-fix-processing-hash-requests-with-req-.patch new file mode 100644 index 00000000000..b44ca1e6b0b --- /dev/null +++ b/queue-5.15/crypto-sahara-fix-processing-hash-requests-with-req-.patch @@ -0,0 +1,56 @@ +From cc2a6fe991a8ed17f2e2f57f6f08fcfd3182b852 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 24 Dec 2023 10:21:35 +0200 +Subject: crypto: sahara - fix processing hash requests with req->nbytes < + sg->length + +From: Ovidiu Panait + +[ Upstream commit 7bafa74d1ba35dcc173e1ce915e983d65905f77e ] + +It's not always the case that the entire sg entry needs to be processed. +Currently, when nbytes is less than sg->length, "Descriptor length" errors +are encountered. + +To fix this, take the actual request size into account when populating the +hw links. + +Fixes: 5a2bb93f5992 ("crypto: sahara - add support for SHA1/256") +Signed-off-by: Ovidiu Panait +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/sahara.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/crypto/sahara.c b/drivers/crypto/sahara.c +index 434c7e17d273..538beec3b062 100644 +--- a/drivers/crypto/sahara.c ++++ b/drivers/crypto/sahara.c +@@ -777,6 +777,7 @@ static int sahara_sha_hw_links_create(struct sahara_dev *dev, + int start) + { + struct scatterlist *sg; ++ unsigned int len; + unsigned int i; + int ret; + +@@ -798,12 +799,14 @@ static int sahara_sha_hw_links_create(struct sahara_dev *dev, + if (!ret) + return -EFAULT; + ++ len = rctx->total; + for (i = start; i < dev->nb_in_sg + start; i++) { +- dev->hw_link[i]->len = sg->length; ++ dev->hw_link[i]->len = min(len, sg->length); + dev->hw_link[i]->p = sg->dma_address; + if (i == (dev->nb_in_sg + start - 1)) { + dev->hw_link[i]->next = 0; + } else { ++ len -= min(len, sg->length); + dev->hw_link[i]->next = dev->hw_phys_link[i + 1]; + sg = sg_next(sg); + } +-- +2.43.0 + diff --git a/queue-5.15/crypto-sahara-fix-processing-requests-with-cryptlen-.patch b/queue-5.15/crypto-sahara-fix-processing-requests-with-cryptlen-.patch new file mode 100644 index 00000000000..6d5291161bf --- /dev/null +++ b/queue-5.15/crypto-sahara-fix-processing-requests-with-cryptlen-.patch @@ -0,0 +1,72 @@ +From 58edd69b840f2d4de3459feca62fcbd80f3a4cd3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Dec 2023 19:06:22 +0200 +Subject: crypto: sahara - fix processing requests with cryptlen < sg->length + +From: Ovidiu Panait + +[ Upstream commit 5b8668ce3452827d27f8c34ff6ba080a8f983ed0 ] + +It's not always the case that the entire sg entry needs to be processed. +Currently, when cryptlen is less than sg->legth, "Descriptor length" errors +are encountered. + +The error was noticed when testing xts(sahara-ecb-aes) with arbitrary sized +input data. To fix this, take the actual request size into account when +populating the hw links. + +Fixes: 5de8875281e1 ("crypto: sahara - Add driver for SAHARA2 accelerator.") +Signed-off-by: Ovidiu Panait +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/sahara.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/drivers/crypto/sahara.c b/drivers/crypto/sahara.c +index 2b20d1767ef9..caa54d5312e9 100644 +--- a/drivers/crypto/sahara.c ++++ b/drivers/crypto/sahara.c +@@ -445,6 +445,7 @@ static int sahara_hw_descriptor_create(struct sahara_dev *dev) + int ret; + int i, j; + int idx = 0; ++ u32 len; + + memcpy(dev->key_base, ctx->key, ctx->keylen); + +@@ -495,12 +496,14 @@ static int sahara_hw_descriptor_create(struct sahara_dev *dev) + /* Create input links */ + dev->hw_desc[idx]->p1 = dev->hw_phys_link[0]; + sg = dev->in_sg; ++ len = dev->total; + for (i = 0; i < dev->nb_in_sg; i++) { +- dev->hw_link[i]->len = sg->length; ++ dev->hw_link[i]->len = min(len, sg->length); + dev->hw_link[i]->p = sg->dma_address; + if (i == (dev->nb_in_sg - 1)) { + dev->hw_link[i]->next = 0; + } else { ++ len -= min(len, sg->length); + dev->hw_link[i]->next = dev->hw_phys_link[i + 1]; + sg = sg_next(sg); + } +@@ -509,12 +512,14 @@ static int sahara_hw_descriptor_create(struct sahara_dev *dev) + /* Create output links */ + dev->hw_desc[idx]->p2 = dev->hw_phys_link[i]; + sg = dev->out_sg; ++ len = dev->total; + for (j = i; j < dev->nb_out_sg + i; j++) { +- dev->hw_link[j]->len = sg->length; ++ dev->hw_link[j]->len = min(len, sg->length); + dev->hw_link[j]->p = sg->dma_address; + if (j == (dev->nb_out_sg + i - 1)) { + dev->hw_link[j]->next = 0; + } else { ++ len -= min(len, sg->length); + dev->hw_link[j]->next = dev->hw_phys_link[j + 1]; + sg = sg_next(sg); + } +-- +2.43.0 + diff --git a/queue-5.15/crypto-sahara-fix-wait_for_completion_timeout-error-.patch b/queue-5.15/crypto-sahara-fix-wait_for_completion_timeout-error-.patch new file mode 100644 index 00000000000..50564a0fd75 --- /dev/null +++ b/queue-5.15/crypto-sahara-fix-wait_for_completion_timeout-error-.patch @@ -0,0 +1,70 @@ +From b612492e4678d4db410b5d91cefd03c274fceca7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 24 Dec 2023 10:21:33 +0200 +Subject: crypto: sahara - fix wait_for_completion_timeout() error handling + +From: Ovidiu Panait + +[ Upstream commit 2dba8e1d1a7957dcbe7888846268538847b471d1 ] + +The sg lists are not unmapped in case of timeout errors. Fix this. + +Fixes: 5a2bb93f5992 ("crypto: sahara - add support for SHA1/256") +Fixes: 5de8875281e1 ("crypto: sahara - Add driver for SAHARA2 accelerator.") +Signed-off-by: Ovidiu Panait +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/sahara.c | 18 ++++++++++-------- + 1 file changed, 10 insertions(+), 8 deletions(-) + +diff --git a/drivers/crypto/sahara.c b/drivers/crypto/sahara.c +index d31ccaffebb8..a5c40ef6d8af 100644 +--- a/drivers/crypto/sahara.c ++++ b/drivers/crypto/sahara.c +@@ -608,16 +608,17 @@ static int sahara_aes_process(struct skcipher_request *req) + + timeout = wait_for_completion_timeout(&dev->dma_completion, + msecs_to_jiffies(SAHARA_TIMEOUT_MS)); +- if (!timeout) { +- dev_err(dev->device, "AES timeout\n"); +- return -ETIMEDOUT; +- } + + dma_unmap_sg(dev->device, dev->out_sg, dev->nb_out_sg, + DMA_FROM_DEVICE); + dma_unmap_sg(dev->device, dev->in_sg, dev->nb_in_sg, + DMA_TO_DEVICE); + ++ if (!timeout) { ++ dev_err(dev->device, "AES timeout\n"); ++ return -ETIMEDOUT; ++ } ++ + if ((dev->flags & FLAGS_CBC) && req->iv) + sahara_aes_cbc_update_iv(req); + +@@ -1008,15 +1009,16 @@ static int sahara_sha_process(struct ahash_request *req) + + timeout = wait_for_completion_timeout(&dev->dma_completion, + msecs_to_jiffies(SAHARA_TIMEOUT_MS)); +- if (!timeout) { +- dev_err(dev->device, "SHA timeout\n"); +- return -ETIMEDOUT; +- } + + if (rctx->sg_in_idx) + dma_unmap_sg(dev->device, dev->in_sg, dev->nb_in_sg, + DMA_TO_DEVICE); + ++ if (!timeout) { ++ dev_err(dev->device, "SHA timeout\n"); ++ return -ETIMEDOUT; ++ } ++ + memcpy(rctx->context, dev->context_base, rctx->context_size); + + if (req->result && rctx->last) +-- +2.43.0 + diff --git a/queue-5.15/crypto-sahara-handle-zero-length-aes-requests.patch b/queue-5.15/crypto-sahara-handle-zero-length-aes-requests.patch new file mode 100644 index 00000000000..07cc733a2c9 --- /dev/null +++ b/queue-5.15/crypto-sahara-handle-zero-length-aes-requests.patch @@ -0,0 +1,36 @@ +From dc862be15cfc1f6780ba2a36fc29f8a7939e9b2b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 24 Dec 2023 10:21:31 +0200 +Subject: crypto: sahara - handle zero-length aes requests + +From: Ovidiu Panait + +[ Upstream commit d1d6351e37aac14b32a291731d0855996c459d11 ] + +In case of a zero-length input, exit gracefully from sahara_aes_crypt(). + +Fixes: 5de8875281e1 ("crypto: sahara - Add driver for SAHARA2 accelerator.") +Signed-off-by: Ovidiu Panait +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/sahara.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/crypto/sahara.c b/drivers/crypto/sahara.c +index bbd2c6474b50..3229dd180d0c 100644 +--- a/drivers/crypto/sahara.c ++++ b/drivers/crypto/sahara.c +@@ -677,6 +677,9 @@ static int sahara_aes_crypt(struct skcipher_request *req, unsigned long mode) + struct sahara_dev *dev = dev_ptr; + int err = 0; + ++ if (!req->cryptlen) ++ return 0; ++ + if (unlikely(ctx->keylen != AES_KEYSIZE_128)) + return sahara_aes_fallback(req, mode); + +-- +2.43.0 + diff --git a/queue-5.15/crypto-sahara-improve-error-handling-in-sahara_sha_p.patch b/queue-5.15/crypto-sahara-improve-error-handling-in-sahara_sha_p.patch new file mode 100644 index 00000000000..bc5b2ddef87 --- /dev/null +++ b/queue-5.15/crypto-sahara-improve-error-handling-in-sahara_sha_p.patch @@ -0,0 +1,51 @@ +From 2339cf7bb8bc85cc714a0693f9f14a59bb99d985 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 24 Dec 2023 10:21:34 +0200 +Subject: crypto: sahara - improve error handling in sahara_sha_process() + +From: Ovidiu Panait + +[ Upstream commit 5deff027fca49a1eb3b20359333cf2ae562a2343 ] + +sahara_sha_hw_data_descriptor_create() returns negative error codes on +failure, so make sure the errors are correctly handled / propagated. + +Fixes: 5a2bb93f5992 ("crypto: sahara - add support for SHA1/256") +Signed-off-by: Ovidiu Panait +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/sahara.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/drivers/crypto/sahara.c b/drivers/crypto/sahara.c +index a5c40ef6d8af..434c7e17d273 100644 +--- a/drivers/crypto/sahara.c ++++ b/drivers/crypto/sahara.c +@@ -988,7 +988,10 @@ static int sahara_sha_process(struct ahash_request *req) + return ret; + + if (rctx->first) { +- sahara_sha_hw_data_descriptor_create(dev, rctx, req, 0); ++ ret = sahara_sha_hw_data_descriptor_create(dev, rctx, req, 0); ++ if (ret) ++ return ret; ++ + dev->hw_desc[0]->next = 0; + rctx->first = 0; + } else { +@@ -996,7 +999,10 @@ static int sahara_sha_process(struct ahash_request *req) + + sahara_sha_hw_context_descriptor_create(dev, rctx, req, 0); + dev->hw_desc[0]->next = dev->hw_phys_desc[1]; +- sahara_sha_hw_data_descriptor_create(dev, rctx, req, 1); ++ ret = sahara_sha_hw_data_descriptor_create(dev, rctx, req, 1); ++ if (ret) ++ return ret; ++ + dev->hw_desc[1]->next = 0; + } + +-- +2.43.0 + diff --git a/queue-5.15/crypto-sahara-remove-flags_new_key-logic.patch b/queue-5.15/crypto-sahara-remove-flags_new_key-logic.patch new file mode 100644 index 00000000000..afb7ee130dd --- /dev/null +++ b/queue-5.15/crypto-sahara-remove-flags_new_key-logic.patch @@ -0,0 +1,105 @@ +From d161bdfa1c1c88bfa586638b1beb73d802053656 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Dec 2023 19:06:19 +0200 +Subject: crypto: sahara - remove FLAGS_NEW_KEY logic + +From: Ovidiu Panait + +[ Upstream commit 8fd183435728b139248a77978ea3732039341779 ] + +Remove the FLAGS_NEW_KEY logic as it has the following issues: +- the wrong key may end up being used when there are multiple data streams: + t1 t2 + setkey() + encrypt() + setkey() + encrypt() + + encrypt() <--- key from t2 is used +- switching between encryption and decryption with the same key is not + possible, as the hdr flags are only updated when a new setkey() is + performed + +With this change, the key is always sent along with the cryptdata when +performing encryption/decryption operations. + +Fixes: 5de8875281e1 ("crypto: sahara - Add driver for SAHARA2 accelerator.") +Signed-off-by: Ovidiu Panait +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/sahara.c | 34 +++++++++++++--------------------- + 1 file changed, 13 insertions(+), 21 deletions(-) + +diff --git a/drivers/crypto/sahara.c b/drivers/crypto/sahara.c +index b07ae4ba165e..84a7c4de537a 100644 +--- a/drivers/crypto/sahara.c ++++ b/drivers/crypto/sahara.c +@@ -44,7 +44,6 @@ + #define FLAGS_MODE_MASK 0x000f + #define FLAGS_ENCRYPT BIT(0) + #define FLAGS_CBC BIT(1) +-#define FLAGS_NEW_KEY BIT(3) + + #define SAHARA_HDR_BASE 0x00800000 + #define SAHARA_HDR_SKHA_ALG_AES 0 +@@ -142,8 +141,6 @@ struct sahara_hw_link { + }; + + struct sahara_ctx { +- unsigned long flags; +- + /* AES-specific context */ + int keylen; + u8 key[AES_KEYSIZE_128]; +@@ -448,26 +445,22 @@ static int sahara_hw_descriptor_create(struct sahara_dev *dev) + int i, j; + int idx = 0; + +- /* Copy new key if necessary */ +- if (ctx->flags & FLAGS_NEW_KEY) { +- memcpy(dev->key_base, ctx->key, ctx->keylen); +- ctx->flags &= ~FLAGS_NEW_KEY; ++ memcpy(dev->key_base, ctx->key, ctx->keylen); + +- if (dev->flags & FLAGS_CBC) { +- dev->hw_desc[idx]->len1 = AES_BLOCK_SIZE; +- dev->hw_desc[idx]->p1 = dev->iv_phys_base; +- } else { +- dev->hw_desc[idx]->len1 = 0; +- dev->hw_desc[idx]->p1 = 0; +- } +- dev->hw_desc[idx]->len2 = ctx->keylen; +- dev->hw_desc[idx]->p2 = dev->key_phys_base; +- dev->hw_desc[idx]->next = dev->hw_phys_desc[1]; ++ if (dev->flags & FLAGS_CBC) { ++ dev->hw_desc[idx]->len1 = AES_BLOCK_SIZE; ++ dev->hw_desc[idx]->p1 = dev->iv_phys_base; ++ } else { ++ dev->hw_desc[idx]->len1 = 0; ++ dev->hw_desc[idx]->p1 = 0; ++ } ++ dev->hw_desc[idx]->len2 = ctx->keylen; ++ dev->hw_desc[idx]->p2 = dev->key_phys_base; ++ dev->hw_desc[idx]->next = dev->hw_phys_desc[1]; ++ dev->hw_desc[idx]->hdr = sahara_aes_key_hdr(dev); + +- dev->hw_desc[idx]->hdr = sahara_aes_key_hdr(dev); ++ idx++; + +- idx++; +- } + + dev->nb_in_sg = sg_nents_for_len(dev->in_sg, dev->total); + if (dev->nb_in_sg < 0) { +@@ -609,7 +602,6 @@ static int sahara_aes_setkey(struct crypto_skcipher *tfm, const u8 *key, + /* SAHARA only supports 128bit keys */ + if (keylen == AES_KEYSIZE_128) { + memcpy(ctx->key, key, keylen); +- ctx->flags |= FLAGS_NEW_KEY; + return 0; + } + +-- +2.43.0 + diff --git a/queue-5.15/crypto-scomp-fix-req-dst-buffer-overflow.patch b/queue-5.15/crypto-scomp-fix-req-dst-buffer-overflow.patch new file mode 100644 index 00000000000..a954389e76d --- /dev/null +++ b/queue-5.15/crypto-scomp-fix-req-dst-buffer-overflow.patch @@ -0,0 +1,57 @@ +From cf671ed14ba479c30097dd9d847bc3ac30e9d19d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Dec 2023 09:35:23 +0000 +Subject: crypto: scomp - fix req->dst buffer overflow + +From: Chengming Zhou + +[ Upstream commit 744e1885922a9943458954cfea917b31064b4131 ] + +The req->dst buffer size should be checked before copying from the +scomp_scratch->dst to avoid req->dst buffer overflow problem. + +Fixes: 1ab53a77b772 ("crypto: acomp - add driver-side scomp interface") +Reported-by: syzbot+3eff5e51bf1db122a16e@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/all/0000000000000b05cd060d6b5511@google.com/ +Signed-off-by: Chengming Zhou +Reviewed-by: Barry Song +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + crypto/scompress.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/crypto/scompress.c b/crypto/scompress.c +index 738f4f8f0f41..4d6366a44400 100644 +--- a/crypto/scompress.c ++++ b/crypto/scompress.c +@@ -124,6 +124,7 @@ static int scomp_acomp_comp_decomp(struct acomp_req *req, int dir) + struct crypto_scomp *scomp = *tfm_ctx; + void **ctx = acomp_request_ctx(req); + struct scomp_scratch *scratch; ++ unsigned int dlen; + int ret; + + if (!req->src || !req->slen || req->slen > SCOMP_SCRATCH_SIZE) +@@ -135,6 +136,8 @@ static int scomp_acomp_comp_decomp(struct acomp_req *req, int dir) + if (!req->dlen || req->dlen > SCOMP_SCRATCH_SIZE) + req->dlen = SCOMP_SCRATCH_SIZE; + ++ dlen = req->dlen; ++ + scratch = raw_cpu_ptr(&scomp_scratch); + spin_lock(&scratch->lock); + +@@ -152,6 +155,9 @@ static int scomp_acomp_comp_decomp(struct acomp_req *req, int dir) + ret = -ENOMEM; + goto out; + } ++ } else if (req->dlen > dlen) { ++ ret = -ENOSPC; ++ goto out; + } + scatterwalk_map_and_copy(scratch->dst, req->dst, 0, req->dlen, + 1); +-- +2.43.0 + diff --git a/queue-5.15/crypto-virtio-handle-dataq-logic-with-tasklet.patch b/queue-5.15/crypto-virtio-handle-dataq-logic-with-tasklet.patch new file mode 100644 index 00000000000..6140f17730d --- /dev/null +++ b/queue-5.15/crypto-virtio-handle-dataq-logic-with-tasklet.patch @@ -0,0 +1,99 @@ +From 6d6eaf0015d214f4b21718d6941768bb577e4e36 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Nov 2023 11:49:45 +0000 +Subject: crypto: virtio - Handle dataq logic with tasklet + +From: Gonglei (Arei) + +[ Upstream commit fed93fb62e05c38152b0fc1dc9609639e63eed76 ] + +Doing ipsec produces a spinlock recursion warning. +This is due to crypto_finalize_request() being called in the upper half. +Move virtual data queue processing of virtio-crypto driver to tasklet. + +Fixes: dbaf0624ffa57 ("crypto: add virtio-crypto driver") +Reported-by: Halil Pasic +Signed-off-by: wangyangxin +Signed-off-by: Gonglei +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/virtio/virtio_crypto_common.h | 2 ++ + drivers/crypto/virtio/virtio_crypto_core.c | 23 +++++++++++--------- + 2 files changed, 15 insertions(+), 10 deletions(-) + +diff --git a/drivers/crypto/virtio/virtio_crypto_common.h b/drivers/crypto/virtio/virtio_crypto_common.h +index a24f85c589e7..faa804a15299 100644 +--- a/drivers/crypto/virtio/virtio_crypto_common.h ++++ b/drivers/crypto/virtio/virtio_crypto_common.h +@@ -10,6 +10,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -27,6 +28,7 @@ struct data_queue { + char name[32]; + + struct crypto_engine *engine; ++ struct tasklet_struct done_task; + }; + + struct virtio_crypto { +diff --git a/drivers/crypto/virtio/virtio_crypto_core.c b/drivers/crypto/virtio/virtio_crypto_core.c +index e2375d992308..370c47c8a67a 100644 +--- a/drivers/crypto/virtio/virtio_crypto_core.c ++++ b/drivers/crypto/virtio/virtio_crypto_core.c +@@ -22,27 +22,28 @@ virtcrypto_clear_request(struct virtio_crypto_request *vc_req) + } + } + +-static void virtcrypto_dataq_callback(struct virtqueue *vq) ++static void virtcrypto_done_task(unsigned long data) + { +- struct virtio_crypto *vcrypto = vq->vdev->priv; ++ struct data_queue *data_vq = (struct data_queue *)data; ++ struct virtqueue *vq = data_vq->vq; + struct virtio_crypto_request *vc_req; +- unsigned long flags; + unsigned int len; +- unsigned int qid = vq->index; + +- spin_lock_irqsave(&vcrypto->data_vq[qid].lock, flags); + do { + virtqueue_disable_cb(vq); + while ((vc_req = virtqueue_get_buf(vq, &len)) != NULL) { +- spin_unlock_irqrestore( +- &vcrypto->data_vq[qid].lock, flags); + if (vc_req->alg_cb) + vc_req->alg_cb(vc_req, len); +- spin_lock_irqsave( +- &vcrypto->data_vq[qid].lock, flags); + } + } while (!virtqueue_enable_cb(vq)); +- spin_unlock_irqrestore(&vcrypto->data_vq[qid].lock, flags); ++} ++ ++static void virtcrypto_dataq_callback(struct virtqueue *vq) ++{ ++ struct virtio_crypto *vcrypto = vq->vdev->priv; ++ struct data_queue *dq = &vcrypto->data_vq[vq->index]; ++ ++ tasklet_schedule(&dq->done_task); + } + + static int virtcrypto_find_vqs(struct virtio_crypto *vi) +@@ -99,6 +100,8 @@ static int virtcrypto_find_vqs(struct virtio_crypto *vi) + ret = -ENOMEM; + goto err_engine; + } ++ tasklet_init(&vi->data_vq[i].done_task, virtcrypto_done_task, ++ (unsigned long)&vi->data_vq[i]); + } + + kfree(names); +-- +2.43.0 + diff --git a/queue-5.15/crypto-virtio-wait-for-tasklet-to-complete-on-device.patch b/queue-5.15/crypto-virtio-wait-for-tasklet-to-complete-on-device.patch new file mode 100644 index 00000000000..c8ec22f1d2b --- /dev/null +++ b/queue-5.15/crypto-virtio-wait-for-tasklet-to-complete-on-device.patch @@ -0,0 +1,42 @@ +From da2ce5f2ab28551f77b12a72c0d70496b62636d3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Dec 2023 19:42:15 +0800 +Subject: crypto: virtio - Wait for tasklet to complete on device remove + +From: wangyangxin + +[ Upstream commit 67cc511e8d436456cc98033e6d4ba83ebfc8e672 ] + +The scheduled tasklet needs to be executed on device remove. + +Fixes: fed93fb62e05 ("crypto: virtio - Handle dataq logic with tasklet") +Signed-off-by: wangyangxin +Signed-off-by: Gonglei +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/virtio/virtio_crypto_core.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/crypto/virtio/virtio_crypto_core.c b/drivers/crypto/virtio/virtio_crypto_core.c +index 370c47c8a67a..f1eff8f752cd 100644 +--- a/drivers/crypto/virtio/virtio_crypto_core.c ++++ b/drivers/crypto/virtio/virtio_crypto_core.c +@@ -434,11 +434,14 @@ static void virtcrypto_free_unused_reqs(struct virtio_crypto *vcrypto) + static void virtcrypto_remove(struct virtio_device *vdev) + { + struct virtio_crypto *vcrypto = vdev->priv; ++ int i; + + dev_info(&vdev->dev, "Start virtcrypto_remove.\n"); + + if (virtcrypto_dev_started(vcrypto)) + virtcrypto_dev_stop(vcrypto); ++ for (i = 0; i < vcrypto->max_data_queues; i++) ++ tasklet_kill(&vcrypto->data_vq[i].done_task); + vdev->config->reset(vdev); + virtcrypto_free_unused_reqs(vcrypto); + virtcrypto_clear_crypto_engines(vcrypto); +-- +2.43.0 + diff --git a/queue-5.15/dma-mapping-add-dma_release_coherent_memory-to-dma-a.patch b/queue-5.15/dma-mapping-add-dma_release_coherent_memory-to-dma-a.patch new file mode 100644 index 00000000000..025f59933f5 --- /dev/null +++ b/queue-5.15/dma-mapping-add-dma_release_coherent_memory-to-dma-a.patch @@ -0,0 +1,79 @@ +From a68013e0283c27ea95cecf766ed3f85919c6cbda Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Apr 2022 14:24:35 +0800 +Subject: dma-mapping: Add dma_release_coherent_memory to DMA API + +From: Mark-PK Tsai + +[ Upstream commit e61c451476e61450f6771ce03bbc01210a09be16 ] + +Add dma_release_coherent_memory to DMA API to allow dma +user call it to release dev->dma_mem when the device is +removed. + +Signed-off-by: Mark-PK Tsai +Acked-by: Christoph Hellwig +Link: https://lore.kernel.org/r/20220422062436.14384-2-mark-pk.tsai@mediatek.com +Signed-off-by: Mathieu Poirier +Stable-dep-of: b07bc2347672 ("dma-mapping: clear dev->dma_mem to NULL after freeing it") +Signed-off-by: Sasha Levin +--- + include/linux/dma-map-ops.h | 3 +++ + kernel/dma/coherent.c | 10 ++++++++-- + 2 files changed, 11 insertions(+), 2 deletions(-) + +diff --git a/include/linux/dma-map-ops.h b/include/linux/dma-map-ops.h +index 0d5b06b3a4a6..53db9655efe9 100644 +--- a/include/linux/dma-map-ops.h ++++ b/include/linux/dma-map-ops.h +@@ -166,6 +166,7 @@ static inline void dma_pernuma_cma_reserve(void) { } + #ifdef CONFIG_DMA_DECLARE_COHERENT + int dma_declare_coherent_memory(struct device *dev, phys_addr_t phys_addr, + dma_addr_t device_addr, size_t size); ++void dma_release_coherent_memory(struct device *dev); + int dma_alloc_from_dev_coherent(struct device *dev, ssize_t size, + dma_addr_t *dma_handle, void **ret); + int dma_release_from_dev_coherent(struct device *dev, int order, void *vaddr); +@@ -177,6 +178,8 @@ static inline int dma_declare_coherent_memory(struct device *dev, + { + return -ENOSYS; + } ++ ++#define dma_release_coherent_memory(dev) (0) + #define dma_alloc_from_dev_coherent(dev, size, handle, ret) (0) + #define dma_release_from_dev_coherent(dev, order, vaddr) (0) + #define dma_mmap_from_dev_coherent(dev, vma, vaddr, order, ret) (0) +diff --git a/kernel/dma/coherent.c b/kernel/dma/coherent.c +index 25fc85a7aebe..ca05989d9901 100644 +--- a/kernel/dma/coherent.c ++++ b/kernel/dma/coherent.c +@@ -75,7 +75,7 @@ static struct dma_coherent_mem *dma_init_coherent_memory(phys_addr_t phys_addr, + return ERR_PTR(-ENOMEM); + } + +-static void dma_release_coherent_memory(struct dma_coherent_mem *mem) ++static void _dma_release_coherent_memory(struct dma_coherent_mem *mem) + { + if (!mem) + return; +@@ -127,10 +127,16 @@ int dma_declare_coherent_memory(struct device *dev, phys_addr_t phys_addr, + + ret = dma_assign_coherent_memory(dev, mem); + if (ret) +- dma_release_coherent_memory(mem); ++ _dma_release_coherent_memory(mem); + return ret; + } + ++void dma_release_coherent_memory(struct device *dev) ++{ ++ if (dev) ++ _dma_release_coherent_memory(dev->dma_mem); ++} ++ + static void *__dma_alloc_from_coherent(struct device *dev, + struct dma_coherent_mem *mem, + ssize_t size, dma_addr_t *dma_handle) +-- +2.43.0 + diff --git a/queue-5.15/dma-mapping-clear-dev-dma_mem-to-null-after-freeing-.patch b/queue-5.15/dma-mapping-clear-dev-dma_mem-to-null-after-freeing-.patch new file mode 100644 index 00000000000..23a48f83546 --- /dev/null +++ b/queue-5.15/dma-mapping-clear-dev-dma_mem-to-null-after-freeing-.patch @@ -0,0 +1,44 @@ +From da2e85c0324035104362d27402c789d431d84d81 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Dec 2023 16:25:26 +0800 +Subject: dma-mapping: clear dev->dma_mem to NULL after freeing it + +From: Joakim Zhang + +[ Upstream commit b07bc2347672cc8c7293c64499f1488278c5ca3d ] + +Reproduced with below sequence: +dma_declare_coherent_memory()->dma_release_coherent_memory() +->dma_declare_coherent_memory()->"return -EBUSY" error + +It will return -EBUSY from the dma_assign_coherent_memory() +in dma_declare_coherent_memory(), the reason is that dev->dma_mem +pointer has not been set to NULL after it's freed. + +Fixes: cf65a0f6f6ff ("dma-mapping: move all DMA mapping code to kernel/dma") +Signed-off-by: Joakim Zhang +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + kernel/dma/coherent.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/kernel/dma/coherent.c b/kernel/dma/coherent.c +index ca05989d9901..2df824fa40ef 100644 +--- a/kernel/dma/coherent.c ++++ b/kernel/dma/coherent.c +@@ -133,8 +133,10 @@ int dma_declare_coherent_memory(struct device *dev, phys_addr_t phys_addr, + + void dma_release_coherent_memory(struct device *dev) + { +- if (dev) ++ if (dev) { + _dma_release_coherent_memory(dev->dma_mem); ++ dev->dma_mem = NULL; ++ } + } + + static void *__dma_alloc_from_coherent(struct device *dev, +-- +2.43.0 + diff --git a/queue-5.15/driver-core-remove-config_sysfs_deprecated-and-confi.patch b/queue-5.15/driver-core-remove-config_sysfs_deprecated-and-confi.patch new file mode 100644 index 00000000000..5f54a392e99 --- /dev/null +++ b/queue-5.15/driver-core-remove-config_sysfs_deprecated-and-confi.patch @@ -0,0 +1,278 @@ +From 8b2493474383d7966b09bce73a840539090e7d75 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Feb 2023 08:33:26 +0100 +Subject: driver core: remove CONFIG_SYSFS_DEPRECATED and + CONFIG_SYSFS_DEPRECATED_V2 + +From: Greg Kroah-Hartman + +[ Upstream commit 721da5cee9d43901105f5b8bd33fcb9101b12fc3 ] + +CONFIG_SYSFS_DEPRECATED was added in commit 88a22c985e35 +("CONFIG_SYSFS_DEPRECATED") in 2006 to allow systems with older versions +of some tools (i.e. Fedora 3's version of udev) to boot properly. Four +years later, in 2010, the option was attempted to be removed as most of +userspace should have been fixed up properly by then, but some kernel +developers clung to those old systems and refused to update, so we added +CONFIG_SYSFS_DEPRECATED_V2 in commit e52eec13cd6b ("SYSFS: Allow boot +time switching between deprecated and modern sysfs layout") to allow +them to continue to boot properly, and we allowed a boot time parameter +to be used to switch back to the old format if needed. + +Over time, the logic that was covered under these config options was +slowly removed from individual driver subsystems successfully, removed, +and the only thing that is now left in the kernel are some changes in +the block layer's representation in sysfs where real directories are +used instead of symlinks like normal. + +Because the original changes were done to userspace tools in 2006, and +all distros that use those tools are long end-of-life, and older +non-udev-based systems do not care about the block layer's sysfs +representation, it is time to finally remove this old logic and the +config entries from the kernel. + +Cc: Jonathan Corbet +Cc: "Rafael J. Wysocki" +Cc: linux-block@vger.kernel.org +Cc: linux-doc@vger.kernel.org +Acked-by: Jens Axboe +Link: https://lore.kernel.org/r/20230223073326.2073220-1-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: 5fa3d1a00c2d ("block: Set memalloc_noio to false on device_add_disk() error path") +Signed-off-by: Sasha Levin +--- + .../admin-guide/kernel-parameters.txt | 9 ----- + block/genhd.c | 19 ++++------ + drivers/base/class.c | 2 +- + drivers/base/core.c | 37 ------------------ + include/linux/device.h | 6 --- + init/Kconfig | 38 ------------------- + 6 files changed, 8 insertions(+), 103 deletions(-) + +diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt +index 34b093e7f891..3734e8be3dad 100644 +--- a/Documentation/admin-guide/kernel-parameters.txt ++++ b/Documentation/admin-guide/kernel-parameters.txt +@@ -5727,15 +5727,6 @@ + later by a loaded module cannot be set this way. + Example: sysctl.vm.swappiness=40 + +- sysfs.deprecated=0|1 [KNL] +- Enable/disable old style sysfs layout for old udev +- on older distributions. When this option is enabled +- very new udev will not work anymore. When this option +- is disabled (or CONFIG_SYSFS_DEPRECATED not compiled) +- in older udev will not work anymore. +- Default depends on CONFIG_SYSFS_DEPRECATED_V2 set in +- the kernel configuration. +- + sysrq_always_enabled + [KNL] + Ignore sysrq setting - this boot parameter will +diff --git a/block/genhd.c b/block/genhd.c +index 6123f13e148e..62dd331db639 100644 +--- a/block/genhd.c ++++ b/block/genhd.c +@@ -451,12 +451,10 @@ int device_add_disk(struct device *parent, struct gendisk *disk, + if (ret) + goto out_device_del; + +- if (!sysfs_deprecated) { +- ret = sysfs_create_link(block_depr, &ddev->kobj, +- kobject_name(&ddev->kobj)); +- if (ret) +- goto out_device_del; +- } ++ ret = sysfs_create_link(block_depr, &ddev->kobj, ++ kobject_name(&ddev->kobj)); ++ if (ret) ++ goto out_device_del; + + /* + * avoid probable deadlock caused by allocating memory with +@@ -536,8 +534,7 @@ int device_add_disk(struct device *parent, struct gendisk *disk, + out_del_integrity: + blk_integrity_del(disk); + out_del_block_link: +- if (!sysfs_deprecated) +- sysfs_remove_link(block_depr, dev_name(ddev)); ++ sysfs_remove_link(block_depr, dev_name(ddev)); + out_device_del: + device_del(ddev); + out_free_ext_minor: +@@ -629,8 +626,7 @@ void del_gendisk(struct gendisk *disk) + + part_stat_set_all(disk->part0, 0); + disk->part0->bd_stamp = 0; +- if (!sysfs_deprecated) +- sysfs_remove_link(block_depr, dev_name(disk_to_dev(disk))); ++ sysfs_remove_link(block_depr, dev_name(disk_to_dev(disk))); + pm_runtime_set_memalloc_noio(disk_to_dev(disk), false); + device_del(disk_to_dev(disk)); + +@@ -848,8 +844,7 @@ static int __init genhd_device_init(void) + register_blkdev(BLOCK_EXT_MAJOR, "blkext"); + + /* create top-level block dir */ +- if (!sysfs_deprecated) +- block_depr = kobject_create_and_add("block", NULL); ++ block_depr = kobject_create_and_add("block", NULL); + return 0; + } + +diff --git a/drivers/base/class.c b/drivers/base/class.c +index 0e44a68e90a0..88465c42c2ed 100644 +--- a/drivers/base/class.c ++++ b/drivers/base/class.c +@@ -176,7 +176,7 @@ int __class_register(struct class *cls, struct lock_class_key *key) + + #if defined(CONFIG_BLOCK) + /* let the block class directory show up in the root of sysfs */ +- if (!sysfs_deprecated || cls != &block_class) ++ if (cls != &block_class) + cp->subsys.kobj.kset = class_kset; + #else + cp->subsys.kobj.kset = class_kset; +diff --git a/drivers/base/core.c b/drivers/base/core.c +index adf003a7e8d6..d1ff9fa7bbe1 100644 +--- a/drivers/base/core.c ++++ b/drivers/base/core.c +@@ -34,19 +34,6 @@ + #include "base.h" + #include "power/power.h" + +-#ifdef CONFIG_SYSFS_DEPRECATED +-#ifdef CONFIG_SYSFS_DEPRECATED_V2 +-long sysfs_deprecated = 1; +-#else +-long sysfs_deprecated = 0; +-#endif +-static int __init sysfs_deprecated_setup(char *arg) +-{ +- return kstrtol(arg, 10, &sysfs_deprecated); +-} +-early_param("sysfs.deprecated", sysfs_deprecated_setup); +-#endif +- + /* Device links support. */ + static LIST_HEAD(deferred_sync); + static unsigned int defer_sync_state_count = 1; +@@ -2963,15 +2950,6 @@ static struct kobject *get_device_parent(struct device *dev, + struct kobject *parent_kobj; + struct kobject *k; + +-#ifdef CONFIG_BLOCK +- /* block disks show up in /sys/block */ +- if (sysfs_deprecated && dev->class == &block_class) { +- if (parent && parent->class == &block_class) +- return &parent->kobj; +- return &block_class.p->subsys.kobj; +- } +-#endif +- + /* + * If we have no parent, we live in "virtual". + * Class-devices with a non class-device as parent, live +@@ -3126,12 +3104,6 @@ static int device_add_class_symlinks(struct device *dev) + goto out_subsys; + } + +-#ifdef CONFIG_BLOCK +- /* /sys/block has directories and does not need symlinks */ +- if (sysfs_deprecated && dev->class == &block_class) +- return 0; +-#endif +- + /* link in the class directory pointing to the device */ + error = sysfs_create_link(&dev->class->p->subsys.kobj, + &dev->kobj, dev_name(dev)); +@@ -3161,10 +3133,6 @@ static void device_remove_class_symlinks(struct device *dev) + if (dev->parent && device_is_not_partition(dev)) + sysfs_remove_link(&dev->kobj, "device"); + sysfs_remove_link(&dev->kobj, "subsystem"); +-#ifdef CONFIG_BLOCK +- if (sysfs_deprecated && dev->class == &block_class) +- return; +-#endif + sysfs_delete_link(&dev->class->p->subsys.kobj, &dev->kobj, dev_name(dev)); + } + +@@ -4442,11 +4410,6 @@ int device_change_owner(struct device *dev, kuid_t kuid, kgid_t kgid) + if (error) + goto out; + +-#ifdef CONFIG_BLOCK +- if (sysfs_deprecated && dev->class == &block_class) +- goto out; +-#endif +- + /* + * Change the owner of the symlink located in the class directory of + * the device class associated with @dev which points to the actual +diff --git a/include/linux/device.h b/include/linux/device.h +index e270cb740b9e..7ed8625e2173 100644 +--- a/include/linux/device.h ++++ b/include/linux/device.h +@@ -981,10 +981,4 @@ int dev_err_probe(const struct device *dev, int err, const char *fmt, ...); + #define MODULE_ALIAS_CHARDEV_MAJOR(major) \ + MODULE_ALIAS("char-major-" __stringify(major) "-*") + +-#ifdef CONFIG_SYSFS_DEPRECATED +-extern long sysfs_deprecated; +-#else +-#define sysfs_deprecated 0 +-#endif +- + #endif /* _DEVICE_H_ */ +diff --git a/init/Kconfig b/init/Kconfig +index dafc3ba6fa7a..e319e10afd94 100644 +--- a/init/Kconfig ++++ b/init/Kconfig +@@ -1278,44 +1278,6 @@ config SCHED_AUTOGROUP + desktop applications. Task group autogeneration is currently based + upon task session. + +-config SYSFS_DEPRECATED +- bool "Enable deprecated sysfs features to support old userspace tools" +- depends on SYSFS +- default n +- help +- This option adds code that switches the layout of the "block" class +- devices, to not show up in /sys/class/block/, but only in +- /sys/block/. +- +- This switch is only active when the sysfs.deprecated=1 boot option is +- passed or the SYSFS_DEPRECATED_V2 option is set. +- +- This option allows new kernels to run on old distributions and tools, +- which might get confused by /sys/class/block/. Since 2007/2008 all +- major distributions and tools handle this just fine. +- +- Recent distributions and userspace tools after 2009/2010 depend on +- the existence of /sys/class/block/, and will not work with this +- option enabled. +- +- Only if you are using a new kernel on an old distribution, you might +- need to say Y here. +- +-config SYSFS_DEPRECATED_V2 +- bool "Enable deprecated sysfs features by default" +- default n +- depends on SYSFS +- depends on SYSFS_DEPRECATED +- help +- Enable deprecated sysfs by default. +- +- See the CONFIG_SYSFS_DEPRECATED option for more details about this +- option. +- +- Only if you are using a new kernel on an old distribution, you might +- need to say Y here. Even then, odds are you would not need it +- enabled, you can always pass the boot option if absolutely necessary. +- + config RELAY + bool "Kernel->user space relay support (formerly relayfs)" + select IRQ_WORK +-- +2.43.0 + diff --git a/queue-5.15/drivers-amd-pm-fix-a-use-after-free-in-kv_parse_powe.patch b/queue-5.15/drivers-amd-pm-fix-a-use-after-free-in-kv_parse_powe.patch new file mode 100644 index 00000000000..07a7986ce25 --- /dev/null +++ b/queue-5.15/drivers-amd-pm-fix-a-use-after-free-in-kv_parse_powe.patch @@ -0,0 +1,48 @@ +From 402013527ba4c89dcabe0f94efd01bdae0debcf1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Dec 2023 00:24:58 +0800 +Subject: drivers/amd/pm: fix a use-after-free in kv_parse_power_table + +From: Zhipeng Lu + +[ Upstream commit 28dd788382c43b330480f57cd34cde0840896743 ] + +When ps allocated by kzalloc equals to NULL, kv_parse_power_table +frees adev->pm.dpm.ps that allocated before. However, after the control +flow goes through the following call chains: + +kv_parse_power_table + |-> kv_dpm_init + |-> kv_dpm_sw_init + |-> kv_dpm_fini + +The adev->pm.dpm.ps is used in the for loop of kv_dpm_fini after its +first free in kv_parse_power_table and causes a use-after-free bug. + +Fixes: a2e73f56fa62 ("drm/amdgpu: Add support for CIK parts") +Signed-off-by: Zhipeng Lu +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/powerplay/kv_dpm.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/amd/pm/powerplay/kv_dpm.c b/drivers/gpu/drm/amd/pm/powerplay/kv_dpm.c +index 6ba4c2ae69a6..309c9f0b8f83 100644 +--- a/drivers/gpu/drm/amd/pm/powerplay/kv_dpm.c ++++ b/drivers/gpu/drm/amd/pm/powerplay/kv_dpm.c +@@ -2731,10 +2731,8 @@ static int kv_parse_power_table(struct amdgpu_device *adev) + non_clock_info = (struct _ATOM_PPLIB_NONCLOCK_INFO *) + &non_clock_info_array->nonClockInfo[non_clock_array_index]; + ps = kzalloc(sizeof(struct kv_ps), GFP_KERNEL); +- if (ps == NULL) { +- kfree(adev->pm.dpm.ps); ++ if (ps == NULL) + return -ENOMEM; +- } + adev->pm.dpm.ps[i].ps_priv = ps; + k = 0; + idx = (u8 *)&power_state->v2.clockInfoIndex[0]; +-- +2.43.0 + diff --git a/queue-5.15/drivers-clk-zynqmp-calculate-closest-mux-rate.patch b/queue-5.15/drivers-clk-zynqmp-calculate-closest-mux-rate.patch new file mode 100644 index 00000000000..1424c60d691 --- /dev/null +++ b/queue-5.15/drivers-clk-zynqmp-calculate-closest-mux-rate.patch @@ -0,0 +1,61 @@ +From f70333fa958e1aee566c5f1627502380b4a40db1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Nov 2023 03:29:15 -0800 +Subject: drivers: clk: zynqmp: calculate closest mux rate + +From: Jay Buddhabhatti + +[ Upstream commit b782921ddd7f84f524723090377903f399fdbbcb ] + +Currently zynqmp clock driver is not calculating closest mux rate and +because of that Linux is not setting proper frequency for CPU and +not able to set given frequency for dynamic frequency scaling. + +E.g., In current logic initial acpu clock parent and frequency as below +apll1 0 0 0 2199999978 0 0 50000 Y + acpu0_mux 0 0 0 2199999978 0 0 50000 Y + acpu0_idiv1 0 0 0 2199999978 0 0 50000 Y + acpu0 0 0 0 2199999978 0 0 50000 Y + +After changing acpu frequency to 549999994 Hz using CPU freq scaling its +selecting incorrect parent which is not closest frequency. +rpll_to_xpd 0 0 0 1599999984 0 0 50000 Y + acpu0_mux 0 0 0 1599999984 0 0 50000 Y + acpu0_div1 0 0 0 533333328 0 0 50000 Y + acpu0 0 0 0 533333328 0 0 50000 Y + +Parent should remain same since 549999994 = 2199999978 / 4. + +So use __clk_mux_determine_rate_closest() generic function to calculate +closest rate for mux clock. After this change its selecting correct +parent and correct clock rate. +apll1 0 0 0 2199999978 0 0 50000 Y + acpu0_mux 0 0 0 2199999978 0 0 50000 Y + acpu0_div1 0 0 0 549999995 0 0 50000 Y + acpu0 0 0 0 549999995 0 0 50000 Y + +Fixes: 3fde0e16d016 ("drivers: clk: Add ZynqMP clock driver") +Signed-off-by: Jay Buddhabhatti +Link: https://lore.kernel.org/r/20231129112916.23125-2-jay.buddhabhatti@amd.com +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/zynqmp/clk-mux-zynqmp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/zynqmp/clk-mux-zynqmp.c b/drivers/clk/zynqmp/clk-mux-zynqmp.c +index 17afce594f28..5a040f939056 100644 +--- a/drivers/clk/zynqmp/clk-mux-zynqmp.c ++++ b/drivers/clk/zynqmp/clk-mux-zynqmp.c +@@ -89,7 +89,7 @@ static int zynqmp_clk_mux_set_parent(struct clk_hw *hw, u8 index) + static const struct clk_ops zynqmp_clk_mux_ops = { + .get_parent = zynqmp_clk_mux_get_parent, + .set_parent = zynqmp_clk_mux_set_parent, +- .determine_rate = __clk_mux_determine_rate, ++ .determine_rate = __clk_mux_determine_rate_closest, + }; + + static const struct clk_ops zynqmp_clk_mux_ro_ops = { +-- +2.43.0 + diff --git a/queue-5.15/drivers-clk-zynqmp-update-divider-round-rate-logic.patch b/queue-5.15/drivers-clk-zynqmp-update-divider-round-rate-logic.patch new file mode 100644 index 00000000000..506f1d37347 --- /dev/null +++ b/queue-5.15/drivers-clk-zynqmp-update-divider-round-rate-logic.patch @@ -0,0 +1,121 @@ +From 622cef593b5d60bd38330688add9cd376f307a92 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Nov 2023 03:29:16 -0800 +Subject: drivers: clk: zynqmp: update divider round rate logic + +From: Jay Buddhabhatti + +[ Upstream commit 1fe15be1fb613534ecbac5f8c3f8744f757d237d ] + +Currently zynqmp divider round rate is considering single parent and +calculating rate and parent rate accordingly. But if divider clock flag +is set to SET_RATE_PARENT then its not trying to traverse through all +parent rate and not selecting best parent rate from that. So use common +divider_round_rate() which is traversing through all clock parents and +its rate and calculating proper parent rate. + +Fixes: 3fde0e16d016 ("drivers: clk: Add ZynqMP clock driver") +Signed-off-by: Jay Buddhabhatti +Link: https://lore.kernel.org/r/20231129112916.23125-3-jay.buddhabhatti@amd.com +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/zynqmp/divider.c | 66 +++--------------------------------- + 1 file changed, 5 insertions(+), 61 deletions(-) + +diff --git a/drivers/clk/zynqmp/divider.c b/drivers/clk/zynqmp/divider.c +index 47a199346ddf..e25c76ff2739 100644 +--- a/drivers/clk/zynqmp/divider.c ++++ b/drivers/clk/zynqmp/divider.c +@@ -110,52 +110,6 @@ static unsigned long zynqmp_clk_divider_recalc_rate(struct clk_hw *hw, + return DIV_ROUND_UP_ULL(parent_rate, value); + } + +-static void zynqmp_get_divider2_val(struct clk_hw *hw, +- unsigned long rate, +- struct zynqmp_clk_divider *divider, +- u32 *bestdiv) +-{ +- int div1; +- int div2; +- long error = LONG_MAX; +- unsigned long div1_prate; +- struct clk_hw *div1_parent_hw; +- struct zynqmp_clk_divider *pdivider; +- struct clk_hw *div2_parent_hw = clk_hw_get_parent(hw); +- +- if (!div2_parent_hw) +- return; +- +- pdivider = to_zynqmp_clk_divider(div2_parent_hw); +- if (!pdivider) +- return; +- +- div1_parent_hw = clk_hw_get_parent(div2_parent_hw); +- if (!div1_parent_hw) +- return; +- +- div1_prate = clk_hw_get_rate(div1_parent_hw); +- *bestdiv = 1; +- for (div1 = 1; div1 <= pdivider->max_div;) { +- for (div2 = 1; div2 <= divider->max_div;) { +- long new_error = ((div1_prate / div1) / div2) - rate; +- +- if (abs(new_error) < abs(error)) { +- *bestdiv = div2; +- error = new_error; +- } +- if (divider->flags & CLK_DIVIDER_POWER_OF_TWO) +- div2 = div2 << 1; +- else +- div2++; +- } +- if (pdivider->flags & CLK_DIVIDER_POWER_OF_TWO) +- div1 = div1 << 1; +- else +- div1++; +- } +-} +- + /** + * zynqmp_clk_divider_round_rate() - Round rate of divider clock + * @hw: handle between common and hardware-specific interfaces +@@ -174,6 +128,7 @@ static long zynqmp_clk_divider_round_rate(struct clk_hw *hw, + u32 div_type = divider->div_type; + u32 bestdiv; + int ret; ++ u8 width; + + /* if read only, just return current value */ + if (divider->flags & CLK_DIVIDER_READ_ONLY) { +@@ -193,23 +148,12 @@ static long zynqmp_clk_divider_round_rate(struct clk_hw *hw, + return DIV_ROUND_UP_ULL((u64)*prate, bestdiv); + } + +- bestdiv = zynqmp_divider_get_val(*prate, rate, divider->flags); +- +- /* +- * In case of two divisors, compute best divider values and return +- * divider2 value based on compute value. div1 will be automatically +- * set to optimum based on required total divider value. +- */ +- if (div_type == TYPE_DIV2 && +- (clk_hw_get_flags(hw) & CLK_SET_RATE_PARENT)) { +- zynqmp_get_divider2_val(hw, rate, divider, &bestdiv); +- } ++ width = fls(divider->max_div); + +- if ((clk_hw_get_flags(hw) & CLK_SET_RATE_PARENT) && divider->is_frac) +- bestdiv = rate % *prate ? 1 : bestdiv; ++ rate = divider_round_rate(hw, rate, prate, NULL, width, divider->flags); + +- bestdiv = min_t(u32, bestdiv, divider->max_div); +- *prate = rate * bestdiv; ++ if (divider->is_frac && (clk_hw_get_flags(hw) & CLK_SET_RATE_PARENT) && (rate % *prate)) ++ *prate = rate; + + return rate; + } +-- +2.43.0 + diff --git a/queue-5.15/drm-amd-pm-fix-a-double-free-in-si_dpm_init.patch b/queue-5.15/drm-amd-pm-fix-a-double-free-in-si_dpm_init.patch new file mode 100644 index 00000000000..b4e6b9808b1 --- /dev/null +++ b/queue-5.15/drm-amd-pm-fix-a-double-free-in-si_dpm_init.patch @@ -0,0 +1,45 @@ +From 35363510a8cc37cbbc898f11688facd9bb815540 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Dec 2023 23:24:11 +0800 +Subject: drm/amd/pm: fix a double-free in si_dpm_init + +From: Zhipeng Lu + +[ Upstream commit ac16667237a82e2597e329eb9bc520d1cf9dff30 ] + +When the allocation of +adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries fails, +amdgpu_free_extended_power_table is called to free some fields of adev. +However, when the control flow returns to si_dpm_sw_init, it goes to +label dpm_failed and calls si_dpm_fini, which calls +amdgpu_free_extended_power_table again and free those fields again. Thus +a double-free is triggered. + +Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)") +Signed-off-by: Zhipeng Lu +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/powerplay/si_dpm.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/amd/pm/powerplay/si_dpm.c b/drivers/gpu/drm/amd/pm/powerplay/si_dpm.c +index 66fc63f1f1c1..09e78575db87 100644 +--- a/drivers/gpu/drm/amd/pm/powerplay/si_dpm.c ++++ b/drivers/gpu/drm/amd/pm/powerplay/si_dpm.c +@@ -7346,10 +7346,9 @@ static int si_dpm_init(struct amdgpu_device *adev) + kcalloc(4, + sizeof(struct amdgpu_clock_voltage_dependency_entry), + GFP_KERNEL); +- if (!adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries) { +- amdgpu_free_extended_power_table(adev); ++ if (!adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries) + return -ENOMEM; +- } ++ + adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.count = 4; + adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries[0].clk = 0; + adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries[0].v = 0; +-- +2.43.0 + diff --git a/queue-5.15/drm-amd-pm-smu7-fix-a-memleak-in-smu7_hwmgr_backend_.patch b/queue-5.15/drm-amd-pm-smu7-fix-a-memleak-in-smu7_hwmgr_backend_.patch new file mode 100644 index 00000000000..e545e34b2e9 --- /dev/null +++ b/queue-5.15/drm-amd-pm-smu7-fix-a-memleak-in-smu7_hwmgr_backend_.patch @@ -0,0 +1,53 @@ +From 8de5823fda9c27f6029049b461abd6dd03f99893 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 24 Dec 2023 16:22:47 +0800 +Subject: drm/amd/pm/smu7: fix a memleak in smu7_hwmgr_backend_init + +From: Zhipeng Lu + +[ Upstream commit 2f3be3ca779b11c332441b10e00443a2510f4d7b ] + +The hwmgr->backend, (i.e. data) allocated by kzalloc is not freed in +the error-handling paths of smu7_get_evv_voltages and +smu7_update_edc_leakage_table. However, it did be freed in the +error-handling of phm_initializa_dynamic_state_adjustment_rule_settings, +by smu7_hwmgr_backend_fini. So the lack of free in smu7_get_evv_voltages +and smu7_update_edc_leakage_table is considered a memleak in this patch. + +Fixes: 599a7e9fe1b6 ("drm/amd/powerplay: implement smu7 hwmgr to manager asics with smu ip version 7.") +Fixes: 8f0804c6b7d0 ("drm/amd/pm: add edc leakage controller setting") +Signed-off-by: Zhipeng Lu +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c +index 611969bf4520..9bfc465d08fb 100644 +--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c ++++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c +@@ -2924,6 +2924,8 @@ static int smu7_hwmgr_backend_init(struct pp_hwmgr *hwmgr) + result = smu7_get_evv_voltages(hwmgr); + if (result) { + pr_info("Get EVV Voltage Failed. Abort Driver loading!\n"); ++ kfree(hwmgr->backend); ++ hwmgr->backend = NULL; + return -EINVAL; + } + } else { +@@ -2969,8 +2971,10 @@ static int smu7_hwmgr_backend_init(struct pp_hwmgr *hwmgr) + } + + result = smu7_update_edc_leakage_table(hwmgr); +- if (result) ++ if (result) { ++ smu7_hwmgr_backend_fini(hwmgr); + return result; ++ } + + return 0; + } +-- +2.43.0 + diff --git a/queue-5.15/drm-amdgpu-debugfs-fix-error-code-when-smc-register-.patch b/queue-5.15/drm-amdgpu-debugfs-fix-error-code-when-smc-register-.patch new file mode 100644 index 00000000000..46edc5dfc66 --- /dev/null +++ b/queue-5.15/drm-amdgpu-debugfs-fix-error-code-when-smc-register-.patch @@ -0,0 +1,48 @@ +From 3ec0e5a35bf5b1b78768de0e203321f7debbe1e1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Nov 2023 17:26:29 -0500 +Subject: drm/amdgpu/debugfs: fix error code when smc register accessors are + NULL +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Alex Deucher + +[ Upstream commit afe58346d5d3887b3e49ff623d2f2e471f232a8d ] + +Should be -EOPNOTSUPP. + +Fixes: 5104fdf50d32 ("drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL") +Reviewed-by: Christian König +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c +index 632d8df04ef4..aa057ceecf06 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c +@@ -465,7 +465,7 @@ static ssize_t amdgpu_debugfs_regs_smc_read(struct file *f, char __user *buf, + int r; + + if (!adev->smc_rreg) +- return -EPERM; ++ return -EOPNOTSUPP; + + if (size & 0x3 || *pos & 0x3) + return -EINVAL; +@@ -527,7 +527,7 @@ static ssize_t amdgpu_debugfs_regs_smc_write(struct file *f, const char __user * + int r; + + if (!adev->smc_wreg) +- return -EPERM; ++ return -EOPNOTSUPP; + + if (size & 0x3 || *pos & 0x3) + return -EINVAL; +-- +2.43.0 + diff --git a/queue-5.15/drm-bridge-cdns-mhdp8546-fix-use-of-uninitialized-va.patch b/queue-5.15/drm-bridge-cdns-mhdp8546-fix-use-of-uninitialized-va.patch new file mode 100644 index 00000000000..efae5c5608f --- /dev/null +++ b/queue-5.15/drm-bridge-cdns-mhdp8546-fix-use-of-uninitialized-va.patch @@ -0,0 +1,38 @@ +From 3c83794e783c4d1f52f6fb621ad41be45de5eb6e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Nov 2023 15:14:05 +0200 +Subject: drm/bridge: cdns-mhdp8546: Fix use of uninitialized variable + +From: Tomi Valkeinen + +[ Upstream commit 155d6fb61270dd297f128731cd155080deee8f3a ] + +'ret' could be uninitialized at the end of the function, although it's +not clear if that can happen in practice. + +Fixes: 6a3608eae6d3 ("drm: bridge: cdns-mhdp8546: Enable HDCP") +Acked-by: Maxime Ripard +Signed-off-by: Tomi Valkeinen +Link: https://patchwork.freedesktop.org/patch/msgid/20231103-uninit-fixes-v2-3-c22b2444f5f5@ideasonboard.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-hdcp.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-hdcp.c b/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-hdcp.c +index fccd6fbcc257..29c04012b701 100644 +--- a/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-hdcp.c ++++ b/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-hdcp.c +@@ -403,7 +403,8 @@ static int _cdns_mhdp_hdcp_disable(struct cdns_mhdp_device *mhdp) + + static int _cdns_mhdp_hdcp_enable(struct cdns_mhdp_device *mhdp, u8 content_type) + { +- int ret, tries = 3; ++ int ret = -EINVAL; ++ int tries = 3; + u32 i; + + for (i = 0; i < tries; i++) { +-- +2.43.0 + diff --git a/queue-5.15/drm-bridge-fix-typo-in-post_disable-description.patch b/queue-5.15/drm-bridge-fix-typo-in-post_disable-description.patch new file mode 100644 index 00000000000..6c5aa31dcef --- /dev/null +++ b/queue-5.15/drm-bridge-fix-typo-in-post_disable-description.patch @@ -0,0 +1,36 @@ +From 7278c2a248abfa162a023ce661177e691515f850 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Nov 2023 10:42:30 +0100 +Subject: drm/bridge: Fix typo in post_disable() description + +From: Dario Binacchi + +[ Upstream commit 288b039db225676e0c520c981a1b5a2562d893a3 ] + +s/singals/signals/ + +Fixes: 199e4e967af4 ("drm: Extract drm_bridge.h") +Signed-off-by: Dario Binacchi +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20231124094253.658064-1-dario.binacchi@amarulasolutions.com +Signed-off-by: Sasha Levin +--- + include/drm/drm_bridge.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/drm/drm_bridge.h b/include/drm/drm_bridge.h +index c84783cd5abd..3188b7a1d2c7 100644 +--- a/include/drm/drm_bridge.h ++++ b/include/drm/drm_bridge.h +@@ -191,7 +191,7 @@ struct drm_bridge_funcs { + * or &drm_encoder_helper_funcs.dpms hook. + * + * The bridge must assume that the display pipe (i.e. clocks and timing +- * singals) feeding it is no longer running when this callback is ++ * signals) feeding it is no longer running when this callback is + * called. + * + * The @post_disable callback is optional. +-- +2.43.0 + diff --git a/queue-5.15/drm-bridge-tc358767-fix-return-value-on-error-case.patch b/queue-5.15/drm-bridge-tc358767-fix-return-value-on-error-case.patch new file mode 100644 index 00000000000..30cf8927d41 --- /dev/null +++ b/queue-5.15/drm-bridge-tc358767-fix-return-value-on-error-case.patch @@ -0,0 +1,39 @@ +From c0f1172956ddd3bb72015ca6c90f48ad1b59776a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Nov 2023 15:14:06 +0200 +Subject: drm/bridge: tc358767: Fix return value on error case + +From: Tomi Valkeinen + +[ Upstream commit 32bd29b619638256c5b75fb021d6d9f12fc4a984 ] + +If the hpd_pin is invalid, the driver returns 'ret'. But 'ret' contains +0, instead of an error value. + +Return -EINVAL instead. + +Fixes: f25ee5017e4f ("drm/bridge: tc358767: add IRQ and HPD support") +Acked-by: Maxime Ripard +Signed-off-by: Tomi Valkeinen +Link: https://patchwork.freedesktop.org/patch/msgid/20231103-uninit-fixes-v2-4-c22b2444f5f5@ideasonboard.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/tc358767.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/bridge/tc358767.c b/drivers/gpu/drm/bridge/tc358767.c +index 14d671742963..4c6f3052156b 100644 +--- a/drivers/gpu/drm/bridge/tc358767.c ++++ b/drivers/gpu/drm/bridge/tc358767.c +@@ -1633,7 +1633,7 @@ static int tc_probe(struct i2c_client *client, const struct i2c_device_id *id) + } else { + if (tc->hpd_pin < 0 || tc->hpd_pin > 1) { + dev_err(dev, "failed to parse HPD number\n"); +- return ret; ++ return -EINVAL; + } + } + +-- +2.43.0 + diff --git a/queue-5.15/drm-bridge-tpd12s015-drop-buggy-__exit-annotation-fo.patch b/queue-5.15/drm-bridge-tpd12s015-drop-buggy-__exit-annotation-fo.patch new file mode 100644 index 00000000000..416139e482a --- /dev/null +++ b/queue-5.15/drm-bridge-tpd12s015-drop-buggy-__exit-annotation-fo.patch @@ -0,0 +1,52 @@ +From a3a0b1589354b51c4b4f42505d8f6a82f88740c6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Nov 2023 17:56:42 +0100 +Subject: drm/bridge: tpd12s015: Drop buggy __exit annotation for remove + function +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit ce3e112e7ae854249d8755906acc5f27e1542114 ] + +With tpd12s015_remove() marked with __exit this function is discarded +when the driver is compiled as a built-in. The result is that when the +driver unbinds there is no cleanup done which results in resource +leakage or worse. + +Fixes: cff5e6f7e83f ("drm/bridge: Add driver for the TI TPD12S015 HDMI level shifter") +Signed-off-by: Uwe Kleine-König +Signed-off-by: Thomas Zimmermann +Link: https://patchwork.freedesktop.org/patch/msgid/20231102165640.3307820-19-u.kleine-koenig@pengutronix.de +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/ti-tpd12s015.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/ti-tpd12s015.c b/drivers/gpu/drm/bridge/ti-tpd12s015.c +index e0e015243a60..b588fea12502 100644 +--- a/drivers/gpu/drm/bridge/ti-tpd12s015.c ++++ b/drivers/gpu/drm/bridge/ti-tpd12s015.c +@@ -179,7 +179,7 @@ static int tpd12s015_probe(struct platform_device *pdev) + return 0; + } + +-static int __exit tpd12s015_remove(struct platform_device *pdev) ++static int tpd12s015_remove(struct platform_device *pdev) + { + struct tpd12s015_device *tpd = platform_get_drvdata(pdev); + +@@ -197,7 +197,7 @@ MODULE_DEVICE_TABLE(of, tpd12s015_of_match); + + static struct platform_driver tpd12s015_driver = { + .probe = tpd12s015_probe, +- .remove = __exit_p(tpd12s015_remove), ++ .remove = tpd12s015_remove, + .driver = { + .name = "tpd12s015", + .of_match_table = tpd12s015_of_match, +-- +2.43.0 + diff --git a/queue-5.15/drm-drv-propagate-errors-from-drm_modeset_register_a.patch b/queue-5.15/drm-drv-propagate-errors-from-drm_modeset_register_a.patch new file mode 100644 index 00000000000..2fc4eef2abc --- /dev/null +++ b/queue-5.15/drm-drv-propagate-errors-from-drm_modeset_register_a.patch @@ -0,0 +1,54 @@ +From 36a51be70a11e249f9d8ede39d6d89d1bc48170c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 3 Dec 2023 01:55:52 +0300 +Subject: drm/drv: propagate errors from drm_modeset_register_all() + +From: Dmitry Baryshkov + +[ Upstream commit 5f8dec200923a76dc57187965fd59c1136f5d085 ] + +In case the drm_modeset_register_all() function fails, its error code +will be ignored. Instead make the drm_dev_register() bail out in case of +such an error. + +Fixes: 79190ea2658a ("drm: Add callbacks for late registering") +Reviewed-by: Neil Armstrong +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Maxime Ripard +Link: https://patchwork.freedesktop.org/patch/msgid/20231202225552.1283638-1-dmitry.baryshkov@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_drv.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c +index 6f1791613757..23409f1916ee 100644 +--- a/drivers/gpu/drm/drm_drv.c ++++ b/drivers/gpu/drm/drm_drv.c +@@ -894,8 +894,11 @@ int drm_dev_register(struct drm_device *dev, unsigned long flags) + goto err_minors; + } + +- if (drm_core_check_feature(dev, DRIVER_MODESET)) +- drm_modeset_register_all(dev); ++ if (drm_core_check_feature(dev, DRIVER_MODESET)) { ++ ret = drm_modeset_register_all(dev); ++ if (ret) ++ goto err_unload; ++ } + + DRM_INFO("Initialized %s %d.%d.%d %s for %s on minor %d\n", + driver->name, driver->major, driver->minor, +@@ -905,6 +908,9 @@ int drm_dev_register(struct drm_device *dev, unsigned long flags) + + goto out_unlock; + ++err_unload: ++ if (dev->driver->unload) ++ dev->driver->unload(dev); + err_minors: + remove_compat_control_link(dev); + drm_minor_unregister(dev, DRM_MINOR_PRIMARY); +-- +2.43.0 + diff --git a/queue-5.15/drm-msm-dsi-use-pm_runtime_resume_and_get-to-prevent.patch b/queue-5.15/drm-msm-dsi-use-pm_runtime_resume_and_get-to-prevent.patch new file mode 100644 index 00000000000..326300ec432 --- /dev/null +++ b/queue-5.15/drm-msm-dsi-use-pm_runtime_resume_and_get-to-prevent.patch @@ -0,0 +1,43 @@ +From 8db0561bd03dca481659d0d2670d0338c422dada Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jun 2023 13:43:20 +0200 +Subject: drm/msm/dsi: Use pm_runtime_resume_and_get to prevent refcnt leaks + +From: Konrad Dybcio + +[ Upstream commit 3d07a411b4faaf2b498760ccf12888f8de529de0 ] + +This helper has been introduced to avoid programmer errors (missing +_put calls leading to dangling refcnt) when using pm_runtime_get, use it. + +While at it, start checking the return value. + +Signed-off-by: Konrad Dybcio +Reviewed-by: Dmitry Baryshkov +Fixes: 5c8290284402 ("drm/msm/dsi: Split PHY drivers to separate files") +Patchwork: https://patchwork.freedesktop.org/patch/543350/ +Link: https://lore.kernel.org/r/20230620-topic-dsiphy_rpm-v2-1-a11a751f34f0@linaro.org +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/dsi/phy/dsi_phy.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/dsi/phy/dsi_phy.c b/drivers/gpu/drm/msm/dsi/phy/dsi_phy.c +index 6a917fe69a83..4b5b0a4b051b 100644 +--- a/drivers/gpu/drm/msm/dsi/phy/dsi_phy.c ++++ b/drivers/gpu/drm/msm/dsi/phy/dsi_phy.c +@@ -588,7 +588,9 @@ static int dsi_phy_enable_resource(struct msm_dsi_phy *phy) + struct device *dev = &phy->pdev->dev; + int ret; + +- pm_runtime_get_sync(dev); ++ ret = pm_runtime_resume_and_get(dev); ++ if (ret) ++ return ret; + + ret = clk_prepare_enable(phy->ahb_clk); + if (ret) { +-- +2.43.0 + diff --git a/queue-5.15/drm-msm-mdp4-flush-vblank-event-on-disable.patch b/queue-5.15/drm-msm-mdp4-flush-vblank-event-on-disable.patch new file mode 100644 index 00000000000..2e3b143c447 --- /dev/null +++ b/queue-5.15/drm-msm-mdp4-flush-vblank-event-on-disable.patch @@ -0,0 +1,53 @@ +From 3029a90bb28450455c9ed808741ca04c1df9b5ca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Nov 2023 00:54:01 +0300 +Subject: drm/msm/mdp4: flush vblank event on disable + +From: Dmitry Baryshkov + +[ Upstream commit c6721b3c6423d8a348ae885a0f4c85e14f9bf85c ] + +Flush queued events when disabling the crtc. This avoids timeouts when +we come back and wait for dependencies (like the previous frame's +flip_done). + +Fixes: c8afe684c95c ("drm/msm: basic KMS driver for snapdragon") +Signed-off-by: Dmitry Baryshkov +Reviewed-by: Abhinav Kumar +Patchwork: https://patchwork.freedesktop.org/patch/569127/ +Link: https://lore.kernel.org/r/20231127215401.4064128-1-dmitry.baryshkov@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/disp/mdp4/mdp4_crtc.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/drivers/gpu/drm/msm/disp/mdp4/mdp4_crtc.c b/drivers/gpu/drm/msm/disp/mdp4/mdp4_crtc.c +index 169f9de4a12a..3100957225a7 100644 +--- a/drivers/gpu/drm/msm/disp/mdp4/mdp4_crtc.c ++++ b/drivers/gpu/drm/msm/disp/mdp4/mdp4_crtc.c +@@ -269,6 +269,7 @@ static void mdp4_crtc_atomic_disable(struct drm_crtc *crtc, + { + struct mdp4_crtc *mdp4_crtc = to_mdp4_crtc(crtc); + struct mdp4_kms *mdp4_kms = get_kms(crtc); ++ unsigned long flags; + + DBG("%s", mdp4_crtc->name); + +@@ -281,6 +282,14 @@ static void mdp4_crtc_atomic_disable(struct drm_crtc *crtc, + mdp_irq_unregister(&mdp4_kms->base, &mdp4_crtc->err); + mdp4_disable(mdp4_kms); + ++ if (crtc->state->event && !crtc->state->active) { ++ WARN_ON(mdp4_crtc->event); ++ spin_lock_irqsave(&mdp4_kms->dev->event_lock, flags); ++ drm_crtc_send_vblank_event(crtc, crtc->state->event); ++ crtc->state->event = NULL; ++ spin_unlock_irqrestore(&mdp4_kms->dev->event_lock, flags); ++ } ++ + mdp4_crtc->enabled = false; + } + +-- +2.43.0 + diff --git a/queue-5.15/drm-nouveau-fence-fix-warning-directly-dereferencing.patch b/queue-5.15/drm-nouveau-fence-fix-warning-directly-dereferencing.patch new file mode 100644 index 00000000000..65bf9ac4931 --- /dev/null +++ b/queue-5.15/drm-nouveau-fence-fix-warning-directly-dereferencing.patch @@ -0,0 +1,58 @@ +From 1d39e52ab0a62a0205bbbb60aeda7b1fbe119ecc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Nov 2023 00:43:03 +0530 +Subject: drm/nouveau/fence:: fix warning directly dereferencing a rcu pointer + +From: Abhinav Singh + +[ Upstream commit 5f35a624c1e30b5bae5023b3c256e94e0ad4f806 ] + +Fix a sparse warning with this message +"warning:dereference of noderef expression". In this context it means we +are dereferencing a __rcu tagged pointer directly. + +We should not be directly dereferencing a rcu pointer. To get a normal +(non __rcu tagged pointer) from a __rcu tagged pointer we are using the +function unrcu_pointer(...). The non __rcu tagged pointer then can be +dereferenced just like a normal pointer. + +I tested with qemu with this command +qemu-system-x86_64 \ + -m 2G \ + -smp 2 \ + -kernel bzImage \ + -append "console=ttyS0 root=/dev/sda earlyprintk=serial net.ifnames=0" \ + -drive file=bullseye.img,format=raw \ + -net user,host=10.0.2.10,hostfwd=tcp:127.0.0.1:10021-:22 \ + -net nic,model=e1000 \ + -enable-kvm \ + -nographic \ + -pidfile vm.pid \ + 2>&1 | tee vm.log +with lockdep enabled. + +Fixes: 0ec5f02f0e2c ("drm/nouveau: prevent stale fence->channel pointers, and protect with rcu") +Signed-off-by: Abhinav Singh +Signed-off-by: Danilo Krummrich +Link: https://patchwork.freedesktop.org/patch/msgid/20231113191303.3277733-1-singhabhinav9051571833@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/nouveau/nv04_fence.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/nouveau/nv04_fence.c b/drivers/gpu/drm/nouveau/nv04_fence.c +index 5b71a5a5cd85..cdbc75e3d1f6 100644 +--- a/drivers/gpu/drm/nouveau/nv04_fence.c ++++ b/drivers/gpu/drm/nouveau/nv04_fence.c +@@ -39,7 +39,7 @@ struct nv04_fence_priv { + static int + nv04_fence_emit(struct nouveau_fence *fence) + { +- struct nvif_push *push = fence->channel->chan.push; ++ struct nvif_push *push = unrcu_pointer(fence->channel)->chan.push; + int ret = PUSH_WAIT(push, 2); + if (ret == 0) { + PUSH_NVSQ(push, NV_SW, 0x0150, fence->base.seqno); +-- +2.43.0 + diff --git a/queue-5.15/drm-panel-elida-kd35t133-hold-panel-in-reset-for-unp.patch b/queue-5.15/drm-panel-elida-kd35t133-hold-panel-in-reset-for-unp.patch new file mode 100644 index 00000000000..c439fb74ce2 --- /dev/null +++ b/queue-5.15/drm-panel-elida-kd35t133-hold-panel-in-reset-for-unp.patch @@ -0,0 +1,42 @@ +From 50bc051de8b03d1d2dcdd13fdd62fa6b2fb2e90e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Nov 2023 13:44:02 -0600 +Subject: drm/panel-elida-kd35t133: hold panel in reset for unprepare + +From: Chris Morgan + +[ Upstream commit 03c5b2a5f6c39fe4e090346536cf1c14ee18b61e ] + +For devices like the Anbernic RG351M and RG351P the panel is wired to +an always on regulator. When the device suspends and wakes up, there +are some slight artifacts on the screen that go away over time. If +instead we hold the panel in reset status after it is unprepared, +this does not happen. + +Fixes: 5b6603360c12 ("drm/panel: add panel driver for Elida KD35T133 panels") +Signed-off-by: Chris Morgan +Reviewed-by: Jessica Zhang +Link: https://lore.kernel.org/r/20231117194405.1386265-3-macroalpha82@gmail.com +Signed-off-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/20231117194405.1386265-3-macroalpha82@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panel/panel-elida-kd35t133.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/panel/panel-elida-kd35t133.c b/drivers/gpu/drm/panel/panel-elida-kd35t133.c +index 80227617a4d6..ccb7d521f30a 100644 +--- a/drivers/gpu/drm/panel/panel-elida-kd35t133.c ++++ b/drivers/gpu/drm/panel/panel-elida-kd35t133.c +@@ -112,6 +112,8 @@ static int kd35t133_unprepare(struct drm_panel *panel) + return ret; + } + ++ gpiod_set_value_cansleep(ctx->reset_gpio, 1); ++ + regulator_disable(ctx->iovcc); + regulator_disable(ctx->vdd); + +-- +2.43.0 + diff --git a/queue-5.15/drm-radeon-check-return-value-of-radeon_ring_lock.patch b/queue-5.15/drm-radeon-check-return-value-of-radeon_ring_lock.patch new file mode 100644 index 00000000000..7d1015620b1 --- /dev/null +++ b/queue-5.15/drm-radeon-check-return-value-of-radeon_ring_lock.patch @@ -0,0 +1,42 @@ +From 89489769292dd49c30c1b5666c7093666d9d25a7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Aug 2023 11:04:16 -0700 +Subject: drm/radeon: check return value of radeon_ring_lock() + +From: Nikita Zhandarovich + +[ Upstream commit 71225e1c930942cb1e042fc08c5cc0c4ef30e95e ] + +In the unlikely event of radeon_ring_lock() failing, its errno return +value should be processed. This patch checks said return value and +prints a debug message in case of an error. + +Found by Linux Verification Center (linuxtesting.org) with static +analysis tool SVACE. + +Fixes: 48c0c902e2e6 ("drm/radeon/kms: add support for CP setup on SI") +Signed-off-by: Nikita Zhandarovich +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/radeon/si.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c +index 4679b798a038..e4481e5a15e1 100644 +--- a/drivers/gpu/drm/radeon/si.c ++++ b/drivers/gpu/drm/radeon/si.c +@@ -3611,6 +3611,10 @@ static int si_cp_start(struct radeon_device *rdev) + for (i = RADEON_RING_TYPE_GFX_INDEX; i <= CAYMAN_RING_TYPE_CP2_INDEX; ++i) { + ring = &rdev->ring[i]; + r = radeon_ring_lock(rdev, ring, 2); ++ if (r) { ++ DRM_ERROR("radeon: cp failed to lock ring (%d).\n", r); ++ return r; ++ } + + /* clear the compute context state */ + radeon_ring_write(ring, PACKET3_COMPUTE(PACKET3_CLEAR_STATE, 0)); +-- +2.43.0 + diff --git a/queue-5.15/drm-radeon-check-the-alloc_workqueue-return-value-in.patch b/queue-5.15/drm-radeon-check-the-alloc_workqueue-return-value-in.patch new file mode 100644 index 00000000000..fc8a5263122 --- /dev/null +++ b/queue-5.15/drm-radeon-check-the-alloc_workqueue-return-value-in.patch @@ -0,0 +1,46 @@ +From 598727e115e76bf6dd2485f43dc1a52ebeed3126 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Nov 2023 15:50:16 +0800 +Subject: drm/radeon: check the alloc_workqueue return value in + radeon_crtc_init() + +From: Yang Yingliang + +[ Upstream commit 7a2464fac80d42f6f8819fed97a553e9c2f43310 ] + +check the alloc_workqueue return value in radeon_crtc_init() +to avoid null-ptr-deref. + +Fixes: fa7f517cb26e ("drm/radeon: rework page flip handling v4") +Signed-off-by: Yang Yingliang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/radeon/radeon_display.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c +index 573154268d43..6337fad441df 100644 +--- a/drivers/gpu/drm/radeon/radeon_display.c ++++ b/drivers/gpu/drm/radeon/radeon_display.c +@@ -681,11 +681,16 @@ static void radeon_crtc_init(struct drm_device *dev, int index) + if (radeon_crtc == NULL) + return; + ++ radeon_crtc->flip_queue = alloc_workqueue("radeon-crtc", WQ_HIGHPRI, 0); ++ if (!radeon_crtc->flip_queue) { ++ kfree(radeon_crtc); ++ return; ++ } ++ + drm_crtc_init(dev, &radeon_crtc->base, &radeon_crtc_funcs); + + drm_mode_crtc_set_gamma_size(&radeon_crtc->base, 256); + radeon_crtc->crtc_id = index; +- radeon_crtc->flip_queue = alloc_workqueue("radeon-crtc", WQ_HIGHPRI, 0); + rdev->mode_info.crtcs[index] = radeon_crtc; + + if (rdev->family >= CHIP_BONAIRE) { +-- +2.43.0 + diff --git a/queue-5.15/drm-radeon-dpm-fix-a-memleak-in-sumo_parse_power_tab.patch b/queue-5.15/drm-radeon-dpm-fix-a-memleak-in-sumo_parse_power_tab.patch new file mode 100644 index 00000000000..31cfdedd166 --- /dev/null +++ b/queue-5.15/drm-radeon-dpm-fix-a-memleak-in-sumo_parse_power_tab.patch @@ -0,0 +1,41 @@ +From 8ea1568b0dfcb9f3b4d0aad035224ccca573cc8c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Dec 2023 16:57:56 +0800 +Subject: drm/radeon/dpm: fix a memleak in sumo_parse_power_table + +From: Zhipeng Lu + +[ Upstream commit 0737df9ed0997f5b8addd6e2b9699a8c6edba2e4 ] + +The rdev->pm.dpm.ps allocated by kcalloc should be freed in every +following error-handling path. However, in the error-handling of +rdev->pm.power_state[i].clock_info the rdev->pm.dpm.ps is not freed, +resulting in a memleak in this function. + +Fixes: 80ea2c129c76 ("drm/radeon/kms: add dpm support for sumo asics (v2)") +Signed-off-by: Zhipeng Lu +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/radeon/sumo_dpm.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/radeon/sumo_dpm.c b/drivers/gpu/drm/radeon/sumo_dpm.c +index f74f381af05f..d49c145db437 100644 +--- a/drivers/gpu/drm/radeon/sumo_dpm.c ++++ b/drivers/gpu/drm/radeon/sumo_dpm.c +@@ -1493,8 +1493,10 @@ static int sumo_parse_power_table(struct radeon_device *rdev) + non_clock_array_index = power_state->v2.nonClockInfoIndex; + non_clock_info = (struct _ATOM_PPLIB_NONCLOCK_INFO *) + &non_clock_info_array->nonClockInfo[non_clock_array_index]; +- if (!rdev->pm.power_state[i].clock_info) ++ if (!rdev->pm.power_state[i].clock_info) { ++ kfree(rdev->pm.dpm.ps); + return -EINVAL; ++ } + ps = kzalloc(sizeof(struct sumo_ps), GFP_KERNEL); + if (ps == NULL) { + kfree(rdev->pm.dpm.ps); +-- +2.43.0 + diff --git a/queue-5.15/drm-radeon-r100-fix-integer-overflow-issues-in-r100_.patch b/queue-5.15/drm-radeon-r100-fix-integer-overflow-issues-in-r100_.patch new file mode 100644 index 00000000000..bc097297526 --- /dev/null +++ b/queue-5.15/drm-radeon-r100-fix-integer-overflow-issues-in-r100_.patch @@ -0,0 +1,52 @@ +From 1164abeb2f9cf0f67f7b656cdc5e87404015845b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Nov 2023 07:22:12 -0800 +Subject: drm/radeon/r100: Fix integer overflow issues in r100_cs_track_check() + +From: Nikita Zhandarovich + +[ Upstream commit b5c5baa458faa5430c445acd9a17481274d77ccf ] + +It may be possible, albeit unlikely, to encounter integer overflow +during the multiplication of several unsigned int variables, the +result being assigned to a variable 'size' of wider type. + +Prevent this potential behaviour by converting one of the multiples +to unsigned long. + +Found by Linux Verification Center (linuxtesting.org) with static +analysis tool SVACE. + +Fixes: 0242f74d29df ("drm/radeon: clean up CS functions in r100.c") +Signed-off-by: Nikita Zhandarovich +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/radeon/r100.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c +index 2dd85ba1faa2..d3ad98bd2590 100644 +--- a/drivers/gpu/drm/radeon/r100.c ++++ b/drivers/gpu/drm/radeon/r100.c +@@ -2320,7 +2320,7 @@ int r100_cs_track_check(struct radeon_device *rdev, struct r100_cs_track *track) + switch (prim_walk) { + case 1: + for (i = 0; i < track->num_arrays; i++) { +- size = track->arrays[i].esize * track->max_indx * 4; ++ size = track->arrays[i].esize * track->max_indx * 4UL; + if (track->arrays[i].robj == NULL) { + DRM_ERROR("(PW %u) Vertex array %u no buffer " + "bound\n", prim_walk, i); +@@ -2339,7 +2339,7 @@ int r100_cs_track_check(struct radeon_device *rdev, struct r100_cs_track *track) + break; + case 2: + for (i = 0; i < track->num_arrays; i++) { +- size = track->arrays[i].esize * (nverts - 1) * 4; ++ size = track->arrays[i].esize * (nverts - 1) * 4UL; + if (track->arrays[i].robj == NULL) { + DRM_ERROR("(PW %u) Vertex array %u no buffer " + "bound\n", prim_walk, i); +-- +2.43.0 + diff --git a/queue-5.15/drm-radeon-r600_cs-fix-possible-int-overflows-in-r60.patch b/queue-5.15/drm-radeon-r600_cs-fix-possible-int-overflows-in-r60.patch new file mode 100644 index 00000000000..0ebb7d6d2cf --- /dev/null +++ b/queue-5.15/drm-radeon-r600_cs-fix-possible-int-overflows-in-r60.patch @@ -0,0 +1,51 @@ +From 5dcbf1fdb7205f858984ff732af9d8560673065a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Nov 2023 07:22:30 -0800 +Subject: drm/radeon/r600_cs: Fix possible int overflows in r600_cs_check_reg() + +From: Nikita Zhandarovich + +[ Upstream commit 39c960bbf9d9ea862398759e75736cfb68c3446f ] + +While improbable, there may be a chance of hitting integer +overflow when the result of radeon_get_ib_value() gets shifted +left. + +Avoid it by casting one of the operands to larger data type (u64). + +Found by Linux Verification Center (linuxtesting.org) with static +analysis tool SVACE. + +Fixes: 1729dd33d20b ("drm/radeon/kms: r600 CS parser fixes") +Signed-off-by: Nikita Zhandarovich +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/radeon/r600_cs.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/radeon/r600_cs.c b/drivers/gpu/drm/radeon/r600_cs.c +index 8be4799a98ef..6ade5dd470d5 100644 +--- a/drivers/gpu/drm/radeon/r600_cs.c ++++ b/drivers/gpu/drm/radeon/r600_cs.c +@@ -1277,7 +1277,7 @@ static int r600_cs_check_reg(struct radeon_cs_parser *p, u32 reg, u32 idx) + return -EINVAL; + } + tmp = (reg - CB_COLOR0_BASE) / 4; +- track->cb_color_bo_offset[tmp] = radeon_get_ib_value(p, idx) << 8; ++ track->cb_color_bo_offset[tmp] = (u64)radeon_get_ib_value(p, idx) << 8; + ib[idx] += (u32)((reloc->gpu_offset >> 8) & 0xffffffff); + track->cb_color_base_last[tmp] = ib[idx]; + track->cb_color_bo[tmp] = reloc->robj; +@@ -1304,7 +1304,7 @@ static int r600_cs_check_reg(struct radeon_cs_parser *p, u32 reg, u32 idx) + "0x%04X\n", reg); + return -EINVAL; + } +- track->htile_offset = radeon_get_ib_value(p, idx) << 8; ++ track->htile_offset = (u64)radeon_get_ib_value(p, idx) << 8; + ib[idx] += (u32)((reloc->gpu_offset >> 8) & 0xffffffff); + track->htile_bo = reloc->robj; + track->db_dirty = true; +-- +2.43.0 + diff --git a/queue-5.15/drm-radeon-trinity_dpm-fix-a-memleak-in-trinity_pars.patch b/queue-5.15/drm-radeon-trinity_dpm-fix-a-memleak-in-trinity_pars.patch new file mode 100644 index 00000000000..74504945235 --- /dev/null +++ b/queue-5.15/drm-radeon-trinity_dpm-fix-a-memleak-in-trinity_pars.patch @@ -0,0 +1,41 @@ +From 5394c6e6605f750e62d05be82416947c4565f532 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Dec 2023 18:21:54 +0800 +Subject: drm/radeon/trinity_dpm: fix a memleak in trinity_parse_power_table + +From: Zhipeng Lu + +[ Upstream commit 28c28d7f77c06ac2c0b8f9c82bc04eba22912b3b ] + +The rdev->pm.dpm.ps allocated by kcalloc should be freed in every +following error-handling path. However, in the error-handling of +rdev->pm.power_state[i].clock_info the rdev->pm.dpm.ps is not freed, +resulting in a memleak in this function. + +Fixes: d70229f70447 ("drm/radeon/kms: add dpm support for trinity asics") +Signed-off-by: Zhipeng Lu +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/radeon/trinity_dpm.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/radeon/trinity_dpm.c b/drivers/gpu/drm/radeon/trinity_dpm.c +index 08ea1c864cb2..ef1cc7bad20a 100644 +--- a/drivers/gpu/drm/radeon/trinity_dpm.c ++++ b/drivers/gpu/drm/radeon/trinity_dpm.c +@@ -1726,8 +1726,10 @@ static int trinity_parse_power_table(struct radeon_device *rdev) + non_clock_array_index = power_state->v2.nonClockInfoIndex; + non_clock_info = (struct _ATOM_PPLIB_NONCLOCK_INFO *) + &non_clock_info_array->nonClockInfo[non_clock_array_index]; +- if (!rdev->pm.power_state[i].clock_info) ++ if (!rdev->pm.power_state[i].clock_info) { ++ kfree(rdev->pm.dpm.ps); + return -EINVAL; ++ } + ps = kzalloc(sizeof(struct sumo_ps), GFP_KERNEL); + if (ps == NULL) { + kfree(rdev->pm.dpm.ps); +-- +2.43.0 + diff --git a/queue-5.15/drm-tilcdc-fix-irq-free-on-unload.patch b/queue-5.15/drm-tilcdc-fix-irq-free-on-unload.patch new file mode 100644 index 00000000000..3ab15f9b97e --- /dev/null +++ b/queue-5.15/drm-tilcdc-fix-irq-free-on-unload.patch @@ -0,0 +1,40 @@ +From 6155e7014e357a5db0391148183a4ab936f8935d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Sep 2023 10:12:50 +0300 +Subject: drm/tilcdc: Fix irq free on unload + +From: Tomi Valkeinen + +[ Upstream commit 38360bf96d816e175bc602c4ee76953cd303b71d ] + +The driver only frees the reserved irq if priv->irq_enabled is set to +true. However, the driver mistakenly sets priv->irq_enabled to false, +instead of true, in tilcdc_irq_install(), and thus the driver never +frees the irq, causing issues on loading the driver a second time. + +Fixes: b6366814fa77 ("drm/tilcdc: Convert to Linux IRQ interfaces") +Cc: Thomas Zimmermann +Reviewed-by: Aradhya Bhatia +Signed-off-by: Tomi Valkeinen +Link: https://patchwork.freedesktop.org/patch/msgid/20230919-lcdc-v1-1-ba60da7421e1@ideasonboard.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/tilcdc/tilcdc_drv.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/tilcdc/tilcdc_drv.c b/drivers/gpu/drm/tilcdc/tilcdc_drv.c +index 6b03f89a98d4..6924488274dd 100644 +--- a/drivers/gpu/drm/tilcdc/tilcdc_drv.c ++++ b/drivers/gpu/drm/tilcdc/tilcdc_drv.c +@@ -140,7 +140,7 @@ static int tilcdc_irq_install(struct drm_device *dev, unsigned int irq) + if (ret) + return ret; + +- priv->irq_enabled = false; ++ priv->irq_enabled = true; + + return 0; + } +-- +2.43.0 + diff --git a/queue-5.15/dt-bindings-clock-update-the-videocc-resets-for-sm81.patch b/queue-5.15/dt-bindings-clock-update-the-videocc-resets-for-sm81.patch new file mode 100644 index 00000000000..c580e234255 --- /dev/null +++ b/queue-5.15/dt-bindings-clock-update-the-videocc-resets-for-sm81.patch @@ -0,0 +1,40 @@ +From 2a6494a47e9eeaeba392ece66c932bd5dc266629 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Dec 2023 15:20:24 +0530 +Subject: dt-bindings: clock: Update the videocc resets for sm8150 + +From: Satya Priya Kakitapalli + +[ Upstream commit 3185f96968eedd117ec72ee7b87ead44b6d1bbbd ] + +Add all the available resets for the video clock controller +on sm8150. + +Signed-off-by: Satya Priya Kakitapalli +Acked-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20231201-videocc-8150-v3-1-56bec3a5e443@quicinc.com +Signed-off-by: Bjorn Andersson +Stable-dep-of: 1fd9a939db24 ("clk: qcom: videocc-sm8150: Update the videocc resets") +Signed-off-by: Sasha Levin +--- + include/dt-bindings/clock/qcom,videocc-sm8150.h | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/include/dt-bindings/clock/qcom,videocc-sm8150.h b/include/dt-bindings/clock/qcom,videocc-sm8150.h +index e24ee840cfdb..c557b78dc572 100644 +--- a/include/dt-bindings/clock/qcom,videocc-sm8150.h ++++ b/include/dt-bindings/clock/qcom,videocc-sm8150.h +@@ -16,6 +16,10 @@ + + /* VIDEO_CC Resets */ + #define VIDEO_CC_MVSC_CORE_CLK_BCR 0 ++#define VIDEO_CC_INTERFACE_BCR 1 ++#define VIDEO_CC_MVS0_BCR 2 ++#define VIDEO_CC_MVS1_BCR 3 ++#define VIDEO_CC_MVSC_BCR 4 + + /* VIDEO_CC GDSCRs */ + #define VENUS_GDSC 0 +-- +2.43.0 + diff --git a/queue-5.15/edac-thunderx-fix-possible-out-of-bounds-string-acce.patch b/queue-5.15/edac-thunderx-fix-possible-out-of-bounds-string-acce.patch new file mode 100644 index 00000000000..2ed4dd98e92 --- /dev/null +++ b/queue-5.15/edac-thunderx-fix-possible-out-of-bounds-string-acce.patch @@ -0,0 +1,91 @@ +From fd34e87d9e8e7c5419539b39f3e988cea2f22abc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Nov 2023 23:19:53 +0100 +Subject: EDAC/thunderx: Fix possible out-of-bounds string access + +From: Arnd Bergmann + +[ Upstream commit 475c58e1a471e9b873e3e39958c64a2d278275c8 ] + +Enabling -Wstringop-overflow globally exposes a warning for a common bug +in the usage of strncat(): + + drivers/edac/thunderx_edac.c: In function 'thunderx_ocx_com_threaded_isr': + drivers/edac/thunderx_edac.c:1136:17: error: 'strncat' specified bound 1024 equals destination size [-Werror=stringop-overflow=] + 1136 | strncat(msg, other, OCX_MESSAGE_SIZE); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + ... + 1145 | strncat(msg, other, OCX_MESSAGE_SIZE); + ... + 1150 | strncat(msg, other, OCX_MESSAGE_SIZE); + + ... + +Apparently the author of this driver expected strncat() to behave the +way that strlcat() does, which uses the size of the destination buffer +as its third argument rather than the length of the source buffer. The +result is that there is no check on the size of the allocated buffer. + +Change it to strlcat(). + + [ bp: Trim compiler output, fixup commit message. ] + +Fixes: 41003396f932 ("EDAC, thunderx: Add Cavium ThunderX EDAC driver") +Signed-off-by: Arnd Bergmann +Signed-off-by: Borislav Petkov (AMD) +Reviewed-by: Gustavo A. R. Silva +Link: https://lore.kernel.org/r/20231122222007.3199885-1-arnd@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/edac/thunderx_edac.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/edac/thunderx_edac.c b/drivers/edac/thunderx_edac.c +index f13674081cb6..4dca21b39bf7 100644 +--- a/drivers/edac/thunderx_edac.c ++++ b/drivers/edac/thunderx_edac.c +@@ -1133,7 +1133,7 @@ static irqreturn_t thunderx_ocx_com_threaded_isr(int irq, void *irq_id) + decode_register(other, OCX_OTHER_SIZE, + ocx_com_errors, ctx->reg_com_int); + +- strncat(msg, other, OCX_MESSAGE_SIZE); ++ strlcat(msg, other, OCX_MESSAGE_SIZE); + + for (lane = 0; lane < OCX_RX_LANES; lane++) + if (ctx->reg_com_int & BIT(lane)) { +@@ -1142,12 +1142,12 @@ static irqreturn_t thunderx_ocx_com_threaded_isr(int irq, void *irq_id) + lane, ctx->reg_lane_int[lane], + lane, ctx->reg_lane_stat11[lane]); + +- strncat(msg, other, OCX_MESSAGE_SIZE); ++ strlcat(msg, other, OCX_MESSAGE_SIZE); + + decode_register(other, OCX_OTHER_SIZE, + ocx_lane_errors, + ctx->reg_lane_int[lane]); +- strncat(msg, other, OCX_MESSAGE_SIZE); ++ strlcat(msg, other, OCX_MESSAGE_SIZE); + } + + if (ctx->reg_com_int & OCX_COM_INT_CE) +@@ -1217,7 +1217,7 @@ static irqreturn_t thunderx_ocx_lnk_threaded_isr(int irq, void *irq_id) + decode_register(other, OCX_OTHER_SIZE, + ocx_com_link_errors, ctx->reg_com_link_int); + +- strncat(msg, other, OCX_MESSAGE_SIZE); ++ strlcat(msg, other, OCX_MESSAGE_SIZE); + + if (ctx->reg_com_link_int & OCX_COM_LINK_INT_UE) + edac_device_handle_ue(ocx->edac_dev, 0, 0, msg); +@@ -1896,7 +1896,7 @@ static irqreturn_t thunderx_l2c_threaded_isr(int irq, void *irq_id) + + decode_register(other, L2C_OTHER_SIZE, l2_errors, ctx->reg_int); + +- strncat(msg, other, L2C_MESSAGE_SIZE); ++ strlcat(msg, other, L2C_MESSAGE_SIZE); + + if (ctx->reg_int & mask_ue) + edac_device_handle_ue(l2c->edac_dev, 0, 0, msg); +-- +2.43.0 + diff --git a/queue-5.15/efivarfs-force-ro-when-remounting-if-setvariable-is-.patch b/queue-5.15/efivarfs-force-ro-when-remounting-if-setvariable-is-.patch new file mode 100644 index 00000000000..e545bc6f0ad --- /dev/null +++ b/queue-5.15/efivarfs-force-ro-when-remounting-if-setvariable-is-.patch @@ -0,0 +1,108 @@ +From 2c8cc68d200e0885197c78e50941538c34733761 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Nov 2023 14:40:56 +0900 +Subject: efivarfs: force RO when remounting if SetVariable is not supported + +From: Ilias Apalodimas + +[ Upstream commit 0e8d2444168dd519fea501599d150e62718ed2fe ] + +If SetVariable at runtime is not supported by the firmware we never assign +a callback for that function. At the same time mount the efivarfs as +RO so no one can call that. However, we never check the permission flags +when someone remounts the filesystem as RW. As a result this leads to a +crash looking like this: + +$ mount -o remount,rw /sys/firmware/efi/efivars +$ efi-updatevar -f PK.auth PK + +[ 303.279166] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 +[ 303.280482] Mem abort info: +[ 303.280854] ESR = 0x0000000086000004 +[ 303.281338] EC = 0x21: IABT (current EL), IL = 32 bits +[ 303.282016] SET = 0, FnV = 0 +[ 303.282414] EA = 0, S1PTW = 0 +[ 303.282821] FSC = 0x04: level 0 translation fault +[ 303.283771] user pgtable: 4k pages, 48-bit VAs, pgdp=000000004258c000 +[ 303.284913] [0000000000000000] pgd=0000000000000000, p4d=0000000000000000 +[ 303.286076] Internal error: Oops: 0000000086000004 [#1] PREEMPT SMP +[ 303.286936] Modules linked in: qrtr tpm_tis tpm_tis_core crct10dif_ce arm_smccc_trng rng_core drm fuse ip_tables x_tables ipv6 +[ 303.288586] CPU: 1 PID: 755 Comm: efi-updatevar Not tainted 6.3.0-rc1-00108-gc7d0c4695c68 #1 +[ 303.289748] Hardware name: Unknown Unknown Product/Unknown Product, BIOS 2023.04-00627-g88336918701d 04/01/2023 +[ 303.291150] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) +[ 303.292123] pc : 0x0 +[ 303.292443] lr : efivar_set_variable_locked+0x74/0xec +[ 303.293156] sp : ffff800008673c10 +[ 303.293619] x29: ffff800008673c10 x28: ffff0000037e8000 x27: 0000000000000000 +[ 303.294592] x26: 0000000000000800 x25: ffff000002467400 x24: 0000000000000027 +[ 303.295572] x23: ffffd49ea9832000 x22: ffff0000020c9800 x21: ffff000002467000 +[ 303.296566] x20: 0000000000000001 x19: 00000000000007fc x18: 0000000000000000 +[ 303.297531] x17: 0000000000000000 x16: 0000000000000000 x15: 0000aaaac807ab54 +[ 303.298495] x14: ed37489f673633c0 x13: 71c45c606de13f80 x12: 47464259e219acf4 +[ 303.299453] x11: ffff000002af7b01 x10: 0000000000000003 x9 : 0000000000000002 +[ 303.300431] x8 : 0000000000000010 x7 : ffffd49ea8973230 x6 : 0000000000a85201 +[ 303.301412] x5 : 0000000000000000 x4 : ffff0000020c9800 x3 : 00000000000007fc +[ 303.302370] x2 : 0000000000000027 x1 : ffff000002467400 x0 : ffff000002467000 +[ 303.303341] Call trace: +[ 303.303679] 0x0 +[ 303.303938] efivar_entry_set_get_size+0x98/0x16c +[ 303.304585] efivarfs_file_write+0xd0/0x1a4 +[ 303.305148] vfs_write+0xc4/0x2e4 +[ 303.305601] ksys_write+0x70/0x104 +[ 303.306073] __arm64_sys_write+0x1c/0x28 +[ 303.306622] invoke_syscall+0x48/0x114 +[ 303.307156] el0_svc_common.constprop.0+0x44/0xec +[ 303.307803] do_el0_svc+0x38/0x98 +[ 303.308268] el0_svc+0x2c/0x84 +[ 303.308702] el0t_64_sync_handler+0xf4/0x120 +[ 303.309293] el0t_64_sync+0x190/0x194 +[ 303.309794] Code: ???????? ???????? ???????? ???????? (????????) +[ 303.310612] ---[ end trace 0000000000000000 ]--- + +Fix this by adding a .reconfigure() function to the fs operations which +we can use to check the requested flags and deny anything that's not RO +if the firmware doesn't implement SetVariable at runtime. + +Fixes: f88814cc2578 ("efi/efivars: Expose RT service availability via efivars abstraction") +Signed-off-by: Ilias Apalodimas +Signed-off-by: Ard Biesheuvel +Signed-off-by: Sasha Levin +--- + fs/efivarfs/super.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/fs/efivarfs/super.c b/fs/efivarfs/super.c +index 15880a68faad..3626816b174a 100644 +--- a/fs/efivarfs/super.c ++++ b/fs/efivarfs/super.c +@@ -13,6 +13,7 @@ + #include + #include + #include ++#include + + #include "internal.h" + +@@ -231,8 +232,19 @@ static int efivarfs_get_tree(struct fs_context *fc) + return get_tree_single(fc, efivarfs_fill_super); + } + ++static int efivarfs_reconfigure(struct fs_context *fc) ++{ ++ if (!efivar_supports_writes() && !(fc->sb_flags & SB_RDONLY)) { ++ pr_err("Firmware does not support SetVariableRT. Can not remount with rw\n"); ++ return -EINVAL; ++ } ++ ++ return 0; ++} ++ + static const struct fs_context_operations efivarfs_context_ops = { + .get_tree = efivarfs_get_tree, ++ .reconfigure = efivarfs_reconfigure, + }; + + static int efivarfs_init_fs_context(struct fs_context *fc) +-- +2.43.0 + diff --git a/queue-5.15/f2fs-fix-the-f2fs_file_write_iter-tracepoint.patch b/queue-5.15/f2fs-fix-the-f2fs_file_write_iter-tracepoint.patch new file mode 100644 index 00000000000..3ab29eae411 --- /dev/null +++ b/queue-5.15/f2fs-fix-the-f2fs_file_write_iter-tracepoint.patch @@ -0,0 +1,86 @@ +From 7d2b90db2cc3a3785e631d7cc38dca8a04ec89e9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Jul 2021 09:39:15 -0500 +Subject: f2fs: fix the f2fs_file_write_iter tracepoint + +From: Eric Biggers + +[ Upstream commit ccf7cf92373d1a53166582013430b3b9c05a6ba2 ] + +Pass in the original position and count rather than the position and +count that were updated by the write. Also use the correct types for +all arguments, in particular the file offset which was being truncated +to 32 bits on 32-bit platforms. + +Signed-off-by: Eric Biggers +Reviewed-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Stable-dep-of: bb34cc6ca87f ("f2fs: fix to update iostat correctly in f2fs_filemap_fault()") +Signed-off-by: Sasha Levin +--- + fs/f2fs/file.c | 5 +++-- + include/trace/events/f2fs.h | 12 ++++++------ + 2 files changed, 9 insertions(+), 8 deletions(-) + +diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c +index 533ab259ce01..d220c4523982 100644 +--- a/fs/f2fs/file.c ++++ b/fs/f2fs/file.c +@@ -4255,6 +4255,8 @@ static ssize_t f2fs_file_write_iter(struct kiocb *iocb, struct iov_iter *from) + { + struct file *file = iocb->ki_filp; + struct inode *inode = file_inode(file); ++ const loff_t orig_pos = iocb->ki_pos; ++ const size_t orig_count = iov_iter_count(from); + ssize_t ret; + + if (unlikely(f2fs_cp_error(F2FS_I_SB(inode)))) { +@@ -4358,8 +4360,7 @@ static ssize_t f2fs_file_write_iter(struct kiocb *iocb, struct iov_iter *from) + unlock: + inode_unlock(inode); + out: +- trace_f2fs_file_write_iter(inode, iocb->ki_pos, +- iov_iter_count(from), ret); ++ trace_f2fs_file_write_iter(inode, orig_pos, orig_count, ret); + if (ret > 0) + ret = generic_write_sync(iocb, ret); + return ret; +diff --git a/include/trace/events/f2fs.h b/include/trace/events/f2fs.h +index f5dcf7c9b707..6033eaddcb74 100644 +--- a/include/trace/events/f2fs.h ++++ b/include/trace/events/f2fs.h +@@ -540,17 +540,17 @@ TRACE_EVENT(f2fs_truncate_partial_nodes, + + TRACE_EVENT(f2fs_file_write_iter, + +- TP_PROTO(struct inode *inode, unsigned long offset, +- unsigned long length, int ret), ++ TP_PROTO(struct inode *inode, loff_t offset, size_t length, ++ ssize_t ret), + + TP_ARGS(inode, offset, length, ret), + + TP_STRUCT__entry( + __field(dev_t, dev) + __field(ino_t, ino) +- __field(unsigned long, offset) +- __field(unsigned long, length) +- __field(int, ret) ++ __field(loff_t, offset) ++ __field(size_t, length) ++ __field(ssize_t, ret) + ), + + TP_fast_assign( +@@ -562,7 +562,7 @@ TRACE_EVENT(f2fs_file_write_iter, + ), + + TP_printk("dev = (%d,%d), ino = %lu, " +- "offset = %lu, length = %lu, written(err) = %d", ++ "offset = %lld, length = %zu, written(err) = %zd", + show_dev_ino(__entry), + __entry->offset, + __entry->length, +-- +2.43.0 + diff --git a/queue-5.15/f2fs-fix-to-avoid-dirent-corruption.patch b/queue-5.15/f2fs-fix-to-avoid-dirent-corruption.patch new file mode 100644 index 00000000000..767e404b12f --- /dev/null +++ b/queue-5.15/f2fs-fix-to-avoid-dirent-corruption.patch @@ -0,0 +1,60 @@ +From bb50974534f26a5eadf44e1bf88ca969aa3d2799 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Nov 2023 17:25:16 +0800 +Subject: f2fs: fix to avoid dirent corruption + +From: Chao Yu + +[ Upstream commit 53edb549565f55ccd0bdf43be3d66ce4c2d48b28 ] + +As Al reported in link[1]: + +f2fs_rename() +... + if (old_dir != new_dir && !whiteout) + f2fs_set_link(old_inode, old_dir_entry, + old_dir_page, new_dir); + else + f2fs_put_page(old_dir_page, 0); + +You want correct inumber in the ".." link. And cross-directory +rename does move the source to new parent, even if you'd been asked +to leave a whiteout in the old place. + +[1] https://lore.kernel.org/all/20231017055040.GN800259@ZenIV/ + +With below testcase, it may cause dirent corruption, due to it missed +to call f2fs_set_link() to update ".." link to new directory. +- mkdir -p dir/foo +- renameat2 -w dir/foo bar + +[ASSERT] (__chk_dots_dentries:1421) --> Bad inode number[0x4] for '..', parent parent ino is [0x3] +[FSCK] other corrupted bugs [Fail] + +Fixes: 7e01e7ad746b ("f2fs: support RENAME_WHITEOUT") +Cc: Jan Kara +Reported-by: Al Viro +Signed-off-by: Chao Yu +Reviewed-by: Jan Kara +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/namei.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/f2fs/namei.c b/fs/f2fs/namei.c +index 7a86a8dcf4f1..0d6906644feb 100644 +--- a/fs/f2fs/namei.c ++++ b/fs/f2fs/namei.c +@@ -1088,7 +1088,7 @@ static int f2fs_rename(struct inode *old_dir, struct dentry *old_dentry, + } + + if (old_dir_entry) { +- if (old_dir != new_dir && !whiteout) ++ if (old_dir != new_dir) + f2fs_set_link(old_inode, old_dir_entry, + old_dir_page, new_dir); + else +-- +2.43.0 + diff --git a/queue-5.15/f2fs-fix-to-check-compress-file-in-f2fs_move_file_ra.patch b/queue-5.15/f2fs-fix-to-check-compress-file-in-f2fs_move_file_ra.patch new file mode 100644 index 00000000000..2d00cea06c1 --- /dev/null +++ b/queue-5.15/f2fs-fix-to-check-compress-file-in-f2fs_move_file_ra.patch @@ -0,0 +1,40 @@ +From 04949e82e22f864a8449eb5b36e211300e18a0e7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 10 Dec 2023 19:35:44 +0800 +Subject: f2fs: fix to check compress file in f2fs_move_file_range() + +From: Chao Yu + +[ Upstream commit fb9b65340c818875ea86464faf3c744bdce0055c ] + +f2fs_move_file_range() doesn't support migrating compressed cluster +data, let's add the missing check condition and return -EOPNOTSUPP +for the case until we support it. + +Fixes: 4c8ff7095bef ("f2fs: support data compression") +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/file.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c +index 58fd32db025d..0669ac4c0f12 100644 +--- a/fs/f2fs/file.c ++++ b/fs/f2fs/file.c +@@ -2780,6 +2780,11 @@ static int f2fs_move_file_range(struct file *file_in, loff_t pos_in, + goto out; + } + ++ if (f2fs_compressed_file(src) || f2fs_compressed_file(dst)) { ++ ret = -EOPNOTSUPP; ++ goto out_unlock; ++ } ++ + ret = -EINVAL; + if (pos_in + len > src->i_size || pos_in + len < pos_in) + goto out_unlock; +-- +2.43.0 + diff --git a/queue-5.15/f2fs-fix-to-update-iostat-correctly-in-f2fs_filemap_.patch b/queue-5.15/f2fs-fix-to-update-iostat-correctly-in-f2fs_filemap_.patch new file mode 100644 index 00000000000..1ead7b5996c --- /dev/null +++ b/queue-5.15/f2fs-fix-to-update-iostat-correctly-in-f2fs_filemap_.patch @@ -0,0 +1,36 @@ +From 0971b16d1308be00f7da815732a7d7b0219b7ee7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 10 Dec 2023 19:35:47 +0800 +Subject: f2fs: fix to update iostat correctly in f2fs_filemap_fault() + +From: Chao Yu + +[ Upstream commit bb34cc6ca87ff78f9fb5913d7619dc1389554da6 ] + +In f2fs_filemap_fault(), it fixes to update iostat info only if +VM_FAULT_LOCKED is tagged in return value of filemap_fault(). + +Fixes: 8b83ac81f428 ("f2fs: support read iostat") +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/file.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c +index 0669ac4c0f12..533ab259ce01 100644 +--- a/fs/f2fs/file.c ++++ b/fs/f2fs/file.c +@@ -41,7 +41,7 @@ static vm_fault_t f2fs_filemap_fault(struct vm_fault *vmf) + vm_fault_t ret; + + ret = filemap_fault(vmf); +- if (!ret) ++ if (ret & VM_FAULT_LOCKED) + f2fs_update_iostat(F2FS_I_SB(inode), APP_MAPPED_READ_IO, + F2FS_BLKSIZE); + +-- +2.43.0 + diff --git a/queue-5.15/firmware-meson_sm-populate-platform-devices-from-sm-.patch b/queue-5.15/firmware-meson_sm-populate-platform-devices-from-sm-.patch new file mode 100644 index 00000000000..067c36ad96f --- /dev/null +++ b/queue-5.15/firmware-meson_sm-populate-platform-devices-from-sm-.patch @@ -0,0 +1,51 @@ +From 0e71489b4c7ddb46696808290fa32079794c5f34 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Mar 2023 17:55:57 +0300 +Subject: firmware: meson_sm: populate platform devices from sm device tree + data + +From: Dmitry Rokosov + +[ Upstream commit e45f243409db98d610248c843b25435e7fb0baf3 ] + +In some meson boards, secure monitor device has children, for example, +power secure controller. By default, secure monitor isn't the bus in terms +of device tree subsystem, so the of_platform initialization code doesn't +populate its device tree data. As a result, secure monitor's children +aren't probed at all. + +Run the 'of_platform_populate()' routine manually to resolve such issues. + +Signed-off-by: Dmitry Rokosov +Acked-by: Martin Blumenstingl +Link: https://lore.kernel.org/r/20230324145557.27797-1-ddrokosov@sberdevices.ru +Signed-off-by: Neil Armstrong +Stable-dep-of: d8385d7433f9 ("firmware: meson-sm: unmap out_base shmem in error path") +Signed-off-by: Sasha Levin +--- + drivers/firmware/meson/meson_sm.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/firmware/meson/meson_sm.c b/drivers/firmware/meson/meson_sm.c +index d081a6312627..bf19dd66c213 100644 +--- a/drivers/firmware/meson/meson_sm.c ++++ b/drivers/firmware/meson/meson_sm.c +@@ -313,11 +313,14 @@ static int __init meson_sm_probe(struct platform_device *pdev) + + platform_set_drvdata(pdev, fw); + +- pr_info("secure-monitor enabled\n"); ++ if (devm_of_platform_populate(dev)) ++ goto out_in_base; + + if (sysfs_create_group(&pdev->dev.kobj, &meson_sm_sysfs_attr_group)) + goto out_in_base; + ++ pr_info("secure-monitor enabled\n"); ++ + return 0; + + out_in_base: +-- +2.43.0 + diff --git a/queue-5.15/firmware-ti_sci-fix-an-off-by-one-in-ti_sci_debugfs_.patch b/queue-5.15/firmware-ti_sci-fix-an-off-by-one-in-ti_sci_debugfs_.patch new file mode 100644 index 00000000000..4a6bdc7a693 --- /dev/null +++ b/queue-5.15/firmware-ti_sci-fix-an-off-by-one-in-ti_sci_debugfs_.patch @@ -0,0 +1,55 @@ +From fa2aaed6a2d0dfc193dba099e1c7f29498e5911c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Oct 2023 11:12:26 +0100 +Subject: firmware: ti_sci: Fix an off-by-one in ti_sci_debugfs_create() + +From: Christophe JAILLET + +[ Upstream commit 964946b88887089f447a9b6a28c39ee97dc76360 ] + +The ending NULL is not taken into account by strncat(), so switch to +snprintf() to correctly build 'debug_name'. + +Using snprintf() also makes the code more readable. + +Fixes: aa276781a64a ("firmware: Add basic support for TI System Control Interface (TI-SCI) protocol") +Signed-off-by: Christophe JAILLET +Reviewed-by: Dan Carpenter +Link: https://lore.kernel.org/r/7158db0a4d7b19855ddd542ec61b666973aad8dc.1698660720.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Nishanth Menon +Signed-off-by: Sasha Levin +--- + drivers/firmware/ti_sci.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/firmware/ti_sci.c b/drivers/firmware/ti_sci.c +index c2fafe49c2e8..b313337e4f19 100644 +--- a/drivers/firmware/ti_sci.c ++++ b/drivers/firmware/ti_sci.c +@@ -161,7 +161,7 @@ static int ti_sci_debugfs_create(struct platform_device *pdev, + { + struct device *dev = &pdev->dev; + struct resource *res; +- char debug_name[50] = "ti_sci_debug@"; ++ char debug_name[50]; + + /* Debug region is optional */ + res = platform_get_resource_byname(pdev, IORESOURCE_MEM, +@@ -178,10 +178,10 @@ static int ti_sci_debugfs_create(struct platform_device *pdev, + /* Setup NULL termination */ + info->debug_buffer[info->debug_region_size] = 0; + +- info->d = debugfs_create_file(strncat(debug_name, dev_name(dev), +- sizeof(debug_name) - +- sizeof("ti_sci_debug@")), +- 0444, NULL, info, &ti_sci_debug_fops); ++ snprintf(debug_name, sizeof(debug_name), "ti_sci_debug@%s", ++ dev_name(dev)); ++ info->d = debugfs_create_file(debug_name, 0444, NULL, info, ++ &ti_sci_debug_fops); + if (IS_ERR(info->d)) + return PTR_ERR(info->d); + +-- +2.43.0 + diff --git a/queue-5.15/fs-indicate-request-originates-from-old-mount-api.patch b/queue-5.15/fs-indicate-request-originates-from-old-mount-api.patch new file mode 100644 index 00000000000..e37a549363b --- /dev/null +++ b/queue-5.15/fs-indicate-request-originates-from-old-mount-api.patch @@ -0,0 +1,61 @@ +From d173d2c8c9647088cbdbbd409bd7af3a33d0fdd5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Nov 2023 12:17:37 -0500 +Subject: fs: indicate request originates from old mount API + +From: Christian Brauner + +[ Upstream commit f67d922edb4e95a4a56d07d5d40a76dd4f23a85b ] + +We already communicate to filesystems when a remount request comes from +the old mount API as some filesystems choose to implement different +behavior in the new mount API than the old mount API to e.g., take the +chance to fix significant API bugs. Allow the same for regular mount +requests. + +Fixes: b330966f79fb ("fuse: reject options on reconfigure via fsconfig(2)") +Reviewed-by: Christoph Hellwig +Reviewed-by: Johannes Thumshirn +Reviewed-by: Anand Jain +Signed-off-by: Christian Brauner +Signed-off-by: Josef Bacik +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/namespace.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/fs/namespace.c b/fs/namespace.c +index 1a9df6afb90b..932986448a98 100644 +--- a/fs/namespace.c ++++ b/fs/namespace.c +@@ -2647,7 +2647,12 @@ static int do_remount(struct path *path, int ms_flags, int sb_flags, + if (IS_ERR(fc)) + return PTR_ERR(fc); + ++ /* ++ * Indicate to the filesystem that the remount request is coming ++ * from the legacy mount system call. ++ */ + fc->oldapi = true; ++ + err = parse_monolithic_mount_data(fc, data); + if (!err) { + down_write(&sb->s_umount); +@@ -2981,6 +2986,12 @@ static int do_new_mount(struct path *path, const char *fstype, int sb_flags, + if (IS_ERR(fc)) + return PTR_ERR(fc); + ++ /* ++ * Indicate to the filesystem that the mount request is coming ++ * from the legacy mount system call. ++ */ ++ fc->oldapi = true; ++ + if (subtype) + err = vfs_parse_fs_string(fc, "subtype", + subtype, strlen(subtype)); +-- +2.43.0 + diff --git a/queue-5.15/gfs2-fix-kernel-null-pointer-dereference-in-gfs2_rgr.patch b/queue-5.15/gfs2-fix-kernel-null-pointer-dereference-in-gfs2_rgr.patch new file mode 100644 index 00000000000..cf24111222a --- /dev/null +++ b/queue-5.15/gfs2-fix-kernel-null-pointer-dereference-in-gfs2_rgr.patch @@ -0,0 +1,40 @@ +From 0d7df8337d84430263ebd3c2262c90b5d651ea50 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Nov 2023 21:21:29 +0500 +Subject: gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump + +From: Osama Muhammad + +[ Upstream commit 8877243beafa7c6bfc42022cbfdf9e39b25bd4fa ] + +Syzkaller has reported a NULL pointer dereference when accessing +rgd->rd_rgl in gfs2_rgrp_dump(). This can happen when creating +rgd->rd_gl fails in read_rindex_entry(). Add a NULL pointer check in +gfs2_rgrp_dump() to prevent that. + +Reported-and-tested-by: syzbot+da0fc229cc1ff4bb2e6d@syzkaller.appspotmail.com +Link: https://syzkaller.appspot.com/bug?extid=da0fc229cc1ff4bb2e6d +Fixes: 72244b6bc752 ("gfs2: improve debug information when lvb mismatches are found") +Signed-off-by: Osama Muhammad +Signed-off-by: Andreas Gruenbacher +Signed-off-by: Sasha Levin +--- + fs/gfs2/rgrp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c +index 6901cd85f1df..e4e85010ab5b 100644 +--- a/fs/gfs2/rgrp.c ++++ b/fs/gfs2/rgrp.c +@@ -2316,7 +2316,7 @@ void gfs2_rgrp_dump(struct seq_file *seq, struct gfs2_rgrpd *rgd, + (unsigned long long)rgd->rd_addr, rgd->rd_flags, + rgd->rd_free, rgd->rd_free_clone, rgd->rd_dinodes, + rgd->rd_requested, rgd->rd_reserved, rgd->rd_extfail_pt); +- if (rgd->rd_sbd->sd_args.ar_rgrplvb) { ++ if (rgd->rd_sbd->sd_args.ar_rgrplvb && rgd->rd_rgl) { + struct gfs2_rgrp_lvb *rgl = rgd->rd_rgl; + + gfs2_print_dbg(seq, "%s L: f:%02x b:%u i:%u\n", fs_id_buf, +-- +2.43.0 + diff --git a/queue-5.15/gpu-drm-radeon-fix-two-memleaks-in-radeon_vm_init.patch b/queue-5.15/gpu-drm-radeon-fix-two-memleaks-in-radeon_vm_init.patch new file mode 100644 index 00000000000..30268b84be6 --- /dev/null +++ b/queue-5.15/gpu-drm-radeon-fix-two-memleaks-in-radeon_vm_init.patch @@ -0,0 +1,48 @@ +From 0a6a48975260b078110d1cc1a4de7fad18d008b1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Dec 2023 00:58:42 +0800 +Subject: gpu/drm/radeon: fix two memleaks in radeon_vm_init + +From: Zhipeng Lu + +[ Upstream commit c2709b2d6a537ca0fa0f1da36fdaf07e48ef447d ] + +When radeon_bo_create and radeon_vm_clear_bo fail, the vm->page_tables +allocated before need to be freed. However, neither radeon_vm_init +itself nor its caller have done such deallocation. + +Fixes: 6d2f2944e95e ("drm/radeon: use normal BOs for the page tables v4") +Signed-off-by: Zhipeng Lu +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/radeon/radeon_vm.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/radeon/radeon_vm.c b/drivers/gpu/drm/radeon/radeon_vm.c +index bb53016f3138..f2fc8ef99139 100644 +--- a/drivers/gpu/drm/radeon/radeon_vm.c ++++ b/drivers/gpu/drm/radeon/radeon_vm.c +@@ -1204,13 +1204,17 @@ int radeon_vm_init(struct radeon_device *rdev, struct radeon_vm *vm) + r = radeon_bo_create(rdev, pd_size, align, true, + RADEON_GEM_DOMAIN_VRAM, 0, NULL, + NULL, &vm->page_directory); +- if (r) ++ if (r) { ++ kfree(vm->page_tables); ++ vm->page_tables = NULL; + return r; +- ++ } + r = radeon_vm_clear_bo(rdev, vm->page_directory); + if (r) { + radeon_bo_unref(&vm->page_directory); + vm->page_directory = NULL; ++ kfree(vm->page_tables); ++ vm->page_tables = NULL; + return r; + } + +-- +2.43.0 + diff --git a/queue-5.15/ib-iser-prevent-invalidating-wrong-mr.patch b/queue-5.15/ib-iser-prevent-invalidating-wrong-mr.patch new file mode 100644 index 00000000000..c37b9b90763 --- /dev/null +++ b/queue-5.15/ib-iser-prevent-invalidating-wrong-mr.patch @@ -0,0 +1,133 @@ +From 8691b0c312f014393334ab643e6189c085de2ec9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Dec 2023 09:23:11 +0200 +Subject: IB/iser: Prevent invalidating wrong MR + +From: Sergey Gorenko + +[ Upstream commit 2f1888281e67205bd80d3e8f54dbd519a9653f26 ] + +The iser_reg_resources structure has two pointers to MR but only one +mr_valid field. The implementation assumes that we use only *sig_mr when +pi_enable is true. Otherwise, we use only *mr. However, it is only +sometimes correct. Read commands without protection information occur even +when pi_enble is true. For example, the following SCSI commands have a +Data-In buffer but never have protection information: READ CAPACITY (16), +INQUIRY, MODE SENSE(6), MAINTENANCE IN. So, we use +*sig_mr for some SCSI commands and *mr for the other SCSI commands. + +In most cases, it works fine because the remote invalidation is applied. +However, there are two cases when the remote invalidation is not +applicable. + 1. Small write commands when all data is sent as an immediate. + 2. The target does not support the remote invalidation feature. + +The lazy invalidation is used if the remote invalidation is impossible. +Since, at the lazy invalidation, we always invalidate the MR we want to +use, the wrong MR may be invalidated. + +To fix the issue, we need a field per MR that indicates the MR needs +invalidation. Since the ib_mr structure already has such a field, let's +use ib_mr.need_inval instead of iser_reg_resources.mr_valid. + +Fixes: b76a439982f8 ("IB/iser: Use IB_WR_REG_MR_INTEGRITY for PI handover") +Link: https://lore.kernel.org/r/20231219072311.40989-1-sergeygo@nvidia.com +Acked-by: Max Gurtovoy +Signed-off-by: Sergey Gorenko +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/ulp/iser/iscsi_iser.h | 2 -- + drivers/infiniband/ulp/iser/iser_initiator.c | 5 ++++- + drivers/infiniband/ulp/iser/iser_memory.c | 8 ++++---- + drivers/infiniband/ulp/iser/iser_verbs.c | 1 - + 4 files changed, 8 insertions(+), 8 deletions(-) + +diff --git a/drivers/infiniband/ulp/iser/iscsi_iser.h b/drivers/infiniband/ulp/iser/iscsi_iser.h +index 9f6ac0a09a78..35cc0a57e697 100644 +--- a/drivers/infiniband/ulp/iser/iscsi_iser.h ++++ b/drivers/infiniband/ulp/iser/iscsi_iser.h +@@ -321,12 +321,10 @@ struct iser_device { + * + * @mr: memory region + * @sig_mr: signature memory region +- * @mr_valid: is mr valid indicator + */ + struct iser_reg_resources { + struct ib_mr *mr; + struct ib_mr *sig_mr; +- u8 mr_valid:1; + }; + + /** +diff --git a/drivers/infiniband/ulp/iser/iser_initiator.c b/drivers/infiniband/ulp/iser/iser_initiator.c +index 27a6f75a9912..9ea88dd6a414 100644 +--- a/drivers/infiniband/ulp/iser/iser_initiator.c ++++ b/drivers/infiniband/ulp/iser/iser_initiator.c +@@ -602,7 +602,10 @@ iser_inv_desc(struct iser_fr_desc *desc, u32 rkey) + return -EINVAL; + } + +- desc->rsc.mr_valid = 0; ++ if (desc->sig_protected) ++ desc->rsc.sig_mr->need_inval = false; ++ else ++ desc->rsc.mr->need_inval = false; + + return 0; + } +diff --git a/drivers/infiniband/ulp/iser/iser_memory.c b/drivers/infiniband/ulp/iser/iser_memory.c +index 9776b755d848..c362043e7f17 100644 +--- a/drivers/infiniband/ulp/iser/iser_memory.c ++++ b/drivers/infiniband/ulp/iser/iser_memory.c +@@ -250,7 +250,7 @@ iser_reg_sig_mr(struct iscsi_iser_task *iser_task, + + iser_set_prot_checks(iser_task->sc, &sig_attrs->check_mask); + +- if (rsc->mr_valid) ++ if (rsc->sig_mr->need_inval) + iser_inv_rkey(&tx_desc->inv_wr, mr, cqe, &wr->wr); + + ib_update_fast_reg_key(mr, ib_inc_rkey(mr->rkey)); +@@ -274,7 +274,7 @@ iser_reg_sig_mr(struct iscsi_iser_task *iser_task, + wr->access = IB_ACCESS_LOCAL_WRITE | + IB_ACCESS_REMOTE_READ | + IB_ACCESS_REMOTE_WRITE; +- rsc->mr_valid = 1; ++ rsc->sig_mr->need_inval = true; + + sig_reg->sge.lkey = mr->lkey; + sig_reg->rkey = mr->rkey; +@@ -299,7 +299,7 @@ static int iser_fast_reg_mr(struct iscsi_iser_task *iser_task, + struct ib_reg_wr *wr = &tx_desc->reg_wr; + int n; + +- if (rsc->mr_valid) ++ if (rsc->mr->need_inval) + iser_inv_rkey(&tx_desc->inv_wr, mr, cqe, &wr->wr); + + ib_update_fast_reg_key(mr, ib_inc_rkey(mr->rkey)); +@@ -322,7 +322,7 @@ static int iser_fast_reg_mr(struct iscsi_iser_task *iser_task, + IB_ACCESS_REMOTE_WRITE | + IB_ACCESS_REMOTE_READ; + +- rsc->mr_valid = 1; ++ rsc->mr->need_inval = true; + + reg->sge.lkey = mr->lkey; + reg->rkey = mr->rkey; +diff --git a/drivers/infiniband/ulp/iser/iser_verbs.c b/drivers/infiniband/ulp/iser/iser_verbs.c +index b566f7cb7797..8656664a15c5 100644 +--- a/drivers/infiniband/ulp/iser/iser_verbs.c ++++ b/drivers/infiniband/ulp/iser/iser_verbs.c +@@ -136,7 +136,6 @@ iser_create_fastreg_desc(struct iser_device *device, + goto err_alloc_mr_integrity; + } + } +- desc->rsc.mr_valid = 0; + + return desc; + +-- +2.43.0 + diff --git a/queue-5.15/ip6_tunnel-fix-nexthdr_fragment-handling-in-ip6_tnl_.patch b/queue-5.15/ip6_tunnel-fix-nexthdr_fragment-handling-in-ip6_tnl_.patch new file mode 100644 index 00000000000..e1cc482bc60 --- /dev/null +++ b/queue-5.15/ip6_tunnel-fix-nexthdr_fragment-handling-in-ip6_tnl_.patch @@ -0,0 +1,173 @@ +From f527009098702031f660774f4309a33d42db754a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Jan 2024 17:03:13 +0000 +Subject: ip6_tunnel: fix NEXTHDR_FRAGMENT handling in + ip6_tnl_parse_tlv_enc_lim() + +From: Eric Dumazet + +[ Upstream commit d375b98e0248980681e5e56b712026174d617198 ] + +syzbot pointed out [1] that NEXTHDR_FRAGMENT handling is broken. + +Reading frag_off can only be done if we pulled enough bytes +to skb->head. Currently we might access garbage. + +[1] +BUG: KMSAN: uninit-value in ip6_tnl_parse_tlv_enc_lim+0x94f/0xbb0 +ip6_tnl_parse_tlv_enc_lim+0x94f/0xbb0 +ipxip6_tnl_xmit net/ipv6/ip6_tunnel.c:1326 [inline] +ip6_tnl_start_xmit+0xab2/0x1a70 net/ipv6/ip6_tunnel.c:1432 +__netdev_start_xmit include/linux/netdevice.h:4940 [inline] +netdev_start_xmit include/linux/netdevice.h:4954 [inline] +xmit_one net/core/dev.c:3548 [inline] +dev_hard_start_xmit+0x247/0xa10 net/core/dev.c:3564 +__dev_queue_xmit+0x33b8/0x5130 net/core/dev.c:4349 +dev_queue_xmit include/linux/netdevice.h:3134 [inline] +neigh_connected_output+0x569/0x660 net/core/neighbour.c:1592 +neigh_output include/net/neighbour.h:542 [inline] +ip6_finish_output2+0x23a9/0x2b30 net/ipv6/ip6_output.c:137 +ip6_finish_output+0x855/0x12b0 net/ipv6/ip6_output.c:222 +NF_HOOK_COND include/linux/netfilter.h:303 [inline] +ip6_output+0x323/0x610 net/ipv6/ip6_output.c:243 +dst_output include/net/dst.h:451 [inline] +ip6_local_out+0xe9/0x140 net/ipv6/output_core.c:155 +ip6_send_skb net/ipv6/ip6_output.c:1952 [inline] +ip6_push_pending_frames+0x1f9/0x560 net/ipv6/ip6_output.c:1972 +rawv6_push_pending_frames+0xbe8/0xdf0 net/ipv6/raw.c:582 +rawv6_sendmsg+0x2b66/0x2e70 net/ipv6/raw.c:920 +inet_sendmsg+0x105/0x190 net/ipv4/af_inet.c:847 +sock_sendmsg_nosec net/socket.c:730 [inline] +__sock_sendmsg net/socket.c:745 [inline] +____sys_sendmsg+0x9c2/0xd60 net/socket.c:2584 +___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638 +__sys_sendmsg net/socket.c:2667 [inline] +__do_sys_sendmsg net/socket.c:2676 [inline] +__se_sys_sendmsg net/socket.c:2674 [inline] +__x64_sys_sendmsg+0x307/0x490 net/socket.c:2674 +do_syscall_x64 arch/x86/entry/common.c:52 [inline] +do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83 +entry_SYSCALL_64_after_hwframe+0x63/0x6b + +Uninit was created at: +slab_post_alloc_hook+0x129/0xa70 mm/slab.h:768 +slab_alloc_node mm/slub.c:3478 [inline] +__kmem_cache_alloc_node+0x5c9/0x970 mm/slub.c:3517 +__do_kmalloc_node mm/slab_common.c:1006 [inline] +__kmalloc_node_track_caller+0x118/0x3c0 mm/slab_common.c:1027 +kmalloc_reserve+0x249/0x4a0 net/core/skbuff.c:582 +pskb_expand_head+0x226/0x1a00 net/core/skbuff.c:2098 +__pskb_pull_tail+0x13b/0x2310 net/core/skbuff.c:2655 +pskb_may_pull_reason include/linux/skbuff.h:2673 [inline] +pskb_may_pull include/linux/skbuff.h:2681 [inline] +ip6_tnl_parse_tlv_enc_lim+0x901/0xbb0 net/ipv6/ip6_tunnel.c:408 +ipxip6_tnl_xmit net/ipv6/ip6_tunnel.c:1326 [inline] +ip6_tnl_start_xmit+0xab2/0x1a70 net/ipv6/ip6_tunnel.c:1432 +__netdev_start_xmit include/linux/netdevice.h:4940 [inline] +netdev_start_xmit include/linux/netdevice.h:4954 [inline] +xmit_one net/core/dev.c:3548 [inline] +dev_hard_start_xmit+0x247/0xa10 net/core/dev.c:3564 +__dev_queue_xmit+0x33b8/0x5130 net/core/dev.c:4349 +dev_queue_xmit include/linux/netdevice.h:3134 [inline] +neigh_connected_output+0x569/0x660 net/core/neighbour.c:1592 +neigh_output include/net/neighbour.h:542 [inline] +ip6_finish_output2+0x23a9/0x2b30 net/ipv6/ip6_output.c:137 +ip6_finish_output+0x855/0x12b0 net/ipv6/ip6_output.c:222 +NF_HOOK_COND include/linux/netfilter.h:303 [inline] +ip6_output+0x323/0x610 net/ipv6/ip6_output.c:243 +dst_output include/net/dst.h:451 [inline] +ip6_local_out+0xe9/0x140 net/ipv6/output_core.c:155 +ip6_send_skb net/ipv6/ip6_output.c:1952 [inline] +ip6_push_pending_frames+0x1f9/0x560 net/ipv6/ip6_output.c:1972 +rawv6_push_pending_frames+0xbe8/0xdf0 net/ipv6/raw.c:582 +rawv6_sendmsg+0x2b66/0x2e70 net/ipv6/raw.c:920 +inet_sendmsg+0x105/0x190 net/ipv4/af_inet.c:847 +sock_sendmsg_nosec net/socket.c:730 [inline] +__sock_sendmsg net/socket.c:745 [inline] +____sys_sendmsg+0x9c2/0xd60 net/socket.c:2584 +___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638 +__sys_sendmsg net/socket.c:2667 [inline] +__do_sys_sendmsg net/socket.c:2676 [inline] +__se_sys_sendmsg net/socket.c:2674 [inline] +__x64_sys_sendmsg+0x307/0x490 net/socket.c:2674 +do_syscall_x64 arch/x86/entry/common.c:52 [inline] +do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83 +entry_SYSCALL_64_after_hwframe+0x63/0x6b + +CPU: 0 PID: 7345 Comm: syz-executor.3 Not tainted 6.7.0-rc8-syzkaller-00024-gac865f00af29 #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 + +Fixes: fbfa743a9d2a ("ipv6: fix ip6_tnl_parse_tlv_enc_lim()") +Reported-by: syzbot +Signed-off-by: Eric Dumazet +Cc: Willem de Bruijn +Reviewed-by: Willem de Bruijn +Reviewed-by: David Ahern +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv6/ip6_tunnel.c | 26 +++++++++++++------------- + 1 file changed, 13 insertions(+), 13 deletions(-) + +diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c +index bc5d3188454d..a41ba4b161c4 100644 +--- a/net/ipv6/ip6_tunnel.c ++++ b/net/ipv6/ip6_tunnel.c +@@ -401,7 +401,7 @@ __u16 ip6_tnl_parse_tlv_enc_lim(struct sk_buff *skb, __u8 *raw) + const struct ipv6hdr *ipv6h = (const struct ipv6hdr *)raw; + unsigned int nhoff = raw - skb->data; + unsigned int off = nhoff + sizeof(*ipv6h); +- u8 next, nexthdr = ipv6h->nexthdr; ++ u8 nexthdr = ipv6h->nexthdr; + + while (ipv6_ext_hdr(nexthdr) && nexthdr != NEXTHDR_NONE) { + struct ipv6_opt_hdr *hdr; +@@ -412,25 +412,25 @@ __u16 ip6_tnl_parse_tlv_enc_lim(struct sk_buff *skb, __u8 *raw) + + hdr = (struct ipv6_opt_hdr *)(skb->data + off); + if (nexthdr == NEXTHDR_FRAGMENT) { +- struct frag_hdr *frag_hdr = (struct frag_hdr *) hdr; +- if (frag_hdr->frag_off) +- break; + optlen = 8; + } else if (nexthdr == NEXTHDR_AUTH) { + optlen = ipv6_authlen(hdr); + } else { + optlen = ipv6_optlen(hdr); + } +- /* cache hdr->nexthdr, since pskb_may_pull() might +- * invalidate hdr +- */ +- next = hdr->nexthdr; +- if (nexthdr == NEXTHDR_DEST) { +- u16 i = 2; + +- /* Remember : hdr is no longer valid at this point. */ +- if (!pskb_may_pull(skb, off + optlen)) ++ if (!pskb_may_pull(skb, off + optlen)) ++ break; ++ ++ hdr = (struct ipv6_opt_hdr *)(skb->data + off); ++ if (nexthdr == NEXTHDR_FRAGMENT) { ++ struct frag_hdr *frag_hdr = (struct frag_hdr *)hdr; ++ ++ if (frag_hdr->frag_off) + break; ++ } ++ if (nexthdr == NEXTHDR_DEST) { ++ u16 i = 2; + + while (1) { + struct ipv6_tlv_tnl_enc_lim *tel; +@@ -451,7 +451,7 @@ __u16 ip6_tnl_parse_tlv_enc_lim(struct sk_buff *skb, __u8 *raw) + i++; + } + } +- nexthdr = next; ++ nexthdr = hdr->nexthdr; + off += optlen; + } + return 0; +-- +2.43.0 + diff --git a/queue-5.15/ksmbd-validate-the-zero-field-of-packet-header.patch b/queue-5.15/ksmbd-validate-the-zero-field-of-packet-header.patch new file mode 100644 index 00000000000..674138488fa --- /dev/null +++ b/queue-5.15/ksmbd-validate-the-zero-field-of-packet-header.patch @@ -0,0 +1,48 @@ +From 48c215427130e2ca830c951cd8f54b4891f80f7f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Dec 2023 14:56:47 +0800 +Subject: ksmbd: validate the zero field of packet header + +From: Li Nan + +[ Upstream commit 516b3eb8c8065f7465f87608d37a7ed08298c7a5 ] + +The SMB2 Protocol requires that "The first byte of the Direct TCP +transport packet header MUST be zero (0x00)"[1]. Commit 1c1bcf2d3ea0 +("ksmbd: validate smb request protocol id") removed the validation of +this 1-byte zero. Add the validation back now. + +[1]: [MS-SMB2] - v20230227, page 30. +https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-SMB2/%5bMS-SMB2%5d-230227.pdf + +Fixes: 1c1bcf2d3ea0 ("ksmbd: validate smb request protocol id") +Signed-off-by: Li Nan +Acked-by: Tom Talpey +Acked-by: Namjae Jeon +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/ksmbd/smb_common.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/fs/ksmbd/smb_common.c b/fs/ksmbd/smb_common.c +index d160363c09eb..e90a1e8c1951 100644 +--- a/fs/ksmbd/smb_common.c ++++ b/fs/ksmbd/smb_common.c +@@ -158,8 +158,12 @@ int ksmbd_verify_smb_message(struct ksmbd_work *work) + */ + bool ksmbd_smb_request(struct ksmbd_conn *conn) + { +- __le32 *proto = (__le32 *)smb2_get_msg(conn->request_buf); ++ __le32 *proto; + ++ if (conn->request_buf[0] != 0) ++ return false; ++ ++ proto = (__le32 *)smb2_get_msg(conn->request_buf); + if (*proto == SMB2_COMPRESSION_TRANSFORM_ID) { + pr_err_ratelimited("smb2 compression not support yet"); + return false; +-- +2.43.0 + diff --git a/queue-5.15/kunit-debugfs-fix-unchecked-dereference-in-debugfs_p.patch b/queue-5.15/kunit-debugfs-fix-unchecked-dereference-in-debugfs_p.patch new file mode 100644 index 00000000000..e8e6440f818 --- /dev/null +++ b/queue-5.15/kunit-debugfs-fix-unchecked-dereference-in-debugfs_p.patch @@ -0,0 +1,50 @@ +From d865f92a1ee6e3b96207998f5435b2cae9f7f361 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Oct 2023 10:47:58 +0000 +Subject: kunit: debugfs: Fix unchecked dereference in debugfs_print_results() + +From: Richard Fitzgerald + +[ Upstream commit 34dfd5bb2e5507e69d9b6d6c90f546600c7a4977 ] + +Move the call to kunit_suite_has_succeeded() after the check that +the kunit_suite pointer is valid. + +This was found by smatch: + + lib/kunit/debugfs.c:66 debugfs_print_results() warn: variable + dereferenced before check 'suite' (see line 63) + +Signed-off-by: Richard Fitzgerald +Reported-by: Dan Carpenter +Fixes: 38289a26e1b8 ("kunit: fix debugfs code to use enum kunit_status, not bool") +Reviewed-by: Rae Moar +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + lib/kunit/debugfs.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/lib/kunit/debugfs.c b/lib/kunit/debugfs.c +index 1048ef1b8d6e..4c4b84db8f4a 100644 +--- a/lib/kunit/debugfs.c ++++ b/lib/kunit/debugfs.c +@@ -52,12 +52,14 @@ static void debugfs_print_result(struct seq_file *seq, + static int debugfs_print_results(struct seq_file *seq, void *v) + { + struct kunit_suite *suite = (struct kunit_suite *)seq->private; +- enum kunit_status success = kunit_suite_has_succeeded(suite); ++ enum kunit_status success; + struct kunit_case *test_case; + + if (!suite || !suite->log) + return 0; + ++ success = kunit_suite_has_succeeded(suite); ++ + seq_printf(seq, "%s", suite->log); + + kunit_suite_for_each_test_case(suite, test_case) +-- +2.43.0 + diff --git a/queue-5.15/media-cx231xx-fix-a-memleak-in-cx231xx_init_isoc.patch b/queue-5.15/media-cx231xx-fix-a-memleak-in-cx231xx_init_isoc.patch new file mode 100644 index 00000000000..eab9db2f004 --- /dev/null +++ b/queue-5.15/media-cx231xx-fix-a-memleak-in-cx231xx_init_isoc.patch @@ -0,0 +1,51 @@ +From 778eabf7acd005b9a7028f4556faa60abbbfd733 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Dec 2023 21:22:55 +0800 +Subject: media: cx231xx: fix a memleak in cx231xx_init_isoc + +From: Zhipeng Lu + +[ Upstream commit 5d3c8990e2bbf929cb211563dadd70708f42e4e6 ] + +The dma_q->p_left_data alloced by kzalloc should be freed in all the +following error handling paths. However, it hasn't been freed in the +allocation error paths of dev->video_mode.isoc_ctl.urb and +dev->video_mode.isoc_ctl.transfer_buffer. + +On the other hand, the dma_q->p_left_data did be freed in the +error-handling paths after that of dev->video_mode.isoc_ctl.urb and +dev->video_mode.isoc_ctl.transfer_buffer, by calling +cx231xx_uninit_isoc(dev). So the same free operation should be done in +error-handling paths of those two allocation. + +Fixes: 64fbf4445526 ("[media] cx231xx: Added support for Carraera, Shelby, RDx_253S and VIDEO_GRABBER") +Signed-off-by: Zhipeng Lu +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/usb/cx231xx/cx231xx-core.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/media/usb/cx231xx/cx231xx-core.c b/drivers/media/usb/cx231xx/cx231xx-core.c +index 727e6268567f..f1feccc28bf0 100644 +--- a/drivers/media/usb/cx231xx/cx231xx-core.c ++++ b/drivers/media/usb/cx231xx/cx231xx-core.c +@@ -1024,6 +1024,7 @@ int cx231xx_init_isoc(struct cx231xx *dev, int max_packets, + if (!dev->video_mode.isoc_ctl.urb) { + dev_err(dev->dev, + "cannot alloc memory for usb buffers\n"); ++ kfree(dma_q->p_left_data); + return -ENOMEM; + } + +@@ -1033,6 +1034,7 @@ int cx231xx_init_isoc(struct cx231xx *dev, int max_packets, + dev_err(dev->dev, + "cannot allocate memory for usbtransfer\n"); + kfree(dev->video_mode.isoc_ctl.urb); ++ kfree(dma_q->p_left_data); + return -ENOMEM; + } + +-- +2.43.0 + diff --git a/queue-5.15/media-dvb-frontends-m88ds3103-fix-a-memory-leak-in-a.patch b/queue-5.15/media-dvb-frontends-m88ds3103-fix-a-memory-leak-in-a.patch new file mode 100644 index 00000000000..388aa9acb38 --- /dev/null +++ b/queue-5.15/media-dvb-frontends-m88ds3103-fix-a-memory-leak-in-a.patch @@ -0,0 +1,54 @@ +From 93d287d2552ff2c57208aab4663b046537499aa8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Oct 2023 08:20:26 +0100 +Subject: media: dvb-frontends: m88ds3103: Fix a memory leak in an error + handling path of m88ds3103_probe() + +From: Christophe JAILLET + +[ Upstream commit 5b2f885e2f6f482d05c23f04c8240f7b4fc5bdb5 ] + +If an error occurs after a successful i2c_mux_add_adapter(), then +i2c_mux_del_adapters() should be called to free some resources, as +already done in the remove function. + +Fixes: e6089feca460 ("media: m88ds3103: Add support for ds3103b demod") +Signed-off-by: Christophe JAILLET +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/dvb-frontends/m88ds3103.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/dvb-frontends/m88ds3103.c b/drivers/media/dvb-frontends/m88ds3103.c +index e03fac025b51..fdf993da3001 100644 +--- a/drivers/media/dvb-frontends/m88ds3103.c ++++ b/drivers/media/dvb-frontends/m88ds3103.c +@@ -1898,7 +1898,7 @@ static int m88ds3103_probe(struct i2c_client *client, + /* get frontend address */ + ret = regmap_read(dev->regmap, 0x29, &utmp); + if (ret) +- goto err_kfree; ++ goto err_del_adapters; + dev->dt_addr = ((utmp & 0x80) == 0) ? 0x42 >> 1 : 0x40 >> 1; + dev_dbg(&client->dev, "dt addr is 0x%02x\n", dev->dt_addr); + +@@ -1906,11 +1906,14 @@ static int m88ds3103_probe(struct i2c_client *client, + dev->dt_addr); + if (IS_ERR(dev->dt_client)) { + ret = PTR_ERR(dev->dt_client); +- goto err_kfree; ++ goto err_del_adapters; + } + } + + return 0; ++ ++err_del_adapters: ++ i2c_mux_del_adapters(dev->muxc); + err_kfree: + kfree(dev); + err: +-- +2.43.0 + diff --git a/queue-5.15/media-dvbdev-drop-refcount-on-error-path-in-dvb_devi.patch b/queue-5.15/media-dvbdev-drop-refcount-on-error-path-in-dvb_devi.patch new file mode 100644 index 00000000000..0d3cb803125 --- /dev/null +++ b/queue-5.15/media-dvbdev-drop-refcount-on-error-path-in-dvb_devi.patch @@ -0,0 +1,35 @@ +From cd57b4becd50e15124f023913550e0a0c58cf97b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 Oct 2023 12:53:33 +0300 +Subject: media: dvbdev: drop refcount on error path in dvb_device_open() + +From: Dan Carpenter + +[ Upstream commit a2dd235df435a05d389240be748909ada91201d2 ] + +If call to file->f_op->open() fails, then call dvb_device_put(dvbdev). + +Fixes: 0fc044b2b5e2 ("media: dvbdev: adopts refcnt to avoid UAF") +Signed-off-by: Dan Carpenter +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/dvb-core/dvbdev.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/media/dvb-core/dvbdev.c b/drivers/media/dvb-core/dvbdev.c +index 2ff8a1b776fb..3a83e8e09256 100644 +--- a/drivers/media/dvb-core/dvbdev.c ++++ b/drivers/media/dvb-core/dvbdev.c +@@ -114,6 +114,8 @@ static int dvb_device_open(struct inode *inode, struct file *file) + err = file->f_op->open(inode, file); + up_read(&minor_rwsem); + mutex_unlock(&dvbdev_mutex); ++ if (err) ++ dvb_device_put(dvbdev); + return err; + } + fail: +-- +2.43.0 + diff --git a/queue-5.15/media-pvrusb2-fix-use-after-free-on-context-disconne.patch b/queue-5.15/media-pvrusb2-fix-use-after-free-on-context-disconne.patch new file mode 100644 index 00000000000..d513c57a869 --- /dev/null +++ b/queue-5.15/media-pvrusb2-fix-use-after-free-on-context-disconne.patch @@ -0,0 +1,46 @@ +From 627aedd7a9ae405410e50df3cbe843b463d4bcdd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Oct 2023 01:09:12 +0200 +Subject: media: pvrusb2: fix use after free on context disconnection + +From: Ricardo B. Marliere + +[ Upstream commit ded85b0c0edd8f45fec88783d7555a5b982449c1 ] + +Upon module load, a kthread is created targeting the +pvr2_context_thread_func function, which may call pvr2_context_destroy +and thus call kfree() on the context object. However, that might happen +before the usb hub_event handler is able to notify the driver. This +patch adds a sanity check before the invalid read reported by syzbot, +within the context disconnection call stack. + +Reported-and-tested-by: syzbot+621409285c4156a009b3@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/all/000000000000a02a4205fff8eb92@google.com/ + +Fixes: e5be15c63804 ("V4L/DVB (7711): pvrusb2: Fix race on module unload") +Signed-off-by: Ricardo B. Marliere +Acked-by: Mike Isely +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/usb/pvrusb2/pvrusb2-context.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/usb/pvrusb2/pvrusb2-context.c b/drivers/media/usb/pvrusb2/pvrusb2-context.c +index 14170a5d72b3..1764674de98b 100644 +--- a/drivers/media/usb/pvrusb2/pvrusb2-context.c ++++ b/drivers/media/usb/pvrusb2/pvrusb2-context.c +@@ -268,7 +268,8 @@ void pvr2_context_disconnect(struct pvr2_context *mp) + { + pvr2_hdw_disconnect(mp->hdw); + mp->disconnect_flag = !0; +- pvr2_context_notify(mp); ++ if (!pvr2_context_shutok()) ++ pvr2_context_notify(mp); + } + + +-- +2.43.0 + diff --git a/queue-5.15/media-rkisp1-disable-runtime-pm-in-probe-error-path.patch b/queue-5.15/media-rkisp1-disable-runtime-pm-in-probe-error-path.patch new file mode 100644 index 00000000000..d92f82ede4f --- /dev/null +++ b/queue-5.15/media-rkisp1-disable-runtime-pm-in-probe-error-path.patch @@ -0,0 +1,46 @@ +From 31c1e7916ec50dc3b207517ae48f6d9b62d21626 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Jun 2022 20:10:36 +0100 +Subject: media: rkisp1: Disable runtime PM in probe error path + +From: Laurent Pinchart + +[ Upstream commit 13c9810281f8b24af9b7712cd84a1fce61843e93 ] + +If the v4l2_device_register() call fails, runtime PM is left enabled. +Fix it. + +Signed-off-by: Laurent Pinchart +Reviewed-by: Dafna Hirschfeld +Reviewed-by: Paul Elder +Signed-off-by: Mauro Carvalho Chehab +Stable-dep-of: 452f604a4683 ("media: rkisp1: Fix media device memory leak") +Signed-off-by: Sasha Levin +--- + drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c b/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c +index 560f928c3752..79cfa99f2a64 100644 +--- a/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c ++++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c +@@ -514,7 +514,7 @@ static int rkisp1_probe(struct platform_device *pdev) + + ret = v4l2_device_register(rkisp1->dev, &rkisp1->v4l2_dev); + if (ret) +- return ret; ++ goto err_pm_runtime_disable; + + ret = media_device_register(&rkisp1->media_dev); + if (ret) { +@@ -534,6 +534,7 @@ static int rkisp1_probe(struct platform_device *pdev) + media_device_unregister(&rkisp1->media_dev); + err_unreg_v4l2_dev: + v4l2_device_unregister(&rkisp1->v4l2_dev); ++err_pm_runtime_disable: + pm_runtime_disable(&pdev->dev); + return ret; + } +-- +2.43.0 + diff --git a/queue-5.15/media-rkisp1-fix-media-device-memory-leak.patch b/queue-5.15/media-rkisp1-fix-media-device-memory-leak.patch new file mode 100644 index 00000000000..842b451eac3 --- /dev/null +++ b/queue-5.15/media-rkisp1-fix-media-device-memory-leak.patch @@ -0,0 +1,57 @@ +From 3b190bd7cf63494da3169ce1e2e71b189fee07cd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Nov 2023 16:50:07 +0100 +Subject: media: rkisp1: Fix media device memory leak + +From: Tomi Valkeinen + +[ Upstream commit 452f604a4683654f4d9472b3126d8da61d748443 ] + +Add missing calls to media_device_cleanup() to fix memory leak. + +Link: https://lore.kernel.org/r/20231122-rkisp-fixes-v2-1-78bfb63cdcf8@ideasonboard.com + +Fixes: d65dd85281fb ("media: staging: rkisp1: add Rockchip ISP1 base driver") +Reviewed-by: Tommaso Merciai +Signed-off-by: Tomi Valkeinen +Signed-off-by: Laurent Pinchart +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c b/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c +index 79cfa99f2a64..0255b24af243 100644 +--- a/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c ++++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c +@@ -514,7 +514,7 @@ static int rkisp1_probe(struct platform_device *pdev) + + ret = v4l2_device_register(rkisp1->dev, &rkisp1->v4l2_dev); + if (ret) +- goto err_pm_runtime_disable; ++ goto err_media_dev_cleanup; + + ret = media_device_register(&rkisp1->media_dev); + if (ret) { +@@ -534,6 +534,8 @@ static int rkisp1_probe(struct platform_device *pdev) + media_device_unregister(&rkisp1->media_dev); + err_unreg_v4l2_dev: + v4l2_device_unregister(&rkisp1->v4l2_dev); ++err_media_dev_cleanup: ++ media_device_cleanup(&rkisp1->media_dev); + err_pm_runtime_disable: + pm_runtime_disable(&pdev->dev); + return ret; +@@ -555,6 +557,8 @@ static int rkisp1_remove(struct platform_device *pdev) + media_device_unregister(&rkisp1->media_dev); + v4l2_device_unregister(&rkisp1->v4l2_dev); + ++ media_device_cleanup(&rkisp1->media_dev); ++ + pm_runtime_disable(&pdev->dev); + + debugfs_remove_recursive(rkisp1->debug.debugfs_dir); +-- +2.43.0 + diff --git a/queue-5.15/mlxbf_gige-enable-the-gige-port-in-mlxbf_gige_open.patch b/queue-5.15/mlxbf_gige-enable-the-gige-port-in-mlxbf_gige_open.patch new file mode 100644 index 00000000000..8870c2e6761 --- /dev/null +++ b/queue-5.15/mlxbf_gige-enable-the-gige-port-in-mlxbf_gige_open.patch @@ -0,0 +1,68 @@ +From 3fbde3859d1fb9682c2164ec810df78e9c4c9cce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Jan 2024 11:00:14 -0500 +Subject: mlxbf_gige: Enable the GigE port in mlxbf_gige_open + +From: Asmaa Mnebhi + +[ Upstream commit a460f4a684511e007bbf1700758a41f05d9981e6 ] + +At the moment, the GigE port is enabled in the mlxbf_gige_probe +function. If the mlxbf_gige_open is not executed, this could cause +pause frames to increase in the case where there is high backgroud +traffic. This results in clogging the port. +So move enabling the OOB port to mlxbf_gige_open. + +Fixes: f92e1869d74e ("Add Mellanox BlueField Gigabit Ethernet driver") +Reviewed-by: David Thompson +Signed-off-by: Asmaa Mnebhi +Reviewed-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c +index 181a0845a105..679415a64f25 100644 +--- a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c ++++ b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c +@@ -132,9 +132,15 @@ static int mlxbf_gige_open(struct net_device *netdev) + { + struct mlxbf_gige *priv = netdev_priv(netdev); + struct phy_device *phydev = netdev->phydev; ++ u64 control; + u64 int_en; + int err; + ++ /* Perform general init of GigE block */ ++ control = readq(priv->base + MLXBF_GIGE_CONTROL); ++ control |= MLXBF_GIGE_CONTROL_PORT_EN; ++ writeq(control, priv->base + MLXBF_GIGE_CONTROL); ++ + err = mlxbf_gige_request_irqs(priv); + if (err) + return err; +@@ -281,7 +287,6 @@ static int mlxbf_gige_probe(struct platform_device *pdev) + void __iomem *plu_base; + void __iomem *base; + int addr, phy_irq; +- u64 control; + int err; + + base = devm_platform_ioremap_resource(pdev, MLXBF_GIGE_RES_MAC); +@@ -296,11 +301,6 @@ static int mlxbf_gige_probe(struct platform_device *pdev) + if (IS_ERR(plu_base)) + return PTR_ERR(plu_base); + +- /* Perform general init of GigE block */ +- control = readq(base + MLXBF_GIGE_CONTROL); +- control |= MLXBF_GIGE_CONTROL_PORT_EN; +- writeq(control, base + MLXBF_GIGE_CONTROL); +- + netdev = devm_alloc_etherdev(&pdev->dev, sizeof(*priv)); + if (!netdev) + return -ENOMEM; +-- +2.43.0 + diff --git a/queue-5.15/mlxbf_gige-fix-intermittent-no-ip-issue.patch b/queue-5.15/mlxbf_gige-fix-intermittent-no-ip-issue.patch new file mode 100644 index 00000000000..c2db8df379d --- /dev/null +++ b/queue-5.15/mlxbf_gige-fix-intermittent-no-ip-issue.patch @@ -0,0 +1,92 @@ +From cba5dfe1189047a354dc144df431c576e5ebe820 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Jan 2024 10:59:46 -0500 +Subject: mlxbf_gige: Fix intermittent no ip issue + +From: Asmaa Mnebhi + +[ Upstream commit ef210ef85d5cb543ce34a57803ed856d0c8c08c2 ] + +Although the link is up, there is no ip assigned on setups with high background +traffic. Nothing is transmitted nor received. The RX error count keeps on +increasing. After several minutes, the RX error count stagnates and the +GigE interface finally gets an ip. + +The issue is that mlxbf_gige_rx_init() is called before phy_start(). +As soon as the RX DMA is enabled in mlxbf_gige_rx_init(), the RX CI reaches the max +of 128, and becomes equal to RX PI. RX CI doesn't decrease since the code hasn't +ran phy_start yet. +Bring the PHY up before starting the RX. + +Fixes: f92e1869d74e ("Add Mellanox BlueField Gigabit Ethernet driver") +Reviewed-by: David Thompson +Signed-off-by: Asmaa Mnebhi +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c | 14 +++++++------- + .../ethernet/mellanox/mlxbf_gige/mlxbf_gige_rx.c | 6 +++--- + 2 files changed, 10 insertions(+), 10 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c +index b990782c1eb1..2cbe0daafd41 100644 +--- a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c ++++ b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c +@@ -149,14 +149,14 @@ static int mlxbf_gige_open(struct net_device *netdev) + */ + priv->valid_polarity = 0; + +- err = mlxbf_gige_rx_init(priv); ++ phy_start(phydev); ++ ++ err = mlxbf_gige_tx_init(priv); + if (err) + goto free_irqs; +- err = mlxbf_gige_tx_init(priv); ++ err = mlxbf_gige_rx_init(priv); + if (err) +- goto rx_deinit; +- +- phy_start(phydev); ++ goto tx_deinit; + + netif_napi_add(netdev, &priv->napi, mlxbf_gige_poll, NAPI_POLL_WEIGHT); + napi_enable(&priv->napi); +@@ -178,8 +178,8 @@ static int mlxbf_gige_open(struct net_device *netdev) + + return 0; + +-rx_deinit: +- mlxbf_gige_rx_deinit(priv); ++tx_deinit: ++ mlxbf_gige_tx_deinit(priv); + + free_irqs: + mlxbf_gige_free_irqs(priv); +diff --git a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_rx.c b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_rx.c +index 227d01cace3f..699984358493 100644 +--- a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_rx.c ++++ b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_rx.c +@@ -142,6 +142,9 @@ int mlxbf_gige_rx_init(struct mlxbf_gige *priv) + writeq(MLXBF_GIGE_RX_MAC_FILTER_COUNT_PASS_EN, + priv->base + MLXBF_GIGE_RX_MAC_FILTER_COUNT_PASS); + ++ writeq(ilog2(priv->rx_q_entries), ++ priv->base + MLXBF_GIGE_RX_WQE_SIZE_LOG2); ++ + /* Clear MLXBF_GIGE_INT_MASK 'receive pkt' bit to + * indicate readiness to receive interrupts + */ +@@ -154,9 +157,6 @@ int mlxbf_gige_rx_init(struct mlxbf_gige *priv) + data |= MLXBF_GIGE_RX_DMA_EN; + writeq(data, priv->base + MLXBF_GIGE_RX_DMA); + +- writeq(ilog2(priv->rx_q_entries), +- priv->base + MLXBF_GIGE_RX_WQE_SIZE_LOG2); +- + return 0; + + free_wqe_and_skb: +-- +2.43.0 + diff --git a/queue-5.15/mmc-sdhci_am654-fix-ti-soc-dependencies.patch b/queue-5.15/mmc-sdhci_am654-fix-ti-soc-dependencies.patch new file mode 100644 index 00000000000..9d9cd0dd1be --- /dev/null +++ b/queue-5.15/mmc-sdhci_am654-fix-ti-soc-dependencies.patch @@ -0,0 +1,48 @@ +From 71b40ca005e7be24f14ed36862f65667e540f62b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Dec 2023 13:59:46 +0000 +Subject: mmc: sdhci_am654: Fix TI SoC dependencies + +From: Peter Robinson + +[ Upstream commit cb052da7f031b0d2309a4895ca236afb3b4bbf50 ] + +The sdhci_am654 is specific to recent TI SoCs, update the +dependencies for those SoCs and compile testing. While we're +at it update the text to reflect the wider range of +supported TI SoCS the driver now supports. + +Fixes: 41fd4caeb00b ("mmc: sdhci_am654: Add Initial Support for AM654 SDHCI driver") +Signed-off-by: Peter Robinson +Link: https://lore.kernel.org/r/20231220135950.433588-1-pbrobinson@gmail.com +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/Kconfig | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/mmc/host/Kconfig b/drivers/mmc/host/Kconfig +index a281df78d168..ef36a0095211 100644 +--- a/drivers/mmc/host/Kconfig ++++ b/drivers/mmc/host/Kconfig +@@ -1070,14 +1070,15 @@ config MMC_SDHCI_OMAP + + config MMC_SDHCI_AM654 + tristate "Support for the SDHCI Controller in TI's AM654 SOCs" ++ depends on ARCH_K3 || COMPILE_TEST + depends on MMC_SDHCI_PLTFM && OF + select MMC_SDHCI_IO_ACCESSORS + select MMC_CQHCI + select REGMAP_MMIO + help + This selects the Secure Digital Host Controller Interface (SDHCI) +- support present in TI's AM654 SOCs. The controller supports +- SD/MMC/SDIO devices. ++ support present in TI's AM65x/AM64x/AM62x/J721E SOCs. The controller ++ supports SD/MMC/SDIO devices. + + If you have a controller with this interface, say Y or M here. + +-- +2.43.0 + diff --git a/queue-5.15/mmc-sdhci_omap-fix-ti-soc-dependencies.patch b/queue-5.15/mmc-sdhci_omap-fix-ti-soc-dependencies.patch new file mode 100644 index 00000000000..b613ddaa062 --- /dev/null +++ b/queue-5.15/mmc-sdhci_omap-fix-ti-soc-dependencies.patch @@ -0,0 +1,48 @@ +From a9cd651ba24f5a9edcdca14f0569cf1ed74dce4d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Dec 2023 13:59:47 +0000 +Subject: mmc: sdhci_omap: Fix TI SoC dependencies + +From: Peter Robinson + +[ Upstream commit 09f164d393a6671e5ff8342ba6b3cb7fe3f20208 ] + +The sdhci_omap is specific to older TI SoCs, update the +dependencies for those SoCs and compile testing. While we're +at it update the text to reflect the wider range of +supported TI SoCS the driver now supports. + +Fixes: 7d326930d352 ("mmc: sdhci-omap: Add OMAP SDHCI driver") +Signed-off-by: Peter Robinson +Link: https://lore.kernel.org/r/20231220135950.433588-2-pbrobinson@gmail.com +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/Kconfig | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/mmc/host/Kconfig b/drivers/mmc/host/Kconfig +index ef36a0095211..0061eeec220b 100644 +--- a/drivers/mmc/host/Kconfig ++++ b/drivers/mmc/host/Kconfig +@@ -1055,14 +1055,15 @@ config MMC_SDHCI_XENON + + config MMC_SDHCI_OMAP + tristate "TI SDHCI Controller Support" ++ depends on ARCH_OMAP2PLUS || ARCH_KEYSTONE || COMPILE_TEST + depends on MMC_SDHCI_PLTFM && OF + select THERMAL + imply TI_SOC_THERMAL + select MMC_SDHCI_EXTERNAL_DMA if DMA_ENGINE + help + This selects the Secure Digital Host Controller Interface (SDHCI) +- support present in TI's DRA7 SOCs. The controller supports +- SD/MMC/SDIO devices. ++ support present in TI's Keystone/OMAP2+/DRA7 SOCs. The controller ++ supports SD/MMC/SDIO devices. + + If you have a controller with this interface, say Y or M here. + +-- +2.43.0 + diff --git a/queue-5.15/mtd-fix-gluebi-null-pointer-dereference-caused-by-ft.patch b/queue-5.15/mtd-fix-gluebi-null-pointer-dereference-caused-by-ft.patch new file mode 100644 index 00000000000..59cdb91f48b --- /dev/null +++ b/queue-5.15/mtd-fix-gluebi-null-pointer-dereference-caused-by-ft.patch @@ -0,0 +1,85 @@ +From dc51c45068669c4e79f9f68b3abcd8ad269b1ccb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Dec 2023 10:46:19 +0800 +Subject: mtd: Fix gluebi NULL pointer dereference caused by ftl notifier +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: ZhaoLong Wang + +[ Upstream commit a43bdc376deab5fff1ceb93dca55bcab8dbdc1d6 ] + +If both ftl.ko and gluebi.ko are loaded, the notifier of ftl +triggers NULL pointer dereference when trying to access +‘gluebi->desc’ in gluebi_read(). + +ubi_gluebi_init + ubi_register_volume_notifier + ubi_enumerate_volumes + ubi_notify_all + gluebi_notify nb->notifier_call() + gluebi_create + mtd_device_register + mtd_device_parse_register + add_mtd_device + blktrans_notify_add not->add() + ftl_add_mtd tr->add_mtd() + scan_header + mtd_read + mtd_read_oob + mtd_read_oob_std + gluebi_read mtd->read() + gluebi->desc - NULL + +Detailed reproduction information available at the Link [1], + +In the normal case, obtain gluebi->desc in the gluebi_get_device(), +and access gluebi->desc in the gluebi_read(). However, +gluebi_get_device() is not executed in advance in the +ftl_add_mtd() process, which leads to NULL pointer dereference. + +The solution for the gluebi module is to run jffs2 on the UBI +volume without considering working with ftl or mtdblock [2]. +Therefore, this problem can be avoided by preventing gluebi from +creating the mtdblock device after creating mtd partition of the +type MTD_UBIVOLUME. + +Fixes: 2ba3d76a1e29 ("UBI: make gluebi a separate module") +Link: https://bugzilla.kernel.org/show_bug.cgi?id=217992 [1] +Link: https://lore.kernel.org/lkml/441107100.23734.1697904580252.JavaMail.zimbra@nod.at/ [2] +Signed-off-by: ZhaoLong Wang +Reviewed-by: Zhihao Cheng +Acked-by: Richard Weinberger +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20231220024619.2138625-1-wangzhaolong1@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/mtd/mtd_blkdevs.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/mtd/mtd_blkdevs.c b/drivers/mtd/mtd_blkdevs.c +index b8ae1ec14e17..5288a6aaf182 100644 +--- a/drivers/mtd/mtd_blkdevs.c ++++ b/drivers/mtd/mtd_blkdevs.c +@@ -457,7 +457,7 @@ static void blktrans_notify_add(struct mtd_info *mtd) + { + struct mtd_blktrans_ops *tr; + +- if (mtd->type == MTD_ABSENT) ++ if (mtd->type == MTD_ABSENT || mtd->type == MTD_UBIVOLUME) + return; + + list_for_each_entry(tr, &blktrans_majors, list) +@@ -497,7 +497,7 @@ int register_mtd_blktrans(struct mtd_blktrans_ops *tr) + mutex_lock(&mtd_table_mutex); + list_add(&tr->list, &blktrans_majors); + mtd_for_each_device(mtd) +- if (mtd->type != MTD_ABSENT) ++ if (mtd->type != MTD_ABSENT && mtd->type != MTD_UBIVOLUME) + tr->add_mtd(tr, mtd); + mutex_unlock(&mtd_table_mutex); + return 0; +-- +2.43.0 + diff --git a/queue-5.15/mtd-rawnand-increment-ifc_timeout_msecs-for-nand-con.patch b/queue-5.15/mtd-rawnand-increment-ifc_timeout_msecs-for-nand-con.patch new file mode 100644 index 00000000000..3fc6cab1bbf --- /dev/null +++ b/queue-5.15/mtd-rawnand-increment-ifc_timeout_msecs-for-nand-con.patch @@ -0,0 +1,49 @@ +From a42ee8314038b2ef34da6935262131b072d8dab0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 18 Nov 2023 18:31:51 +1000 +Subject: mtd: rawnand: Increment IFC_TIMEOUT_MSECS for nand controller + response + +From: Ronald Monthero + +[ Upstream commit 923fb6238cb3ac529aa2bf13b3b1e53762186a8b ] + +Under heavy load it is likely that the controller is done +with its own task but the thread unlocking the wait is not +scheduled in time. Increasing IFC_TIMEOUT_MSECS allows the +controller to respond within allowable timeslice of 1 sec. + +fsl,ifc-nand 7e800000.nand: Controller is not responding + +[<804b2047>] (nand_get_device) from [<804b5335>] (nand_write_oob+0x1b/0x4a) +[<804b5335>] (nand_write_oob) from [<804a3585>] (mtd_write+0x41/0x5c) +[<804a3585>] (mtd_write) from [<804c1d47>] (ubi_io_write+0x17f/0x22c) +[<804c1d47>] (ubi_io_write) from [<804c047b>] (ubi_eba_write_leb+0x5b/0x1d0) + +Fixes: 82771882d960 ("NAND Machine support for Integrated Flash Controller") +Reviewed-by: Miquel Raynal +Reviewed-by: Andy Shevchenko +Signed-off-by: Ronald Monthero +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20231118083156.776887-1-debug.penguin32@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/mtd/nand/raw/fsl_ifc_nand.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/mtd/nand/raw/fsl_ifc_nand.c b/drivers/mtd/nand/raw/fsl_ifc_nand.c +index 02d500176838..bea1a7d3edd7 100644 +--- a/drivers/mtd/nand/raw/fsl_ifc_nand.c ++++ b/drivers/mtd/nand/raw/fsl_ifc_nand.c +@@ -20,7 +20,7 @@ + + #define ERR_BYTE 0xFF /* Value returned for read + bytes when read failed */ +-#define IFC_TIMEOUT_MSECS 500 /* Maximum number of mSecs to wait ++#define IFC_TIMEOUT_MSECS 1000 /* Maximum timeout to wait + for IFC NAND Machine */ + + struct fsl_ifc_ctrl; +-- +2.43.0 + diff --git a/queue-5.15/net-mellanox-mlxbf_gige-replace-non-standard-interru.patch b/queue-5.15/net-mellanox-mlxbf_gige-replace-non-standard-interru.patch new file mode 100644 index 00000000000..73cede67cf2 --- /dev/null +++ b/queue-5.15/net-mellanox-mlxbf_gige-replace-non-standard-interru.patch @@ -0,0 +1,369 @@ +From b068286f799b4e51ad1b21029dfd840ab2191061 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Oct 2021 12:48:09 -0400 +Subject: net: mellanox: mlxbf_gige: Replace non-standard interrupt handling + +From: Asmaa Mnebhi + +[ Upstream commit 6c2a6ddca763271fa583e22bce10c2805c1ea9f6 ] + +Since the GPIO driver (gpio-mlxbf2.c) supports interrupt handling, +replace the custom routine with simple IRQ request. + +Signed-off-by: Asmaa Mnebhi +Acked-by: David S. Miller +Signed-off-by: Bartosz Golaszewski +Stable-dep-of: a460f4a68451 ("mlxbf_gige: Enable the GigE port in mlxbf_gige_open") +Signed-off-by: Sasha Levin +--- + .../net/ethernet/mellanox/mlxbf_gige/Makefile | 1 - + .../ethernet/mellanox/mlxbf_gige/mlxbf_gige.h | 12 - + .../mellanox/mlxbf_gige/mlxbf_gige_gpio.c | 212 ------------------ + .../mellanox/mlxbf_gige/mlxbf_gige_main.c | 22 +- + 4 files changed, 9 insertions(+), 238 deletions(-) + delete mode 100644 drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_gpio.c + +diff --git a/drivers/net/ethernet/mellanox/mlxbf_gige/Makefile b/drivers/net/ethernet/mellanox/mlxbf_gige/Makefile +index e57c1375f236..a97c2bef846b 100644 +--- a/drivers/net/ethernet/mellanox/mlxbf_gige/Makefile ++++ b/drivers/net/ethernet/mellanox/mlxbf_gige/Makefile +@@ -3,7 +3,6 @@ + obj-$(CONFIG_MLXBF_GIGE) += mlxbf_gige.o + + mlxbf_gige-y := mlxbf_gige_ethtool.o \ +- mlxbf_gige_gpio.o \ + mlxbf_gige_intr.o \ + mlxbf_gige_main.o \ + mlxbf_gige_mdio.o \ +diff --git a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige.h b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige.h +index 3e8725b7f0b7..0fdf2c8ca480 100644 +--- a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige.h ++++ b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige.h +@@ -51,11 +51,6 @@ + #define MLXBF_GIGE_ERROR_INTR_IDX 0 + #define MLXBF_GIGE_RECEIVE_PKT_INTR_IDX 1 + #define MLXBF_GIGE_LLU_PLU_INTR_IDX 2 +-#define MLXBF_GIGE_PHY_INT_N 3 +- +-#define MLXBF_GIGE_MDIO_DEFAULT_PHY_ADDR 0x3 +- +-#define MLXBF_GIGE_DEFAULT_PHY_INT_GPIO 12 + + struct mlxbf_gige_stats { + u64 hw_access_errors; +@@ -82,11 +77,7 @@ struct mlxbf_gige { + void __iomem *mdio_io; + void __iomem *clk_io; + struct mii_bus *mdiobus; +- void __iomem *gpio_io; +- struct irq_domain *irqdomain; +- u32 phy_int_gpio_mask; + spinlock_t lock; /* for packet processing indices */ +- spinlock_t gpio_lock; /* for GPIO bus access */ + u16 rx_q_entries; + u16 tx_q_entries; + u64 *tx_wqe_base; +@@ -186,7 +177,4 @@ int mlxbf_gige_poll(struct napi_struct *napi, int budget); + extern const struct ethtool_ops mlxbf_gige_ethtool_ops; + void mlxbf_gige_update_tx_wqe_next(struct mlxbf_gige *priv); + +-int mlxbf_gige_gpio_init(struct platform_device *pdev, struct mlxbf_gige *priv); +-void mlxbf_gige_gpio_free(struct mlxbf_gige *priv); +- + #endif /* !defined(__MLXBF_GIGE_H__) */ +diff --git a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_gpio.c b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_gpio.c +deleted file mode 100644 +index a8d966db5715..000000000000 +--- a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_gpio.c ++++ /dev/null +@@ -1,212 +0,0 @@ +-// SPDX-License-Identifier: GPL-2.0-only OR BSD-3-Clause +- +-/* Initialize and handle GPIO interrupt triggered by INT_N PHY signal. +- * This GPIO interrupt triggers the PHY state machine to bring the link +- * up/down. +- * +- * Copyright (C) 2021 NVIDIA CORPORATION & AFFILIATES +- */ +- +-#include +-#include +-#include +-#include +-#include +-#include +-#include +-#include +-#include +-#include +-#include +-#include +- +-#include "mlxbf_gige.h" +-#include "mlxbf_gige_regs.h" +- +-#define MLXBF_GIGE_GPIO_CAUSE_FALL_EN 0x48 +-#define MLXBF_GIGE_GPIO_CAUSE_OR_CAUSE_EVTEN0 0x80 +-#define MLXBF_GIGE_GPIO_CAUSE_OR_EVTEN0 0x94 +-#define MLXBF_GIGE_GPIO_CAUSE_OR_CLRCAUSE 0x98 +- +-static void mlxbf_gige_gpio_enable(struct mlxbf_gige *priv) +-{ +- unsigned long flags; +- u32 val; +- +- spin_lock_irqsave(&priv->gpio_lock, flags); +- val = readl(priv->gpio_io + MLXBF_GIGE_GPIO_CAUSE_OR_CLRCAUSE); +- val |= priv->phy_int_gpio_mask; +- writel(val, priv->gpio_io + MLXBF_GIGE_GPIO_CAUSE_OR_CLRCAUSE); +- +- /* The INT_N interrupt level is active low. +- * So enable cause fall bit to detect when GPIO +- * state goes low. +- */ +- val = readl(priv->gpio_io + MLXBF_GIGE_GPIO_CAUSE_FALL_EN); +- val |= priv->phy_int_gpio_mask; +- writel(val, priv->gpio_io + MLXBF_GIGE_GPIO_CAUSE_FALL_EN); +- +- /* Enable PHY interrupt by setting the priority level */ +- val = readl(priv->gpio_io + MLXBF_GIGE_GPIO_CAUSE_OR_EVTEN0); +- val |= priv->phy_int_gpio_mask; +- writel(val, priv->gpio_io + MLXBF_GIGE_GPIO_CAUSE_OR_EVTEN0); +- spin_unlock_irqrestore(&priv->gpio_lock, flags); +-} +- +-static void mlxbf_gige_gpio_disable(struct mlxbf_gige *priv) +-{ +- unsigned long flags; +- u32 val; +- +- spin_lock_irqsave(&priv->gpio_lock, flags); +- val = readl(priv->gpio_io + MLXBF_GIGE_GPIO_CAUSE_OR_EVTEN0); +- val &= ~priv->phy_int_gpio_mask; +- writel(val, priv->gpio_io + MLXBF_GIGE_GPIO_CAUSE_OR_EVTEN0); +- spin_unlock_irqrestore(&priv->gpio_lock, flags); +-} +- +-static irqreturn_t mlxbf_gige_gpio_handler(int irq, void *ptr) +-{ +- struct mlxbf_gige *priv; +- u32 val; +- +- priv = ptr; +- +- /* Check if this interrupt is from PHY device. +- * Return if it is not. +- */ +- val = readl(priv->gpio_io + MLXBF_GIGE_GPIO_CAUSE_OR_CAUSE_EVTEN0); +- if (!(val & priv->phy_int_gpio_mask)) +- return IRQ_NONE; +- +- /* Clear interrupt when done, otherwise, no further interrupt +- * will be triggered. +- */ +- val = readl(priv->gpio_io + MLXBF_GIGE_GPIO_CAUSE_OR_CLRCAUSE); +- val |= priv->phy_int_gpio_mask; +- writel(val, priv->gpio_io + MLXBF_GIGE_GPIO_CAUSE_OR_CLRCAUSE); +- +- generic_handle_irq(priv->phy_irq); +- +- return IRQ_HANDLED; +-} +- +-static void mlxbf_gige_gpio_mask(struct irq_data *irqd) +-{ +- struct mlxbf_gige *priv = irq_data_get_irq_chip_data(irqd); +- +- mlxbf_gige_gpio_disable(priv); +-} +- +-static void mlxbf_gige_gpio_unmask(struct irq_data *irqd) +-{ +- struct mlxbf_gige *priv = irq_data_get_irq_chip_data(irqd); +- +- mlxbf_gige_gpio_enable(priv); +-} +- +-static struct irq_chip mlxbf_gige_gpio_chip = { +- .name = "mlxbf_gige_phy", +- .irq_mask = mlxbf_gige_gpio_mask, +- .irq_unmask = mlxbf_gige_gpio_unmask, +-}; +- +-static int mlxbf_gige_gpio_domain_map(struct irq_domain *d, +- unsigned int irq, +- irq_hw_number_t hwirq) +-{ +- irq_set_chip_data(irq, d->host_data); +- irq_set_chip_and_handler(irq, &mlxbf_gige_gpio_chip, handle_simple_irq); +- irq_set_noprobe(irq); +- +- return 0; +-} +- +-static const struct irq_domain_ops mlxbf_gige_gpio_domain_ops = { +- .map = mlxbf_gige_gpio_domain_map, +- .xlate = irq_domain_xlate_twocell, +-}; +- +-#ifdef CONFIG_ACPI +-static int mlxbf_gige_gpio_resources(struct acpi_resource *ares, +- void *data) +-{ +- struct acpi_resource_gpio *gpio; +- u32 *phy_int_gpio = data; +- +- if (ares->type == ACPI_RESOURCE_TYPE_GPIO) { +- gpio = &ares->data.gpio; +- *phy_int_gpio = gpio->pin_table[0]; +- } +- +- return 1; +-} +-#endif +- +-void mlxbf_gige_gpio_free(struct mlxbf_gige *priv) +-{ +- irq_dispose_mapping(priv->phy_irq); +- irq_domain_remove(priv->irqdomain); +-} +- +-int mlxbf_gige_gpio_init(struct platform_device *pdev, +- struct mlxbf_gige *priv) +-{ +- struct device *dev = &pdev->dev; +- struct resource *res; +- u32 phy_int_gpio = 0; +- int ret; +- +- LIST_HEAD(resources); +- +- res = platform_get_resource(pdev, IORESOURCE_MEM, MLXBF_GIGE_RES_GPIO0); +- if (!res) +- return -ENODEV; +- +- priv->gpio_io = devm_ioremap(dev, res->start, resource_size(res)); +- if (!priv->gpio_io) +- return -ENOMEM; +- +-#ifdef CONFIG_ACPI +- ret = acpi_dev_get_resources(ACPI_COMPANION(dev), +- &resources, mlxbf_gige_gpio_resources, +- &phy_int_gpio); +- acpi_dev_free_resource_list(&resources); +- if (ret < 0 || !phy_int_gpio) { +- dev_err(dev, "Error retrieving the gpio phy pin"); +- return -EINVAL; +- } +-#endif +- +- priv->phy_int_gpio_mask = BIT(phy_int_gpio); +- +- mlxbf_gige_gpio_disable(priv); +- +- priv->hw_phy_irq = platform_get_irq(pdev, MLXBF_GIGE_PHY_INT_N); +- +- priv->irqdomain = irq_domain_add_simple(NULL, 1, 0, +- &mlxbf_gige_gpio_domain_ops, +- priv); +- if (!priv->irqdomain) { +- dev_err(dev, "Failed to add IRQ domain\n"); +- return -ENOMEM; +- } +- +- priv->phy_irq = irq_create_mapping(priv->irqdomain, 0); +- if (!priv->phy_irq) { +- irq_domain_remove(priv->irqdomain); +- priv->irqdomain = NULL; +- dev_err(dev, "Error mapping PHY IRQ\n"); +- return -EINVAL; +- } +- +- ret = devm_request_irq(dev, priv->hw_phy_irq, mlxbf_gige_gpio_handler, +- IRQF_ONESHOT | IRQF_SHARED, "mlxbf_gige_phy", priv); +- if (ret) { +- dev_err(dev, "Failed to request PHY IRQ"); +- mlxbf_gige_gpio_free(priv); +- return ret; +- } +- +- return ret; +-} +diff --git a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c +index 2cbe0daafd41..181a0845a105 100644 +--- a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c ++++ b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c +@@ -280,8 +280,8 @@ static int mlxbf_gige_probe(struct platform_device *pdev) + void __iomem *llu_base; + void __iomem *plu_base; + void __iomem *base; ++ int addr, phy_irq; + u64 control; +- int addr; + int err; + + base = devm_platform_ioremap_resource(pdev, MLXBF_GIGE_RES_MAC); +@@ -316,20 +316,12 @@ static int mlxbf_gige_probe(struct platform_device *pdev) + priv->pdev = pdev; + + spin_lock_init(&priv->lock); +- spin_lock_init(&priv->gpio_lock); + + /* Attach MDIO device */ + err = mlxbf_gige_mdio_probe(pdev, priv); + if (err) + return err; + +- err = mlxbf_gige_gpio_init(pdev, priv); +- if (err) { +- dev_err(&pdev->dev, "PHY IRQ initialization failed\n"); +- mlxbf_gige_mdio_remove(priv); +- return -ENODEV; +- } +- + priv->base = base; + priv->llu_base = llu_base; + priv->plu_base = plu_base; +@@ -350,6 +342,12 @@ static int mlxbf_gige_probe(struct platform_device *pdev) + priv->rx_irq = platform_get_irq(pdev, MLXBF_GIGE_RECEIVE_PKT_INTR_IDX); + priv->llu_plu_irq = platform_get_irq(pdev, MLXBF_GIGE_LLU_PLU_INTR_IDX); + ++ phy_irq = acpi_dev_gpio_irq_get_by(ACPI_COMPANION(&pdev->dev), "phy-gpios", 0); ++ if (phy_irq < 0) { ++ dev_err(&pdev->dev, "Error getting PHY irq. Use polling instead"); ++ phy_irq = PHY_POLL; ++ } ++ + phydev = phy_find_first(priv->mdiobus); + if (!phydev) { + err = -ENODEV; +@@ -357,8 +355,8 @@ static int mlxbf_gige_probe(struct platform_device *pdev) + } + + addr = phydev->mdio.addr; +- priv->mdiobus->irq[addr] = priv->phy_irq; +- phydev->irq = priv->phy_irq; ++ priv->mdiobus->irq[addr] = phy_irq; ++ phydev->irq = phy_irq; + + err = phy_connect_direct(netdev, phydev, + mlxbf_gige_adjust_link, +@@ -394,7 +392,6 @@ static int mlxbf_gige_probe(struct platform_device *pdev) + return 0; + + out: +- mlxbf_gige_gpio_free(priv); + mlxbf_gige_mdio_remove(priv); + return err; + } +@@ -405,7 +402,6 @@ static int mlxbf_gige_remove(struct platform_device *pdev) + + unregister_netdev(priv->netdev); + phy_disconnect(priv->netdev->phydev); +- mlxbf_gige_gpio_free(priv); + mlxbf_gige_mdio_remove(priv); + platform_set_drvdata(pdev, NULL); + +-- +2.43.0 + diff --git a/queue-5.15/net-ncsi-fix-netlink-major-minor-version-numbers.patch b/queue-5.15/net-ncsi-fix-netlink-major-minor-version-numbers.patch new file mode 100644 index 00000000000..1174b8220a7 --- /dev/null +++ b/queue-5.15/net-ncsi-fix-netlink-major-minor-version-numbers.patch @@ -0,0 +1,202 @@ +From c5cab63957044a8870177c42fe6fe427526d6ec2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Nov 2023 10:07:34 -0600 +Subject: net/ncsi: Fix netlink major/minor version numbers + +From: Peter Delevoryas + +[ Upstream commit 3084b58bfd0b9e4b5e034f31f31b42977db35f12 ] + +The netlink interface for major and minor version numbers doesn't actually +return the major and minor version numbers. + +It reports a u32 that contains the (major, minor, update, alpha1) +components as the major version number, and then alpha2 as the minor +version number. + +For whatever reason, the u32 byte order was reversed (ntohl): maybe it was +assumed that the encoded value was a single big-endian u32, and alpha2 was +the minor version. + +The correct way to get the supported NC-SI version from the network +controller is to parse the Get Version ID response as described in 8.4.44 +of the NC-SI spec[1]. + + Get Version ID Response Packet Format + + Bits + +--------+--------+--------+--------+ + Bytes | 31..24 | 23..16 | 15..8 | 7..0 | + +-------+--------+--------+--------+--------+ + | 0..15 | NC-SI Header | + +-------+--------+--------+--------+--------+ + | 16..19| Response code | Reason code | + +-------+--------+--------+--------+--------+ + |20..23 | Major | Minor | Update | Alpha1 | + +-------+--------+--------+--------+--------+ + |24..27 | reserved | Alpha2 | + +-------+--------+--------+--------+--------+ + | .... other stuff .... | + +The major, minor, and update fields are all binary-coded decimal (BCD) +encoded [2]. The spec provides examples below the Get Version ID response +format in section 8.4.44.1, but for practical purposes, this is an example +from a live network card: + + root@bmc:~# ncsi-util 0x15 + NC-SI Command Response: + cmd: GET_VERSION_ID(0x15) + Response: COMMAND_COMPLETED(0x0000) Reason: NO_ERROR(0x0000) + Payload length = 40 + + 20: 0xf1 0xf1 0xf0 0x00 <<<<<<<<< (major, minor, update, alpha1) + 24: 0x00 0x00 0x00 0x00 <<<<<<<<< (_, _, _, alpha2) + + 28: 0x6d 0x6c 0x78 0x30 + 32: 0x2e 0x31 0x00 0x00 + 36: 0x00 0x00 0x00 0x00 + 40: 0x16 0x1d 0x07 0xd2 + 44: 0x10 0x1d 0x15 0xb3 + 48: 0x00 0x17 0x15 0xb3 + 52: 0x00 0x00 0x81 0x19 + +This should be parsed as "1.1.0". + +"f" in the upper-nibble means to ignore it, contributing zero. + +If both nibbles are "f", I think the whole field is supposed to be ignored. +Major and minor are "required", meaning they're not supposed to be "ff", +but the update field is "optional" so I think it can be ff. I think the +simplest thing to do is just set the major and minor to zero instead of +juggling some conditional logic or something. + +bcd2bin() from "include/linux/bcd.h" seems to assume both nibbles are 0-9, +so I've provided a custom BCD decoding function. + +Alpha1 and alpha2 are ISO/IEC 8859-1 encoded, which just means ASCII +characters as far as I can tell, although the full encoding table for +non-alphabetic characters is slightly different (I think). + +I imagine the alpha fields are just supposed to be alphabetic characters, +but I haven't seen any network cards actually report a non-zero value for +either. + +If people wrote software against this netlink behavior, and were parsing +the major and minor versions themselves from the u32, then this would +definitely break their code. + +[1] https://www.dmtf.org/sites/default/files/standards/documents/DSP0222_1.0.0.pdf +[2] https://en.wikipedia.org/wiki/Binary-coded_decimal +[2] https://en.wikipedia.org/wiki/ISO/IEC_8859-1 + +Signed-off-by: Peter Delevoryas +Fixes: 138635cc27c9 ("net/ncsi: NCSI response packet handler") +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ncsi/internal.h | 7 +++++-- + net/ncsi/ncsi-netlink.c | 4 ++-- + net/ncsi/ncsi-pkt.h | 7 +++++-- + net/ncsi/ncsi-rsp.c | 26 ++++++++++++++++++++++++-- + 4 files changed, 36 insertions(+), 8 deletions(-) + +diff --git a/net/ncsi/internal.h b/net/ncsi/internal.h +index 03757e76bb6b..374412ed780b 100644 +--- a/net/ncsi/internal.h ++++ b/net/ncsi/internal.h +@@ -105,8 +105,11 @@ enum { + + + struct ncsi_channel_version { +- u32 version; /* Supported BCD encoded NCSI version */ +- u32 alpha2; /* Supported BCD encoded NCSI version */ ++ u8 major; /* NCSI version major */ ++ u8 minor; /* NCSI version minor */ ++ u8 update; /* NCSI version update */ ++ char alpha1; /* NCSI version alpha1 */ ++ char alpha2; /* NCSI version alpha2 */ + u8 fw_name[12]; /* Firmware name string */ + u32 fw_version; /* Firmware version */ + u16 pci_ids[4]; /* PCI identification */ +diff --git a/net/ncsi/ncsi-netlink.c b/net/ncsi/ncsi-netlink.c +index c189b4c8a182..db350b8f5d88 100644 +--- a/net/ncsi/ncsi-netlink.c ++++ b/net/ncsi/ncsi-netlink.c +@@ -71,8 +71,8 @@ static int ncsi_write_channel_info(struct sk_buff *skb, + if (nc == nc->package->preferred_channel) + nla_put_flag(skb, NCSI_CHANNEL_ATTR_FORCED); + +- nla_put_u32(skb, NCSI_CHANNEL_ATTR_VERSION_MAJOR, nc->version.version); +- nla_put_u32(skb, NCSI_CHANNEL_ATTR_VERSION_MINOR, nc->version.alpha2); ++ nla_put_u32(skb, NCSI_CHANNEL_ATTR_VERSION_MAJOR, nc->version.major); ++ nla_put_u32(skb, NCSI_CHANNEL_ATTR_VERSION_MINOR, nc->version.minor); + nla_put_string(skb, NCSI_CHANNEL_ATTR_VERSION_STR, nc->version.fw_name); + + vid_nest = nla_nest_start_noflag(skb, NCSI_CHANNEL_ATTR_VLAN_LIST); +diff --git a/net/ncsi/ncsi-pkt.h b/net/ncsi/ncsi-pkt.h +index ba66c7dc3a21..c9d1da34dc4d 100644 +--- a/net/ncsi/ncsi-pkt.h ++++ b/net/ncsi/ncsi-pkt.h +@@ -197,9 +197,12 @@ struct ncsi_rsp_gls_pkt { + /* Get Version ID */ + struct ncsi_rsp_gvi_pkt { + struct ncsi_rsp_pkt_hdr rsp; /* Response header */ +- __be32 ncsi_version; /* NCSI version */ ++ unsigned char major; /* NCSI version major */ ++ unsigned char minor; /* NCSI version minor */ ++ unsigned char update; /* NCSI version update */ ++ unsigned char alpha1; /* NCSI version alpha1 */ + unsigned char reserved[3]; /* Reserved */ +- unsigned char alpha2; /* NCSI version */ ++ unsigned char alpha2; /* NCSI version alpha2 */ + unsigned char fw_name[12]; /* f/w name string */ + __be32 fw_version; /* f/w version */ + __be16 pci_ids[4]; /* PCI IDs */ +diff --git a/net/ncsi/ncsi-rsp.c b/net/ncsi/ncsi-rsp.c +index 069c2659074b..480e80e3c283 100644 +--- a/net/ncsi/ncsi-rsp.c ++++ b/net/ncsi/ncsi-rsp.c +@@ -19,6 +19,19 @@ + #include "ncsi-pkt.h" + #include "ncsi-netlink.h" + ++/* Nibbles within [0xA, 0xF] add zero "0" to the returned value. ++ * Optional fields (encoded as 0xFF) will default to zero. ++ */ ++static u8 decode_bcd_u8(u8 x) ++{ ++ int lo = x & 0xF; ++ int hi = x >> 4; ++ ++ lo = lo < 0xA ? lo : 0; ++ hi = hi < 0xA ? hi : 0; ++ return lo + hi * 10; ++} ++ + static int ncsi_validate_rsp_pkt(struct ncsi_request *nr, + unsigned short payload) + { +@@ -755,9 +768,18 @@ static int ncsi_rsp_handler_gvi(struct ncsi_request *nr) + if (!nc) + return -ENODEV; + +- /* Update to channel's version info */ ++ /* Update channel's version info ++ * ++ * Major, minor, and update fields are supposed to be ++ * unsigned integers encoded as packed BCD. ++ * ++ * Alpha1 and alpha2 are ISO/IEC 8859-1 characters. ++ */ + ncv = &nc->version; +- ncv->version = ntohl(rsp->ncsi_version); ++ ncv->major = decode_bcd_u8(rsp->major); ++ ncv->minor = decode_bcd_u8(rsp->minor); ++ ncv->update = decode_bcd_u8(rsp->update); ++ ncv->alpha1 = rsp->alpha1; + ncv->alpha2 = rsp->alpha2; + memcpy(ncv->fw_name, rsp->fw_name, 12); + ncv->fw_version = ntohl(rsp->fw_version); +-- +2.43.0 + diff --git a/queue-5.15/net-sched-act_ct-fix-skb-leak-and-crash-on-ooo-frags.patch b/queue-5.15/net-sched-act_ct-fix-skb-leak-and-crash-on-ooo-frags.patch new file mode 100644 index 00000000000..57a5968de9b --- /dev/null +++ b/queue-5.15/net-sched-act_ct-fix-skb-leak-and-crash-on-ooo-frags.patch @@ -0,0 +1,149 @@ +From e7b24298f5e8afe75ea3bbf6b6ccc38844c610b9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Dec 2023 16:14:57 +0800 +Subject: net/sched: act_ct: fix skb leak and crash on ooo frags + +From: Tao Liu + +[ Upstream commit 3f14b377d01d8357eba032b4cabc8c1149b458b6 ] + +act_ct adds skb->users before defragmentation. If frags arrive in order, +the last frag's reference is reset in: + + inet_frag_reasm_prepare + skb_morph + +which is not straightforward. + +However when frags arrive out of order, nobody unref the last frag, and +all frags are leaked. The situation is even worse, as initiating packet +capture can lead to a crash[0] when skb has been cloned and shared at the +same time. + +Fix the issue by removing skb_get() before defragmentation. act_ct +returns TC_ACT_CONSUMED when defrag failed or in progress. + +[0]: +[ 843.804823] ------------[ cut here ]------------ +[ 843.809659] kernel BUG at net/core/skbuff.c:2091! +[ 843.814516] invalid opcode: 0000 [#1] PREEMPT SMP +[ 843.819296] CPU: 7 PID: 0 Comm: swapper/7 Kdump: loaded Tainted: G S 6.7.0-rc3 #2 +[ 843.824107] Hardware name: XFUSION 1288H V6/BC13MBSBD, BIOS 1.29 11/25/2022 +[ 843.828953] RIP: 0010:pskb_expand_head+0x2ac/0x300 +[ 843.833805] Code: 8b 70 28 48 85 f6 74 82 48 83 c6 08 bf 01 00 00 00 e8 38 bd ff ff 8b 83 c0 00 00 00 48 03 83 c8 00 00 00 e9 62 ff ff ff 0f 0b <0f> 0b e8 8d d0 ff ff e9 b3 fd ff ff 81 7c 24 14 40 01 00 00 4c 89 +[ 843.843698] RSP: 0018:ffffc9000cce07c0 EFLAGS: 00010202 +[ 843.848524] RAX: 0000000000000002 RBX: ffff88811a211d00 RCX: 0000000000000820 +[ 843.853299] RDX: 0000000000000640 RSI: 0000000000000000 RDI: ffff88811a211d00 +[ 843.857974] RBP: ffff888127d39518 R08: 00000000bee97314 R09: 0000000000000000 +[ 843.862584] R10: 0000000000000000 R11: ffff8881109f0000 R12: 0000000000000880 +[ 843.867147] R13: ffff888127d39580 R14: 0000000000000640 R15: ffff888170f7b900 +[ 843.871680] FS: 0000000000000000(0000) GS:ffff889ffffc0000(0000) knlGS:0000000000000000 +[ 843.876242] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 843.880778] CR2: 00007fa42affcfb8 CR3: 000000011433a002 CR4: 0000000000770ef0 +[ 843.885336] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +[ 843.889809] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +[ 843.894229] PKRU: 55555554 +[ 843.898539] Call Trace: +[ 843.902772] +[ 843.906922] ? __die_body+0x1e/0x60 +[ 843.911032] ? die+0x3c/0x60 +[ 843.915037] ? do_trap+0xe2/0x110 +[ 843.918911] ? pskb_expand_head+0x2ac/0x300 +[ 843.922687] ? do_error_trap+0x65/0x80 +[ 843.926342] ? pskb_expand_head+0x2ac/0x300 +[ 843.929905] ? exc_invalid_op+0x50/0x60 +[ 843.933398] ? pskb_expand_head+0x2ac/0x300 +[ 843.936835] ? asm_exc_invalid_op+0x1a/0x20 +[ 843.940226] ? pskb_expand_head+0x2ac/0x300 +[ 843.943580] inet_frag_reasm_prepare+0xd1/0x240 +[ 843.946904] ip_defrag+0x5d4/0x870 +[ 843.950132] nf_ct_handle_fragments+0xec/0x130 [nf_conntrack] +[ 843.953334] tcf_ct_act+0x252/0xd90 [act_ct] +[ 843.956473] ? tcf_mirred_act+0x516/0x5a0 [act_mirred] +[ 843.959657] tcf_action_exec+0xa1/0x160 +[ 843.962823] fl_classify+0x1db/0x1f0 [cls_flower] +[ 843.966010] ? skb_clone+0x53/0xc0 +[ 843.969173] tcf_classify+0x24d/0x420 +[ 843.972333] tc_run+0x8f/0xf0 +[ 843.975465] __netif_receive_skb_core+0x67a/0x1080 +[ 843.978634] ? dev_gro_receive+0x249/0x730 +[ 843.981759] __netif_receive_skb_list_core+0x12d/0x260 +[ 843.984869] netif_receive_skb_list_internal+0x1cb/0x2f0 +[ 843.987957] ? mlx5e_handle_rx_cqe_mpwrq_rep+0xfa/0x1a0 [mlx5_core] +[ 843.991170] napi_complete_done+0x72/0x1a0 +[ 843.994305] mlx5e_napi_poll+0x28c/0x6d0 [mlx5_core] +[ 843.997501] __napi_poll+0x25/0x1b0 +[ 844.000627] net_rx_action+0x256/0x330 +[ 844.003705] __do_softirq+0xb3/0x29b +[ 844.006718] irq_exit_rcu+0x9e/0xc0 +[ 844.009672] common_interrupt+0x86/0xa0 +[ 844.012537] +[ 844.015285] +[ 844.017937] asm_common_interrupt+0x26/0x40 +[ 844.020591] RIP: 0010:acpi_safe_halt+0x1b/0x20 +[ 844.023247] Code: ff 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 65 48 8b 04 25 00 18 03 00 48 8b 00 a8 08 75 0c 66 90 0f 00 2d 81 d0 44 00 fb f4 c3 0f 1f 00 89 fa ec 48 8b 05 ee 88 ed 00 a9 00 00 00 80 75 11 +[ 844.028900] RSP: 0018:ffffc90000533e70 EFLAGS: 00000246 +[ 844.031725] RAX: 0000000000004000 RBX: 0000000000000001 RCX: 0000000000000000 +[ 844.034553] RDX: ffff889ffffc0000 RSI: ffffffff828b7f20 RDI: ffff88a090f45c64 +[ 844.037368] RBP: ffff88a0901a2800 R08: ffff88a090f45c00 R09: 00000000000317c0 +[ 844.040155] R10: 00ec812281150475 R11: ffff889fffff0e04 R12: ffffffff828b7fa0 +[ 844.042962] R13: ffffffff828b7f20 R14: 0000000000000001 R15: 0000000000000000 +[ 844.045819] acpi_idle_enter+0x7b/0xc0 +[ 844.048621] cpuidle_enter_state+0x7f/0x430 +[ 844.051451] cpuidle_enter+0x2d/0x40 +[ 844.054279] do_idle+0x1d4/0x240 +[ 844.057096] cpu_startup_entry+0x2a/0x30 +[ 844.059934] start_secondary+0x104/0x130 +[ 844.062787] secondary_startup_64_no_verify+0x16b/0x16b +[ 844.065674] + +Fixes: b57dc7c13ea9 ("net/sched: Introduce action ct") +Signed-off-by: Tao Liu +Link: https://lore.kernel.org/r/20231228081457.936732-1-taoliu828@163.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/sched/act_ct.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/net/sched/act_ct.c b/net/sched/act_ct.c +index 81a2d6cbfb44..b4c42b257ae7 100644 +--- a/net/sched/act_ct.c ++++ b/net/sched/act_ct.c +@@ -705,7 +705,6 @@ static int tcf_ct_handle_fragments(struct net *net, struct sk_buff *skb, + if (err || !frag) + return err; + +- skb_get(skb); + mru = tc_skb_cb(skb)->mru; + + if (family == NFPROTO_IPV4) { +@@ -987,12 +986,8 @@ static int tcf_ct_act(struct sk_buff *skb, const struct tc_action *a, + nh_ofs = skb_network_offset(skb); + skb_pull_rcsum(skb, nh_ofs); + err = tcf_ct_handle_fragments(net, skb, family, p->zone, &defrag); +- if (err == -EINPROGRESS) { +- retval = TC_ACT_STOLEN; +- goto out_clear; +- } + if (err) +- goto drop; ++ goto out_frag; + + err = tcf_ct_skb_network_trim(skb, family); + if (err) +@@ -1059,6 +1054,11 @@ static int tcf_ct_act(struct sk_buff *skb, const struct tc_action *a, + qdisc_skb_cb(skb)->pkt_len = skb->len; + return retval; + ++out_frag: ++ if (err != -EINPROGRESS) ++ tcf_action_inc_drop_qstats(&c->common); ++ return TC_ACT_CONSUMED; ++ + drop: + tcf_action_inc_drop_qstats(&c->common); + return TC_ACT_SHOT; +-- +2.43.0 + diff --git a/queue-5.15/netfilter-nf_tables-mark-newset-as-dead-on-transacti.patch b/queue-5.15/netfilter-nf_tables-mark-newset-as-dead-on-transacti.patch new file mode 100644 index 00000000000..1ca0396941d --- /dev/null +++ b/queue-5.15/netfilter-nf_tables-mark-newset-as-dead-on-transacti.patch @@ -0,0 +1,50 @@ +From ff2f2ae2febaa57e183cbd3a6a33ae71f493935f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Nov 2023 11:00:37 +0100 +Subject: netfilter: nf_tables: mark newset as dead on transaction abort + +From: Florian Westphal + +[ Upstream commit 08e4c8c5919fd405a4d709b4ba43d836894a26eb ] + +If a transaction is aborted, we should mark the to-be-released NEWSET dead, +just like commit path does for DEL and DESTROYSET commands. + +In both cases all remaining elements will be released via +set->ops->destroy(). + +The existing abort code does NOT post the actual release to the work queue. +Also the entire __nf_tables_abort() function is wrapped in gc_seq +begin/end pair. + +Therefore, async gc worker will never try to release the pending set +elements, as gc sequence is always stale. + +It might be possible to speed up transaction aborts via work queue too, +this would result in a race and a possible use-after-free. + +So fix this before it becomes an issue. + +Fixes: 5f68718b34a5 ("netfilter: nf_tables: GC transaction API to avoid race with control plane") +Signed-off-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_tables_api.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index 3556818c7162..5fb8c7f0ad02 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -9740,6 +9740,7 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action) + nft_trans_destroy(trans); + break; + } ++ nft_trans_set(trans)->dead = 1; + list_del_rcu(&nft_trans_set(trans)->list); + break; + case NFT_MSG_DELSET: +-- +2.43.0 + diff --git a/queue-5.15/nfsv4.1-pnfs-ensure-we-handle-the-error-nfs4err_retu.patch b/queue-5.15/nfsv4.1-pnfs-ensure-we-handle-the-error-nfs4err_retu.patch new file mode 100644 index 00000000000..68922d2dbfe --- /dev/null +++ b/queue-5.15/nfsv4.1-pnfs-ensure-we-handle-the-error-nfs4err_retu.patch @@ -0,0 +1,53 @@ +From e813628ed65a77fd3b10c380d9ca47a81e00fd91 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Nov 2023 13:55:29 -0500 +Subject: NFSv4.1/pnfs: Ensure we handle the error NFS4ERR_RETURNCONFLICT + +From: Trond Myklebust + +[ Upstream commit 037e56a22ff37f9a9c2330b66cff55d3d1ff9b90 ] + +Once the client has processed the CB_LAYOUTRECALL, but has not yet +successfully returned the layout, the server is supposed to switch to +returning NFS4ERR_RETURNCONFLICT. This patch ensures that we handle +that return value correctly. + +Fixes: 183d9e7b112a ("pnfs: rework LAYOUTGET retry handling") +Signed-off-by: Trond Myklebust +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs4proc.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c +index d65af9a60c35..a865b384f0fc 100644 +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -173,6 +173,7 @@ static int nfs4_map_errors(int err) + case -NFS4ERR_RESOURCE: + case -NFS4ERR_LAYOUTTRYLATER: + case -NFS4ERR_RECALLCONFLICT: ++ case -NFS4ERR_RETURNCONFLICT: + return -EREMOTEIO; + case -NFS4ERR_WRONGSEC: + case -NFS4ERR_WRONG_CRED: +@@ -560,6 +561,7 @@ static int nfs4_do_handle_exception(struct nfs_server *server, + case -NFS4ERR_GRACE: + case -NFS4ERR_LAYOUTTRYLATER: + case -NFS4ERR_RECALLCONFLICT: ++ case -NFS4ERR_RETURNCONFLICT: + exception->delay = 1; + return 0; + +@@ -9588,6 +9590,7 @@ nfs4_layoutget_handle_exception(struct rpc_task *task, + status = -EBUSY; + break; + case -NFS4ERR_RECALLCONFLICT: ++ case -NFS4ERR_RETURNCONFLICT: + status = -ERECALLCONFLICT; + break; + case -NFS4ERR_DELEG_REVOKED: +-- +2.43.0 + diff --git a/queue-5.15/null_blk-don-t-cap-max_hw_sectors-to-blk_def_max_sec.patch b/queue-5.15/null_blk-don-t-cap-max_hw_sectors-to-blk_def_max_sec.patch new file mode 100644 index 00000000000..5115fe02ae7 --- /dev/null +++ b/queue-5.15/null_blk-don-t-cap-max_hw_sectors-to-blk_def_max_sec.patch @@ -0,0 +1,59 @@ +From d51dea2d2b407869bfc0183186f65350bb0529ff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Dec 2023 09:23:02 +0000 +Subject: null_blk: don't cap max_hw_sectors to BLK_DEF_MAX_SECTORS + +From: Christoph Hellwig + +[ Upstream commit 9a9525de865410047fa962867b4fcd33943b206f ] + +null_blk has some rather odd capping of the max_hw_sectors value to +BLK_DEF_MAX_SECTORS, which doesn't make sense - max_hw_sector is the +hardware limit, and BLK_DEF_MAX_SECTORS despite the confusing name is the +default cap for the max_sectors field used for normal file system I/O. + +Remove all the capping, and simply leave it to the block layer or +user to take up or not all of that for file system I/O. + +Fixes: ea17fd354ca8 ("null_blk: Allow controlling max_hw_sectors limit") +Signed-off-by: Christoph Hellwig +Link: https://lore.kernel.org/r/20231227092305.279567-2-hch@lst.de +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/null_blk/main.c | 12 ++---------- + 1 file changed, 2 insertions(+), 10 deletions(-) + +diff --git a/drivers/block/null_blk/main.c b/drivers/block/null_blk/main.c +index 4a867233b14a..87791265e09b 100644 +--- a/drivers/block/null_blk/main.c ++++ b/drivers/block/null_blk/main.c +@@ -1900,10 +1900,8 @@ static int null_add_dev(struct nullb_device *dev) + + blk_queue_logical_block_size(nullb->q, dev->blocksize); + blk_queue_physical_block_size(nullb->q, dev->blocksize); +- if (!dev->max_sectors) +- dev->max_sectors = queue_max_hw_sectors(nullb->q); +- dev->max_sectors = min(dev->max_sectors, BLK_DEF_MAX_SECTORS); +- blk_queue_max_hw_sectors(nullb->q, dev->max_sectors); ++ if (dev->max_sectors) ++ blk_queue_max_hw_sectors(nullb->q, dev->max_sectors); + + if (dev->virt_boundary) + blk_queue_virt_boundary(nullb->q, PAGE_SIZE - 1); +@@ -1953,12 +1951,6 @@ static int __init null_init(void) + g_bs = PAGE_SIZE; + } + +- if (g_max_sectors > BLK_DEF_MAX_SECTORS) { +- pr_warn("invalid max sectors\n"); +- pr_warn("defaults max sectors to %u\n", BLK_DEF_MAX_SECTORS); +- g_max_sectors = BLK_DEF_MAX_SECTORS; +- } +- + if (g_home_node != NUMA_NO_NODE && g_home_node >= nr_online_nodes) { + pr_err("invalid home_node value\n"); + g_home_node = NUMA_NO_NODE; +-- +2.43.0 + diff --git a/queue-5.15/of-add-of_property_present-helper.patch b/queue-5.15/of-add-of_property_present-helper.patch new file mode 100644 index 00000000000..ea82356ac7c --- /dev/null +++ b/queue-5.15/of-add-of_property_present-helper.patch @@ -0,0 +1,61 @@ +From 58e1f9fee60d9c778f33ff9454fc35cd6fd00b73 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Feb 2023 15:35:01 -0600 +Subject: of: Add of_property_present() helper + +From: Rob Herring + +[ Upstream commit 9cbad37ce8122de32a1529e394b468bc101c9e7f ] + +Add an of_property_present() function similar to +fwnode_property_present(). of_property_read_bool() could be used +directly, but it is cleaner to not use it on non-boolean properties. + +Reviewed-by: Frank Rowand +Tested-by: Frank Rowand +Link: https://lore.kernel.org/all/20230215215547.691573-1-robh@kernel.org/ +Signed-off-by: Rob Herring +Stable-dep-of: c4a5118a3ae1 ("cpufreq: scmi: process the result of devm_of_clk_add_hw_provider()") +Signed-off-by: Sasha Levin +--- + include/linux/of.h | 17 ++++++++++++++++- + 1 file changed, 16 insertions(+), 1 deletion(-) + +diff --git a/include/linux/of.h b/include/linux/of.h +index 4403e8fc764a..29f657101f4f 100644 +--- a/include/linux/of.h ++++ b/include/linux/of.h +@@ -1073,7 +1073,8 @@ static inline int of_property_read_string_index(const struct device_node *np, + * @np: device node from which the property value is to be read. + * @propname: name of the property to be searched. + * +- * Search for a property in a device node. ++ * Search for a boolean property in a device node. Usage on non-boolean ++ * property types is deprecated. + * + * Return: true if the property exists false otherwise. + */ +@@ -1085,6 +1086,20 @@ static inline bool of_property_read_bool(const struct device_node *np, + return prop ? true : false; + } + ++/** ++ * of_property_present - Test if a property is present in a node ++ * @np: device node to search for the property. ++ * @propname: name of the property to be searched. ++ * ++ * Test for a property present in a device node. ++ * ++ * Return: true if the property exists false otherwise. ++ */ ++static inline bool of_property_present(const struct device_node *np, const char *propname) ++{ ++ return of_property_read_bool(np, propname); ++} ++ + /** + * of_property_read_u8_array - Find and read an array of u8 from a property. + * +-- +2.43.0 + diff --git a/queue-5.15/of-fix-double-free-in-of_parse_phandle_with_args_map.patch b/queue-5.15/of-fix-double-free-in-of_parse_phandle_with_args_map.patch new file mode 100644 index 00000000000..c51f4bff2d1 --- /dev/null +++ b/queue-5.15/of-fix-double-free-in-of_parse_phandle_with_args_map.patch @@ -0,0 +1,231 @@ +From 09184555fb55d9e0963f62ce726ec332205e18ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Dec 2023 11:54:11 +0100 +Subject: of: Fix double free in of_parse_phandle_with_args_map + +From: Christian A. Ehrhardt + +[ Upstream commit 4dde83569832f9377362e50f7748463340c5db6b ] + +In of_parse_phandle_with_args_map() the inner loop that +iterates through the map entries calls of_node_put(new) +to free the reference acquired by the previous iteration +of the inner loop. This assumes that the value of "new" is +NULL on the first iteration of the inner loop. + +Make sure that this is true in all iterations of the outer +loop by setting "new" to NULL after its value is assigned to "cur". + +Extend the unittest to detect the double free and add an additional +test case that actually triggers this path. + +Fixes: bd6f2fd5a1 ("of: Support parsing phandle argument lists through a nexus node") +Cc: Stephen Boyd +Signed-off-by: "Christian A. Ehrhardt" +Link: https://lore.kernel.org/r/20231229105411.1603434-1-lk@c--e.de +Signed-off-by: Rob Herring +Signed-off-by: Sasha Levin +--- + drivers/of/base.c | 1 + + drivers/of/unittest-data/tests-phandle.dtsi | 10 ++- + drivers/of/unittest.c | 74 ++++++++++++--------- + 3 files changed, 53 insertions(+), 32 deletions(-) + +diff --git a/drivers/of/base.c b/drivers/of/base.c +index 54719f8156ed..bc5abe650c5c 100644 +--- a/drivers/of/base.c ++++ b/drivers/of/base.c +@@ -1669,6 +1669,7 @@ int of_parse_phandle_with_args_map(const struct device_node *np, + out_args->np = new; + of_node_put(cur); + cur = new; ++ new = NULL; + } + put: + of_node_put(cur); +diff --git a/drivers/of/unittest-data/tests-phandle.dtsi b/drivers/of/unittest-data/tests-phandle.dtsi +index 6b33be4c4416..aa0d7027ffa6 100644 +--- a/drivers/of/unittest-data/tests-phandle.dtsi ++++ b/drivers/of/unittest-data/tests-phandle.dtsi +@@ -38,6 +38,13 @@ provider4: provider4 { + phandle-map-pass-thru = <0x0 0xf0>; + }; + ++ provider5: provider5 { ++ #phandle-cells = <2>; ++ phandle-map = <2 7 &provider4 2 3>; ++ phandle-map-mask = <0xff 0xf>; ++ phandle-map-pass-thru = <0x0 0xf0>; ++ }; ++ + consumer-a { + phandle-list = <&provider1 1>, + <&provider2 2 0>, +@@ -64,7 +71,8 @@ consumer-b { + <&provider4 4 0x100>, + <&provider4 0 0x61>, + <&provider0>, +- <&provider4 19 0x20>; ++ <&provider4 19 0x20>, ++ <&provider5 2 7>; + phandle-list-bad-phandle = <12345678 0 0>; + phandle-list-bad-args = <&provider2 1 0>, + <&provider4 0>; +diff --git a/drivers/of/unittest.c b/drivers/of/unittest.c +index 073a3f44c404..f3a136d75093 100644 +--- a/drivers/of/unittest.c ++++ b/drivers/of/unittest.c +@@ -448,6 +448,9 @@ static void __init of_unittest_parse_phandle_with_args(void) + + unittest(passed, "index %i - data error on node %pOF rc=%i\n", + i, args.np, rc); ++ ++ if (rc == 0) ++ of_node_put(args.np); + } + + /* Check for missing list property */ +@@ -537,8 +540,9 @@ static void __init of_unittest_parse_phandle_with_args(void) + + static void __init of_unittest_parse_phandle_with_args_map(void) + { +- struct device_node *np, *p0, *p1, *p2, *p3; ++ struct device_node *np, *p[6] = {}; + struct of_phandle_args args; ++ unsigned int prefs[6]; + int i, rc; + + np = of_find_node_by_path("/testcase-data/phandle-tests/consumer-b"); +@@ -547,34 +551,24 @@ static void __init of_unittest_parse_phandle_with_args_map(void) + return; + } + +- p0 = of_find_node_by_path("/testcase-data/phandle-tests/provider0"); +- if (!p0) { +- pr_err("missing testcase data\n"); +- return; +- } +- +- p1 = of_find_node_by_path("/testcase-data/phandle-tests/provider1"); +- if (!p1) { +- pr_err("missing testcase data\n"); +- return; +- } +- +- p2 = of_find_node_by_path("/testcase-data/phandle-tests/provider2"); +- if (!p2) { +- pr_err("missing testcase data\n"); +- return; +- } +- +- p3 = of_find_node_by_path("/testcase-data/phandle-tests/provider3"); +- if (!p3) { +- pr_err("missing testcase data\n"); +- return; ++ p[0] = of_find_node_by_path("/testcase-data/phandle-tests/provider0"); ++ p[1] = of_find_node_by_path("/testcase-data/phandle-tests/provider1"); ++ p[2] = of_find_node_by_path("/testcase-data/phandle-tests/provider2"); ++ p[3] = of_find_node_by_path("/testcase-data/phandle-tests/provider3"); ++ p[4] = of_find_node_by_path("/testcase-data/phandle-tests/provider4"); ++ p[5] = of_find_node_by_path("/testcase-data/phandle-tests/provider5"); ++ for (i = 0; i < ARRAY_SIZE(p); ++i) { ++ if (!p[i]) { ++ pr_err("missing testcase data\n"); ++ return; ++ } ++ prefs[i] = kref_read(&p[i]->kobj.kref); + } + + rc = of_count_phandle_with_args(np, "phandle-list", "#phandle-cells"); +- unittest(rc == 7, "of_count_phandle_with_args() returned %i, expected 7\n", rc); ++ unittest(rc == 8, "of_count_phandle_with_args() returned %i, expected 7\n", rc); + +- for (i = 0; i < 8; i++) { ++ for (i = 0; i < 9; i++) { + bool passed = true; + + memset(&args, 0, sizeof(args)); +@@ -585,13 +579,13 @@ static void __init of_unittest_parse_phandle_with_args_map(void) + switch (i) { + case 0: + passed &= !rc; +- passed &= (args.np == p1); ++ passed &= (args.np == p[1]); + passed &= (args.args_count == 1); + passed &= (args.args[0] == 1); + break; + case 1: + passed &= !rc; +- passed &= (args.np == p3); ++ passed &= (args.np == p[3]); + passed &= (args.args_count == 3); + passed &= (args.args[0] == 2); + passed &= (args.args[1] == 5); +@@ -602,28 +596,36 @@ static void __init of_unittest_parse_phandle_with_args_map(void) + break; + case 3: + passed &= !rc; +- passed &= (args.np == p0); ++ passed &= (args.np == p[0]); + passed &= (args.args_count == 0); + break; + case 4: + passed &= !rc; +- passed &= (args.np == p1); ++ passed &= (args.np == p[1]); + passed &= (args.args_count == 1); + passed &= (args.args[0] == 3); + break; + case 5: + passed &= !rc; +- passed &= (args.np == p0); ++ passed &= (args.np == p[0]); + passed &= (args.args_count == 0); + break; + case 6: + passed &= !rc; +- passed &= (args.np == p2); ++ passed &= (args.np == p[2]); + passed &= (args.args_count == 2); + passed &= (args.args[0] == 15); + passed &= (args.args[1] == 0x20); + break; + case 7: ++ passed &= !rc; ++ passed &= (args.np == p[3]); ++ passed &= (args.args_count == 3); ++ passed &= (args.args[0] == 2); ++ passed &= (args.args[1] == 5); ++ passed &= (args.args[2] == 3); ++ break; ++ case 8: + passed &= (rc == -ENOENT); + break; + default: +@@ -632,6 +634,9 @@ static void __init of_unittest_parse_phandle_with_args_map(void) + + unittest(passed, "index %i - data error on node %s rc=%i\n", + i, args.np->full_name, rc); ++ ++ if (rc == 0) ++ of_node_put(args.np); + } + + /* Check for missing list property */ +@@ -678,6 +683,13 @@ static void __init of_unittest_parse_phandle_with_args_map(void) + "OF: /testcase-data/phandle-tests/consumer-b: #phandle-cells = 2 found -1"); + + unittest(rc == -EINVAL, "expected:%i got:%i\n", -EINVAL, rc); ++ ++ for (i = 0; i < ARRAY_SIZE(p); ++i) { ++ unittest(prefs[i] == kref_read(&p[i]->kobj.kref), ++ "provider%d: expected:%d got:%d\n", ++ i, prefs[i], kref_read(&p[i]->kobj.kref)); ++ of_node_put(p[i]); ++ } + } + + static void __init of_unittest_property_string(void) +-- +2.43.0 + diff --git a/queue-5.15/of-property-define-of_property_read_u-8-16-32-64-_ar.patch b/queue-5.15/of-property-define-of_property_read_u-8-16-32-64-_ar.patch new file mode 100644 index 00000000000..ec89dfc1197 --- /dev/null +++ b/queue-5.15/of-property-define-of_property_read_u-8-16-32-64-_ar.patch @@ -0,0 +1,325 @@ +From 9faa7c99b02c6238a1170b25bfe2e966881ba35a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Jan 2022 18:35:03 +0100 +Subject: of: property: define of_property_read_u{8,16,32,64}_array() + unconditionally + +From: Michael Walle + +[ Upstream commit 2ca42c3ad9ed875b136065b010753a4caaaa1d38 ] + +We can get rid of all the empty stubs because all these functions call +of_property_read_variable_u{8,16,32,64}_array() which already have an +empty stub if CONFIG_OF is not defined. + +Signed-off-by: Michael Walle +Signed-off-by: Rob Herring +Link: https://lore.kernel.org/r/20220118173504.2867523-3-michael@walle.cc +Stable-dep-of: c4a5118a3ae1 ("cpufreq: scmi: process the result of devm_of_clk_add_hw_provider()") +Signed-off-by: Sasha Levin +--- + include/linux/of.h | 274 ++++++++++++++++++++------------------------- + 1 file changed, 124 insertions(+), 150 deletions(-) + +diff --git a/include/linux/of.h b/include/linux/of.h +index 6f15e8b0f9d1..4403e8fc764a 100644 +--- a/include/linux/of.h ++++ b/include/linux/of.h +@@ -415,130 +415,6 @@ extern int of_detach_node(struct device_node *); + + #define of_match_ptr(_ptr) (_ptr) + +-/** +- * of_property_read_u8_array - Find and read an array of u8 from a property. +- * +- * @np: device node from which the property value is to be read. +- * @propname: name of the property to be searched. +- * @out_values: pointer to return value, modified only if return value is 0. +- * @sz: number of array elements to read +- * +- * Search for a property in a device node and read 8-bit value(s) from +- * it. +- * +- * dts entry of array should be like: +- * ``property = /bits/ 8 <0x50 0x60 0x70>;`` +- * +- * Return: 0 on success, -EINVAL if the property does not exist, +- * -ENODATA if property does not have a value, and -EOVERFLOW if the +- * property data isn't large enough. +- * +- * The out_values is modified only if a valid u8 value can be decoded. +- */ +-static inline int of_property_read_u8_array(const struct device_node *np, +- const char *propname, +- u8 *out_values, size_t sz) +-{ +- int ret = of_property_read_variable_u8_array(np, propname, out_values, +- sz, 0); +- if (ret >= 0) +- return 0; +- else +- return ret; +-} +- +-/** +- * of_property_read_u16_array - Find and read an array of u16 from a property. +- * +- * @np: device node from which the property value is to be read. +- * @propname: name of the property to be searched. +- * @out_values: pointer to return value, modified only if return value is 0. +- * @sz: number of array elements to read +- * +- * Search for a property in a device node and read 16-bit value(s) from +- * it. +- * +- * dts entry of array should be like: +- * ``property = /bits/ 16 <0x5000 0x6000 0x7000>;`` +- * +- * Return: 0 on success, -EINVAL if the property does not exist, +- * -ENODATA if property does not have a value, and -EOVERFLOW if the +- * property data isn't large enough. +- * +- * The out_values is modified only if a valid u16 value can be decoded. +- */ +-static inline int of_property_read_u16_array(const struct device_node *np, +- const char *propname, +- u16 *out_values, size_t sz) +-{ +- int ret = of_property_read_variable_u16_array(np, propname, out_values, +- sz, 0); +- if (ret >= 0) +- return 0; +- else +- return ret; +-} +- +-/** +- * of_property_read_u32_array - Find and read an array of 32 bit integers +- * from a property. +- * +- * @np: device node from which the property value is to be read. +- * @propname: name of the property to be searched. +- * @out_values: pointer to return value, modified only if return value is 0. +- * @sz: number of array elements to read +- * +- * Search for a property in a device node and read 32-bit value(s) from +- * it. +- * +- * Return: 0 on success, -EINVAL if the property does not exist, +- * -ENODATA if property does not have a value, and -EOVERFLOW if the +- * property data isn't large enough. +- * +- * The out_values is modified only if a valid u32 value can be decoded. +- */ +-static inline int of_property_read_u32_array(const struct device_node *np, +- const char *propname, +- u32 *out_values, size_t sz) +-{ +- int ret = of_property_read_variable_u32_array(np, propname, out_values, +- sz, 0); +- if (ret >= 0) +- return 0; +- else +- return ret; +-} +- +-/** +- * of_property_read_u64_array - Find and read an array of 64 bit integers +- * from a property. +- * +- * @np: device node from which the property value is to be read. +- * @propname: name of the property to be searched. +- * @out_values: pointer to return value, modified only if return value is 0. +- * @sz: number of array elements to read +- * +- * Search for a property in a device node and read 64-bit value(s) from +- * it. +- * +- * Return: 0 on success, -EINVAL if the property does not exist, +- * -ENODATA if property does not have a value, and -EOVERFLOW if the +- * property data isn't large enough. +- * +- * The out_values is modified only if a valid u64 value can be decoded. +- */ +-static inline int of_property_read_u64_array(const struct device_node *np, +- const char *propname, +- u64 *out_values, size_t sz) +-{ +- int ret = of_property_read_variable_u64_array(np, propname, out_values, +- sz, 0); +- if (ret >= 0) +- return 0; +- else +- return ret; +-} +- + /* + * struct property *prop; + * const __be32 *p; +@@ -733,32 +609,6 @@ static inline int of_property_count_elems_of_size(const struct device_node *np, + return -ENOSYS; + } + +-static inline int of_property_read_u8_array(const struct device_node *np, +- const char *propname, u8 *out_values, size_t sz) +-{ +- return -ENOSYS; +-} +- +-static inline int of_property_read_u16_array(const struct device_node *np, +- const char *propname, u16 *out_values, size_t sz) +-{ +- return -ENOSYS; +-} +- +-static inline int of_property_read_u32_array(const struct device_node *np, +- const char *propname, +- u32 *out_values, size_t sz) +-{ +- return -ENOSYS; +-} +- +-static inline int of_property_read_u64_array(const struct device_node *np, +- const char *propname, +- u64 *out_values, size_t sz) +-{ +- return -ENOSYS; +-} +- + static inline int of_property_read_u32_index(const struct device_node *np, + const char *propname, u32 index, u32 *out_value) + { +@@ -1235,6 +1085,130 @@ static inline bool of_property_read_bool(const struct device_node *np, + return prop ? true : false; + } + ++/** ++ * of_property_read_u8_array - Find and read an array of u8 from a property. ++ * ++ * @np: device node from which the property value is to be read. ++ * @propname: name of the property to be searched. ++ * @out_values: pointer to return value, modified only if return value is 0. ++ * @sz: number of array elements to read ++ * ++ * Search for a property in a device node and read 8-bit value(s) from ++ * it. ++ * ++ * dts entry of array should be like: ++ * ``property = /bits/ 8 <0x50 0x60 0x70>;`` ++ * ++ * Return: 0 on success, -EINVAL if the property does not exist, ++ * -ENODATA if property does not have a value, and -EOVERFLOW if the ++ * property data isn't large enough. ++ * ++ * The out_values is modified only if a valid u8 value can be decoded. ++ */ ++static inline int of_property_read_u8_array(const struct device_node *np, ++ const char *propname, ++ u8 *out_values, size_t sz) ++{ ++ int ret = of_property_read_variable_u8_array(np, propname, out_values, ++ sz, 0); ++ if (ret >= 0) ++ return 0; ++ else ++ return ret; ++} ++ ++/** ++ * of_property_read_u16_array - Find and read an array of u16 from a property. ++ * ++ * @np: device node from which the property value is to be read. ++ * @propname: name of the property to be searched. ++ * @out_values: pointer to return value, modified only if return value is 0. ++ * @sz: number of array elements to read ++ * ++ * Search for a property in a device node and read 16-bit value(s) from ++ * it. ++ * ++ * dts entry of array should be like: ++ * ``property = /bits/ 16 <0x5000 0x6000 0x7000>;`` ++ * ++ * Return: 0 on success, -EINVAL if the property does not exist, ++ * -ENODATA if property does not have a value, and -EOVERFLOW if the ++ * property data isn't large enough. ++ * ++ * The out_values is modified only if a valid u16 value can be decoded. ++ */ ++static inline int of_property_read_u16_array(const struct device_node *np, ++ const char *propname, ++ u16 *out_values, size_t sz) ++{ ++ int ret = of_property_read_variable_u16_array(np, propname, out_values, ++ sz, 0); ++ if (ret >= 0) ++ return 0; ++ else ++ return ret; ++} ++ ++/** ++ * of_property_read_u32_array - Find and read an array of 32 bit integers ++ * from a property. ++ * ++ * @np: device node from which the property value is to be read. ++ * @propname: name of the property to be searched. ++ * @out_values: pointer to return value, modified only if return value is 0. ++ * @sz: number of array elements to read ++ * ++ * Search for a property in a device node and read 32-bit value(s) from ++ * it. ++ * ++ * Return: 0 on success, -EINVAL if the property does not exist, ++ * -ENODATA if property does not have a value, and -EOVERFLOW if the ++ * property data isn't large enough. ++ * ++ * The out_values is modified only if a valid u32 value can be decoded. ++ */ ++static inline int of_property_read_u32_array(const struct device_node *np, ++ const char *propname, ++ u32 *out_values, size_t sz) ++{ ++ int ret = of_property_read_variable_u32_array(np, propname, out_values, ++ sz, 0); ++ if (ret >= 0) ++ return 0; ++ else ++ return ret; ++} ++ ++/** ++ * of_property_read_u64_array - Find and read an array of 64 bit integers ++ * from a property. ++ * ++ * @np: device node from which the property value is to be read. ++ * @propname: name of the property to be searched. ++ * @out_values: pointer to return value, modified only if return value is 0. ++ * @sz: number of array elements to read ++ * ++ * Search for a property in a device node and read 64-bit value(s) from ++ * it. ++ * ++ * Return: 0 on success, -EINVAL if the property does not exist, ++ * -ENODATA if property does not have a value, and -EOVERFLOW if the ++ * property data isn't large enough. ++ * ++ * The out_values is modified only if a valid u64 value can be decoded. ++ */ ++static inline int of_property_read_u64_array(const struct device_node *np, ++ const char *propname, ++ u64 *out_values, size_t sz) ++{ ++ int ret = of_property_read_variable_u64_array(np, propname, out_values, ++ sz, 0); ++ if (ret >= 0) ++ return 0; ++ else ++ return ret; ++} ++ + static inline int of_property_read_u8(const struct device_node *np, + const char *propname, + u8 *out_value) +-- +2.43.0 + diff --git a/queue-5.15/of-unittest-fix-of_count_phandle_with_args-expected-.patch b/queue-5.15/of-unittest-fix-of_count_phandle_with_args-expected-.patch new file mode 100644 index 00000000000..7e8bd34b944 --- /dev/null +++ b/queue-5.15/of-unittest-fix-of_count_phandle_with_args-expected-.patch @@ -0,0 +1,38 @@ +From 9d7827e0a5f55ca3919920bf30e67010aa8ad24b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Jan 2024 09:50:25 +0100 +Subject: of: unittest: Fix of_count_phandle_with_args() expected value message + +From: Geert Uytterhoeven + +[ Upstream commit 716089b417cf98d01f0dc1b39f9c47e1d7b4c965 ] + +The expected result value for the call to of_count_phandle_with_args() +was updated from 7 to 8, but the accompanying error message was +forgotten. + +Fixes: 4dde83569832f937 ("of: Fix double free in of_parse_phandle_with_args_map") +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/20240111085025.2073894-1-geert+renesas@glider.be +Signed-off-by: Rob Herring +Signed-off-by: Sasha Levin +--- + drivers/of/unittest.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/of/unittest.c b/drivers/of/unittest.c +index f3a136d75093..699daf0645d1 100644 +--- a/drivers/of/unittest.c ++++ b/drivers/of/unittest.c +@@ -566,7 +566,7 @@ static void __init of_unittest_parse_phandle_with_args_map(void) + } + + rc = of_count_phandle_with_args(np, "phandle-list", "#phandle-cells"); +- unittest(rc == 8, "of_count_phandle_with_args() returned %i, expected 7\n", rc); ++ unittest(rc == 8, "of_count_phandle_with_args() returned %i, expected 8\n", rc); + + for (i = 0; i < 9; i++) { + bool passed = true; +-- +2.43.0 + diff --git a/queue-5.15/powerpc-44x-select-i2c-for-currituck.patch b/queue-5.15/powerpc-44x-select-i2c-for-currituck.patch new file mode 100644 index 00000000000..01696e3648d --- /dev/null +++ b/queue-5.15/powerpc-44x-select-i2c-for-currituck.patch @@ -0,0 +1,43 @@ +From b2fec38513b6c495b9d8b39e0d6a6578d0d74133 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Nov 2023 21:51:59 -0800 +Subject: powerpc/44x: select I2C for CURRITUCK + +From: Randy Dunlap + +[ Upstream commit 4a74197b65e69c46fe6e53f7df2f4d6ce9ffe012 ] + +Fix build errors when CURRITUCK=y and I2C is not builtin (=m or is +not set). Fixes these build errors: + +powerpc-linux-ld: arch/powerpc/platforms/44x/ppc476.o: in function `avr_halt_system': +ppc476.c:(.text+0x58): undefined reference to `i2c_smbus_write_byte_data' +powerpc-linux-ld: arch/powerpc/platforms/44x/ppc476.o: in function `ppc47x_device_probe': +ppc476.c:(.init.text+0x18): undefined reference to `i2c_register_driver' + +Fixes: 2a2c74b2efcb ("IBM Akebono: Add the Akebono platform") +Signed-off-by: Randy Dunlap +Reported-by: kernel test robot +Closes: lore.kernel.org/r/202312010820.cmdwF5X9-lkp@intel.com +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20231201055159.8371-1-rdunlap@infradead.org +Signed-off-by: Sasha Levin +--- + arch/powerpc/platforms/44x/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/powerpc/platforms/44x/Kconfig b/arch/powerpc/platforms/44x/Kconfig +index 83975ef50975..66c54cef3cfa 100644 +--- a/arch/powerpc/platforms/44x/Kconfig ++++ b/arch/powerpc/platforms/44x/Kconfig +@@ -177,6 +177,7 @@ config ISS4xx + config CURRITUCK + bool "IBM Currituck (476fpe) Support" + depends on PPC_47x ++ select I2C + select SWIOTLB + select 476FPE + select FORCE_PCI +-- +2.43.0 + diff --git a/queue-5.15/powerpc-add-crtsavres.o-to-always-y-instead-of-extra.patch b/queue-5.15/powerpc-add-crtsavres.o-to-always-y-instead-of-extra.patch new file mode 100644 index 00000000000..cd2a7ef5153 --- /dev/null +++ b/queue-5.15/powerpc-add-crtsavres.o-to-always-y-instead-of-extra.patch @@ -0,0 +1,50 @@ +From c3463c628e8312aab15dd14d5457996258e9bb7e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Nov 2023 08:23:32 +0900 +Subject: powerpc: add crtsavres.o to always-y instead of extra-y + +From: Masahiro Yamada + +[ Upstream commit 1b1e38002648819c04773647d5242990e2824264 ] + +crtsavres.o is linked to modules. However, as explained in commit +d0e628cd817f ("kbuild: doc: clarify the difference between extra-y +and always-y"), 'make modules' does not build extra-y. + +For example, the following command fails: + + $ make ARCH=powerpc LLVM=1 KBUILD_MODPOST_WARN=1 mrproper ps3_defconfig modules + [snip] + LD [M] arch/powerpc/platforms/cell/spufs/spufs.ko + ld.lld: error: cannot open arch/powerpc/lib/crtsavres.o: No such file or directory + make[3]: *** [scripts/Makefile.modfinal:56: arch/powerpc/platforms/cell/spufs/spufs.ko] Error 1 + make[2]: *** [Makefile:1844: modules] Error 2 + make[1]: *** [/home/masahiro/workspace/linux-kbuild/Makefile:350: __build_one_by_one] Error 2 + make: *** [Makefile:234: __sub-make] Error 2 + +Signed-off-by: Masahiro Yamada +Fixes: baa25b571a16 ("powerpc/64: Do not link crtsavres.o in vmlinux") +Reviewed-by: Nicholas Piggin +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20231120232332.4100288-1-masahiroy@kernel.org +Signed-off-by: Sasha Levin +--- + arch/powerpc/lib/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/powerpc/lib/Makefile b/arch/powerpc/lib/Makefile +index cb8a66743a02..6448de85f738 100644 +--- a/arch/powerpc/lib/Makefile ++++ b/arch/powerpc/lib/Makefile +@@ -38,7 +38,7 @@ obj-$(CONFIG_FUNCTION_ERROR_INJECTION) += error-inject.o + # so it is only needed for modules, and only for older linkers which + # do not support --save-restore-funcs + ifndef CONFIG_LD_IS_BFD +-extra-$(CONFIG_PPC64) += crtsavres.o ++always-$(CONFIG_PPC64) += crtsavres.o + endif + + obj-$(CONFIG_PPC_BOOK3S_64) += copyuser_power7.o copypage_power7.o \ +-- +2.43.0 + diff --git a/queue-5.15/powerpc-imc-pmu-add-a-null-pointer-check-in-update_e.patch b/queue-5.15/powerpc-imc-pmu-add-a-null-pointer-check-in-update_e.patch new file mode 100644 index 00000000000..7e8d025580f --- /dev/null +++ b/queue-5.15/powerpc-imc-pmu-add-a-null-pointer-check-in-update_e.patch @@ -0,0 +1,55 @@ +From b6210444d5cd71447bf95b24bec9961f824bb1ba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 26 Nov 2023 17:37:19 +0800 +Subject: powerpc/imc-pmu: Add a null pointer check in update_events_in_group() + +From: Kunwu Chan + +[ Upstream commit 0a233867a39078ebb0f575e2948593bbff5826b3 ] + +kasprintf() returns a pointer to dynamically allocated memory +which can be NULL upon failure. + +Fixes: 885dcd709ba9 ("powerpc/perf: Add nest IMC PMU support") +Signed-off-by: Kunwu Chan +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20231126093719.1440305-1-chentao@kylinos.cn +Signed-off-by: Sasha Levin +--- + arch/powerpc/perf/imc-pmu.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/arch/powerpc/perf/imc-pmu.c b/arch/powerpc/perf/imc-pmu.c +index 55a853edc3be..e2f6fe259aa6 100644 +--- a/arch/powerpc/perf/imc-pmu.c ++++ b/arch/powerpc/perf/imc-pmu.c +@@ -292,6 +292,8 @@ static int update_events_in_group(struct device_node *node, struct imc_pmu *pmu) + attr_group->attrs = attrs; + do { + ev_val_str = kasprintf(GFP_KERNEL, "event=0x%x", pmu->events[i].value); ++ if (!ev_val_str) ++ continue; + dev_str = device_str_attr_create(pmu->events[i].name, ev_val_str); + if (!dev_str) + continue; +@@ -299,6 +301,8 @@ static int update_events_in_group(struct device_node *node, struct imc_pmu *pmu) + attrs[j++] = dev_str; + if (pmu->events[i].scale) { + ev_scale_str = kasprintf(GFP_KERNEL, "%s.scale", pmu->events[i].name); ++ if (!ev_scale_str) ++ continue; + dev_str = device_str_attr_create(ev_scale_str, pmu->events[i].scale); + if (!dev_str) + continue; +@@ -308,6 +312,8 @@ static int update_events_in_group(struct device_node *node, struct imc_pmu *pmu) + + if (pmu->events[i].unit) { + ev_unit_str = kasprintf(GFP_KERNEL, "%s.unit", pmu->events[i].name); ++ if (!ev_unit_str) ++ continue; + dev_str = device_str_attr_create(ev_unit_str, pmu->events[i].unit); + if (!dev_str) + continue; +-- +2.43.0 + diff --git a/queue-5.15/powerpc-mark-.opd-section-read-only.patch b/queue-5.15/powerpc-mark-.opd-section-read-only.patch new file mode 100644 index 00000000000..29bd820190c --- /dev/null +++ b/queue-5.15/powerpc-mark-.opd-section-read-only.patch @@ -0,0 +1,58 @@ +From 730a5fb7b64b79d1746249de1a2cf8c9b24fac54 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Oct 2021 16:43:54 +0200 +Subject: powerpc: Mark .opd section read-only + +From: Christophe Leroy + +[ Upstream commit 3091f5fc5f1df7741ddf326561384e0997eca2a1 ] + +.opd section contains function descriptors used to locate +functions in the kernel. If someone is able to modify a +function descriptor he will be able to run arbitrary +kernel function instead of another. + +To avoid that, move .opd section inside read-only memory. + +Signed-off-by: Christophe Leroy +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/3cd40b682fb6f75bb40947b55ca0bac20cb3f995.1634136222.git.christophe.leroy@csgroup.eu +Stable-dep-of: 1b1e38002648 ("powerpc: add crtsavres.o to always-y instead of extra-y") +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/vmlinux.lds.S | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/arch/powerpc/kernel/vmlinux.lds.S b/arch/powerpc/kernel/vmlinux.lds.S +index d4531902d8c6..d8301ce7c675 100644 +--- a/arch/powerpc/kernel/vmlinux.lds.S ++++ b/arch/powerpc/kernel/vmlinux.lds.S +@@ -148,6 +148,12 @@ SECTIONS + SOFT_MASK_TABLE(8) + RESTART_TABLE(8) + ++ .opd : AT(ADDR(.opd) - LOAD_OFFSET) { ++ __start_opd = .; ++ KEEP(*(.opd)) ++ __end_opd = .; ++ } ++ + . = ALIGN(8); + __stf_entry_barrier_fixup : AT(ADDR(__stf_entry_barrier_fixup) - LOAD_OFFSET) { + __start___stf_entry_barrier_fixup = .; +@@ -346,12 +352,6 @@ SECTIONS + *(.branch_lt) + } + +- .opd : AT(ADDR(.opd) - LOAD_OFFSET) { +- __start_opd = .; +- KEEP(*(.opd)) +- __end_opd = .; +- } +- + . = ALIGN(256); + .got : AT(ADDR(.got) - LOAD_OFFSET) { + __toc_start = .; +-- +2.43.0 + diff --git a/queue-5.15/powerpc-powernv-add-a-null-pointer-check-in-opal_eve.patch b/queue-5.15/powerpc-powernv-add-a-null-pointer-check-in-opal_eve.patch new file mode 100644 index 00000000000..01c935d82f4 --- /dev/null +++ b/queue-5.15/powerpc-powernv-add-a-null-pointer-check-in-opal_eve.patch @@ -0,0 +1,37 @@ +From 2a17329f662715bc09a6ec923e96bbbfb4e9cff8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Nov 2023 11:07:55 +0800 +Subject: powerpc/powernv: Add a null pointer check in opal_event_init() + +From: Kunwu Chan + +[ Upstream commit 8649829a1dd25199bbf557b2621cedb4bf9b3050 ] + +kasprintf() returns a pointer to dynamically allocated memory +which can be NULL upon failure. + +Fixes: 2717a33d6074 ("powerpc/opal-irqchip: Use interrupt names if present") +Signed-off-by: Kunwu Chan +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20231127030755.1546750-1-chentao@kylinos.cn +Signed-off-by: Sasha Levin +--- + arch/powerpc/platforms/powernv/opal-irqchip.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/powerpc/platforms/powernv/opal-irqchip.c b/arch/powerpc/platforms/powernv/opal-irqchip.c +index d55652b5f6fa..391f50535200 100644 +--- a/arch/powerpc/platforms/powernv/opal-irqchip.c ++++ b/arch/powerpc/platforms/powernv/opal-irqchip.c +@@ -275,6 +275,8 @@ int __init opal_event_init(void) + else + name = kasprintf(GFP_KERNEL, "opal"); + ++ if (!name) ++ continue; + /* Install interrupt handler */ + rc = request_irq(r->start, opal_interrupt, r->flags & IRQD_TRIGGER_MASK, + name, NULL); +-- +2.43.0 + diff --git a/queue-5.15/powerpc-powernv-add-a-null-pointer-check-in-opal_pow.patch b/queue-5.15/powerpc-powernv-add-a-null-pointer-check-in-opal_pow.patch new file mode 100644 index 00000000000..34273fcec58 --- /dev/null +++ b/queue-5.15/powerpc-powernv-add-a-null-pointer-check-in-opal_pow.patch @@ -0,0 +1,41 @@ +From 88fbff41693c2eb6f23c29402dbe3e3784918d3b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 26 Nov 2023 17:57:39 +0800 +Subject: powerpc/powernv: Add a null pointer check in opal_powercap_init() + +From: Kunwu Chan + +[ Upstream commit e123015c0ba859cf48aa7f89c5016cc6e98e018d ] + +kasprintf() returns a pointer to dynamically allocated memory +which can be NULL upon failure. + +Fixes: b9ef7b4b867f ("powerpc: Convert to using %pOFn instead of device_node.name") +Signed-off-by: Kunwu Chan +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20231126095739.1501990-1-chentao@kylinos.cn +Signed-off-by: Sasha Levin +--- + arch/powerpc/platforms/powernv/opal-powercap.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/arch/powerpc/platforms/powernv/opal-powercap.c b/arch/powerpc/platforms/powernv/opal-powercap.c +index c16d44f6f1d1..ce9ec3962cef 100644 +--- a/arch/powerpc/platforms/powernv/opal-powercap.c ++++ b/arch/powerpc/platforms/powernv/opal-powercap.c +@@ -196,6 +196,12 @@ void __init opal_powercap_init(void) + + j = 0; + pcaps[i].pg.name = kasprintf(GFP_KERNEL, "%pOFn", node); ++ if (!pcaps[i].pg.name) { ++ kfree(pcaps[i].pattrs); ++ kfree(pcaps[i].pg.attrs); ++ goto out_pcaps_pattrs; ++ } ++ + if (has_min) { + powercap_add_attr(min, "powercap-min", + &pcaps[i].pattrs[j]); +-- +2.43.0 + diff --git a/queue-5.15/powerpc-powernv-add-a-null-pointer-check-to-scom_deb.patch b/queue-5.15/powerpc-powernv-add-a-null-pointer-check-to-scom_deb.patch new file mode 100644 index 00000000000..f754c4a050a --- /dev/null +++ b/queue-5.15/powerpc-powernv-add-a-null-pointer-check-to-scom_deb.patch @@ -0,0 +1,41 @@ +From 3be877fc508f283e9b9c567576c7849100f242b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Dec 2023 16:59:37 +0800 +Subject: powerpc/powernv: Add a null pointer check to scom_debug_init_one() + +From: Kunwu Chan + +[ Upstream commit 9a260f2dd827bbc82cc60eb4f4d8c22707d80742 ] + +kasprintf() returns a pointer to dynamically allocated memory +which can be NULL upon failure. +Add a null pointer check, and release 'ent' to avoid memory leaks. + +Fixes: bfd2f0d49aef ("powerpc/powernv: Get rid of old scom_controller abstraction") +Signed-off-by: Kunwu Chan +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20231208085937.107210-1-chentao@kylinos.cn +Signed-off-by: Sasha Levin +--- + arch/powerpc/platforms/powernv/opal-xscom.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/arch/powerpc/platforms/powernv/opal-xscom.c b/arch/powerpc/platforms/powernv/opal-xscom.c +index 6b4eed2ef4fa..f67235d1ba2c 100644 +--- a/arch/powerpc/platforms/powernv/opal-xscom.c ++++ b/arch/powerpc/platforms/powernv/opal-xscom.c +@@ -165,6 +165,11 @@ static int scom_debug_init_one(struct dentry *root, struct device_node *dn, + ent->chip = chip; + snprintf(ent->name, 16, "%08x", chip); + ent->path.data = (void *)kasprintf(GFP_KERNEL, "%pOF", dn); ++ if (!ent->path.data) { ++ kfree(ent); ++ return -ENOMEM; ++ } ++ + ent->path.size = strlen((char *)ent->path.data); + + dir = debugfs_create_dir(ent->name, root); +-- +2.43.0 + diff --git a/queue-5.15/powerpc-pseries-memhp-fix-access-beyond-end-of-drmem.patch b/queue-5.15/powerpc-pseries-memhp-fix-access-beyond-end-of-drmem.patch new file mode 100644 index 00000000000..29d4cc98c13 --- /dev/null +++ b/queue-5.15/powerpc-pseries-memhp-fix-access-beyond-end-of-drmem.patch @@ -0,0 +1,101 @@ +From ae12e96be50e19349966737d0cb3ed1333bc4a64 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Nov 2023 11:01:53 -0600 +Subject: powerpc/pseries/memhp: Fix access beyond end of drmem array + +From: Nathan Lynch + +[ Upstream commit bd68ffce69f6cf8ddd3a3c32549d1d2275e49fc5 ] + +dlpar_memory_remove_by_index() may access beyond the bounds of the +drmem lmb array when the LMB lookup fails to match an entry with the +given DRC index. When the search fails, the cursor is left pointing to +&drmem_info->lmbs[drmem_info->n_lmbs], which is one element past the +last valid entry in the array. The debug message at the end of the +function then dereferences this pointer: + + pr_debug("Failed to hot-remove memory at %llx\n", + lmb->base_addr); + +This was found by inspection and confirmed with KASAN: + + pseries-hotplug-mem: Attempting to hot-remove LMB, drc index 1234 + ================================================================== + BUG: KASAN: slab-out-of-bounds in dlpar_memory+0x298/0x1658 + Read of size 8 at addr c000000364e97fd0 by task bash/949 + + dump_stack_lvl+0xa4/0xfc (unreliable) + print_report+0x214/0x63c + kasan_report+0x140/0x2e0 + __asan_load8+0xa8/0xe0 + dlpar_memory+0x298/0x1658 + handle_dlpar_errorlog+0x130/0x1d0 + dlpar_store+0x18c/0x3e0 + kobj_attr_store+0x68/0xa0 + sysfs_kf_write+0xc4/0x110 + kernfs_fop_write_iter+0x26c/0x390 + vfs_write+0x2d4/0x4e0 + ksys_write+0xac/0x1a0 + system_call_exception+0x268/0x530 + system_call_vectored_common+0x15c/0x2ec + + Allocated by task 1: + kasan_save_stack+0x48/0x80 + kasan_set_track+0x34/0x50 + kasan_save_alloc_info+0x34/0x50 + __kasan_kmalloc+0xd0/0x120 + __kmalloc+0x8c/0x320 + kmalloc_array.constprop.0+0x48/0x5c + drmem_init+0x2a0/0x41c + do_one_initcall+0xe0/0x5c0 + kernel_init_freeable+0x4ec/0x5a0 + kernel_init+0x30/0x1e0 + ret_from_kernel_user_thread+0x14/0x1c + + The buggy address belongs to the object at c000000364e80000 + which belongs to the cache kmalloc-128k of size 131072 + The buggy address is located 0 bytes to the right of + allocated 98256-byte region [c000000364e80000, c000000364e97fd0) + + ================================================================== + pseries-hotplug-mem: Failed to hot-remove memory at 0 + +Log failed lookups with a separate message and dereference the +cursor only when it points to a valid entry. + +Signed-off-by: Nathan Lynch +Fixes: 51925fb3c5c9 ("powerpc/pseries: Implement memory hotplug remove in the kernel") +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20231114-pseries-memhp-fixes-v1-1-fb8f2bb7c557@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/platforms/pseries/hotplug-memory.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/arch/powerpc/platforms/pseries/hotplug-memory.c b/arch/powerpc/platforms/pseries/hotplug-memory.c +index 91cf23495ccb..642951c0d5f5 100644 +--- a/arch/powerpc/platforms/pseries/hotplug-memory.c ++++ b/arch/powerpc/platforms/pseries/hotplug-memory.c +@@ -501,14 +501,15 @@ static int dlpar_memory_remove_by_index(u32 drc_index) + } + } + +- if (!lmb_found) ++ if (!lmb_found) { ++ pr_debug("Failed to look up LMB for drc index %x\n", drc_index); + rc = -EINVAL; +- +- if (rc) ++ } else if (rc) { + pr_debug("Failed to hot-remove memory at %llx\n", + lmb->base_addr); +- else ++ } else { + pr_debug("Memory at %llx was hot-removed\n", lmb->base_addr); ++ } + + return rc; + } +-- +2.43.0 + diff --git a/queue-5.15/powerpc-remove-checks-for-binutils-older-than-2.25.patch b/queue-5.15/powerpc-remove-checks-for-binutils-older-than-2.25.patch new file mode 100644 index 00000000000..7b9f890aebc --- /dev/null +++ b/queue-5.15/powerpc-remove-checks-for-binutils-older-than-2.25.patch @@ -0,0 +1,96 @@ +From c2a8fb35f95d768f1fd880c6d534bbb24338687e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Jan 2023 17:22:50 +0900 +Subject: powerpc: remove checks for binutils older than 2.25 + +From: Masahiro Yamada + +[ Upstream commit 54a11654de163994e32b24e3aa90ef81f4a3184d ] + +Commit e4412739472b ("Documentation: raise minimum supported version of +binutils to 2.25") allows us to remove the checks for old binutils. + +There is no more user for ld-ifversion. Remove it as well. + +Signed-off-by: Masahiro Yamada +Reviewed-by: Nicholas Piggin +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20230119082250.151485-1-masahiroy@kernel.org +Stable-dep-of: 1b1e38002648 ("powerpc: add crtsavres.o to always-y instead of extra-y") +Signed-off-by: Sasha Levin +--- + arch/powerpc/Makefile | 17 +---------------- + arch/powerpc/lib/Makefile | 2 +- + scripts/Makefile.compiler | 4 ---- + 3 files changed, 2 insertions(+), 21 deletions(-) + +diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile +index 41604a37b385..11a0ccb47be3 100644 +--- a/arch/powerpc/Makefile ++++ b/arch/powerpc/Makefile +@@ -44,18 +44,13 @@ machine-$(CONFIG_PPC64) += 64 + machine-$(CONFIG_CPU_LITTLE_ENDIAN) += le + UTS_MACHINE := $(subst $(space),,$(machine-y)) + +-# XXX This needs to be before we override LD below +-ifdef CONFIG_PPC32 +-KBUILD_LDFLAGS_MODULE += arch/powerpc/lib/crtsavres.o +-else +-ifeq ($(call ld-ifversion, -ge, 22500, y),y) ++ifeq ($(CONFIG_PPC64)$(CONFIG_LD_IS_BFD),yy) + # Have the linker provide sfpr if possible. + # There is a corresponding test in arch/powerpc/lib/Makefile + KBUILD_LDFLAGS_MODULE += --save-restore-funcs + else + KBUILD_LDFLAGS_MODULE += arch/powerpc/lib/crtsavres.o + endif +-endif + + ifdef CONFIG_CPU_LITTLE_ENDIAN + KBUILD_CFLAGS += -mlittle-endian +@@ -434,17 +429,7 @@ endif # CONFIG_PPC32 + endif # CONFIG_SMP + + PHONY += checkbin +-# Check toolchain versions: +-# - gcc-4.6 is the minimum kernel-wide version so nothing required. + checkbin: +- @if test "x${CONFIG_LD_IS_LLD}" != "xy" -a \ +- "x$(call ld-ifversion, -le, 22400, y)" = "xy" ; then \ +- echo -n '*** binutils 2.24 miscompiles weak symbols ' ; \ +- echo 'in some circumstances.' ; \ +- echo '*** binutils 2.23 do not define the TOC symbol ' ; \ +- echo -n '*** Please use a different binutils version.' ; \ +- false ; \ +- fi + @if test "x${CONFIG_FTRACE_MCOUNT_USE_RECORDMCOUNT}" = "xy" -a \ + "x${CONFIG_LD_IS_BFD}" = "xy" -a \ + "${CONFIG_LD_VERSION}" = "23700" ; then \ +diff --git a/arch/powerpc/lib/Makefile b/arch/powerpc/lib/Makefile +index 54be64203b2a..cb8a66743a02 100644 +--- a/arch/powerpc/lib/Makefile ++++ b/arch/powerpc/lib/Makefile +@@ -37,7 +37,7 @@ obj-$(CONFIG_FUNCTION_ERROR_INJECTION) += error-inject.o + # 64-bit linker creates .sfpr on demand for final link (vmlinux), + # so it is only needed for modules, and only for older linkers which + # do not support --save-restore-funcs +-ifeq ($(call ld-ifversion, -lt, 22500, y),y) ++ifndef CONFIG_LD_IS_BFD + extra-$(CONFIG_PPC64) += crtsavres.o + endif + +diff --git a/scripts/Makefile.compiler b/scripts/Makefile.compiler +index 86ecd2ac874c..60ddd47bfa1b 100644 +--- a/scripts/Makefile.compiler ++++ b/scripts/Makefile.compiler +@@ -68,7 +68,3 @@ cc-ifversion = $(shell [ $(CONFIG_GCC_VERSION)0 $(1) $(2)000 ] && echo $(3) || e + # ld-option + # Usage: KBUILD_LDFLAGS += $(call ld-option, -X, -Y) + ld-option = $(call try-run, $(LD) $(KBUILD_LDFLAGS) $(1) -v,$(1),$(2),$(3)) +- +-# ld-ifversion +-# Usage: $(call ld-ifversion, -ge, 22252, y) +-ld-ifversion = $(shell [ $(CONFIG_LD_VERSION)0 $(1) $(2)0 ] && echo $(3) || echo $(4)) +-- +2.43.0 + diff --git a/queue-5.15/powerpc-toc-future-proof-kernel-toc.patch b/queue-5.15/powerpc-toc-future-proof-kernel-toc.patch new file mode 100644 index 00000000000..fd8efeee8b3 --- /dev/null +++ b/queue-5.15/powerpc-toc-future-proof-kernel-toc.patch @@ -0,0 +1,210 @@ +From b329452ad87286adfb90522b453807c9c1a218a7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Dec 2021 16:58:59 +1100 +Subject: powerpc/toc: Future proof kernel toc + +From: Alan Modra + +[ Upstream commit a3ad84da076009c94969fa97f604257667e2980f ] + +This patch future-proofs the kernel against linker changes that might +put the toc pointer at some location other than .got+0x8000, by +replacing __toc_start+0x8000 with .TOC. throughout. If the kernel's +idea of the toc pointer doesn't agree with the linker, bad things +happen. + +prom_init.c code relocating its toc is also changed so that a symbolic +__prom_init_toc_start toc-pointer relative address is calculated +rather than assuming that it is always at toc-pointer - 0x8000. The +length calculations loading values from the toc are also avoided. +It's a little incestuous to do that with unreloc_toc picking up +adjusted values (which is fine in practice, they both adjust by the +same amount if all goes well). + +I've also changed the way .got is aligned in vmlinux.lds and +zImage.lds, mostly so that dumping out section info by objdump or +readelf plainly shows the alignment is 256. This linker script +feature was added 2005-09-27, available in FSF binutils releases from +2.17 onwards. Should be safe to use in the kernel, I think. + +Finally, put *(.got) before the prom_init.o entry which only needs +*(.toc), so that the GOT header goes in the correct place. I don't +believe this makes any difference for the kernel as it would for +dynamic objects being loaded by ld.so. That change is just to stop +lusers who blindly copy kernel scripts being led astray. Of course, +this change needs the prom_init.c changes. + +Some notes on .toc and .got. + +.toc is a compiler generated section of addresses. .got is a linker +generated section of addresses, generally built when the linker sees +R_*_*GOT* relocations. In the case of powerpc64 ld.bfd, there are +multiple generated .got sections, one per input object file. So you +can somewhat reasonably write in a linker script an input section +statement like *prom_init.o(.got .toc) to mean "the .got and .toc +section for files matching *prom_init.o". On other architectures that +doesn't make sense, because the linker generally has just one .got +section. Even on powerpc64, note well that the GOT entries for +prom_init.o may be merged with GOT entries from other objects. That +means that if prom_init.o references, say, _end via some GOT +relocation, and some other object also references _end via a GOT +relocation, the GOT entry for _end may be in the range +__prom_init_toc_start to __prom_init_toc_end and if the kernel does +something special to GOT/TOC entries in that range then the value of +_end as seen by objects other than prom_init.o will be affected. On +the other hand the GOT entry for _end may not be in the range +__prom_init_toc_start to __prom_init_toc_end. Which way it turns out +is deterministic but a detail of linker operation that should not be +relied on. + +A feature of ld.bfd is that input .toc (and .got) sections matching +one linker input section statement may be sorted, to put entries used +by small-model code first, near the toc base. This is why scripts for +powerpc64 normally use *(.got .toc) rather than *(.got) *(.toc), since +the first form allows more freedom to sort. + +Another feature of ld.bfd is that indirect addressing sequences using +the GOT/TOC may be edited by the linker to relative addressing. In +many cases relative addressing would be emitted by gcc for +-mcmodel=medium if you appropriately decorate variable declarations +with non-default visibility. + +The original patch is here: +https://lore.kernel.org/linuxppc-dev/20210310034813.GM6042@bubble.grove.modra.org/ + +Signed-off-by: Alan Modra +[aik: removed non-relocatable which is gone in 24d33ac5b8ffb] +[aik: added <=2.24 check] +[aik: because of llvm-as, kernel_toc_addr() uses "mr" instead of global register variable] +Signed-off-by: Alexey Kardashevskiy +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20211221055904.555763-2-aik@ozlabs.ru +Stable-dep-of: 1b1e38002648 ("powerpc: add crtsavres.o to always-y instead of extra-y") +Signed-off-by: Sasha Levin +--- + arch/powerpc/Makefile | 5 +++-- + arch/powerpc/boot/crt0.S | 2 +- + arch/powerpc/boot/zImage.lds.S | 7 ++----- + arch/powerpc/include/asm/sections.h | 16 ++++++++-------- + arch/powerpc/kernel/head_64.S | 2 +- + arch/powerpc/kernel/vmlinux.lds.S | 8 +++----- + 6 files changed, 18 insertions(+), 22 deletions(-) + +diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile +index 3dc75040a756..41604a37b385 100644 +--- a/arch/powerpc/Makefile ++++ b/arch/powerpc/Makefile +@@ -437,10 +437,11 @@ PHONY += checkbin + # Check toolchain versions: + # - gcc-4.6 is the minimum kernel-wide version so nothing required. + checkbin: +- @if test "x${CONFIG_CPU_LITTLE_ENDIAN}" = "xy" \ +- && $(LD) --version | head -1 | grep ' 2\.24$$' >/dev/null ; then \ ++ @if test "x${CONFIG_LD_IS_LLD}" != "xy" -a \ ++ "x$(call ld-ifversion, -le, 22400, y)" = "xy" ; then \ + echo -n '*** binutils 2.24 miscompiles weak symbols ' ; \ + echo 'in some circumstances.' ; \ ++ echo '*** binutils 2.23 do not define the TOC symbol ' ; \ + echo -n '*** Please use a different binutils version.' ; \ + false ; \ + fi +diff --git a/arch/powerpc/boot/crt0.S b/arch/powerpc/boot/crt0.S +index e8f10a599659..feadee18e271 100644 +--- a/arch/powerpc/boot/crt0.S ++++ b/arch/powerpc/boot/crt0.S +@@ -28,7 +28,7 @@ p_etext: .8byte _etext + p_bss_start: .8byte __bss_start + p_end: .8byte _end + +-p_toc: .8byte __toc_start + 0x8000 - p_base ++p_toc: .8byte .TOC. - p_base + p_dyn: .8byte __dynamic_start - p_base + p_rela: .8byte __rela_dyn_start - p_base + p_prom: .8byte 0 +diff --git a/arch/powerpc/boot/zImage.lds.S b/arch/powerpc/boot/zImage.lds.S +index d6f072865627..d65cd55a6f38 100644 +--- a/arch/powerpc/boot/zImage.lds.S ++++ b/arch/powerpc/boot/zImage.lds.S +@@ -36,12 +36,9 @@ SECTIONS + } + + #ifdef CONFIG_PPC64_BOOT_WRAPPER +- . = ALIGN(256); +- .got : ++ .got : ALIGN(256) + { +- __toc_start = .; +- *(.got) +- *(.toc) ++ *(.got .toc) + } + #endif + +diff --git a/arch/powerpc/include/asm/sections.h b/arch/powerpc/include/asm/sections.h +index e92d39c0cd1d..34d82ae1774c 100644 +--- a/arch/powerpc/include/asm/sections.h ++++ b/arch/powerpc/include/asm/sections.h +@@ -26,16 +26,16 @@ extern char start_virt_trampolines[]; + extern char end_virt_trampolines[]; + #endif + ++/* ++ * This assumes the kernel is never compiled -mcmodel=small or ++ * the total .toc is always less than 64k. ++ */ + static inline unsigned long kernel_toc_addr(void) + { +- /* Defined by the linker, see vmlinux.lds.S */ +- extern unsigned long __toc_start; +- +- /* +- * The TOC register (r2) points 32kB into the TOC, so that 64kB of +- * the TOC can be addressed using a single machine instruction. +- */ +- return (unsigned long)(&__toc_start) + 0x8000UL; ++ unsigned long toc_ptr; ++ ++ asm volatile("mr %0, 2" : "=r" (toc_ptr)); ++ return toc_ptr; + } + + static inline int overlaps_interrupt_vector_text(unsigned long start, +diff --git a/arch/powerpc/kernel/head_64.S b/arch/powerpc/kernel/head_64.S +index f17ae2083733..a08c050ff645 100644 +--- a/arch/powerpc/kernel/head_64.S ++++ b/arch/powerpc/kernel/head_64.S +@@ -904,7 +904,7 @@ _GLOBAL(relative_toc) + blr + + .balign 8 +-p_toc: .8byte __toc_start + 0x8000 - 0b ++p_toc: .8byte .TOC. - 0b + + /* + * This is where the main kernel code starts. +diff --git a/arch/powerpc/kernel/vmlinux.lds.S b/arch/powerpc/kernel/vmlinux.lds.S +index d8301ce7c675..70bf67ed87b5 100644 +--- a/arch/powerpc/kernel/vmlinux.lds.S ++++ b/arch/powerpc/kernel/vmlinux.lds.S +@@ -352,15 +352,13 @@ SECTIONS + *(.branch_lt) + } + +- . = ALIGN(256); +- .got : AT(ADDR(.got) - LOAD_OFFSET) { +- __toc_start = .; ++ .got : AT(ADDR(.got) - LOAD_OFFSET) ALIGN(256) { ++ *(.got) + #ifndef CONFIG_RELOCATABLE + __prom_init_toc_start = .; +- arch/powerpc/kernel/prom_init.o*(.toc .got) ++ arch/powerpc/kernel/prom_init.o*(.toc) + __prom_init_toc_end = .; + #endif +- *(.got) + *(.toc) + } + #endif +-- +2.43.0 + diff --git a/queue-5.15/pstore-ram_core-fix-possible-overflow-in-persistent_.patch b/queue-5.15/pstore-ram_core-fix-possible-overflow-in-persistent_.patch new file mode 100644 index 00000000000..73eb686503b --- /dev/null +++ b/queue-5.15/pstore-ram_core-fix-possible-overflow-in-persistent_.patch @@ -0,0 +1,46 @@ +From 5af429a5a16c412d89ec3f5986eb9298939dac51 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 5 Nov 2023 23:29:36 +0300 +Subject: pstore: ram_core: fix possible overflow in persistent_ram_init_ecc() + +From: Sergey Shtylyov + +[ Upstream commit 86222a8fc16ec517de8da2604d904c9df3a08e5d ] + +In persistent_ram_init_ecc(), on 64-bit arches DIV_ROUND_UP() will return +64-bit value since persistent_ram_zone::buffer_size has type size_t which +is derived from the 64-bit *unsigned long*, while the ecc_blocks variable +this value gets assigned to has (always 32-bit) *int* type. Even if that +value fits into *int* type, an overflow is still possible when calculating +the size_t typed ecc_total variable further below since there's no cast to +any 64-bit type before multiplication. Declaring the ecc_blocks variable +as *size_t* should fix this mess... + +Found by Linux Verification Center (linuxtesting.org) with the SVACE static +analysis tool. + +Fixes: 9cc05ad97c57 ("staging: android: persistent_ram: refactor ecc support") +Signed-off-by: Sergey Shtylyov +Link: https://lore.kernel.org/r/20231105202936.25694-1-s.shtylyov@omp.ru +Signed-off-by: Kees Cook +Signed-off-by: Sasha Levin +--- + fs/pstore/ram_core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/pstore/ram_core.c b/fs/pstore/ram_core.c +index ccdb71c3dc51..ec321722384d 100644 +--- a/fs/pstore/ram_core.c ++++ b/fs/pstore/ram_core.c +@@ -190,7 +190,7 @@ static int persistent_ram_init_ecc(struct persistent_ram_zone *prz, + { + int numerr; + struct persistent_ram_buffer *buffer = prz->buffer; +- int ecc_blocks; ++ size_t ecc_blocks; + size_t ecc_total; + + if (!ecc_info || !ecc_info->ecc_size) +-- +2.43.0 + diff --git a/queue-5.15/pwm-stm32-fix-enable-count-for-clk-in-.probe.patch b/queue-5.15/pwm-stm32-fix-enable-count-for-clk-in-.probe.patch new file mode 100644 index 00000000000..6fc33a36149 --- /dev/null +++ b/queue-5.15/pwm-stm32-fix-enable-count-for-clk-in-.probe.patch @@ -0,0 +1,80 @@ +From b96c53531c6f9d0c2e6f70162c84c7d1e5fc0246 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Oct 2023 22:07:04 +0200 +Subject: pwm: stm32: Fix enable count for clk in .probe() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Philipp Zabel + +[ Upstream commit 19f1016ea9600ed89bc24247c36ff5934ad94fbb ] + +Make the driver take over hardware state without disabling in .probe() +and enable the clock for each enabled channel. + +Signed-off-by: Philipp Zabel +[ukleinek: split off from a patch that also implemented .get_state()] +Signed-off-by: Uwe Kleine-König +Fixes: 7edf7369205b ("pwm: Add driver for STM32 plaftorm") +Reviewed-by: Fabrice Gasnier +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-stm32.c | 18 ++++++++++++++---- + 1 file changed, 14 insertions(+), 4 deletions(-) + +diff --git a/drivers/pwm/pwm-stm32.c b/drivers/pwm/pwm-stm32.c +index 9c260aac442d..bdcdb7f38312 100644 +--- a/drivers/pwm/pwm-stm32.c ++++ b/drivers/pwm/pwm-stm32.c +@@ -575,17 +575,21 @@ static void stm32_pwm_detect_complementary(struct stm32_pwm *priv) + priv->have_complementary_output = (ccer != 0); + } + +-static unsigned int stm32_pwm_detect_channels(struct stm32_pwm *priv) ++static unsigned int stm32_pwm_detect_channels(struct stm32_pwm *priv, ++ unsigned int *num_enabled) + { +- u32 ccer; ++ u32 ccer, ccer_backup; + + /* + * If channels enable bits don't exist writing 1 will have no + * effect so we can detect and count them. + */ ++ regmap_read(priv->regmap, TIM_CCER, &ccer_backup); + regmap_set_bits(priv->regmap, TIM_CCER, TIM_CCER_CCXE); + regmap_read(priv->regmap, TIM_CCER, &ccer); +- regmap_clear_bits(priv->regmap, TIM_CCER, TIM_CCER_CCXE); ++ regmap_write(priv->regmap, TIM_CCER, ccer_backup); ++ ++ *num_enabled = hweight32(ccer_backup & TIM_CCER_CCXE); + + return hweight32(ccer & TIM_CCER_CCXE); + } +@@ -596,6 +600,8 @@ static int stm32_pwm_probe(struct platform_device *pdev) + struct device_node *np = dev->of_node; + struct stm32_timers *ddata = dev_get_drvdata(pdev->dev.parent); + struct stm32_pwm *priv; ++ unsigned int num_enabled; ++ unsigned int i; + int ret; + + priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL); +@@ -618,7 +624,11 @@ static int stm32_pwm_probe(struct platform_device *pdev) + + priv->chip.dev = dev; + priv->chip.ops = &stm32pwm_ops; +- priv->chip.npwm = stm32_pwm_detect_channels(priv); ++ priv->chip.npwm = stm32_pwm_detect_channels(priv, &num_enabled); ++ ++ /* Initialize clock refcount to number of enabled PWM channels. */ ++ for (i = 0; i < num_enabled; i++) ++ clk_enable(priv->clk); + + ret = pwmchip_add(&priv->chip); + if (ret < 0) +-- +2.43.0 + diff --git a/queue-5.15/pwm-stm32-use-hweight32-in-stm32_pwm_detect_channels.patch b/queue-5.15/pwm-stm32-use-hweight32-in-stm32_pwm_detect_channels.patch new file mode 100644 index 00000000000..8f6946377c5 --- /dev/null +++ b/queue-5.15/pwm-stm32-use-hweight32-in-stm32_pwm_detect_channels.patch @@ -0,0 +1,66 @@ +From fd685acf525004554eb9d63bd99b591c1e1bad33 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Oct 2023 22:07:02 +0200 +Subject: pwm: stm32: Use hweight32 in stm32_pwm_detect_channels +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Philipp Zabel + +[ Upstream commit 41fa8f57c0d269243fe3bde2bce71e82c884b9ad ] + +Use hweight32() to count the CCxE bits in stm32_pwm_detect_channels(). +Since the return value is assigned to chip.npwm, change it to unsigned +int as well. + +Signed-off-by: Philipp Zabel +Signed-off-by: Uwe Kleine-König +Reviewed-by: Fabrice Gasnier +Signed-off-by: Thierry Reding +Stable-dep-of: 19f1016ea960 ("pwm: stm32: Fix enable count for clk in .probe()") +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-stm32.c | 17 ++--------------- + 1 file changed, 2 insertions(+), 15 deletions(-) + +diff --git a/drivers/pwm/pwm-stm32.c b/drivers/pwm/pwm-stm32.c +index 21e4a34dfff3..9c260aac442d 100644 +--- a/drivers/pwm/pwm-stm32.c ++++ b/drivers/pwm/pwm-stm32.c +@@ -575,10 +575,9 @@ static void stm32_pwm_detect_complementary(struct stm32_pwm *priv) + priv->have_complementary_output = (ccer != 0); + } + +-static int stm32_pwm_detect_channels(struct stm32_pwm *priv) ++static unsigned int stm32_pwm_detect_channels(struct stm32_pwm *priv) + { + u32 ccer; +- int npwm = 0; + + /* + * If channels enable bits don't exist writing 1 will have no +@@ -588,19 +587,7 @@ static int stm32_pwm_detect_channels(struct stm32_pwm *priv) + regmap_read(priv->regmap, TIM_CCER, &ccer); + regmap_clear_bits(priv->regmap, TIM_CCER, TIM_CCER_CCXE); + +- if (ccer & TIM_CCER_CC1E) +- npwm++; +- +- if (ccer & TIM_CCER_CC2E) +- npwm++; +- +- if (ccer & TIM_CCER_CC3E) +- npwm++; +- +- if (ccer & TIM_CCER_CC4E) +- npwm++; +- +- return npwm; ++ return hweight32(ccer & TIM_CCER_CCXE); + } + + static int stm32_pwm_probe(struct platform_device *pdev) +-- +2.43.0 + diff --git a/queue-5.15/pwm-stm32-use-regmap_clear_bits-and-regmap_set_bits-.patch b/queue-5.15/pwm-stm32-use-regmap_clear_bits-and-regmap_set_bits-.patch new file mode 100644 index 00000000000..27f6e4840e7 --- /dev/null +++ b/queue-5.15/pwm-stm32-use-regmap_clear_bits-and-regmap_set_bits-.patch @@ -0,0 +1,150 @@ +From 7efd90f9217f4491f590b9ba596fb1880e37d812 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Dec 2022 19:35:18 +0100 +Subject: pwm: stm32: Use regmap_clear_bits and regmap_set_bits where + applicable +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 632ae5d7eb348b3ef88552ec0999260b6f9d6ab1 ] + +Found using coccinelle and the following semantic patch: + +@@ +expression map, reg, bits; +@@ + +- regmap_update_bits(map, reg, bits, bits) ++ regmap_set_bits(map, reg, bits) + +@@ +expression map, reg, bits; +@@ + +- regmap_update_bits(map, reg, bits, 0) ++ regmap_clear_bits(map, reg, bits) + +Tested-by: Fabrice Gasnier +Link: https://lore.kernel.org/r/20221115111347.3705732-6-u.kleine-koenig@pengutronix.de +Signed-off-by: Uwe Kleine-König +Signed-off-by: Thierry Reding +Stable-dep-of: 19f1016ea960 ("pwm: stm32: Fix enable count for clk in .probe()") +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-stm32.c | 34 ++++++++++++++++------------------ + 1 file changed, 16 insertions(+), 18 deletions(-) + +diff --git a/drivers/pwm/pwm-stm32.c b/drivers/pwm/pwm-stm32.c +index 794ca5b02968..21e4a34dfff3 100644 +--- a/drivers/pwm/pwm-stm32.c ++++ b/drivers/pwm/pwm-stm32.c +@@ -115,14 +115,14 @@ static int stm32_pwm_raw_capture(struct stm32_pwm *priv, struct pwm_device *pwm, + int ret; + + /* Ensure registers have been updated, enable counter and capture */ +- regmap_update_bits(priv->regmap, TIM_EGR, TIM_EGR_UG, TIM_EGR_UG); +- regmap_update_bits(priv->regmap, TIM_CR1, TIM_CR1_CEN, TIM_CR1_CEN); ++ regmap_set_bits(priv->regmap, TIM_EGR, TIM_EGR_UG); ++ regmap_set_bits(priv->regmap, TIM_CR1, TIM_CR1_CEN); + + /* Use cc1 or cc3 DMA resp for PWM input channels 1 & 2 or 3 & 4 */ + dma_id = pwm->hwpwm < 2 ? STM32_TIMERS_DMA_CH1 : STM32_TIMERS_DMA_CH3; + ccen = pwm->hwpwm < 2 ? TIM_CCER_CC12E : TIM_CCER_CC34E; + ccr = pwm->hwpwm < 2 ? TIM_CCR1 : TIM_CCR3; +- regmap_update_bits(priv->regmap, TIM_CCER, ccen, ccen); ++ regmap_set_bits(priv->regmap, TIM_CCER, ccen); + + /* + * Timer DMA burst mode. Request 2 registers, 2 bursts, to get both +@@ -160,8 +160,8 @@ static int stm32_pwm_raw_capture(struct stm32_pwm *priv, struct pwm_device *pwm, + } + + stop: +- regmap_update_bits(priv->regmap, TIM_CCER, ccen, 0); +- regmap_update_bits(priv->regmap, TIM_CR1, TIM_CR1_CEN, 0); ++ regmap_clear_bits(priv->regmap, TIM_CCER, ccen); ++ regmap_clear_bits(priv->regmap, TIM_CR1, TIM_CR1_CEN); + + return ret; + } +@@ -359,7 +359,7 @@ static int stm32_pwm_config(struct stm32_pwm *priv, int ch, + + regmap_write(priv->regmap, TIM_PSC, prescaler); + regmap_write(priv->regmap, TIM_ARR, prd - 1); +- regmap_update_bits(priv->regmap, TIM_CR1, TIM_CR1_ARPE, TIM_CR1_ARPE); ++ regmap_set_bits(priv->regmap, TIM_CR1, TIM_CR1_ARPE); + + /* Calculate the duty cycles */ + dty = prd * duty_ns; +@@ -377,7 +377,7 @@ static int stm32_pwm_config(struct stm32_pwm *priv, int ch, + else + regmap_update_bits(priv->regmap, TIM_CCMR2, mask, ccmr); + +- regmap_update_bits(priv->regmap, TIM_BDTR, TIM_BDTR_MOE, TIM_BDTR_MOE); ++ regmap_set_bits(priv->regmap, TIM_BDTR, TIM_BDTR_MOE); + + return 0; + } +@@ -411,13 +411,13 @@ static int stm32_pwm_enable(struct stm32_pwm *priv, int ch) + if (priv->have_complementary_output) + mask |= TIM_CCER_CC1NE << (ch * 4); + +- regmap_update_bits(priv->regmap, TIM_CCER, mask, mask); ++ regmap_set_bits(priv->regmap, TIM_CCER, mask); + + /* Make sure that registers are updated */ +- regmap_update_bits(priv->regmap, TIM_EGR, TIM_EGR_UG, TIM_EGR_UG); ++ regmap_set_bits(priv->regmap, TIM_EGR, TIM_EGR_UG); + + /* Enable controller */ +- regmap_update_bits(priv->regmap, TIM_CR1, TIM_CR1_CEN, TIM_CR1_CEN); ++ regmap_set_bits(priv->regmap, TIM_CR1, TIM_CR1_CEN); + + return 0; + } +@@ -431,11 +431,11 @@ static void stm32_pwm_disable(struct stm32_pwm *priv, int ch) + if (priv->have_complementary_output) + mask |= TIM_CCER_CC1NE << (ch * 4); + +- regmap_update_bits(priv->regmap, TIM_CCER, mask, 0); ++ regmap_clear_bits(priv->regmap, TIM_CCER, mask); + + /* When all channels are disabled, we can disable the controller */ + if (!active_channels(priv)) +- regmap_update_bits(priv->regmap, TIM_CR1, TIM_CR1_CEN, 0); ++ regmap_clear_bits(priv->regmap, TIM_CR1, TIM_CR1_CEN); + + clk_disable(priv->clk); + } +@@ -568,10 +568,9 @@ static void stm32_pwm_detect_complementary(struct stm32_pwm *priv) + * If complementary bit doesn't exist writing 1 will have no + * effect so we can detect it. + */ +- regmap_update_bits(priv->regmap, +- TIM_CCER, TIM_CCER_CC1NE, TIM_CCER_CC1NE); ++ regmap_set_bits(priv->regmap, TIM_CCER, TIM_CCER_CC1NE); + regmap_read(priv->regmap, TIM_CCER, &ccer); +- regmap_update_bits(priv->regmap, TIM_CCER, TIM_CCER_CC1NE, 0); ++ regmap_clear_bits(priv->regmap, TIM_CCER, TIM_CCER_CC1NE); + + priv->have_complementary_output = (ccer != 0); + } +@@ -585,10 +584,9 @@ static int stm32_pwm_detect_channels(struct stm32_pwm *priv) + * If channels enable bits don't exist writing 1 will have no + * effect so we can detect and count them. + */ +- regmap_update_bits(priv->regmap, +- TIM_CCER, TIM_CCER_CCXE, TIM_CCER_CCXE); ++ regmap_set_bits(priv->regmap, TIM_CCER, TIM_CCER_CCXE); + regmap_read(priv->regmap, TIM_CCER, &ccer); +- regmap_update_bits(priv->regmap, TIM_CCER, TIM_CCER_CCXE, 0); ++ regmap_clear_bits(priv->regmap, TIM_CCER, TIM_CCER_CCXE); + + if (ccer & TIM_CCER_CC1E) + npwm++; +-- +2.43.0 + diff --git a/queue-5.15/rdma-hns-fix-inappropriate-err-code-for-unsupported-.patch b/queue-5.15/rdma-hns-fix-inappropriate-err-code-for-unsupported-.patch new file mode 100644 index 00000000000..df7d6a79fb9 --- /dev/null +++ b/queue-5.15/rdma-hns-fix-inappropriate-err-code-for-unsupported-.patch @@ -0,0 +1,52 @@ +From 08a40af91d7acadca6c72d50514ac97f047f6419 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Nov 2023 20:34:47 +0800 +Subject: RDMA/hns: Fix inappropriate err code for unsupported operations + +From: Junxian Huang + +[ Upstream commit f45b83ad39f8033e717b1eee57e81811113d5a84 ] + +EOPNOTSUPP is more situable than EINVAL for allocating XRCD while XRC +is not supported and unsupported resizing SRQ. + +Fixes: 32548870d438 ("RDMA/hns: Add support for XRC on HIP09") +Fixes: 221109e64316 ("RDMA/hns: Add interception for resizing SRQs") +Signed-off-by: Junxian Huang +Link: https://lore.kernel.org/r/20231114123449.1106162-2-huangjunxian6@hisilicon.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 2 +- + drivers/infiniband/hw/hns/hns_roce_pd.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +index 6d8f3aa9d6aa..7376f012ece1 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c ++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +@@ -5442,7 +5442,7 @@ static int hns_roce_v2_modify_srq(struct ib_srq *ibsrq, + + /* Resizing SRQs is not supported yet */ + if (srq_attr_mask & IB_SRQ_MAX_WR) +- return -EINVAL; ++ return -EOPNOTSUPP; + + if (srq_attr_mask & IB_SRQ_LIMIT) { + if (srq_attr->srq_limit > srq->wqe_cnt) +diff --git a/drivers/infiniband/hw/hns/hns_roce_pd.c b/drivers/infiniband/hw/hns/hns_roce_pd.c +index 81ffad77ae42..21bc26bd92d9 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_pd.c ++++ b/drivers/infiniband/hw/hns/hns_roce_pd.c +@@ -161,7 +161,7 @@ int hns_roce_alloc_xrcd(struct ib_xrcd *ib_xrcd, struct ib_udata *udata) + int ret; + + if (!(hr_dev->caps.flags & HNS_ROCE_CAP_FLAG_XRC)) +- return -EINVAL; ++ return -EOPNOTSUPP; + + ret = hns_roce_xrcd_alloc(hr_dev, &xrcd->xrcdn); + if (ret) +-- +2.43.0 + diff --git a/queue-5.15/rdma-usnic-silence-uninitialized-symbol-smatch-warni.patch b/queue-5.15/rdma-usnic-silence-uninitialized-symbol-smatch-warni.patch new file mode 100644 index 00000000000..757c0a134e6 --- /dev/null +++ b/queue-5.15/rdma-usnic-silence-uninitialized-symbol-smatch-warni.patch @@ -0,0 +1,82 @@ +From 964f87124739293a5c933b1ac99a1bd004f4e875 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Nov 2023 11:28:02 +0200 +Subject: RDMA/usnic: Silence uninitialized symbol smatch warnings + +From: Leon Romanovsky + +[ Upstream commit b9a85e5eec126d6ae6c362f94b447c223e8fe6e4 ] + +The patch 1da177e4c3f4: "Linux-2.6.12-rc2" from Apr 16, 2005 +(linux-next), leads to the following Smatch static checker warning: + + drivers/infiniband/hw/mthca/mthca_cmd.c:644 mthca_SYS_EN() + error: uninitialized symbol 'out'. + +drivers/infiniband/hw/mthca/mthca_cmd.c + 636 int mthca_SYS_EN(struct mthca_dev *dev) + 637 { + 638 u64 out; + 639 int ret; + 640 + 641 ret = mthca_cmd_imm(dev, 0, &out, 0, 0, CMD_SYS_EN, CMD_TIME_CLASS_D); + +We pass out here and it gets used without being initialized. + + err = mthca_cmd_post(dev, in_param, + out_param ? *out_param : 0, + ^^^^^^^^^^ + in_modifier, op_modifier, + op, context->token, 1); + +It's the same in mthca_cmd_wait() and mthca_cmd_poll(). + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Reported-by: Dan Carpenter +Closes: https://lore.kernel.org/all/533bc3df-8078-4397-b93d-d1f6cec9b636@moroto.mountain +Link: https://lore.kernel.org/r/c559cb7113158c02d75401ac162652072ef1b5f0.1699867650.git.leon@kernel.org +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mthca/mthca_cmd.c | 4 ++-- + drivers/infiniband/hw/mthca/mthca_main.c | 2 +- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/infiniband/hw/mthca/mthca_cmd.c b/drivers/infiniband/hw/mthca/mthca_cmd.c +index bdf5ed38de22..0307c45aa6d3 100644 +--- a/drivers/infiniband/hw/mthca/mthca_cmd.c ++++ b/drivers/infiniband/hw/mthca/mthca_cmd.c +@@ -635,7 +635,7 @@ void mthca_free_mailbox(struct mthca_dev *dev, struct mthca_mailbox *mailbox) + + int mthca_SYS_EN(struct mthca_dev *dev) + { +- u64 out; ++ u64 out = 0; + int ret; + + ret = mthca_cmd_imm(dev, 0, &out, 0, 0, CMD_SYS_EN, CMD_TIME_CLASS_D); +@@ -1955,7 +1955,7 @@ int mthca_WRITE_MGM(struct mthca_dev *dev, int index, + int mthca_MGID_HASH(struct mthca_dev *dev, struct mthca_mailbox *mailbox, + u16 *hash) + { +- u64 imm; ++ u64 imm = 0; + int err; + + err = mthca_cmd_imm(dev, mailbox->dma, &imm, 0, 0, CMD_MGID_HASH, +diff --git a/drivers/infiniband/hw/mthca/mthca_main.c b/drivers/infiniband/hw/mthca/mthca_main.c +index f507c4cd46d3..f77c48b317f2 100644 +--- a/drivers/infiniband/hw/mthca/mthca_main.c ++++ b/drivers/infiniband/hw/mthca/mthca_main.c +@@ -382,7 +382,7 @@ static int mthca_init_icm(struct mthca_dev *mdev, + struct mthca_init_hca_param *init_hca, + u64 icm_size) + { +- u64 aux_pages; ++ u64 aux_pages = 0; + int err; + + err = mthca_SET_ICM_SIZE(mdev, icm_size, &aux_pages); +-- +2.43.0 + diff --git a/queue-5.15/revert-drm-omapdrm-annotate-dma-fence-critical-secti.patch b/queue-5.15/revert-drm-omapdrm-annotate-dma-fence-critical-secti.patch new file mode 100644 index 00000000000..94fcd789deb --- /dev/null +++ b/queue-5.15/revert-drm-omapdrm-annotate-dma-fence-critical-secti.patch @@ -0,0 +1,191 @@ +From 15c733e0425192a9e635aa3bd67895c11a9cc00a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Sep 2023 15:57:17 +0300 +Subject: Revert "drm/omapdrm: Annotate dma-fence critical section in commit + path" + +From: Tomi Valkeinen + +[ Upstream commit 9d7c8c066916f231ca0ed4e4fce6c4b58ca3e451 ] + +This reverts commit 250aa22920cd5d956a5d3e9c6a43d671c2bae217. + +The DMA-fence annotations cause a lockdep warning (see below). As per +https://patchwork.freedesktop.org/patch/462170/ it sounds like the +annotations don't work correctly. + +====================================================== +WARNING: possible circular locking dependency detected +6.5.0-rc2+ #2 Not tainted +------------------------------------------------------ +kmstest/219 is trying to acquire lock: +c4705838 (&hdmi->lock){+.+.}-{3:3}, at: hdmi5_bridge_mode_set+0x1c/0x50 + +but task is already holding lock: +c11e1128 (dma_fence_map){++++}-{0:0}, at: omap_atomic_commit_tail+0x14/0xbc + +which lock already depends on the new lock. + +the existing dependency chain (in reverse order) is: + +-> #2 (dma_fence_map){++++}-{0:0}: + __dma_fence_might_wait+0x48/0xb4 + dma_resv_lockdep+0x1b8/0x2bc + do_one_initcall+0x68/0x3b0 + kernel_init_freeable+0x260/0x34c + kernel_init+0x14/0x140 + ret_from_fork+0x14/0x28 + +-> #1 (fs_reclaim){+.+.}-{0:0}: + fs_reclaim_acquire+0x70/0xa8 + __kmem_cache_alloc_node+0x3c/0x368 + kmalloc_trace+0x28/0x58 + _drm_do_get_edid+0x7c/0x35c + hdmi5_bridge_get_edid+0xc8/0x1ac + drm_bridge_connector_get_modes+0x64/0xc0 + drm_helper_probe_single_connector_modes+0x170/0x528 + drm_client_modeset_probe+0x208/0x1334 + __drm_fb_helper_initial_config_and_unlock+0x30/0x548 + omap_fbdev_client_hotplug+0x3c/0x6c + drm_client_register+0x58/0x94 + pdev_probe+0x544/0x6b0 + platform_probe+0x58/0xbc + really_probe+0xd8/0x3fc + __driver_probe_device+0x94/0x1f4 + driver_probe_device+0x2c/0xc4 + __device_attach_driver+0xa4/0x11c + bus_for_each_drv+0x84/0xdc + __device_attach+0xac/0x20c + bus_probe_device+0x8c/0x90 + device_add+0x588/0x7e0 + platform_device_add+0x110/0x24c + platform_device_register_full+0x108/0x15c + dss_bind+0x90/0xc0 + try_to_bring_up_aggregate_device+0x1e0/0x2c8 + __component_add+0xa4/0x174 + hdmi5_probe+0x1c8/0x270 + platform_probe+0x58/0xbc + really_probe+0xd8/0x3fc + __driver_probe_device+0x94/0x1f4 + driver_probe_device+0x2c/0xc4 + __device_attach_driver+0xa4/0x11c + bus_for_each_drv+0x84/0xdc + __device_attach+0xac/0x20c + bus_probe_device+0x8c/0x90 + deferred_probe_work_func+0x8c/0xd8 + process_one_work+0x2ac/0x6e4 + worker_thread+0x30/0x4ec + kthread+0x100/0x124 + ret_from_fork+0x14/0x28 + +-> #0 (&hdmi->lock){+.+.}-{3:3}: + __lock_acquire+0x145c/0x29cc + lock_acquire.part.0+0xb4/0x258 + __mutex_lock+0x90/0x950 + mutex_lock_nested+0x1c/0x24 + hdmi5_bridge_mode_set+0x1c/0x50 + drm_bridge_chain_mode_set+0x48/0x5c + crtc_set_mode+0x188/0x1d0 + omap_atomic_commit_tail+0x2c/0xbc + commit_tail+0x9c/0x188 + drm_atomic_helper_commit+0x158/0x18c + drm_atomic_commit+0xa4/0xe8 + drm_mode_atomic_ioctl+0x9a4/0xc38 + drm_ioctl+0x210/0x4a8 + sys_ioctl+0x138/0xf00 + ret_fast_syscall+0x0/0x1c + +other info that might help us debug this: + +Chain exists of: + &hdmi->lock --> fs_reclaim --> dma_fence_map + + Possible unsafe locking scenario: + + CPU0 CPU1 + ---- ---- + rlock(dma_fence_map); + lock(fs_reclaim); + lock(dma_fence_map); + lock(&hdmi->lock); + + *** DEADLOCK *** + +3 locks held by kmstest/219: + #0: f1011de4 (crtc_ww_class_acquire){+.+.}-{0:0}, at: drm_mode_atomic_ioctl+0xf0/0xc38 + #1: c47059c8 (crtc_ww_class_mutex){+.+.}-{3:3}, at: modeset_lock+0xf8/0x230 + #2: c11e1128 (dma_fence_map){++++}-{0:0}, at: omap_atomic_commit_tail+0x14/0xbc + +stack backtrace: +CPU: 1 PID: 219 Comm: kmstest Not tainted 6.5.0-rc2+ #2 +Hardware name: Generic DRA74X (Flattened Device Tree) + unwind_backtrace from show_stack+0x10/0x14 + show_stack from dump_stack_lvl+0x58/0x70 + dump_stack_lvl from check_noncircular+0x164/0x198 + check_noncircular from __lock_acquire+0x145c/0x29cc + __lock_acquire from lock_acquire.part.0+0xb4/0x258 + lock_acquire.part.0 from __mutex_lock+0x90/0x950 + __mutex_lock from mutex_lock_nested+0x1c/0x24 + mutex_lock_nested from hdmi5_bridge_mode_set+0x1c/0x50 + hdmi5_bridge_mode_set from drm_bridge_chain_mode_set+0x48/0x5c + drm_bridge_chain_mode_set from crtc_set_mode+0x188/0x1d0 + crtc_set_mode from omap_atomic_commit_tail+0x2c/0xbc + omap_atomic_commit_tail from commit_tail+0x9c/0x188 + commit_tail from drm_atomic_helper_commit+0x158/0x18c + drm_atomic_helper_commit from drm_atomic_commit+0xa4/0xe8 + drm_atomic_commit from drm_mode_atomic_ioctl+0x9a4/0xc38 + drm_mode_atomic_ioctl from drm_ioctl+0x210/0x4a8 + drm_ioctl from sys_ioctl+0x138/0xf00 + sys_ioctl from ret_fast_syscall+0x0/0x1c +Exception stack(0xf1011fa8 to 0xf1011ff0) +1fa0: 00466d58 be9ab510 00000003 c03864bc be9ab510 be9ab4e0 +1fc0: 00466d58 be9ab510 c03864bc 00000036 00466ef0 00466fc0 00467020 00466f20 +1fe0: b6bc7ef4 be9ab4d0 b6bbbb00 b6cb2cc0 + +Fixes: 250aa22920cd ("drm/omapdrm: Annotate dma-fence critical section in commit path") +Reviewed-by: Aradhya Bhatia +Signed-off-by: Tomi Valkeinen +Link: https://patchwork.freedesktop.org/patch/msgid/20230920-dma-fence-annotation-revert-v1-2-7ebf6f7f5bf6@ideasonboard.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/omapdrm/omap_drv.c | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/omapdrm/omap_drv.c b/drivers/gpu/drm/omapdrm/omap_drv.c +index f86e20578143..60871d255a4d 100644 +--- a/drivers/gpu/drm/omapdrm/omap_drv.c ++++ b/drivers/gpu/drm/omapdrm/omap_drv.c +@@ -68,7 +68,6 @@ static void omap_atomic_commit_tail(struct drm_atomic_state *old_state) + { + struct drm_device *dev = old_state->dev; + struct omap_drm_private *priv = dev->dev_private; +- bool fence_cookie = dma_fence_begin_signalling(); + + dispc_runtime_get(priv->dispc); + +@@ -91,6 +90,8 @@ static void omap_atomic_commit_tail(struct drm_atomic_state *old_state) + omap_atomic_wait_for_completion(dev, old_state); + + drm_atomic_helper_commit_planes(dev, old_state, 0); ++ ++ drm_atomic_helper_commit_hw_done(old_state); + } else { + /* + * OMAP3 DSS seems to have issues with the work-around above, +@@ -100,11 +101,9 @@ static void omap_atomic_commit_tail(struct drm_atomic_state *old_state) + drm_atomic_helper_commit_planes(dev, old_state, 0); + + drm_atomic_helper_commit_modeset_enables(dev, old_state); +- } + +- drm_atomic_helper_commit_hw_done(old_state); +- +- dma_fence_end_signalling(fence_cookie); ++ drm_atomic_helper_commit_hw_done(old_state); ++ } + + /* + * Wait for completion of the page flips to ensure that old buffers +-- +2.43.0 + diff --git a/queue-5.15/revert-drm-tidss-annotate-dma-fence-critical-section.patch b/queue-5.15/revert-drm-tidss-annotate-dma-fence-critical-section.patch new file mode 100644 index 00000000000..aaf51fff53a --- /dev/null +++ b/queue-5.15/revert-drm-tidss-annotate-dma-fence-critical-section.patch @@ -0,0 +1,176 @@ +From dfd8d1b3bc7699c931a5025a2158eeaf7957fea3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Sep 2023 15:57:16 +0300 +Subject: Revert "drm/tidss: Annotate dma-fence critical section in commit + path" + +From: Tomi Valkeinen + +[ Upstream commit ca34d816558c3e4c3f8fe037b5a6b16c944693de ] + +This reverts commit 4d56a4f08391857ba93465de489707b66adad114. + +The DMA-fence annotations cause a lockdep warning (see below). As per +https://patchwork.freedesktop.org/patch/462170/ it sounds like the +annotations don't work correctly. + +====================================================== +WARNING: possible circular locking dependency detected +6.6.0-rc2+ #1 Not tainted +------------------------------------------------------ +kmstest/733 is trying to acquire lock: +ffff8000819377f0 (fs_reclaim){+.+.}-{0:0}, at: __kmem_cache_alloc_node+0x58/0x2d4 + +but task is already holding lock: +ffff800081a06aa0 (dma_fence_map){++++}-{0:0}, at: tidss_atomic_commit_tail+0x20/0xc0 [tidss] + +which lock already depends on the new lock. + +the existing dependency chain (in reverse order) is: + +-> #2 (dma_fence_map){++++}-{0:0}: + __dma_fence_might_wait+0x5c/0xd0 + dma_resv_lockdep+0x1a4/0x32c + do_one_initcall+0x84/0x2fc + kernel_init_freeable+0x28c/0x4c4 + kernel_init+0x24/0x1dc + ret_from_fork+0x10/0x20 + +-> #1 (mmu_notifier_invalidate_range_start){+.+.}-{0:0}: + fs_reclaim_acquire+0x70/0xe4 + __kmem_cache_alloc_node+0x58/0x2d4 + kmalloc_trace+0x38/0x78 + __kthread_create_worker+0x3c/0x150 + kthread_create_worker+0x64/0x8c + workqueue_init+0x1e8/0x2f0 + kernel_init_freeable+0x11c/0x4c4 + kernel_init+0x24/0x1dc + ret_from_fork+0x10/0x20 + +-> #0 (fs_reclaim){+.+.}-{0:0}: + __lock_acquire+0x1370/0x20d8 + lock_acquire+0x1e8/0x308 + fs_reclaim_acquire+0xd0/0xe4 + __kmem_cache_alloc_node+0x58/0x2d4 + __kmalloc_node_track_caller+0x58/0xf0 + kmemdup+0x34/0x60 + regmap_bulk_write+0x64/0x2c0 + tc358768_bridge_pre_enable+0x8c/0x12d0 [tc358768] + drm_atomic_bridge_call_pre_enable+0x68/0x80 [drm] + drm_atomic_bridge_chain_pre_enable+0x50/0x158 [drm] + drm_atomic_helper_commit_modeset_enables+0x164/0x264 [drm_kms_helper] + tidss_atomic_commit_tail+0x58/0xc0 [tidss] + commit_tail+0xa0/0x188 [drm_kms_helper] + drm_atomic_helper_commit+0x1a8/0x1c0 [drm_kms_helper] + drm_atomic_commit+0xa8/0xe0 [drm] + drm_mode_atomic_ioctl+0x9ec/0xc80 [drm] + drm_ioctl_kernel+0xc4/0x170 [drm] + drm_ioctl+0x234/0x4b0 [drm] + drm_compat_ioctl+0x110/0x12c [drm] + __arm64_compat_sys_ioctl+0x128/0x150 + invoke_syscall+0x48/0x110 + el0_svc_common.constprop.0+0x40/0xe0 + do_el0_svc_compat+0x1c/0x38 + el0_svc_compat+0x48/0xb4 + el0t_32_sync_handler+0xb0/0x138 + el0t_32_sync+0x194/0x198 + +other info that might help us debug this: + +Chain exists of: + fs_reclaim --> mmu_notifier_invalidate_range_start --> dma_fence_map + + Possible unsafe locking scenario: + + CPU0 CPU1 + ---- ---- + rlock(dma_fence_map); + lock(mmu_notifier_invalidate_range_start); + lock(dma_fence_map); + lock(fs_reclaim); + + *** DEADLOCK *** + +3 locks held by kmstest/733: + #0: ffff800082e5bba0 (crtc_ww_class_acquire){+.+.}-{0:0}, at: drm_mode_atomic_ioctl+0x118/0xc80 [drm] + #1: ffff000004224c88 (crtc_ww_class_mutex){+.+.}-{3:3}, at: modeset_lock+0xdc/0x1a0 [drm] + #2: ffff800081a06aa0 (dma_fence_map){++++}-{0:0}, at: tidss_atomic_commit_tail+0x20/0xc0 [tidss] + +stack backtrace: +CPU: 0 PID: 733 Comm: kmstest Not tainted 6.6.0-rc2+ #1 +Hardware name: Toradex Verdin AM62 on Verdin Development Board (DT) +Call trace: + dump_backtrace+0x98/0x118 + show_stack+0x18/0x24 + dump_stack_lvl+0x60/0xac + dump_stack+0x18/0x24 + print_circular_bug+0x288/0x368 + check_noncircular+0x168/0x17c + __lock_acquire+0x1370/0x20d8 + lock_acquire+0x1e8/0x308 + fs_reclaim_acquire+0xd0/0xe4 + __kmem_cache_alloc_node+0x58/0x2d4 + __kmalloc_node_track_caller+0x58/0xf0 + kmemdup+0x34/0x60 + regmap_bulk_write+0x64/0x2c0 + tc358768_bridge_pre_enable+0x8c/0x12d0 [tc358768] + drm_atomic_bridge_call_pre_enable+0x68/0x80 [drm] + drm_atomic_bridge_chain_pre_enable+0x50/0x158 [drm] + drm_atomic_helper_commit_modeset_enables+0x164/0x264 [drm_kms_helper] + tidss_atomic_commit_tail+0x58/0xc0 [tidss] + commit_tail+0xa0/0x188 [drm_kms_helper] + drm_atomic_helper_commit+0x1a8/0x1c0 [drm_kms_helper] + drm_atomic_commit+0xa8/0xe0 [drm] + drm_mode_atomic_ioctl+0x9ec/0xc80 [drm] + drm_ioctl_kernel+0xc4/0x170 [drm] + drm_ioctl+0x234/0x4b0 [drm] + drm_compat_ioctl+0x110/0x12c [drm] + __arm64_compat_sys_ioctl+0x128/0x150 + invoke_syscall+0x48/0x110 + el0_svc_common.constprop.0+0x40/0xe0 + do_el0_svc_compat+0x1c/0x38 + el0_svc_compat+0x48/0xb4 + el0t_32_sync_handler+0xb0/0x138 + el0t_32_sync+0x194/0x198 + +Fixes: 4d56a4f08391 ("drm/tidss: Annotate dma-fence critical section in commit path") +Reviewed-by: Aradhya Bhatia +Signed-off-by: Tomi Valkeinen +Link: https://patchwork.freedesktop.org/patch/msgid/20230920-dma-fence-annotation-revert-v1-1-7ebf6f7f5bf6@ideasonboard.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/tidss/tidss_kms.c | 4 ---- + 1 file changed, 4 deletions(-) + +diff --git a/drivers/gpu/drm/tidss/tidss_kms.c b/drivers/gpu/drm/tidss/tidss_kms.c +index 666e527a0acf..cb0ab224282f 100644 +--- a/drivers/gpu/drm/tidss/tidss_kms.c ++++ b/drivers/gpu/drm/tidss/tidss_kms.c +@@ -4,8 +4,6 @@ + * Author: Tomi Valkeinen + */ + +-#include +- + #include + #include + #include +@@ -28,7 +26,6 @@ static void tidss_atomic_commit_tail(struct drm_atomic_state *old_state) + { + struct drm_device *ddev = old_state->dev; + struct tidss_device *tidss = to_tidss(ddev); +- bool fence_cookie = dma_fence_begin_signalling(); + + dev_dbg(ddev->dev, "%s\n", __func__); + +@@ -39,7 +36,6 @@ static void tidss_atomic_commit_tail(struct drm_atomic_state *old_state) + drm_atomic_helper_commit_modeset_enables(ddev, old_state); + + drm_atomic_helper_commit_hw_done(old_state); +- dma_fence_end_signalling(fence_cookie); + drm_atomic_helper_wait_for_flip_done(ddev, old_state); + + drm_atomic_helper_cleanup_planes(ddev, old_state); +-- +2.43.0 + diff --git a/queue-5.15/scsi-fnic-return-error-if-vmalloc-failed.patch b/queue-5.15/scsi-fnic-return-error-if-vmalloc-failed.patch new file mode 100644 index 00000000000..f7e05defbde --- /dev/null +++ b/queue-5.15/scsi-fnic-return-error-if-vmalloc-failed.patch @@ -0,0 +1,44 @@ +From 7afb484c2e35cbe269ddccdd5379cef194d54d83 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Nov 2023 14:10:08 +0300 +Subject: scsi: fnic: Return error if vmalloc() failed + +From: Artem Chernyshev + +[ Upstream commit f5f27a332a14f43463aa0075efa3a0c662c0f4a8 ] + +In fnic_init_module() exists redundant check for return value from +fnic_debugfs_init(), because at moment it only can return zero. It make +sense to process theoretical vmalloc() failure. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 9730ddfb123d ("scsi: fnic: remove redundant assignment of variable rc") +Signed-off-by: Artem Chernyshev +Link: https://lore.kernel.org/r/20231128111008.2280507-1-artem.chernyshev@red-soft.ru +Reviewed-by: Karan Tilak Kumar +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/fnic/fnic_debugfs.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/fnic/fnic_debugfs.c b/drivers/scsi/fnic/fnic_debugfs.c +index e7326505cabb..f611e9f00a9d 100644 +--- a/drivers/scsi/fnic/fnic_debugfs.c ++++ b/drivers/scsi/fnic/fnic_debugfs.c +@@ -66,9 +66,10 @@ int fnic_debugfs_init(void) + fc_trc_flag->fnic_trace = 2; + fc_trc_flag->fc_trace = 3; + fc_trc_flag->fc_clear = 4; ++ return 0; + } + +- return 0; ++ return -ENOMEM; + } + + /* +-- +2.43.0 + diff --git a/queue-5.15/scsi-hisi_sas-correct-the-number-of-global-debugfs-r.patch b/queue-5.15/scsi-hisi_sas-correct-the-number-of-global-debugfs-r.patch new file mode 100644 index 00000000000..742b822d7a6 --- /dev/null +++ b/queue-5.15/scsi-hisi_sas-correct-the-number-of-global-debugfs-r.patch @@ -0,0 +1,42 @@ +From 8e9e07b8b25ca9eb4307171cea827f1a562c9404 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Dec 2023 11:45:16 +0800 +Subject: scsi: hisi_sas: Correct the number of global debugfs registers + +From: Yihang Li + +[ Upstream commit 73e33f969ef05328766b23a99b2c07bfff765009 ] + +In function debugfs_debugfs_snapshot_global_reg_v3_hw() it uses +debugfs_axi_reg.count (which is the number of axi debugfs registers) to +acquire the number of global debugfs registers. + +Use debugfs_global_reg.count to acquire the number of global debugfs +registers instead. + +Fixes: 623a4b6d5c2a ("scsi: hisi_sas: Move debugfs code to v3 hw driver") +Signed-off-by: Yihang Li +Signed-off-by: Xiang Chen +Link: https://lore.kernel.org/r/1702525516-51258-6-git-send-email-chenxiang66@hisilicon.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +index 4505310c0c3c..1651d03d3b46 100644 +--- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c ++++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +@@ -3331,7 +3331,7 @@ static void debugfs_snapshot_global_reg_v3_hw(struct hisi_hba *hisi_hba) + u32 *databuf = hisi_hba->debugfs_regs[dump_index][DEBUGFS_GLOBAL].data; + int i; + +- for (i = 0; i < debugfs_axi_reg.count; i++, databuf++) ++ for (i = 0; i < debugfs_global_reg.count; i++, databuf++) + *databuf = hisi_sas_read32(hisi_hba, 4 * i); + } + +-- +2.43.0 + diff --git a/queue-5.15/scsi-hisi_sas-prevent-parallel-flr-and-controller-re.patch b/queue-5.15/scsi-hisi_sas-prevent-parallel-flr-and-controller-re.patch new file mode 100644 index 00000000000..4591841e4dc --- /dev/null +++ b/queue-5.15/scsi-hisi_sas-prevent-parallel-flr-and-controller-re.patch @@ -0,0 +1,98 @@ +From 8dc18255f53f0bcaa39174b78e4e1502b42a7fbd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Dec 2021 22:37:39 +0800 +Subject: scsi: hisi_sas: Prevent parallel FLR and controller reset + +From: Qi Liu + +[ Upstream commit 16775db613c2bdea09705dcb876942c0641a1098 ] + +If we issue a controller reset command during executing a FLR a hung task +may be found: + + Call trace: + __switch_to+0x158/0x1cc + __schedule+0x2e8/0x85c + schedule+0x7c/0x110 + schedule_timeout+0x190/0x1cc + __down+0x7c/0xd4 + down+0x5c/0x7c + hisi_sas_task_exec+0x510/0x680 [hisi_sas_main] + hisi_sas_queue_command+0x24/0x30 [hisi_sas_main] + smp_execute_task_sg+0xf4/0x23c [libsas] + sas_smp_phy_control+0x110/0x1e0 [libsas] + transport_sas_phy_reset+0xc8/0x190 [libsas] + phy_reset_work+0x2c/0x40 [libsas] + process_one_work+0x1dc/0x48c + worker_thread+0x15c/0x464 + kthread+0x160/0x170 + ret_from_fork+0x10/0x18 + +This is a race condition which occurs when the FLR completes first. + +Here the host HISI_SAS_RESETTING_BIT flag out gets of sync as +HISI_SAS_RESETTING_BIT is not always cleared with the hisi_hba.sem held, so +now only set/unset HISI_SAS_RESETTING_BIT under hisi_hba.sem . + +Link: https://lore.kernel.org/r/1639579061-179473-7-git-send-email-john.garry@huawei.com +Signed-off-by: Qi Liu +Signed-off-by: John Garry +Signed-off-by: Martin K. Petersen +Stable-dep-of: d34ee535705e ("scsi: hisi_sas: Replace with standard error code return value") +Signed-off-by: Sasha Levin +--- + drivers/scsi/hisi_sas/hisi_sas_main.c | 8 +++++--- + drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 1 + + 2 files changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/scsi/hisi_sas/hisi_sas_main.c b/drivers/scsi/hisi_sas/hisi_sas_main.c +index 7744594cd3e3..19081790f011 100644 +--- a/drivers/scsi/hisi_sas/hisi_sas_main.c ++++ b/drivers/scsi/hisi_sas/hisi_sas_main.c +@@ -1548,7 +1548,6 @@ void hisi_sas_controller_reset_prepare(struct hisi_hba *hisi_hba) + { + struct Scsi_Host *shost = hisi_hba->shost; + +- down(&hisi_hba->sem); + hisi_hba->phy_state = hisi_hba->hw->get_phys_state(hisi_hba); + + scsi_block_requests(shost); +@@ -1574,9 +1573,9 @@ void hisi_sas_controller_reset_done(struct hisi_hba *hisi_hba) + if (hisi_hba->reject_stp_links_msk) + hisi_sas_terminate_stp_reject(hisi_hba); + hisi_sas_reset_init_all_devices(hisi_hba); +- up(&hisi_hba->sem); + scsi_unblock_requests(shost); + clear_bit(HISI_SAS_RESETTING_BIT, &hisi_hba->flags); ++ up(&hisi_hba->sem); + + hisi_sas_rescan_topology(hisi_hba, hisi_hba->phy_state); + } +@@ -1587,8 +1586,11 @@ static int hisi_sas_controller_prereset(struct hisi_hba *hisi_hba) + if (!hisi_hba->hw->soft_reset) + return -1; + +- if (test_and_set_bit(HISI_SAS_RESETTING_BIT, &hisi_hba->flags)) ++ down(&hisi_hba->sem); ++ if (test_and_set_bit(HISI_SAS_RESETTING_BIT, &hisi_hba->flags)) { ++ up(&hisi_hba->sem); + return -1; ++ } + + if (hisi_sas_debugfs_enable && hisi_hba->debugfs_itct[0].itct) + hisi_hba->hw->debugfs_snapshot_regs(hisi_hba); +diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +index 2ed787956fa8..0e57381121d5 100644 +--- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c ++++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +@@ -4935,6 +4935,7 @@ static void hisi_sas_reset_prepare_v3_hw(struct pci_dev *pdev) + int rc; + + dev_info(dev, "FLR prepare\n"); ++ down(&hisi_hba->sem); + set_bit(HISI_SAS_RESETTING_BIT, &hisi_hba->flags); + hisi_sas_controller_reset_prepare(hisi_hba); + +-- +2.43.0 + diff --git a/queue-5.15/scsi-hisi_sas-rename-hisi_sas_-reset-resetting-_bit.patch b/queue-5.15/scsi-hisi_sas-rename-hisi_sas_-reset-resetting-_bit.patch new file mode 100644 index 00000000000..4768aa96e08 --- /dev/null +++ b/queue-5.15/scsi-hisi_sas-rename-hisi_sas_-reset-resetting-_bit.patch @@ -0,0 +1,175 @@ +From 1d7aaa533d9d7db67eddbd5189874db7bc4720e4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Aug 2021 18:00:58 +0800 +Subject: scsi: hisi_sas: Rename HISI_SAS_{RESET -> RESETTING}_BIT + +From: Luo Jiaxing + +[ Upstream commit b5a9fa20e3bf59d89b5f48315a0c0c32963796ed ] + +HISI_SAS_RESET_BIT means that the controller is being reset, and so the +name is a bit vague. Rename it to HISI_SAS_RESETTING_BIT. + +Link: https://lore.kernel.org/r/1629799260-120116-4-git-send-email-john.garry@huawei.com +Signed-off-by: Luo Jiaxing +Signed-off-by: John Garry +Signed-off-by: Martin K. Petersen +Stable-dep-of: d34ee535705e ("scsi: hisi_sas: Replace with standard error code return value") +Signed-off-by: Sasha Levin +--- + drivers/scsi/hisi_sas/hisi_sas.h | 2 +- + drivers/scsi/hisi_sas/hisi_sas_main.c | 12 ++++++------ + drivers/scsi/hisi_sas/hisi_sas_v1_hw.c | 2 +- + drivers/scsi/hisi_sas/hisi_sas_v2_hw.c | 2 +- + drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 10 +++++----- + 5 files changed, 14 insertions(+), 14 deletions(-) + +diff --git a/drivers/scsi/hisi_sas/hisi_sas.h b/drivers/scsi/hisi_sas/hisi_sas.h +index 436d174f2194..57be32ba0109 100644 +--- a/drivers/scsi/hisi_sas/hisi_sas.h ++++ b/drivers/scsi/hisi_sas/hisi_sas.h +@@ -35,7 +35,7 @@ + #define HISI_SAS_QUEUE_SLOTS 4096 + #define HISI_SAS_MAX_ITCT_ENTRIES 1024 + #define HISI_SAS_MAX_DEVICES HISI_SAS_MAX_ITCT_ENTRIES +-#define HISI_SAS_RESET_BIT 0 ++#define HISI_SAS_RESETTING_BIT 0 + #define HISI_SAS_REJECT_CMD_BIT 1 + #define HISI_SAS_PM_BIT 2 + #define HISI_SAS_HW_FAULT_BIT 3 +diff --git a/drivers/scsi/hisi_sas/hisi_sas_main.c b/drivers/scsi/hisi_sas/hisi_sas_main.c +index 7d93783c09a5..7744594cd3e3 100644 +--- a/drivers/scsi/hisi_sas/hisi_sas_main.c ++++ b/drivers/scsi/hisi_sas/hisi_sas_main.c +@@ -724,7 +724,7 @@ static int hisi_sas_init_device(struct domain_device *device) + */ + local_phy = sas_get_local_phy(device); + if (!scsi_is_sas_phy_local(local_phy) && +- !test_bit(HISI_SAS_RESET_BIT, &hisi_hba->flags)) { ++ !test_bit(HISI_SAS_RESETTING_BIT, &hisi_hba->flags)) { + unsigned long deadline = ata_deadline(jiffies, 20000); + struct sata_device *sata_dev = &device->sata_dev; + struct ata_host *ata_host = sata_dev->ata_host; +@@ -1072,7 +1072,7 @@ static void hisi_sas_dev_gone(struct domain_device *device) + sas_dev->device_id, sas_dev->dev_type); + + down(&hisi_hba->sem); +- if (!test_bit(HISI_SAS_RESET_BIT, &hisi_hba->flags)) { ++ if (!test_bit(HISI_SAS_RESETTING_BIT, &hisi_hba->flags)) { + hisi_sas_internal_task_abort(hisi_hba, device, + HISI_SAS_INT_ABT_DEV, 0, true); + +@@ -1576,7 +1576,7 @@ void hisi_sas_controller_reset_done(struct hisi_hba *hisi_hba) + hisi_sas_reset_init_all_devices(hisi_hba); + up(&hisi_hba->sem); + scsi_unblock_requests(shost); +- clear_bit(HISI_SAS_RESET_BIT, &hisi_hba->flags); ++ clear_bit(HISI_SAS_RESETTING_BIT, &hisi_hba->flags); + + hisi_sas_rescan_topology(hisi_hba, hisi_hba->phy_state); + } +@@ -1587,7 +1587,7 @@ static int hisi_sas_controller_prereset(struct hisi_hba *hisi_hba) + if (!hisi_hba->hw->soft_reset) + return -1; + +- if (test_and_set_bit(HISI_SAS_RESET_BIT, &hisi_hba->flags)) ++ if (test_and_set_bit(HISI_SAS_RESETTING_BIT, &hisi_hba->flags)) + return -1; + + if (hisi_sas_debugfs_enable && hisi_hba->debugfs_itct[0].itct) +@@ -1611,7 +1611,7 @@ static int hisi_sas_controller_reset(struct hisi_hba *hisi_hba) + clear_bit(HISI_SAS_REJECT_CMD_BIT, &hisi_hba->flags); + up(&hisi_hba->sem); + scsi_unblock_requests(shost); +- clear_bit(HISI_SAS_RESET_BIT, &hisi_hba->flags); ++ clear_bit(HISI_SAS_RESETTING_BIT, &hisi_hba->flags); + return rc; + } + +@@ -2251,7 +2251,7 @@ void hisi_sas_phy_down(struct hisi_hba *hisi_hba, int phy_no, int rdy, + } else { + struct hisi_sas_port *port = phy->port; + +- if (test_bit(HISI_SAS_RESET_BIT, &hisi_hba->flags) || ++ if (test_bit(HISI_SAS_RESETTING_BIT, &hisi_hba->flags) || + phy->in_reset) { + dev_info(dev, "ignore flutter phy%d down\n", phy_no); + return; +diff --git a/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c +index afe639994f3d..862f4e8b7eb5 100644 +--- a/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c ++++ b/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c +@@ -1422,7 +1422,7 @@ static irqreturn_t int_bcast_v1_hw(int irq, void *p) + goto end; + } + +- if (!test_bit(HISI_SAS_RESET_BIT, &hisi_hba->flags)) ++ if (!test_bit(HISI_SAS_RESETTING_BIT, &hisi_hba->flags)) + sas_notify_port_event(sas_phy, PORTE_BROADCAST_RCVD, + GFP_ATOMIC); + +diff --git a/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c +index c40588ed68a5..a6d89a149546 100644 +--- a/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c ++++ b/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c +@@ -2831,7 +2831,7 @@ static void phy_bcast_v2_hw(int phy_no, struct hisi_hba *hisi_hba) + hisi_sas_phy_write32(hisi_hba, phy_no, SL_RX_BCAST_CHK_MSK, 1); + bcast_status = hisi_sas_phy_read32(hisi_hba, phy_no, RX_PRIMS_STATUS); + if ((bcast_status & RX_BCAST_CHG_MSK) && +- !test_bit(HISI_SAS_RESET_BIT, &hisi_hba->flags)) ++ !test_bit(HISI_SAS_RESETTING_BIT, &hisi_hba->flags)) + sas_notify_port_event(sas_phy, PORTE_BROADCAST_RCVD, + GFP_ATOMIC); + hisi_sas_phy_write32(hisi_hba, phy_no, CHL_INT0, +diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +index d1c07e7cb60d..2ed787956fa8 100644 +--- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c ++++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +@@ -1622,7 +1622,7 @@ static irqreturn_t phy_bcast_v3_hw(int phy_no, struct hisi_hba *hisi_hba) + hisi_sas_phy_write32(hisi_hba, phy_no, SL_RX_BCAST_CHK_MSK, 1); + bcast_status = hisi_sas_phy_read32(hisi_hba, phy_no, RX_PRIMS_STATUS); + if ((bcast_status & RX_BCAST_CHG_MSK) && +- !test_bit(HISI_SAS_RESET_BIT, &hisi_hba->flags)) ++ !test_bit(HISI_SAS_RESETTING_BIT, &hisi_hba->flags)) + sas_notify_port_event(sas_phy, PORTE_BROADCAST_RCVD, + GFP_ATOMIC); + hisi_sas_phy_write32(hisi_hba, phy_no, CHL_INT0, +@@ -4935,7 +4935,7 @@ static void hisi_sas_reset_prepare_v3_hw(struct pci_dev *pdev) + int rc; + + dev_info(dev, "FLR prepare\n"); +- set_bit(HISI_SAS_RESET_BIT, &hisi_hba->flags); ++ set_bit(HISI_SAS_RESETTING_BIT, &hisi_hba->flags); + hisi_sas_controller_reset_prepare(hisi_hba); + + rc = disable_host_v3_hw(hisi_hba); +@@ -4981,7 +4981,7 @@ static int _suspend_v3_hw(struct device *device) + return -ENODEV; + } + +- if (test_and_set_bit(HISI_SAS_RESET_BIT, &hisi_hba->flags)) ++ if (test_and_set_bit(HISI_SAS_RESETTING_BIT, &hisi_hba->flags)) + return -1; + + scsi_block_requests(shost); +@@ -4992,7 +4992,7 @@ static int _suspend_v3_hw(struct device *device) + if (rc) { + dev_err(dev, "PM suspend: disable host failed rc=%d\n", rc); + clear_bit(HISI_SAS_REJECT_CMD_BIT, &hisi_hba->flags); +- clear_bit(HISI_SAS_RESET_BIT, &hisi_hba->flags); ++ clear_bit(HISI_SAS_RESETTING_BIT, &hisi_hba->flags); + scsi_unblock_requests(shost); + return rc; + } +@@ -5031,7 +5031,7 @@ static int _resume_v3_hw(struct device *device) + } + phys_init_v3_hw(hisi_hba); + sas_resume_ha(sha); +- clear_bit(HISI_SAS_RESET_BIT, &hisi_hba->flags); ++ clear_bit(HISI_SAS_RESETTING_BIT, &hisi_hba->flags); + + return 0; + } +-- +2.43.0 + diff --git a/queue-5.15/scsi-hisi_sas-replace-with-standard-error-code-retur.patch b/queue-5.15/scsi-hisi_sas-replace-with-standard-error-code-retur.patch new file mode 100644 index 00000000000..e90984e7968 --- /dev/null +++ b/queue-5.15/scsi-hisi_sas-replace-with-standard-error-code-retur.patch @@ -0,0 +1,63 @@ +From db5609e44c4a684b665f4df7892fc2b75cbe0005 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Dec 2023 11:45:13 +0800 +Subject: scsi: hisi_sas: Replace with standard error code return value + +From: Yihang Li + +[ Upstream commit d34ee535705eb43885bc0f561c63046f697355ad ] + +In function hisi_sas_controller_prereset(), -ENOSYS (Function not +implemented) should be returned if the driver does not support .soft_reset. +Returns -EPERM (Operation not permitted) if HISI_SAS_RESETTING_BIT is +already be set. + +In function _suspend_v3_hw(), returns -EPERM (Operation not permitted) if +HISI_SAS_RESETTING_BIT is already be set. + +Fixes: 4522204ab218 ("scsi: hisi_sas: tidy host controller reset function a bit") +Signed-off-by: Yihang Li +Signed-off-by: Xiang Chen +Link: https://lore.kernel.org/r/1702525516-51258-3-git-send-email-chenxiang66@hisilicon.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/hisi_sas/hisi_sas_main.c | 4 ++-- + drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 2 +- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/scsi/hisi_sas/hisi_sas_main.c b/drivers/scsi/hisi_sas/hisi_sas_main.c +index 19081790f011..530f61df109a 100644 +--- a/drivers/scsi/hisi_sas/hisi_sas_main.c ++++ b/drivers/scsi/hisi_sas/hisi_sas_main.c +@@ -1584,12 +1584,12 @@ EXPORT_SYMBOL_GPL(hisi_sas_controller_reset_done); + static int hisi_sas_controller_prereset(struct hisi_hba *hisi_hba) + { + if (!hisi_hba->hw->soft_reset) +- return -1; ++ return -ENOENT; + + down(&hisi_hba->sem); + if (test_and_set_bit(HISI_SAS_RESETTING_BIT, &hisi_hba->flags)) { + up(&hisi_hba->sem); +- return -1; ++ return -EPERM; + } + + if (hisi_sas_debugfs_enable && hisi_hba->debugfs_itct[0].itct) +diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +index 0e57381121d5..88af529ab100 100644 +--- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c ++++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +@@ -4983,7 +4983,7 @@ static int _suspend_v3_hw(struct device *device) + } + + if (test_and_set_bit(HISI_SAS_RESETTING_BIT, &hisi_hba->flags)) +- return -1; ++ return -EPERM; + + scsi_block_requests(shost); + set_bit(HISI_SAS_REJECT_CMD_BIT, &hisi_hba->flags); +-- +2.43.0 + diff --git a/queue-5.15/scsi-hisi_sas-rollback-some-operations-if-flr-failed.patch b/queue-5.15/scsi-hisi_sas-rollback-some-operations-if-flr-failed.patch new file mode 100644 index 00000000000..47e8b1c53fa --- /dev/null +++ b/queue-5.15/scsi-hisi_sas-rollback-some-operations-if-flr-failed.patch @@ -0,0 +1,55 @@ +From 5b795ccf6d6f89696f06893ff5eafdacd74b6a60 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Dec 2023 11:45:15 +0800 +Subject: scsi: hisi_sas: Rollback some operations if FLR failed + +From: Yihang Li + +[ Upstream commit 7ea3e7763c50b20a8bd25cf524ea0c6463de69be ] + +We obtain the semaphore and set HISI_SAS_RESETTING_BIT in +hisi_sas_reset_prepare_v3_hw(), block the scsi host and set +HISI_SAS_REJECT_CMD_BIT in hisi_sas_controller_reset_prepare(), released +them in hisi_sas_controller_reset_done(). However, if the HW reset failure +in FLR results in early return, the semaphore and flag bits will not be +release. + +Rollback some operations including clearing flags / releasing semaphore +when FLR is failed. + +Fixes: e5ea48014adc ("scsi: hisi_sas: Implement handlers of PCIe FLR for v3 hw") +Signed-off-by: Yihang Li +Signed-off-by: Xiang Chen +Link: https://lore.kernel.org/r/1702525516-51258-5-git-send-email-chenxiang66@hisilicon.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +index 88af529ab100..4505310c0c3c 100644 +--- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c ++++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +@@ -4948,6 +4948,7 @@ static void hisi_sas_reset_done_v3_hw(struct pci_dev *pdev) + { + struct sas_ha_struct *sha = pci_get_drvdata(pdev); + struct hisi_hba *hisi_hba = sha->lldd_ha; ++ struct Scsi_Host *shost = hisi_hba->shost; + struct device *dev = hisi_hba->dev; + int rc; + +@@ -4956,6 +4957,10 @@ static void hisi_sas_reset_done_v3_hw(struct pci_dev *pdev) + rc = hw_init_v3_hw(hisi_hba); + if (rc) { + dev_err(dev, "FLR: hw init failed rc=%d\n", rc); ++ clear_bit(HISI_SAS_REJECT_CMD_BIT, &hisi_hba->flags); ++ scsi_unblock_requests(shost); ++ clear_bit(HISI_SAS_RESETTING_BIT, &hisi_hba->flags); ++ up(&hisi_hba->sem); + return; + } + +-- +2.43.0 + diff --git a/queue-5.15/selftests-net-fix-grep-checking-for-fib_nexthop_mult.patch b/queue-5.15/selftests-net-fix-grep-checking-for-fib_nexthop_mult.patch new file mode 100644 index 00000000000..8189a9afe7f --- /dev/null +++ b/queue-5.15/selftests-net-fix-grep-checking-for-fib_nexthop_mult.patch @@ -0,0 +1,68 @@ +From ce2e8f058ccc4d1a05b75c27ff721ec11e380525 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Dec 2023 14:08:49 +0800 +Subject: selftests/net: fix grep checking for fib_nexthop_multiprefix + +From: Hangbin Liu + +[ Upstream commit a33e9da3470499e9ff476138f271fb52d6bfe767 ] + +When running fib_nexthop_multiprefix test I saw all IPv6 test failed. +e.g. + + ]# ./fib_nexthop_multiprefix.sh + TEST: IPv4: host 0 to host 1, mtu 1300 [ OK ] + TEST: IPv6: host 0 to host 1, mtu 1300 [FAIL] + + With -v it shows + + COMMAND: ip netns exec h0 /usr/sbin/ping6 -s 1350 -c5 -w5 2001:db8:101::1 + PING 2001:db8:101::1(2001:db8:101::1) 1350 data bytes + From 2001:db8:100::64 icmp_seq=1 Packet too big: mtu=1300 + + --- 2001:db8:101::1 ping statistics --- + 1 packets transmitted, 0 received, +1 errors, 100% packet loss, time 0ms + + Route get + 2001:db8:101::1 via 2001:db8:100::64 dev eth0 src 2001:db8:100::1 metric 1024 expires 599sec mtu 1300 pref medium + Searching for: + 2001:db8:101::1 from :: via 2001:db8:100::64 dev eth0 src 2001:db8:100::1 .* mtu 1300 + +The reason is when CONFIG_IPV6_SUBTREES is not enabled, rt6_fill_node() will +not put RTA_SRC info. After fix: + +]# ./fib_nexthop_multiprefix.sh +TEST: IPv4: host 0 to host 1, mtu 1300 [ OK ] +TEST: IPv6: host 0 to host 1, mtu 1300 [ OK ] + +Fixes: 735ab2f65dce ("selftests: Add test with multiple prefixes using single nexthop") +Signed-off-by: Hangbin Liu +Link: https://lore.kernel.org/r/20231213060856.4030084-7-liuhangbin@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/net/fib_nexthop_multiprefix.sh | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/testing/selftests/net/fib_nexthop_multiprefix.sh b/tools/testing/selftests/net/fib_nexthop_multiprefix.sh +index 51df5e305855..b52d59547fc5 100755 +--- a/tools/testing/selftests/net/fib_nexthop_multiprefix.sh ++++ b/tools/testing/selftests/net/fib_nexthop_multiprefix.sh +@@ -209,12 +209,12 @@ validate_v6_exception() + echo "Route get" + ip -netns h0 -6 ro get ${dst} + echo "Searching for:" +- echo " ${dst} from :: via ${r1} dev eth0 src ${h0} .* mtu ${mtu}" ++ echo " ${dst}.* via ${r1} dev eth0 src ${h0} .* mtu ${mtu}" + echo + fi + + ip -netns h0 -6 ro get ${dst} | \ +- grep -q "${dst} from :: via ${r1} dev eth0 src ${h0} .* mtu ${mtu}" ++ grep -q "${dst}.* via ${r1} dev eth0 src ${h0} .* mtu ${mtu}" + rc=$? + + log_test $rc 0 "IPv6: host 0 to host ${i}, mtu ${mtu}" +-- +2.43.0 + diff --git a/queue-5.15/selftests-powerpc-fix-error-handling-in-fpu-vmx-pree.patch b/queue-5.15/selftests-powerpc-fix-error-handling-in-fpu-vmx-pree.patch new file mode 100644 index 00000000000..14f8e39372b --- /dev/null +++ b/queue-5.15/selftests-powerpc-fix-error-handling-in-fpu-vmx-pree.patch @@ -0,0 +1,88 @@ +From bc762b72517cecc6aa765852336cf7c57d390fd7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Nov 2023 00:27:44 +1100 +Subject: selftests/powerpc: Fix error handling in FPU/VMX preemption tests + +From: Michael Ellerman + +[ Upstream commit 9dbd5927408c4a0707de73ae9dd9306b184e8fee ] + +The FPU & VMX preemption tests do not check for errors returned by the +low-level asm routines, preempt_fpu() / preempt_vsx() respectively. +That means any register corruption detected by the asm routines does not +result in a test failure. + +Fix it by returning the return value of the asm routines from the +pthread child routines. + +Fixes: e5ab8be68e44 ("selftests/powerpc: Test preservation of FPU and VMX regs across preemption") +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20231128132748.1990179-1-mpe@ellerman.id.au +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/powerpc/math/fpu_preempt.c | 9 +++++---- + tools/testing/selftests/powerpc/math/vmx_preempt.c | 10 ++++++---- + 2 files changed, 11 insertions(+), 8 deletions(-) + +diff --git a/tools/testing/selftests/powerpc/math/fpu_preempt.c b/tools/testing/selftests/powerpc/math/fpu_preempt.c +index 5235bdc8c0b1..3e5b5663d244 100644 +--- a/tools/testing/selftests/powerpc/math/fpu_preempt.c ++++ b/tools/testing/selftests/powerpc/math/fpu_preempt.c +@@ -37,19 +37,20 @@ __thread double darray[] = {0.1, 0.2, 0.3, 0.4, 0.5, 0.6, 0.7, 0.8, 0.9, 1.0, + int threads_starting; + int running; + +-extern void preempt_fpu(double *darray, int *threads_starting, int *running); ++extern int preempt_fpu(double *darray, int *threads_starting, int *running); + + void *preempt_fpu_c(void *p) + { ++ long rc; + int i; ++ + srand(pthread_self()); + for (i = 0; i < 21; i++) + darray[i] = rand(); + +- /* Test failed if it ever returns */ +- preempt_fpu(darray, &threads_starting, &running); ++ rc = preempt_fpu(darray, &threads_starting, &running); + +- return p; ++ return (void *)rc; + } + + int test_preempt_fpu(void) +diff --git a/tools/testing/selftests/powerpc/math/vmx_preempt.c b/tools/testing/selftests/powerpc/math/vmx_preempt.c +index 6761d6ce30ec..6f7cf400c687 100644 +--- a/tools/testing/selftests/powerpc/math/vmx_preempt.c ++++ b/tools/testing/selftests/powerpc/math/vmx_preempt.c +@@ -37,19 +37,21 @@ __thread vector int varray[] = {{1, 2, 3, 4}, {5, 6, 7, 8}, {9, 10,11,12}, + int threads_starting; + int running; + +-extern void preempt_vmx(vector int *varray, int *threads_starting, int *running); ++extern int preempt_vmx(vector int *varray, int *threads_starting, int *running); + + void *preempt_vmx_c(void *p) + { + int i, j; ++ long rc; ++ + srand(pthread_self()); + for (i = 0; i < 12; i++) + for (j = 0; j < 4; j++) + varray[i][j] = rand(); + +- /* Test fails if it ever returns */ +- preempt_vmx(varray, &threads_starting, &running); +- return p; ++ rc = preempt_vmx(varray, &threads_starting, &running); ++ ++ return (void *)rc; + } + + int test_preempt_vmx(void) +-- +2.43.0 + diff --git a/queue-5.15/selinux-fix-error-priority-for-bind-with-af_unspec-o.patch b/queue-5.15/selinux-fix-error-priority-for-bind-with-af_unspec-o.patch new file mode 100644 index 00000000000..483e7caf429 --- /dev/null +++ b/queue-5.15/selinux-fix-error-priority-for-bind-with-af_unspec-o.patch @@ -0,0 +1,55 @@ +From 9c939c0d4646473f1674082a0ed0116482338352 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Jan 2024 17:34:15 +0100 +Subject: selinux: Fix error priority for bind with AF_UNSPEC on PF_INET6 + socket +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Mickaël Salaün + +[ Upstream commit bbf5a1d0e5d0fb3bdf90205aa872636122692a50 ] + +The IPv6 network stack first checks the sockaddr length (-EINVAL error) +before checking the family (-EAFNOSUPPORT error). + +This was discovered thanks to commit a549d055a22e ("selftests/landlock: +Add network tests"). + +Cc: Eric Paris +Cc: Konstantin Meskhidze +Cc: Paul Moore +Cc: Stephen Smalley +Reported-by: Muhammad Usama Anjum +Closes: https://lore.kernel.org/r/0584f91c-537c-4188-9e4f-04f192565667@collabora.com +Fixes: 0f8db8cc73df ("selinux: add AF_UNSPEC and INADDR_ANY checks to selinux_socket_bind()") +Signed-off-by: Mickaël Salaün +Tested-by: Muhammad Usama Anjum +Signed-off-by: Paul Moore +Signed-off-by: Sasha Levin +--- + security/selinux/hooks.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c +index 9ce029b2f226..ec839716dbac 100644 +--- a/security/selinux/hooks.c ++++ b/security/selinux/hooks.c +@@ -4774,6 +4774,13 @@ static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, in + return -EINVAL; + addr4 = (struct sockaddr_in *)address; + if (family_sa == AF_UNSPEC) { ++ if (family == PF_INET6) { ++ /* Length check from inet6_bind_sk() */ ++ if (addrlen < SIN6_LEN_RFC2133) ++ return -EINVAL; ++ /* Family check from __inet6_bind() */ ++ goto err_af; ++ } + /* see __inet_bind(), we only want to allow + * AF_UNSPEC if the address is INADDR_ANY + */ +-- +2.43.0 + diff --git a/queue-5.15/series b/queue-5.15/series index bfc71323692..76273fefd10 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -60,3 +60,183 @@ parport-parport_serial-add-brainboxes-device-ids-and-geometry.patch leds-ledtrig-tty-free-allocated-ttyname-buffer-on-deactivate.patch pci-add-acs-quirk-for-more-zhaoxin-root-ports.patch coresight-etm4x-fix-width-of-ccitmin-field.patch +x86-lib-fix-overflow-when-counting-digits.patch +edac-thunderx-fix-possible-out-of-bounds-string-acce.patch +powerpc-mark-.opd-section-read-only.patch +powerpc-toc-future-proof-kernel-toc.patch +powerpc-remove-checks-for-binutils-older-than-2.25.patch +powerpc-add-crtsavres.o-to-always-y-instead-of-extra.patch +powerpc-44x-select-i2c-for-currituck.patch +powerpc-pseries-memhp-fix-access-beyond-end-of-drmem.patch +selftests-powerpc-fix-error-handling-in-fpu-vmx-pree.patch +powerpc-powernv-add-a-null-pointer-check-to-scom_deb.patch +powerpc-powernv-add-a-null-pointer-check-in-opal_eve.patch +powerpc-powernv-add-a-null-pointer-check-in-opal_pow.patch +powerpc-imc-pmu-add-a-null-pointer-check-in-update_e.patch +spi-spi-zynqmp-gqspi-fix-driver-kconfig-dependencies.patch +mtd-rawnand-increment-ifc_timeout_msecs-for-nand-con.patch +acpi-video-check-for-error-while-searching-for-backl.patch +acpi-lpit-avoid-u32-multiplication-overflow.patch +of-property-define-of_property_read_u-8-16-32-64-_ar.patch +of-add-of_property_present-helper.patch +cpufreq-use-of_property_present-for-testing-dt-prope.patch +cpufreq-scmi-process-the-result-of-devm_of_clk_add_h.patch +calipso-fix-memory-leak-in-netlbl_calipso_add_pass.patch +efivarfs-force-ro-when-remounting-if-setvariable-is-.patch +spi-sh-msiof-enforce-fixed-dtdl-for-r-car-h3.patch +acpi-lpss-fix-the-fractional-clock-divider-flags.patch +acpi-extlog-clear-extended-error-log-status-when-ras.patch +kunit-debugfs-fix-unchecked-dereference-in-debugfs_p.patch +mtd-fix-gluebi-null-pointer-dereference-caused-by-ft.patch +selinux-fix-error-priority-for-bind-with-af_unspec-o.patch +crypto-virtio-handle-dataq-logic-with-tasklet.patch +crypto-sa2ul-return-crypto_aead_setkey-to-transfer-t.patch +crypto-ccp-fix-memleak-in-ccp_init_dm_workarea.patch +crypto-af_alg-disallow-multiple-in-flight-aio-reques.patch +crypto-sahara-remove-flags_new_key-logic.patch +crypto-sahara-fix-cbc-selftest-failure.patch +crypto-sahara-fix-ahash-selftest-failure.patch +crypto-sahara-fix-processing-requests-with-cryptlen-.patch +crypto-sahara-fix-error-handling-in-sahara_hw_descri.patch +pstore-ram_core-fix-possible-overflow-in-persistent_.patch +fs-indicate-request-originates-from-old-mount-api.patch +gfs2-fix-kernel-null-pointer-dereference-in-gfs2_rgr.patch +crypto-virtio-wait-for-tasklet-to-complete-on-device.patch +crypto-sahara-avoid-skcipher-fallback-code-duplicati.patch +crypto-sahara-handle-zero-length-aes-requests.patch +crypto-sahara-fix-ahash-reqsize.patch +crypto-sahara-fix-wait_for_completion_timeout-error-.patch +crypto-sahara-improve-error-handling-in-sahara_sha_p.patch +crypto-sahara-fix-processing-hash-requests-with-req-.patch +crypto-sahara-do-not-resize-req-src-when-doing-hash-.patch +crypto-scomp-fix-req-dst-buffer-overflow.patch +blocklayoutdriver-fix-reference-leak-of-pnfs_device_.patch +nfsv4.1-pnfs-ensure-we-handle-the-error-nfs4err_retu.patch +wifi-rtw88-fix-rx-filter-in-fif_allmulti-flag.patch +bpf-lpm-fix-check-prefixlen-before-walking-trie.patch +bpf-add-crosstask-check-to-__bpf_get_stack.patch +wifi-ath11k-defer-on-rproc_get-failure.patch +wifi-libertas-stop-selecting-wext.patch +arm-dts-qcom-apq8064-correct-xoadc-register-address.patch +net-ncsi-fix-netlink-major-minor-version-numbers.patch +firmware-ti_sci-fix-an-off-by-one-in-ti_sci_debugfs_.patch +firmware-meson_sm-populate-platform-devices-from-sm-.patch +wifi-rtlwifi-rtl8821ae-phy-fix-an-undefined-bitwise-.patch +arm64-dts-ti-k3-am65-main-fix-dss-irq-trigger-type.patch +bpf-enforce-precision-of-r0-on-callback-return.patch +arm-dts-qcom-sdx65-correct-spmi-node-name.patch +arm64-dts-qcom-sc7180-make-watchdog-bark-interrupt-e.patch +arm64-dts-qcom-sc7280-make-watchdog-bark-interrupt-e.patch +arm64-dts-qcom-sdm845-make-watchdog-bark-interrupt-e.patch +arm64-dts-qcom-sm8150-make-watchdog-bark-interrupt-e.patch +arm64-dts-qcom-sm8250-make-watchdog-bark-interrupt-e.patch +bpf-fix-check-for-attempt-to-corrupt-spilled-pointer.patch +scsi-fnic-return-error-if-vmalloc-failed.patch +arm64-dts-qcom-qrb5165-rb5-correct-led-panic-indicat.patch +arm64-dts-qcom-sdm845-db845c-correct-led-panic-indic.patch +arm64-dts-qcom-sc7280-fix-usb_2-wakeup-interrupt-typ.patch +bpf-fix-verification-of-indirect-var-off-stack-acces.patch +driver-core-remove-config_sysfs_deprecated-and-confi.patch +block-set-memalloc_noio-to-false-on-device_add_disk-.patch +scsi-hisi_sas-rename-hisi_sas_-reset-resetting-_bit.patch +scsi-hisi_sas-prevent-parallel-flr-and-controller-re.patch +scsi-hisi_sas-replace-with-standard-error-code-retur.patch +scsi-hisi_sas-rollback-some-operations-if-flr-failed.patch +scsi-hisi_sas-correct-the-number-of-global-debugfs-r.patch +selftests-net-fix-grep-checking-for-fib_nexthop_mult.patch +virtio-vsock-fix-logic-which-reduces-credit-update-m.patch +dma-mapping-add-dma_release_coherent_memory-to-dma-a.patch +dma-mapping-clear-dev-dma_mem-to-null-after-freeing-.patch +soc-qcom-llcc-fix-dis_cap_alloc-and-retain_on_pc-con.patch +arm64-dts-qcom-sm8150-hdk-fix-ss-usb-regulators.patch +block-add-check-of-minors-and-first_minor-in-device_.patch +arm64-dts-qcom-sc7280-mark-sdhci-hosts-as-cache-cohe.patch +wifi-rtlwifi-add-calculate_bit_shift.patch +wifi-rtlwifi-rtl8188ee-phy-using-calculate_bit_shift.patch +wifi-rtlwifi-rtl8192c-using-calculate_bit_shift.patch +wifi-rtlwifi-rtl8192cu-using-calculate_bit_shift.patch +wifi-rtlwifi-rtl8192ce-using-calculate_bit_shift.patch +wifi-rtlwifi-rtl8192de-using-calculate_bit_shift.patch +wifi-rtlwifi-rtl8192ee-using-calculate_bit_shift.patch +wifi-rtlwifi-rtl8192se-using-calculate_bit_shift.patch +wifi-iwlwifi-mvm-set-siso-mimo-chains-to-1-in-fw-smp.patch +wifi-iwlwifi-mvm-send-tx-path-flush-in-rfkill.patch +netfilter-nf_tables-mark-newset-as-dead-on-transacti.patch +bluetooth-fix-bogus-check-for-re-auth-no-supported-w.patch +bluetooth-btmtkuart-fix-recv_buf-return-value.patch +block-make-blk_def_max_sectors-unsigned.patch +null_blk-don-t-cap-max_hw_sectors-to-blk_def_max_sec.patch +net-sched-act_ct-fix-skb-leak-and-crash-on-ooo-frags.patch +mlxbf_gige-fix-intermittent-no-ip-issue.patch +net-mellanox-mlxbf_gige-replace-non-standard-interru.patch +mlxbf_gige-enable-the-gige-port-in-mlxbf_gige_open.patch +ip6_tunnel-fix-nexthdr_fragment-handling-in-ip6_tnl_.patch +arm-davinci-always-select-config_cpu_arm926t.patch +revert-drm-tidss-annotate-dma-fence-critical-section.patch +revert-drm-omapdrm-annotate-dma-fence-critical-secti.patch +rdma-usnic-silence-uninitialized-symbol-smatch-warni.patch +rdma-hns-fix-inappropriate-err-code-for-unsupported-.patch +drm-panel-elida-kd35t133-hold-panel-in-reset-for-unp.patch +drm-nouveau-fence-fix-warning-directly-dereferencing.patch +drm-bridge-tpd12s015-drop-buggy-__exit-annotation-fo.patch +drm-tilcdc-fix-irq-free-on-unload.patch +media-pvrusb2-fix-use-after-free-on-context-disconne.patch +drm-bridge-fix-typo-in-post_disable-description.patch +f2fs-fix-to-avoid-dirent-corruption.patch +drm-radeon-r600_cs-fix-possible-int-overflows-in-r60.patch +drm-radeon-r100-fix-integer-overflow-issues-in-r100_.patch +drm-radeon-check-return-value-of-radeon_ring_lock.patch +asoc-cs35l33-fix-gpio-name-and-drop-legacy-include.patch +asoc-cs35l34-fix-gpio-name-and-drop-legacy-include.patch +drm-msm-mdp4-flush-vblank-event-on-disable.patch +drm-msm-dsi-use-pm_runtime_resume_and_get-to-prevent.patch +drm-drv-propagate-errors-from-drm_modeset_register_a.patch +drm-radeon-check-the-alloc_workqueue-return-value-in.patch +drm-radeon-dpm-fix-a-memleak-in-sumo_parse_power_tab.patch +drm-radeon-trinity_dpm-fix-a-memleak-in-trinity_pars.patch +drm-bridge-cdns-mhdp8546-fix-use-of-uninitialized-va.patch +drm-bridge-tc358767-fix-return-value-on-error-case.patch +media-cx231xx-fix-a-memleak-in-cx231xx_init_isoc.patch +clk-qcom-gpucc-sm8150-update-the-gpu_cc_pll1-config.patch +media-rkisp1-disable-runtime-pm-in-probe-error-path.patch +media-rkisp1-fix-media-device-memory-leak.patch +f2fs-fix-to-check-compress-file-in-f2fs_move_file_ra.patch +f2fs-fix-to-update-iostat-correctly-in-f2fs_filemap_.patch +f2fs-fix-the-f2fs_file_write_iter-tracepoint.patch +media-dvbdev-drop-refcount-on-error-path-in-dvb_devi.patch +media-dvb-frontends-m88ds3103-fix-a-memory-leak-in-a.patch +drm-amdgpu-debugfs-fix-error-code-when-smc-register-.patch +drm-amd-pm-fix-a-double-free-in-si_dpm_init.patch +drivers-amd-pm-fix-a-use-after-free-in-kv_parse_powe.patch +gpu-drm-radeon-fix-two-memleaks-in-radeon_vm_init.patch +dt-bindings-clock-update-the-videocc-resets-for-sm81.patch +clk-qcom-videocc-sm8150-update-the-videocc-resets.patch +clk-qcom-videocc-sm8150-add-missing-pll-config-prope.patch +drivers-clk-zynqmp-calculate-closest-mux-rate.patch +clk-zynqmp-make-bestdiv-unsigned.patch +clk-zynqmp-add-a-check-for-null-pointer.patch +drivers-clk-zynqmp-update-divider-round-rate-logic.patch +watchdog-set-cdev-owner-before-adding.patch +watchdog-hpwdt-only-claim-unknown-nmi-if-from-ilo.patch +watchdog-bcm2835_wdt-fix-wdioc_settimeout-handling.patch +watchdog-rti_wdt-drop-runtime-pm-reference-count-whe.patch +clk-si5341-fix-an-error-code-problem-in-si5341_outpu.patch +clk-asm9260-use-parent-index-to-link-the-reference-c.patch +clk-fixed-rate-add-devm_clk_hw_register_fixed_rate.patch +clk-fixed-rate-fix-clk_hw_register_fixed_rate_with_a.patch +pwm-stm32-use-regmap_clear_bits-and-regmap_set_bits-.patch +pwm-stm32-use-hweight32-in-stm32_pwm_detect_channels.patch +pwm-stm32-fix-enable-count-for-clk-in-.probe.patch +asoc-rt5645-drop-double-ef20-entry-from-dmi_platform.patch +alsa-scarlett2-add-missing-error-check-to-scarlett2_.patch +alsa-scarlett2-add-missing-error-check-to-scarlett2_.patch-9803 +alsa-scarlett2-allow-passing-any-output-to-line_out_.patch +alsa-scarlett2-add-missing-error-checks-to-_ctl_get.patch +alsa-scarlett2-add-clamp-in-scarlett2_mixer_ctl_put.patch +mmc-sdhci_am654-fix-ti-soc-dependencies.patch +mmc-sdhci_omap-fix-ti-soc-dependencies.patch +ib-iser-prevent-invalidating-wrong-mr.patch +drm-amd-pm-smu7-fix-a-memleak-in-smu7_hwmgr_backend_.patch +ksmbd-validate-the-zero-field-of-packet-header.patch +of-fix-double-free-in-of_parse_phandle_with_args_map.patch +of-unittest-fix-of_count_phandle_with_args-expected-.patch diff --git a/queue-5.15/soc-qcom-llcc-fix-dis_cap_alloc-and-retain_on_pc-con.patch b/queue-5.15/soc-qcom-llcc-fix-dis_cap_alloc-and-retain_on_pc-con.patch new file mode 100644 index 00000000000..dc87a8d4c56 --- /dev/null +++ b/queue-5.15/soc-qcom-llcc-fix-dis_cap_alloc-and-retain_on_pc-con.patch @@ -0,0 +1,69 @@ +From d2527e3d3672f2a74d3c7f97fd7cbcbf3c9f1de1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Dec 2023 21:02:51 +0530 +Subject: soc: qcom: llcc: Fix dis_cap_alloc and retain_on_pc configuration + +From: Atul Dhudase + +[ Upstream commit eed6e57e9f3e2beac37563eb6a0129549daa330e ] + +Commit c14e64b46944 ("soc: qcom: llcc: Support chipsets that can + write to llcc") add the support for chipset where capacity based +allocation and retention through power collapse can be programmed +based on content of SCT table mentioned in the llcc driver where +the target like sdm845 where the entire programming related to it +is controlled in firmware. However, the commit introduces a bug +where capacity/retention register get overwritten each time it +gets programmed for each slice and that results in misconfiguration +of the register based on SCT table and that is not expected +behaviour instead it should be read modify write to retain the +configuration of other slices. + +This issue is totally caught from code review and programming test +and not through any power/perf numbers so, it is not known what +impact this could make if we don't have this change however, +this feature are for these targets and they should have been +programmed accordingly as per their configuration mentioned in +SCT table like others bits information. + +This change brings one difference where it keeps capacity/retention +bits of the slices that are not mentioned in SCT table in unknown +state where as earlier it was initialized to zero. + +Fixes: c14e64b46944 ("soc: qcom: llcc: Support chipsets that can write to llcc") +Signed-off-by: Atul Dhudase +Signed-off-by: Mukesh Ojha +Reviewed-by: Douglas Anderson +Link: https://lore.kernel.org/r/1701876771-10695-1-git-send-email-quic_mojha@quicinc.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/soc/qcom/llcc-qcom.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/soc/qcom/llcc-qcom.c b/drivers/soc/qcom/llcc-qcom.c +index fabc5ce828af..59e359e9062b 100644 +--- a/drivers/soc/qcom/llcc-qcom.c ++++ b/drivers/soc/qcom/llcc-qcom.c +@@ -450,14 +450,14 @@ static int _qcom_llcc_cfg_program(const struct llcc_slice_config *config, + u32 disable_cap_alloc, retain_pc; + + disable_cap_alloc = config->dis_cap_alloc << config->slice_id; +- ret = regmap_write(drv_data->bcast_regmap, +- LLCC_TRP_SCID_DIS_CAP_ALLOC, disable_cap_alloc); ++ ret = regmap_update_bits(drv_data->bcast_regmap, LLCC_TRP_SCID_DIS_CAP_ALLOC, ++ BIT(config->slice_id), disable_cap_alloc); + if (ret) + return ret; + + retain_pc = config->retain_on_pc << config->slice_id; +- ret = regmap_write(drv_data->bcast_regmap, +- LLCC_TRP_PCB_ACT, retain_pc); ++ ret = regmap_update_bits(drv_data->bcast_regmap, LLCC_TRP_PCB_ACT, ++ BIT(config->slice_id), retain_pc); + if (ret) + return ret; + } +-- +2.43.0 + diff --git a/queue-5.15/spi-sh-msiof-enforce-fixed-dtdl-for-r-car-h3.patch b/queue-5.15/spi-sh-msiof-enforce-fixed-dtdl-for-r-car-h3.patch new file mode 100644 index 00000000000..23b2572f6d3 --- /dev/null +++ b/queue-5.15/spi-sh-msiof-enforce-fixed-dtdl-for-r-car-h3.patch @@ -0,0 +1,80 @@ +From 5f835ba8ca0d06d98bf5c0d750c9bf344122c37f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Dec 2023 09:12:38 +0100 +Subject: spi: sh-msiof: Enforce fixed DTDL for R-Car H3 + +From: Wolfram Sang + +[ Upstream commit e5c7bcb499840551cfbe85c6df177ebc50432bf0 ] + +Documentation says only DTDL of 200 is allowed for this SoC. + +Fixes: 4286db8456f4 ("spi: sh-msiof: Add R-Car Gen 2 and 3 fallback bindings") +Signed-off-by: Wolfram Sang +Reviewed-by: Geert Uytterhoeven +Reviewed-by: Yoshihiro Shimoda +Link: https://msgid.link/r/20231212081239.14254-1-wsa+renesas@sang-engineering.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-sh-msiof.c | 17 +++++++++++++++++ + 1 file changed, 17 insertions(+) + +diff --git a/drivers/spi/spi-sh-msiof.c b/drivers/spi/spi-sh-msiof.c +index f88d9acd20d9..eb2c64e0a5f7 100644 +--- a/drivers/spi/spi-sh-msiof.c ++++ b/drivers/spi/spi-sh-msiof.c +@@ -30,12 +30,15 @@ + + #include + ++#define SH_MSIOF_FLAG_FIXED_DTDL_200 BIT(0) ++ + struct sh_msiof_chipdata { + u32 bits_per_word_mask; + u16 tx_fifo_size; + u16 rx_fifo_size; + u16 ctlr_flags; + u16 min_div_pow; ++ u32 flags; + }; + + struct sh_msiof_spi_priv { +@@ -1073,6 +1076,16 @@ static const struct sh_msiof_chipdata rcar_gen3_data = { + .min_div_pow = 1, + }; + ++static const struct sh_msiof_chipdata rcar_r8a7795_data = { ++ .bits_per_word_mask = SPI_BPW_MASK(8) | SPI_BPW_MASK(16) | ++ SPI_BPW_MASK(24) | SPI_BPW_MASK(32), ++ .tx_fifo_size = 64, ++ .rx_fifo_size = 64, ++ .ctlr_flags = SPI_CONTROLLER_MUST_TX, ++ .min_div_pow = 1, ++ .flags = SH_MSIOF_FLAG_FIXED_DTDL_200, ++}; ++ + static const struct of_device_id sh_msiof_match[] = { + { .compatible = "renesas,sh-mobile-msiof", .data = &sh_data }, + { .compatible = "renesas,msiof-r8a7743", .data = &rcar_gen2_data }, +@@ -1083,6 +1096,7 @@ static const struct of_device_id sh_msiof_match[] = { + { .compatible = "renesas,msiof-r8a7793", .data = &rcar_gen2_data }, + { .compatible = "renesas,msiof-r8a7794", .data = &rcar_gen2_data }, + { .compatible = "renesas,rcar-gen2-msiof", .data = &rcar_gen2_data }, ++ { .compatible = "renesas,msiof-r8a7795", .data = &rcar_r8a7795_data }, + { .compatible = "renesas,msiof-r8a7796", .data = &rcar_gen3_data }, + { .compatible = "renesas,rcar-gen3-msiof", .data = &rcar_gen3_data }, + { .compatible = "renesas,sh-msiof", .data = &sh_data }, /* Deprecated */ +@@ -1279,6 +1293,9 @@ static int sh_msiof_spi_probe(struct platform_device *pdev) + return -ENXIO; + } + ++ if (chipdata->flags & SH_MSIOF_FLAG_FIXED_DTDL_200) ++ info->dtdl = 200; ++ + if (info->mode == MSIOF_SPI_SLAVE) + ctlr = spi_alloc_slave(&pdev->dev, + sizeof(struct sh_msiof_spi_priv)); +-- +2.43.0 + diff --git a/queue-5.15/spi-spi-zynqmp-gqspi-fix-driver-kconfig-dependencies.patch b/queue-5.15/spi-spi-zynqmp-gqspi-fix-driver-kconfig-dependencies.patch new file mode 100644 index 00000000000..38e20676cf2 --- /dev/null +++ b/queue-5.15/spi-spi-zynqmp-gqspi-fix-driver-kconfig-dependencies.patch @@ -0,0 +1,42 @@ +From 1a59b4132f9dc1bf55fe8eb72e5f6e12e67cb4d4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Nov 2023 20:23:55 +0530 +Subject: spi: spi-zynqmp-gqspi: fix driver kconfig dependencies + +From: Amit Kumar Mahapatra + +[ Upstream commit 424a8166764e462258fdccaaefbdeb07517c8b21 ] + +ZynqMP GQSPI driver no longer uses spi-master framework. It had been +converted to use spi-mem framework. So remove driver dependency from +spi-master and replace it with spi-mem. + +Fixes: 1c26372e5aa9 ("spi: spi-zynqmp-gqspi: Update driver to use spi-mem framework") +Signed-off-by: Amit Kumar Mahapatra +Signed-off-by: Radhey Shyam Pandey +Link: https://lore.kernel.org/r/1699282435-884917-1-git-send-email-radhey.shyam.pandey@amd.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/Kconfig | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/spi/Kconfig b/drivers/spi/Kconfig +index 123689e457d1..412154732c46 100644 +--- a/drivers/spi/Kconfig ++++ b/drivers/spi/Kconfig +@@ -984,9 +984,10 @@ config SPI_ZYNQ_QSPI + + config SPI_ZYNQMP_GQSPI + tristate "Xilinx ZynqMP GQSPI controller" +- depends on (SPI_MASTER && HAS_DMA) || COMPILE_TEST ++ depends on (SPI_MEM && HAS_DMA) || COMPILE_TEST + help + Enables Xilinx GQSPI controller driver for Zynq UltraScale+ MPSoC. ++ This controller only supports SPI memory interface. + + config SPI_AMD + tristate "AMD SPI controller" +-- +2.43.0 + diff --git a/queue-5.15/virtio-vsock-fix-logic-which-reduces-credit-update-m.patch b/queue-5.15/virtio-vsock-fix-logic-which-reduces-credit-update-m.patch new file mode 100644 index 00000000000..580cc928749 --- /dev/null +++ b/queue-5.15/virtio-vsock-fix-logic-which-reduces-credit-update-m.patch @@ -0,0 +1,69 @@ +From 9bf830baeca12eefb057538b81dbc9755d633b31 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Dec 2023 15:52:28 +0300 +Subject: virtio/vsock: fix logic which reduces credit update messages + +From: Arseniy Krasnov + +[ Upstream commit 93b80887668226180ea5f5349cc728ca6dc700ab ] + +Add one more condition for sending credit update during dequeue from +stream socket: when number of bytes in the rx queue is smaller than +SO_RCVLOWAT value of the socket. This is actual for non-default value +of SO_RCVLOWAT (e.g. not 1) - idea is to "kick" peer to continue data +transmission, because we need at least SO_RCVLOWAT bytes in our rx +queue to wake up user for reading data (in corner case it is also +possible to stuck both tx and rx sides, this is why 'Fixes' is used). + +Fixes: b89d882dc9fc ("vsock/virtio: reduce credit update messages") +Signed-off-by: Arseniy Krasnov +Reviewed-by: Stefano Garzarella +Acked-by: Michael S. Tsirkin +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/vmw_vsock/virtio_transport_common.c | 13 ++++++++++--- + 1 file changed, 10 insertions(+), 3 deletions(-) + +diff --git a/net/vmw_vsock/virtio_transport_common.c b/net/vmw_vsock/virtio_transport_common.c +index 00e8b60af0f8..b490f832439e 100644 +--- a/net/vmw_vsock/virtio_transport_common.c ++++ b/net/vmw_vsock/virtio_transport_common.c +@@ -355,6 +355,8 @@ virtio_transport_stream_do_dequeue(struct vsock_sock *vsk, + struct virtio_vsock_pkt *pkt; + size_t bytes, total = 0; + u32 free_space; ++ u32 fwd_cnt_delta; ++ bool low_rx_bytes; + int err = -EFAULT; + + spin_lock_bh(&vvs->rx_lock); +@@ -386,7 +388,10 @@ virtio_transport_stream_do_dequeue(struct vsock_sock *vsk, + } + } + +- free_space = vvs->buf_alloc - (vvs->fwd_cnt - vvs->last_fwd_cnt); ++ fwd_cnt_delta = vvs->fwd_cnt - vvs->last_fwd_cnt; ++ free_space = vvs->buf_alloc - fwd_cnt_delta; ++ low_rx_bytes = (vvs->rx_bytes < ++ sock_rcvlowat(sk_vsock(vsk), 0, INT_MAX)); + + spin_unlock_bh(&vvs->rx_lock); + +@@ -396,9 +401,11 @@ virtio_transport_stream_do_dequeue(struct vsock_sock *vsk, + * too high causes extra messages. Too low causes transmitter + * stalls. As stalls are in theory more expensive than extra + * messages, we set the limit to a high value. TODO: experiment +- * with different values. ++ * with different values. Also send credit update message when ++ * number of bytes in rx queue is not enough to wake up reader. + */ +- if (free_space < VIRTIO_VSOCK_MAX_PKT_BUF_SIZE) ++ if (fwd_cnt_delta && ++ (free_space < VIRTIO_VSOCK_MAX_PKT_BUF_SIZE || low_rx_bytes)) + virtio_transport_send_credit_update(vsk); + + return total; +-- +2.43.0 + diff --git a/queue-5.15/watchdog-bcm2835_wdt-fix-wdioc_settimeout-handling.patch b/queue-5.15/watchdog-bcm2835_wdt-fix-wdioc_settimeout-handling.patch new file mode 100644 index 00000000000..da58e252de7 --- /dev/null +++ b/queue-5.15/watchdog-bcm2835_wdt-fix-wdioc_settimeout-handling.patch @@ -0,0 +1,57 @@ +From c0e11ff4b93661d51d303ad0db1a6578ce47aa81 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 12 Nov 2023 18:32:51 +0100 +Subject: watchdog: bcm2835_wdt: Fix WDIOC_SETTIMEOUT handling + +From: Stefan Wahren + +[ Upstream commit f33f5b1fd1be5f5106d16f831309648cb0f1c31d ] + +Users report about the unexpected behavior for setting timeouts above +15 sec on Raspberry Pi. According to watchdog-api.rst the ioctl +WDIOC_SETTIMEOUT shouldn't fail because of hardware limitations. +But looking at the code shows that max_timeout based on the +register value PM_WDOG_TIME_SET, which is the maximum. + +Since 664a39236e71 ("watchdog: Introduce hardware maximum heartbeat +in watchdog core") the watchdog core is able to handle this problem. + +This fix has been tested with watchdog-test from selftests. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=217374 +Fixes: 664a39236e71 ("watchdog: Introduce hardware maximum heartbeat in watchdog core") +Signed-off-by: Stefan Wahren +Reviewed-by: Florian Fainelli +Reviewed-by: Guenter Roeck +Link: https://lore.kernel.org/r/20231112173251.4827-1-wahrenst@gmx.net +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/bcm2835_wdt.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/watchdog/bcm2835_wdt.c b/drivers/watchdog/bcm2835_wdt.c +index 94907176a0e4..55c0f7b0e8fb 100644 +--- a/drivers/watchdog/bcm2835_wdt.c ++++ b/drivers/watchdog/bcm2835_wdt.c +@@ -42,6 +42,7 @@ + + #define SECS_TO_WDOG_TICKS(x) ((x) << 16) + #define WDOG_TICKS_TO_SECS(x) ((x) >> 16) ++#define WDOG_TICKS_TO_MSECS(x) ((x) * 1000 >> 16) + + struct bcm2835_wdt { + void __iomem *base; +@@ -140,7 +141,7 @@ static struct watchdog_device bcm2835_wdt_wdd = { + .info = &bcm2835_wdt_info, + .ops = &bcm2835_wdt_ops, + .min_timeout = 1, +- .max_timeout = WDOG_TICKS_TO_SECS(PM_WDOG_TIME_SET), ++ .max_hw_heartbeat_ms = WDOG_TICKS_TO_MSECS(PM_WDOG_TIME_SET), + .timeout = WDOG_TICKS_TO_SECS(PM_WDOG_TIME_SET), + }; + +-- +2.43.0 + diff --git a/queue-5.15/watchdog-hpwdt-only-claim-unknown-nmi-if-from-ilo.patch b/queue-5.15/watchdog-hpwdt-only-claim-unknown-nmi-if-from-ilo.patch new file mode 100644 index 00000000000..7a0704b6ccc --- /dev/null +++ b/queue-5.15/watchdog-hpwdt-only-claim-unknown-nmi-if-from-ilo.patch @@ -0,0 +1,51 @@ +From 8feba99308d253c331ef1d380f2094facf2a124f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Dec 2023 14:53:38 -0700 +Subject: watchdog/hpwdt: Only claim UNKNOWN NMI if from iLO + +From: Jerry Hoemann + +[ Upstream commit dced0b3e51dd2af3730efe14dd86b5e3173f0a65 ] + +Avoid unnecessary crashes by claiming only NMIs that are due to +ERROR signalling or generated by the hpwdt hardware device. + +The code does this, but only for iLO5. + +The intent was to preserve legacy, Gen9 and earlier, semantics of +using hpwdt for error containtment as hardware/firmware would signal +fatal IO errors as an NMI with the expectation of hpwdt crashing +the system. Howerver, these IO errors should be received by hpwdt +as an NMI_IO_CHECK. So the test is overly permissive and should +not be limited to only ilo5. + +We need to enable this protection for future iLOs not matching the +current PCI IDs. + +Fixes: 62290a5c194b ("watchdog: hpwdt: Claim NMIs generated by iLO5") +Signed-off-by: Jerry Hoemann +Reviewed-by: Guenter Roeck +Link: https://lore.kernel.org/r/20231213215340.495734-2-jerry.hoemann@hpe.com +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/hpwdt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/watchdog/hpwdt.c b/drivers/watchdog/hpwdt.c +index a5006a58e0db..39fc209f799e 100644 +--- a/drivers/watchdog/hpwdt.c ++++ b/drivers/watchdog/hpwdt.c +@@ -176,7 +176,7 @@ static int hpwdt_pretimeout(unsigned int ulReason, struct pt_regs *regs) + "3. OA Forward Progress Log\n" + "4. iLO Event Log"; + +- if (ilo5 && ulReason == NMI_UNKNOWN && !mynmi) ++ if (ulReason == NMI_UNKNOWN && !mynmi) + return NMI_DONE; + + if (ilo5 && !pretimeout && !mynmi) +-- +2.43.0 + diff --git a/queue-5.15/watchdog-rti_wdt-drop-runtime-pm-reference-count-whe.patch b/queue-5.15/watchdog-rti_wdt-drop-runtime-pm-reference-count-whe.patch new file mode 100644 index 00000000000..fbb070c01fd --- /dev/null +++ b/queue-5.15/watchdog-rti_wdt-drop-runtime-pm-reference-count-whe.patch @@ -0,0 +1,72 @@ +From 823429dadc6322f8c969c665b8e9b7a46cc3a884 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Dec 2023 19:31:10 +0530 +Subject: watchdog: rti_wdt: Drop runtime pm reference count when watchdog is + unused + +From: Vignesh Raghavendra + +[ Upstream commit c1a6edf3b541e44e78f10bc6024df779715723f1 ] + +Call runtime_pm_put*() if watchdog is not already started during probe and re +enable it in watchdog start as required. + +On K3 SoCs, watchdogs and their corresponding CPUs are under same +power-domain, so if the reference count of unused watchdogs aren't +dropped, it will lead to CPU hotplug failures as Device Management +firmware won't allow to turn off the power-domain due to dangling +reference count. + +Fixes: 2d63908bdbfb ("watchdog: Add K3 RTI watchdog support") +Signed-off-by: Vignesh Raghavendra +Tested-by: Manorit Chawdhry +Reviewed-by: Guenter Roeck +Link: https://lore.kernel.org/r/20231213140110.938129-1-vigneshr@ti.com +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/rti_wdt.c | 13 ++++++++++++- + 1 file changed, 12 insertions(+), 1 deletion(-) + +diff --git a/drivers/watchdog/rti_wdt.c b/drivers/watchdog/rti_wdt.c +index 46c2a4bd9ebe..daa00f3c5a6a 100644 +--- a/drivers/watchdog/rti_wdt.c ++++ b/drivers/watchdog/rti_wdt.c +@@ -70,6 +70,11 @@ static int rti_wdt_start(struct watchdog_device *wdd) + { + u32 timer_margin; + struct rti_wdt_device *wdt = watchdog_get_drvdata(wdd); ++ int ret; ++ ++ ret = pm_runtime_resume_and_get(wdd->parent); ++ if (ret) ++ return ret; + + /* set timeout period */ + timer_margin = (u64)wdd->timeout * wdt->freq; +@@ -296,6 +301,9 @@ static int rti_wdt_probe(struct platform_device *pdev) + if (last_ping) + watchdog_set_last_hw_keepalive(wdd, last_ping); + ++ if (!watchdog_hw_running(wdd)) ++ pm_runtime_put_sync(&pdev->dev); ++ + return 0; + + err_iomap: +@@ -310,7 +318,10 @@ static int rti_wdt_remove(struct platform_device *pdev) + struct rti_wdt_device *wdt = platform_get_drvdata(pdev); + + watchdog_unregister_device(&wdt->wdd); +- pm_runtime_put(&pdev->dev); ++ ++ if (!pm_runtime_suspended(&pdev->dev)) ++ pm_runtime_put(&pdev->dev); ++ + pm_runtime_disable(&pdev->dev); + + return 0; +-- +2.43.0 + diff --git a/queue-5.15/watchdog-set-cdev-owner-before-adding.patch b/queue-5.15/watchdog-set-cdev-owner-before-adding.patch new file mode 100644 index 00000000000..535ca13386b --- /dev/null +++ b/queue-5.15/watchdog-set-cdev-owner-before-adding.patch @@ -0,0 +1,61 @@ +From 1b4b8761dbd517d7c2aeb4a9653e226d12909970 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Dec 2023 11:05:22 -0800 +Subject: watchdog: set cdev owner before adding + +From: Curtis Klein + +[ Upstream commit 38d75297745f04206db9c29bdd75557f0344c7cc ] + +When the new watchdog character device is registered, it becomes +available for opening. This creates a race where userspace may open the +device before the character device's owner is set. This results in an +imbalance in module_get calls as the cdev_get in cdev_open will not +increment the reference count on the watchdog driver module. + +This causes problems when the watchdog character device is released as +the module loader's reference will also be released. This makes it +impossible to open the watchdog device later on as it now appears that +the module is being unloaded. The open will fail with -ENXIO from +chrdev_open. + +The legacy watchdog device will fail with -EBUSY from the try_module_get +in watchdog_open because it's module owner is the watchdog core module +so it can still be opened but it will fail to get a refcount on the +underlying watchdog device driver. + +Fixes: 72139dfa2464 ("watchdog: Fix the race between the release of watchdog_core_data and cdev") +Signed-off-by: Curtis Klein +Reviewed-by: Guenter Roeck +Link: https://lore.kernel.org/r/20231205190522.55153-1-curtis.klein@hpe.com +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/watchdog_dev.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/watchdog/watchdog_dev.c b/drivers/watchdog/watchdog_dev.c +index 5eec84fa6517..d3b5aa87c141 100644 +--- a/drivers/watchdog/watchdog_dev.c ++++ b/drivers/watchdog/watchdog_dev.c +@@ -1035,6 +1035,7 @@ static int watchdog_cdev_register(struct watchdog_device *wdd) + + /* Fill in the data structures */ + cdev_init(&wd_data->cdev, &watchdog_fops); ++ wd_data->cdev.owner = wdd->ops->owner; + + /* Add the device */ + err = cdev_device_add(&wd_data->cdev, &wd_data->dev); +@@ -1049,8 +1050,6 @@ static int watchdog_cdev_register(struct watchdog_device *wdd) + return err; + } + +- wd_data->cdev.owner = wdd->ops->owner; +- + /* Record time of most recent heartbeat as 'just before now'. */ + wd_data->last_hw_keepalive = ktime_sub(ktime_get(), 1); + watchdog_set_open_deadline(wd_data); +-- +2.43.0 + diff --git a/queue-5.15/wifi-ath11k-defer-on-rproc_get-failure.patch b/queue-5.15/wifi-ath11k-defer-on-rproc_get-failure.patch new file mode 100644 index 00000000000..20c5432ad3b --- /dev/null +++ b/queue-5.15/wifi-ath11k-defer-on-rproc_get-failure.patch @@ -0,0 +1,57 @@ +From 23a342a14d08cc7bf82a1d6666f512c3ca86b98f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Oct 2023 08:57:18 +0200 +Subject: wifi: ath11k: Defer on rproc_get failure + +From: Luca Weiss + +[ Upstream commit 2a3ec40b98b46c339adb57313d3b933ee5e7a8e8 ] + +If we already have gotten the rproc_handle (meaning the "qcom,rproc" +property is defined in the devicetree), it's a valid state that the +remoteproc module hasn't probed yet so we should defer probing instead +of just failing to probe. + +This resolves a race condition when the ath11k driver probes and fails +before the wpss remoteproc driver has probed, like the following: + + [ 6.232360] ath11k 17a10040.wifi: failed to get rproc + [ 6.232366] ath11k 17a10040.wifi: failed to get rproc: -22 + [ 6.232478] ath11k: probe of 17a10040.wifi failed with error -22 + ... + [ 6.252415] remoteproc remoteproc2: 8a00000.remoteproc is available + [ 6.252776] remoteproc remoteproc2: powering up 8a00000.remoteproc + [ 6.252781] remoteproc remoteproc2: Booting fw image qcom/qcm6490/fairphone5/wpss.mdt, size 7188 + +So, defer the probe if we hit that so we can retry later once the wpss +remoteproc is available. + +Tested-on: WCN6750 hw1.0 AHB WLAN.MSL.1.0.1-01264-QCAMSLSWPLZ-1.37886.3 + +Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices") +Signed-off-by: Luca Weiss +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20231027-ath11k-rproc-defer-v1-1-f6b6a812cd18@fairphone.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath11k/ahb.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath11k/ahb.c b/drivers/net/wireless/ath/ath11k/ahb.c +index 24bd0520926b..853a5df4f38c 100644 +--- a/drivers/net/wireless/ath/ath11k/ahb.c ++++ b/drivers/net/wireless/ath/ath11k/ahb.c +@@ -650,8 +650,8 @@ static int ath11k_core_get_rproc(struct ath11k_base *ab) + + prproc = rproc_get_by_phandle(rproc_phandle); + if (!prproc) { +- ath11k_err(ab, "failed to get rproc\n"); +- return -EINVAL; ++ ath11k_dbg(ab, ATH11K_DBG_AHB, "failed to get rproc, deferring\n"); ++ return -EPROBE_DEFER; + } + ab_ahb->tgt_rproc = prproc; + +-- +2.43.0 + diff --git a/queue-5.15/wifi-iwlwifi-mvm-send-tx-path-flush-in-rfkill.patch b/queue-5.15/wifi-iwlwifi-mvm-send-tx-path-flush-in-rfkill.patch new file mode 100644 index 00000000000..9cad3586b12 --- /dev/null +++ b/queue-5.15/wifi-iwlwifi-mvm-send-tx-path-flush-in-rfkill.patch @@ -0,0 +1,42 @@ +From fdd7f593d4d17cabfc57e31a6db5c2944c82095f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Dec 2023 21:58:52 +0200 +Subject: wifi: iwlwifi: mvm: send TX path flush in rfkill + +From: Johannes Berg + +[ Upstream commit 2afc3dad39ea84a072d04ff40a417234326adc47 ] + +If we want to drop packets, that's surely a good thing to +do when we want to enter rfkill. Send this command despite +rfkill so we can successfully clean up everything, we need +to handle it separately since it has CMD_WANT_SKB, so it's +not going to automatically return success when in rfkill. + +Fixes: d4e3a341b87b ("iwlwifi: mvm: add support for new flush queue response") +Signed-off-by: Johannes Berg +Reviewed-by: Gregory Greenman +Signed-off-by: Miri Korenblit +Link: https://msgid.link/20231219215605.c528a6fa6cec.Ibe5e9560359ccc0fba60c35e01de285c376748a2@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/mvm/tx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c +index 08dd227bad4b..266d1e9a89f5 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c +@@ -2054,7 +2054,7 @@ int iwl_mvm_flush_sta_tids(struct iwl_mvm *mvm, u32 sta_id, u16 tids) + WARN_ON(!iwl_mvm_has_new_tx_api(mvm)); + + if (iwl_fw_lookup_notif_ver(mvm->fw, LONG_GROUP, TXPATH_FLUSH, 0) > 0) +- cmd.flags |= CMD_WANT_SKB; ++ cmd.flags |= CMD_WANT_SKB | CMD_SEND_IN_RFKILL; + + IWL_DEBUG_TX_QUEUES(mvm, "flush for sta id %d tid mask 0x%x\n", + sta_id, tids); +-- +2.43.0 + diff --git a/queue-5.15/wifi-iwlwifi-mvm-set-siso-mimo-chains-to-1-in-fw-smp.patch b/queue-5.15/wifi-iwlwifi-mvm-set-siso-mimo-chains-to-1-in-fw-smp.patch new file mode 100644 index 00000000000..1ccfc9cf015 --- /dev/null +++ b/queue-5.15/wifi-iwlwifi-mvm-set-siso-mimo-chains-to-1-in-fw-smp.patch @@ -0,0 +1,49 @@ +From 466b3dccf4d662462558b5ee17e61578778cdc9f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Dec 2023 21:58:49 +0200 +Subject: wifi: iwlwifi: mvm: set siso/mimo chains to 1 in FW SMPS request + +From: Johannes Berg + +[ Upstream commit b1a2e5c310e063560760806d2cc5d2233c596067 ] + +The firmware changed their mind, don't set the chains to zero, +instead set them to 1 as we normally would for connections to +APs that don't use MIMO. + +Fixes: 2a7ce54ccc23 ("iwlwifi: mvm: honour firmware SMPS requests") +Signed-off-by: Johannes Berg +Reviewed-by: Luciano Coelho +Signed-off-by: Miri Korenblit +Link: https://msgid.link/20231219215605.7f031f1a127f.Idc816e0f604b07d22a9d5352bc23c445512fad14@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/mvm/phy-ctxt.c | 11 ----------- + 1 file changed, 11 deletions(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/phy-ctxt.c b/drivers/net/wireless/intel/iwlwifi/mvm/phy-ctxt.c +index 6d82725cb87d..32ed8227d985 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/phy-ctxt.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/phy-ctxt.c +@@ -99,17 +99,6 @@ static void iwl_mvm_phy_ctxt_set_rxchain(struct iwl_mvm *mvm, + active_cnt = 2; + } + +- /* +- * If the firmware requested it, then we know that it supports +- * getting zero for the values to indicate "use one, but pick +- * which one yourself", which means it can dynamically pick one +- * that e.g. has better RSSI. +- */ +- if (mvm->fw_static_smps_request && active_cnt == 1 && idle_cnt == 1) { +- idle_cnt = 0; +- active_cnt = 0; +- } +- + *rxchain_info = cpu_to_le32(iwl_mvm_get_valid_rx_ant(mvm) << + PHY_RX_CHAIN_VALID_POS); + *rxchain_info |= cpu_to_le32(idle_cnt << PHY_RX_CHAIN_CNT_POS); +-- +2.43.0 + diff --git a/queue-5.15/wifi-libertas-stop-selecting-wext.patch b/queue-5.15/wifi-libertas-stop-selecting-wext.patch new file mode 100644 index 00000000000..f6dad8fb3c2 --- /dev/null +++ b/queue-5.15/wifi-libertas-stop-selecting-wext.patch @@ -0,0 +1,37 @@ +From 9c7fed9820535c0333f5ca061c8a2a83948a2206 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Nov 2023 16:34:03 +0100 +Subject: wifi: libertas: stop selecting wext + +From: Arnd Bergmann + +[ Upstream commit 8170b04c2c92eee52ea50b96db4c54662197e512 ] + +Libertas no longer references the iw_handler infrastructure or wext_spy, +so neither of the 'select' statements are used any more. + +Fixes: e86dc1ca4676 ("Libertas: cfg80211 support") +Signed-off-by: Arnd Bergmann +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20231108153409.1065286-1-arnd@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/marvell/libertas/Kconfig | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/net/wireless/marvell/libertas/Kconfig b/drivers/net/wireless/marvell/libertas/Kconfig +index 6d62ab49aa8d..c7d02adb3eea 100644 +--- a/drivers/net/wireless/marvell/libertas/Kconfig ++++ b/drivers/net/wireless/marvell/libertas/Kconfig +@@ -2,8 +2,6 @@ + config LIBERTAS + tristate "Marvell 8xxx Libertas WLAN driver support" + depends on CFG80211 +- select WIRELESS_EXT +- select WEXT_SPY + select LIB80211 + select FW_LOADER + help +-- +2.43.0 + diff --git a/queue-5.15/wifi-rtlwifi-add-calculate_bit_shift.patch b/queue-5.15/wifi-rtlwifi-add-calculate_bit_shift.patch new file mode 100644 index 00000000000..3f5c86ee7dd --- /dev/null +++ b/queue-5.15/wifi-rtlwifi-add-calculate_bit_shift.patch @@ -0,0 +1,43 @@ +From e1ae547aab632fe62f728ea07c43e222e2dba4a7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Dec 2023 14:57:29 +0800 +Subject: wifi: rtlwifi: add calculate_bit_shift() + +From: Su Hui + +[ Upstream commit 52221dfddbbfb5b4e029bb2efe9bb7da33ec1e46 ] + +There are many same functions like _rtl88e_phy_calculate_bit_shift(), +_rtl92c_phy_calculate_bit_shift() and so on. And these functions can +cause undefined bitwise shift behavior. Add calculate_bit_shift() to +replace them and fix undefined behavior in subsequent patches. + +Signed-off-by: Su Hui +Acked-by: Ping-Ke Shih +Signed-off-by: Kalle Valo +Link: https://msgid.link/20231219065739.1895666-2-suhui@nfschina.com +Stable-dep-of: 969bc926f04b ("wifi: rtlwifi: rtl8188ee: phy: using calculate_bit_shift()") +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtlwifi/wifi.h | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/net/wireless/realtek/rtlwifi/wifi.h b/drivers/net/wireless/realtek/rtlwifi/wifi.h +index aa07856411b1..a1f223c8848b 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/wifi.h ++++ b/drivers/net/wireless/realtek/rtlwifi/wifi.h +@@ -3106,4 +3106,11 @@ static inline struct ieee80211_sta *rtl_find_sta(struct ieee80211_hw *hw, + return ieee80211_find_sta(mac->vif, mac_addr); + } + ++static inline u32 calculate_bit_shift(u32 bitmask) ++{ ++ if (WARN_ON_ONCE(!bitmask)) ++ return 0; ++ ++ return __ffs(bitmask); ++} + #endif +-- +2.43.0 + diff --git a/queue-5.15/wifi-rtlwifi-rtl8188ee-phy-using-calculate_bit_shift.patch b/queue-5.15/wifi-rtlwifi-rtl8188ee-phy-using-calculate_bit_shift.patch new file mode 100644 index 00000000000..9acd8e17676 --- /dev/null +++ b/queue-5.15/wifi-rtlwifi-rtl8188ee-phy-using-calculate_bit_shift.patch @@ -0,0 +1,77 @@ +From a5aed7cb8f80e91e6fe2e2c56e8e33b333fa551f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Dec 2023 14:57:31 +0800 +Subject: wifi: rtlwifi: rtl8188ee: phy: using calculate_bit_shift() + +From: Su Hui + +[ Upstream commit 969bc926f04b438676768aeffffffb050e480b62 ] + +Using calculate_bit_shift() to replace _rtl88e_phy_calculate_bit_shift(). +And fix the undefined bitwise shift behavior problem. + +Fixes: f0eb856e0b6c ("rtlwifi: rtl8188ee: Add new driver") +Signed-off-by: Su Hui +Signed-off-by: Kalle Valo +Link: https://msgid.link/20231219065739.1895666-4-suhui@nfschina.com +Signed-off-by: Sasha Levin +--- + .../net/wireless/realtek/rtlwifi/rtl8188ee/phy.c | 14 ++++---------- + 1 file changed, 4 insertions(+), 10 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/phy.c b/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/phy.c +index 12d0b3a87af7..0fab3a0c7d49 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/phy.c ++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/phy.c +@@ -16,12 +16,6 @@ static u32 _rtl88e_phy_rf_serial_read(struct ieee80211_hw *hw, + static void _rtl88e_phy_rf_serial_write(struct ieee80211_hw *hw, + enum radio_path rfpath, u32 offset, + u32 data); +-static u32 _rtl88e_phy_calculate_bit_shift(u32 bitmask) +-{ +- u32 i = ffs(bitmask); +- +- return i ? i - 1 : 32; +-} + static bool _rtl88e_phy_bb8188e_config_parafile(struct ieee80211_hw *hw); + static bool _rtl88e_phy_config_mac_with_headerfile(struct ieee80211_hw *hw); + static bool phy_config_bb_with_headerfile(struct ieee80211_hw *hw, +@@ -51,7 +45,7 @@ u32 rtl88e_phy_query_bb_reg(struct ieee80211_hw *hw, u32 regaddr, u32 bitmask) + rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE, + "regaddr(%#x), bitmask(%#x)\n", regaddr, bitmask); + originalvalue = rtl_read_dword(rtlpriv, regaddr); +- bitshift = _rtl88e_phy_calculate_bit_shift(bitmask); ++ bitshift = calculate_bit_shift(bitmask); + returnvalue = (originalvalue & bitmask) >> bitshift; + + rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE, +@@ -74,7 +68,7 @@ void rtl88e_phy_set_bb_reg(struct ieee80211_hw *hw, + + if (bitmask != MASKDWORD) { + originalvalue = rtl_read_dword(rtlpriv, regaddr); +- bitshift = _rtl88e_phy_calculate_bit_shift(bitmask); ++ bitshift = calculate_bit_shift(bitmask); + data = ((originalvalue & (~bitmask)) | (data << bitshift)); + } + +@@ -99,7 +93,7 @@ u32 rtl88e_phy_query_rf_reg(struct ieee80211_hw *hw, + + + original_value = _rtl88e_phy_rf_serial_read(hw, rfpath, regaddr); +- bitshift = _rtl88e_phy_calculate_bit_shift(bitmask); ++ bitshift = calculate_bit_shift(bitmask); + readback_value = (original_value & bitmask) >> bitshift; + + spin_unlock(&rtlpriv->locks.rf_lock); +@@ -127,7 +121,7 @@ void rtl88e_phy_set_rf_reg(struct ieee80211_hw *hw, + original_value = _rtl88e_phy_rf_serial_read(hw, + rfpath, + regaddr); +- bitshift = _rtl88e_phy_calculate_bit_shift(bitmask); ++ bitshift = calculate_bit_shift(bitmask); + data = + ((original_value & (~bitmask)) | + (data << bitshift)); +-- +2.43.0 + diff --git a/queue-5.15/wifi-rtlwifi-rtl8192c-using-calculate_bit_shift.patch b/queue-5.15/wifi-rtlwifi-rtl8192c-using-calculate_bit_shift.patch new file mode 100644 index 00000000000..d42038737c7 --- /dev/null +++ b/queue-5.15/wifi-rtlwifi-rtl8192c-using-calculate_bit_shift.patch @@ -0,0 +1,74 @@ +From d6f637594531fc9743b185988212c005e676c7d4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Dec 2023 14:57:32 +0800 +Subject: wifi: rtlwifi: rtl8192c: using calculate_bit_shift() + +From: Su Hui + +[ Upstream commit 1dedc3a6699d827d345019e921b8d8f37f694333 ] + +Using calculate_bit_shift() to replace _rtl92c_phy_calculate_bit_shift(). +And fix the undefined bitwise shift behavior problem. + +Fixes: 4295cd254af3 ("rtlwifi: Move common parts of rtl8192ce/phy.c") +Signed-off-by: Su Hui +Signed-off-by: Kalle Valo +Link: https://msgid.link/20231219065739.1895666-5-suhui@nfschina.com +Signed-off-by: Sasha Levin +--- + .../wireless/realtek/rtlwifi/rtl8192c/phy_common.c | 12 ++---------- + .../wireless/realtek/rtlwifi/rtl8192c/phy_common.h | 1 - + 2 files changed, 2 insertions(+), 11 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192c/phy_common.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192c/phy_common.c +index 3d29c8dbb255..144ee780e1b6 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192c/phy_common.c ++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192c/phy_common.c +@@ -17,7 +17,7 @@ u32 rtl92c_phy_query_bb_reg(struct ieee80211_hw *hw, u32 regaddr, u32 bitmask) + rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE, "regaddr(%#x), bitmask(%#x)\n", + regaddr, bitmask); + originalvalue = rtl_read_dword(rtlpriv, regaddr); +- bitshift = _rtl92c_phy_calculate_bit_shift(bitmask); ++ bitshift = calculate_bit_shift(bitmask); + returnvalue = (originalvalue & bitmask) >> bitshift; + + rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE, +@@ -40,7 +40,7 @@ void rtl92c_phy_set_bb_reg(struct ieee80211_hw *hw, + + if (bitmask != MASKDWORD) { + originalvalue = rtl_read_dword(rtlpriv, regaddr); +- bitshift = _rtl92c_phy_calculate_bit_shift(bitmask); ++ bitshift = calculate_bit_shift(bitmask); + data = ((originalvalue & (~bitmask)) | (data << bitshift)); + } + +@@ -143,14 +143,6 @@ void _rtl92c_phy_rf_serial_write(struct ieee80211_hw *hw, + } + EXPORT_SYMBOL(_rtl92c_phy_rf_serial_write); + +-u32 _rtl92c_phy_calculate_bit_shift(u32 bitmask) +-{ +- u32 i = ffs(bitmask); +- +- return i ? i - 1 : 32; +-} +-EXPORT_SYMBOL(_rtl92c_phy_calculate_bit_shift); +- + static void _rtl92c_phy_bb_config_1t(struct ieee80211_hw *hw) + { + rtl_set_bbreg(hw, RFPGA0_TXINFO, 0x3, 0x2); +diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192c/phy_common.h b/drivers/net/wireless/realtek/rtlwifi/rtl8192c/phy_common.h +index 75afa6253ad0..e64d377dfe9e 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192c/phy_common.h ++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192c/phy_common.h +@@ -196,7 +196,6 @@ bool rtl92c_phy_set_rf_power_state(struct ieee80211_hw *hw, + void rtl92ce_phy_set_rf_on(struct ieee80211_hw *hw); + void rtl92c_phy_set_io(struct ieee80211_hw *hw); + void rtl92c_bb_block_on(struct ieee80211_hw *hw); +-u32 _rtl92c_phy_calculate_bit_shift(u32 bitmask); + long _rtl92c_phy_txpwr_idx_to_dbm(struct ieee80211_hw *hw, + enum wireless_mode wirelessmode, + u8 txpwridx); +-- +2.43.0 + diff --git a/queue-5.15/wifi-rtlwifi-rtl8192ce-using-calculate_bit_shift.patch b/queue-5.15/wifi-rtlwifi-rtl8192ce-using-calculate_bit_shift.patch new file mode 100644 index 00000000000..ed398905c64 --- /dev/null +++ b/queue-5.15/wifi-rtlwifi-rtl8192ce-using-calculate_bit_shift.patch @@ -0,0 +1,68 @@ +From d297923eff08fd2928d7927e2bd382cc88528a48 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Dec 2023 14:57:34 +0800 +Subject: wifi: rtlwifi: rtl8192ce: using calculate_bit_shift() + +From: Su Hui + +[ Upstream commit 3d03e8231031bcc65a48cd88ef9c71b6524ce70b ] + +Using calculate_bit_shift() to replace _rtl92c_phy_calculate_bit_shift(). +And fix the undefined bitwise shift behavior problem. + +Fixes: 0c8173385e54 ("rtl8192ce: Add new driver") +Signed-off-by: Su Hui +Signed-off-by: Kalle Valo +Link: https://msgid.link/20231219065739.1895666-7-suhui@nfschina.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtlwifi/rtl8192ce/phy.c | 6 +++--- + drivers/net/wireless/realtek/rtlwifi/rtl8192ce/phy.h | 1 - + 2 files changed, 3 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/phy.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/phy.c +index 04735da11168..6b98e77768e9 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/phy.c ++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/phy.c +@@ -39,7 +39,7 @@ u32 rtl92c_phy_query_rf_reg(struct ieee80211_hw *hw, + rfpath, regaddr); + } + +- bitshift = _rtl92c_phy_calculate_bit_shift(bitmask); ++ bitshift = calculate_bit_shift(bitmask); + readback_value = (original_value & bitmask) >> bitshift; + + spin_unlock(&rtlpriv->locks.rf_lock); +@@ -110,7 +110,7 @@ void rtl92ce_phy_set_rf_reg(struct ieee80211_hw *hw, + original_value = _rtl92c_phy_rf_serial_read(hw, + rfpath, + regaddr); +- bitshift = _rtl92c_phy_calculate_bit_shift(bitmask); ++ bitshift = calculate_bit_shift(bitmask); + data = + ((original_value & (~bitmask)) | + (data << bitshift)); +@@ -122,7 +122,7 @@ void rtl92ce_phy_set_rf_reg(struct ieee80211_hw *hw, + original_value = _rtl92c_phy_fw_rf_serial_read(hw, + rfpath, + regaddr); +- bitshift = _rtl92c_phy_calculate_bit_shift(bitmask); ++ bitshift = calculate_bit_shift(bitmask); + data = + ((original_value & (~bitmask)) | + (data << bitshift)); +diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/phy.h b/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/phy.h +index 7582a162bd11..c7a0d4c776f0 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/phy.h ++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/phy.h +@@ -94,7 +94,6 @@ u32 _rtl92c_phy_rf_serial_read(struct ieee80211_hw *hw, enum radio_path rfpath, + u32 offset); + u32 _rtl92c_phy_fw_rf_serial_read(struct ieee80211_hw *hw, + enum radio_path rfpath, u32 offset); +-u32 _rtl92c_phy_calculate_bit_shift(u32 bitmask); + void _rtl92c_phy_rf_serial_write(struct ieee80211_hw *hw, + enum radio_path rfpath, u32 offset, u32 data); + void _rtl92c_phy_fw_rf_serial_write(struct ieee80211_hw *hw, +-- +2.43.0 + diff --git a/queue-5.15/wifi-rtlwifi-rtl8192cu-using-calculate_bit_shift.patch b/queue-5.15/wifi-rtlwifi-rtl8192cu-using-calculate_bit_shift.patch new file mode 100644 index 00000000000..494dc9d857d --- /dev/null +++ b/queue-5.15/wifi-rtlwifi-rtl8192cu-using-calculate_bit_shift.patch @@ -0,0 +1,55 @@ +From 45b9fc3c100d396a0b6d5e6ff597db9af112deda Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Dec 2023 14:57:33 +0800 +Subject: wifi: rtlwifi: rtl8192cu: using calculate_bit_shift() + +From: Su Hui + +[ Upstream commit f4088c8fcbabadad9dd17d17ae9ba24e9e3221ec ] + +Using calculate_bit_shift() to replace _rtl92c_phy_calculate_bit_shift(). +And fix an undefined bitwise shift behavior problem. + +Fixes: f0a39ae738d6 ("rtlwifi: rtl8192cu: Add routine phy") +Signed-off-by: Su Hui +Signed-off-by: Kalle Valo +Link: https://msgid.link/20231219065739.1895666-6-suhui@nfschina.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtlwifi/rtl8192cu/phy.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/phy.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/phy.c +index a8d9fe269f31..0b8cb7e61fd8 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/phy.c ++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/phy.c +@@ -32,7 +32,7 @@ u32 rtl92cu_phy_query_rf_reg(struct ieee80211_hw *hw, + original_value = _rtl92c_phy_fw_rf_serial_read(hw, + rfpath, regaddr); + } +- bitshift = _rtl92c_phy_calculate_bit_shift(bitmask); ++ bitshift = calculate_bit_shift(bitmask); + readback_value = (original_value & bitmask) >> bitshift; + rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE, + "regaddr(%#x), rfpath(%#x), bitmask(%#x), original_value(%#x)\n", +@@ -56,7 +56,7 @@ void rtl92cu_phy_set_rf_reg(struct ieee80211_hw *hw, + original_value = _rtl92c_phy_rf_serial_read(hw, + rfpath, + regaddr); +- bitshift = _rtl92c_phy_calculate_bit_shift(bitmask); ++ bitshift = calculate_bit_shift(bitmask); + data = + ((original_value & (~bitmask)) | + (data << bitshift)); +@@ -67,7 +67,7 @@ void rtl92cu_phy_set_rf_reg(struct ieee80211_hw *hw, + original_value = _rtl92c_phy_fw_rf_serial_read(hw, + rfpath, + regaddr); +- bitshift = _rtl92c_phy_calculate_bit_shift(bitmask); ++ bitshift = calculate_bit_shift(bitmask); + data = + ((original_value & (~bitmask)) | + (data << bitshift)); +-- +2.43.0 + diff --git a/queue-5.15/wifi-rtlwifi-rtl8192de-using-calculate_bit_shift.patch b/queue-5.15/wifi-rtlwifi-rtl8192de-using-calculate_bit_shift.patch new file mode 100644 index 00000000000..b21b13c052c --- /dev/null +++ b/queue-5.15/wifi-rtlwifi-rtl8192de-using-calculate_bit_shift.patch @@ -0,0 +1,78 @@ +From 257380b675df8ccfbb88e909a667b43b90465dca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Dec 2023 14:57:35 +0800 +Subject: wifi: rtlwifi: rtl8192de: using calculate_bit_shift() + +From: Su Hui + +[ Upstream commit b8b2baad2e652042cf8b6339939ac2f4e6f53de4 ] + +Using calculate_bit_shift() to replace _rtl92d_phy_calculate_bit_shift(). +And fix the undefined bitwise shift behavior problem. + +Fixes: 7274a8c22980 ("rtlwifi: rtl8192de: Merge phy routines") +Signed-off-by: Su Hui +Signed-off-by: Kalle Valo +Link: https://msgid.link/20231219065739.1895666-8-suhui@nfschina.com +Signed-off-by: Sasha Levin +--- + .../net/wireless/realtek/rtlwifi/rtl8192de/phy.c | 15 ++++----------- + 1 file changed, 4 insertions(+), 11 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c +index 4d153bd62c53..c3c07ca77614 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c ++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c +@@ -169,13 +169,6 @@ static const u8 channel_all[59] = { + 157, 159, 161, 163, 165 + }; + +-static u32 _rtl92d_phy_calculate_bit_shift(u32 bitmask) +-{ +- u32 i = ffs(bitmask); +- +- return i ? i - 1 : 32; +-} +- + u32 rtl92d_phy_query_bb_reg(struct ieee80211_hw *hw, u32 regaddr, u32 bitmask) + { + struct rtl_priv *rtlpriv = rtl_priv(hw); +@@ -198,7 +191,7 @@ u32 rtl92d_phy_query_bb_reg(struct ieee80211_hw *hw, u32 regaddr, u32 bitmask) + } else { + originalvalue = rtl_read_dword(rtlpriv, regaddr); + } +- bitshift = _rtl92d_phy_calculate_bit_shift(bitmask); ++ bitshift = calculate_bit_shift(bitmask); + returnvalue = (originalvalue & bitmask) >> bitshift; + rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE, + "BBR MASK=0x%x Addr[0x%x]=0x%x\n", +@@ -230,7 +223,7 @@ void rtl92d_phy_set_bb_reg(struct ieee80211_hw *hw, + dbi_direct); + else + originalvalue = rtl_read_dword(rtlpriv, regaddr); +- bitshift = _rtl92d_phy_calculate_bit_shift(bitmask); ++ bitshift = calculate_bit_shift(bitmask); + data = ((originalvalue & (~bitmask)) | (data << bitshift)); + } + if (rtlhal->during_mac1init_radioa || rtlhal->during_mac0init_radiob) +@@ -317,7 +310,7 @@ u32 rtl92d_phy_query_rf_reg(struct ieee80211_hw *hw, + regaddr, rfpath, bitmask); + spin_lock(&rtlpriv->locks.rf_lock); + original_value = _rtl92d_phy_rf_serial_read(hw, rfpath, regaddr); +- bitshift = _rtl92d_phy_calculate_bit_shift(bitmask); ++ bitshift = calculate_bit_shift(bitmask); + readback_value = (original_value & bitmask) >> bitshift; + spin_unlock(&rtlpriv->locks.rf_lock); + rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE, +@@ -343,7 +336,7 @@ void rtl92d_phy_set_rf_reg(struct ieee80211_hw *hw, enum radio_path rfpath, + if (bitmask != RFREG_OFFSET_MASK) { + original_value = _rtl92d_phy_rf_serial_read(hw, + rfpath, regaddr); +- bitshift = _rtl92d_phy_calculate_bit_shift(bitmask); ++ bitshift = calculate_bit_shift(bitmask); + data = ((original_value & (~bitmask)) | + (data << bitshift)); + } +-- +2.43.0 + diff --git a/queue-5.15/wifi-rtlwifi-rtl8192ee-using-calculate_bit_shift.patch b/queue-5.15/wifi-rtlwifi-rtl8192ee-using-calculate_bit_shift.patch new file mode 100644 index 00000000000..163dd1589a7 --- /dev/null +++ b/queue-5.15/wifi-rtlwifi-rtl8192ee-using-calculate_bit_shift.patch @@ -0,0 +1,86 @@ +From 0d6aac73e81eef0ebefd8764ab8ec707d3fd5b8a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Dec 2023 14:57:36 +0800 +Subject: wifi: rtlwifi: rtl8192ee: using calculate_bit_shift() + +From: Su Hui + +[ Upstream commit 63526897fc0d086069bcab67c3a112caaec751cb ] + +Using calculate_bit_shift() to replace _rtl92ee_phy_calculate_bit_shift(). +And fix the undefined bitwise shift behavior problem. + +Fixes: b1a3bfc97cd9 ("rtlwifi: rtl8192ee: Move driver from staging to the regular tree") +Signed-off-by: Su Hui +Signed-off-by: Kalle Valo +Link: https://msgid.link/20231219065739.1895666-9-suhui@nfschina.com +Signed-off-by: Sasha Levin +--- + .../net/wireless/realtek/rtlwifi/rtl8192ee/phy.c | 16 ++++------------ + 1 file changed, 4 insertions(+), 12 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/phy.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/phy.c +index cc0bcaf13e96..73ef602bfb01 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/phy.c ++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/phy.c +@@ -16,7 +16,6 @@ static u32 _rtl92ee_phy_rf_serial_read(struct ieee80211_hw *hw, + static void _rtl92ee_phy_rf_serial_write(struct ieee80211_hw *hw, + enum radio_path rfpath, u32 offset, + u32 data); +-static u32 _rtl92ee_phy_calculate_bit_shift(u32 bitmask); + static bool _rtl92ee_phy_bb8192ee_config_parafile(struct ieee80211_hw *hw); + static bool _rtl92ee_phy_config_mac_with_headerfile(struct ieee80211_hw *hw); + static bool phy_config_bb_with_hdr_file(struct ieee80211_hw *hw, +@@ -46,7 +45,7 @@ u32 rtl92ee_phy_query_bb_reg(struct ieee80211_hw *hw, u32 regaddr, u32 bitmask) + rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE, + "regaddr(%#x), bitmask(%#x)\n", regaddr, bitmask); + originalvalue = rtl_read_dword(rtlpriv, regaddr); +- bitshift = _rtl92ee_phy_calculate_bit_shift(bitmask); ++ bitshift = calculate_bit_shift(bitmask); + returnvalue = (originalvalue & bitmask) >> bitshift; + + rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE, +@@ -68,7 +67,7 @@ void rtl92ee_phy_set_bb_reg(struct ieee80211_hw *hw, u32 regaddr, + + if (bitmask != MASKDWORD) { + originalvalue = rtl_read_dword(rtlpriv, regaddr); +- bitshift = _rtl92ee_phy_calculate_bit_shift(bitmask); ++ bitshift = calculate_bit_shift(bitmask); + data = ((originalvalue & (~bitmask)) | (data << bitshift)); + } + +@@ -92,7 +91,7 @@ u32 rtl92ee_phy_query_rf_reg(struct ieee80211_hw *hw, + spin_lock(&rtlpriv->locks.rf_lock); + + original_value = _rtl92ee_phy_rf_serial_read(hw , rfpath, regaddr); +- bitshift = _rtl92ee_phy_calculate_bit_shift(bitmask); ++ bitshift = calculate_bit_shift(bitmask); + readback_value = (original_value & bitmask) >> bitshift; + + spin_unlock(&rtlpriv->locks.rf_lock); +@@ -119,7 +118,7 @@ void rtl92ee_phy_set_rf_reg(struct ieee80211_hw *hw, + + if (bitmask != RFREG_OFFSET_MASK) { + original_value = _rtl92ee_phy_rf_serial_read(hw, rfpath, addr); +- bitshift = _rtl92ee_phy_calculate_bit_shift(bitmask); ++ bitshift = calculate_bit_shift(bitmask); + data = (original_value & (~bitmask)) | (data << bitshift); + } + +@@ -201,13 +200,6 @@ static void _rtl92ee_phy_rf_serial_write(struct ieee80211_hw *hw, + pphyreg->rf3wire_offset, data_and_addr); + } + +-static u32 _rtl92ee_phy_calculate_bit_shift(u32 bitmask) +-{ +- u32 i = ffs(bitmask); +- +- return i ? i - 1 : 32; +-} +- + bool rtl92ee_phy_mac_config(struct ieee80211_hw *hw) + { + return _rtl92ee_phy_config_mac_with_headerfile(hw); +-- +2.43.0 + diff --git a/queue-5.15/wifi-rtlwifi-rtl8192se-using-calculate_bit_shift.patch b/queue-5.15/wifi-rtlwifi-rtl8192se-using-calculate_bit_shift.patch new file mode 100644 index 00000000000..0562ba0fb45 --- /dev/null +++ b/queue-5.15/wifi-rtlwifi-rtl8192se-using-calculate_bit_shift.patch @@ -0,0 +1,78 @@ +From 4b5e049a8e4c264c3b75ec447bbc567ec5828779 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Dec 2023 14:57:37 +0800 +Subject: wifi: rtlwifi: rtl8192se: using calculate_bit_shift() + +From: Su Hui + +[ Upstream commit ac32b9317063b101a8ff3d3e885f76f87a280419 ] + +Using calculate_bit_shift() to replace _rtl92s_phy_calculate_bit_shift(). +And fix the undefined bitwise shift behavior problem. + +Fixes: d15853163bea ("rtlwifi: rtl8192se: Merge phy routines") +Signed-off-by: Su Hui +Signed-off-by: Kalle Valo +Link: https://msgid.link/20231219065739.1895666-10-suhui@nfschina.com +Signed-off-by: Sasha Levin +--- + .../net/wireless/realtek/rtlwifi/rtl8192se/phy.c | 15 ++++----------- + 1 file changed, 4 insertions(+), 11 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192se/phy.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192se/phy.c +index aaa004d4d6d0..0e2b9698088b 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192se/phy.c ++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192se/phy.c +@@ -14,13 +14,6 @@ + #include "hw.h" + #include "table.h" + +-static u32 _rtl92s_phy_calculate_bit_shift(u32 bitmask) +-{ +- u32 i = ffs(bitmask); +- +- return i ? i - 1 : 32; +-} +- + u32 rtl92s_phy_query_bb_reg(struct ieee80211_hw *hw, u32 regaddr, u32 bitmask) + { + struct rtl_priv *rtlpriv = rtl_priv(hw); +@@ -30,7 +23,7 @@ u32 rtl92s_phy_query_bb_reg(struct ieee80211_hw *hw, u32 regaddr, u32 bitmask) + regaddr, bitmask); + + originalvalue = rtl_read_dword(rtlpriv, regaddr); +- bitshift = _rtl92s_phy_calculate_bit_shift(bitmask); ++ bitshift = calculate_bit_shift(bitmask); + returnvalue = (originalvalue & bitmask) >> bitshift; + + rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE, "BBR MASK=0x%x Addr[0x%x]=0x%x\n", +@@ -52,7 +45,7 @@ void rtl92s_phy_set_bb_reg(struct ieee80211_hw *hw, u32 regaddr, u32 bitmask, + + if (bitmask != MASKDWORD) { + originalvalue = rtl_read_dword(rtlpriv, regaddr); +- bitshift = _rtl92s_phy_calculate_bit_shift(bitmask); ++ bitshift = calculate_bit_shift(bitmask); + data = ((originalvalue & (~bitmask)) | (data << bitshift)); + } + +@@ -160,7 +153,7 @@ u32 rtl92s_phy_query_rf_reg(struct ieee80211_hw *hw, enum radio_path rfpath, + + original_value = _rtl92s_phy_rf_serial_read(hw, rfpath, regaddr); + +- bitshift = _rtl92s_phy_calculate_bit_shift(bitmask); ++ bitshift = calculate_bit_shift(bitmask); + readback_value = (original_value & bitmask) >> bitshift; + + spin_unlock(&rtlpriv->locks.rf_lock); +@@ -191,7 +184,7 @@ void rtl92s_phy_set_rf_reg(struct ieee80211_hw *hw, enum radio_path rfpath, + if (bitmask != RFREG_OFFSET_MASK) { + original_value = _rtl92s_phy_rf_serial_read(hw, rfpath, + regaddr); +- bitshift = _rtl92s_phy_calculate_bit_shift(bitmask); ++ bitshift = calculate_bit_shift(bitmask); + data = ((original_value & (~bitmask)) | (data << bitshift)); + } + +-- +2.43.0 + diff --git a/queue-5.15/wifi-rtlwifi-rtl8821ae-phy-fix-an-undefined-bitwise-.patch b/queue-5.15/wifi-rtlwifi-rtl8821ae-phy-fix-an-undefined-bitwise-.patch new file mode 100644 index 00000000000..c434b05e96e --- /dev/null +++ b/queue-5.15/wifi-rtlwifi-rtl8821ae-phy-fix-an-undefined-bitwise-.patch @@ -0,0 +1,59 @@ +From 3e8cd841b34025ee4e8683fc0d707b032f39ccfc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Nov 2023 09:35:13 +0800 +Subject: wifi: rtlwifi: rtl8821ae: phy: fix an undefined bitwise shift + behavior + +From: Su Hui + +[ Upstream commit bc8263083af60e7e57c6120edbc1f75d6c909a35 ] + +Clang static checker warns: + +drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c:184:49: + The result of the left shift is undefined due to shifting by '32', + which is greater or equal to the width of type 'u32'. + [core.UndefinedBinaryOperatorResult] + +If the value of the right operand is negative or is greater than or +equal to the width of the promoted left operand, the behavior is +undefined.[1][2] + +For example, when using different gcc's compilation optimization options +(-O0 or -O2), the result of '(u32)data << 32' is different. One is 0, the +other is old value of data. Let _rtl8821ae_phy_calculate_bit_shift()'s +return value less than 32 to fix this problem. Warn if bitmask is zero. + +[1] https://stackoverflow.com/questions/11270492/what-does-the-c-standard-say-about-bitshifting-more-bits-than-the-width-of-type +[2] https://www.open-std.org/jtc1/sc22/wg14/www/docs/n1256.pdf + +Fixes: 21e4b0726dc6 ("rtlwifi: rtl8821ae: Move driver from staging to regular tree") +Signed-off-by: Su Hui +Acked-by: Ping-Ke Shih +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20231127013511.26694-2-suhui@nfschina.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c +index 5323ead30db0..fa1839d8ee55 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c ++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c +@@ -29,9 +29,10 @@ static void _rtl8821ae_phy_rf_serial_write(struct ieee80211_hw *hw, + u32 data); + static u32 _rtl8821ae_phy_calculate_bit_shift(u32 bitmask) + { +- u32 i = ffs(bitmask); ++ if (WARN_ON_ONCE(!bitmask)) ++ return 0; + +- return i ? i - 1 : 32; ++ return __ffs(bitmask); + } + static bool _rtl8821ae_phy_bb8821a_config_parafile(struct ieee80211_hw *hw); + /*static bool _rtl8812ae_phy_config_mac_with_headerfile(struct ieee80211_hw *hw);*/ +-- +2.43.0 + diff --git a/queue-5.15/wifi-rtw88-fix-rx-filter-in-fif_allmulti-flag.patch b/queue-5.15/wifi-rtw88-fix-rx-filter-in-fif_allmulti-flag.patch new file mode 100644 index 00000000000..ecfca1c0366 --- /dev/null +++ b/queue-5.15/wifi-rtw88-fix-rx-filter-in-fif_allmulti-flag.patch @@ -0,0 +1,42 @@ +From 7e68bbbe34f0065f74674c581a67f40cf4291bed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Nov 2023 10:08:51 +0800 +Subject: wifi: rtw88: fix RX filter in FIF_ALLMULTI flag + +From: Chih-Kang Chang + +[ Upstream commit 53ee0b3b99edc6a47096bffef15695f5a895386f ] + +The broadcast packets will be filtered in the FIF_ALLMULTI flag in +the original code, which causes beacon packets to be filtered out +and disconnection. Therefore, we fix it. + +Fixes: e3037485c68e ("rtw88: new Realtek 802.11ac driver") +Signed-off-by: Chih-Kang Chang +Signed-off-by: Ping-Ke Shih +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20231103020851.102238-1-pkshih@realtek.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw88/mac80211.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtw88/mac80211.c b/drivers/net/wireless/realtek/rtw88/mac80211.c +index 6f5629852416..942bb2ab8b50 100644 +--- a/drivers/net/wireless/realtek/rtw88/mac80211.c ++++ b/drivers/net/wireless/realtek/rtw88/mac80211.c +@@ -267,9 +267,9 @@ static void rtw_ops_configure_filter(struct ieee80211_hw *hw, + + if (changed_flags & FIF_ALLMULTI) { + if (*new_flags & FIF_ALLMULTI) +- rtwdev->hal.rcr |= BIT_AM | BIT_AB; ++ rtwdev->hal.rcr |= BIT_AM; + else +- rtwdev->hal.rcr &= ~(BIT_AM | BIT_AB); ++ rtwdev->hal.rcr &= ~(BIT_AM); + } + if (changed_flags & FIF_FCSFAIL) { + if (*new_flags & FIF_FCSFAIL) +-- +2.43.0 + diff --git a/queue-5.15/x86-lib-fix-overflow-when-counting-digits.patch b/queue-5.15/x86-lib-fix-overflow-when-counting-digits.patch new file mode 100644 index 00000000000..ae2cab0550a --- /dev/null +++ b/queue-5.15/x86-lib-fix-overflow-when-counting-digits.patch @@ -0,0 +1,66 @@ +From 27fb247add7db5a51ba8bfa1d6d47e7d565d472d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Nov 2023 17:49:01 +0000 +Subject: x86/lib: Fix overflow when counting digits + +From: Colin Ian King + +[ Upstream commit a24d61c609813963aacc9f6ec8343f4fcaac7243 ] + +tl;dr: The num_digits() function has a theoretical overflow issue. +But it doesn't affect any actual in-tree users. Fix it by using +a larger type for one of the local variables. + +Long version: + +There is an overflow in variable m in function num_digits when val +is >= 1410065408 which leads to the digit calculation loop to +iterate more times than required. This results in either more +digits being counted or in some cases (for example where val is +1932683193) the value of m eventually overflows to zero and the +while loop spins forever). + +Currently the function num_digits is currently only being used for +small values of val in the SMP boot stage for digit counting on the +number of cpus and NUMA nodes, so the overflow is never encountered. +However it is useful to fix the overflow issue in case the function +is used for other purposes in the future. (The issue was discovered +while investigating the digit counting performance in various +kernel helper functions rather than any real-world use-case). + +The simplest fix is to make m a long long, the overhead in +multiplication speed for a long long is very minor for small values +of val less than 10000 on modern processors. The alternative +fix is to replace the multiplication with a constant division +by 10 loop (this compiles down to an multiplication and shift) +without needing to make m a long long, but this is slightly slower +than the fix in this commit when measured on a range of x86 +processors). + +[ dhansen: subject and changelog tweaks ] + +Fixes: 646e29a1789a ("x86: Improve the printout of the SMP bootup CPU table") +Signed-off-by: Colin Ian King +Signed-off-by: Dave Hansen +Link: https://lore.kernel.org/all/20231102174901.2590325-1-colin.i.king%40gmail.com +Signed-off-by: Sasha Levin +--- + arch/x86/lib/misc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/x86/lib/misc.c b/arch/x86/lib/misc.c +index a018ec4fba53..c97be9a1430a 100644 +--- a/arch/x86/lib/misc.c ++++ b/arch/x86/lib/misc.c +@@ -6,7 +6,7 @@ + */ + int num_digits(int val) + { +- int m = 10; ++ long long m = 10; + int d = 1; + + if (val < 0) { +-- +2.43.0 +