From d7e22cda4351956e1cf5ced160b55f9143bf3fad Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Wed, 12 Jul 2023 22:10:01 -0400 Subject: [PATCH] Fixes for 6.4 Signed-off-by: Sasha Levin --- ...odule_firmware-for-firmware_tg357766.patch | 37 ++ ...idental-truncation-when-storing-data.patch | 74 +++ ...sing-failure-check-in-compute_xmatch.patch | 34 ++ ...sing-error-check-for-rhashtable_inse.patch | 47 ++ ...icy_compat-permission-remap-with-ext.patch | 81 +++ ...x-profile-verification-and-enable-it.patch | 180 +++++++ ...ttle-fix-io-statistics-for-cgroup-v1.patch | 95 ++++ ...valid-bdaddr-quirk-for-non-persisten.patch | 68 +++ ...etooth-fix-use-bdaddr-property-quirk.patch | 67 +++ ...m-do-not-mark-valid-bd_addr-as-inval.patch | 51 ++ ...e-hci_sync-for-setting-cig-parameter.patch | 117 +++++ ...ix-marking-scan_rsp-as-not-connectab.patch | 73 +++ ...-return-no-error-for-null-btf-from-_.patch | 57 +++ ...-assume-child-devices-are-all-fsl-mc.patch | 99 ++++ .../cdx-fix-driver-managed-dma-support.patch | 84 ++++ ...c7180-add-parent-dependency-to-all-c.patch | 88 ++++ ...spcc-qcm2290-fix-bi_tcxo_ao-handling.patch | 57 +++ ...c-qcm2290-fix-gpll0_out_div-handling.patch | 60 +++ ...pq5332-use-floor-ops-for-sdcc-clocks.patch | 37 ++ ...pq6018-use-floor-ops-for-sdcc-clocks.patch | 37 ++ ...2290-mark-rcgs-shared-where-applicab.patch | 307 ++++++++++++ ...-fix-the-order-of-sleep_clk-and-xo-c.patch | 41 ++ ...-fix-the-src-parameter-in-ftbl_gcc_a.patch | 39 ++ ...k-qcom-ipq6018-fix-networking-resets.patch | 72 +++ ...cc-msm8974-fix-mdss_gdsc-power-flags.patch | 40 ++ ...mcc-msm8974-remove-oxili_ocmemgx_clk.patch | 73 +++ ...m8974-use-clk_rcg2_shared_ops-for-md.patch | 41 ++ ...fix-missing-trctraceidr-file-in-sysf.patch | 84 ++++ ...ss-of-connection-info-when-a-module-.patch | 69 +++ ...-correct-voltages-for-mt7622-and-mt7.patch | 65 +++ ...-fix-an-error-handling-path-in-tegra.patch | 44 ++ ...rs-fwnode-fix-fwnode_irq_get-_byname.patch | 75 +++ ...y-to-enable-secure-display-ta-multip.patch | 40 ++ ...gpu-fix-number-of-fence-calculations.patch | 63 +++ ...c-slpc-apply-min-softlimit-correctly.patch | 53 ++ ...-bdw-psr-aux-ch-data-register-offset.patch | 44 ++ ...-hw.adjusted-mode-when-calculating-i.patch | 52 ++ ...r-reset-qcom-pon-only-allow-reboot-m.patch | 53 ++ ...l-doc-of-property-capability-fields-.patch | 46 ++ ...l-doc-of-property-fields-to-avoid-wa.patch | 45 ++ ...s-check-return-value-of-freeze_super.patch | 39 ++ ...w-to-defragment-files-have-fi_compre.patch | 49 ++ ...rror-path-handling-in-truncate_dnode.patch | 39 ++ ...al-deadlock-due-to-unpaired-node_wri.patch | 108 ++++ ...ng-condition-to-determine-atomic-con.patch | 37 ++ ...d-null-pointer-dereference-f2fs_writ.patch | 161 ++++++ .../f2fs-flush-error-flags-in-workqueue.patch | 105 ++++ ...ors-remount-ro-continue-panic-mounto.patch | 467 ++++++++++++++++++ ...w-mount-sb-marks-on-kernel-internal-.patch | 54 ++ ...duplicate-should_fault_in_pages-call.patch | 43 ++ ...tt-fix-potential-sleep-in-atomic-con.patch | 96 ++++ ...ry-to-handle-more-interrupt-events-a.patch | 60 +++ ...er-svc-fix-cpu-schedule-in-spin-lock.patch | 78 +++ ...not-reset-dql-stats-on-non_fatal-err.patch | 82 +++ ...m-rpm-don-t-use-clk_get_optional-for.patch | 42 ++ ...m-rpm-rename-icc-provider-num_clocks.patch | 102 ++++ ...ng-kernfs_idr_lock-to-remove-an-id-f.patch | 39 ++ ...x-racy-access-of-physical-cpu-number.patch | 60 +++ ..._s390_get_cmma_bits-for-gfns-in-mems.patch | 74 +++ ...0-vsie-fix-the-length-of-apcb-bitmap.patch | 52 ++ ...optimization-of-bitmap_-from-to-_arr.patch | 75 +++ ...eping-allocations-inside-non-preempt.patch | 56 +++ ...m-replace-ll_rw_block-with-submit_bh.patch | 56 +++ ...r-fill-non-message-tx-data-fields-wi.patch | 75 +++ ...he-condition-to-call-bio_end_io_acct.patch | 63 +++ ...op-repeated-codec-data-for-vc1g-form.patch | 56 +++ ...op-repeated-codec-data-for-vc1l-form.patch | 43 ++ ...itiate-a-drain-of-the-capture-queue-.patch | 127 +++++ ...0310-fix-double-free-in-gc0310_remov.patch | 42 ++ ...in_platform-fix-out_len-in-gmin_get_.patch | 42 ++ ...2680-stop-using-half-pixelclock-for-.patch | 79 +++ ...ia-cec-i2c-ch7322-also-select-regmap.patch | 69 +++ ...aa7146-avoid-a-leak-in-vmalloc_to_sg.patch | 51 ++ ...ix-usage-of-pm_runtime_get_if_in_use.patch | 44 ++ ...ct-format-propagation-for-st-mipid02.patch | 47 ++ ...-fix-error-checking-in-imx296_read_t.patch | 43 ++ ...codec-using-decoder-status-instead-o.patch | 152 ++++++ ...as-fdp1-identify-r-car-gen2-versions.patch | 59 +++ ...a-tc358746-select-config_generic_phy.patch | 58 +++ ...a-usb-check-az6007_read-return-value.patch | 38 ++ ...fix-warning-due-to-null-work_func_t-.patch | 83 ++++ ...elpers-fix-align-of-non-power-of-two.patch | 51 ++ ....h-fix-p_s32-and-p_s64-pointer-types.patch | 38 ++ ...h-fix-struct-v4l2_input-tuner-index-.patch | 62 +++ ...dd-missing-check-for-platform_get_re.patch | 38 ++ ...t5033-drop-rt5033-battery-sub-device.patch | 41 ++ ...fx-fix-error-path-in-stmfx_chip_init.patch | 38 ++ ...x-nullify-stmfx-vdd-in-case-of-error.patch | 41 ++ ...isable-the-regulators-if-they-are-en.patch | 45 ++ ...an-error-handling-path-in-wcd934x_sl.patch | 54 ++ ...check-return-value-of-devm_kasprintf.patch | 39 ++ ...x-potential-memory-leak-in-mlxsw_m_l.patch | 40 ++ ...ports-without-iff_unicast_flt-in-br_.patch | 198 ++++++++ ...n-t-drop-ptp-frames-with-tag_8021q-w.patch | 71 +++ ...-always-enable-the-incl_srcpt-option.patch | 77 +++ ...-always-enable-the-send_meta-options.patch | 315 ++++++++++++ ...105-always-prefer-source-port-inform.patch | 104 ++++ ...105-fix-mac-da-patching-from-meta-fr.patch | 46 ++ ...105-fix-source-port-decoding-in-vlan.patch | 62 +++ ...et-dsa-vsc73xx-fix-mtu-configuration.patch | 54 ++ ...start_xmit-trace-event-vs-skb_transp.patch | 72 +++ ...don-t-keep-ptp-configuration-of-all-.patch | 203 ++++++++ ...don-t-report-that-rx-timestamping-is.patch | 49 ++ ...t-add-sanity-checks-on-skb-before-ca.patch | 91 ++++ ...t-add-sanity-checks-on-table-name-an.patch | 102 ++++ ...pt-zero-skb-cb-before-calling-target.patch | 101 ++++ ...dit-add-size-check-for-tca_pedit_par.patch | 57 +++ ...bout-slab-out-of-bounds-caused-by-nt.patch | 52 ++ ...reverse-mac-addresses-on-all-i.mx-de.patch | 81 +++ .../nvmem-rmem-use-nvmem_devid_auto.patch | 41 ++ ...-ocotp-release-otp-clk-before-return.patch | 59 +++ ...fix-hardware-timestamp-configuration.patch | 42 ++ ...-validation-before-accessing-cgx-and.patch | 63 +++ ...f-cn10kb-fix-interrupt-csr-addresses.patch | 58 +++ ...-mapping-for-nix-block-from-cgx-conn.patch | 74 +++ ...teontx2-af-reset-mac-features-in-flr.patch | 275 +++++++++++ ...pf-move-the-declaration-of-struct-rq.patch | 72 +++ ...bo-fix-display-port-phy-configuratio.patch | 78 +++ ...b-check-return-value-of-devm_kzalloc.patch | 40 ++ ...467-make-charger-enable-control-as-l.patch | 40 ++ ...c_early_debug_cpm-only-when-serial_c.patch | 46 ++ ...is1x.dts-fix-pcie-mem-size-for-pci2-.patch | 59 +++ queue-6.4/pptp-fix-fib-lookup-calls.patch | 116 +++++ .../pwm-ab8500-fix-error-code-in-probe.patch | 41 ++ ...ce-real_period-to-be-zero-in-suspend.patch | 48 ++ ...isp-fix-the-disable-flow-of-disp_pwm.patch | 57 +++ ...-apply-state-to-already-disabled-pwm.patch | 90 ++++ ...n-usb-conn-gpio-set-last-role-to-unk.patch | 98 ++++ ...der-of-ipi-enablement-vs-rcu-startup.patch | 54 ++ ...ock_allow_resize-after-linear-mappin.patch | 109 ++++ ...se-some-resources-in-st_rtc_probe-in.patch | 40 ++ .../rtla-hwnoise-reduce-runtime-to-75.patch | 52 ++ queue-6.4/s390-qeth-fix-vipa-deletion.patch | 42 ++ ...al-deadlock-on-net-sctp.addr_wq_lock.patch | 57 +++ ...ock-port-for-stop_rx-in-omap8250_irq.patch | 39 ++ ...-port-for-uart_ier-access-in-omap825.patch | 57 +++ ...-fix-freeing-of-resources-on-failed-.patch | 42 ++ ...-use-force_suspend-and-resume-for-sy.patch | 78 +++ ...-port-for-start_rx-in-uart_resume_po.patch | 44 ++ ...-port-for-stop_rx-in-uart_suspend_po.patch | 42 ++ queue-6.4/series | 171 +++++++ ...for-devlink-port-requires-mae-access.patch | 39 ++ .../sh-avoid-using-irq0-on-sh3-and-sh4.patch | 123 +++++ ...a-fix-dma-channel-offset-calculation.patch | 103 ++++ ...p-to-translate-device-tree-address-i.patch | 44 ++ ...ebugfs-fix-unbalanced-pm_runtime_put.patch | 42 ++ ...e-qcom-fix-unbalanced-pm_runtime_put.patch | 86 ++++ ...se-consistently-ctrl-as-state-variab.patch | 441 +++++++++++++++++ ...urn-error-if-neither-hif_mspi-nor-ms.patch | 58 +++ ...m-enable-spi_controller_must_tx-for-.patch | 42 ++ ..._arm-mark-vchiq_platform_init-static.patch | 72 +++ ...data-races-in-__tcp_oow_rate_limited.patch | 55 +++ ...turn-enomem-instead-of-enospc-on-fai.patch | 111 +++++ ...s-virtio-fix-build-break-for-aarch64.patch | 48 ++ ...onn-gpio-set-last-role-to-unknown-be.patch | 104 ++++ ...b-dwc2-fix-some-error-handling-paths.patch | 81 +++ ...12a-fix-an-error-handling-path-in-dw.patch | 51 ++ ...x-an-error-handling-path-in-dwc3_qco.patch | 43 ++ ...-dwc3-qcom-fix-potential-memory-leak.patch | 53 ++ ...lease-the-correct-resources-in-dwc3_.patch | 50 ++ ...-resume-function-to-handle-pm-events.patch | 320 ++++++++++++ ...ial-add-null-pointer-check-in-gseria.patch | 56 +++ ...usbfs_notify_suspend-resume-function.patch | 52 ++ ...-eud-fix-eud-sysfs-path-use-qcom_eud.patch | 42 ++ ...o-fix-memory-leak-in-tahvo_usb_probe.patch | 43 ++ .../vduse-fix-null-pointer-dereference.patch | 94 ++++ ...unchecked-call-to-null-set_vq_affini.patch | 41 ++ queue-6.4/w1-fix-loop-in-w1_fini.patch | 43 ++ ...rm-fix-locking-behavior-in-convert_t.patch | 91 ++++ ...unt-the-number-of-pages-written-back.patch | 78 +++ ...-improve-the-xhci-system-resume-time.patch | 47 ++ .../xsk-honor-so_bindtodevice-on-bind.patch | 101 ++++ 172 files changed, 13034 insertions(+) create mode 100644 queue-6.4/add-module_firmware-for-firmware_tg357766.patch create mode 100644 queue-6.4/afs-fix-accidental-truncation-when-storing-data.patch create mode 100644 queue-6.4/apparmor-add-missing-failure-check-in-compute_xmatch.patch create mode 100644 queue-6.4/apparmor-fix-missing-error-check-for-rhashtable_inse.patch create mode 100644 queue-6.4/apparmor-fix-policy_compat-permission-remap-with-ext.patch create mode 100644 queue-6.4/apparmor-fix-profile-verification-and-enable-it.patch create mode 100644 queue-6.4/blk-throttle-fix-io-statistics-for-cgroup-v1.patch create mode 100644 queue-6.4/bluetooth-fix-invalid-bdaddr-quirk-for-non-persisten.patch create mode 100644 queue-6.4/bluetooth-fix-use-bdaddr-property-quirk.patch create mode 100644 queue-6.4/bluetooth-hci_bcm-do-not-mark-valid-bd_addr-as-inval.patch create mode 100644 queue-6.4/bluetooth-iso-use-hci_sync-for-setting-cig-parameter.patch create mode 100644 queue-6.4/bluetooth-mgmt-fix-marking-scan_rsp-as-not-connectab.patch create mode 100644 queue-6.4/bpf-btf-warn-but-return-no-error-for-null-btf-from-_.patch create mode 100644 queue-6.4/bus-fsl-mc-don-t-assume-child-devices-are-all-fsl-mc.patch create mode 100644 queue-6.4/cdx-fix-driver-managed-dma-support.patch create mode 100644 queue-6.4/clk-qcom-camcc-sc7180-add-parent-dependency-to-all-c.patch create mode 100644 queue-6.4/clk-qcom-dispcc-qcm2290-fix-bi_tcxo_ao-handling.patch create mode 100644 queue-6.4/clk-qcom-dispcc-qcm2290-fix-gpll0_out_div-handling.patch create mode 100644 queue-6.4/clk-qcom-gcc-ipq5332-use-floor-ops-for-sdcc-clocks.patch create mode 100644 queue-6.4/clk-qcom-gcc-ipq6018-use-floor-ops-for-sdcc-clocks.patch create mode 100644 queue-6.4/clk-qcom-gcc-qcm2290-mark-rcgs-shared-where-applicab.patch create mode 100644 queue-6.4/clk-qcom-ipq5332-fix-the-order-of-sleep_clk-and-xo-c.patch create mode 100644 queue-6.4/clk-qcom-ipq5332-fix-the-src-parameter-in-ftbl_gcc_a.patch create mode 100644 queue-6.4/clk-qcom-ipq6018-fix-networking-resets.patch create mode 100644 queue-6.4/clk-qcom-mmcc-msm8974-fix-mdss_gdsc-power-flags.patch create mode 100644 queue-6.4/clk-qcom-mmcc-msm8974-remove-oxili_ocmemgx_clk.patch create mode 100644 queue-6.4/clk-qcom-mmcc-msm8974-use-clk_rcg2_shared_ops-for-md.patch create mode 100644 queue-6.4/coresight-etm4x-fix-missing-trctraceidr-file-in-sysf.patch create mode 100644 queue-6.4/coresight-fix-loss-of-connection-info-when-a-module-.patch create mode 100644 queue-6.4/cpufreq-mediatek-correct-voltages-for-mt7622-and-mt7.patch create mode 100644 queue-6.4/cpufreq-tegra194-fix-an-error-handling-path-in-tegra.patch create mode 100644 queue-6.4/drivers-fwnode-fix-fwnode_irq_get-_byname.patch create mode 100644 queue-6.4/drm-amd-don-t-try-to-enable-secure-display-ta-multip.patch create mode 100644 queue-6.4/drm-amdgpu-fix-number-of-fence-calculations.patch create mode 100644 queue-6.4/drm-i915-guc-slpc-apply-min-softlimit-correctly.patch create mode 100644 queue-6.4/drm-i915-psr-fix-bdw-psr-aux-ch-data-register-offset.patch create mode 100644 queue-6.4/drm-i915-psr-use-hw.adjusted-mode-when-calculating-i.patch create mode 100644 queue-6.4/dt-bindings-power-reset-qcom-pon-only-allow-reboot-m.patch create mode 100644 queue-6.4/extcon-fix-kernel-doc-of-property-capability-fields-.patch create mode 100644 queue-6.4/extcon-fix-kernel-doc-of-property-fields-to-avoid-wa.patch create mode 100644 queue-6.4/f2fs-check-return-value-of-freeze_super.patch create mode 100644 queue-6.4/f2fs-do-not-allow-to-defragment-files-have-fi_compre.patch create mode 100644 queue-6.4/f2fs-fix-error-path-handling-in-truncate_dnode.patch create mode 100644 queue-6.4/f2fs-fix-potential-deadlock-due-to-unpaired-node_wri.patch create mode 100644 queue-6.4/f2fs-fix-the-wrong-condition-to-determine-atomic-con.patch create mode 100644 queue-6.4/f2fs-fix-to-avoid-null-pointer-dereference-f2fs_writ.patch create mode 100644 queue-6.4/f2fs-flush-error-flags-in-workqueue.patch create mode 100644 queue-6.4/f2fs-support-errors-remount-ro-continue-panic-mounto.patch create mode 100644 queue-6.4/fanotify-disallow-mount-sb-marks-on-kernel-internal-.patch create mode 100644 queue-6.4/gfs2-fix-duplicate-should_fault_in_pages-call.patch create mode 100644 queue-6.4/hwtracing-hisi_ptt-fix-potential-sleep-in-atomic-con.patch create mode 100644 queue-6.4/i2c-xiic-don-t-try-to-handle-more-interrupt-events-a.patch create mode 100644 queue-6.4/i3c-master-svc-fix-cpu-schedule-in-spin-lock.patch create mode 100644 queue-6.4/ibmvnic-do-not-reset-dql-stats-on-non_fatal-err.patch create mode 100644 queue-6.4/interconnect-qcom-rpm-don-t-use-clk_get_optional-for.patch create mode 100644 queue-6.4/interconnect-qcom-rpm-rename-icc-provider-num_clocks.patch create mode 100644 queue-6.4/kernfs-fix-missing-kernfs_idr_lock-to-remove-an-id-f.patch create mode 100644 queue-6.4/kvm-s390-diag-fix-racy-access-of-physical-cpu-number.patch create mode 100644 queue-6.4/kvm-s390-fix-kvm_s390_get_cmma_bits-for-gfns-in-mems.patch create mode 100644 queue-6.4/kvm-s390-vsie-fix-the-length-of-apcb-bitmap.patch create mode 100644 queue-6.4/lib-bitmap-drop-optimization-of-bitmap_-from-to-_arr.patch create mode 100644 queue-6.4/lib-dhry-fix-sleeping-allocations-inside-non-preempt.patch create mode 100644 queue-6.4/lkdtm-replace-ll_rw_block-with-submit_bh.patch create mode 100644 queue-6.4/mailbox-ti-msgmgr-fill-non-message-tx-data-fields-wi.patch create mode 100644 queue-6.4/md-raid10-fix-the-condition-to-call-bio_end_io_acct.patch create mode 100644 queue-6.4/media-amphion-drop-repeated-codec-data-for-vc1g-form.patch create mode 100644 queue-6.4/media-amphion-drop-repeated-codec-data-for-vc1l-form.patch create mode 100644 queue-6.4/media-amphion-initiate-a-drain-of-the-capture-queue-.patch create mode 100644 queue-6.4/media-atomisp-gc0310-fix-double-free-in-gc0310_remov.patch create mode 100644 queue-6.4/media-atomisp-gmin_platform-fix-out_len-in-gmin_get_.patch create mode 100644 queue-6.4/media-atomisp-ov2680-stop-using-half-pixelclock-for-.patch create mode 100644 queue-6.4/media-cec-i2c-ch7322-also-select-regmap.patch create mode 100644 queue-6.4/media-common-saa7146-avoid-a-leak-in-vmalloc_to_sg.patch create mode 100644 queue-6.4/media-hi846-fix-usage-of-pm_runtime_get_if_in_use.patch create mode 100644 queue-6.4/media-i2c-correct-format-propagation-for-st-mipid02.patch create mode 100644 queue-6.4/media-i2c-imx296-fix-error-checking-in-imx296_read_t.patch create mode 100644 queue-6.4/media-mediatek-vcodec-using-decoder-status-instead-o.patch create mode 100644 queue-6.4/media-renesas-fdp1-identify-r-car-gen2-versions.patch create mode 100644 queue-6.4/media-tc358746-select-config_generic_phy.patch create mode 100644 queue-6.4/media-usb-check-az6007_read-return-value.patch create mode 100644 queue-6.4/media-usb-siano-fix-warning-due-to-null-work_func_t-.patch create mode 100644 queue-6.4/media-venus-helpers-fix-align-of-non-power-of-two.patch create mode 100644 queue-6.4/media-videodev2.h-fix-p_s32-and-p_s64-pointer-types.patch create mode 100644 queue-6.4/media-videodev2.h-fix-struct-v4l2_input-tuner-index-.patch create mode 100644 queue-6.4/mfd-intel-lpss-add-missing-check-for-platform_get_re.patch create mode 100644 queue-6.4/mfd-rt5033-drop-rt5033-battery-sub-device.patch create mode 100644 queue-6.4/mfd-stmfx-fix-error-path-in-stmfx_chip_init.patch create mode 100644 queue-6.4/mfd-stmfx-nullify-stmfx-vdd-in-case-of-error.patch create mode 100644 queue-6.4/mfd-stmpe-only-disable-the-regulators-if-they-are-en.patch create mode 100644 queue-6.4/mfd-wcd934x-fix-an-error-handling-path-in-wcd934x_sl.patch create mode 100644 queue-6.4/misc-fastrpc-check-return-value-of-devm_kasprintf.patch create mode 100644 queue-6.4/mlxsw-minimal-fix-potential-memory-leak-in-mlxsw_m_l.patch create mode 100644 queue-6.4/net-bridge-keep-ports-without-iff_unicast_flt-in-br_.patch create mode 100644 queue-6.4/net-dsa-felix-don-t-drop-ptp-frames-with-tag_8021q-w.patch create mode 100644 queue-6.4/net-dsa-sja1105-always-enable-the-incl_srcpt-option.patch create mode 100644 queue-6.4/net-dsa-sja1105-always-enable-the-send_meta-options.patch create mode 100644 queue-6.4/net-dsa-tag_sja1105-always-prefer-source-port-inform.patch create mode 100644 queue-6.4/net-dsa-tag_sja1105-fix-mac-da-patching-from-meta-fr.patch create mode 100644 queue-6.4/net-dsa-tag_sja1105-fix-source-port-decoding-in-vlan.patch create mode 100644 queue-6.4/net-dsa-vsc73xx-fix-mtu-configuration.patch create mode 100644 queue-6.4/net-fix-net_dev_start_xmit-trace-event-vs-skb_transp.patch create mode 100644 queue-6.4/net-mscc-ocelot-don-t-keep-ptp-configuration-of-all-.patch create mode 100644 queue-6.4/net-mscc-ocelot-don-t-report-that-rx-timestamping-is.patch create mode 100644 queue-6.4/net-sched-act_ipt-add-sanity-checks-on-skb-before-ca.patch create mode 100644 queue-6.4/net-sched-act_ipt-add-sanity-checks-on-table-name-an.patch create mode 100644 queue-6.4/net-sched-act_ipt-zero-skb-cb-before-calling-target.patch create mode 100644 queue-6.4/net-sched-act_pedit-add-size-check-for-tca_pedit_par.patch create mode 100644 queue-6.4/ntfs-fix-panic-about-slab-out-of-bounds-caused-by-nt.patch create mode 100644 queue-6.4/nvmem-imx-ocotp-reverse-mac-addresses-on-all-i.mx-de.patch create mode 100644 queue-6.4/nvmem-rmem-use-nvmem_devid_auto.patch create mode 100644 queue-6.4/nvmem-sunplus-ocotp-release-otp-clk-before-return.patch create mode 100644 queue-6.4/octeontx-af-fix-hardware-timestamp-configuration.patch create mode 100644 queue-6.4/octeontx2-af-add-validation-before-accessing-cgx-and.patch create mode 100644 queue-6.4/octeontx2-af-cn10kb-fix-interrupt-csr-addresses.patch create mode 100644 queue-6.4/octeontx2-af-fix-mapping-for-nix-block-from-cgx-conn.patch create mode 100644 queue-6.4/octeontx2-af-reset-mac-features-in-flr.patch create mode 100644 queue-6.4/perf-bpf-move-the-declaration-of-struct-rq.patch create mode 100644 queue-6.4/phy-qcom-qmp-combo-fix-display-port-phy-configuratio.patch create mode 100644 queue-6.4/phy-tegra-xusb-check-return-value-of-devm_kzalloc.patch create mode 100644 queue-6.4/power-supply-rt9467-make-charger-enable-control-as-l.patch create mode 100644 queue-6.4/powerpc-allow-ppc_early_debug_cpm-only-when-serial_c.patch create mode 100644 queue-6.4/powerpc-dts-turris1x.dts-fix-pcie-mem-size-for-pci2-.patch create mode 100644 queue-6.4/pptp-fix-fib-lookup-calls.patch create mode 100644 queue-6.4/pwm-ab8500-fix-error-code-in-probe.patch create mode 100644 queue-6.4/pwm-imx-tpm-force-real_period-to-be-zero-in-suspend.patch create mode 100644 queue-6.4/pwm-mtk_disp-fix-the-disable-flow-of-disp_pwm.patch create mode 100644 queue-6.4/pwm-sysfs-do-not-apply-state-to-already-disabled-pwm.patch create mode 100644 queue-6.4/revert-usb-common-usb-conn-gpio-set-last-role-to-unk.patch create mode 100644 queue-6.4/risc-v-fix-order-of-ipi-enablement-vs-rcu-startup.patch create mode 100644 queue-6.4/riscv-move-memblock_allow_resize-after-linear-mappin.patch create mode 100644 queue-6.4/rtc-st-lpc-release-some-resources-in-st_rtc_probe-in.patch create mode 100644 queue-6.4/rtla-hwnoise-reduce-runtime-to-75.patch create mode 100644 queue-6.4/s390-qeth-fix-vipa-deletion.patch create mode 100644 queue-6.4/sctp-fix-potential-deadlock-on-net-sctp.addr_wq_lock.patch create mode 100644 queue-6.4/serial-8250-lock-port-for-stop_rx-in-omap8250_irq.patch create mode 100644 queue-6.4/serial-8250-lock-port-for-uart_ier-access-in-omap825.patch create mode 100644 queue-6.4/serial-8250-omap-fix-freeing-of-resources-on-failed-.patch create mode 100644 queue-6.4/serial-8250_omap-use-force_suspend-and-resume-for-sy.patch create mode 100644 queue-6.4/serial-core-lock-port-for-start_rx-in-uart_resume_po.patch create mode 100644 queue-6.4/serial-core-lock-port-for-stop_rx-in-uart_suspend_po.patch create mode 100644 queue-6.4/sfc-support-for-devlink-port-requires-mae-access.patch create mode 100644 queue-6.4/sh-avoid-using-irq0-on-sh3-and-sh4.patch create mode 100644 queue-6.4/sh-dma-fix-dma-channel-offset-calculation.patch create mode 100644 queue-6.4/sh-j2-use-ioremap-to-translate-device-tree-address-i.patch create mode 100644 queue-6.4/soundwire-debugfs-fix-unbalanced-pm_runtime_put.patch create mode 100644 queue-6.4/soundwire-qcom-fix-unbalanced-pm_runtime_put.patch create mode 100644 queue-6.4/soundwire-qcom-use-consistently-ctrl-as-state-variab.patch create mode 100644 queue-6.4/spi-bcm-qspi-return-error-if-neither-hif_mspi-nor-ms.patch create mode 100644 queue-6.4/spi-spi-geni-qcom-enable-spi_controller_must_tx-for-.patch create mode 100644 queue-6.4/staging-vchiq_arm-mark-vchiq_platform_init-static.patch create mode 100644 queue-6.4/tcp-annotate-data-races-in-__tcp_oow_rate_limited.patch create mode 100644 queue-6.4/test_firmware-return-enomem-instead-of-enospc-on-fai.patch create mode 100644 queue-6.4/tools-virtio-fix-build-break-for-aarch64.patch create mode 100644 queue-6.4/usb-common-usb-conn-gpio-set-last-role-to-unknown-be.patch create mode 100644 queue-6.4/usb-dwc2-fix-some-error-handling-paths.patch create mode 100644 queue-6.4/usb-dwc3-meson-g12a-fix-an-error-handling-path-in-dw.patch create mode 100644 queue-6.4/usb-dwc3-qcom-fix-an-error-handling-path-in-dwc3_qco.patch create mode 100644 queue-6.4/usb-dwc3-qcom-fix-potential-memory-leak.patch create mode 100644 queue-6.4/usb-dwc3-qcom-release-the-correct-resources-in-dwc3_.patch create mode 100644 queue-6.4/usb-extend-pci-resume-function-to-handle-pm-events.patch create mode 100644 queue-6.4/usb-gadget-u_serial-add-null-pointer-check-in-gseria.patch create mode 100644 queue-6.4/usb-hide-unused-usbfs_notify_suspend-resume-function.patch create mode 100644 queue-6.4/usb-misc-eud-fix-eud-sysfs-path-use-qcom_eud.patch create mode 100644 queue-6.4/usb-phy-phy-tahvo-fix-memory-leak-in-tahvo_usb_probe.patch create mode 100644 queue-6.4/vduse-fix-null-pointer-dereference.patch create mode 100644 queue-6.4/virtio-vdpa-fix-unchecked-call-to-null-set_vq_affini.patch create mode 100644 queue-6.4/w1-fix-loop-in-w1_fini.patch create mode 100644 queue-6.4/w1-w1_therm-fix-locking-behavior-in-convert_t.patch create mode 100644 queue-6.4/writeback-account-the-number-of-pages-written-back.patch create mode 100644 queue-6.4/xhci-improve-the-xhci-system-resume-time.patch create mode 100644 queue-6.4/xsk-honor-so_bindtodevice-on-bind.patch diff --git a/queue-6.4/add-module_firmware-for-firmware_tg357766.patch b/queue-6.4/add-module_firmware-for-firmware_tg357766.patch new file mode 100644 index 00000000000..566f6b678ab --- /dev/null +++ b/queue-6.4/add-module_firmware-for-firmware_tg357766.patch @@ -0,0 +1,37 @@ +From 96b0aba20459f643b368c07d2d2b61aa3dad46f0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Jun 2023 02:13:32 +0200 +Subject: Add MODULE_FIRMWARE() for FIRMWARE_TG357766. + +From: Tobias Heider + +[ Upstream commit 046f753da6143ee16452966915087ec8b0de3c70 ] + +Fixes a bug where on the M1 mac mini initramfs-tools fails to +include the necessary firmware into the initrd. + +Fixes: c4dab50697ff ("tg3: Download 57766 EEE service patch firmware") +Signed-off-by: Tobias Heider +Reviewed-by: Michael Chan +Link: https://lore.kernel.org/r/ZJt7LKzjdz8+dClx@tobhe.de +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/tg3.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c +index 58747292521d8..a52cf9aae4988 100644 +--- a/drivers/net/ethernet/broadcom/tg3.c ++++ b/drivers/net/ethernet/broadcom/tg3.c +@@ -224,6 +224,7 @@ MODULE_AUTHOR("David S. Miller (davem@redhat.com) and Jeff Garzik (jgarzik@pobox + MODULE_DESCRIPTION("Broadcom Tigon3 ethernet driver"); + MODULE_LICENSE("GPL"); + MODULE_FIRMWARE(FIRMWARE_TG3); ++MODULE_FIRMWARE(FIRMWARE_TG357766); + MODULE_FIRMWARE(FIRMWARE_TG3TSO); + MODULE_FIRMWARE(FIRMWARE_TG3TSO5); + +-- +2.39.2 + diff --git a/queue-6.4/afs-fix-accidental-truncation-when-storing-data.patch b/queue-6.4/afs-fix-accidental-truncation-when-storing-data.patch new file mode 100644 index 00000000000..21bbae063be --- /dev/null +++ b/queue-6.4/afs-fix-accidental-truncation-when-storing-data.patch @@ -0,0 +1,74 @@ +From 8b9acf5280d10e836fb3ea6be279353858dc4fdb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Jul 2023 20:22:15 +0100 +Subject: afs: Fix accidental truncation when storing data + +From: David Howells + +[ Upstream commit 03275585cabd0240944f19f33d7584a1b099a3a8 ] + +When an AFS FS.StoreData RPC call is made, amongst other things it is +given the resultant file size to be. On the server, this is processed +by truncating the file to new size and then writing the data. + +Now, kafs has a lock (vnode->io_lock) that serves to serialise +operations against a specific vnode (ie. inode), but the parameters for +the op are set before the lock is taken. This allows two writebacks +(say sync and kswapd) to race - and if writes are ongoing the writeback +for a later write could occur before the writeback for an earlier one if +the latter gets interrupted. + +Note that afs_writepages() cannot take i_mutex and only takes a shared +lock on vnode->validate_lock. + +Also note that the server does the truncation and the write inside a +lock, so there's no problem at that end. + +Fix this by moving the calculation for the proposed new i_size inside +the vnode->io_lock. Also reset the iterator (which we might have read +from) and update the mtime setting there. + +Fixes: bd80d8a80e12 ("afs: Use ITER_XARRAY for writing") +Reported-by: Marc Dionne +Signed-off-by: David Howells +Reviewed-by: Jeffrey Altman +Reviewed-by: Marc Dionne +cc: linux-afs@lists.infradead.org +cc: linux-fsdevel@vger.kernel.org +Link: https://lore.kernel.org/r/3526895.1687960024@warthog.procyon.org.uk/ +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + fs/afs/write.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/fs/afs/write.c b/fs/afs/write.c +index 8750b99c3f566..c1f4391ccd7c6 100644 +--- a/fs/afs/write.c ++++ b/fs/afs/write.c +@@ -413,17 +413,19 @@ static int afs_store_data(struct afs_vnode *vnode, struct iov_iter *iter, loff_t + afs_op_set_vnode(op, 0, vnode); + op->file[0].dv_delta = 1; + op->file[0].modification = true; +- op->store.write_iter = iter; + op->store.pos = pos; + op->store.size = size; +- op->store.i_size = max(pos + size, vnode->netfs.remote_i_size); + op->store.laundering = laundering; +- op->mtime = vnode->netfs.inode.i_mtime; + op->flags |= AFS_OPERATION_UNINTR; + op->ops = &afs_store_data_operation; + + try_next_key: + afs_begin_vnode_operation(op); ++ ++ op->store.write_iter = iter; ++ op->store.i_size = max(pos + size, vnode->netfs.remote_i_size); ++ op->mtime = vnode->netfs.inode.i_mtime; ++ + afs_wait_for_operation(op); + + switch (op->error) { +-- +2.39.2 + diff --git a/queue-6.4/apparmor-add-missing-failure-check-in-compute_xmatch.patch b/queue-6.4/apparmor-add-missing-failure-check-in-compute_xmatch.patch new file mode 100644 index 00000000000..51b21dfdc6d --- /dev/null +++ b/queue-6.4/apparmor-add-missing-failure-check-in-compute_xmatch.patch @@ -0,0 +1,34 @@ +From edee5651c4fdc5f8b959f92822e8cada76d8c389 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Apr 2023 00:24:47 -0700 +Subject: apparmor: add missing failure check in compute_xmatch_perms + +From: John Johansen + +[ Upstream commit 6600e9f692e36e265ef0828f08337fa294bb330f ] + +Add check for failure to allocate the permission table. + +Fixes: caa9f579ca72 ("apparmor: isolate policy backwards compatibility to its own file") +Signed-off-by: John Johansen +Signed-off-by: Sasha Levin +--- + security/apparmor/policy_compat.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/security/apparmor/policy_compat.c b/security/apparmor/policy_compat.c +index cc89d1e88fb74..6fa185ce8d9dc 100644 +--- a/security/apparmor/policy_compat.c ++++ b/security/apparmor/policy_compat.c +@@ -179,6 +179,8 @@ static struct aa_perms *compute_xmatch_perms(struct aa_dfa *xmatch) + state_count = xmatch->tables[YYTD_ID_BASE]->td_lolen; + /* DFAs are restricted from having a state_count of less than 2 */ + perms = kvcalloc(state_count, sizeof(struct aa_perms), GFP_KERNEL); ++ if (!perms) ++ return NULL; + + /* zero init so skip the trap state (state == 0) */ + for (state = 1; state < state_count; state++) +-- +2.39.2 + diff --git a/queue-6.4/apparmor-fix-missing-error-check-for-rhashtable_inse.patch b/queue-6.4/apparmor-fix-missing-error-check-for-rhashtable_inse.patch new file mode 100644 index 00000000000..7c6d57ca822 --- /dev/null +++ b/queue-6.4/apparmor-fix-missing-error-check-for-rhashtable_inse.patch @@ -0,0 +1,47 @@ +From 32e15be51a553269f3f02aa9717949723866760a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Apr 2023 19:05:49 +0000 +Subject: apparmor: fix missing error check for rhashtable_insert_fast + +From: Danila Chernetsov + +[ Upstream commit 000518bc5aef25d3f703592a0296d578c98b1517 ] + + rhashtable_insert_fast() could return err value when memory allocation is + failed. but unpack_profile() do not check values and this always returns + success value. This patch just adds error check code. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: e025be0f26d5 ("apparmor: support querying extended trusted helper extra data") + +Signed-off-by: Danila Chernetsov +Signed-off-by: John Johansen +Signed-off-by: Sasha Levin +--- + security/apparmor/policy_unpack.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c +index 278ed96c30a26..72aac376d3ed7 100644 +--- a/security/apparmor/policy_unpack.c ++++ b/security/apparmor/policy_unpack.c +@@ -1064,8 +1064,13 @@ static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name) + goto fail; + } + +- rhashtable_insert_fast(profile->data, &data->head, +- profile->data->p); ++ if (rhashtable_insert_fast(profile->data, &data->head, ++ profile->data->p)) { ++ kfree_sensitive(data->key); ++ kfree_sensitive(data); ++ info = "failed to insert data to table"; ++ goto fail; ++ } + } + + if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL)) { +-- +2.39.2 + diff --git a/queue-6.4/apparmor-fix-policy_compat-permission-remap-with-ext.patch b/queue-6.4/apparmor-fix-policy_compat-permission-remap-with-ext.patch new file mode 100644 index 00000000000..14b237ca0f8 --- /dev/null +++ b/queue-6.4/apparmor-fix-policy_compat-permission-remap-with-ext.patch @@ -0,0 +1,81 @@ +From 698d2ad90194bccc41c913451e5c547a9d0d4a34 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Mar 2023 15:59:45 -0800 +Subject: apparmor: fix policy_compat permission remap with extended + permissions + +From: John Johansen + +[ Upstream commit 0bac2002b397fda7c9ea81ee0b06a02242958107 ] + +If the extended permission table is present we should not be attempting +to do a compat_permission remap as the compat_permissions are not +stored in the dfa accept states. + +Fixes: fd1b2b95a211 ("apparmor: add the ability for policy to specify a permission table") +Signed-off-by: John Johansen +Reviewed-by: Jon Tourville +Signed-off-by: Sasha Levin +--- + security/apparmor/policy_unpack.c | 31 +++++++++++++++++++------------ + 1 file changed, 19 insertions(+), 12 deletions(-) + +diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c +index 72aac376d3ed7..d50774a16494f 100644 +--- a/security/apparmor/policy_unpack.c ++++ b/security/apparmor/policy_unpack.c +@@ -860,10 +860,12 @@ static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name) + } + profile->attach.xmatch_len = tmp; + profile->attach.xmatch.start[AA_CLASS_XMATCH] = DFA_START; +- error = aa_compat_map_xmatch(&profile->attach.xmatch); +- if (error) { +- info = "failed to convert xmatch permission table"; +- goto fail; ++ if (!profile->attach.xmatch.perms) { ++ error = aa_compat_map_xmatch(&profile->attach.xmatch); ++ if (error) { ++ info = "failed to convert xmatch permission table"; ++ goto fail; ++ } + } + } + +@@ -983,10 +985,13 @@ static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name) + AA_CLASS_FILE); + if (!aa_unpack_nameX(e, AA_STRUCTEND, NULL)) + goto fail; +- error = aa_compat_map_policy(&rules->policy, e->version); +- if (error) { +- info = "failed to remap policydb permission table"; +- goto fail; ++ if (!rules->policy.perms) { ++ error = aa_compat_map_policy(&rules->policy, ++ e->version); ++ if (error) { ++ info = "failed to remap policydb permission table"; ++ goto fail; ++ } + } + } else { + rules->policy.dfa = aa_get_dfa(nulldfa); +@@ -1001,10 +1006,12 @@ static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name) + if (error) { + goto fail; + } else if (rules->file.dfa) { +- error = aa_compat_map_file(&rules->file); +- if (error) { +- info = "failed to remap file permission table"; +- goto fail; ++ if (!rules->file.perms) { ++ error = aa_compat_map_file(&rules->file); ++ if (error) { ++ info = "failed to remap file permission table"; ++ goto fail; ++ } + } + } else if (rules->policy.dfa && + rules->policy.start[AA_CLASS_FILE]) { +-- +2.39.2 + diff --git a/queue-6.4/apparmor-fix-profile-verification-and-enable-it.patch b/queue-6.4/apparmor-fix-profile-verification-and-enable-it.patch new file mode 100644 index 00000000000..95d0b628e51 --- /dev/null +++ b/queue-6.4/apparmor-fix-profile-verification-and-enable-it.patch @@ -0,0 +1,180 @@ +From 758060d91aa3938374ff16394780270d9a6c9614 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Apr 2023 02:57:55 -0700 +Subject: apparmor: fix profile verification and enable it + +From: John Johansen + +[ Upstream commit 6f442d42c0d89876994a4a135eadf82b0e6ff6e4 ] + +The transition table size was not being set by compat mappings +resulting in the profile verification code not being run. Unfortunately +the checks were also buggy not being correctly updated from the old +accept perms, to the new layout. + +Also indicate to userspace that the kernel has the permstable verification +fixes. + +BugLink: http://bugs.launchpad.net/bugs/2017903 +Fixes: 670f31774ab6 ("apparmor: verify permission table indexes") +Signed-off-by: John Johansen +Reviewed-by: Jon Tourville +Signed-off-by: Sasha Levin +--- + security/apparmor/policy_compat.c | 18 ++++++++++------ + security/apparmor/policy_unpack.c | 34 ++++++++++++++----------------- + 2 files changed, 27 insertions(+), 25 deletions(-) + +diff --git a/security/apparmor/policy_compat.c b/security/apparmor/policy_compat.c +index 6fa185ce8d9dc..0cb02da8a3193 100644 +--- a/security/apparmor/policy_compat.c ++++ b/security/apparmor/policy_compat.c +@@ -146,7 +146,8 @@ static struct aa_perms compute_fperms_other(struct aa_dfa *dfa, + * + * Returns: remapped perm table + */ +-static struct aa_perms *compute_fperms(struct aa_dfa *dfa) ++static struct aa_perms *compute_fperms(struct aa_dfa *dfa, ++ u32 *size) + { + aa_state_t state; + unsigned int state_count; +@@ -159,6 +160,7 @@ static struct aa_perms *compute_fperms(struct aa_dfa *dfa) + table = kvcalloc(state_count * 2, sizeof(struct aa_perms), GFP_KERNEL); + if (!table) + return NULL; ++ *size = state_count * 2; + + for (state = 0; state < state_count; state++) { + table[state * 2] = compute_fperms_user(dfa, state); +@@ -168,7 +170,8 @@ static struct aa_perms *compute_fperms(struct aa_dfa *dfa) + return table; + } + +-static struct aa_perms *compute_xmatch_perms(struct aa_dfa *xmatch) ++static struct aa_perms *compute_xmatch_perms(struct aa_dfa *xmatch, ++ u32 *size) + { + struct aa_perms *perms; + int state; +@@ -181,6 +184,7 @@ static struct aa_perms *compute_xmatch_perms(struct aa_dfa *xmatch) + perms = kvcalloc(state_count, sizeof(struct aa_perms), GFP_KERNEL); + if (!perms) + return NULL; ++ *size = state_count; + + /* zero init so skip the trap state (state == 0) */ + for (state = 1; state < state_count; state++) +@@ -241,7 +245,8 @@ static struct aa_perms compute_perms_entry(struct aa_dfa *dfa, + return perms; + } + +-static struct aa_perms *compute_perms(struct aa_dfa *dfa, u32 version) ++static struct aa_perms *compute_perms(struct aa_dfa *dfa, u32 version, ++ u32 *size) + { + unsigned int state; + unsigned int state_count; +@@ -254,6 +259,7 @@ static struct aa_perms *compute_perms(struct aa_dfa *dfa, u32 version) + table = kvcalloc(state_count, sizeof(struct aa_perms), GFP_KERNEL); + if (!table) + return NULL; ++ *size = state_count; + + /* zero init so skip the trap state (state == 0) */ + for (state = 1; state < state_count; state++) +@@ -288,7 +294,7 @@ static void remap_dfa_accept(struct aa_dfa *dfa, unsigned int factor) + /* TODO: merge different dfa mappings into single map_policy fn */ + int aa_compat_map_xmatch(struct aa_policydb *policy) + { +- policy->perms = compute_xmatch_perms(policy->dfa); ++ policy->perms = compute_xmatch_perms(policy->dfa, &policy->size); + if (!policy->perms) + return -ENOMEM; + +@@ -299,7 +305,7 @@ int aa_compat_map_xmatch(struct aa_policydb *policy) + + int aa_compat_map_policy(struct aa_policydb *policy, u32 version) + { +- policy->perms = compute_perms(policy->dfa, version); ++ policy->perms = compute_perms(policy->dfa, version, &policy->size); + if (!policy->perms) + return -ENOMEM; + +@@ -310,7 +316,7 @@ int aa_compat_map_policy(struct aa_policydb *policy, u32 version) + + int aa_compat_map_file(struct aa_policydb *policy) + { +- policy->perms = compute_fperms(policy->dfa); ++ policy->perms = compute_fperms(policy->dfa, &policy->size); + if (!policy->perms) + return -ENOMEM; + +diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c +index d50774a16494f..bc9f436d49cca 100644 +--- a/security/apparmor/policy_unpack.c ++++ b/security/apparmor/policy_unpack.c +@@ -1164,22 +1164,16 @@ static int verify_header(struct aa_ext *e, int required, const char **ns) + return 0; + } + +-static bool verify_xindex(int xindex, int table_size) +-{ +- int index, xtype; +- xtype = xindex & AA_X_TYPE_MASK; +- index = xindex & AA_X_INDEX_MASK; +- if (xtype == AA_X_TABLE && index >= table_size) +- return false; +- return true; +-} +- +-/* verify dfa xindexes are in range of transition tables */ +-static bool verify_dfa_xindex(struct aa_dfa *dfa, int table_size) ++/** ++ * verify_dfa_accept_xindex - verify accept indexes are in range of perms table ++ * @dfa: the dfa to check accept indexes are in range ++ * table_size: the permission table size the indexes should be within ++ */ ++static bool verify_dfa_accept_index(struct aa_dfa *dfa, int table_size) + { + int i; + for (i = 0; i < dfa->tables[YYTD_ID_ACCEPT]->td_lolen; i++) { +- if (!verify_xindex(ACCEPT_TABLE(dfa)[i], table_size)) ++ if (ACCEPT_TABLE(dfa)[i] >= table_size) + return false; + } + return true; +@@ -1216,11 +1210,13 @@ static bool verify_perms(struct aa_policydb *pdb) + if (!verify_perm(&pdb->perms[i])) + return false; + /* verify indexes into str table */ +- if (pdb->perms[i].xindex >= pdb->trans.size) ++ if ((pdb->perms[i].xindex & AA_X_TYPE_MASK) == AA_X_TABLE && ++ (pdb->perms[i].xindex & AA_X_INDEX_MASK) >= pdb->trans.size) + return false; +- if (pdb->perms[i].tag >= pdb->trans.size) ++ if (pdb->perms[i].tag && pdb->perms[i].tag >= pdb->trans.size) + return false; +- if (pdb->perms[i].label >= pdb->trans.size) ++ if (pdb->perms[i].label && ++ pdb->perms[i].label >= pdb->trans.size) + return false; + } + +@@ -1242,10 +1238,10 @@ static int verify_profile(struct aa_profile *profile) + if (!rules) + return 0; + +- if ((rules->file.dfa && !verify_dfa_xindex(rules->file.dfa, +- rules->file.trans.size)) || ++ if ((rules->file.dfa && !verify_dfa_accept_index(rules->file.dfa, ++ rules->file.size)) || + (rules->policy.dfa && +- !verify_dfa_xindex(rules->policy.dfa, rules->policy.trans.size))) { ++ !verify_dfa_accept_index(rules->policy.dfa, rules->policy.size))) { + audit_iface(profile, NULL, NULL, + "Unpack: Invalid named transition", NULL, -EPROTO); + return -EPROTO; +-- +2.39.2 + diff --git a/queue-6.4/blk-throttle-fix-io-statistics-for-cgroup-v1.patch b/queue-6.4/blk-throttle-fix-io-statistics-for-cgroup-v1.patch new file mode 100644 index 00000000000..20a8d472a79 --- /dev/null +++ b/queue-6.4/blk-throttle-fix-io-statistics-for-cgroup-v1.patch @@ -0,0 +1,95 @@ +From 489df5e1cb021511fd781b5f4c979afc0f56cfd3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 May 2023 01:06:31 +0800 +Subject: blk-throttle: Fix io statistics for cgroup v1 + +From: Jinke Han + +[ Upstream commit ad7c3b41e86b59943a903d23c7b037d820e6270c ] + +After commit f382fb0bcef4 ("block: remove legacy IO schedulers"), +blkio.throttle.io_serviced and blkio.throttle.io_service_bytes become +the only stable io stats interface of cgroup v1, and these statistics +are done in the blk-throttle code. But the current code only counts the +bios that are actually throttled. When the user does not add the throttle +limit, the io stats for cgroup v1 has nothing. I fix it according to the +statistical method of v2, and made it count all ios accurately. + +Fixes: a7b36ee6ba29 ("block: move blk-throtl fast path inline") +Tested-by: Andrea Righi +Signed-off-by: Jinke Han +Acked-by: Muchun Song +Acked-by: Tejun Heo +Link: https://lore.kernel.org/r/20230507170631.89607-1-hanjinke.666@bytedance.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-cgroup.c | 6 ++++-- + block/blk-throttle.c | 6 ------ + block/blk-throttle.h | 9 +++++++++ + 3 files changed, 13 insertions(+), 8 deletions(-) + +diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c +index aaf9903ad7b2f..fc49be622e05b 100644 +--- a/block/blk-cgroup.c ++++ b/block/blk-cgroup.c +@@ -2086,6 +2086,9 @@ void blk_cgroup_bio_start(struct bio *bio) + struct blkg_iostat_set *bis; + unsigned long flags; + ++ if (!cgroup_subsys_on_dfl(io_cgrp_subsys)) ++ return; ++ + /* Root-level stats are sourced from system-wide IO stats */ + if (!cgroup_parent(blkcg->css.cgroup)) + return; +@@ -2116,8 +2119,7 @@ void blk_cgroup_bio_start(struct bio *bio) + } + + u64_stats_update_end_irqrestore(&bis->sync, flags); +- if (cgroup_subsys_on_dfl(io_cgrp_subsys)) +- cgroup_rstat_updated(blkcg->css.cgroup, cpu); ++ cgroup_rstat_updated(blkcg->css.cgroup, cpu); + put_cpu(); + } + +diff --git a/block/blk-throttle.c b/block/blk-throttle.c +index 9d010d867fbf4..7397ff199d669 100644 +--- a/block/blk-throttle.c ++++ b/block/blk-throttle.c +@@ -2178,12 +2178,6 @@ bool __blk_throtl_bio(struct bio *bio) + + rcu_read_lock(); + +- if (!cgroup_subsys_on_dfl(io_cgrp_subsys)) { +- blkg_rwstat_add(&tg->stat_bytes, bio->bi_opf, +- bio->bi_iter.bi_size); +- blkg_rwstat_add(&tg->stat_ios, bio->bi_opf, 1); +- } +- + spin_lock_irq(&q->queue_lock); + + throtl_update_latency_buckets(td); +diff --git a/block/blk-throttle.h b/block/blk-throttle.h +index ef4b7a4de987d..d1ccbfe9f7978 100644 +--- a/block/blk-throttle.h ++++ b/block/blk-throttle.h +@@ -185,6 +185,15 @@ static inline bool blk_should_throtl(struct bio *bio) + struct throtl_grp *tg = blkg_to_tg(bio->bi_blkg); + int rw = bio_data_dir(bio); + ++ if (!cgroup_subsys_on_dfl(io_cgrp_subsys)) { ++ if (!bio_flagged(bio, BIO_CGROUP_ACCT)) { ++ bio_set_flag(bio, BIO_CGROUP_ACCT); ++ blkg_rwstat_add(&tg->stat_bytes, bio->bi_opf, ++ bio->bi_iter.bi_size); ++ } ++ blkg_rwstat_add(&tg->stat_ios, bio->bi_opf, 1); ++ } ++ + /* iops limit is always counted */ + if (tg->has_rules_iops[rw]) + return true; +-- +2.39.2 + diff --git a/queue-6.4/bluetooth-fix-invalid-bdaddr-quirk-for-non-persisten.patch b/queue-6.4/bluetooth-fix-invalid-bdaddr-quirk-for-non-persisten.patch new file mode 100644 index 00000000000..a1fe1138969 --- /dev/null +++ b/queue-6.4/bluetooth-fix-invalid-bdaddr-quirk-for-non-persisten.patch @@ -0,0 +1,68 @@ +From 9fd885713e912788e6dbd3bac539dac10ffd0e54 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 May 2023 11:04:23 +0200 +Subject: Bluetooth: fix invalid-bdaddr quirk for non-persistent setup + +From: Johan Hovold + +[ Upstream commit 0cb7365850bacb8c2a9975cae672d65714d8daa1 ] + +Devices that lack persistent storage for the device address can indicate +this by setting the HCI_QUIRK_INVALID_BDADDR which causes the controller +to be marked as unconfigured until user space has set a valid address. + +Once configured, the device address must be set on every setup for +controllers with HCI_QUIRK_NON_PERSISTENT_SETUP to avoid marking the +controller as unconfigured and requiring the address to be set again. + +Fixes: 740011cfe948 ("Bluetooth: Add new quirk for non-persistent setup settings") +Signed-off-by: Johan Hovold +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/bluetooth/hci_sync.c | 28 +++++++++++----------------- + 1 file changed, 11 insertions(+), 17 deletions(-) + +diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c +index 804cde43b4e02..b5b1b610df335 100644 +--- a/net/bluetooth/hci_sync.c ++++ b/net/bluetooth/hci_sync.c +@@ -4626,23 +4626,17 @@ static int hci_dev_setup_sync(struct hci_dev *hdev) + invalid_bdaddr = test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks); + + if (!ret) { +- if (test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) { +- if (!bacmp(&hdev->public_addr, BDADDR_ANY)) +- hci_dev_get_bd_addr_from_property(hdev); +- +- if (bacmp(&hdev->public_addr, BDADDR_ANY) && +- hdev->set_bdaddr) { +- ret = hdev->set_bdaddr(hdev, +- &hdev->public_addr); +- +- /* If setting of the BD_ADDR from the device +- * property succeeds, then treat the address +- * as valid even if the invalid BD_ADDR +- * quirk indicates otherwise. +- */ +- if (!ret) +- invalid_bdaddr = false; +- } ++ if (test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks) && ++ !bacmp(&hdev->public_addr, BDADDR_ANY)) ++ hci_dev_get_bd_addr_from_property(hdev); ++ ++ if ((invalid_bdaddr || ++ test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) && ++ bacmp(&hdev->public_addr, BDADDR_ANY) && ++ hdev->set_bdaddr) { ++ ret = hdev->set_bdaddr(hdev, &hdev->public_addr); ++ if (!ret) ++ invalid_bdaddr = false; + } + } + +-- +2.39.2 + diff --git a/queue-6.4/bluetooth-fix-use-bdaddr-property-quirk.patch b/queue-6.4/bluetooth-fix-use-bdaddr-property-quirk.patch new file mode 100644 index 00000000000..6f93cd3f264 --- /dev/null +++ b/queue-6.4/bluetooth-fix-use-bdaddr-property-quirk.patch @@ -0,0 +1,67 @@ +From c633b05a4d52a247c3fcfe80c726da2439cf2bf8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 May 2023 11:04:24 +0200 +Subject: Bluetooth: fix use-bdaddr-property quirk + +From: Johan Hovold + +[ Upstream commit 6945795bc81ab7be22750ecfb365056688f2fada ] + +Devices that lack persistent storage for the device address can indicate +this by setting the HCI_QUIRK_INVALID_BDADDR which causes the controller +to be marked as unconfigured until user space has set a valid address. + +The related HCI_QUIRK_USE_BDADDR_PROPERTY was later added to similarly +indicate that the device lacks a valid address but that one may be +specified in the devicetree. + +As is clear from commit 7a0e5b15ca45 ("Bluetooth: Add quirk for reading +BD_ADDR from fwnode property") that added and documented this quirk and +commits like de79a9df1692 ("Bluetooth: btqcomsmd: use +HCI_QUIRK_USE_BDADDR_PROPERTY"), the device address of controllers with +this flag should be treated as invalid until user space has had a chance +to configure the controller in case the devicetree property is missing. + +As it does not make sense to allow controllers with invalid addresses, +restore the original semantics, which also makes sure that the +implementation is consistent (e.g. get_missing_options() indicates that +the address must be set) and matches the documentation (including +comments in the code, such as, "In case any of them is set, the +controller has to start up as unconfigured."). + +Fixes: e668eb1e1578 ("Bluetooth: hci_core: Don't stop BT if the BD address missing in dts") +Signed-off-by: Johan Hovold +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/bluetooth/hci_sync.c | 8 +++----- + 1 file changed, 3 insertions(+), 5 deletions(-) + +diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c +index b5b1b610df335..8561616abbe5f 100644 +--- a/net/bluetooth/hci_sync.c ++++ b/net/bluetooth/hci_sync.c +@@ -4623,16 +4623,14 @@ static int hci_dev_setup_sync(struct hci_dev *hdev) + * BD_ADDR invalid before creating the HCI device or in + * its setup callback. + */ +- invalid_bdaddr = test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks); +- ++ invalid_bdaddr = test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) || ++ test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks); + if (!ret) { + if (test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks) && + !bacmp(&hdev->public_addr, BDADDR_ANY)) + hci_dev_get_bd_addr_from_property(hdev); + +- if ((invalid_bdaddr || +- test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) && +- bacmp(&hdev->public_addr, BDADDR_ANY) && ++ if (invalid_bdaddr && bacmp(&hdev->public_addr, BDADDR_ANY) && + hdev->set_bdaddr) { + ret = hdev->set_bdaddr(hdev, &hdev->public_addr); + if (!ret) +-- +2.39.2 + diff --git a/queue-6.4/bluetooth-hci_bcm-do-not-mark-valid-bd_addr-as-inval.patch b/queue-6.4/bluetooth-hci_bcm-do-not-mark-valid-bd_addr-as-inval.patch new file mode 100644 index 00000000000..7b49efab417 --- /dev/null +++ b/queue-6.4/bluetooth-hci_bcm-do-not-mark-valid-bd_addr-as-inval.patch @@ -0,0 +1,51 @@ +From 2cfb11b81d344afe4080da54e6bd057425c7ac0a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Jun 2023 10:19:12 +0200 +Subject: Bluetooth: hci_bcm: do not mark valid bd_addr as invalid + +From: Johan Hovold + +[ Upstream commit 56b7f325db139c9255b1eb1d1e741576d5f8fa34 ] + +A recent commit restored the original (and still documented) semantics +for the HCI_QUIRK_USE_BDADDR_PROPERTY quirk so that the device address +is considered invalid unless an address is provided by firmware. + +This specifically means that this flag must only be set for devices with +invalid addresses, but the Broadcom driver has so far been setting this +flag unconditionally. + +Fortunately the driver already checks for invalid addresses during setup +and sets the HCI_QUIRK_INVALID_BDADDR flag. Use this flag to indicate +when the address can be overridden by firmware (long term, this should +probably just always be allowed). + +Fixes: 6945795bc81a ("Bluetooth: fix use-bdaddr-property quirk") +Reported-by: Marek Szyprowski +Link: https://lore.kernel.org/lkml/ecef83c8-497f-4011-607b-a63c24764867@samsung.com +Signed-off-by: Johan Hovold +Tested-by: Marek Szyprowski +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/hci_bcm.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/bluetooth/hci_bcm.c b/drivers/bluetooth/hci_bcm.c +index 83bf5d4330c40..874d23089b39b 100644 +--- a/drivers/bluetooth/hci_bcm.c ++++ b/drivers/bluetooth/hci_bcm.c +@@ -643,7 +643,8 @@ static int bcm_setup(struct hci_uart *hu) + * Allow the bootloader to set a valid address through the + * device tree. + */ +- set_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hu->hdev->quirks); ++ if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hu->hdev->quirks)) ++ set_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hu->hdev->quirks); + + if (!bcm_request_irq(bcm)) + err = bcm_setup_sleep(hu); +-- +2.39.2 + diff --git a/queue-6.4/bluetooth-iso-use-hci_sync-for-setting-cig-parameter.patch b/queue-6.4/bluetooth-iso-use-hci_sync-for-setting-cig-parameter.patch new file mode 100644 index 00000000000..2d987e1ba9f --- /dev/null +++ b/queue-6.4/bluetooth-iso-use-hci_sync-for-setting-cig-parameter.patch @@ -0,0 +1,117 @@ +From b78b6b5cf07b8d1e875665b5b6c0dc7ee86a4a3d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Jun 2023 09:34:43 +0300 +Subject: Bluetooth: ISO: use hci_sync for setting CIG parameters + +From: Pauli Virtanen + +[ Upstream commit 6b9545dc9f8ff01d8bc1229103960d9cd265343f ] + +When reconfiguring CIG after disconnection of the last CIS, LE Remove +CIG shall be sent before LE Set CIG Parameters. Otherwise, it fails +because CIG is in the inactive state and not configurable (Core v5.3 +Vol 6 Part B Sec. 4.5.14.3). This ordering is currently wrong under +suitable timing conditions, because LE Remove CIG is sent via the +hci_sync queue and may be delayed, but Set CIG Parameters is via +hci_send_cmd. + +Make the ordering well-defined by sending also Set CIG Parameters via +hci_sync. + +Fixes: 26afbd826ee3 ("Bluetooth: Add initial implementation of CIS connections") +Signed-off-by: Pauli Virtanen +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/bluetooth/hci_conn.c | 47 +++++++++++++++++++++++++++++++++------- + 1 file changed, 39 insertions(+), 8 deletions(-) + +diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c +index 1ef952bda97d8..2275e0d9f8419 100644 +--- a/net/bluetooth/hci_conn.c ++++ b/net/bluetooth/hci_conn.c +@@ -775,6 +775,11 @@ static void le_conn_timeout(struct work_struct *work) + hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM); + } + ++struct iso_cig_params { ++ struct hci_cp_le_set_cig_params cp; ++ struct hci_cis_params cis[0x1f]; ++}; ++ + struct iso_list_data { + union { + u8 cig; +@@ -786,10 +791,7 @@ struct iso_list_data { + u16 sync_handle; + }; + int count; +- struct { +- struct hci_cp_le_set_cig_params cp; +- struct hci_cis_params cis[0x11]; +- } pdu; ++ struct iso_cig_params pdu; + }; + + static void bis_list(struct hci_conn *conn, void *data) +@@ -1764,10 +1766,33 @@ static int hci_le_create_big(struct hci_conn *conn, struct bt_iso_qos *qos) + return hci_send_cmd(hdev, HCI_OP_LE_CREATE_BIG, sizeof(cp), &cp); + } + ++static void set_cig_params_complete(struct hci_dev *hdev, void *data, int err) ++{ ++ struct iso_cig_params *pdu = data; ++ ++ bt_dev_dbg(hdev, ""); ++ ++ if (err) ++ bt_dev_err(hdev, "Unable to set CIG parameters: %d", err); ++ ++ kfree(pdu); ++} ++ ++static int set_cig_params_sync(struct hci_dev *hdev, void *data) ++{ ++ struct iso_cig_params *pdu = data; ++ u32 plen; ++ ++ plen = sizeof(pdu->cp) + pdu->cp.num_cis * sizeof(pdu->cis[0]); ++ return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_CIG_PARAMS, plen, pdu, ++ HCI_CMD_TIMEOUT); ++} ++ + static bool hci_le_set_cig_params(struct hci_conn *conn, struct bt_iso_qos *qos) + { + struct hci_dev *hdev = conn->hdev; + struct iso_list_data data; ++ struct iso_cig_params *pdu; + + memset(&data, 0, sizeof(data)); + +@@ -1837,12 +1862,18 @@ static bool hci_le_set_cig_params(struct hci_conn *conn, struct bt_iso_qos *qos) + if (qos->ucast.cis == BT_ISO_QOS_CIS_UNSET || !data.pdu.cp.num_cis) + return false; + +- if (hci_send_cmd(hdev, HCI_OP_LE_SET_CIG_PARAMS, +- sizeof(data.pdu.cp) + +- (data.pdu.cp.num_cis * sizeof(*data.pdu.cis)), +- &data.pdu) < 0) ++ pdu = kzalloc(sizeof(*pdu), GFP_KERNEL); ++ if (!pdu) + return false; + ++ memcpy(pdu, &data.pdu, sizeof(*pdu)); ++ ++ if (hci_cmd_sync_queue(hdev, set_cig_params_sync, pdu, ++ set_cig_params_complete) < 0) { ++ kfree(pdu); ++ return false; ++ } ++ + return true; + } + +-- +2.39.2 + diff --git a/queue-6.4/bluetooth-mgmt-fix-marking-scan_rsp-as-not-connectab.patch b/queue-6.4/bluetooth-mgmt-fix-marking-scan_rsp-as-not-connectab.patch new file mode 100644 index 00000000000..763ce2623f5 --- /dev/null +++ b/queue-6.4/bluetooth-mgmt-fix-marking-scan_rsp-as-not-connectab.patch @@ -0,0 +1,73 @@ +From b6d8f94a9b0ef4cbcaa69ca0fd039ac3a0a9ff7b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Jun 2023 12:33:47 -0700 +Subject: Bluetooth: MGMT: Fix marking SCAN_RSP as not connectable + +From: Luiz Augusto von Dentz + +[ Upstream commit 73f55453ea5236a586a7f1b3d5e2ee051d655351 ] + +When receiving a scan response there is no way to know if the remote +device is connectable or not, so when it cannot be merged don't +make any assumption and instead just mark it with a new flag defined as +MGMT_DEV_FOUND_SCAN_RSP so userspace can tell it is a standalone +SCAN_RSP. + +Link: https://lore.kernel.org/linux-bluetooth/CABBYNZ+CYMsDSPTxBn09Js3BcdC-x7vZFfyLJ3ppZGGwJKmUTw@mail.gmail.com/ +Fixes: c70a7e4cc8d2 ("Bluetooth: Add support for Not Connectable flag for Device Found events") +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + include/net/bluetooth/mgmt.h | 1 + + net/bluetooth/hci_event.c | 15 +++++---------- + 2 files changed, 6 insertions(+), 10 deletions(-) + +diff --git a/include/net/bluetooth/mgmt.h b/include/net/bluetooth/mgmt.h +index a5801649f6196..5e68b3dd44222 100644 +--- a/include/net/bluetooth/mgmt.h ++++ b/include/net/bluetooth/mgmt.h +@@ -979,6 +979,7 @@ struct mgmt_ev_auth_failed { + #define MGMT_DEV_FOUND_NOT_CONNECTABLE BIT(2) + #define MGMT_DEV_FOUND_INITIATED_CONN BIT(3) + #define MGMT_DEV_FOUND_NAME_REQUEST_FAILED BIT(4) ++#define MGMT_DEV_FOUND_SCAN_RSP BIT(5) + + #define MGMT_EV_DEVICE_FOUND 0x0012 + struct mgmt_ev_device_found { +diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c +index 09ba6d8987ee1..21e26d3b286cc 100644 +--- a/net/bluetooth/hci_event.c ++++ b/net/bluetooth/hci_event.c +@@ -6316,23 +6316,18 @@ static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr, + return; + } + +- /* When receiving non-connectable or scannable undirected +- * advertising reports, this means that the remote device is +- * not connectable and then clearly indicate this in the +- * device found event. +- * +- * When receiving a scan response, then there is no way to ++ /* When receiving a scan response, then there is no way to + * know if the remote device is connectable or not. However + * since scan responses are merged with a previously seen + * advertising report, the flags field from that report + * will be used. + * +- * In the really unlikely case that a controller get confused +- * and just sends a scan response event, then it is marked as +- * not connectable as well. ++ * In the unlikely case that a controller just sends a scan ++ * response event that doesn't match the pending report, then ++ * it is marked as a standalone SCAN_RSP. + */ + if (type == LE_ADV_SCAN_RSP) +- flags = MGMT_DEV_FOUND_NOT_CONNECTABLE; ++ flags = MGMT_DEV_FOUND_SCAN_RSP; + + /* If there's nothing pending either store the data from this + * event or send an immediate device found event if the data +-- +2.39.2 + diff --git a/queue-6.4/bpf-btf-warn-but-return-no-error-for-null-btf-from-_.patch b/queue-6.4/bpf-btf-warn-but-return-no-error-for-null-btf-from-_.patch new file mode 100644 index 00000000000..b67b580e321 --- /dev/null +++ b/queue-6.4/bpf-btf-warn-but-return-no-error-for-null-btf-from-_.patch @@ -0,0 +1,57 @@ +From 95eb0da0af12c9fc44a0b40bf8b4cd491770ec3b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 1 Jul 2023 17:14:47 +0000 +Subject: bpf, btf: Warn but return no error for NULL btf from + __register_btf_kfunc_id_set() + +From: SeongJae Park + +[ Upstream commit 3de4d22cc9ac7c9f38e10edcf54f9a8891a9c2aa ] + +__register_btf_kfunc_id_set() assumes .BTF to be part of the module's .ko +file if CONFIG_DEBUG_INFO_BTF is enabled. If that's not the case, the +function prints an error message and return an error. As a result, such +modules cannot be loaded. + +However, the section could be stripped out during a build process. It would +be better to let the modules loaded, because their basic functionalities +have no problem [0], though the BTF functionalities will not be supported. +Make the function to lower the level of the message from error to warn, and +return no error. + + [0] https://lore.kernel.org/bpf/20220219082037.ow2kbq5brktf4f2u@apollo.legion + +Fixes: c446fdacb10d ("bpf: fix register_btf_kfunc_id_set for !CONFIG_DEBUG_INFO_BTF") +Reported-by: Alexander Egorenkov +Suggested-by: Kumar Kartikeya Dwivedi +Signed-off-by: SeongJae Park +Signed-off-by: Daniel Borkmann +Acked-by: Jiri Olsa +Link: https://lore.kernel.org/bpf/87y228q66f.fsf@oc8242746057.ibm.com +Link: https://lore.kernel.org/bpf/20220219082037.ow2kbq5brktf4f2u@apollo.legion +Link: https://lore.kernel.org/bpf/20230701171447.56464-1-sj@kernel.org +Signed-off-by: Sasha Levin +--- + kernel/bpf/btf.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c +index 72b32b7cd9cd9..25ca17a8e1964 100644 +--- a/kernel/bpf/btf.c ++++ b/kernel/bpf/btf.c +@@ -7848,10 +7848,8 @@ static int __register_btf_kfunc_id_set(enum btf_kfunc_hook hook, + pr_err("missing vmlinux BTF, cannot register kfuncs\n"); + return -ENOENT; + } +- if (kset->owner && IS_ENABLED(CONFIG_DEBUG_INFO_BTF_MODULES)) { +- pr_err("missing module BTF, cannot register kfuncs\n"); +- return -ENOENT; +- } ++ if (kset->owner && IS_ENABLED(CONFIG_DEBUG_INFO_BTF_MODULES)) ++ pr_warn("missing module BTF, cannot register kfuncs\n"); + return 0; + } + if (IS_ERR(btf)) +-- +2.39.2 + diff --git a/queue-6.4/bus-fsl-mc-don-t-assume-child-devices-are-all-fsl-mc.patch b/queue-6.4/bus-fsl-mc-don-t-assume-child-devices-are-all-fsl-mc.patch new file mode 100644 index 00000000000..1d09483c959 --- /dev/null +++ b/queue-6.4/bus-fsl-mc-don-t-assume-child-devices-are-all-fsl-mc.patch @@ -0,0 +1,99 @@ +From 6bd24a6cbaf1407e8b2ddb18e9d4872a72452a9c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Jun 2023 19:07:18 +0300 +Subject: bus: fsl-mc: don't assume child devices are all fsl-mc devices + +From: Laurentiu Tudor + +[ Upstream commit 303c9c63abb9390e906052863f82bb4e9824e5c0 ] + +Changes in VFIO caused a pseudo-device to be created as child of +fsl-mc devices causing a crash [1] when trying to bind a fsl-mc +device to VFIO. Fix this by checking the device type when enumerating +fsl-mc child devices. + +[1] +Modules linked in: +Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP +CPU: 6 PID: 1289 Comm: sh Not tainted 6.2.0-rc5-00047-g7c46948a6e9c #2 +Hardware name: NXP Layerscape LX2160ARDB (DT) +pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) +pc : mc_send_command+0x24/0x1f0 +lr : dprc_get_obj_region+0xfc/0x1c0 +sp : ffff80000a88b900 +x29: ffff80000a88b900 x28: ffff48a9429e1400 x27: 00000000000002b2 +x26: ffff48a9429e1718 x25: 0000000000000000 x24: 0000000000000000 +x23: ffffd59331ba3918 x22: ffffd59331ba3000 x21: 0000000000000000 +x20: ffff80000a88b9b8 x19: 0000000000000000 x18: 0000000000000001 +x17: 7270642f636d2d6c x16: 73662e3030303030 x15: ffffffffffffffff +x14: ffffd59330f1d668 x13: ffff48a8727dc389 x12: ffff48a8727dc386 +x11: 0000000000000002 x10: 00008ceaf02f35d4 x9 : 0000000000000012 +x8 : 0000000000000000 x7 : 0000000000000006 x6 : ffff80000a88bab0 +x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff80000a88b9e8 +x2 : ffff80000a88b9e8 x1 : 0000000000000000 x0 : ffff48a945142b80 +Call trace: + mc_send_command+0x24/0x1f0 + dprc_get_obj_region+0xfc/0x1c0 + fsl_mc_device_add+0x340/0x590 + fsl_mc_obj_device_add+0xd0/0xf8 + dprc_scan_objects+0x1c4/0x340 + dprc_scan_container+0x38/0x60 + vfio_fsl_mc_probe+0x9c/0xf8 + fsl_mc_driver_probe+0x24/0x70 + really_probe+0xbc/0x2a8 + __driver_probe_device+0x78/0xe0 + device_driver_attach+0x30/0x68 + bind_store+0xa8/0x130 + drv_attr_store+0x24/0x38 + sysfs_kf_write+0x44/0x60 + kernfs_fop_write_iter+0x128/0x1b8 + vfs_write+0x334/0x448 + ksys_write+0x68/0xf0 + __arm64_sys_write+0x1c/0x28 + invoke_syscall+0x44/0x108 + el0_svc_common.constprop.1+0x94/0xf8 + do_el0_svc+0x38/0xb0 + el0_svc+0x20/0x50 + el0t_64_sync_handler+0x98/0xc0 + el0t_64_sync+0x174/0x178 +Code: aa0103f4 a9025bf5 d5384100 b9400801 (79401260) +---[ end trace 0000000000000000 ]--- + +Fixes: 3c28a76124b2 ("vfio: Add struct device to vfio_device") +Signed-off-by: Laurentiu Tudor +Tested-by: Ioana Ciornei +Reviewed-by: Ioana Ciornei +Message-ID: <20230613160718.29500-1-laurentiu.tudor@nxp.com> +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/bus/fsl-mc/dprc-driver.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/bus/fsl-mc/dprc-driver.c b/drivers/bus/fsl-mc/dprc-driver.c +index 4c84be378bf27..ec5f26a45641b 100644 +--- a/drivers/bus/fsl-mc/dprc-driver.c ++++ b/drivers/bus/fsl-mc/dprc-driver.c +@@ -45,6 +45,9 @@ static int __fsl_mc_device_remove_if_not_in_mc(struct device *dev, void *data) + struct fsl_mc_child_objs *objs; + struct fsl_mc_device *mc_dev; + ++ if (!dev_is_fsl_mc(dev)) ++ return 0; ++ + mc_dev = to_fsl_mc_device(dev); + objs = data; + +@@ -64,6 +67,9 @@ static int __fsl_mc_device_remove_if_not_in_mc(struct device *dev, void *data) + + static int __fsl_mc_device_remove(struct device *dev, void *data) + { ++ if (!dev_is_fsl_mc(dev)) ++ return 0; ++ + fsl_mc_device_remove(to_fsl_mc_device(dev)); + return 0; + } +-- +2.39.2 + diff --git a/queue-6.4/cdx-fix-driver-managed-dma-support.patch b/queue-6.4/cdx-fix-driver-managed-dma-support.patch new file mode 100644 index 00000000000..188f66f385a --- /dev/null +++ b/queue-6.4/cdx-fix-driver-managed-dma-support.patch @@ -0,0 +1,84 @@ +From 083cad331436fbcc7cf7df19e1725eea1db6e2c3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Jun 2023 18:40:09 +0530 +Subject: cdx: fix driver managed dma support + +From: Nipun Gupta + +[ Upstream commit b8c5ff76059ded3758de3db83e04189a072ac01f ] + +The devices on cdx could be bound to drivers with the device +DMA managed by kernel drivers or user-space applications. +As multiple devices can be placed in the same IOMMU group, the +DMA on these devices must either be entirely under kernel control +or userspace control. Fix the CDX bus driver to acknowlege the +driver_managed_dma flag and call the appropriate iommu APIs. + +Fixes: 2959ab247061 ("cdx: add the cdx bus driver") +Signed-off-by: Nipun Gupta +Reported-by: Alex Williamson +Closes: https://lore.kernel.org/lkml/20230524134831.28dc97e2.alex.williamson@redhat.com/ +Reviewed-by: Nikhil Agarwal +Message-ID: <20230605131009.6869-1-nipun.gupta@amd.com> +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/cdx/cdx.c | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) + +diff --git a/drivers/cdx/cdx.c b/drivers/cdx/cdx.c +index 38511fd363257..d2cad4c670a07 100644 +--- a/drivers/cdx/cdx.c ++++ b/drivers/cdx/cdx.c +@@ -62,6 +62,8 @@ + #include + #include + #include ++#include ++#include + #include "cdx.h" + + /* Default DMA mask for devices on a CDX bus */ +@@ -257,6 +259,7 @@ static void cdx_shutdown(struct device *dev) + + static int cdx_dma_configure(struct device *dev) + { ++ struct cdx_driver *cdx_drv = to_cdx_driver(dev->driver); + struct cdx_device *cdx_dev = to_cdx_device(dev); + u32 input_id = cdx_dev->req_id; + int ret; +@@ -267,9 +270,23 @@ static int cdx_dma_configure(struct device *dev) + return ret; + } + ++ if (!ret && !cdx_drv->driver_managed_dma) { ++ ret = iommu_device_use_default_domain(dev); ++ if (ret) ++ arch_teardown_dma_ops(dev); ++ } ++ + return 0; + } + ++static void cdx_dma_cleanup(struct device *dev) ++{ ++ struct cdx_driver *cdx_drv = to_cdx_driver(dev->driver); ++ ++ if (!cdx_drv->driver_managed_dma) ++ iommu_device_unuse_default_domain(dev); ++} ++ + /* show configuration fields */ + #define cdx_config_attr(field, format_string) \ + static ssize_t \ +@@ -405,6 +422,7 @@ struct bus_type cdx_bus_type = { + .remove = cdx_remove, + .shutdown = cdx_shutdown, + .dma_configure = cdx_dma_configure, ++ .dma_cleanup = cdx_dma_cleanup, + .bus_groups = cdx_bus_groups, + .dev_groups = cdx_dev_groups, + }; +-- +2.39.2 + diff --git a/queue-6.4/clk-qcom-camcc-sc7180-add-parent-dependency-to-all-c.patch b/queue-6.4/clk-qcom-camcc-sc7180-add-parent-dependency-to-all-c.patch new file mode 100644 index 00000000000..33592623198 --- /dev/null +++ b/queue-6.4/clk-qcom-camcc-sc7180-add-parent-dependency-to-all-c.patch @@ -0,0 +1,88 @@ +From 4f389a199bd7f80429877feb40e3789781681e63 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 May 2023 19:59:32 +0530 +Subject: clk: qcom: camcc-sc7180: Add parent dependency to all camera GDSCs + +From: Taniya Das + +[ Upstream commit 3e4d179532423f299554cd0dedabdd9d2fdd238d ] + +Camera titan top GDSC is a parent supply to all other camera GDSCs. Titan +top GDSC is required to be enabled before enabling any other camera GDSCs +and it should be disabled only after all other camera GDSCs are disabled. +Ensure this behavior by marking titan top GDSC as parent of all other +camera GDSCs. + +Fixes: 15d09e830bbc ("clk: qcom: camcc: Add camera clock controller driver for SC7180") +Signed-off-by: Taniya Das +Acked-by: Stephen Boyd +Reviewed-by: Bryan O'Donoghue +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230501142932.13049-1-quic_tdas@quicinc.com +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/camcc-sc7180.c | 19 ++++++++++++------- + 1 file changed, 12 insertions(+), 7 deletions(-) + +diff --git a/drivers/clk/qcom/camcc-sc7180.c b/drivers/clk/qcom/camcc-sc7180.c +index e2b4804695f37..8a4ba7a19ed12 100644 +--- a/drivers/clk/qcom/camcc-sc7180.c ++++ b/drivers/clk/qcom/camcc-sc7180.c +@@ -1480,12 +1480,21 @@ static struct clk_branch cam_cc_sys_tmr_clk = { + }, + }; + ++static struct gdsc titan_top_gdsc = { ++ .gdscr = 0xb134, ++ .pd = { ++ .name = "titan_top_gdsc", ++ }, ++ .pwrsts = PWRSTS_OFF_ON, ++}; ++ + static struct gdsc bps_gdsc = { + .gdscr = 0x6004, + .pd = { + .name = "bps_gdsc", + }, + .pwrsts = PWRSTS_OFF_ON, ++ .parent = &titan_top_gdsc.pd, + .flags = HW_CTRL, + }; + +@@ -1495,6 +1504,7 @@ static struct gdsc ife_0_gdsc = { + .name = "ife_0_gdsc", + }, + .pwrsts = PWRSTS_OFF_ON, ++ .parent = &titan_top_gdsc.pd, + }; + + static struct gdsc ife_1_gdsc = { +@@ -1503,6 +1513,7 @@ static struct gdsc ife_1_gdsc = { + .name = "ife_1_gdsc", + }, + .pwrsts = PWRSTS_OFF_ON, ++ .parent = &titan_top_gdsc.pd, + }; + + static struct gdsc ipe_0_gdsc = { +@@ -1512,15 +1523,9 @@ static struct gdsc ipe_0_gdsc = { + }, + .pwrsts = PWRSTS_OFF_ON, + .flags = HW_CTRL, ++ .parent = &titan_top_gdsc.pd, + }; + +-static struct gdsc titan_top_gdsc = { +- .gdscr = 0xb134, +- .pd = { +- .name = "titan_top_gdsc", +- }, +- .pwrsts = PWRSTS_OFF_ON, +-}; + + static struct clk_hw *cam_cc_sc7180_hws[] = { + [CAM_CC_PLL2_OUT_EARLY] = &cam_cc_pll2_out_early.hw, +-- +2.39.2 + diff --git a/queue-6.4/clk-qcom-dispcc-qcm2290-fix-bi_tcxo_ao-handling.patch b/queue-6.4/clk-qcom-dispcc-qcm2290-fix-bi_tcxo_ao-handling.patch new file mode 100644 index 00000000000..6bf5bf7e370 --- /dev/null +++ b/queue-6.4/clk-qcom-dispcc-qcm2290-fix-bi_tcxo_ao-handling.patch @@ -0,0 +1,57 @@ +From b41fabfc8c12ebf5d285662135180b6cc3604470 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Apr 2023 13:06:35 +0200 +Subject: clk: qcom: dispcc-qcm2290: Fix BI_TCXO_AO handling + +From: Konrad Dybcio + +[ Upstream commit 92dfee0fc889b5b00ffb6b1de87ce64c483bcb7b ] + +BI_TCXO_AO (.fw_name = "bi_tcxo_ao") was previously made to reuse the +same parent enum entry as BI_TCXO (.fw_name = "bi_tcxo") in parent_map_2. + +Resolve it by introducing its own entry in the parent enum and +correctly assigning it in disp_cc_parent_map_2[]. + +Fixes: cc517ea3333f ("clk: qcom: Add display clock controller driver for QCM2290") +Signed-off-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230412-topic-qcm_dispcc-v2-1-bce7dd512fe4@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/dispcc-qcm2290.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/clk/qcom/dispcc-qcm2290.c b/drivers/clk/qcom/dispcc-qcm2290.c +index e9cfe41c04426..ee62aca4e5bb2 100644 +--- a/drivers/clk/qcom/dispcc-qcm2290.c ++++ b/drivers/clk/qcom/dispcc-qcm2290.c +@@ -24,6 +24,7 @@ + + enum { + P_BI_TCXO, ++ P_BI_TCXO_AO, + P_DISP_CC_PLL0_OUT_MAIN, + P_DSI0_PHY_PLL_OUT_BYTECLK, + P_DSI0_PHY_PLL_OUT_DSICLK, +@@ -82,7 +83,7 @@ static const struct clk_parent_data disp_cc_parent_data_1[] = { + }; + + static const struct parent_map disp_cc_parent_map_2[] = { +- { P_BI_TCXO, 0 }, ++ { P_BI_TCXO_AO, 0 }, + { P_GPLL0_OUT_MAIN, 4 }, + }; + +@@ -151,7 +152,7 @@ static struct clk_regmap_div disp_cc_mdss_byte0_div_clk_src = { + }; + + static const struct freq_tbl ftbl_disp_cc_mdss_ahb_clk_src[] = { +- F(19200000, P_BI_TCXO, 1, 0, 0), ++ F(19200000, P_BI_TCXO_AO, 1, 0, 0), + F(37500000, P_GPLL0_OUT_MAIN, 8, 0, 0), + F(75000000, P_GPLL0_OUT_MAIN, 4, 0, 0), + { } +-- +2.39.2 + diff --git a/queue-6.4/clk-qcom-dispcc-qcm2290-fix-gpll0_out_div-handling.patch b/queue-6.4/clk-qcom-dispcc-qcm2290-fix-gpll0_out_div-handling.patch new file mode 100644 index 00000000000..4a2181cc726 --- /dev/null +++ b/queue-6.4/clk-qcom-dispcc-qcm2290-fix-gpll0_out_div-handling.patch @@ -0,0 +1,60 @@ +From d3da7e12a5fba23b2fafcc85d28cfb4134300f59 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Apr 2023 13:06:36 +0200 +Subject: clk: qcom: dispcc-qcm2290: Fix GPLL0_OUT_DIV handling + +From: Konrad Dybcio + +[ Upstream commit 63d56adf04b5795e54440dc5b7afddecb2966863 ] + +GPLL0_OUT_DIV (.fw_name = "gcc_disp_gpll0_div_clk_src") was previously +made to reuse the same parent enum entry as GPLL0_OUT_MAIN +(.fw_name = "gcc_disp_gpll0_clk_src") in parent_map_2. + +Resolve it by introducing its own entry in the parent enum and +correctly assigning it in disp_cc_parent_map_2[]. + +Fixes: cc517ea3333f ("clk: qcom: Add display clock controller driver for QCM2290") +Signed-off-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230412-topic-qcm_dispcc-v2-2-bce7dd512fe4@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/dispcc-qcm2290.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/clk/qcom/dispcc-qcm2290.c b/drivers/clk/qcom/dispcc-qcm2290.c +index ee62aca4e5bb2..44dd5cfcc1504 100644 +--- a/drivers/clk/qcom/dispcc-qcm2290.c ++++ b/drivers/clk/qcom/dispcc-qcm2290.c +@@ -28,6 +28,7 @@ enum { + P_DISP_CC_PLL0_OUT_MAIN, + P_DSI0_PHY_PLL_OUT_BYTECLK, + P_DSI0_PHY_PLL_OUT_DSICLK, ++ P_GPLL0_OUT_DIV, + P_GPLL0_OUT_MAIN, + P_SLEEP_CLK, + }; +@@ -84,7 +85,7 @@ static const struct clk_parent_data disp_cc_parent_data_1[] = { + + static const struct parent_map disp_cc_parent_map_2[] = { + { P_BI_TCXO_AO, 0 }, +- { P_GPLL0_OUT_MAIN, 4 }, ++ { P_GPLL0_OUT_DIV, 4 }, + }; + + static const struct clk_parent_data disp_cc_parent_data_2[] = { +@@ -153,8 +154,8 @@ static struct clk_regmap_div disp_cc_mdss_byte0_div_clk_src = { + + static const struct freq_tbl ftbl_disp_cc_mdss_ahb_clk_src[] = { + F(19200000, P_BI_TCXO_AO, 1, 0, 0), +- F(37500000, P_GPLL0_OUT_MAIN, 8, 0, 0), +- F(75000000, P_GPLL0_OUT_MAIN, 4, 0, 0), ++ F(37500000, P_GPLL0_OUT_DIV, 8, 0, 0), ++ F(75000000, P_GPLL0_OUT_DIV, 4, 0, 0), + { } + }; + +-- +2.39.2 + diff --git a/queue-6.4/clk-qcom-gcc-ipq5332-use-floor-ops-for-sdcc-clocks.patch b/queue-6.4/clk-qcom-gcc-ipq5332-use-floor-ops-for-sdcc-clocks.patch new file mode 100644 index 00000000000..8bd81d5c6bf --- /dev/null +++ b/queue-6.4/clk-qcom-gcc-ipq5332-use-floor-ops-for-sdcc-clocks.patch @@ -0,0 +1,37 @@ +From e1bd9e16d1b77096287ef7b5c3c7289ca769f850 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 May 2023 22:01:45 +0530 +Subject: clk: qcom: gcc: ipq5332: Use floor ops for SDCC clocks + +From: Kathiravan T + +[ Upstream commit a30e62bf6bf4d3230fa9164c7e174e32b9be7ba5 ] + +SDCC clocks must be rounded down to avoid overclocking the controller. + +Fixes: 3d89d52970fd ("clk: qcom: add Global Clock controller (GCC) driver for IPQ5332 SoC") +Signed-off-by: Kathiravan T +Reviewed-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230508163145.9678-1-quic_kathirav@quicinc.com +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/gcc-ipq5332.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/qcom/gcc-ipq5332.c b/drivers/clk/qcom/gcc-ipq5332.c +index bdb4a0a11d07b..1ad23aa8aa5a9 100644 +--- a/drivers/clk/qcom/gcc-ipq5332.c ++++ b/drivers/clk/qcom/gcc-ipq5332.c +@@ -963,7 +963,7 @@ static struct clk_rcg2 gcc_sdcc1_apps_clk_src = { + .name = "gcc_sdcc1_apps_clk_src", + .parent_data = gcc_parent_data_9, + .num_parents = ARRAY_SIZE(gcc_parent_data_9), +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_floor_ops, + }, + }; + +-- +2.39.2 + diff --git a/queue-6.4/clk-qcom-gcc-ipq6018-use-floor-ops-for-sdcc-clocks.patch b/queue-6.4/clk-qcom-gcc-ipq6018-use-floor-ops-for-sdcc-clocks.patch new file mode 100644 index 00000000000..b29e327f644 --- /dev/null +++ b/queue-6.4/clk-qcom-gcc-ipq6018-use-floor-ops-for-sdcc-clocks.patch @@ -0,0 +1,37 @@ +From e396801677933a43388df7d1c0905bf5ab33b8c0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Apr 2023 12:11:49 +0300 +Subject: clk: qcom: gcc-ipq6018: Use floor ops for sdcc clocks + +From: Mantas Pucka + +[ Upstream commit 56e5ae0116aef87273cf1812d608645b076e4f02 ] + +SDCC clocks must be rounded down to avoid overclocking the controller. + +Fixes: d9db07f088af ("clk: qcom: Add ipq6018 Global Clock Controller support") +Signed-off-by: Mantas Pucka +Reviewed-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/1682413909-24927-1-git-send-email-mantas@8devices.com +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/gcc-ipq6018.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/qcom/gcc-ipq6018.c b/drivers/clk/qcom/gcc-ipq6018.c +index 3f9c2f61a5d93..5c5d1b04ea7af 100644 +--- a/drivers/clk/qcom/gcc-ipq6018.c ++++ b/drivers/clk/qcom/gcc-ipq6018.c +@@ -1654,7 +1654,7 @@ static struct clk_rcg2 sdcc1_apps_clk_src = { + .name = "sdcc1_apps_clk_src", + .parent_data = gcc_xo_gpll0_gpll2_gpll0_out_main_div2, + .num_parents = 4, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_floor_ops, + }, + }; + +-- +2.39.2 + diff --git a/queue-6.4/clk-qcom-gcc-qcm2290-mark-rcgs-shared-where-applicab.patch b/queue-6.4/clk-qcom-gcc-qcm2290-mark-rcgs-shared-where-applicab.patch new file mode 100644 index 00000000000..54312f2a4b7 --- /dev/null +++ b/queue-6.4/clk-qcom-gcc-qcm2290-mark-rcgs-shared-where-applicab.patch @@ -0,0 +1,307 @@ +From 6d04441be3cced83eaeeb7bd2f8c0d034560dae2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Apr 2023 19:48:07 +0200 +Subject: clk: qcom: gcc-qcm2290: Mark RCGs shared where applicable + +From: Konrad Dybcio + +[ Upstream commit 7bf654a0d95e75b415f454e10627309d650762d0 ] + +The vast majority of shared RCGs were not marked as such. Fix it. + +Fixes: 496d1a13d405 ("clk: qcom: Add Global Clock Controller driver for QCM2290") +Signed-off-by: Konrad Dybcio +Acked-by: Shawn Guo +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230403174807.345185-1-konrad.dybcio@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/gcc-qcm2290.c | 62 +++++++++++++++++----------------- + 1 file changed, 31 insertions(+), 31 deletions(-) + +diff --git a/drivers/clk/qcom/gcc-qcm2290.c b/drivers/clk/qcom/gcc-qcm2290.c +index 096deff2ba257..48995e50c6bd7 100644 +--- a/drivers/clk/qcom/gcc-qcm2290.c ++++ b/drivers/clk/qcom/gcc-qcm2290.c +@@ -650,7 +650,7 @@ static struct clk_rcg2 gcc_usb30_prim_mock_utmi_clk_src = { + .name = "gcc_usb30_prim_mock_utmi_clk_src", + .parent_data = gcc_parents_0, + .num_parents = ARRAY_SIZE(gcc_parents_0), +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -686,7 +686,7 @@ static struct clk_rcg2 gcc_camss_axi_clk_src = { + .name = "gcc_camss_axi_clk_src", + .parent_data = gcc_parents_4, + .num_parents = ARRAY_SIZE(gcc_parents_4), +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -706,7 +706,7 @@ static struct clk_rcg2 gcc_camss_cci_clk_src = { + .name = "gcc_camss_cci_clk_src", + .parent_data = gcc_parents_9, + .num_parents = ARRAY_SIZE(gcc_parents_9), +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -728,7 +728,7 @@ static struct clk_rcg2 gcc_camss_csi0phytimer_clk_src = { + .name = "gcc_camss_csi0phytimer_clk_src", + .parent_data = gcc_parents_5, + .num_parents = ARRAY_SIZE(gcc_parents_5), +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -742,7 +742,7 @@ static struct clk_rcg2 gcc_camss_csi1phytimer_clk_src = { + .name = "gcc_camss_csi1phytimer_clk_src", + .parent_data = gcc_parents_5, + .num_parents = ARRAY_SIZE(gcc_parents_5), +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -764,7 +764,7 @@ static struct clk_rcg2 gcc_camss_mclk0_clk_src = { + .parent_data = gcc_parents_3, + .num_parents = ARRAY_SIZE(gcc_parents_3), + .flags = CLK_OPS_PARENT_ENABLE, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -779,7 +779,7 @@ static struct clk_rcg2 gcc_camss_mclk1_clk_src = { + .parent_data = gcc_parents_3, + .num_parents = ARRAY_SIZE(gcc_parents_3), + .flags = CLK_OPS_PARENT_ENABLE, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -794,7 +794,7 @@ static struct clk_rcg2 gcc_camss_mclk2_clk_src = { + .parent_data = gcc_parents_3, + .num_parents = ARRAY_SIZE(gcc_parents_3), + .flags = CLK_OPS_PARENT_ENABLE, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -809,7 +809,7 @@ static struct clk_rcg2 gcc_camss_mclk3_clk_src = { + .parent_data = gcc_parents_3, + .num_parents = ARRAY_SIZE(gcc_parents_3), + .flags = CLK_OPS_PARENT_ENABLE, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -830,7 +830,7 @@ static struct clk_rcg2 gcc_camss_ope_ahb_clk_src = { + .name = "gcc_camss_ope_ahb_clk_src", + .parent_data = gcc_parents_6, + .num_parents = ARRAY_SIZE(gcc_parents_6), +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -854,7 +854,7 @@ static struct clk_rcg2 gcc_camss_ope_clk_src = { + .parent_data = gcc_parents_6, + .num_parents = ARRAY_SIZE(gcc_parents_6), + .flags = CLK_SET_RATE_PARENT, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -888,7 +888,7 @@ static struct clk_rcg2 gcc_camss_tfe_0_clk_src = { + .name = "gcc_camss_tfe_0_clk_src", + .parent_data = gcc_parents_7, + .num_parents = ARRAY_SIZE(gcc_parents_7), +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -912,7 +912,7 @@ static struct clk_rcg2 gcc_camss_tfe_0_csid_clk_src = { + .name = "gcc_camss_tfe_0_csid_clk_src", + .parent_data = gcc_parents_8, + .num_parents = ARRAY_SIZE(gcc_parents_8), +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -926,7 +926,7 @@ static struct clk_rcg2 gcc_camss_tfe_1_clk_src = { + .name = "gcc_camss_tfe_1_clk_src", + .parent_data = gcc_parents_7, + .num_parents = ARRAY_SIZE(gcc_parents_7), +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -940,7 +940,7 @@ static struct clk_rcg2 gcc_camss_tfe_1_csid_clk_src = { + .name = "gcc_camss_tfe_1_csid_clk_src", + .parent_data = gcc_parents_8, + .num_parents = ARRAY_SIZE(gcc_parents_8), +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -963,7 +963,7 @@ static struct clk_rcg2 gcc_camss_tfe_cphy_rx_clk_src = { + .parent_data = gcc_parents_10, + .num_parents = ARRAY_SIZE(gcc_parents_10), + .flags = CLK_OPS_PARENT_ENABLE, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -984,7 +984,7 @@ static struct clk_rcg2 gcc_camss_top_ahb_clk_src = { + .name = "gcc_camss_top_ahb_clk_src", + .parent_data = gcc_parents_4, + .num_parents = ARRAY_SIZE(gcc_parents_4), +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -1006,7 +1006,7 @@ static struct clk_rcg2 gcc_gp1_clk_src = { + .name = "gcc_gp1_clk_src", + .parent_data = gcc_parents_2, + .num_parents = ARRAY_SIZE(gcc_parents_2), +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -1020,7 +1020,7 @@ static struct clk_rcg2 gcc_gp2_clk_src = { + .name = "gcc_gp2_clk_src", + .parent_data = gcc_parents_2, + .num_parents = ARRAY_SIZE(gcc_parents_2), +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -1034,7 +1034,7 @@ static struct clk_rcg2 gcc_gp3_clk_src = { + .name = "gcc_gp3_clk_src", + .parent_data = gcc_parents_2, + .num_parents = ARRAY_SIZE(gcc_parents_2), +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -1054,7 +1054,7 @@ static struct clk_rcg2 gcc_pdm2_clk_src = { + .name = "gcc_pdm2_clk_src", + .parent_data = gcc_parents_0, + .num_parents = ARRAY_SIZE(gcc_parents_0), +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -1082,7 +1082,7 @@ static struct clk_init_data gcc_qupv3_wrap0_s0_clk_src_init = { + .name = "gcc_qupv3_wrap0_s0_clk_src", + .parent_data = gcc_parents_1, + .num_parents = ARRAY_SIZE(gcc_parents_1), +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }; + + static struct clk_rcg2 gcc_qupv3_wrap0_s0_clk_src = { +@@ -1098,7 +1098,7 @@ static struct clk_init_data gcc_qupv3_wrap0_s1_clk_src_init = { + .name = "gcc_qupv3_wrap0_s1_clk_src", + .parent_data = gcc_parents_1, + .num_parents = ARRAY_SIZE(gcc_parents_1), +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }; + + static struct clk_rcg2 gcc_qupv3_wrap0_s1_clk_src = { +@@ -1114,7 +1114,7 @@ static struct clk_init_data gcc_qupv3_wrap0_s2_clk_src_init = { + .name = "gcc_qupv3_wrap0_s2_clk_src", + .parent_data = gcc_parents_1, + .num_parents = ARRAY_SIZE(gcc_parents_1), +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }; + + static struct clk_rcg2 gcc_qupv3_wrap0_s2_clk_src = { +@@ -1130,7 +1130,7 @@ static struct clk_init_data gcc_qupv3_wrap0_s3_clk_src_init = { + .name = "gcc_qupv3_wrap0_s3_clk_src", + .parent_data = gcc_parents_1, + .num_parents = ARRAY_SIZE(gcc_parents_1), +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }; + + static struct clk_rcg2 gcc_qupv3_wrap0_s3_clk_src = { +@@ -1146,7 +1146,7 @@ static struct clk_init_data gcc_qupv3_wrap0_s4_clk_src_init = { + .name = "gcc_qupv3_wrap0_s4_clk_src", + .parent_data = gcc_parents_1, + .num_parents = ARRAY_SIZE(gcc_parents_1), +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }; + + static struct clk_rcg2 gcc_qupv3_wrap0_s4_clk_src = { +@@ -1162,7 +1162,7 @@ static struct clk_init_data gcc_qupv3_wrap0_s5_clk_src_init = { + .name = "gcc_qupv3_wrap0_s5_clk_src", + .parent_data = gcc_parents_1, + .num_parents = ARRAY_SIZE(gcc_parents_1), +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }; + + static struct clk_rcg2 gcc_qupv3_wrap0_s5_clk_src = { +@@ -1219,7 +1219,7 @@ static struct clk_rcg2 gcc_sdcc1_ice_core_clk_src = { + .name = "gcc_sdcc1_ice_core_clk_src", + .parent_data = gcc_parents_0, + .num_parents = ARRAY_SIZE(gcc_parents_0), +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -1266,7 +1266,7 @@ static struct clk_rcg2 gcc_usb30_prim_master_clk_src = { + .name = "gcc_usb30_prim_master_clk_src", + .parent_data = gcc_parents_0, + .num_parents = ARRAY_SIZE(gcc_parents_0), +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -1280,7 +1280,7 @@ static struct clk_rcg2 gcc_usb3_prim_phy_aux_clk_src = { + .name = "gcc_usb3_prim_phy_aux_clk_src", + .parent_data = gcc_parents_13, + .num_parents = ARRAY_SIZE(gcc_parents_13), +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -1303,7 +1303,7 @@ static struct clk_rcg2 gcc_video_venus_clk_src = { + .parent_data = gcc_parents_14, + .num_parents = ARRAY_SIZE(gcc_parents_14), + .flags = CLK_SET_RATE_PARENT, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +-- +2.39.2 + diff --git a/queue-6.4/clk-qcom-ipq5332-fix-the-order-of-sleep_clk-and-xo-c.patch b/queue-6.4/clk-qcom-ipq5332-fix-the-order-of-sleep_clk-and-xo-c.patch new file mode 100644 index 00000000000..7e6634fb868 --- /dev/null +++ b/queue-6.4/clk-qcom-ipq5332-fix-the-order-of-sleep_clk-and-xo-c.patch @@ -0,0 +1,41 @@ +From 7149aacb55d4f5aacdf88e3ebfcebb75bebc04b7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Apr 2023 16:26:07 +0530 +Subject: clk: qcom: ipq5332: fix the order of SLEEP_CLK and XO clock + +From: Kathiravan T + +[ Upstream commit 7510e80f4ac707efc7e964120525ef759a02f171 ] + +The order of DT_SLEEP_CLK and DT_XO are swapped and it is incorrect. +Due to which the clocks for which the parent should be XO is having parent +as SLEEP_CLK and vice versa. So fix the same by re-ordering the entries. + +Fixes: 3d89d52970fd ("clk: qcom: add Global Clock controller (GCC) driver for IPQ5332 SoC") +Reported-by: Devi Priya +Signed-off-by: Kathiravan T +Reviewed-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230417105607.4091-1-quic_kathirav@quicinc.com +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/gcc-ipq5332.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/qcom/gcc-ipq5332.c b/drivers/clk/qcom/gcc-ipq5332.c +index b9ab67649130a..a75ab88ed14c6 100644 +--- a/drivers/clk/qcom/gcc-ipq5332.c ++++ b/drivers/clk/qcom/gcc-ipq5332.c +@@ -20,8 +20,8 @@ + #include "reset.h" + + enum { +- DT_SLEEP_CLK, + DT_XO, ++ DT_SLEEP_CLK, + DT_PCIE_2LANE_PHY_PIPE_CLK, + DT_PCIE_2LANE_PHY_PIPE_CLK_X1, + DT_USB_PCIE_WRAPPER_PIPE_CLK, +-- +2.39.2 + diff --git a/queue-6.4/clk-qcom-ipq5332-fix-the-src-parameter-in-ftbl_gcc_a.patch b/queue-6.4/clk-qcom-ipq5332-fix-the-src-parameter-in-ftbl_gcc_a.patch new file mode 100644 index 00000000000..5ea9d821b61 --- /dev/null +++ b/queue-6.4/clk-qcom-ipq5332-fix-the-src-parameter-in-ftbl_gcc_a.patch @@ -0,0 +1,39 @@ +From 3df8a9b59cf81af34a3b231c95e5862d8c5bc1ad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Apr 2023 10:13:42 +0530 +Subject: clk: qcom: ipq5332: fix the src parameter in + ftbl_gcc_apss_axi_clk_src + +From: Kathiravan T + +[ Upstream commit 81c1ef89a45eccd5603f1e27e281d14fefcb81f9 ] + +480MHz is derived from P_GPLL4_OUT_AUX not from P_GPLL4_OUT_MAIN. Update +the freq_tbl with the correct src. + +Fixes: 3d89d52970fd ("clk: qcom: add Global Clock controller (GCC) driver for IPQ5332 SoC") +Reported-by: Manikanta Mylavarapu +Signed-off-by: Kathiravan T +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230417044342.9406-1-quic_kathirav@quicinc.com +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/gcc-ipq5332.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/qcom/gcc-ipq5332.c b/drivers/clk/qcom/gcc-ipq5332.c +index 1ad23aa8aa5a9..b9ab67649130a 100644 +--- a/drivers/clk/qcom/gcc-ipq5332.c ++++ b/drivers/clk/qcom/gcc-ipq5332.c +@@ -366,7 +366,7 @@ static struct clk_rcg2 gcc_adss_pwm_clk_src = { + }; + + static const struct freq_tbl ftbl_gcc_apss_axi_clk_src[] = { +- F(480000000, P_GPLL4_OUT_MAIN, 2.5, 0, 0), ++ F(480000000, P_GPLL4_OUT_AUX, 2.5, 0, 0), + F(533333333, P_GPLL0_OUT_MAIN, 1.5, 0, 0), + { } + }; +-- +2.39.2 + diff --git a/queue-6.4/clk-qcom-ipq6018-fix-networking-resets.patch b/queue-6.4/clk-qcom-ipq6018-fix-networking-resets.patch new file mode 100644 index 00000000000..7309e537c77 --- /dev/null +++ b/queue-6.4/clk-qcom-ipq6018-fix-networking-resets.patch @@ -0,0 +1,72 @@ +From 2e0aeb2273a7110a841c25fc64bbdbdebc02f834 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 May 2023 21:08:55 +0200 +Subject: clk: qcom: ipq6018: fix networking resets + +From: Robert Marko + +[ Upstream commit 349b5bed539b491b7894a5186a895751fd8ba6c7 ] + +Networking resets in IPQ6018 all use bitmask as they require multiple +bits to be set and cleared instead of a single bit. + +So, current networking resets have the same register and bit 0 set which +is clearly incorrect. + +Fixes: d9db07f088af ("clk: qcom: Add ipq6018 Global Clock Controller support") +Signed-off-by: Robert Marko +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230526190855.2941291-2-robimarko@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/gcc-ipq6018.c | 32 ++++++++++++++++---------------- + 1 file changed, 16 insertions(+), 16 deletions(-) + +diff --git a/drivers/clk/qcom/gcc-ipq6018.c b/drivers/clk/qcom/gcc-ipq6018.c +index 5c5d1b04ea7af..cde62a11f5736 100644 +--- a/drivers/clk/qcom/gcc-ipq6018.c ++++ b/drivers/clk/qcom/gcc-ipq6018.c +@@ -4517,24 +4517,24 @@ static const struct qcom_reset_map gcc_ipq6018_resets[] = { + [GCC_PCIE0_AHB_ARES] = { 0x75040, 5 }, + [GCC_PCIE0_AXI_MASTER_STICKY_ARES] = { 0x75040, 6 }, + [GCC_PCIE0_AXI_SLAVE_STICKY_ARES] = { 0x75040, 7 }, +- [GCC_PPE_FULL_RESET] = { 0x68014, 0 }, +- [GCC_UNIPHY0_SOFT_RESET] = { 0x56004, 0 }, ++ [GCC_PPE_FULL_RESET] = { .reg = 0x68014, .bitmask = 0xf0000 }, ++ [GCC_UNIPHY0_SOFT_RESET] = { .reg = 0x56004, .bitmask = 0x3ff2 }, + [GCC_UNIPHY0_XPCS_RESET] = { 0x56004, 2 }, +- [GCC_UNIPHY1_SOFT_RESET] = { 0x56104, 0 }, ++ [GCC_UNIPHY1_SOFT_RESET] = { .reg = 0x56104, .bitmask = 0x32 }, + [GCC_UNIPHY1_XPCS_RESET] = { 0x56104, 2 }, +- [GCC_EDMA_HW_RESET] = { 0x68014, 0 }, +- [GCC_NSSPORT1_RESET] = { 0x68014, 0 }, +- [GCC_NSSPORT2_RESET] = { 0x68014, 0 }, +- [GCC_NSSPORT3_RESET] = { 0x68014, 0 }, +- [GCC_NSSPORT4_RESET] = { 0x68014, 0 }, +- [GCC_NSSPORT5_RESET] = { 0x68014, 0 }, +- [GCC_UNIPHY0_PORT1_ARES] = { 0x56004, 0 }, +- [GCC_UNIPHY0_PORT2_ARES] = { 0x56004, 0 }, +- [GCC_UNIPHY0_PORT3_ARES] = { 0x56004, 0 }, +- [GCC_UNIPHY0_PORT4_ARES] = { 0x56004, 0 }, +- [GCC_UNIPHY0_PORT5_ARES] = { 0x56004, 0 }, +- [GCC_UNIPHY0_PORT_4_5_RESET] = { 0x56004, 0 }, +- [GCC_UNIPHY0_PORT_4_RESET] = { 0x56004, 0 }, ++ [GCC_EDMA_HW_RESET] = { .reg = 0x68014, .bitmask = 0x300000 }, ++ [GCC_NSSPORT1_RESET] = { .reg = 0x68014, .bitmask = 0x1000003 }, ++ [GCC_NSSPORT2_RESET] = { .reg = 0x68014, .bitmask = 0x200000c }, ++ [GCC_NSSPORT3_RESET] = { .reg = 0x68014, .bitmask = 0x4000030 }, ++ [GCC_NSSPORT4_RESET] = { .reg = 0x68014, .bitmask = 0x8000300 }, ++ [GCC_NSSPORT5_RESET] = { .reg = 0x68014, .bitmask = 0x10000c00 }, ++ [GCC_UNIPHY0_PORT1_ARES] = { .reg = 0x56004, .bitmask = 0x30 }, ++ [GCC_UNIPHY0_PORT2_ARES] = { .reg = 0x56004, .bitmask = 0xc0 }, ++ [GCC_UNIPHY0_PORT3_ARES] = { .reg = 0x56004, .bitmask = 0x300 }, ++ [GCC_UNIPHY0_PORT4_ARES] = { .reg = 0x56004, .bitmask = 0xc00 }, ++ [GCC_UNIPHY0_PORT5_ARES] = { .reg = 0x56004, .bitmask = 0x3000 }, ++ [GCC_UNIPHY0_PORT_4_5_RESET] = { .reg = 0x56004, .bitmask = 0x3c02 }, ++ [GCC_UNIPHY0_PORT_4_RESET] = { .reg = 0x56004, .bitmask = 0xc02 }, + [GCC_LPASS_BCR] = {0x1F000, 0}, + [GCC_UBI32_TBU_BCR] = {0x65000, 0}, + [GCC_LPASS_TBU_BCR] = {0x6C000, 0}, +-- +2.39.2 + diff --git a/queue-6.4/clk-qcom-mmcc-msm8974-fix-mdss_gdsc-power-flags.patch b/queue-6.4/clk-qcom-mmcc-msm8974-fix-mdss_gdsc-power-flags.patch new file mode 100644 index 00000000000..9f6bc00845f --- /dev/null +++ b/queue-6.4/clk-qcom-mmcc-msm8974-fix-mdss_gdsc-power-flags.patch @@ -0,0 +1,40 @@ +From ddebbf4ed9c933e34fbc46f4bb75aaec0967beea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 7 May 2023 20:53:35 +0300 +Subject: clk: qcom: mmcc-msm8974: fix MDSS_GDSC power flags + +From: Dmitry Baryshkov + +[ Upstream commit 4e13c7a55cf752887f2b8d8008711dbbc64ea796 ] + +Using PWRSTS_RET on msm8974's MDSS_GDSC causes display to stop working. +The gdsc doesn't fully come out of retention mode. Change it's pwrsts +flags to PWRSTS_OFF_ON. + +Fixes: d399723950c4 ("clk: qcom: gdsc: Fix the handling of PWRSTS_RET support") +Signed-off-by: Dmitry Baryshkov +Reviewed-by: Rajendra Nayak +Tested-by: Luca Weiss +Link: https://lore.kernel.org/r/20230507175335.2321503-2-dmitry.baryshkov@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/mmcc-msm8974.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/qcom/mmcc-msm8974.c b/drivers/clk/qcom/mmcc-msm8974.c +index d2fec5d5b22e2..82f6bad144a9a 100644 +--- a/drivers/clk/qcom/mmcc-msm8974.c ++++ b/drivers/clk/qcom/mmcc-msm8974.c +@@ -2384,7 +2384,7 @@ static struct gdsc mdss_gdsc = { + .pd = { + .name = "mdss", + }, +- .pwrsts = PWRSTS_RET_ON, ++ .pwrsts = PWRSTS_OFF_ON, + }; + + static struct gdsc camss_jpeg_gdsc = { +-- +2.39.2 + diff --git a/queue-6.4/clk-qcom-mmcc-msm8974-remove-oxili_ocmemgx_clk.patch b/queue-6.4/clk-qcom-mmcc-msm8974-remove-oxili_ocmemgx_clk.patch new file mode 100644 index 00000000000..49e858571d7 --- /dev/null +++ b/queue-6.4/clk-qcom-mmcc-msm8974-remove-oxili_ocmemgx_clk.patch @@ -0,0 +1,73 @@ +From b9af0edd02eab9de111ea055c61fda51436efa45 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 May 2023 18:33:19 +0300 +Subject: clk: qcom: mmcc-msm8974: remove oxili_ocmemgx_clk + +From: Dmitry Baryshkov + +[ Upstream commit 853c064b57491d739bfd0cc35ff75c5ea9c5e8f5 ] + +After the internal discussions, it looks like this clock is managed by +RPM itself. Linux kernel should not touch it on its own, as this causes +disagreement with RPM. Shutting down this clock causes the OCMEM<->GPU +interface to stop working, resulting in GPU hangchecks/timeouts. + +Fixes: d8b212014e69 ("clk: qcom: Add support for MSM8974's multimedia clock controller (MMCC)") +Suggested-by: Konrad Dybcio +Signed-off-by: Dmitry Baryshkov +Tested-by: Luca Weiss +Reviewed-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230508153319.2371645-1-dmitry.baryshkov@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/mmcc-msm8974.c | 19 ------------------- + 1 file changed, 19 deletions(-) + +diff --git a/drivers/clk/qcom/mmcc-msm8974.c b/drivers/clk/qcom/mmcc-msm8974.c +index 4273fce9a4a4c..b90a9f362f5f7 100644 +--- a/drivers/clk/qcom/mmcc-msm8974.c ++++ b/drivers/clk/qcom/mmcc-msm8974.c +@@ -2204,23 +2204,6 @@ static struct clk_branch ocmemcx_ocmemnoc_clk = { + }, + }; + +-static struct clk_branch oxili_ocmemgx_clk = { +- .halt_reg = 0x402c, +- .clkr = { +- .enable_reg = 0x402c, +- .enable_mask = BIT(0), +- .hw.init = &(struct clk_init_data){ +- .name = "oxili_ocmemgx_clk", +- .parent_data = (const struct clk_parent_data[]){ +- { .fw_name = "gfx3d_clk_src", .name = "gfx3d_clk_src" }, +- }, +- .num_parents = 1, +- .flags = CLK_SET_RATE_PARENT, +- .ops = &clk_branch2_ops, +- }, +- }, +-}; +- + static struct clk_branch ocmemnoc_clk = { + .halt_reg = 0x50b4, + .clkr = { +@@ -2512,7 +2495,6 @@ static struct clk_regmap *mmcc_msm8226_clocks[] = { + [MMSS_MMSSNOC_AXI_CLK] = &mmss_mmssnoc_axi_clk.clkr, + [MMSS_S0_AXI_CLK] = &mmss_s0_axi_clk.clkr, + [OCMEMCX_AHB_CLK] = &ocmemcx_ahb_clk.clkr, +- [OXILI_OCMEMGX_CLK] = &oxili_ocmemgx_clk.clkr, + [OXILI_GFX3D_CLK] = &oxili_gfx3d_clk.clkr, + [OXILICX_AHB_CLK] = &oxilicx_ahb_clk.clkr, + [OXILICX_AXI_CLK] = &oxilicx_axi_clk.clkr, +@@ -2670,7 +2652,6 @@ static struct clk_regmap *mmcc_msm8974_clocks[] = { + [MMSS_S0_AXI_CLK] = &mmss_s0_axi_clk.clkr, + [OCMEMCX_AHB_CLK] = &ocmemcx_ahb_clk.clkr, + [OCMEMCX_OCMEMNOC_CLK] = &ocmemcx_ocmemnoc_clk.clkr, +- [OXILI_OCMEMGX_CLK] = &oxili_ocmemgx_clk.clkr, + [OCMEMNOC_CLK] = &ocmemnoc_clk.clkr, + [OXILI_GFX3D_CLK] = &oxili_gfx3d_clk.clkr, + [OXILICX_AHB_CLK] = &oxilicx_ahb_clk.clkr, +-- +2.39.2 + diff --git a/queue-6.4/clk-qcom-mmcc-msm8974-use-clk_rcg2_shared_ops-for-md.patch b/queue-6.4/clk-qcom-mmcc-msm8974-use-clk_rcg2_shared_ops-for-md.patch new file mode 100644 index 00000000000..ff33b722204 --- /dev/null +++ b/queue-6.4/clk-qcom-mmcc-msm8974-use-clk_rcg2_shared_ops-for-md.patch @@ -0,0 +1,41 @@ +From 7209e550c85ab9c68eb788e8352583a2e9d9061f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 7 May 2023 20:53:34 +0300 +Subject: clk: qcom: mmcc-msm8974: use clk_rcg2_shared_ops for mdp_clk_src + clock + +From: Dmitry Baryshkov + +[ Upstream commit 8fd492e77ff71f68f7311c22f7bc960182465cd7 ] + +The mdp_clk_src clock should not be turned off. Instead it should be +'parked' to the XO, as most of other mdp_clk_src clocks. Fix that by +using the clk_rcg2_shared_ops. + +Fixes: d8b212014e69 ("clk: qcom: Add support for MSM8974's multimedia clock controller (MMCC)") +Signed-off-by: Dmitry Baryshkov +Tested-by: Luca Weiss +Acked-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230507175335.2321503-1-dmitry.baryshkov@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/mmcc-msm8974.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/qcom/mmcc-msm8974.c b/drivers/clk/qcom/mmcc-msm8974.c +index b90a9f362f5f7..d2fec5d5b22e2 100644 +--- a/drivers/clk/qcom/mmcc-msm8974.c ++++ b/drivers/clk/qcom/mmcc-msm8974.c +@@ -485,7 +485,7 @@ static struct clk_rcg2 mdp_clk_src = { + .name = "mdp_clk_src", + .parent_data = mmcc_xo_mmpll0_dsi_hdmi_gpll0, + .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_dsi_hdmi_gpll0), +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +-- +2.39.2 + diff --git a/queue-6.4/coresight-etm4x-fix-missing-trctraceidr-file-in-sysf.patch b/queue-6.4/coresight-etm4x-fix-missing-trctraceidr-file-in-sysf.patch new file mode 100644 index 00000000000..e4e3ac7e3e2 --- /dev/null +++ b/queue-6.4/coresight-etm4x-fix-missing-trctraceidr-file-in-sysf.patch @@ -0,0 +1,84 @@ +From f3c9f47641e1bbb2b33135846621efbda861f2a0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 May 2023 14:30:54 +0100 +Subject: coresight: etm4x: Fix missing trctraceidr file in sysfs + +From: Mike Leach + +[ Upstream commit 9f37d3798026f9a7447d851a2cb356610852e426 ] + +The trace ID patchset adjusted the handling of the TRCTRACEIDR register +sysfs to allocate on read. + +Although this was initally correct, the final version of the patch series +introduced an error which resulted in the mgmt/trctraceidr file in sysfs +not being visible. + +This patch fixes that issue. + +Fixes: df4871204e5d ("coresight: etm4x: Update ETM4 driver to use Trace ID API") +Reported-by: Junhao He +Link: https://lists.linaro.org/archives/list/coresight@lists.linaro.org/thread/KK3CVVMRHJWVUORKMFJRSXYCEDFKENQJ/ +Signed-off-by: Mike Leach +Signed-off-by: Suzuki K Poulose +Link: https://lore.kernel.org/r/20230512133054.235073-1-mike.leach@linaro.org +Signed-off-by: Sasha Levin +--- + .../coresight/coresight-etm4x-sysfs.c | 27 ++++++++++++------- + 1 file changed, 18 insertions(+), 9 deletions(-) + +diff --git a/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c b/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c +index 5e62aa40ecd0f..a9f19629f3f84 100644 +--- a/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c ++++ b/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c +@@ -2411,7 +2411,6 @@ static ssize_t trctraceid_show(struct device *dev, + + return sysfs_emit(buf, "0x%x\n", trace_id); + } +-static DEVICE_ATTR_RO(trctraceid); + + struct etmv4_reg { + struct coresight_device *csdev; +@@ -2528,13 +2527,23 @@ coresight_etm4x_attr_reg_implemented(struct kobject *kobj, + return 0; + } + +-#define coresight_etm4x_reg(name, offset) \ +- &((struct dev_ext_attribute[]) { \ +- { \ +- __ATTR(name, 0444, coresight_etm4x_reg_show, NULL), \ +- (void *)(unsigned long)offset \ +- } \ +- })[0].attr.attr ++/* ++ * Macro to set an RO ext attribute with offset and show function. ++ * Offset is used in mgmt group to ensure only correct registers for ++ * the ETM / ETE variant are visible. ++ */ ++#define coresight_etm4x_reg_showfn(name, offset, showfn) ( \ ++ &((struct dev_ext_attribute[]) { \ ++ { \ ++ __ATTR(name, 0444, showfn, NULL), \ ++ (void *)(unsigned long)offset \ ++ } \ ++ })[0].attr.attr \ ++ ) ++ ++/* macro using the default coresight_etm4x_reg_show function */ ++#define coresight_etm4x_reg(name, offset) \ ++ coresight_etm4x_reg_showfn(name, offset, coresight_etm4x_reg_show) + + static struct attribute *coresight_etmv4_mgmt_attrs[] = { + coresight_etm4x_reg(trcpdcr, TRCPDCR), +@@ -2549,7 +2558,7 @@ static struct attribute *coresight_etmv4_mgmt_attrs[] = { + coresight_etm4x_reg(trcpidr3, TRCPIDR3), + coresight_etm4x_reg(trcoslsr, TRCOSLSR), + coresight_etm4x_reg(trcconfig, TRCCONFIGR), +- &dev_attr_trctraceid.attr, ++ coresight_etm4x_reg_showfn(trctraceid, TRCTRACEIDR, trctraceid_show), + coresight_etm4x_reg(trcdevarch, TRCDEVARCH), + NULL, + }; +-- +2.39.2 + diff --git a/queue-6.4/coresight-fix-loss-of-connection-info-when-a-module-.patch b/queue-6.4/coresight-fix-loss-of-connection-info-when-a-module-.patch new file mode 100644 index 00000000000..56ed4b05707 --- /dev/null +++ b/queue-6.4/coresight-fix-loss-of-connection-info-when-a-module-.patch @@ -0,0 +1,69 @@ +From f7f6ea80f542f86c446195edb953ca9c31a3ed9e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Apr 2023 15:35:28 +0100 +Subject: coresight: Fix loss of connection info when a module is unloaded + +From: James Clark + +[ Upstream commit c45b2835e7b205783bdfe08cc98fa86a7c5eeb74 ] + +child_fwnode should be a read only property based on the DT or ACPI. If +it's cleared on the parent device when a child is unloaded, then when +the child is loaded again the connection won't be remade. + +child_dev should be cleared instead which signifies that the connection +should be remade when the child_fwnode registers a new coresight_device. + +Similarly the reference count shouldn't be decremented as long as the +parent device exists. The correct place to drop the reference is in +coresight_release_platform_data() which is already done. + +Reproducible on Juno with the following steps: + + # load all coresight modules. + $ cd /sys/bus/coresight/devices/ + $ echo 1 > tmc_etr0/enable_sink + $ echo 1 > etm0/enable_source + # Works fine ^ + + $ echo 0 > etm0/enable_source + $ rmmod coresight-funnel + $ modprobe coresight-funnel + $ echo 1 > etm0/enable_source + -bash: echo: write error: Invalid argument + +Fixes: 37ea1ffddffa ("coresight: Use fwnode handle instead of device names") +Fixes: 2af89ebacf29 ("coresight: Clear the connection field properly") +Tested-by: Suzuki K Poulose +Reviewed-by: Mike Leach +Signed-off-by: James Clark +Signed-off-by: Suzuki K Poulose +Link: https://lore.kernel.org/r/20230425143542.2305069-2-james.clark@arm.com +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/coresight/coresight-core.c | 9 ++------- + 1 file changed, 2 insertions(+), 7 deletions(-) + +diff --git a/drivers/hwtracing/coresight/coresight-core.c b/drivers/hwtracing/coresight/coresight-core.c +index d3bf82c0de1d8..5733294ce5cd2 100644 +--- a/drivers/hwtracing/coresight/coresight-core.c ++++ b/drivers/hwtracing/coresight/coresight-core.c +@@ -1419,13 +1419,8 @@ static int coresight_remove_match(struct device *dev, void *data) + if (csdev->dev.fwnode == conn->child_fwnode) { + iterator->orphan = true; + coresight_remove_links(iterator, conn); +- /* +- * Drop the reference to the handle for the remote +- * device acquired in parsing the connections from +- * platform data. +- */ +- fwnode_handle_put(conn->child_fwnode); +- conn->child_fwnode = NULL; ++ ++ conn->child_dev = NULL; + /* No need to continue */ + break; + } +-- +2.39.2 + diff --git a/queue-6.4/cpufreq-mediatek-correct-voltages-for-mt7622-and-mt7.patch b/queue-6.4/cpufreq-mediatek-correct-voltages-for-mt7622-and-mt7.patch new file mode 100644 index 00000000000..f839df62892 --- /dev/null +++ b/queue-6.4/cpufreq-mediatek-correct-voltages-for-mt7622-and-mt7.patch @@ -0,0 +1,65 @@ +From d59a194336b295fae2e3afc1547791ca8de1bd1b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Jun 2023 15:18:12 +0100 +Subject: cpufreq: mediatek: correct voltages for MT7622 and MT7623 + +From: Daniel Golle + +[ Upstream commit f85534113f5ae90a52521cdb9e9977a43ee42626 ] + +The MT6380 regulator typically used together with MT7622 does not +support the current maximum processor and SRAM voltage in the cpufreq +driver (1360000uV). +For MT7622 limit processor and SRAM supply voltages to 1350000uV to +avoid having the tracking algorithm request unsupported voltages from +the regulator. + +On MT7623 there is no separate SRAM supply and the maximum voltage used +is 1300000uV. Create dedicated platform data for MT7623 to cover that +case as well. + +Fixes: 0883426fd07e3 ("cpufreq: mediatek: Raise proc and sram max voltage for MT7622/7623") +Suggested-by: Jia-wei Chang +Signed-off-by: Daniel Golle +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/mediatek-cpufreq.c | 13 ++++++++++--- + 1 file changed, 10 insertions(+), 3 deletions(-) + +diff --git a/drivers/cpufreq/mediatek-cpufreq.c b/drivers/cpufreq/mediatek-cpufreq.c +index 9a39a7ccfae96..fef68cb2b38f7 100644 +--- a/drivers/cpufreq/mediatek-cpufreq.c ++++ b/drivers/cpufreq/mediatek-cpufreq.c +@@ -696,9 +696,16 @@ static const struct mtk_cpufreq_platform_data mt2701_platform_data = { + static const struct mtk_cpufreq_platform_data mt7622_platform_data = { + .min_volt_shift = 100000, + .max_volt_shift = 200000, +- .proc_max_volt = 1360000, ++ .proc_max_volt = 1350000, + .sram_min_volt = 0, +- .sram_max_volt = 1360000, ++ .sram_max_volt = 1350000, ++ .ccifreq_supported = false, ++}; ++ ++static const struct mtk_cpufreq_platform_data mt7623_platform_data = { ++ .min_volt_shift = 100000, ++ .max_volt_shift = 200000, ++ .proc_max_volt = 1300000, + .ccifreq_supported = false, + }; + +@@ -734,7 +741,7 @@ static const struct of_device_id mtk_cpufreq_machines[] __initconst = { + { .compatible = "mediatek,mt2701", .data = &mt2701_platform_data }, + { .compatible = "mediatek,mt2712", .data = &mt2701_platform_data }, + { .compatible = "mediatek,mt7622", .data = &mt7622_platform_data }, +- { .compatible = "mediatek,mt7623", .data = &mt7622_platform_data }, ++ { .compatible = "mediatek,mt7623", .data = &mt7623_platform_data }, + { .compatible = "mediatek,mt8167", .data = &mt8516_platform_data }, + { .compatible = "mediatek,mt817x", .data = &mt2701_platform_data }, + { .compatible = "mediatek,mt8173", .data = &mt2701_platform_data }, +-- +2.39.2 + diff --git a/queue-6.4/cpufreq-tegra194-fix-an-error-handling-path-in-tegra.patch b/queue-6.4/cpufreq-tegra194-fix-an-error-handling-path-in-tegra.patch new file mode 100644 index 00000000000..a16a20ac0e9 --- /dev/null +++ b/queue-6.4/cpufreq-tegra194-fix-an-error-handling-path-in-tegra.patch @@ -0,0 +1,44 @@ +From 6dbf5e7fd03d75a919c11283dda2eab1135dd626 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Apr 2023 15:11:19 +0200 +Subject: cpufreq: tegra194: Fix an error handling path in + tegra194_cpufreq_probe() + +From: Christophe JAILLET + +[ Upstream commit 9ab24b0486681ecc059ee766e00d9570c6311e08 ] + +If the probe needs to be deferred, some resources still need to be +released. So branch to the error handling path instead of returning +directly. + +Fixes: f41e1442ac5b ("cpufreq: tegra194: add OPP support and set bandwidth") +Signed-off-by: Christophe JAILLET +Reviewed-by: Sumit Gupta +Acked-by: Thierry Reding +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/tegra194-cpufreq.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/cpufreq/tegra194-cpufreq.c b/drivers/cpufreq/tegra194-cpufreq.c +index c8d03346068ab..36dad5ea59475 100644 +--- a/drivers/cpufreq/tegra194-cpufreq.c ++++ b/drivers/cpufreq/tegra194-cpufreq.c +@@ -686,8 +686,10 @@ static int tegra194_cpufreq_probe(struct platform_device *pdev) + + /* Check for optional OPPv2 and interconnect paths on CPU0 to enable ICC scaling */ + cpu_dev = get_cpu_device(0); +- if (!cpu_dev) +- return -EPROBE_DEFER; ++ if (!cpu_dev) { ++ err = -EPROBE_DEFER; ++ goto err_free_res; ++ } + + if (dev_pm_opp_of_get_opp_desc_node(cpu_dev)) { + err = dev_pm_opp_of_find_icc_paths(cpu_dev, NULL); +-- +2.39.2 + diff --git a/queue-6.4/drivers-fwnode-fix-fwnode_irq_get-_byname.patch b/queue-6.4/drivers-fwnode-fix-fwnode_irq_get-_byname.patch new file mode 100644 index 00000000000..e26613417bf --- /dev/null +++ b/queue-6.4/drivers-fwnode-fix-fwnode_irq_get-_byname.patch @@ -0,0 +1,75 @@ +From d972f07d6a0689c8dfb2dc9b7da1c17d968d80c2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 May 2023 09:22:33 +0300 +Subject: drivers: fwnode: fix fwnode_irq_get[_byname]() + +From: Matti Vaittinen + +[ Upstream commit 39d422555e43379516d4d13f5b7162a3dee6e646 ] + +The fwnode_irq_get() and the fwnode_irq_get_byname() return 0 upon +device-tree IRQ mapping failure. This is contradicting the +fwnode_irq_get_byname() function documentation and can potentially be a +source of errors like: + +int probe(...) { + ... + + irq = fwnode_irq_get_byname(); + if (irq <= 0) + return irq; + + ... +} + +Here we do correctly check the return value from fwnode_irq_get_byname() +but the driver probe will now return success. (There was already one +such user in-tree). + +Change the fwnode_irq_get_byname() to work as documented and make also the +fwnode_irq_get() follow same common convention returning a negative errno +upon failure. + +Fixes: ca0acb511c21 ("device property: Add fwnode_irq_get_byname") +Suggested-by: Sakari Ailus +Suggested-by: Jonathan Cameron +Signed-off-by: Matti Vaittinen +Reviewed-by: Andy Shevchenko +Reviewed-by: Jonathan Cameron + +Message-ID: <3e64fe592dc99e27ef9a0b247fc49fa26b6b8a58.1685340157.git.mazziesaccount@gmail.com> +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/base/property.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/drivers/base/property.c b/drivers/base/property.c +index f6117ec9805c4..8c40abed78524 100644 +--- a/drivers/base/property.c ++++ b/drivers/base/property.c +@@ -987,12 +987,18 @@ EXPORT_SYMBOL(fwnode_iomap); + * @fwnode: Pointer to the firmware node + * @index: Zero-based index of the IRQ + * +- * Return: Linux IRQ number on success. Other values are determined +- * according to acpi_irq_get() or of_irq_get() operation. ++ * Return: Linux IRQ number on success. Negative errno on failure. + */ + int fwnode_irq_get(const struct fwnode_handle *fwnode, unsigned int index) + { +- return fwnode_call_int_op(fwnode, irq_get, index); ++ int ret; ++ ++ ret = fwnode_call_int_op(fwnode, irq_get, index); ++ /* We treat mapping errors as invalid case */ ++ if (ret == 0) ++ return -EINVAL; ++ ++ return ret; + } + EXPORT_SYMBOL(fwnode_irq_get); + +-- +2.39.2 + diff --git a/queue-6.4/drm-amd-don-t-try-to-enable-secure-display-ta-multip.patch b/queue-6.4/drm-amd-don-t-try-to-enable-secure-display-ta-multip.patch new file mode 100644 index 00000000000..2bdf46a21a6 --- /dev/null +++ b/queue-6.4/drm-amd-don-t-try-to-enable-secure-display-ta-multip.patch @@ -0,0 +1,40 @@ +From 2ebc7e61af8e9ca19b64426a728efa54aa616c9e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jun 2023 22:18:39 -0500 +Subject: drm/amd: Don't try to enable secure display TA multiple times + +From: Mario Limonciello + +[ Upstream commit 5c6d52ff4b61e5267b25be714eb5a9ba2a338199 ] + +If the securedisplay TA failed to load the first time, it's unlikely +to work again after a suspend/resume cycle or reset cycle and it appears +to be causing problems in futher attempts. + +Fixes: e42dfa66d592 ("drm/amdgpu: Add secure display TA load for Renoir") +Reported-by: Filip Hejsek +Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/2633 +Signed-off-by: Mario Limonciello +Acked-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +index a150b7a4b4aae..e4757a2807d9a 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +@@ -1947,6 +1947,8 @@ static int psp_securedisplay_initialize(struct psp_context *psp) + psp_securedisplay_parse_resp_status(psp, securedisplay_cmd->status); + dev_err(psp->adev->dev, "SECUREDISPLAY: query securedisplay TA failed. ret 0x%x\n", + securedisplay_cmd->securedisplay_out_message.query_ta.query_cmd_ret); ++ /* don't try again */ ++ psp->securedisplay_context.context.bin_desc.size_bytes = 0; + } + + return 0; +-- +2.39.2 + diff --git a/queue-6.4/drm-amdgpu-fix-number-of-fence-calculations.patch b/queue-6.4/drm-amdgpu-fix-number-of-fence-calculations.patch new file mode 100644 index 00000000000..b966b133a34 --- /dev/null +++ b/queue-6.4/drm-amdgpu-fix-number-of-fence-calculations.patch @@ -0,0 +1,63 @@ +From 4de4045e2da6022a0a4b5ffaab80971ac7cea339 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jun 2023 13:18:13 +0200 +Subject: drm/amdgpu: fix number of fence calculations +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Christian König + +[ Upstream commit 570b295248b00c3cf4cf59e397de5cb2361e10c2 ] + +Since adding gang submit we need to take the gang size into account +while reserving fences. + +Signed-off-by: Christian König +Fixes: 4624459c84d7 ("drm/amdgpu: add gang submit frontend v6") +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c +index 2eb2c66843a88..5612caf77dd65 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c +@@ -133,9 +133,6 @@ static int amdgpu_cs_p1_user_fence(struct amdgpu_cs_parser *p, + bo = amdgpu_bo_ref(gem_to_amdgpu_bo(gobj)); + p->uf_entry.priority = 0; + p->uf_entry.tv.bo = &bo->tbo; +- /* One for TTM and two for the CS job */ +- p->uf_entry.tv.num_shared = 3; +- + drm_gem_object_put(gobj); + + size = amdgpu_bo_size(bo); +@@ -882,15 +879,19 @@ static int amdgpu_cs_parser_bos(struct amdgpu_cs_parser *p, + + mutex_lock(&p->bo_list->bo_list_mutex); + +- /* One for TTM and one for the CS job */ ++ /* One for TTM and one for each CS job */ + amdgpu_bo_list_for_each_entry(e, p->bo_list) +- e->tv.num_shared = 2; ++ e->tv.num_shared = 1 + p->gang_size; ++ p->uf_entry.tv.num_shared = 1 + p->gang_size; + + amdgpu_bo_list_get_list(p->bo_list, &p->validated); + + INIT_LIST_HEAD(&duplicates); + amdgpu_vm_get_pd_bo(&fpriv->vm, &p->validated, &p->vm_pd); + ++ /* Two for VM updates, one for TTM and one for each CS job */ ++ p->vm_pd.tv.num_shared = 3 + p->gang_size; ++ + if (p->uf_entry.tv.bo && !ttm_to_amdgpu_bo(p->uf_entry.tv.bo)->parent) + list_add(&p->uf_entry.tv.head, &p->validated); + +-- +2.39.2 + diff --git a/queue-6.4/drm-i915-guc-slpc-apply-min-softlimit-correctly.patch b/queue-6.4/drm-i915-guc-slpc-apply-min-softlimit-correctly.patch new file mode 100644 index 00000000000..4845f3262ec --- /dev/null +++ b/queue-6.4/drm-i915-guc-slpc-apply-min-softlimit-correctly.patch @@ -0,0 +1,53 @@ +From a3d25a66267ecaf9c884a0ed6ea20fefced0c425 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jun 2023 18:42:57 -0700 +Subject: drm/i915/guc/slpc: Apply min softlimit correctly + +From: Vinay Belgaumkar + +[ Upstream commit 3e49de73fb89272dea01ba420c7ccbcf6b96aed7 ] + +The scenario being fixed here is depicted in the following sequence- + +modprobe i915 +echo 1 > /sys/class/drm/card0/gt/gt0/slpc_ignore_eff_freq +echo 300 > /sys/class/drm/card0/gt_min_freq_mhz (RPn) +cat /sys/class/drm/card0/gt_cur_freq_mhz --> cur == RPn as expected +echo 1 > /sys/kernel/debug/dri/0/gt0/reset --> reset +cat /sys/class/drm/card0/gt_min_freq_mhz --> cached freq is RPn +cat /sys/class/drm/card0/gt_cur_freq_mhz --> it's not RPn, but RPe!! + +When SLPC reinitializes, it sets SLPC min freq to efficient frequency. +Even if we disable efficient freq post that, we should restore the cached +min freq (via H2G) for it to take effect. + +v2: Clarify commit message (Ashutosh) + +Fixes: 95ccf312a1e4 ("drm/i915/guc/slpc: Allow SLPC to use efficient frequency") +Reviewed-by: Ashutosh Dixit +Signed-off-by: Vinay Belgaumkar +Signed-off-by: Daniele Ceraolo Spurio +Link: https://patchwork.freedesktop.org/patch/msgid/20230621014257.1769564-1-vinay.belgaumkar@intel.com +(cherry picked from commit da86b2b13f1d1ca26745b951ac94421f3137539a) +Signed-off-by: Tvrtko Ursulin +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/gt/uc/intel_guc_slpc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/i915/gt/uc/intel_guc_slpc.c b/drivers/gpu/drm/i915/gt/uc/intel_guc_slpc.c +index 56dbba1ef6684..cc18e8f664864 100644 +--- a/drivers/gpu/drm/i915/gt/uc/intel_guc_slpc.c ++++ b/drivers/gpu/drm/i915/gt/uc/intel_guc_slpc.c +@@ -606,7 +606,7 @@ static int slpc_set_softlimits(struct intel_guc_slpc *slpc) + if (unlikely(ret)) + return ret; + slpc_to_gt(slpc)->defaults.min_freq = slpc->min_freq_softlimit; +- } else if (slpc->min_freq_softlimit != slpc->min_freq) { ++ } else { + return intel_guc_slpc_set_min_freq(slpc, + slpc->min_freq_softlimit); + } +-- +2.39.2 + diff --git a/queue-6.4/drm-i915-psr-fix-bdw-psr-aux-ch-data-register-offset.patch b/queue-6.4/drm-i915-psr-fix-bdw-psr-aux-ch-data-register-offset.patch new file mode 100644 index 00000000000..00904eada62 --- /dev/null +++ b/queue-6.4/drm-i915-psr-fix-bdw-psr-aux-ch-data-register-offset.patch @@ -0,0 +1,44 @@ +From b11165fd42a835e3f9281547b67751f56457112e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Jun 2023 17:13:53 +0300 +Subject: drm/i915/psr: Fix BDW PSR AUX CH data register offsets +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ville Syrjälä + +[ Upstream commit fdffb7dbc74f48cb1d404d9ab0c9fd769a59caf0 ] + +The multiplication got replaced by an addition in some cleanup. +This means we never write the correct data to some of the BDW +PSR data registers and thus we fail to actually wake up the +panel from PSR. + +Fixes: 4ab4fa103217 ("drm/i915/psr: Make PSR registers relative to transcoders") +Signed-off-by: Ville Syrjälä +Link: https://patchwork.freedesktop.org/patch/msgid/20230609141404.12729-3-ville.syrjala@linux.intel.com +Reviewed-by: Jouni Högander +(cherry picked from commit 460dc4ba1442b3e5e543328d11db2702b98d3d7c) +Signed-off-by: Tvrtko Ursulin +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/display/intel_psr_regs.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/i915/display/intel_psr_regs.h b/drivers/gpu/drm/i915/display/intel_psr_regs.h +index 958d8cabc44b5..5e3fe23ef8eb2 100644 +--- a/drivers/gpu/drm/i915/display/intel_psr_regs.h ++++ b/drivers/gpu/drm/i915/display/intel_psr_regs.h +@@ -75,7 +75,7 @@ + + #define _SRD_AUX_DATA_A 0x60814 + #define _SRD_AUX_DATA_EDP 0x6f814 +-#define EDP_PSR_AUX_DATA(tran, i) _MMIO_TRANS2(tran, _SRD_AUX_DATA_A + (i) + 4) /* 5 registers */ ++#define EDP_PSR_AUX_DATA(tran, i) _MMIO_TRANS2(tran, _SRD_AUX_DATA_A + (i) * 4) /* 5 registers */ + + #define _SRD_STATUS_A 0x60840 + #define _SRD_STATUS_EDP 0x6f840 +-- +2.39.2 + diff --git a/queue-6.4/drm-i915-psr-use-hw.adjusted-mode-when-calculating-i.patch b/queue-6.4/drm-i915-psr-use-hw.adjusted-mode-when-calculating-i.patch new file mode 100644 index 00000000000..e65387a33b9 --- /dev/null +++ b/queue-6.4/drm-i915-psr-use-hw.adjusted-mode-when-calculating-i.patch @@ -0,0 +1,52 @@ +From 981318d5ae7017ff87e1c083625a9b4df395d4ba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jun 2023 14:17:45 +0300 +Subject: drm/i915/psr: Use hw.adjusted mode when calculating io/fast wake + times +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jouni Högander + +[ Upstream commit 5311892a0ad1d301aafd53ca0154091b3eb407ea ] + +Encoder compute config is changing hw.adjusted mode. Uapi.adjusted mode +doesn't get updated before psr compute config gets called. This causes io +and fast wake line calculation using adjusted mode containing values before +encoder adjustments. Fix this by using hw.adjusted mode instead of +uapi.adjusted mode. + +Cc: Stanislav Lisovskiy + +Signed-off-by: Jouni Högander +Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/8475 +Fixes: cb42e8ede5b4 ("drm/i915/psr: Use calculated io and fast wake lines") +Reviewed-by: Mika Kahola +Link: https://patchwork.freedesktop.org/patch/msgid/20230620111745.2870706-1-jouni.hogander@intel.com +(cherry picked from commit ef0af9db2a21257885116949f471fe5565b2f0ab) +Signed-off-by: Tvrtko Ursulin +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/display/intel_psr.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/i915/display/intel_psr.c b/drivers/gpu/drm/i915/display/intel_psr.c +index 6badfff2b4a28..b7cbc780e672f 100644 +--- a/drivers/gpu/drm/i915/display/intel_psr.c ++++ b/drivers/gpu/drm/i915/display/intel_psr.c +@@ -851,9 +851,9 @@ static bool _compute_psr2_wake_times(struct intel_dp *intel_dp, + } + + io_wake_lines = intel_usecs_to_scanlines( +- &crtc_state->uapi.adjusted_mode, io_wake_time); ++ &crtc_state->hw.adjusted_mode, io_wake_time); + fast_wake_lines = intel_usecs_to_scanlines( +- &crtc_state->uapi.adjusted_mode, fast_wake_time); ++ &crtc_state->hw.adjusted_mode, fast_wake_time); + + if (io_wake_lines > max_wake_lines || + fast_wake_lines > max_wake_lines) +-- +2.39.2 + diff --git a/queue-6.4/dt-bindings-power-reset-qcom-pon-only-allow-reboot-m.patch b/queue-6.4/dt-bindings-power-reset-qcom-pon-only-allow-reboot-m.patch new file mode 100644 index 00000000000..cf8e6c32bcb --- /dev/null +++ b/queue-6.4/dt-bindings-power-reset-qcom-pon-only-allow-reboot-m.patch @@ -0,0 +1,53 @@ +From a10224fcdb3bb932e1245484637cd54006914dc0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Apr 2023 12:41:06 +0200 +Subject: dt-bindings: power: reset: qcom-pon: Only allow reboot-mode + pre-pmk8350 + +From: Konrad Dybcio + +[ Upstream commit d41dab4c031edaa460a484113394327aa52dc0bd ] + +As pointed out by Shazad [1], PMICs using a separate HLOS+PBS scheme +(so PMK8350 and newer) are expected to pass reboot mode data through SDAM, +as the reboot mode registers are absent in the HLOS reg space. + +Limit the reboot-mode.yaml inclusion to PMICs without a separate PBS +region. + +[1] https://lore.kernel.org/linux-arm-msm/12f13183-c381-25f7-459e-62e0c2b19498@quicinc.com/ + +Fixes: 03fccdc76dce ("dt-bindings: power: reset: qcom-pon: Add new compatible "qcom,pmk8350-pon"") +Signed-off-by: Konrad Dybcio +Acked-by: Rob Herring +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + Documentation/devicetree/bindings/power/reset/qcom,pon.yaml | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/Documentation/devicetree/bindings/power/reset/qcom,pon.yaml b/Documentation/devicetree/bindings/power/reset/qcom,pon.yaml +index d96170eecbd22..0b1eca734d3b1 100644 +--- a/Documentation/devicetree/bindings/power/reset/qcom,pon.yaml ++++ b/Documentation/devicetree/bindings/power/reset/qcom,pon.yaml +@@ -56,7 +56,6 @@ required: + unevaluatedProperties: false + + allOf: +- - $ref: reboot-mode.yaml# + - if: + properties: + compatible: +@@ -66,6 +65,9 @@ allOf: + - qcom,pms405-pon + - qcom,pm8998-pon + then: ++ allOf: ++ - $ref: reboot-mode.yaml# ++ + properties: + reg: + maxItems: 1 +-- +2.39.2 + diff --git a/queue-6.4/extcon-fix-kernel-doc-of-property-capability-fields-.patch b/queue-6.4/extcon-fix-kernel-doc-of-property-capability-fields-.patch new file mode 100644 index 00000000000..617921d68a6 --- /dev/null +++ b/queue-6.4/extcon-fix-kernel-doc-of-property-capability-fields-.patch @@ -0,0 +1,46 @@ +From 36e80eb3520dcc784aabb3d9ae70093b08ed2f9f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Mar 2023 16:39:53 +0200 +Subject: extcon: Fix kernel doc of property capability fields to avoid + warnings + +From: Andy Shevchenko + +[ Upstream commit 73346b9965ebda2feb7fef8629e9b28baee820e3 ] + +Kernel documentation has to be synchronized with a code, otherwise +the validator is not happy: + + Function parameter or member 'usb_bits' not described in 'extcon_cable' + Function parameter or member 'chg_bits' not described in 'extcon_cable' + Function parameter or member 'jack_bits' not described in 'extcon_cable' + Function parameter or member 'disp_bits' not described in 'extcon_cable' + +Describe the fields added in the past. + +Fixes: ceaa98f442cf ("extcon: Add the support for the capability of each property") +Signed-off-by: Andy Shevchenko +Signed-off-by: Chanwoo Choi +Signed-off-by: Sasha Levin +--- + drivers/extcon/extcon.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/extcon/extcon.c b/drivers/extcon/extcon.c +index efaf234582d97..370b5b26d10b7 100644 +--- a/drivers/extcon/extcon.c ++++ b/drivers/extcon/extcon.c +@@ -210,6 +210,10 @@ static const struct __extcon_info { + * @chg_propval: the array of charger connector properties + * @jack_propval: the array of jack connector properties + * @disp_propval: the array of display connector properties ++ * @usb_bits: the bit array of the USB connector property capabilities ++ * @chg_bits: the bit array of the charger connector property capabilities ++ * @jack_bits: the bit array of the jack connector property capabilities ++ * @disp_bits: the bit array of the display connector property capabilities + */ + struct extcon_cable { + struct extcon_dev *edev; +-- +2.39.2 + diff --git a/queue-6.4/extcon-fix-kernel-doc-of-property-fields-to-avoid-wa.patch b/queue-6.4/extcon-fix-kernel-doc-of-property-fields-to-avoid-wa.patch new file mode 100644 index 00000000000..528fab2701f --- /dev/null +++ b/queue-6.4/extcon-fix-kernel-doc-of-property-fields-to-avoid-wa.patch @@ -0,0 +1,45 @@ +From 357f2b3b1271b3451da490c8c82fb7db226867c4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Mar 2023 16:39:52 +0200 +Subject: extcon: Fix kernel doc of property fields to avoid warnings + +From: Andy Shevchenko + +[ Upstream commit 7e77e0b7a9f4cdf91cb0950749b40c840ea63efc ] + +Kernel documentation has to be synchronized with a code, otherwise +the validator is not happy: + + Function parameter or member 'usb_propval' not described in 'extcon_cable' + Function parameter or member 'chg_propval' not described in 'extcon_cable' + Function parameter or member 'jack_propval' not described in 'extcon_cable' + Function parameter or member 'disp_propval' not described in 'extcon_cable' + +Describe the fields added in the past. + +Fixes: 067c1652e7a7 ("extcon: Add the support for extcon property according to extcon type") +Signed-off-by: Andy Shevchenko +Signed-off-by: Chanwoo Choi +Signed-off-by: Sasha Levin +--- + drivers/extcon/extcon.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/extcon/extcon.c b/drivers/extcon/extcon.c +index d43ba8e7260dd..efaf234582d97 100644 +--- a/drivers/extcon/extcon.c ++++ b/drivers/extcon/extcon.c +@@ -206,6 +206,10 @@ static const struct __extcon_info { + * @attr_name: "name" sysfs entry + * @attr_state: "state" sysfs entry + * @attrs: the array pointing to attr_name and attr_state for attr_g ++ * @usb_propval: the array of USB connector properties ++ * @chg_propval: the array of charger connector properties ++ * @jack_propval: the array of jack connector properties ++ * @disp_propval: the array of display connector properties + */ + struct extcon_cable { + struct extcon_dev *edev; +-- +2.39.2 + diff --git a/queue-6.4/f2fs-check-return-value-of-freeze_super.patch b/queue-6.4/f2fs-check-return-value-of-freeze_super.patch new file mode 100644 index 00000000000..a80fd9027c9 --- /dev/null +++ b/queue-6.4/f2fs-check-return-value-of-freeze_super.patch @@ -0,0 +1,39 @@ +From b82d3f2dcd569a15e91b3484779ee459fb99fffc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Jun 2023 14:19:01 +0800 +Subject: f2fs: check return value of freeze_super() + +From: Chao Yu + +[ Upstream commit 8bec7dd1b3f7d7769d433d67bde404de948a2d95 ] + +freeze_super() can fail, it needs to check its return value and do +error handling in f2fs_resize_fs(). + +Fixes: 04f0b2eaa3b3 ("f2fs: ioctl for removing a range from F2FS") +Fixes: b4b10061ef98 ("f2fs: refactor resize_fs to avoid meta updates in progress") +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/gc.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c +index 67f1b58d424ed..719b1ba32a78b 100644 +--- a/fs/f2fs/gc.c ++++ b/fs/f2fs/gc.c +@@ -2175,7 +2175,9 @@ int f2fs_resize_fs(struct file *filp, __u64 block_count) + if (err) + return err; + +- freeze_super(sbi->sb); ++ err = freeze_super(sbi->sb); ++ if (err) ++ return err; + + if (f2fs_readonly(sbi->sb)) { + thaw_super(sbi->sb); +-- +2.39.2 + diff --git a/queue-6.4/f2fs-do-not-allow-to-defragment-files-have-fi_compre.patch b/queue-6.4/f2fs-do-not-allow-to-defragment-files-have-fi_compre.patch new file mode 100644 index 00000000000..f78e9c83f9e --- /dev/null +++ b/queue-6.4/f2fs-do-not-allow-to-defragment-files-have-fi_compre.patch @@ -0,0 +1,49 @@ +From 272d03e0120bdf54da398c97c05b2d68260bd9c2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Apr 2023 00:47:11 +0800 +Subject: f2fs: do not allow to defragment files have FI_COMPRESS_RELEASED + +From: Yangtao Li + +[ Upstream commit 7cd2e5f75b86a1befa99834f3ed1d735eeff69e6 ] + +If a file has FI_COMPRESS_RELEASED, all writes for it should not be +allowed. + +Fixes: 5fdb322ff2c2 ("f2fs: add F2FS_IOC_DECOMPRESS_FILE and F2FS_IOC_COMPRESS_FILE") +Signed-off-by: Qi Han +Signed-off-by: Yangtao Li +Reviewed-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/file.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c +index 5ac53d2627d20..fa50c6475876c 100644 +--- a/fs/f2fs/file.c ++++ b/fs/f2fs/file.c +@@ -2593,6 +2593,11 @@ static int f2fs_defragment_range(struct f2fs_sb_info *sbi, + + inode_lock(inode); + ++ if (is_inode_flag_set(inode, FI_COMPRESS_RELEASED)) { ++ err = -EINVAL; ++ goto unlock_out; ++ } ++ + /* if in-place-update policy is enabled, don't waste time here */ + set_inode_flag(inode, FI_OPU_WRITE); + if (f2fs_should_update_inplace(inode, NULL)) { +@@ -2717,6 +2722,7 @@ static int f2fs_defragment_range(struct f2fs_sb_info *sbi, + clear_inode_flag(inode, FI_SKIP_WRITES); + out: + clear_inode_flag(inode, FI_OPU_WRITE); ++unlock_out: + inode_unlock(inode); + if (!err) + range->len = (u64)total << PAGE_SHIFT; +-- +2.39.2 + diff --git a/queue-6.4/f2fs-fix-error-path-handling-in-truncate_dnode.patch b/queue-6.4/f2fs-fix-error-path-handling-in-truncate_dnode.patch new file mode 100644 index 00000000000..19be8127952 --- /dev/null +++ b/queue-6.4/f2fs-fix-error-path-handling-in-truncate_dnode.patch @@ -0,0 +1,39 @@ +From e8a08a15af706bbcb27b980df2f01160c286127e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Jun 2023 09:41:02 +0800 +Subject: f2fs: fix error path handling in truncate_dnode() + +From: Chao Yu + +[ Upstream commit 0135c482fa97e2fd8245cb462784112a00ed1211 ] + +If truncate_node() fails in truncate_dnode(), it missed to call +f2fs_put_page(), fix it. + +Fixes: 7735730d39d7 ("f2fs: fix to propagate error from __get_meta_page()") +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/node.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c +index 834c6f099c955..6bdb1bed29ec9 100644 +--- a/fs/f2fs/node.c ++++ b/fs/f2fs/node.c +@@ -943,8 +943,10 @@ static int truncate_dnode(struct dnode_of_data *dn) + dn->ofs_in_node = 0; + f2fs_truncate_data_blocks(dn); + err = truncate_node(dn); +- if (err) ++ if (err) { ++ f2fs_put_page(page, 1); + return err; ++ } + + return 1; + } +-- +2.39.2 + diff --git a/queue-6.4/f2fs-fix-potential-deadlock-due-to-unpaired-node_wri.patch b/queue-6.4/f2fs-fix-potential-deadlock-due-to-unpaired-node_wri.patch new file mode 100644 index 00000000000..29dc10e5f02 --- /dev/null +++ b/queue-6.4/f2fs-fix-potential-deadlock-due-to-unpaired-node_wri.patch @@ -0,0 +1,108 @@ +From 1310968da51b80e1b2c19b06072a1d46e5db8449 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 14 May 2023 16:07:23 +0800 +Subject: f2fs: fix potential deadlock due to unpaired node_write lock use + +From: Chao Yu + +[ Upstream commit f082c6b205a06953f26c40bdc7621cc5a58ceb7c ] + +If S_NOQUOTA is cleared from inode during data page writeback of quota +file, it may miss to unlock node_write lock, result in potential +deadlock, fix to use the lock in paired. + +Kworker Thread +- writepage + if (IS_NOQUOTA()) + f2fs_down_read(&sbi->node_write); + - vfs_cleanup_quota_inode + - inode->i_flags &= ~S_NOQUOTA; + if (IS_NOQUOTA()) + f2fs_up_read(&sbi->node_write); + +Fixes: 79963d967b49 ("f2fs: shrink node_write lock coverage") +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/compress.c | 7 ++++--- + fs/f2fs/data.c | 7 ++++--- + 2 files changed, 8 insertions(+), 6 deletions(-) + +diff --git a/fs/f2fs/compress.c b/fs/f2fs/compress.c +index 11653fa792897..2ec7cf4544180 100644 +--- a/fs/f2fs/compress.c ++++ b/fs/f2fs/compress.c +@@ -1215,6 +1215,7 @@ static int f2fs_write_compressed_pages(struct compress_ctx *cc, + unsigned int last_index = cc->cluster_size - 1; + loff_t psize; + int i, err; ++ bool quota_inode = IS_NOQUOTA(inode); + + /* we should bypass data pages to proceed the kworker jobs */ + if (unlikely(f2fs_cp_error(sbi))) { +@@ -1222,7 +1223,7 @@ static int f2fs_write_compressed_pages(struct compress_ctx *cc, + goto out_free; + } + +- if (IS_NOQUOTA(inode)) { ++ if (quota_inode) { + /* + * We need to wait for node_write to avoid block allocation during + * checkpoint. This can only happen to quota writes which can cause +@@ -1344,7 +1345,7 @@ static int f2fs_write_compressed_pages(struct compress_ctx *cc, + set_inode_flag(inode, FI_FIRST_BLOCK_WRITTEN); + + f2fs_put_dnode(&dn); +- if (IS_NOQUOTA(inode)) ++ if (quota_inode) + f2fs_up_read(&sbi->node_write); + else + f2fs_unlock_op(sbi); +@@ -1370,7 +1371,7 @@ static int f2fs_write_compressed_pages(struct compress_ctx *cc, + out_put_dnode: + f2fs_put_dnode(&dn); + out_unlock_op: +- if (IS_NOQUOTA(inode)) ++ if (quota_inode) + f2fs_up_read(&sbi->node_write); + else + f2fs_unlock_op(sbi); +diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c +index 7165b1202f539..4a0ee9cc43b5d 100644 +--- a/fs/f2fs/data.c ++++ b/fs/f2fs/data.c +@@ -2775,6 +2775,7 @@ int f2fs_write_single_data_page(struct page *page, int *submitted, + loff_t psize = (loff_t)(page->index + 1) << PAGE_SHIFT; + unsigned offset = 0; + bool need_balance_fs = false; ++ bool quota_inode = IS_NOQUOTA(inode); + int err = 0; + struct f2fs_io_info fio = { + .sbi = sbi, +@@ -2832,19 +2833,19 @@ int f2fs_write_single_data_page(struct page *page, int *submitted, + goto out; + + /* Dentry/quota blocks are controlled by checkpoint */ +- if (S_ISDIR(inode->i_mode) || IS_NOQUOTA(inode)) { ++ if (S_ISDIR(inode->i_mode) || quota_inode) { + /* + * We need to wait for node_write to avoid block allocation during + * checkpoint. This can only happen to quota writes which can cause + * the below discard race condition. + */ +- if (IS_NOQUOTA(inode)) ++ if (quota_inode) + f2fs_down_read(&sbi->node_write); + + fio.need_lock = LOCK_DONE; + err = f2fs_do_write_data_page(&fio); + +- if (IS_NOQUOTA(inode)) ++ if (quota_inode) + f2fs_up_read(&sbi->node_write); + + goto done; +-- +2.39.2 + diff --git a/queue-6.4/f2fs-fix-the-wrong-condition-to-determine-atomic-con.patch b/queue-6.4/f2fs-fix-the-wrong-condition-to-determine-atomic-con.patch new file mode 100644 index 00000000000..48a309049a0 --- /dev/null +++ b/queue-6.4/f2fs-fix-the-wrong-condition-to-determine-atomic-con.patch @@ -0,0 +1,37 @@ +From 8799b689755abe7b50d67957253528e021c5ce52 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 May 2023 12:16:54 -0700 +Subject: f2fs: fix the wrong condition to determine atomic context + +From: Jaegeuk Kim + +[ Upstream commit 633c8b9409f564ce4b7f7944c595ffac27ed1ff4 ] + +Should use !in_task for irq context. + +Cc: stable@vger.kernel.org +Fixes: 1aa161e43106 ("f2fs: fix scheduling while atomic in decompression path") +Reviewed-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Stable-dep-of: 901c12d14457 ("f2fs: flush error flags in workqueue") +Signed-off-by: Sasha Levin +--- + fs/f2fs/compress.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/f2fs/compress.c b/fs/f2fs/compress.c +index 2ec7cf4544180..905b7c39a2b32 100644 +--- a/fs/f2fs/compress.c ++++ b/fs/f2fs/compress.c +@@ -743,7 +743,7 @@ void f2fs_decompress_cluster(struct decompress_io_ctx *dic, bool in_task) + ret = -EFSCORRUPTED; + + /* Avoid f2fs_commit_super in irq context */ +- if (in_task) ++ if (!in_task) + f2fs_save_errors(sbi, ERROR_FAIL_DECOMPRESSION); + else + f2fs_handle_error(sbi, ERROR_FAIL_DECOMPRESSION); +-- +2.39.2 + diff --git a/queue-6.4/f2fs-fix-to-avoid-null-pointer-dereference-f2fs_writ.patch b/queue-6.4/f2fs-fix-to-avoid-null-pointer-dereference-f2fs_writ.patch new file mode 100644 index 00000000000..f576753627a --- /dev/null +++ b/queue-6.4/f2fs-fix-to-avoid-null-pointer-dereference-f2fs_writ.patch @@ -0,0 +1,161 @@ +From 2445331de0d07db1302cb4b3e8c08285d33b24b7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 May 2023 14:17:25 +0800 +Subject: f2fs: fix to avoid NULL pointer dereference f2fs_write_end_io() + +From: Chao Yu + +[ Upstream commit d8189834d4348ae608083e1f1f53792cfcc2a9bc ] + +butt3rflyh4ck reports a bug as below: + +When a thread always calls F2FS_IOC_RESIZE_FS to resize fs, if resize fs is +failed, f2fs kernel thread would invoke callback function to update f2fs io +info, it would call f2fs_write_end_io and may trigger null-ptr-deref in +NODE_MAPPING. + +general protection fault, probably for non-canonical address +KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037] +RIP: 0010:NODE_MAPPING fs/f2fs/f2fs.h:1972 [inline] +RIP: 0010:f2fs_write_end_io+0x727/0x1050 fs/f2fs/data.c:370 + + bio_endio+0x5af/0x6c0 block/bio.c:1608 + req_bio_endio block/blk-mq.c:761 [inline] + blk_update_request+0x5cc/0x1690 block/blk-mq.c:906 + blk_mq_end_request+0x59/0x4c0 block/blk-mq.c:1023 + lo_complete_rq+0x1c6/0x280 drivers/block/loop.c:370 + blk_complete_reqs+0xad/0xe0 block/blk-mq.c:1101 + __do_softirq+0x1d4/0x8ef kernel/softirq.c:571 + run_ksoftirqd kernel/softirq.c:939 [inline] + run_ksoftirqd+0x31/0x60 kernel/softirq.c:931 + smpboot_thread_fn+0x659/0x9e0 kernel/smpboot.c:164 + kthread+0x33e/0x440 kernel/kthread.c:379 + ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308 + +The root cause is below race case can cause leaving dirty metadata +in f2fs after filesystem is remount as ro: + +Thread A Thread B +- f2fs_ioc_resize_fs + - f2fs_readonly --- return false + - f2fs_resize_fs + - f2fs_remount + - write_checkpoint + - set f2fs as ro + - free_segment_range + - update meta_inode's data + +Then, if f2fs_put_super() fails to write_checkpoint due to readonly +status, and meta_inode's dirty data will be writebacked after node_inode +is put, finally, f2fs_write_end_io will access NULL pointer on +sbi->node_inode. + +Thread A IRQ context +- f2fs_put_super + - write_checkpoint fails + - iput(node_inode) + - node_inode = NULL + - iput(meta_inode) + - write_inode_now + - f2fs_write_meta_page + - f2fs_write_end_io + - NODE_MAPPING(sbi) + : access NULL pointer on node_inode + +Fixes: b4b10061ef98 ("f2fs: refactor resize_fs to avoid meta updates in progress") +Reported-by: butt3rflyh4ck +Closes: https://lore.kernel.org/r/1684480657-2375-1-git-send-email-yangtiezhu@loongson.cn +Tested-by: butt3rflyh4ck +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/f2fs.h | 2 +- + fs/f2fs/file.c | 2 +- + fs/f2fs/gc.c | 21 ++++++++++++++++++--- + 3 files changed, 20 insertions(+), 5 deletions(-) + +diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h +index d211ee89c1586..25999ed2c4258 100644 +--- a/fs/f2fs/f2fs.h ++++ b/fs/f2fs/f2fs.h +@@ -3815,7 +3815,7 @@ void f2fs_stop_gc_thread(struct f2fs_sb_info *sbi); + block_t f2fs_start_bidx_of_node(unsigned int node_ofs, struct inode *inode); + int f2fs_gc(struct f2fs_sb_info *sbi, struct f2fs_gc_control *gc_control); + void f2fs_build_gc_manager(struct f2fs_sb_info *sbi); +-int f2fs_resize_fs(struct f2fs_sb_info *sbi, __u64 block_count); ++int f2fs_resize_fs(struct file *filp, __u64 block_count); + int __init f2fs_create_garbage_collection_cache(void); + void f2fs_destroy_garbage_collection_cache(void); + /* victim selection function for cleaning and SSR */ +diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c +index fa50c6475876c..7482af51ab408 100644 +--- a/fs/f2fs/file.c ++++ b/fs/f2fs/file.c +@@ -3284,7 +3284,7 @@ static int f2fs_ioc_resize_fs(struct file *filp, unsigned long arg) + sizeof(block_count))) + return -EFAULT; + +- return f2fs_resize_fs(sbi, block_count); ++ return f2fs_resize_fs(filp, block_count); + } + + static int f2fs_ioc_enable_verity(struct file *filp, unsigned long arg) +diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c +index 61c5f9d26018e..48cb4700ba3f5 100644 +--- a/fs/f2fs/gc.c ++++ b/fs/f2fs/gc.c +@@ -2099,8 +2099,9 @@ static void update_fs_metadata(struct f2fs_sb_info *sbi, int secs) + } + } + +-int f2fs_resize_fs(struct f2fs_sb_info *sbi, __u64 block_count) ++int f2fs_resize_fs(struct file *filp, __u64 block_count) + { ++ struct f2fs_sb_info *sbi = F2FS_I_SB(file_inode(filp)); + __u64 old_block_count, shrunk_blocks; + struct cp_control cpc = { CP_RESIZE, 0, 0, 0 }; + unsigned int secs; +@@ -2138,12 +2139,18 @@ int f2fs_resize_fs(struct f2fs_sb_info *sbi, __u64 block_count) + return -EINVAL; + } + ++ err = mnt_want_write_file(filp); ++ if (err) ++ return err; ++ + shrunk_blocks = old_block_count - block_count; + secs = div_u64(shrunk_blocks, BLKS_PER_SEC(sbi)); + + /* stop other GC */ +- if (!f2fs_down_write_trylock(&sbi->gc_lock)) +- return -EAGAIN; ++ if (!f2fs_down_write_trylock(&sbi->gc_lock)) { ++ err = -EAGAIN; ++ goto out_drop_write; ++ } + + /* stop CP to protect MAIN_SEC in free_segment_range */ + f2fs_lock_op(sbi); +@@ -2163,10 +2170,18 @@ int f2fs_resize_fs(struct f2fs_sb_info *sbi, __u64 block_count) + out_unlock: + f2fs_unlock_op(sbi); + f2fs_up_write(&sbi->gc_lock); ++out_drop_write: ++ mnt_drop_write_file(filp); + if (err) + return err; + + freeze_super(sbi->sb); ++ ++ if (f2fs_readonly(sbi->sb)) { ++ thaw_super(sbi->sb); ++ return -EROFS; ++ } ++ + f2fs_down_write(&sbi->gc_lock); + f2fs_down_write(&sbi->cp_global_sem); + +-- +2.39.2 + diff --git a/queue-6.4/f2fs-flush-error-flags-in-workqueue.patch b/queue-6.4/f2fs-flush-error-flags-in-workqueue.patch new file mode 100644 index 00000000000..18f0e19be41 --- /dev/null +++ b/queue-6.4/f2fs-flush-error-flags-in-workqueue.patch @@ -0,0 +1,105 @@ +From 035e390ae87a76513a9f15eb3a72e30a0f11ca8f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 May 2023 10:14:12 +0800 +Subject: f2fs: flush error flags in workqueue + +From: Chao Yu + +[ Upstream commit 901c12d144570ed2558f4a6806201453c5b01bea ] + +In IRQ context, it wakes up workqueue to record errors into on-disk +superblock fields rather than in-memory fields. + +Fixes: 1aa161e43106 ("f2fs: fix scheduling while atomic in decompression path") +Fixes: 95fa90c9e5a7 ("f2fs: support recording errors into superblock") +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/compress.c | 2 +- + fs/f2fs/f2fs.h | 1 + + fs/f2fs/super.c | 26 +++++++++++++++++++++++--- + 3 files changed, 25 insertions(+), 4 deletions(-) + +diff --git a/fs/f2fs/compress.c b/fs/f2fs/compress.c +index 905b7c39a2b32..1132d3cd8f337 100644 +--- a/fs/f2fs/compress.c ++++ b/fs/f2fs/compress.c +@@ -744,7 +744,7 @@ void f2fs_decompress_cluster(struct decompress_io_ctx *dic, bool in_task) + + /* Avoid f2fs_commit_super in irq context */ + if (!in_task) +- f2fs_save_errors(sbi, ERROR_FAIL_DECOMPRESSION); ++ f2fs_handle_error_async(sbi, ERROR_FAIL_DECOMPRESSION); + else + f2fs_handle_error(sbi, ERROR_FAIL_DECOMPRESSION); + goto out_release; +diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h +index 35a025d7e305b..d867056a01f65 100644 +--- a/fs/f2fs/f2fs.h ++++ b/fs/f2fs/f2fs.h +@@ -3558,6 +3558,7 @@ void f2fs_save_errors(struct f2fs_sb_info *sbi, unsigned char flag); + void f2fs_handle_critical_error(struct f2fs_sb_info *sbi, unsigned char reason, + bool irq_context); + void f2fs_handle_error(struct f2fs_sb_info *sbi, unsigned char error); ++void f2fs_handle_error_async(struct f2fs_sb_info *sbi, unsigned char error); + int f2fs_commit_super(struct f2fs_sb_info *sbi, bool recover); + int f2fs_sync_fs(struct super_block *sb, int sync); + int f2fs_sanity_check_ckpt(struct f2fs_sb_info *sbi); +diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c +index 51812f4595813..17082dc3c1a34 100644 +--- a/fs/f2fs/super.c ++++ b/fs/f2fs/super.c +@@ -3980,6 +3980,11 @@ static void f2fs_record_stop_reason(struct f2fs_sb_info *sbi) + f2fs_down_write(&sbi->sb_lock); + + spin_lock_irqsave(&sbi->error_lock, flags); ++ if (sbi->error_dirty) { ++ memcpy(F2FS_RAW_SUPER(sbi)->s_errors, sbi->errors, ++ MAX_F2FS_ERRORS); ++ sbi->error_dirty = false; ++ } + memcpy(raw_super->s_stop_reason, sbi->stop_reason, MAX_STOP_REASON); + spin_unlock_irqrestore(&sbi->error_lock, flags); + +@@ -4019,12 +4024,10 @@ static bool f2fs_update_errors(struct f2fs_sb_info *sbi) + return need_update; + } + +-void f2fs_handle_error(struct f2fs_sb_info *sbi, unsigned char error) ++static void f2fs_record_errors(struct f2fs_sb_info *sbi, unsigned char error) + { + int err; + +- f2fs_save_errors(sbi, error); +- + f2fs_down_write(&sbi->sb_lock); + + if (!f2fs_update_errors(sbi)) +@@ -4038,6 +4041,23 @@ void f2fs_handle_error(struct f2fs_sb_info *sbi, unsigned char error) + f2fs_up_write(&sbi->sb_lock); + } + ++void f2fs_handle_error(struct f2fs_sb_info *sbi, unsigned char error) ++{ ++ f2fs_save_errors(sbi, error); ++ f2fs_record_errors(sbi, error); ++} ++ ++void f2fs_handle_error_async(struct f2fs_sb_info *sbi, unsigned char error) ++{ ++ f2fs_save_errors(sbi, error); ++ ++ if (!sbi->error_dirty) ++ return; ++ if (!test_bit(error, (unsigned long *)sbi->errors)) ++ return; ++ schedule_work(&sbi->s_error_work); ++} ++ + static bool system_going_down(void) + { + return system_state == SYSTEM_HALT || system_state == SYSTEM_POWER_OFF +-- +2.39.2 + diff --git a/queue-6.4/f2fs-support-errors-remount-ro-continue-panic-mounto.patch b/queue-6.4/f2fs-support-errors-remount-ro-continue-panic-mounto.patch new file mode 100644 index 00000000000..56e785c2c68 --- /dev/null +++ b/queue-6.4/f2fs-support-errors-remount-ro-continue-panic-mounto.patch @@ -0,0 +1,467 @@ +From 261d982d265e5f2c3062cfcb77558a664662da81 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 23 Apr 2023 23:49:15 +0800 +Subject: f2fs: support errors=remount-ro|continue|panic mountoption + +From: Chao Yu + +[ Upstream commit b62e71be2110d8b52bf5faf3c3ed7ca1a0c113a5 ] + +This patch supports errors=remount-ro|continue|panic mount option +for f2fs. + +f2fs behaves as below in three different modes: +mode continue remount-ro panic +access ops normal noraml N/A +syscall errors -EIO -EROFS N/A +mount option rw ro N/A +pending dir write keep keep N/A +pending non-dir write drop keep N/A +pending node write drop keep N/A +pending meta write keep keep N/A + +By default it uses "continue" mode. + +[Yangtao helps to clean up function's name] +Signed-off-by: Yangtao Li +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Stable-dep-of: 901c12d14457 ("f2fs: flush error flags in workqueue") +Signed-off-by: Sasha Levin +--- + Documentation/filesystems/f2fs.rst | 16 ++++ + fs/f2fs/checkpoint.c | 7 +- + fs/f2fs/data.c | 4 + + fs/f2fs/f2fs.h | 20 ++++- + fs/f2fs/file.c | 5 -- + fs/f2fs/gc.c | 2 +- + fs/f2fs/node.c | 3 + + fs/f2fs/super.c | 134 ++++++++++++++++++++++++++--- + 8 files changed, 167 insertions(+), 24 deletions(-) + +diff --git a/Documentation/filesystems/f2fs.rst b/Documentation/filesystems/f2fs.rst +index c57745375edbc..9359978a5af26 100644 +--- a/Documentation/filesystems/f2fs.rst ++++ b/Documentation/filesystems/f2fs.rst +@@ -351,6 +351,22 @@ age_extent_cache Enable an age extent cache based on rb-tree. It records + data block update frequency of the extent per inode, in + order to provide better temperature hints for data block + allocation. ++errors=%s Specify f2fs behavior on critical errors. This supports modes: ++ "panic", "continue" and "remount-ro", respectively, trigger ++ panic immediately, continue without doing anything, and remount ++ the partition in read-only mode. By default it uses "continue" ++ mode. ++ ====================== =============== =============== ======== ++ mode continue remount-ro panic ++ ====================== =============== =============== ======== ++ access ops normal noraml N/A ++ syscall errors -EIO -EROFS N/A ++ mount option rw ro N/A ++ pending dir write keep keep N/A ++ pending non-dir write drop keep N/A ++ pending node write drop keep N/A ++ pending meta write keep keep N/A ++ ====================== =============== =============== ======== + ======================== ============================================================ + + Debugfs Entries +diff --git a/fs/f2fs/checkpoint.c b/fs/f2fs/checkpoint.c +index 64b3860f50ee5..8fd3b7f9fb88e 100644 +--- a/fs/f2fs/checkpoint.c ++++ b/fs/f2fs/checkpoint.c +@@ -30,12 +30,9 @@ void f2fs_stop_checkpoint(struct f2fs_sb_info *sbi, bool end_io, + unsigned char reason) + { + f2fs_build_fault_attr(sbi, 0, 0); +- set_ckpt_flags(sbi, CP_ERROR_FLAG); +- if (!end_io) { ++ if (!end_io) + f2fs_flush_merged_writes(sbi); +- +- f2fs_handle_stop(sbi, reason); +- } ++ f2fs_handle_critical_error(sbi, reason, end_io); + } + + /* +diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c +index 4a0ee9cc43b5d..15b6dc2e06410 100644 +--- a/fs/f2fs/data.c ++++ b/fs/f2fs/data.c +@@ -2808,6 +2808,10 @@ int f2fs_write_single_data_page(struct page *page, int *submitted, + if (S_ISDIR(inode->i_mode) && + !is_sbi_flag_set(sbi, SBI_IS_CLOSE)) + goto redirty_out; ++ ++ /* keep data pages in remount-ro mode */ ++ if (F2FS_OPTION(sbi).errors == MOUNT_ERRORS_READONLY) ++ goto redirty_out; + goto out; + } + +diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h +index 25999ed2c4258..35a025d7e305b 100644 +--- a/fs/f2fs/f2fs.h ++++ b/fs/f2fs/f2fs.h +@@ -162,6 +162,7 @@ struct f2fs_mount_info { + int fs_mode; /* fs mode: LFS or ADAPTIVE */ + int bggc_mode; /* bggc mode: off, on or sync */ + int memory_mode; /* memory mode */ ++ int errors; /* errors parameter */ + int discard_unit; /* + * discard command's offset/size should + * be aligned to this unit: block, +@@ -1370,6 +1371,12 @@ enum { + MEMORY_MODE_LOW, /* memory mode for low memry devices */ + }; + ++enum errors_option { ++ MOUNT_ERRORS_READONLY, /* remount fs ro on errors */ ++ MOUNT_ERRORS_CONTINUE, /* continue on errors */ ++ MOUNT_ERRORS_PANIC, /* panic on errors */ ++}; ++ + static inline int f2fs_test_bit(unsigned int nr, char *addr); + static inline void f2fs_set_bit(unsigned int nr, char *addr); + static inline void f2fs_clear_bit(unsigned int nr, char *addr); +@@ -1721,8 +1728,14 @@ struct f2fs_sb_info { + + struct workqueue_struct *post_read_wq; /* post read workqueue */ + +- unsigned char errors[MAX_F2FS_ERRORS]; /* error flags */ +- spinlock_t error_lock; /* protect errors array */ ++ /* ++ * If we are in irq context, let's update error information into ++ * on-disk superblock in the work. ++ */ ++ struct work_struct s_error_work; ++ unsigned char errors[MAX_F2FS_ERRORS]; /* error flags */ ++ unsigned char stop_reason[MAX_STOP_REASON]; /* stop reason */ ++ spinlock_t error_lock; /* protect errors/stop_reason array */ + bool error_dirty; /* errors of sb is dirty */ + + struct kmem_cache *inline_xattr_slab; /* inline xattr entry */ +@@ -3541,8 +3554,9 @@ int f2fs_enable_quota_files(struct f2fs_sb_info *sbi, bool rdonly); + int f2fs_quota_sync(struct super_block *sb, int type); + loff_t max_file_blocks(struct inode *inode); + void f2fs_quota_off_umount(struct super_block *sb); +-void f2fs_handle_stop(struct f2fs_sb_info *sbi, unsigned char reason); + void f2fs_save_errors(struct f2fs_sb_info *sbi, unsigned char flag); ++void f2fs_handle_critical_error(struct f2fs_sb_info *sbi, unsigned char reason, ++ bool irq_context); + void f2fs_handle_error(struct f2fs_sb_info *sbi, unsigned char error); + int f2fs_commit_super(struct f2fs_sb_info *sbi, bool recover); + int f2fs_sync_fs(struct super_block *sb, int sync); +diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c +index 7482af51ab408..015ed274dc312 100644 +--- a/fs/f2fs/file.c ++++ b/fs/f2fs/file.c +@@ -2225,7 +2225,6 @@ static int f2fs_ioc_shutdown(struct file *filp, unsigned long arg) + ret = 0; + f2fs_stop_checkpoint(sbi, false, + STOP_CP_REASON_SHUTDOWN); +- set_sbi_flag(sbi, SBI_IS_SHUTDOWN); + trace_f2fs_shutdown(sbi, in, ret); + } + return ret; +@@ -2238,7 +2237,6 @@ static int f2fs_ioc_shutdown(struct file *filp, unsigned long arg) + if (ret) + goto out; + f2fs_stop_checkpoint(sbi, false, STOP_CP_REASON_SHUTDOWN); +- set_sbi_flag(sbi, SBI_IS_SHUTDOWN); + thaw_bdev(sb->s_bdev); + break; + case F2FS_GOING_DOWN_METASYNC: +@@ -2247,16 +2245,13 @@ static int f2fs_ioc_shutdown(struct file *filp, unsigned long arg) + if (ret) + goto out; + f2fs_stop_checkpoint(sbi, false, STOP_CP_REASON_SHUTDOWN); +- set_sbi_flag(sbi, SBI_IS_SHUTDOWN); + break; + case F2FS_GOING_DOWN_NOSYNC: + f2fs_stop_checkpoint(sbi, false, STOP_CP_REASON_SHUTDOWN); +- set_sbi_flag(sbi, SBI_IS_SHUTDOWN); + break; + case F2FS_GOING_DOWN_METAFLUSH: + f2fs_sync_meta_pages(sbi, META, LONG_MAX, FS_META_IO); + f2fs_stop_checkpoint(sbi, false, STOP_CP_REASON_SHUTDOWN); +- set_sbi_flag(sbi, SBI_IS_SHUTDOWN); + break; + case F2FS_GOING_DOWN_NEED_FSCK: + set_sbi_flag(sbi, SBI_NEED_FSCK); +diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c +index 48cb4700ba3f5..67f1b58d424ed 100644 +--- a/fs/f2fs/gc.c ++++ b/fs/f2fs/gc.c +@@ -59,7 +59,7 @@ static int gc_thread_func(void *data) + if (gc_th->gc_wake) + gc_th->gc_wake = false; + +- if (try_to_freeze()) { ++ if (try_to_freeze() || f2fs_readonly(sbi->sb)) { + stat_other_skip_bggc_count(sbi); + continue; + } +diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c +index bd1dad5237967..834c6f099c955 100644 +--- a/fs/f2fs/node.c ++++ b/fs/f2fs/node.c +@@ -1596,6 +1596,9 @@ static int __write_node_page(struct page *page, bool atomic, bool *submitted, + trace_f2fs_writepage(page, NODE); + + if (unlikely(f2fs_cp_error(sbi))) { ++ /* keep node pages in remount-ro mode */ ++ if (F2FS_OPTION(sbi).errors == MOUNT_ERRORS_READONLY) ++ goto redirty_out; + ClearPageUptodate(page); + dec_page_count(sbi, F2FS_DIRTY_NODES); + unlock_page(page); +diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c +index 9f15b03037dba..51812f4595813 100644 +--- a/fs/f2fs/super.c ++++ b/fs/f2fs/super.c +@@ -164,6 +164,7 @@ enum { + Opt_discard_unit, + Opt_memory_mode, + Opt_age_extent_cache, ++ Opt_errors, + Opt_err, + }; + +@@ -243,6 +244,7 @@ static match_table_t f2fs_tokens = { + {Opt_discard_unit, "discard_unit=%s"}, + {Opt_memory_mode, "memory=%s"}, + {Opt_age_extent_cache, "age_extent_cache"}, ++ {Opt_errors, "errors=%s"}, + {Opt_err, NULL}, + }; + +@@ -1268,6 +1270,25 @@ static int parse_options(struct super_block *sb, char *options, bool is_remount) + case Opt_age_extent_cache: + set_opt(sbi, AGE_EXTENT_CACHE); + break; ++ case Opt_errors: ++ name = match_strdup(&args[0]); ++ if (!name) ++ return -ENOMEM; ++ if (!strcmp(name, "remount-ro")) { ++ F2FS_OPTION(sbi).errors = ++ MOUNT_ERRORS_READONLY; ++ } else if (!strcmp(name, "continue")) { ++ F2FS_OPTION(sbi).errors = ++ MOUNT_ERRORS_CONTINUE; ++ } else if (!strcmp(name, "panic")) { ++ F2FS_OPTION(sbi).errors = ++ MOUNT_ERRORS_PANIC; ++ } else { ++ kfree(name); ++ return -EINVAL; ++ } ++ kfree(name); ++ break; + default: + f2fs_err(sbi, "Unrecognized mount option \"%s\" or missing value", + p); +@@ -1622,6 +1643,9 @@ static void f2fs_put_super(struct super_block *sb) + f2fs_destroy_node_manager(sbi); + f2fs_destroy_segment_manager(sbi); + ++ /* flush s_error_work before sbi destroy */ ++ flush_work(&sbi->s_error_work); ++ + f2fs_destroy_post_read_wq(sbi); + + kvfree(sbi->ckpt); +@@ -2052,6 +2076,13 @@ static int f2fs_show_options(struct seq_file *seq, struct dentry *root) + else if (F2FS_OPTION(sbi).memory_mode == MEMORY_MODE_LOW) + seq_printf(seq, ",memory=%s", "low"); + ++ if (F2FS_OPTION(sbi).errors == MOUNT_ERRORS_READONLY) ++ seq_printf(seq, ",errors=%s", "remount-ro"); ++ else if (F2FS_OPTION(sbi).errors == MOUNT_ERRORS_CONTINUE) ++ seq_printf(seq, ",errors=%s", "continue"); ++ else if (F2FS_OPTION(sbi).errors == MOUNT_ERRORS_PANIC) ++ seq_printf(seq, ",errors=%s", "panic"); ++ + return 0; + } + +@@ -2080,6 +2111,7 @@ static void default_options(struct f2fs_sb_info *sbi) + } + F2FS_OPTION(sbi).bggc_mode = BGGC_MODE_ON; + F2FS_OPTION(sbi).memory_mode = MEMORY_MODE_NORMAL; ++ F2FS_OPTION(sbi).errors = MOUNT_ERRORS_CONTINUE; + + sbi->sb->s_flags &= ~SB_INLINECRYPT; + +@@ -2281,6 +2313,9 @@ static int f2fs_remount(struct super_block *sb, int *flags, char *data) + if (err) + goto restore_opts; + ++ /* flush outstanding errors before changing fs state */ ++ flush_work(&sbi->s_error_work); ++ + /* + * Previous and new state of filesystem is RO, + * so skip checking GC and FLUSH_MERGE conditions. +@@ -3926,45 +3961,60 @@ int f2fs_commit_super(struct f2fs_sb_info *sbi, bool recover) + return err; + } + +-void f2fs_handle_stop(struct f2fs_sb_info *sbi, unsigned char reason) ++static void save_stop_reason(struct f2fs_sb_info *sbi, unsigned char reason) ++{ ++ unsigned long flags; ++ ++ spin_lock_irqsave(&sbi->error_lock, flags); ++ if (sbi->stop_reason[reason] < GENMASK(BITS_PER_BYTE - 1, 0)) ++ sbi->stop_reason[reason]++; ++ spin_unlock_irqrestore(&sbi->error_lock, flags); ++} ++ ++static void f2fs_record_stop_reason(struct f2fs_sb_info *sbi) + { + struct f2fs_super_block *raw_super = F2FS_RAW_SUPER(sbi); ++ unsigned long flags; + int err; + + f2fs_down_write(&sbi->sb_lock); + +- if (raw_super->s_stop_reason[reason] < GENMASK(BITS_PER_BYTE - 1, 0)) +- raw_super->s_stop_reason[reason]++; ++ spin_lock_irqsave(&sbi->error_lock, flags); ++ memcpy(raw_super->s_stop_reason, sbi->stop_reason, MAX_STOP_REASON); ++ spin_unlock_irqrestore(&sbi->error_lock, flags); + + err = f2fs_commit_super(sbi, false); +- if (err) +- f2fs_err(sbi, "f2fs_commit_super fails to record reason:%u err:%d", +- reason, err); ++ + f2fs_up_write(&sbi->sb_lock); ++ if (err) ++ f2fs_err(sbi, "f2fs_commit_super fails to record err:%d", err); + } + + void f2fs_save_errors(struct f2fs_sb_info *sbi, unsigned char flag) + { +- spin_lock(&sbi->error_lock); ++ unsigned long flags; ++ ++ spin_lock_irqsave(&sbi->error_lock, flags); + if (!test_bit(flag, (unsigned long *)sbi->errors)) { + set_bit(flag, (unsigned long *)sbi->errors); + sbi->error_dirty = true; + } +- spin_unlock(&sbi->error_lock); ++ spin_unlock_irqrestore(&sbi->error_lock, flags); + } + + static bool f2fs_update_errors(struct f2fs_sb_info *sbi) + { ++ unsigned long flags; + bool need_update = false; + +- spin_lock(&sbi->error_lock); ++ spin_lock_irqsave(&sbi->error_lock, flags); + if (sbi->error_dirty) { + memcpy(F2FS_RAW_SUPER(sbi)->s_errors, sbi->errors, + MAX_F2FS_ERRORS); + sbi->error_dirty = false; + need_update = true; + } +- spin_unlock(&sbi->error_lock); ++ spin_unlock_irqrestore(&sbi->error_lock, flags); + + return need_update; + } +@@ -3988,6 +4038,66 @@ void f2fs_handle_error(struct f2fs_sb_info *sbi, unsigned char error) + f2fs_up_write(&sbi->sb_lock); + } + ++static bool system_going_down(void) ++{ ++ return system_state == SYSTEM_HALT || system_state == SYSTEM_POWER_OFF ++ || system_state == SYSTEM_RESTART; ++} ++ ++void f2fs_handle_critical_error(struct f2fs_sb_info *sbi, unsigned char reason, ++ bool irq_context) ++{ ++ struct super_block *sb = sbi->sb; ++ bool shutdown = reason == STOP_CP_REASON_SHUTDOWN; ++ bool continue_fs = !shutdown && ++ F2FS_OPTION(sbi).errors == MOUNT_ERRORS_CONTINUE; ++ ++ set_ckpt_flags(sbi, CP_ERROR_FLAG); ++ ++ if (!f2fs_hw_is_readonly(sbi)) { ++ save_stop_reason(sbi, reason); ++ ++ if (irq_context && !shutdown) ++ schedule_work(&sbi->s_error_work); ++ else ++ f2fs_record_stop_reason(sbi); ++ } ++ ++ /* ++ * We force ERRORS_RO behavior when system is rebooting. Otherwise we ++ * could panic during 'reboot -f' as the underlying device got already ++ * disabled. ++ */ ++ if (F2FS_OPTION(sbi).errors == MOUNT_ERRORS_PANIC && ++ !shutdown && !system_going_down() && ++ !is_sbi_flag_set(sbi, SBI_IS_SHUTDOWN)) ++ panic("F2FS-fs (device %s): panic forced after error\n", ++ sb->s_id); ++ ++ if (shutdown) ++ set_sbi_flag(sbi, SBI_IS_SHUTDOWN); ++ ++ /* continue filesystem operators if errors=continue */ ++ if (continue_fs || f2fs_readonly(sb)) ++ return; ++ ++ f2fs_warn(sbi, "Remounting filesystem read-only"); ++ /* ++ * Make sure updated value of ->s_mount_flags will be visible before ++ * ->s_flags update ++ */ ++ smp_wmb(); ++ sb->s_flags |= SB_RDONLY; ++} ++ ++static void f2fs_record_error_work(struct work_struct *work) ++{ ++ struct f2fs_sb_info *sbi = container_of(work, ++ struct f2fs_sb_info, s_error_work); ++ ++ f2fs_record_stop_reason(sbi); ++} ++ + static int f2fs_scan_devices(struct f2fs_sb_info *sbi) + { + struct f2fs_super_block *raw_super = F2FS_RAW_SUPER(sbi); +@@ -4218,7 +4328,9 @@ static int f2fs_fill_super(struct super_block *sb, void *data, int silent) + sb->s_fs_info = sbi; + sbi->raw_super = raw_super; + ++ INIT_WORK(&sbi->s_error_work, f2fs_record_error_work); + memcpy(sbi->errors, raw_super->s_errors, MAX_F2FS_ERRORS); ++ memcpy(sbi->stop_reason, raw_super->s_stop_reason, MAX_STOP_REASON); + + /* precompute checksum seed for metadata */ + if (f2fs_sb_has_inode_chksum(sbi)) +@@ -4615,6 +4727,8 @@ static int f2fs_fill_super(struct super_block *sb, void *data, int silent) + f2fs_destroy_segment_manager(sbi); + stop_ckpt_thread: + f2fs_stop_ckpt_thread(sbi); ++ /* flush s_error_work before sbi destroy */ ++ flush_work(&sbi->s_error_work); + f2fs_destroy_post_read_wq(sbi); + free_devices: + destroy_device_list(sbi); +-- +2.39.2 + diff --git a/queue-6.4/fanotify-disallow-mount-sb-marks-on-kernel-internal-.patch b/queue-6.4/fanotify-disallow-mount-sb-marks-on-kernel-internal-.patch new file mode 100644 index 00000000000..0544e8df278 --- /dev/null +++ b/queue-6.4/fanotify-disallow-mount-sb-marks-on-kernel-internal-.patch @@ -0,0 +1,54 @@ +From 7a86bdcdb7369eae30a517e6e1879df375f0d513 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Jun 2023 07:20:44 +0300 +Subject: fanotify: disallow mount/sb marks on kernel internal pseudo fs + +From: Amir Goldstein + +[ Upstream commit 69562eb0bd3e6bb8e522a7b254334e0fb30dff0c ] + +Hopefully, nobody is trying to abuse mount/sb marks for watching all +anonymous pipes/inodes. + +I cannot think of a good reason to allow this - it looks like an +oversight that dated back to the original fanotify API. + +Link: https://lore.kernel.org/linux-fsdevel/20230628101132.kvchg544mczxv2pm@quack3/ +Fixes: 0ff21db9fcc3 ("fanotify: hooks the fanotify_mark syscall to the vfsmount code") +Signed-off-by: Amir Goldstein +Reviewed-by: Christian Brauner +Signed-off-by: Jan Kara +Message-Id: <20230629042044.25723-1-amir73il@gmail.com> +Signed-off-by: Sasha Levin +--- + fs/notify/fanotify/fanotify_user.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +diff --git a/fs/notify/fanotify/fanotify_user.c b/fs/notify/fanotify/fanotify_user.c +index 22fb1cf7e1fc5..f7e11ac763907 100644 +--- a/fs/notify/fanotify/fanotify_user.c ++++ b/fs/notify/fanotify/fanotify_user.c +@@ -1623,6 +1623,20 @@ static int fanotify_events_supported(struct fsnotify_group *group, + path->mnt->mnt_sb->s_type->fs_flags & FS_DISALLOW_NOTIFY_PERM) + return -EINVAL; + ++ /* ++ * mount and sb marks are not allowed on kernel internal pseudo fs, ++ * like pipe_mnt, because that would subscribe to events on all the ++ * anonynous pipes in the system. ++ * ++ * SB_NOUSER covers all of the internal pseudo fs whose objects are not ++ * exposed to user's mount namespace, but there are other SB_KERNMOUNT ++ * fs, like nsfs, debugfs, for which the value of allowing sb and mount ++ * mark is questionable. For now we leave them alone. ++ */ ++ if (mark_type != FAN_MARK_INODE && ++ path->mnt->mnt_sb->s_flags & SB_NOUSER) ++ return -EINVAL; ++ + /* + * We shouldn't have allowed setting dirent events and the directory + * flags FAN_ONDIR and FAN_EVENT_ON_CHILD in mask of non-dir inode, +-- +2.39.2 + diff --git a/queue-6.4/gfs2-fix-duplicate-should_fault_in_pages-call.patch b/queue-6.4/gfs2-fix-duplicate-should_fault_in_pages-call.patch new file mode 100644 index 00000000000..d36b71a6ae6 --- /dev/null +++ b/queue-6.4/gfs2-fix-duplicate-should_fault_in_pages-call.patch @@ -0,0 +1,43 @@ +From fc167ad98760525dae44bf6913726c6916544f46 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Jun 2023 12:26:23 -0500 +Subject: gfs2: Fix duplicate should_fault_in_pages() call + +From: Bob Peterson + +[ Upstream commit c8ed1b35931245087968fd95b2ec3dfc50f77769 ] + +In gfs2_file_buffered_write(), we currently jump from the second call of +function should_fault_in_pages() to above the first call, so +should_fault_in_pages() is getting called twice in a row, causing it to +accidentally fall back to single-page writes rather than trying the more +efficient multi-page writes first. + +Fix that by moving the retry label to the correct place, behind the +first call to should_fault_in_pages(). + +Fixes: e1fa9ea85ce8 ("gfs2: Stop using glock holder auto-demotion for now") +Signed-off-by: Bob Peterson +Signed-off-by: Andreas Gruenbacher +Signed-off-by: Sasha Levin +--- + fs/gfs2/file.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/gfs2/file.c b/fs/gfs2/file.c +index cb62c8f07d1e7..21335d1b67bf2 100644 +--- a/fs/gfs2/file.c ++++ b/fs/gfs2/file.c +@@ -1030,8 +1030,8 @@ static ssize_t gfs2_file_buffered_write(struct kiocb *iocb, + } + + gfs2_holder_init(ip->i_gl, LM_ST_EXCLUSIVE, 0, gh); +-retry: + if (should_fault_in_pages(from, iocb, &prev_count, &window_size)) { ++retry: + window_size -= fault_in_iov_iter_readable(from, window_size); + if (!window_size) { + ret = -EFAULT; +-- +2.39.2 + diff --git a/queue-6.4/hwtracing-hisi_ptt-fix-potential-sleep-in-atomic-con.patch b/queue-6.4/hwtracing-hisi_ptt-fix-potential-sleep-in-atomic-con.patch new file mode 100644 index 00000000000..a6c4bc398e0 --- /dev/null +++ b/queue-6.4/hwtracing-hisi_ptt-fix-potential-sleep-in-atomic-con.patch @@ -0,0 +1,96 @@ +From 8d820851abbc2c90b99309d1258711705542e928 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Jun 2023 17:28:04 +0800 +Subject: hwtracing: hisi_ptt: Fix potential sleep in atomic context + +From: Yicong Yang + +[ Upstream commit 6c50384ef8b94a527445e3694ae6549e1f15d859 ] + +We're using pci_irq_vector() to obtain the interrupt number and then +bind it to the CPU start perf under the protection of spinlock in +pmu::start(). pci_irq_vector() might sleep since [1] because it will +call msi_domain_get_virq() to get the MSI interrupt number and it +needs to acquire dev->msi.data->mutex. Getting a mutex will sleep on +contention. So use pci_irq_vector() in an atomic context is problematic. + +This patch cached the interrupt number in the probe() and uses the +cached data instead to avoid potential sleep. + +[1] commit 82ff8e6b78fc ("PCI/MSI: Use msi_get_virq() in pci_get_vector()") + +Fixes: ff0de066b463 ("hwtracing: hisi_ptt: Add trace function support for HiSilicon PCIe Tune and Trace device") +Reviewed-by: Jonathan Cameron +Signed-off-by: Yicong Yang +Signed-off-by: Suzuki K Poulose +Link: https://lore.kernel.org/r/20230621092804.15120-6-yangyicong@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/ptt/hisi_ptt.c | 12 +++++------- + drivers/hwtracing/ptt/hisi_ptt.h | 2 ++ + 2 files changed, 7 insertions(+), 7 deletions(-) + +diff --git a/drivers/hwtracing/ptt/hisi_ptt.c b/drivers/hwtracing/ptt/hisi_ptt.c +index 30f1525639b57..4140efd664097 100644 +--- a/drivers/hwtracing/ptt/hisi_ptt.c ++++ b/drivers/hwtracing/ptt/hisi_ptt.c +@@ -341,13 +341,13 @@ static int hisi_ptt_register_irq(struct hisi_ptt *hisi_ptt) + if (ret < 0) + return ret; + +- ret = devm_request_threaded_irq(&pdev->dev, +- pci_irq_vector(pdev, HISI_PTT_TRACE_DMA_IRQ), ++ hisi_ptt->trace_irq = pci_irq_vector(pdev, HISI_PTT_TRACE_DMA_IRQ); ++ ret = devm_request_threaded_irq(&pdev->dev, hisi_ptt->trace_irq, + NULL, hisi_ptt_isr, 0, + DRV_NAME, hisi_ptt); + if (ret) { + pci_err(pdev, "failed to request irq %d, ret = %d\n", +- pci_irq_vector(pdev, HISI_PTT_TRACE_DMA_IRQ), ret); ++ hisi_ptt->trace_irq, ret); + return ret; + } + +@@ -757,8 +757,7 @@ static void hisi_ptt_pmu_start(struct perf_event *event, int flags) + * core in event_function_local(). If CPU passed is offline we'll fail + * here, just log it since we can do nothing here. + */ +- ret = irq_set_affinity(pci_irq_vector(hisi_ptt->pdev, HISI_PTT_TRACE_DMA_IRQ), +- cpumask_of(cpu)); ++ ret = irq_set_affinity(hisi_ptt->trace_irq, cpumask_of(cpu)); + if (ret) + dev_warn(dev, "failed to set the affinity of trace interrupt\n"); + +@@ -1018,8 +1017,7 @@ static int hisi_ptt_cpu_teardown(unsigned int cpu, struct hlist_node *node) + * Also make sure the interrupt bind to the migrated CPU as well. Warn + * the user on failure here. + */ +- if (irq_set_affinity(pci_irq_vector(hisi_ptt->pdev, HISI_PTT_TRACE_DMA_IRQ), +- cpumask_of(target))) ++ if (irq_set_affinity(hisi_ptt->trace_irq, cpumask_of(target))) + dev_warn(dev, "failed to set the affinity of trace interrupt\n"); + + hisi_ptt->trace_ctrl.on_cpu = target; +diff --git a/drivers/hwtracing/ptt/hisi_ptt.h b/drivers/hwtracing/ptt/hisi_ptt.h +index 5beb1648c93ab..948a4c4231527 100644 +--- a/drivers/hwtracing/ptt/hisi_ptt.h ++++ b/drivers/hwtracing/ptt/hisi_ptt.h +@@ -166,6 +166,7 @@ struct hisi_ptt_pmu_buf { + * @pdev: pci_dev of this PTT device + * @tune_lock: lock to serialize the tune process + * @pmu_lock: lock to serialize the perf process ++ * @trace_irq: interrupt number used by trace + * @upper_bdf: the upper BDF range of the PCI devices managed by this PTT device + * @lower_bdf: the lower BDF range of the PCI devices managed by this PTT device + * @port_filters: the filter list of root ports +@@ -180,6 +181,7 @@ struct hisi_ptt { + struct pci_dev *pdev; + struct mutex tune_lock; + spinlock_t pmu_lock; ++ int trace_irq; + u32 upper_bdf; + u32 lower_bdf; + +-- +2.39.2 + diff --git a/queue-6.4/i2c-xiic-don-t-try-to-handle-more-interrupt-events-a.patch b/queue-6.4/i2c-xiic-don-t-try-to-handle-more-interrupt-events-a.patch new file mode 100644 index 00000000000..142b79b3be9 --- /dev/null +++ b/queue-6.4/i2c-xiic-don-t-try-to-handle-more-interrupt-events-a.patch @@ -0,0 +1,60 @@ +From 5421636d8b68c96cb1e4744e4e463b611bb91ec9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Jun 2023 12:25:58 -0600 +Subject: i2c: xiic: Don't try to handle more interrupt events after error + +From: Robert Hancock + +[ Upstream commit cb6e45c9a0ad9e0f8664fd06db0227d185dc76ab ] + +In xiic_process, it is possible that error events such as arbitration +lost or TX error can be raised in conjunction with other interrupt flags +such as TX FIFO empty or bus not busy. Error events result in the +controller being reset and the error returned to the calling request, +but the function could potentially try to keep handling the other +events, such as by writing more messages into the TX FIFO. Since the +transaction has already failed, this is not helpful and will just cause +issues. + +This problem has been present ever since: + +commit 7f9906bd7f72 ("i2c: xiic: Service all interrupts in isr") + +which allowed non-error events to be handled after errors, but became +more obvious after: + +commit 743e227a8959 ("i2c: xiic: Defer xiic_wakeup() and +__xiic_start_xfer() in xiic_process()") + +which reworked the code to add a WARN_ON which triggers if both the +xfer_more and wakeup_req flags were set, since this combination is +not supposed to happen, but was occurring in this scenario. + +Skip further interrupt handling after error flags are detected to avoid +this problem. + +Fixes: 7f9906bd7f72 ("i2c: xiic: Service all interrupts in isr") +Signed-off-by: Robert Hancock +Acked-by: Andi Shyti +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-xiic.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/i2c/busses/i2c-xiic.c b/drivers/i2c/busses/i2c-xiic.c +index 8a3d9817cb41c..ee6edc963deac 100644 +--- a/drivers/i2c/busses/i2c-xiic.c ++++ b/drivers/i2c/busses/i2c-xiic.c +@@ -721,6 +721,8 @@ static irqreturn_t xiic_process(int irq, void *dev_id) + wakeup_req = 1; + wakeup_code = STATE_ERROR; + } ++ /* don't try to handle other events */ ++ goto out; + } + if (pend & XIIC_INTR_RX_FULL_MASK) { + /* Receive register/FIFO is full */ +-- +2.39.2 + diff --git a/queue-6.4/i3c-master-svc-fix-cpu-schedule-in-spin-lock.patch b/queue-6.4/i3c-master-svc-fix-cpu-schedule-in-spin-lock.patch new file mode 100644 index 00000000000..99429b9c56a --- /dev/null +++ b/queue-6.4/i3c-master-svc-fix-cpu-schedule-in-spin-lock.patch @@ -0,0 +1,78 @@ +From 24b569214a16c94e5d9e6e469109b73ce5daedb9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 May 2023 11:30:29 +0800 +Subject: i3c: master: svc: fix cpu schedule in spin lock + +From: Clark Wang + +[ Upstream commit 33beadb3b1ab74e69db2c49d9663f3a93a273943 ] + +pm_runtime_resume_and_get() may call sleep(). It cannot be used in +svc_i3c_master_start_xfer_locked(), because it is in a spin lock. + +Move the pm runtime operations to svc_i3c_master_enqueue_xfer(). + +Signed-off-by: Clark Wang +Fixes: 05be23ef78f7 ("i3c: master: svc: add runtime pm support") +Reviewed-by: Miquel Raynal +Link: https://lore.kernel.org/r/20230517033030.3068085-2-xiaoning.wang@nxp.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/i3c/master/svc-i3c-master.c | 19 ++++++++++--------- + 1 file changed, 10 insertions(+), 9 deletions(-) + +diff --git a/drivers/i3c/master/svc-i3c-master.c b/drivers/i3c/master/svc-i3c-master.c +index e3f454123805e..79b08942a925d 100644 +--- a/drivers/i3c/master/svc-i3c-master.c ++++ b/drivers/i3c/master/svc-i3c-master.c +@@ -1090,12 +1090,6 @@ static void svc_i3c_master_start_xfer_locked(struct svc_i3c_master *master) + if (!xfer) + return; + +- ret = pm_runtime_resume_and_get(master->dev); +- if (ret < 0) { +- dev_err(master->dev, "<%s> Cannot get runtime PM.\n", __func__); +- return; +- } +- + svc_i3c_master_clear_merrwarn(master); + svc_i3c_master_flush_fifo(master); + +@@ -1110,9 +1104,6 @@ static void svc_i3c_master_start_xfer_locked(struct svc_i3c_master *master) + break; + } + +- pm_runtime_mark_last_busy(master->dev); +- pm_runtime_put_autosuspend(master->dev); +- + xfer->ret = ret; + complete(&xfer->comp); + +@@ -1133,6 +1124,13 @@ static void svc_i3c_master_enqueue_xfer(struct svc_i3c_master *master, + struct svc_i3c_xfer *xfer) + { + unsigned long flags; ++ int ret; ++ ++ ret = pm_runtime_resume_and_get(master->dev); ++ if (ret < 0) { ++ dev_err(master->dev, "<%s> Cannot get runtime PM.\n", __func__); ++ return; ++ } + + init_completion(&xfer->comp); + spin_lock_irqsave(&master->xferqueue.lock, flags); +@@ -1143,6 +1141,9 @@ static void svc_i3c_master_enqueue_xfer(struct svc_i3c_master *master, + svc_i3c_master_start_xfer_locked(master); + } + spin_unlock_irqrestore(&master->xferqueue.lock, flags); ++ ++ pm_runtime_mark_last_busy(master->dev); ++ pm_runtime_put_autosuspend(master->dev); + } + + static bool +-- +2.39.2 + diff --git a/queue-6.4/ibmvnic-do-not-reset-dql-stats-on-non_fatal-err.patch b/queue-6.4/ibmvnic-do-not-reset-dql-stats-on-non_fatal-err.patch new file mode 100644 index 00000000000..7fc41b11319 --- /dev/null +++ b/queue-6.4/ibmvnic-do-not-reset-dql-stats-on-non_fatal-err.patch @@ -0,0 +1,82 @@ +From 8342e0704dc73a6792f994e398deb060b723f1c4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Jun 2023 13:22:44 -0500 +Subject: ibmvnic: Do not reset dql stats on NON_FATAL err + +From: Nick Child + +[ Upstream commit 48538ccb825b05544ec308a509e2cc9c013402db ] + +All ibmvnic resets, make a call to netdev_tx_reset_queue() when +re-opening the device. netdev_tx_reset_queue() resets the num_queued +and num_completed byte counters. These stats are used in Byte Queue +Limit (BQL) algorithms. The difference between these two stats tracks +the number of bytes currently sitting on the physical NIC. ibmvnic +increases the number of queued bytes though calls to +netdev_tx_sent_queue() in the drivers xmit function. When, VIOS reports +that it is done transmitting bytes, the ibmvnic device increases the +number of completed bytes through calls to netdev_tx_completed_queue(). +It is important to note that the driver batches its transmit calls and +num_queued is increased every time that an skb is added to the next +batch, not necessarily when the batch is sent to VIOS for transmission. + +Unlike other reset types, a NON FATAL reset will not flush the sub crq +tx buffers. Therefore, it is possible for the batched skb array to be +partially full. So if there is call to netdev_tx_reset_queue() when +re-opening the device, the value of num_queued (0) would not account +for the skb's that are currently batched. Eventually, when the batch +is sent to VIOS, the call to netdev_tx_completed_queue() would increase +num_completed to a value greater than the num_queued. This causes a +BUG_ON crash: + +ibmvnic 30000002: Firmware reports error, cause: adapter problem. +Starting recovery... +ibmvnic 30000002: tx error 600 +ibmvnic 30000002: tx error 600 +ibmvnic 30000002: tx error 600 +ibmvnic 30000002: tx error 600 +------------[ cut here ]------------ +kernel BUG at lib/dynamic_queue_limits.c:27! +Oops: Exception in kernel mode, sig: 5 +[....] +NIP dql_completed+0x28/0x1c0 +LR ibmvnic_complete_tx.isra.0+0x23c/0x420 [ibmvnic] +Call Trace: +ibmvnic_complete_tx.isra.0+0x3f8/0x420 [ibmvnic] (unreliable) +ibmvnic_interrupt_tx+0x40/0x70 [ibmvnic] +__handle_irq_event_percpu+0x98/0x270 +---[ end trace ]--- + +Therefore, do not reset the dql stats when performing a NON_FATAL reset. + +Fixes: 0d973388185d ("ibmvnic: Introduce xmit_more support using batched subCRQ hcalls") +Signed-off-by: Nick Child +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/ibm/ibmvnic.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c +index c63d3ec9d3284..763d613adbcc0 100644 +--- a/drivers/net/ethernet/ibm/ibmvnic.c ++++ b/drivers/net/ethernet/ibm/ibmvnic.c +@@ -1816,7 +1816,14 @@ static int __ibmvnic_open(struct net_device *netdev) + if (prev_state == VNIC_CLOSED) + enable_irq(adapter->tx_scrq[i]->irq); + enable_scrq_irq(adapter, adapter->tx_scrq[i]); +- netdev_tx_reset_queue(netdev_get_tx_queue(netdev, i)); ++ /* netdev_tx_reset_queue will reset dql stats. During NON_FATAL ++ * resets, don't reset the stats because there could be batched ++ * skb's waiting to be sent. If we reset dql stats, we risk ++ * num_completed being greater than num_queued. This will cause ++ * a BUG_ON in dql_completed(). ++ */ ++ if (adapter->reset_reason != VNIC_RESET_NON_FATAL) ++ netdev_tx_reset_queue(netdev_get_tx_queue(netdev, i)); + } + + rc = set_link_state(adapter, IBMVNIC_LOGICAL_LNK_UP); +-- +2.39.2 + diff --git a/queue-6.4/interconnect-qcom-rpm-don-t-use-clk_get_optional-for.patch b/queue-6.4/interconnect-qcom-rpm-don-t-use-clk_get_optional-for.patch new file mode 100644 index 00000000000..8e6d4d51c79 --- /dev/null +++ b/queue-6.4/interconnect-qcom-rpm-don-t-use-clk_get_optional-for.patch @@ -0,0 +1,42 @@ +From d8a5111bafff346389b53af943e23780ce84a637 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Apr 2023 22:14:49 +0200 +Subject: interconnect: qcom: rpm: Don't use clk_get_optional for bus clocks + anymore + +From: Konrad Dybcio + +[ Upstream commit 1ff7aedcdcdd4fe02201269ab428b09491e5cf6e ] + +Commit dd42ec8ea5b9 ("interconnect: qcom: rpm: Use _optional func for provider clocks") +relaxed the requirements around probing bus clocks. This was a decent +solution for making sure MSM8996 would still boot with old DTs, but +now that there's a proper fix in place that both old and new DTs +will be happy about, revert back to the safer variant of the +function. + +Fixes: dd42ec8ea5b9 ("interconnect: qcom: rpm: Use _optional func for provider clocks") +Signed-off-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20230228-topic-qos-v8-7-ee696a2c15a9@linaro.org +Signed-off-by: Georgi Djakov +Signed-off-by: Sasha Levin +--- + drivers/interconnect/qcom/icc-rpm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/interconnect/qcom/icc-rpm.c b/drivers/interconnect/qcom/icc-rpm.c +index ec39861c1764c..8d3138e8c1ee3 100644 +--- a/drivers/interconnect/qcom/icc-rpm.c ++++ b/drivers/interconnect/qcom/icc-rpm.c +@@ -494,7 +494,7 @@ int qnoc_probe(struct platform_device *pdev) + } + + regmap_done: +- ret = devm_clk_bulk_get_optional(dev, qp->num_bus_clks, qp->bus_clks); ++ ret = devm_clk_bulk_get(dev, qp->num_bus_clks, qp->bus_clks); + if (ret) + return ret; + +-- +2.39.2 + diff --git a/queue-6.4/interconnect-qcom-rpm-rename-icc-provider-num_clocks.patch b/queue-6.4/interconnect-qcom-rpm-rename-icc-provider-num_clocks.patch new file mode 100644 index 00000000000..c9c0b94cdd1 --- /dev/null +++ b/queue-6.4/interconnect-qcom-rpm-rename-icc-provider-num_clocks.patch @@ -0,0 +1,102 @@ +From 73aff5edd8d4a06f707d78898741d04347cf411b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Apr 2023 22:14:44 +0200 +Subject: interconnect: qcom: rpm: Rename icc provider num_clocks to + num_bus_clocks + +From: Konrad Dybcio + +[ Upstream commit 1a12928e25627e02126ad2d1c12cfdba79d6bd94 ] + +In preparation for handling non-scaling clocks that we still have to +enable, rename num_clocks to more descriptive num_bus_clocks. + +Signed-off-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20230228-topic-qos-v8-2-ee696a2c15a9@linaro.org +Signed-off-by: Georgi Djakov +Stable-dep-of: 1ff7aedcdcdd ("interconnect: qcom: rpm: Don't use clk_get_optional for bus clocks anymore") +Signed-off-by: Sasha Levin +--- + drivers/interconnect/qcom/icc-rpm.c | 12 ++++++------ + drivers/interconnect/qcom/icc-rpm.h | 4 ++-- + 2 files changed, 8 insertions(+), 8 deletions(-) + +diff --git a/drivers/interconnect/qcom/icc-rpm.c b/drivers/interconnect/qcom/icc-rpm.c +index 5341fa169dbf1..ec39861c1764c 100644 +--- a/drivers/interconnect/qcom/icc-rpm.c ++++ b/drivers/interconnect/qcom/icc-rpm.c +@@ -379,7 +379,7 @@ static int qcom_icc_set(struct icc_node *src, struct icc_node *dst) + return ret; + } + +- for (i = 0; i < qp->num_clks; i++) { ++ for (i = 0; i < qp->num_bus_clks; i++) { + /* + * Use WAKE bucket for active clock, otherwise, use SLEEP bucket + * for other clocks. If a platform doesn't set interconnect +@@ -464,7 +464,7 @@ int qnoc_probe(struct platform_device *pdev) + + for (i = 0; i < cd_num; i++) + qp->bus_clks[i].id = cds[i]; +- qp->num_clks = cd_num; ++ qp->num_bus_clks = cd_num; + + qp->type = desc->type; + qp->qos_offset = desc->qos_offset; +@@ -494,11 +494,11 @@ int qnoc_probe(struct platform_device *pdev) + } + + regmap_done: +- ret = devm_clk_bulk_get_optional(dev, qp->num_clks, qp->bus_clks); ++ ret = devm_clk_bulk_get_optional(dev, qp->num_bus_clks, qp->bus_clks); + if (ret) + return ret; + +- ret = clk_bulk_prepare_enable(qp->num_clks, qp->bus_clks); ++ ret = clk_bulk_prepare_enable(qp->num_bus_clks, qp->bus_clks); + if (ret) + return ret; + +@@ -551,7 +551,7 @@ int qnoc_probe(struct platform_device *pdev) + icc_provider_deregister(provider); + err_remove_nodes: + icc_nodes_remove(provider); +- clk_bulk_disable_unprepare(qp->num_clks, qp->bus_clks); ++ clk_bulk_disable_unprepare(qp->num_bus_clks, qp->bus_clks); + + return ret; + } +@@ -563,7 +563,7 @@ int qnoc_remove(struct platform_device *pdev) + + icc_provider_deregister(&qp->provider); + icc_nodes_remove(&qp->provider); +- clk_bulk_disable_unprepare(qp->num_clks, qp->bus_clks); ++ clk_bulk_disable_unprepare(qp->num_bus_clks, qp->bus_clks); + + return 0; + } +diff --git a/drivers/interconnect/qcom/icc-rpm.h b/drivers/interconnect/qcom/icc-rpm.h +index 22bdb1e4bb123..838f3fa82278e 100644 +--- a/drivers/interconnect/qcom/icc-rpm.h ++++ b/drivers/interconnect/qcom/icc-rpm.h +@@ -23,7 +23,7 @@ enum qcom_icc_type { + /** + * struct qcom_icc_provider - Qualcomm specific interconnect provider + * @provider: generic interconnect provider +- * @num_clks: the total number of clk_bulk_data entries ++ * @num_bus_clks: the total number of bus_clks clk_bulk_data entries + * @type: the ICC provider type + * @regmap: regmap for QoS registers read/write access + * @qos_offset: offset to QoS registers +@@ -32,7 +32,7 @@ enum qcom_icc_type { + */ + struct qcom_icc_provider { + struct icc_provider provider; +- int num_clks; ++ int num_bus_clks; + enum qcom_icc_type type; + struct regmap *regmap; + unsigned int qos_offset; +-- +2.39.2 + diff --git a/queue-6.4/kernfs-fix-missing-kernfs_idr_lock-to-remove-an-id-f.patch b/queue-6.4/kernfs-fix-missing-kernfs_idr_lock-to-remove-an-id-f.patch new file mode 100644 index 00000000000..b492adc036e --- /dev/null +++ b/queue-6.4/kernfs-fix-missing-kernfs_idr_lock-to-remove-an-id-f.patch @@ -0,0 +1,39 @@ +From d36ee012fa013c53e4990db2f5b3ffb96d7edcd7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 May 2023 10:40:17 +0800 +Subject: kernfs: fix missing kernfs_idr_lock to remove an ID from the IDR + +From: Muchun Song + +[ Upstream commit 30480b988f88c279752f3202a26b6fee5f586aef ] + +The root->ino_idr is supposed to be protected by kernfs_idr_lock, fix +it. + +Fixes: 488dee96bb62 ("kernfs: allow creating kernfs objects with arbitrary uid/gid") +Signed-off-by: Muchun Song +Acked-by: Tejun Heo +Link: https://lore.kernel.org/r/20230523024017.24851-1-songmuchun@bytedance.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + fs/kernfs/dir.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/fs/kernfs/dir.c b/fs/kernfs/dir.c +index 45b6919903e6b..5a1a4af9d3d29 100644 +--- a/fs/kernfs/dir.c ++++ b/fs/kernfs/dir.c +@@ -655,7 +655,9 @@ static struct kernfs_node *__kernfs_new_node(struct kernfs_root *root, + return kn; + + err_out3: ++ spin_lock(&kernfs_idr_lock); + idr_remove(&root->ino_idr, (u32)kernfs_ino(kn)); ++ spin_unlock(&kernfs_idr_lock); + err_out2: + kmem_cache_free(kernfs_node_cache, kn); + err_out1: +-- +2.39.2 + diff --git a/queue-6.4/kvm-s390-diag-fix-racy-access-of-physical-cpu-number.patch b/queue-6.4/kvm-s390-diag-fix-racy-access-of-physical-cpu-number.patch new file mode 100644 index 00000000000..7ade2a748a2 --- /dev/null +++ b/queue-6.4/kvm-s390-diag-fix-racy-access-of-physical-cpu-number.patch @@ -0,0 +1,60 @@ +From bae0036b51963a467b99e02a574182c145afafaa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 May 2023 10:42:34 +0200 +Subject: KVM: s390/diag: fix racy access of physical cpu number in diag 9c + handler + +From: Christian Borntraeger + +[ Upstream commit 0bc380beb78aa352eadbc21d934dd9606fcee808 ] + +We do check for target CPU == -1, but this might change at the time we +are going to use it. Hold the physical target CPU in a local variable to +avoid out-of-bound accesses to the cpu arrays. + +Cc: Pierre Morel +Fixes: 87e28a15c42c ("KVM: s390: diag9c (directed yield) forwarding") +Reported-by: Marc Hartmayer +Reviewed-by: Nico Boehr +Reviewed-by: Pierre Morel +Signed-off-by: Christian Borntraeger +Signed-off-by: Janosch Frank +Signed-off-by: Sasha Levin +--- + arch/s390/kvm/diag.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/arch/s390/kvm/diag.c b/arch/s390/kvm/diag.c +index 807fa9da1e721..3c65b8258ae67 100644 +--- a/arch/s390/kvm/diag.c ++++ b/arch/s390/kvm/diag.c +@@ -166,6 +166,7 @@ static int diag9c_forwarding_overrun(void) + static int __diag_time_slice_end_directed(struct kvm_vcpu *vcpu) + { + struct kvm_vcpu *tcpu; ++ int tcpu_cpu; + int tid; + + tid = vcpu->run->s.regs.gprs[(vcpu->arch.sie_block->ipa & 0xf0) >> 4]; +@@ -181,14 +182,15 @@ static int __diag_time_slice_end_directed(struct kvm_vcpu *vcpu) + goto no_yield; + + /* target guest VCPU already running */ +- if (READ_ONCE(tcpu->cpu) >= 0) { ++ tcpu_cpu = READ_ONCE(tcpu->cpu); ++ if (tcpu_cpu >= 0) { + if (!diag9c_forwarding_hz || diag9c_forwarding_overrun()) + goto no_yield; + + /* target host CPU already running */ +- if (!vcpu_is_preempted(tcpu->cpu)) ++ if (!vcpu_is_preempted(tcpu_cpu)) + goto no_yield; +- smp_yield_cpu(tcpu->cpu); ++ smp_yield_cpu(tcpu_cpu); + VCPU_EVENT(vcpu, 5, + "diag time slice end directed to %d: yield forwarded", + tid); +-- +2.39.2 + diff --git a/queue-6.4/kvm-s390-fix-kvm_s390_get_cmma_bits-for-gfns-in-mems.patch b/queue-6.4/kvm-s390-fix-kvm_s390_get_cmma_bits-for-gfns-in-mems.patch new file mode 100644 index 00000000000..c5a3d7fe907 --- /dev/null +++ b/queue-6.4/kvm-s390-fix-kvm_s390_get_cmma_bits-for-gfns-in-mems.patch @@ -0,0 +1,74 @@ +From d5bf6408318a0a102b4e2d717e604e437e98d566 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Mar 2023 15:54:23 +0100 +Subject: KVM: s390: fix KVM_S390_GET_CMMA_BITS for GFNs in memslot holes + +From: Nico Boehr + +[ Upstream commit 285cff4c0454340a4dc53f46e67f2cb1c293bd74 ] + +The KVM_S390_GET_CMMA_BITS ioctl may return incorrect values when userspace +specifies a start_gfn outside of memslots. + +This can occur when a VM has multiple memslots with a hole in between: + ++-----+----------+--------+--------+ +| ... | Slot N-1 | | Slot N | ++-----+----------+--------+--------+ + ^ ^ ^ ^ + | | | | +GFN A A+B | | + A+B+C | + A+B+C+D + +When userspace specifies a GFN in [A+B, A+B+C), it would expect to get the +CMMA values of the first dirty page in Slot N. However, userspace may get a +start_gfn of A+B+C+D with a count of 0, hence completely skipping over any +dirty pages in slot N. + +The error is in kvm_s390_next_dirty_cmma(), which assumes +gfn_to_memslot_approx() will return the memslot _below_ the specified GFN +when the specified GFN lies outside a memslot. In reality it may return +either the memslot below or above the specified GFN. + +When a memslot above the specified GFN is returned this happens: + +- ofs is calculated, but since the memslot's base_gfn is larger than the + specified cur_gfn, ofs will underflow to a huge number. +- ofs is passed to find_next_bit(). Since ofs will exceed the memslot's + number of pages, the number of pages in the memslot is returned, + completely skipping over all bits in the memslot userspace would be + interested in. + +Fix this by resetting ofs to zero when a memslot _above_ cur_gfn is +returned (cur_gfn < ms->base_gfn). + +Signed-off-by: Nico Boehr +Reviewed-by: Claudio Imbrenda +Fixes: afdad61615cc ("KVM: s390: Fix storage attributes migration with memory slots") +Message-Id: <20230324145424.293889-2-nrb@linux.ibm.com> +Signed-off-by: Claudio Imbrenda +Signed-off-by: Janosch Frank +Signed-off-by: Sasha Levin +--- + arch/s390/kvm/kvm-s390.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c +index 17b81659cdb20..6700196964648 100644 +--- a/arch/s390/kvm/kvm-s390.c ++++ b/arch/s390/kvm/kvm-s390.c +@@ -2156,6 +2156,10 @@ static unsigned long kvm_s390_next_dirty_cmma(struct kvm_memslots *slots, + ms = container_of(mnode, struct kvm_memory_slot, gfn_node[slots->node_idx]); + ofs = 0; + } ++ ++ if (cur_gfn < ms->base_gfn) ++ ofs = 0; ++ + ofs = find_next_bit(kvm_second_dirty_bitmap(ms), ms->npages, ofs); + while (ofs >= ms->npages && (mnode = rb_next(mnode))) { + ms = container_of(mnode, struct kvm_memory_slot, gfn_node[slots->node_idx]); +-- +2.39.2 + diff --git a/queue-6.4/kvm-s390-vsie-fix-the-length-of-apcb-bitmap.patch b/queue-6.4/kvm-s390-vsie-fix-the-length-of-apcb-bitmap.patch new file mode 100644 index 00000000000..5e6387ca749 --- /dev/null +++ b/queue-6.4/kvm-s390-vsie-fix-the-length-of-apcb-bitmap.patch @@ -0,0 +1,52 @@ +From b7da2f58d43cbb8469bf8e12a0097748aa062cf0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 May 2023 17:42:58 +0200 +Subject: KVM: s390: vsie: fix the length of APCB bitmap + +From: Pierre Morel + +[ Upstream commit 246be7d2720ea9a795b576067ecc5e5c7a1e7848 ] + +bit_and() uses the count of bits as the woking length. +Fix the previous implementation and effectively use +the right bitmap size. + +Fixes: 19fd83a64718 ("KVM: s390: vsie: allow CRYCB FORMAT-1") +Fixes: 56019f9aca22 ("KVM: s390: vsie: Allow CRYCB FORMAT-2") + +Signed-off-by: Pierre Morel +Reviewed-by: Janosch Frank +Link: https://lore.kernel.org/kvm/20230511094719.9691-1-pmorel@linux.ibm.com/ +Signed-off-by: Janosch Frank +Signed-off-by: Sasha Levin +--- + arch/s390/kvm/vsie.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/arch/s390/kvm/vsie.c b/arch/s390/kvm/vsie.c +index 8d6b765abf29b..0333ee482eb89 100644 +--- a/arch/s390/kvm/vsie.c ++++ b/arch/s390/kvm/vsie.c +@@ -177,7 +177,8 @@ static int setup_apcb00(struct kvm_vcpu *vcpu, unsigned long *apcb_s, + sizeof(struct kvm_s390_apcb0))) + return -EFAULT; + +- bitmap_and(apcb_s, apcb_s, apcb_h, sizeof(struct kvm_s390_apcb0)); ++ bitmap_and(apcb_s, apcb_s, apcb_h, ++ BITS_PER_BYTE * sizeof(struct kvm_s390_apcb0)); + + return 0; + } +@@ -203,7 +204,8 @@ static int setup_apcb11(struct kvm_vcpu *vcpu, unsigned long *apcb_s, + sizeof(struct kvm_s390_apcb1))) + return -EFAULT; + +- bitmap_and(apcb_s, apcb_s, apcb_h, sizeof(struct kvm_s390_apcb1)); ++ bitmap_and(apcb_s, apcb_s, apcb_h, ++ BITS_PER_BYTE * sizeof(struct kvm_s390_apcb1)); + + return 0; + } +-- +2.39.2 + diff --git a/queue-6.4/lib-bitmap-drop-optimization-of-bitmap_-from-to-_arr.patch b/queue-6.4/lib-bitmap-drop-optimization-of-bitmap_-from-to-_arr.patch new file mode 100644 index 00000000000..348c17b5d9f --- /dev/null +++ b/queue-6.4/lib-bitmap-drop-optimization-of-bitmap_-from-to-_arr.patch @@ -0,0 +1,75 @@ +From 652c15b135e8e0e0922f7097ec5eebbed6966040 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Feb 2023 11:24:36 -0800 +Subject: lib/bitmap: drop optimization of bitmap_{from,to}_arr64 + +From: Yury Norov + +[ Upstream commit c1d2ba10f594046831d14b03f194e8d05e78abad ] + +bitmap_{from,to}_arr64() optimization is overly optimistic on 32-bit LE +architectures when it's wired to bitmap_copy_clear_tail(). + +bitmap_copy_clear_tail() takes care of unused bits in the bitmap up to +the next word boundary. But on 32-bit machines when copying bits from +bitmap to array of 64-bit words, it's expected that the unused part of +a recipient array must be cleared up to 64-bit boundary, so the last 4 +bytes may stay untouched when nbits % 64 <= 32. + +While the copying part of the optimization works correct, that clear-tail +trick makes corresponding tests reasonably fail: + +test_bitmap: bitmap_to_arr64(nbits == 1): tail is not safely cleared: 0xa5a5a5a500000001 (must be 0x0000000000000001) + +Fix it by removing bitmap_{from,to}_arr64() optimization for 32-bit LE +arches. + +Reported-by: Guenter Roeck +Link: https://lore.kernel.org/lkml/20230225184702.GA3587246@roeck-us.net/ +Fixes: 0a97953fd221 ("lib: add bitmap_{from,to}_arr64") +Signed-off-by: Yury Norov +Tested-by: Guenter Roeck +Reviewed-by: Andy Shevchenko +Reviewed-by: Alexander Lobakin +Signed-off-by: Sasha Levin +--- + include/linux/bitmap.h | 8 +++----- + lib/bitmap.c | 2 +- + 2 files changed, 4 insertions(+), 6 deletions(-) + +diff --git a/include/linux/bitmap.h b/include/linux/bitmap.h +index 7d6d73b781472..03644237e1efb 100644 +--- a/include/linux/bitmap.h ++++ b/include/linux/bitmap.h +@@ -302,12 +302,10 @@ void bitmap_to_arr32(u32 *buf, const unsigned long *bitmap, + #endif + + /* +- * On 64-bit systems bitmaps are represented as u64 arrays internally. On LE32 +- * machines the order of hi and lo parts of numbers match the bitmap structure. +- * In both cases conversion is not needed when copying data from/to arrays of +- * u64. ++ * On 64-bit systems bitmaps are represented as u64 arrays internally. So, ++ * the conversion is not needed when copying data from/to arrays of u64. + */ +-#if (BITS_PER_LONG == 32) && defined(__BIG_ENDIAN) ++#if BITS_PER_LONG == 32 + void bitmap_from_arr64(unsigned long *bitmap, const u64 *buf, unsigned int nbits); + void bitmap_to_arr64(u64 *buf, const unsigned long *bitmap, unsigned int nbits); + #else +diff --git a/lib/bitmap.c b/lib/bitmap.c +index 1c81413c51f86..ddb31015e38ae 100644 +--- a/lib/bitmap.c ++++ b/lib/bitmap.c +@@ -1495,7 +1495,7 @@ void bitmap_to_arr32(u32 *buf, const unsigned long *bitmap, unsigned int nbits) + EXPORT_SYMBOL(bitmap_to_arr32); + #endif + +-#if (BITS_PER_LONG == 32) && defined(__BIG_ENDIAN) ++#if BITS_PER_LONG == 32 + /** + * bitmap_from_arr64 - copy the contents of u64 array of bits to bitmap + * @bitmap: array of unsigned longs, the destination bitmap +-- +2.39.2 + diff --git a/queue-6.4/lib-dhry-fix-sleeping-allocations-inside-non-preempt.patch b/queue-6.4/lib-dhry-fix-sleeping-allocations-inside-non-preempt.patch new file mode 100644 index 00000000000..6235ca09eff --- /dev/null +++ b/queue-6.4/lib-dhry-fix-sleeping-allocations-inside-non-preempt.patch @@ -0,0 +1,56 @@ +From d66587f44f14f6c601c193997d362c637c6d9f2e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Jul 2023 16:54:04 +0200 +Subject: lib: dhry: fix sleeping allocations inside non-preemptable section + +From: Geert Uytterhoeven + +[ Upstream commit 8ba388c06bc8056935ec1814b2689bfb42f3b89a ] + +The Smatch static checker reports the following warnings: + + lib/dhry_run.c:38 dhry_benchmark() warn: sleeping in atomic context + lib/dhry_run.c:43 dhry_benchmark() warn: sleeping in atomic context + +Indeed, dhry() does sleeping allocations inside the non-preemptable +section delimited by get_cpu()/put_cpu(). + +Fix this by using atomic allocations instead. +Add error handling, as atomic these allocations may fail. + +Link: https://lkml.kernel.org/r/bac6d517818a7cd8efe217c1ad649fffab9cc371.1688568764.git.geert+renesas@glider.be +Fixes: 13684e966d46283e ("lib: dhry: fix unstable smp_processor_id(_) usage") +Reported-by: Dan Carpenter +Closes: https://lore.kernel.org/r/0469eb3a-02eb-4b41-b189-de20b931fa56@moroto.mountain +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + lib/dhry_1.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/lib/dhry_1.c b/lib/dhry_1.c +index 83247106824cc..08edbbb19f573 100644 +--- a/lib/dhry_1.c ++++ b/lib/dhry_1.c +@@ -139,8 +139,15 @@ int dhry(int n) + + /* Initializations */ + +- Next_Ptr_Glob = (Rec_Pointer)kzalloc(sizeof(Rec_Type), GFP_KERNEL); +- Ptr_Glob = (Rec_Pointer)kzalloc(sizeof(Rec_Type), GFP_KERNEL); ++ Next_Ptr_Glob = (Rec_Pointer)kzalloc(sizeof(Rec_Type), GFP_ATOMIC); ++ if (!Next_Ptr_Glob) ++ return -ENOMEM; ++ ++ Ptr_Glob = (Rec_Pointer)kzalloc(sizeof(Rec_Type), GFP_ATOMIC); ++ if (!Ptr_Glob) { ++ kfree(Next_Ptr_Glob); ++ return -ENOMEM; ++ } + + Ptr_Glob->Ptr_Comp = Next_Ptr_Glob; + Ptr_Glob->Discr = Ident_1; +-- +2.39.2 + diff --git a/queue-6.4/lkdtm-replace-ll_rw_block-with-submit_bh.patch b/queue-6.4/lkdtm-replace-ll_rw_block-with-submit_bh.patch new file mode 100644 index 00000000000..a5191e81725 --- /dev/null +++ b/queue-6.4/lkdtm-replace-ll_rw_block-with-submit_bh.patch @@ -0,0 +1,56 @@ +From c7782f250eccbddfea642634beb2d19e0d62e270 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 May 2023 00:29:44 +0800 +Subject: lkdtm: replace ll_rw_block with submit_bh + +From: Yue Zhao + +[ Upstream commit b290df06811852d4cc36f4b8a2a30c2063197a74 ] + +Function ll_rw_block was removed in commit 79f597842069 ("fs/buffer: +remove ll_rw_block() helper"). There is no unified function to sumbit +read or write buffer in block layer for now. Consider similar sematics, +we can choose submit_bh() to replace ll_rw_block() as predefined crash +point. In submit_bh(), it also takes read or write flag as the first +argument and invoke submit_bio() to submit I/O request to block layer. + +Fixes: 79f597842069 ("fs/buffer: remove ll_rw_block() helper") +Signed-off-by: Yue Zhao +Acked-by: Kees Cook +Link: https://lore.kernel.org/r/20230503162944.3969-1-findns94@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + Documentation/fault-injection/provoke-crashes.rst | 2 +- + drivers/misc/lkdtm/core.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/Documentation/fault-injection/provoke-crashes.rst b/Documentation/fault-injection/provoke-crashes.rst +index 3abe842256139..1f087e502ca6d 100644 +--- a/Documentation/fault-injection/provoke-crashes.rst ++++ b/Documentation/fault-injection/provoke-crashes.rst +@@ -29,7 +29,7 @@ recur_count + cpoint_name + Where in the kernel to trigger the action. It can be + one of INT_HARDWARE_ENTRY, INT_HW_IRQ_EN, INT_TASKLET_ENTRY, +- FS_DEVRW, MEM_SWAPOUT, TIMERADD, SCSI_QUEUE_RQ, or DIRECT. ++ FS_SUBMIT_BH, MEM_SWAPOUT, TIMERADD, SCSI_QUEUE_RQ, or DIRECT. + + cpoint_type + Indicates the action to be taken on hitting the crash point. +diff --git a/drivers/misc/lkdtm/core.c b/drivers/misc/lkdtm/core.c +index b4712ff196b4e..0772e4a4757e9 100644 +--- a/drivers/misc/lkdtm/core.c ++++ b/drivers/misc/lkdtm/core.c +@@ -79,7 +79,7 @@ static struct crashpoint crashpoints[] = { + CRASHPOINT("INT_HARDWARE_ENTRY", "do_IRQ"), + CRASHPOINT("INT_HW_IRQ_EN", "handle_irq_event"), + CRASHPOINT("INT_TASKLET_ENTRY", "tasklet_action"), +- CRASHPOINT("FS_DEVRW", "ll_rw_block"), ++ CRASHPOINT("FS_SUBMIT_BH", "submit_bh"), + CRASHPOINT("MEM_SWAPOUT", "shrink_inactive_list"), + CRASHPOINT("TIMERADD", "hrtimer_start"), + CRASHPOINT("SCSI_QUEUE_RQ", "scsi_queue_rq"), +-- +2.39.2 + diff --git a/queue-6.4/mailbox-ti-msgmgr-fill-non-message-tx-data-fields-wi.patch b/queue-6.4/mailbox-ti-msgmgr-fill-non-message-tx-data-fields-wi.patch new file mode 100644 index 00000000000..f34a38b2ddd --- /dev/null +++ b/queue-6.4/mailbox-ti-msgmgr-fill-non-message-tx-data-fields-wi.patch @@ -0,0 +1,75 @@ +From a3e8a2ec2e2c76a9377d0b98c2f61e65d0d71310 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jun 2023 20:00:22 -0500 +Subject: mailbox: ti-msgmgr: Fill non-message tx data fields with 0x0 + +From: Nishanth Menon + +[ Upstream commit 1b712f18c461bd75f018033a15cf381e712806b5 ] + +Sec proxy/message manager data buffer is 60 bytes with the last of the +registers indicating transmission completion. This however poses a bit +of a challenge. + +The backing memory for sec_proxy / message manager is regular memory, +and all sec proxy does is to trigger a burst of all 60 bytes of data +over to the target thread backing ring accelerator. It doesn't do a +memory scrub when it moves data out in the burst. When we transmit +multiple messages, remnants of previous message is also transmitted +which results in some random data being set in TISCI fields of +messages that have been expanded forward. + +The entire concept of backward compatibility hinges on the fact that +the unused message fields remain 0x0 allowing for 0x0 value to be +specially considered when backward compatibility of message extension +is done. + +So, instead of just writing the completion register, we continue +to fill the message buffer up with 0x0 (note: for partial message +involving completion, we already do this). + +This allows us to scale and introduce ABI changes back also work with +other boot stages that may have left data in the internal memory. + +While at this, be consistent and explicit with the data_reg pointer +increment. + +Fixes: aace66b170ce ("mailbox: Introduce TI message manager driver") +Signed-off-by: Nishanth Menon +Signed-off-by: Jassi Brar +Signed-off-by: Sasha Levin +--- + drivers/mailbox/ti-msgmgr.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/drivers/mailbox/ti-msgmgr.c b/drivers/mailbox/ti-msgmgr.c +index ddac423ac1a91..03048cbda525e 100644 +--- a/drivers/mailbox/ti-msgmgr.c ++++ b/drivers/mailbox/ti-msgmgr.c +@@ -430,14 +430,20 @@ static int ti_msgmgr_send_data(struct mbox_chan *chan, void *data) + /* Ensure all unused data is 0 */ + data_trail &= 0xFFFFFFFF >> (8 * (sizeof(u32) - trail_bytes)); + writel(data_trail, data_reg); +- data_reg++; ++ data_reg += sizeof(u32); + } ++ + /* + * 'data_reg' indicates next register to write. If we did not already + * write on tx complete reg(last reg), we must do so for transmit ++ * In addition, we also need to make sure all intermediate data ++ * registers(if any required), are reset to 0 for TISCI backward ++ * compatibility to be maintained. + */ +- if (data_reg <= qinst->queue_buff_end) +- writel(0, qinst->queue_buff_end); ++ while (data_reg <= qinst->queue_buff_end) { ++ writel(0, data_reg); ++ data_reg += sizeof(u32); ++ } + + /* If we are in polled mode, wait for a response before proceeding */ + if (ti_msgmgr_chan_has_polled_queue_rx(message->chan_rx)) +-- +2.39.2 + diff --git a/queue-6.4/md-raid10-fix-the-condition-to-call-bio_end_io_acct.patch b/queue-6.4/md-raid10-fix-the-condition-to-call-bio_end_io_acct.patch new file mode 100644 index 00000000000..b57c5603110 --- /dev/null +++ b/queue-6.4/md-raid10-fix-the-condition-to-call-bio_end_io_acct.patch @@ -0,0 +1,63 @@ +From 75d6713a879b1ca713ab30b4a0d3da59e8e445fc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Jun 2023 17:43:20 +0800 +Subject: md/raid10: fix the condition to call bio_end_io_acct() + +From: Li Nan + +[ Upstream commit 125bfc7cd750e68c99f1d446e2c22abea08c237f ] + +/sys/block/[device]/queue/iostats is used to control whether to count io +stat. Write 0 to it will clear queue_flags QUEUE_FLAG_IO_STAT which means +iostats is disabled. If we disable iostats and later endable it, the io +issued during this period will be counted incorrectly, inflight will be +decreased to -1. + + //T1 set iostats + echo 0 > /sys/block/md0/queue/iostats + clear QUEUE_FLAG_IO_STAT + + //T2 issue io + if (QUEUE_FLAG_IO_STAT) -> false + bio_start_io_acct + inflight++ + + echo 1 > /sys/block/md0/queue/iostats + set QUEUE_FLAG_IO_STAT + + //T3 io end + if (QUEUE_FLAG_IO_STAT) -> true + bio_end_io_acct + inflight-- -> -1 + +Also, if iostats is enabled while issuing io but disabled while io end, +inflight will never be decreased. + +Fix it by checking start_time when io end. If start_time is not 0, call +bio_end_io_acct(). + +Fixes: 528bc2cf2fcc ("md/raid10: enable io accounting") +Signed-off-by: Li Nan +Signed-off-by: Song Liu +Link: https://lore.kernel.org/r/20230609094320.2397604-1-linan666@huaweicloud.com +Signed-off-by: Sasha Levin +--- + drivers/md/raid10.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c +index 9d11a52367d17..9d23963496194 100644 +--- a/drivers/md/raid10.c ++++ b/drivers/md/raid10.c +@@ -325,7 +325,7 @@ static void raid_end_bio_io(struct r10bio *r10_bio) + if (!test_bit(R10BIO_Uptodate, &r10_bio->state)) + bio->bi_status = BLK_STS_IOERR; + +- if (blk_queue_io_stat(bio->bi_bdev->bd_disk->queue)) ++ if (r10_bio->start_time) + bio_end_io_acct(bio, r10_bio->start_time); + bio_endio(bio); + /* +-- +2.39.2 + diff --git a/queue-6.4/media-amphion-drop-repeated-codec-data-for-vc1g-form.patch b/queue-6.4/media-amphion-drop-repeated-codec-data-for-vc1g-form.patch new file mode 100644 index 00000000000..c7e6ad0383d --- /dev/null +++ b/queue-6.4/media-amphion-drop-repeated-codec-data-for-vc1g-form.patch @@ -0,0 +1,56 @@ +From ca106f1e0389286520b4aa4bec9e43da7142f09b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Apr 2023 09:55:43 +0800 +Subject: media: amphion: drop repeated codec data for vc1g format + +From: Ming Qian + +[ Upstream commit e1d2ccc2cdd6333584aa3d5386dc667d0837c48f ] + +For format V4L2_PIX_FMT_VC1_ANNEX_G, +the separate codec data is required only once. +The repeated codec data may introduce some decoding error. +so drop the repeated codec data. + +It's amphion vpu's limitation + +Fixes: e670f5d672ef ("media: amphion: only insert the first sequence startcode for vc1l format") +Signed-off-by: Ming Qian +Tested-by: xiahong.bao +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/platform/amphion/vpu_malone.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/media/platform/amphion/vpu_malone.c b/drivers/media/platform/amphion/vpu_malone.c +index e96994437429f..c1d6606ad7e57 100644 +--- a/drivers/media/platform/amphion/vpu_malone.c ++++ b/drivers/media/platform/amphion/vpu_malone.c +@@ -1313,6 +1313,15 @@ static int vpu_malone_insert_scode_pic(struct malone_scode_t *scode, u32 codec_i + return sizeof(hdr); + } + ++static int vpu_malone_insert_scode_vc1_g_seq(struct malone_scode_t *scode) ++{ ++ if (!scode->inst->total_input_count) ++ return 0; ++ if (vpu_vb_is_codecconfig(to_vb2_v4l2_buffer(scode->vb))) ++ scode->need_data = 0; ++ return 0; ++} ++ + static int vpu_malone_insert_scode_vc1_g_pic(struct malone_scode_t *scode) + { + struct vb2_v4l2_buffer *vbuf; +@@ -1460,6 +1469,7 @@ static const struct malone_scode_handler scode_handlers[] = { + }, + { + .pixelformat = V4L2_PIX_FMT_VC1_ANNEX_G, ++ .insert_scode_seq = vpu_malone_insert_scode_vc1_g_seq, + .insert_scode_pic = vpu_malone_insert_scode_vc1_g_pic, + }, + { +-- +2.39.2 + diff --git a/queue-6.4/media-amphion-drop-repeated-codec-data-for-vc1l-form.patch b/queue-6.4/media-amphion-drop-repeated-codec-data-for-vc1l-form.patch new file mode 100644 index 00000000000..5b17efe30e1 --- /dev/null +++ b/queue-6.4/media-amphion-drop-repeated-codec-data-for-vc1l-form.patch @@ -0,0 +1,43 @@ +From 36529d36ab4d3330f6e5d12715ff22146ba99566 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Apr 2023 09:55:42 +0800 +Subject: media: amphion: drop repeated codec data for vc1l format + +From: Ming Qian + +[ Upstream commit 668ee1a3a1870381225002c246972419b98e4253 ] + +For format V4L2_PIX_FMT_VC1_ANNEX_L, +the codec data is replaced with startcode, +and then driver drop it, otherwise it may led to decoding error. + +It's amphion vpu's limitation + +Driver has dropped the first codec data, +but need to drop the repeated codec data too. + +Fixes: e670f5d672ef ("media: amphion: only insert the first sequence startcode for vc1l format") +Signed-off-by: Ming Qian +Tested-by: xiahong.bao +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/platform/amphion/vpu_malone.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/media/platform/amphion/vpu_malone.c b/drivers/media/platform/amphion/vpu_malone.c +index ef44bff9fbaf6..e96994437429f 100644 +--- a/drivers/media/platform/amphion/vpu_malone.c ++++ b/drivers/media/platform/amphion/vpu_malone.c +@@ -1344,6 +1344,8 @@ static int vpu_malone_insert_scode_vc1_l_seq(struct malone_scode_t *scode) + int size = 0; + u8 rcv_seqhdr[MALONE_VC1_RCV_SEQ_HEADER_LEN]; + ++ if (vpu_vb_is_codecconfig(to_vb2_v4l2_buffer(scode->vb))) ++ scode->need_data = 0; + if (scode->inst->total_input_count) + return 0; + scode->need_data = 0; +-- +2.39.2 + diff --git a/queue-6.4/media-amphion-initiate-a-drain-of-the-capture-queue-.patch b/queue-6.4/media-amphion-initiate-a-drain-of-the-capture-queue-.patch new file mode 100644 index 00000000000..ed44c22105c --- /dev/null +++ b/queue-6.4/media-amphion-initiate-a-drain-of-the-capture-queue-.patch @@ -0,0 +1,127 @@ +From bb18fbefa49e0d47aab24af07c3f744dffc876ba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 6 May 2023 16:47:35 +0800 +Subject: media: amphion: initiate a drain of the capture queue in dynamic + resolution change + +From: Ming Qian + +[ Upstream commit 076b6289b2c12d76fab248659896682830fa7766 ] + +The last buffer from before the change must be marked +with the V4L2_BUF_FLAG_LAST flag, +similarly to the Drain sequence above. + +initiate a drain of the capture queue in dynamic resolution change + +Fixes: 6de8d628df6e ("media: amphion: add v4l2 m2m vpu decoder stateful driver") +Signed-off-by: Ming Qian +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/platform/amphion/vdec.c | 7 ++++--- + drivers/media/platform/amphion/venc.c | 4 ++-- + drivers/media/platform/amphion/vpu_v4l2.c | 5 +++-- + drivers/media/platform/amphion/vpu_v4l2.h | 2 +- + 4 files changed, 10 insertions(+), 8 deletions(-) + +diff --git a/drivers/media/platform/amphion/vdec.c b/drivers/media/platform/amphion/vdec.c +index 3fa1a74a2e204..6515f3cdb7a74 100644 +--- a/drivers/media/platform/amphion/vdec.c ++++ b/drivers/media/platform/amphion/vdec.c +@@ -279,6 +279,7 @@ static void vdec_handle_resolution_change(struct vpu_inst *inst) + + vdec->source_change--; + vpu_notify_source_change(inst); ++ vpu_set_last_buffer_dequeued(inst, false); + } + + static int vdec_update_state(struct vpu_inst *inst, enum vpu_codec_state state, u32 force) +@@ -314,7 +315,7 @@ static void vdec_set_last_buffer_dequeued(struct vpu_inst *inst) + return; + + if (vdec->eos_received) { +- if (!vpu_set_last_buffer_dequeued(inst)) { ++ if (!vpu_set_last_buffer_dequeued(inst, true)) { + vdec->eos_received--; + vdec_update_state(inst, VPU_CODEC_STATE_DRAIN, 0); + } +@@ -569,7 +570,7 @@ static int vdec_drain(struct vpu_inst *inst) + return 0; + + if (!vdec->params.frame_count) { +- vpu_set_last_buffer_dequeued(inst); ++ vpu_set_last_buffer_dequeued(inst, true); + return 0; + } + +@@ -608,7 +609,7 @@ static int vdec_cmd_stop(struct vpu_inst *inst) + vpu_trace(inst->dev, "[%d]\n", inst->id); + + if (inst->state == VPU_CODEC_STATE_DEINIT) { +- vpu_set_last_buffer_dequeued(inst); ++ vpu_set_last_buffer_dequeued(inst, true); + } else { + vdec->drain = 1; + vdec_drain(inst); +diff --git a/drivers/media/platform/amphion/venc.c b/drivers/media/platform/amphion/venc.c +index e6e8fe45fc7c3..58480e2755ec4 100644 +--- a/drivers/media/platform/amphion/venc.c ++++ b/drivers/media/platform/amphion/venc.c +@@ -458,7 +458,7 @@ static int venc_encoder_cmd(struct file *file, void *fh, struct v4l2_encoder_cmd + vpu_inst_lock(inst); + if (cmd->cmd == V4L2_ENC_CMD_STOP) { + if (inst->state == VPU_CODEC_STATE_DEINIT) +- vpu_set_last_buffer_dequeued(inst); ++ vpu_set_last_buffer_dequeued(inst, true); + else + venc_request_eos(inst); + } +@@ -878,7 +878,7 @@ static void venc_set_last_buffer_dequeued(struct vpu_inst *inst) + struct venc_t *venc = inst->priv; + + if (venc->stopped && list_empty(&venc->frames)) +- vpu_set_last_buffer_dequeued(inst); ++ vpu_set_last_buffer_dequeued(inst, true); + } + + static void venc_stop_done(struct vpu_inst *inst) +diff --git a/drivers/media/platform/amphion/vpu_v4l2.c b/drivers/media/platform/amphion/vpu_v4l2.c +index 6773b885597ce..810e93d2c954a 100644 +--- a/drivers/media/platform/amphion/vpu_v4l2.c ++++ b/drivers/media/platform/amphion/vpu_v4l2.c +@@ -100,7 +100,7 @@ int vpu_notify_source_change(struct vpu_inst *inst) + return 0; + } + +-int vpu_set_last_buffer_dequeued(struct vpu_inst *inst) ++int vpu_set_last_buffer_dequeued(struct vpu_inst *inst, bool eos) + { + struct vb2_queue *q; + +@@ -116,7 +116,8 @@ int vpu_set_last_buffer_dequeued(struct vpu_inst *inst) + vpu_trace(inst->dev, "last buffer dequeued\n"); + q->last_buffer_dequeued = true; + wake_up(&q->done_wq); +- vpu_notify_eos(inst); ++ if (eos) ++ vpu_notify_eos(inst); + return 0; + } + +diff --git a/drivers/media/platform/amphion/vpu_v4l2.h b/drivers/media/platform/amphion/vpu_v4l2.h +index ef5de6b66e474..60f43056a7a28 100644 +--- a/drivers/media/platform/amphion/vpu_v4l2.h ++++ b/drivers/media/platform/amphion/vpu_v4l2.h +@@ -27,7 +27,7 @@ struct vb2_v4l2_buffer *vpu_find_buf_by_idx(struct vpu_inst *inst, u32 type, u32 + void vpu_v4l2_set_error(struct vpu_inst *inst); + int vpu_notify_eos(struct vpu_inst *inst); + int vpu_notify_source_change(struct vpu_inst *inst); +-int vpu_set_last_buffer_dequeued(struct vpu_inst *inst); ++int vpu_set_last_buffer_dequeued(struct vpu_inst *inst, bool eos); + void vpu_vb2_buffers_return(struct vpu_inst *inst, unsigned int type, enum vb2_buffer_state state); + int vpu_get_num_buffers(struct vpu_inst *inst, u32 type); + bool vpu_is_source_empty(struct vpu_inst *inst); +-- +2.39.2 + diff --git a/queue-6.4/media-atomisp-gc0310-fix-double-free-in-gc0310_remov.patch b/queue-6.4/media-atomisp-gc0310-fix-double-free-in-gc0310_remov.patch new file mode 100644 index 00000000000..eb73a0efd37 --- /dev/null +++ b/queue-6.4/media-atomisp-gc0310-fix-double-free-in-gc0310_remov.patch @@ -0,0 +1,42 @@ +From b222ff15bc9cc3fed15a79517624f773f71cb9d2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 May 2023 15:15:07 +0100 +Subject: media: atomisp: gc0310: Fix double free in gc0310_remove() + +From: Hans de Goede + +[ Upstream commit 2746a966f9f05fdb0727f4e1e8f2d51ec79e071d ] + +gc0310_remove() must not call kfree(dev) since the gc0310_device struct +is devm managed so explicitly freeing it causes a double free. + +While at it add a missing mutex_destroy() call for the input_lock. + +Link: https://lore.kernel.org/r/20230518153214.194976-6-hdegoede@redhat.com + +Fixes: 340b4dd6c183 ("media: atomisp: gc0310: Use devm_kzalloc() for data struct") +Reviewed-by: Andy Shevchenko +Signed-off-by: Hans de Goede +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/staging/media/atomisp/i2c/atomisp-gc0310.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/staging/media/atomisp/i2c/atomisp-gc0310.c b/drivers/staging/media/atomisp/i2c/atomisp-gc0310.c +index 273155308fe36..eb6db1571dc0d 100644 +--- a/drivers/staging/media/atomisp/i2c/atomisp-gc0310.c ++++ b/drivers/staging/media/atomisp/i2c/atomisp-gc0310.c +@@ -377,8 +377,8 @@ static void gc0310_remove(struct i2c_client *client) + v4l2_device_unregister_subdev(sd); + media_entity_cleanup(&dev->sd.entity); + v4l2_ctrl_handler_free(&dev->ctrls.handler); ++ mutex_destroy(&dev->input_lock); + pm_runtime_disable(&client->dev); +- kfree(dev); + } + + static int gc0310_probe(struct i2c_client *client) +-- +2.39.2 + diff --git a/queue-6.4/media-atomisp-gmin_platform-fix-out_len-in-gmin_get_.patch b/queue-6.4/media-atomisp-gmin_platform-fix-out_len-in-gmin_get_.patch new file mode 100644 index 00000000000..5802579971e --- /dev/null +++ b/queue-6.4/media-atomisp-gmin_platform-fix-out_len-in-gmin_get_.patch @@ -0,0 +1,42 @@ +From 0de3fcfb57cdceee0e7eb1f817637a5fa74dc223 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 May 2023 12:53:23 +0100 +Subject: media: atomisp: gmin_platform: fix out_len in + gmin_get_config_dsm_var() + +From: Dan Carpenter + +[ Upstream commit 1657f2934daf89e8d9fa4b2697008909eb22c73e ] + +Ideally, strlen(cur->string.pointer) and strlen(out) would be the same. +But this code is using strscpy() to avoid a potential buffer overflow. +So in the same way we should take the strlen() of the smaller string to +avoid a buffer overflow in the caller, gmin_get_var_int(). + +Link: https://lore.kernel.org/r/26124bcd-8132-4483-9d67-225c87d424e8@kili.mountain + +Fixes: 387041cda44e ("media: atomisp: improve sensor detection code to use _DSM table") +Signed-off-by: Dan Carpenter +Signed-off-by: Hans de Goede +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c b/drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c +index c718a74ea70a3..88d4499233b98 100644 +--- a/drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c ++++ b/drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c +@@ -1357,7 +1357,7 @@ static int gmin_get_config_dsm_var(struct device *dev, + dev_info(dev, "found _DSM entry for '%s': %s\n", var, + cur->string.pointer); + strscpy(out, cur->string.pointer, *out_len); +- *out_len = strlen(cur->string.pointer); ++ *out_len = strlen(out); + + ACPI_FREE(obj); + return 0; +-- +2.39.2 + diff --git a/queue-6.4/media-atomisp-ov2680-stop-using-half-pixelclock-for-.patch b/queue-6.4/media-atomisp-ov2680-stop-using-half-pixelclock-for-.patch new file mode 100644 index 00000000000..72448b8f2e7 --- /dev/null +++ b/queue-6.4/media-atomisp-ov2680-stop-using-half-pixelclock-for-.patch @@ -0,0 +1,79 @@ +From 603463f6ef2aec61121ebe143d96de41745361c5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 4 Jun 2023 17:14:03 +0100 +Subject: media: atomisp: ov2680: Stop using half pixelclock for binned modes + +From: Hans de Goede + +[ Upstream commit 7d45a432251a30ed0252655177e708229b163291 ] + +Stop using half pixelclock for binned modes this fixes: +1. The exposure being twice as high for binned mods (due to the half clk) +2. The framerate being 15 fps instead of 30 fps + +The original code with fixed per mode register lists did use half pixel +clk, but this should be combined with using half for the VTS value too. + +Using half VTS fixes the framerate issue, but this has the undesired +side-effect of change the exposure ctrl range (half the range, double +the amount of exposure per step). + +Link: https://lore.kernel.org/r/20230604161406.69369-3-hdegoede@redhat.com + +Signed-off-by: Hans de Goede +Reviewed-by: Andy Shevchenko +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/staging/media/atomisp/i2c/atomisp-ov2680.c | 8 +------- + drivers/staging/media/atomisp/i2c/ov2680.h | 1 + + 2 files changed, 2 insertions(+), 7 deletions(-) + +diff --git a/drivers/staging/media/atomisp/i2c/atomisp-ov2680.c b/drivers/staging/media/atomisp/i2c/atomisp-ov2680.c +index c079368019e87..3a6bc3e56b10e 100644 +--- a/drivers/staging/media/atomisp/i2c/atomisp-ov2680.c ++++ b/drivers/staging/media/atomisp/i2c/atomisp-ov2680.c +@@ -239,27 +239,21 @@ static void ov2680_calc_mode(struct ov2680_device *sensor, int width, int height + static int ov2680_set_mode(struct ov2680_device *sensor) + { + struct i2c_client *client = sensor->client; +- u8 pll_div, unknown, inc, fmt1, fmt2; ++ u8 unknown, inc, fmt1, fmt2; + int ret; + + if (sensor->mode.binning) { +- pll_div = 1; + unknown = 0x23; + inc = 0x31; + fmt1 = 0xc2; + fmt2 = 0x01; + } else { +- pll_div = 0; + unknown = 0x21; + inc = 0x11; + fmt1 = 0xc0; + fmt2 = 0x00; + } + +- ret = ov_write_reg8(client, 0x3086, pll_div); +- if (ret) +- return ret; +- + ret = ov_write_reg8(client, 0x370a, unknown); + if (ret) + return ret; +diff --git a/drivers/staging/media/atomisp/i2c/ov2680.h b/drivers/staging/media/atomisp/i2c/ov2680.h +index baf49eb0659e3..eed18d6943370 100644 +--- a/drivers/staging/media/atomisp/i2c/ov2680.h ++++ b/drivers/staging/media/atomisp/i2c/ov2680.h +@@ -172,6 +172,7 @@ static struct ov2680_reg const ov2680_global_setting[] = { + {0x3082, 0x45}, + {0x3084, 0x09}, + {0x3085, 0x04}, ++ {0x3086, 0x00}, + {0x3503, 0x03}, + {0x350b, 0x36}, + {0x3600, 0xb4}, +-- +2.39.2 + diff --git a/queue-6.4/media-cec-i2c-ch7322-also-select-regmap.patch b/queue-6.4/media-cec-i2c-ch7322-also-select-regmap.patch new file mode 100644 index 00000000000..0062e7b8d3a --- /dev/null +++ b/queue-6.4/media-cec-i2c-ch7322-also-select-regmap.patch @@ -0,0 +1,69 @@ +From ecfef0e6e3ee602bdd579054471581996bfab452 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Jun 2023 04:54:35 +0200 +Subject: media: cec: i2c: ch7322: also select REGMAP + +From: Randy Dunlap + +[ Upstream commit 29f96ac23648b2259f42d40703c47dd18fd172ca ] + +Selecting only REGMAP_I2C can leave REGMAP unset, causing build errors, +so also select REGMAP to prevent the build errors. + +../drivers/media/cec/i2c/ch7322.c:158:21: error: variable 'ch7322_regmap' has initializer but incomplete type + 158 | static const struct regmap_config ch7322_regmap = { +../drivers/media/cec/i2c/ch7322.c:159:10: error: 'const struct regmap_config' has no member named 'reg_bits' + 159 | .reg_bits = 8, +../drivers/media/cec/i2c/ch7322.c:159:21: warning: excess elements in struct initializer + 159 | .reg_bits = 8, +../drivers/media/cec/i2c/ch7322.c:160:10: error: 'const struct regmap_config' has no member named 'val_bits' + 160 | .val_bits = 8, +../drivers/media/cec/i2c/ch7322.c:160:21: warning: excess elements in struct initializer + 160 | .val_bits = 8, +../drivers/media/cec/i2c/ch7322.c:161:10: error: 'const struct regmap_config' has no member named 'max_register' + 161 | .max_register = 0x7f, +../drivers/media/cec/i2c/ch7322.c:161:25: warning: excess elements in struct initializer + 161 | .max_register = 0x7f, +../drivers/media/cec/i2c/ch7322.c:162:10: error: 'const struct regmap_config' has no member named 'disable_locking' + 162 | .disable_locking = true, +../drivers/media/cec/i2c/ch7322.c:162:28: warning: excess elements in struct initializer + 162 | .disable_locking = true, +../drivers/media/cec/i2c/ch7322.c: In function 'ch7322_probe': +../drivers/media/cec/i2c/ch7322.c:468:26: error: implicit declaration of function 'devm_regmap_init_i2c' [-Werror=implicit-function-declaration] + 468 | ch7322->regmap = devm_regmap_init_i2c(client, &ch7322_regmap); +../drivers/media/cec/i2c/ch7322.c:468:24: warning: assignment to 'struct regmap *' from 'int' makes pointer from integer without a cast [-Wint-conversion] + 468 | ch7322->regmap = devm_regmap_init_i2c(client, &ch7322_regmap); +../drivers/media/cec/i2c/ch7322.c: At top level: +../drivers/media/cec/i2c/ch7322.c:158:35: error: storage size of 'ch7322_regmap' isn't known + 158 | static const struct regmap_config ch7322_regmap = { + +Link: https://lore.kernel.org/linux-media/20230608025435.29249-1-rdunlap@infradead.org +Fixes: 21b9a47e0ec7 ("media: cec: i2c: ch7322: Add ch7322 CEC controller driver") +Signed-off-by: Randy Dunlap +Cc: Jeff Chase +Cc: Hans Verkuil +Cc: Joe Tessler +Cc: Arnd Bergmann +Cc: Mark Brown +Cc: Masahiro Yamada +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/cec/i2c/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/media/cec/i2c/Kconfig b/drivers/media/cec/i2c/Kconfig +index 70432a1d69186..d912d143fb312 100644 +--- a/drivers/media/cec/i2c/Kconfig ++++ b/drivers/media/cec/i2c/Kconfig +@@ -5,6 +5,7 @@ + config CEC_CH7322 + tristate "Chrontel CH7322 CEC controller" + depends on I2C ++ select REGMAP + select REGMAP_I2C + select CEC_CORE + help +-- +2.39.2 + diff --git a/queue-6.4/media-common-saa7146-avoid-a-leak-in-vmalloc_to_sg.patch b/queue-6.4/media-common-saa7146-avoid-a-leak-in-vmalloc_to_sg.patch new file mode 100644 index 00000000000..2ab8c2f7160 --- /dev/null +++ b/queue-6.4/media-common-saa7146-avoid-a-leak-in-vmalloc_to_sg.patch @@ -0,0 +1,51 @@ +From 7f315906f2734741e941c6f6703a9d4708d41b82 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Apr 2023 15:25:46 +0200 +Subject: media: common: saa7146: Avoid a leak in vmalloc_to_sg() + +From: Christophe JAILLET + +[ Upstream commit b2aa8ac6f97e26d788948fb60dcc5625c9633f4e ] + +Commit in Fixes turned a BUG() into a "normal" memory allocation failure. +While at it, it introduced a memory leak. +So fix it. + +Also update the comment on top of the function to reflect what has been +change by the commit in Fixes. + +Fixes: 40e986c99624 ("media: common: saa7146: replace BUG_ON by WARN_ON") +Signed-off-by: Christophe JAILLET +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/common/saa7146/saa7146_core.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/media/common/saa7146/saa7146_core.c b/drivers/media/common/saa7146/saa7146_core.c +index bcb957883044c..27c53eed8fe39 100644 +--- a/drivers/media/common/saa7146/saa7146_core.c ++++ b/drivers/media/common/saa7146/saa7146_core.c +@@ -133,8 +133,8 @@ int saa7146_wait_for_debi_done(struct saa7146_dev *dev, int nobusyloop) + ****************************************************************************/ + + /* this is videobuf_vmalloc_to_sg() from videobuf-dma-sg.c +- make sure virt has been allocated with vmalloc_32(), otherwise the BUG() +- may be triggered on highmem machines */ ++ make sure virt has been allocated with vmalloc_32(), otherwise return NULL ++ on highmem machines */ + static struct scatterlist* vmalloc_to_sg(unsigned char *virt, int nr_pages) + { + struct scatterlist *sglist; +@@ -150,7 +150,7 @@ static struct scatterlist* vmalloc_to_sg(unsigned char *virt, int nr_pages) + if (NULL == pg) + goto err; + if (WARN_ON(PageHighMem(pg))) +- return NULL; ++ goto err; + sg_set_page(&sglist[i], pg, PAGE_SIZE, 0); + } + return sglist; +-- +2.39.2 + diff --git a/queue-6.4/media-hi846-fix-usage-of-pm_runtime_get_if_in_use.patch b/queue-6.4/media-hi846-fix-usage-of-pm_runtime_get_if_in_use.patch new file mode 100644 index 00000000000..3f6572723ea --- /dev/null +++ b/queue-6.4/media-hi846-fix-usage-of-pm_runtime_get_if_in_use.patch @@ -0,0 +1,44 @@ +From cca6eefeb42b229a179cf84f85f93fb7185158f0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Apr 2023 11:47:47 +0200 +Subject: media: hi846: fix usage of pm_runtime_get_if_in_use() + +From: Martin Kepplinger + +[ Upstream commit 04fc06f6dc1592ed5d675311ac50d8fba5db62ab ] + +pm_runtime_get_if_in_use() does not only return nonzero values when +the device is in use, it can return a negative errno too. + +And especially during resuming from system suspend, when runtime pm +is not yet up again, -EAGAIN is being returned, so the subsequent +pm_runtime_put() call results in a refcount underflow. + +Fix system-resume by handling -EAGAIN of pm_runtime_get_if_in_use(). + +Signed-off-by: Martin Kepplinger +Fixes: e8c0882685f9 ("media: i2c: add driver for the SK Hynix Hi-846 8M pixel camera") +Signed-off-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/hi846.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/i2c/hi846.c b/drivers/media/i2c/hi846.c +index 306dc35e925fd..f8709cdf28b39 100644 +--- a/drivers/media/i2c/hi846.c ++++ b/drivers/media/i2c/hi846.c +@@ -1353,7 +1353,8 @@ static int hi846_set_ctrl(struct v4l2_ctrl *ctrl) + exposure_max); + } + +- if (!pm_runtime_get_if_in_use(&client->dev)) ++ ret = pm_runtime_get_if_in_use(&client->dev); ++ if (!ret || ret == -EAGAIN) + return 0; + + switch (ctrl->id) { +-- +2.39.2 + diff --git a/queue-6.4/media-i2c-correct-format-propagation-for-st-mipid02.patch b/queue-6.4/media-i2c-correct-format-propagation-for-st-mipid02.patch new file mode 100644 index 00000000000..0d1d135c795 --- /dev/null +++ b/queue-6.4/media-i2c-correct-format-propagation-for-st-mipid02.patch @@ -0,0 +1,47 @@ +From e5e549bbe242b6dc658466b4ba5ec6cd4b68044c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 May 2023 11:35:46 +0100 +Subject: media: i2c: Correct format propagation for st-mipid02 + +From: Daniel Scally + +[ Upstream commit 306c3190b30d4d6a098888b9d7d4cefaa0ddcb91 ] + +Format propagation in the st-mipid02 driver is incorrect in that when +setting format for V4L2_SUBDEV_FORMAT_TRY on the source pad, the +_active_ rather than _try_ format from the sink pad is propagated. +This causes problems with format negotiation - update the function to +propagate the correct format. + +Fixes: 642bb5e88fed ("media: st-mipid02: MIPID02 CSI-2 to PARALLEL bridge driver") +Signed-off-by: Daniel Scally +Signed-off-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/st-mipid02.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/i2c/st-mipid02.c b/drivers/media/i2c/st-mipid02.c +index 31b89aff0e86a..f20f87562bf11 100644 +--- a/drivers/media/i2c/st-mipid02.c ++++ b/drivers/media/i2c/st-mipid02.c +@@ -736,8 +736,13 @@ static void mipid02_set_fmt_source(struct v4l2_subdev *sd, + { + struct mipid02_dev *bridge = to_mipid02_dev(sd); + +- /* source pad mirror active sink pad */ +- format->format = bridge->fmt; ++ /* source pad mirror sink pad */ ++ if (format->which == V4L2_SUBDEV_FORMAT_ACTIVE) ++ format->format = bridge->fmt; ++ else ++ format->format = *v4l2_subdev_get_try_format(sd, sd_state, ++ MIPID02_SINK_0); ++ + /* but code may need to be converted */ + format->format.code = serial_to_parallel_code(format->format.code); + +-- +2.39.2 + diff --git a/queue-6.4/media-i2c-imx296-fix-error-checking-in-imx296_read_t.patch b/queue-6.4/media-i2c-imx296-fix-error-checking-in-imx296_read_t.patch new file mode 100644 index 00000000000..0323b0c432a --- /dev/null +++ b/queue-6.4/media-i2c-imx296-fix-error-checking-in-imx296_read_t.patch @@ -0,0 +1,43 @@ +From a676c29a1bba2b6ff122fb6d372803eeea5c0c3e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Feb 2023 16:59:51 +0300 +Subject: media: i2c: imx296: fix error checking in imx296_read_temperature() + +From: Dan Carpenter + +[ Upstream commit 1b3565dbc6aa124f34674e3dcf6966f663817e05 ] + +The "& IMX296_TMDOUT_MASK" means that "tmdout" can't be negative so the +error checking will not work. + +Fixes: cb33db2b6ccf ("media: i2c: IMX296 camera sensor driver") +Signed-off-by: Dan Carpenter +Reviewed-by: Laurent Pinchart +Signed-off-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/imx296.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/i2c/imx296.c b/drivers/media/i2c/imx296.c +index 4f22c0515ef8d..c3d6d52fc7727 100644 +--- a/drivers/media/i2c/imx296.c ++++ b/drivers/media/i2c/imx296.c +@@ -922,10 +922,12 @@ static int imx296_read_temperature(struct imx296 *sensor, int *temp) + if (ret < 0) + return ret; + +- tmdout = imx296_read(sensor, IMX296_TMDOUT) & IMX296_TMDOUT_MASK; ++ tmdout = imx296_read(sensor, IMX296_TMDOUT); + if (tmdout < 0) + return tmdout; + ++ tmdout &= IMX296_TMDOUT_MASK; ++ + /* T(°C) = 246.312 - 0.304 * TMDOUT */; + *temp = 246312 - 304 * tmdout; + +-- +2.39.2 + diff --git a/queue-6.4/media-mediatek-vcodec-using-decoder-status-instead-o.patch b/queue-6.4/media-mediatek-vcodec-using-decoder-status-instead-o.patch new file mode 100644 index 00000000000..3b872f17f14 --- /dev/null +++ b/queue-6.4/media-mediatek-vcodec-using-decoder-status-instead-o.patch @@ -0,0 +1,152 @@ +From 38efb255732055b943916ac5b3f6453c56584b85 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 May 2023 02:40:07 +0100 +Subject: media: mediatek: vcodec: using decoder status instead of core work + count + +From: Yunfei Dong + +[ Upstream commit 2864e304faec04c2674328aad0e820a9cd84cdec ] + +Adding the definition of decoder status to separate different decoder +period for core hardware. + +core_work_cnt is the number of core work queued to work queue, the control +is very complex, leading to some unreasonable test result. + +Using parameter status to indicate whether queue core work to work queue. + +Fixes: 2e0ef56d81cb ("media: mediatek: vcodec: making sure queue_work successfully") +Signed-off-by: Yunfei Dong +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + .../platform/mediatek/vcodec/vdec_msg_queue.c | 33 ++++++++----------- + .../platform/mediatek/vcodec/vdec_msg_queue.h | 16 +++++++-- + 2 files changed, 28 insertions(+), 21 deletions(-) + +diff --git a/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c b/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c +index f3073d1e7f420..03f8d7cd8eddc 100644 +--- a/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c ++++ b/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c +@@ -71,7 +71,6 @@ static void vdec_msg_queue_dec(struct vdec_msg_queue *msg_queue, int hardware_in + int vdec_msg_queue_qbuf(struct vdec_msg_queue_ctx *msg_ctx, struct vdec_lat_buf *buf) + { + struct list_head *head; +- int status; + + head = vdec_get_buf_list(msg_ctx->hardware_index, buf); + if (!head) { +@@ -87,12 +86,9 @@ int vdec_msg_queue_qbuf(struct vdec_msg_queue_ctx *msg_ctx, struct vdec_lat_buf + if (msg_ctx->hardware_index != MTK_VDEC_CORE) { + wake_up_all(&msg_ctx->ready_to_use); + } else { +- if (buf->ctx->msg_queue.core_work_cnt < +- atomic_read(&buf->ctx->msg_queue.core_list_cnt)) { +- status = queue_work(buf->ctx->dev->core_workqueue, +- &buf->ctx->msg_queue.core_work); +- if (status) +- buf->ctx->msg_queue.core_work_cnt++; ++ if (!(buf->ctx->msg_queue.status & CONTEXT_LIST_QUEUED)) { ++ queue_work(buf->ctx->dev->core_workqueue, &buf->ctx->msg_queue.core_work); ++ buf->ctx->msg_queue.status |= CONTEXT_LIST_QUEUED; + } + } + +@@ -261,7 +257,10 @@ static void vdec_msg_queue_core_work(struct work_struct *work) + container_of(msg_queue, struct mtk_vcodec_ctx, msg_queue); + struct mtk_vcodec_dev *dev = ctx->dev; + struct vdec_lat_buf *lat_buf; +- int status; ++ ++ spin_lock(&ctx->dev->msg_queue_core_ctx.ready_lock); ++ ctx->msg_queue.status &= ~CONTEXT_LIST_QUEUED; ++ spin_unlock(&ctx->dev->msg_queue_core_ctx.ready_lock); + + lat_buf = vdec_msg_queue_dqbuf(&dev->msg_queue_core_ctx); + if (!lat_buf) +@@ -278,17 +277,13 @@ static void vdec_msg_queue_core_work(struct work_struct *work) + vdec_msg_queue_qbuf(&ctx->msg_queue.lat_ctx, lat_buf); + + wake_up_all(&ctx->msg_queue.core_dec_done); +- spin_lock(&dev->msg_queue_core_ctx.ready_lock); +- lat_buf->ctx->msg_queue.core_work_cnt--; +- +- if (lat_buf->ctx->msg_queue.core_work_cnt < +- atomic_read(&lat_buf->ctx->msg_queue.core_list_cnt)) { +- status = queue_work(lat_buf->ctx->dev->core_workqueue, +- &lat_buf->ctx->msg_queue.core_work); +- if (status) +- lat_buf->ctx->msg_queue.core_work_cnt++; ++ if (!(ctx->msg_queue.status & CONTEXT_LIST_QUEUED) && ++ atomic_read(&msg_queue->core_list_cnt)) { ++ spin_lock(&ctx->dev->msg_queue_core_ctx.ready_lock); ++ ctx->msg_queue.status |= CONTEXT_LIST_QUEUED; ++ spin_unlock(&ctx->dev->msg_queue_core_ctx.ready_lock); ++ queue_work(ctx->dev->core_workqueue, &msg_queue->core_work); + } +- spin_unlock(&dev->msg_queue_core_ctx.ready_lock); + } + + int vdec_msg_queue_init(struct vdec_msg_queue *msg_queue, +@@ -303,13 +298,13 @@ int vdec_msg_queue_init(struct vdec_msg_queue *msg_queue, + return 0; + + msg_queue->ctx = ctx; +- msg_queue->core_work_cnt = 0; + vdec_msg_queue_init_ctx(&msg_queue->lat_ctx, MTK_VDEC_LAT0); + INIT_WORK(&msg_queue->core_work, vdec_msg_queue_core_work); + + atomic_set(&msg_queue->lat_list_cnt, 0); + atomic_set(&msg_queue->core_list_cnt, 0); + init_waitqueue_head(&msg_queue->core_dec_done); ++ msg_queue->status = CONTEXT_LIST_EMPTY; + + msg_queue->wdma_addr.size = + vde_msg_queue_get_trans_size(ctx->picinfo.buf_w, +diff --git a/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.h b/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.h +index a5d44bc97c16b..8f82d14847726 100644 +--- a/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.h ++++ b/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.h +@@ -21,6 +21,18 @@ struct mtk_vcodec_ctx; + struct mtk_vcodec_dev; + typedef int (*core_decode_cb_t)(struct vdec_lat_buf *lat_buf); + ++/** ++ * enum core_ctx_status - Context decode status for core hardwre. ++ * @CONTEXT_LIST_EMPTY: No buffer queued on core hardware(must always be 0) ++ * @CONTEXT_LIST_QUEUED: Buffer queued to core work list ++ * @CONTEXT_LIST_DEC_DONE: context decode done ++ */ ++enum core_ctx_status { ++ CONTEXT_LIST_EMPTY = 0, ++ CONTEXT_LIST_QUEUED, ++ CONTEXT_LIST_DEC_DONE, ++}; ++ + /** + * struct vdec_msg_queue_ctx - represents a queue for buffers ready to be processed + * @ready_to_use: ready used queue used to signalize when get a job queue +@@ -77,7 +89,7 @@ struct vdec_lat_buf { + * @lat_list_cnt: used to record each instance lat list count + * @core_list_cnt: used to record each instance core list count + * @core_dec_done: core work queue decode done event +- * @core_work_cnt: the number of core work in work queue ++ * @status: current context decode status for core hardware + */ + struct vdec_msg_queue { + struct vdec_lat_buf lat_buf[NUM_BUFFER_COUNT]; +@@ -93,7 +105,7 @@ struct vdec_msg_queue { + atomic_t lat_list_cnt; + atomic_t core_list_cnt; + wait_queue_head_t core_dec_done; +- int core_work_cnt; ++ int status; + }; + + /** +-- +2.39.2 + diff --git a/queue-6.4/media-renesas-fdp1-identify-r-car-gen2-versions.patch b/queue-6.4/media-renesas-fdp1-identify-r-car-gen2-versions.patch new file mode 100644 index 00000000000..58b826222cd --- /dev/null +++ b/queue-6.4/media-renesas-fdp1-identify-r-car-gen2-versions.patch @@ -0,0 +1,59 @@ +From 667e6a4ffcc5c36f43f19cbde503c1116159e4bf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Apr 2023 12:18:24 +0200 +Subject: media: renesas: fdp1: Identify R-Car Gen2 versions + +From: Geert Uytterhoeven + +[ Upstream commit 59a95979638664a905cd46845e7cac1b3ff942f7 ] + +On R-Car M2-W: + + rcar_fdp1 fe940000.fdp1: FDP1 Unidentifiable (0x02010101) + rcar_fdp1 fe944000.fdp1: FDP1 Unidentifiable (0x02010101) + +Although the IP Internal Data Register on R-Car Gen2 is documented to +contain all zeros, the actual register contents seem to match the FDP1 +version ID of R-Car H3 ES1.*, which has just been removed. +Fortunately this version is not used for any other purposes yet. + +Fix this by re-adding the ID, now using an R-Car Gen2-specific name. + +Fixes: af4273b43f2b ("media: renesas: fdp1: remove R-Car H3 ES1.* handling") +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Wolfram Sang +Reviewed-by: Laurent Pinchart +Reviewed-by: Kieran Bingham +Signed-off-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/platform/renesas/rcar_fdp1.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/media/platform/renesas/rcar_fdp1.c b/drivers/media/platform/renesas/rcar_fdp1.c +index f43e458590b8c..ab39cd2201c85 100644 +--- a/drivers/media/platform/renesas/rcar_fdp1.c ++++ b/drivers/media/platform/renesas/rcar_fdp1.c +@@ -254,6 +254,8 @@ MODULE_PARM_DESC(debug, "activate debug info"); + + /* Internal Data (HW Version) */ + #define FD1_IP_INTDATA 0x0800 ++/* R-Car Gen2 HW manual says zero, but actual value matches R-Car H3 ES1.x */ ++#define FD1_IP_GEN2 0x02010101 + #define FD1_IP_M3W 0x02010202 + #define FD1_IP_H3 0x02010203 + #define FD1_IP_M3N 0x02010204 +@@ -2360,6 +2362,9 @@ static int fdp1_probe(struct platform_device *pdev) + + hw_version = fdp1_read(fdp1, FD1_IP_INTDATA); + switch (hw_version) { ++ case FD1_IP_GEN2: ++ dprintk(fdp1, "FDP1 Version R-Car Gen2\n"); ++ break; + case FD1_IP_M3W: + dprintk(fdp1, "FDP1 Version R-Car M3-W\n"); + break; +-- +2.39.2 + diff --git a/queue-6.4/media-tc358746-select-config_generic_phy.patch b/queue-6.4/media-tc358746-select-config_generic_phy.patch new file mode 100644 index 00000000000..2157b8e4985 --- /dev/null +++ b/queue-6.4/media-tc358746-select-config_generic_phy.patch @@ -0,0 +1,58 @@ +From f2de585287ec030ed0e8779ad8ddf0b2522f4667 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Jun 2023 17:23:09 +0200 +Subject: media: tc358746: select CONFIG_GENERIC_PHY + +From: Arnd Bergmann + +[ Upstream commit 582d4ad468cbc6ef2db4689ff3bd5868d95402c9 ] + +The tc358746 driver selects CONFIG_GENERIC_PHY_MIPI_DPHY and links to +that, but this fails when CONFIG_GENERIC_PHY is disabled, because Kbuild +then never enters the drivers/phy directory for building object files: + +ERROR: modpost: "phy_mipi_dphy_get_default_config_for_hsclk" [drivers/media/i2c/tc358746.ko] undefined! + +Add an explicit 'select GENERIC_PHY' here to ensure that the directory +is entered, and add another dependency on that symbol so make it +more obvious what is going on if another driver has the same problem, +as this will produce a Kconfig warning. + +Link: https://lore.kernel.org/linux-media/20230623152318.2276816-1-arnd@kernel.org +Fixes: 80a21da360516 ("media: tc358746: add Toshiba TC358746 Parallel to CSI-2 bridge driver") +Signed-off-by: Arnd Bergmann +Reviewed-by: Marco Felsch +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/Kconfig | 1 + + drivers/phy/Kconfig | 1 + + 2 files changed, 2 insertions(+) + +diff --git a/drivers/media/i2c/Kconfig b/drivers/media/i2c/Kconfig +index 256d55bb2b1da..76d1ee3cc1bab 100644 +--- a/drivers/media/i2c/Kconfig ++++ b/drivers/media/i2c/Kconfig +@@ -1292,6 +1292,7 @@ config VIDEO_TC358746 + select VIDEO_V4L2_SUBDEV_API + select MEDIA_CONTROLLER + select V4L2_FWNODE ++ select GENERIC_PHY + select GENERIC_PHY_MIPI_DPHY + select REGMAP_I2C + help +diff --git a/drivers/phy/Kconfig b/drivers/phy/Kconfig +index f46e3148d286d..8dba9596408f2 100644 +--- a/drivers/phy/Kconfig ++++ b/drivers/phy/Kconfig +@@ -18,6 +18,7 @@ config GENERIC_PHY + + config GENERIC_PHY_MIPI_DPHY + bool ++ depends on GENERIC_PHY + help + Generic MIPI D-PHY support. + +-- +2.39.2 + diff --git a/queue-6.4/media-usb-check-az6007_read-return-value.patch b/queue-6.4/media-usb-check-az6007_read-return-value.patch new file mode 100644 index 00000000000..a266cec2a4c --- /dev/null +++ b/queue-6.4/media-usb-check-az6007_read-return-value.patch @@ -0,0 +1,38 @@ +From a46a350e84854c68ad12f76584226e7c1bb84f4e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Mar 2023 10:04:49 -0700 +Subject: media: usb: Check az6007_read() return value + +From: Daniil Dulov + +[ Upstream commit fdaca63186f59fc664b346c45b76576624b48e57 ] + +If az6007_read() returns error, there is no sence to continue. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 3af2f4f15a61 ("[media] az6007: Change the az6007 read/write routine parameter") +Signed-off-by: Daniil Dulov +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/usb/dvb-usb-v2/az6007.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/usb/dvb-usb-v2/az6007.c b/drivers/media/usb/dvb-usb-v2/az6007.c +index 62ee09f28a0bc..7524c90f5da61 100644 +--- a/drivers/media/usb/dvb-usb-v2/az6007.c ++++ b/drivers/media/usb/dvb-usb-v2/az6007.c +@@ -202,7 +202,8 @@ static int az6007_rc_query(struct dvb_usb_device *d) + unsigned code; + enum rc_proto proto; + +- az6007_read(d, AZ6007_READ_IR, 0, 0, st->data, 10); ++ if (az6007_read(d, AZ6007_READ_IR, 0, 0, st->data, 10) < 0) ++ return -EIO; + + if (st->data[1] == 0x44) + return 0; +-- +2.39.2 + diff --git a/queue-6.4/media-usb-siano-fix-warning-due-to-null-work_func_t-.patch b/queue-6.4/media-usb-siano-fix-warning-due-to-null-work_func_t-.patch new file mode 100644 index 00000000000..4ce9637ac93 --- /dev/null +++ b/queue-6.4/media-usb-siano-fix-warning-due-to-null-work_func_t-.patch @@ -0,0 +1,83 @@ +From 4421ee976d62cb4f78d765f61f981e8771dcfc32 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 May 2023 07:59:32 +0800 +Subject: media: usb: siano: Fix warning due to null work_func_t function + pointer + +From: Duoming Zhou + +[ Upstream commit 6f489a966fbeb0da63d45c2c66a8957eab604bf6 ] + +The previous commit ebad8e731c1c ("media: usb: siano: Fix use after +free bugs caused by do_submit_urb") adds cancel_work_sync() in +smsusb_stop_streaming(). But smsusb_stop_streaming() may be called, +even if the work_struct surb->wq has not been initialized. As a result, +the warning will occur. One of the processes that could lead to warning +is shown below: + +smsusb_probe() + smsusb_init_device() + if (!dev->in_ep || !dev->out_ep || align < 0) { + smsusb_term_device(intf); + smsusb_stop_streaming() + cancel_work_sync(&dev->surbs[i].wq); + __cancel_work_timer() + __flush_work() + if (WARN_ON(!work->func)) // work->func is null + +The log reported by syzbot is shown below: + +WARNING: CPU: 0 PID: 897 at kernel/workqueue.c:3066 __flush_work+0x798/0xa80 kernel/workqueue.c:3063 +Modules linked in: +CPU: 0 PID: 897 Comm: kworker/0:2 Not tainted 6.2.0-rc1-syzkaller #0 +RIP: 0010:__flush_work+0x798/0xa80 kernel/workqueue.c:3066 +... +RSP: 0018:ffffc9000464ebf8 EFLAGS: 00010246 +RAX: 1ffff11002dbb420 RBX: 0000000000000021 RCX: 1ffffffff204fa4e +RDX: dffffc0000000000 RSI: 0000000000000001 RDI: ffff888016dda0e8 +RBP: ffffc9000464ed98 R08: 0000000000000001 R09: ffffffff90253b2f +R10: 0000000000000001 R11: 0000000000000000 R12: ffff888016dda0e8 +R13: ffff888016dda0e8 R14: ffff888016dda100 R15: 0000000000000001 +FS: 0000000000000000(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 00007ffd4331efe8 CR3: 000000000b48e000 CR4: 00000000003506f0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +Call Trace: + + __cancel_work_timer+0x315/0x460 kernel/workqueue.c:3160 + smsusb_stop_streaming drivers/media/usb/siano/smsusb.c:182 [inline] + smsusb_term_device+0xda/0x2d0 drivers/media/usb/siano/smsusb.c:344 + smsusb_init_device+0x400/0x9ce drivers/media/usb/siano/smsusb.c:419 + smsusb_probe+0xbbd/0xc55 drivers/media/usb/siano/smsusb.c:567 +... + +This patch adds check before cancel_work_sync(). If surb->wq has not +been initialized, the cancel_work_sync() will not be executed. + +Reported-by: syzbot+27b0b464864741b18b99@syzkaller.appspotmail.com +Fixes: ebad8e731c1c ("media: usb: siano: Fix use after free bugs caused by do_submit_urb") +Signed-off-by: Duoming Zhou +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/usb/siano/smsusb.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/usb/siano/smsusb.c b/drivers/media/usb/siano/smsusb.c +index 6f443c542c6da..640737d3b8aeb 100644 +--- a/drivers/media/usb/siano/smsusb.c ++++ b/drivers/media/usb/siano/smsusb.c +@@ -179,7 +179,8 @@ static void smsusb_stop_streaming(struct smsusb_device_t *dev) + + for (i = 0; i < MAX_URBS; i++) { + usb_kill_urb(&dev->surbs[i].urb); +- cancel_work_sync(&dev->surbs[i].wq); ++ if (dev->surbs[i].wq.func) ++ cancel_work_sync(&dev->surbs[i].wq); + + if (dev->surbs[i].cb) { + smscore_putbuffer(dev->coredev, dev->surbs[i].cb); +-- +2.39.2 + diff --git a/queue-6.4/media-venus-helpers-fix-align-of-non-power-of-two.patch b/queue-6.4/media-venus-helpers-fix-align-of-non-power-of-two.patch new file mode 100644 index 00000000000..c469861ec9a --- /dev/null +++ b/queue-6.4/media-venus-helpers-fix-align-of-non-power-of-two.patch @@ -0,0 +1,51 @@ +From 4c2da866995863c6f08f579cf8ab98ac39a7bb35 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 12 Sep 2020 20:03:01 +0100 +Subject: media: venus: helpers: Fix ALIGN() of non power of two + +From: Rikard Falkeborn + +[ Upstream commit 927e78ac8bc58155316cf6f46026e1912bbbbcfc ] + +ALIGN() expects its second argument to be a power of 2, otherwise +incorrect results are produced for some inputs. The output can be +both larger or smaller than what is expected. + +For example, ALIGN(304, 192) equals 320 instead of 384, and +ALIGN(65, 192) equals 256 instead of 192. + +However, nestling two ALIGN() as is done in this case seem to only +produce results equal to or bigger than the expected result if ALIGN() +had handled non powers of two, and that in turn results in framesizes +that are either the correct size or too large. + +Fortunately, since 192 * 4 / 3 equals 256, it turns out that one ALIGN() +is sufficient. + +Fixes: ab1eda449c6e ("media: venus: vdec: handle 10bit bitstreams") +Signed-off-by: Rikard Falkeborn +Signed-off-by: Stanimir Varbanov +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/qcom/venus/helpers.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/platform/qcom/venus/helpers.c b/drivers/media/platform/qcom/venus/helpers.c +index a2ceab7f9ddbf..a68389b0aae0a 100644 +--- a/drivers/media/platform/qcom/venus/helpers.c ++++ b/drivers/media/platform/qcom/venus/helpers.c +@@ -1036,8 +1036,8 @@ static u32 get_framesize_raw_yuv420_tp10_ubwc(u32 width, u32 height) + u32 extradata = SZ_16K; + u32 size; + +- y_stride = ALIGN(ALIGN(width, 192) * 4 / 3, 256); +- uv_stride = ALIGN(ALIGN(width, 192) * 4 / 3, 256); ++ y_stride = ALIGN(width * 4 / 3, 256); ++ uv_stride = ALIGN(width * 4 / 3, 256); + y_sclines = ALIGN(height, 16); + uv_sclines = ALIGN((height + 1) >> 1, 16); + +-- +2.39.2 + diff --git a/queue-6.4/media-videodev2.h-fix-p_s32-and-p_s64-pointer-types.patch b/queue-6.4/media-videodev2.h-fix-p_s32-and-p_s64-pointer-types.patch new file mode 100644 index 00000000000..7e04fff17b2 --- /dev/null +++ b/queue-6.4/media-videodev2.h-fix-p_s32-and-p_s64-pointer-types.patch @@ -0,0 +1,38 @@ +From 7d385bdc0348136f9b95140c9746f0b63f724f5a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 May 2023 16:57:06 +0200 +Subject: media: videodev2.h: Fix p_s32 and p_s64 pointer types + +From: Daniel Lundberg Pedersen + +[ Upstream commit 3f6375a2d1956739c6c8ffa3a862c9278d346940 ] + +Use the intended pointer types for p_s32 and p_64 in the union of the +struct v4l2_ext_control. + +Fixes: e77eb66342c7 ("videodev2.h: add p_s32 and p_s64 pointers") +Signed-off-by: Daniel Lundberg Pedersen +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + include/uapi/linux/videodev2.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/include/uapi/linux/videodev2.h b/include/uapi/linux/videodev2.h +index aee75eb9e6863..9e7cf1d369456 100644 +--- a/include/uapi/linux/videodev2.h ++++ b/include/uapi/linux/videodev2.h +@@ -1807,8 +1807,8 @@ struct v4l2_ext_control { + __u8 __user *p_u8; + __u16 __user *p_u16; + __u32 __user *p_u32; +- __u32 __user *p_s32; +- __u32 __user *p_s64; ++ __s32 __user *p_s32; ++ __s64 __user *p_s64; + struct v4l2_area __user *p_area; + struct v4l2_ctrl_h264_sps __user *p_h264_sps; + struct v4l2_ctrl_h264_pps *p_h264_pps; +-- +2.39.2 + diff --git a/queue-6.4/media-videodev2.h-fix-struct-v4l2_input-tuner-index-.patch b/queue-6.4/media-videodev2.h-fix-struct-v4l2_input-tuner-index-.patch new file mode 100644 index 00000000000..891cbe3e174 --- /dev/null +++ b/queue-6.4/media-videodev2.h-fix-struct-v4l2_input-tuner-index-.patch @@ -0,0 +1,62 @@ +From 3ea3e5a76876706cd1dc57ee4201c63ac4b4d66c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 May 2023 15:36:49 +0200 +Subject: media: videodev2.h: Fix struct v4l2_input tuner index comment + +From: Marek Vasut + +[ Upstream commit 26ae58f65e64fa7ba61d64bae752e59e08380c6a ] + +VIDIOC_ENUMINPUT documentation describes the tuner field of +struct v4l2_input as index: + +Documentation/userspace-api/media/v4l/vidioc-enuminput.rst +" +* - __u32 + - ``tuner`` + - Capture devices can have zero or more tuners (RF demodulators). + When the ``type`` is set to ``V4L2_INPUT_TYPE_TUNER`` this is an + RF connector and this field identifies the tuner. It corresponds + to struct :c:type:`v4l2_tuner` field ``index``. For + details on tuners see :ref:`tuner`. +" + +Drivers I could find also use the 'tuner' field as an index, e.g.: +drivers/media/pci/bt8xx/bttv-driver.c bttv_enum_input() +drivers/media/usb/go7007/go7007-v4l2.c vidioc_enum_input() + +However, the UAPI comment claims this field is 'enum v4l2_tuner_type': +include/uapi/linux/videodev2.h + +This field being 'enum v4l2_tuner_type' is unlikely as it seems to be +never used that way in drivers, and documentation confirms it. It seem +this comment got in accidentally in the commit which this patch fixes. +Fix the UAPI comment to stop confusion. + +This was pointed out by Dmitry while reviewing VIDIOC_ENUMINPUT +support for strace. + +Fixes: 6016af82eafc ("[media] v4l2: use __u32 rather than enums in ioctl() structs") +Signed-off-by: Marek Vasut +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + include/uapi/linux/videodev2.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/uapi/linux/videodev2.h b/include/uapi/linux/videodev2.h +index 9e7cf1d369456..5d8bd754c69f1 100644 +--- a/include/uapi/linux/videodev2.h ++++ b/include/uapi/linux/videodev2.h +@@ -1720,7 +1720,7 @@ struct v4l2_input { + __u8 name[32]; /* Label */ + __u32 type; /* Type of input */ + __u32 audioset; /* Associated audios (bitfield) */ +- __u32 tuner; /* enum v4l2_tuner_type */ ++ __u32 tuner; /* Tuner index */ + v4l2_std_id std; + __u32 status; + __u32 capabilities; +-- +2.39.2 + diff --git a/queue-6.4/mfd-intel-lpss-add-missing-check-for-platform_get_re.patch b/queue-6.4/mfd-intel-lpss-add-missing-check-for-platform_get_re.patch new file mode 100644 index 00000000000..886f42f00f0 --- /dev/null +++ b/queue-6.4/mfd-intel-lpss-add-missing-check-for-platform_get_re.patch @@ -0,0 +1,38 @@ +From ef41a33d56b26587cd87e6dc107039348baeda52 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Jun 2023 09:48:18 +0800 +Subject: mfd: intel-lpss: Add missing check for platform_get_resource + +From: Jiasheng Jiang + +[ Upstream commit d918e0d5824495a75d00b879118b098fcab36fdb ] + +Add the missing check for platform_get_resource and return error +if it fails. + +Fixes: 4b45efe85263 ("mfd: Add support for Intel Sunrisepoint LPSS devices") +Signed-off-by: Jiasheng Jiang +Signed-off-by: Lee Jones +Link: https://lore.kernel.org/r/20230609014818.28475-1-jiasheng@iscas.ac.cn +Signed-off-by: Sasha Levin +--- + drivers/mfd/intel-lpss-acpi.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/mfd/intel-lpss-acpi.c b/drivers/mfd/intel-lpss-acpi.c +index a143c8dca2d93..212818aef93e2 100644 +--- a/drivers/mfd/intel-lpss-acpi.c ++++ b/drivers/mfd/intel-lpss-acpi.c +@@ -183,6 +183,9 @@ static int intel_lpss_acpi_probe(struct platform_device *pdev) + return -ENOMEM; + + info->mem = platform_get_resource(pdev, IORESOURCE_MEM, 0); ++ if (!info->mem) ++ return -ENODEV; ++ + info->irq = platform_get_irq(pdev, 0); + + ret = intel_lpss_probe(&pdev->dev, info); +-- +2.39.2 + diff --git a/queue-6.4/mfd-rt5033-drop-rt5033-battery-sub-device.patch b/queue-6.4/mfd-rt5033-drop-rt5033-battery-sub-device.patch new file mode 100644 index 00000000000..4131515a475 --- /dev/null +++ b/queue-6.4/mfd-rt5033-drop-rt5033-battery-sub-device.patch @@ -0,0 +1,41 @@ +From 57f2f93608352d23a9891b9cd73e6e23218d8d0b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 May 2023 22:57:10 +0200 +Subject: mfd: rt5033: Drop rt5033-battery sub-device + +From: Stephan Gerhold + +[ Upstream commit 43db1344e0f8c1eb687a1d6cd5b0de3009ab66cb ] + +The fuel gauge in the RT5033 PMIC (rt5033-battery) has its own I2C bus +and interrupt lines. Therefore, it is not part of the MFD device +and needs to be specified separately in the device tree. + +Fixes: 0b271258544b ("mfd: rt5033: Add Richtek RT5033 driver core.") +Signed-off-by: Stephan Gerhold +Signed-off-by: Jakob Hauser +Reviewed-by: Linus Walleij +Signed-off-by: Lee Jones +Link: https://lore.kernel.org/r/6a8a19bc67b5be3732882e8131ad2ffcb546ac03.1684182964.git.jahau@rocketmail.com +Signed-off-by: Sasha Levin +--- + drivers/mfd/rt5033.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/mfd/rt5033.c b/drivers/mfd/rt5033.c +index a5e520fe50a14..8029d444b7942 100644 +--- a/drivers/mfd/rt5033.c ++++ b/drivers/mfd/rt5033.c +@@ -40,9 +40,6 @@ static const struct mfd_cell rt5033_devs[] = { + { + .name = "rt5033-charger", + .of_compatible = "richtek,rt5033-charger", +- }, { +- .name = "rt5033-battery", +- .of_compatible = "richtek,rt5033-battery", + }, { + .name = "rt5033-led", + .of_compatible = "richtek,rt5033-led", +-- +2.39.2 + diff --git a/queue-6.4/mfd-stmfx-fix-error-path-in-stmfx_chip_init.patch b/queue-6.4/mfd-stmfx-fix-error-path-in-stmfx_chip_init.patch new file mode 100644 index 00000000000..4f6c42d4384 --- /dev/null +++ b/queue-6.4/mfd-stmfx-fix-error-path-in-stmfx_chip_init.patch @@ -0,0 +1,38 @@ +From 8f8b632161d688ea1dcd8291e18d483c192a8450 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Jun 2023 11:28:03 +0200 +Subject: mfd: stmfx: Fix error path in stmfx_chip_init + +From: Amelie Delaunay + +[ Upstream commit f592cf624531286f8b52e40dcfc157a5a7fb115c ] + +In error path, disable vdd regulator if it exists, but don't overload ret. +Because if regulator_disable() is successful, stmfx_chip_init will exit +successfully while chip init failed. + +Fixes: 06252ade9156 ("mfd: Add ST Multi-Function eXpander (STMFX) core driver") +Signed-off-by: Amelie Delaunay +Link: https://lore.kernel.org/r/20230609092804.793100-1-amelie.delaunay@foss.st.com +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/stmfx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/mfd/stmfx.c b/drivers/mfd/stmfx.c +index e281971ba54ed..bfe89df276112 100644 +--- a/drivers/mfd/stmfx.c ++++ b/drivers/mfd/stmfx.c +@@ -387,7 +387,7 @@ static int stmfx_chip_init(struct i2c_client *client) + + err: + if (stmfx->vdd) +- return regulator_disable(stmfx->vdd); ++ regulator_disable(stmfx->vdd); + + return ret; + } +-- +2.39.2 + diff --git a/queue-6.4/mfd-stmfx-nullify-stmfx-vdd-in-case-of-error.patch b/queue-6.4/mfd-stmfx-nullify-stmfx-vdd-in-case-of-error.patch new file mode 100644 index 00000000000..6eced19d9a4 --- /dev/null +++ b/queue-6.4/mfd-stmfx-nullify-stmfx-vdd-in-case-of-error.patch @@ -0,0 +1,41 @@ +From 91dc9c4b69c204aaf2bc54395b19a0f8d4b6be44 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Jun 2023 11:28:04 +0200 +Subject: mfd: stmfx: Nullify stmfx->vdd in case of error + +From: Amelie Delaunay + +[ Upstream commit 7c81582c0bccb4757186176f0ee12834597066ad ] + +Nullify stmfx->vdd in case devm_regulator_get_optional() returns an error. +And simplify code by returning an error only if return code is not -ENODEV, +which means there is no vdd regulator and it is not an issue. + +Fixes: d75846ed08e6 ("mfd: stmfx: Fix dev_err_probe() call in stmfx_chip_init()") +Signed-off-by: Amelie Delaunay +Link: https://lore.kernel.org/r/20230609092804.793100-2-amelie.delaunay@foss.st.com +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/stmfx.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/mfd/stmfx.c b/drivers/mfd/stmfx.c +index bfe89df276112..76188212c66eb 100644 +--- a/drivers/mfd/stmfx.c ++++ b/drivers/mfd/stmfx.c +@@ -330,9 +330,8 @@ static int stmfx_chip_init(struct i2c_client *client) + stmfx->vdd = devm_regulator_get_optional(&client->dev, "vdd"); + ret = PTR_ERR_OR_ZERO(stmfx->vdd); + if (ret) { +- if (ret == -ENODEV) +- stmfx->vdd = NULL; +- else ++ stmfx->vdd = NULL; ++ if (ret != -ENODEV) + return dev_err_probe(&client->dev, ret, "Failed to get VDD regulator\n"); + } + +-- +2.39.2 + diff --git a/queue-6.4/mfd-stmpe-only-disable-the-regulators-if-they-are-en.patch b/queue-6.4/mfd-stmpe-only-disable-the-regulators-if-they-are-en.patch new file mode 100644 index 00000000000..879163afb72 --- /dev/null +++ b/queue-6.4/mfd-stmpe-only-disable-the-regulators-if-they-are-en.patch @@ -0,0 +1,45 @@ +From bd5a1e7a9c5f6be939963febfadf1fca8c9a9ce7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 17 Jun 2023 12:43:16 +0200 +Subject: mfd: stmpe: Only disable the regulators if they are enabled + +From: Christophe JAILLET + +[ Upstream commit 104d32bd81f620bb9f67fbf7d1159c414e89f05f ] + +In stmpe_probe(), if some regulator_enable() calls fail, probing continues +and there is only a dev_warn(). + +So, if stmpe_probe() is called the regulator may not be enabled. It is +cleaner to test it before calling regulator_disable() in the remove +function. + +Fixes: 9c9e321455fb ("mfd: stmpe: add optional regulators") +Signed-off-by: Christophe JAILLET +Reviewed-by: Linus Walleij +Link: https://lore.kernel.org/r/8de3aaf297931d655b9ad6aed548f4de8b85425a.1686998575.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/stmpe.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/mfd/stmpe.c b/drivers/mfd/stmpe.c +index a92301dfc7126..9c3cf58457a7d 100644 +--- a/drivers/mfd/stmpe.c ++++ b/drivers/mfd/stmpe.c +@@ -1485,9 +1485,9 @@ int stmpe_probe(struct stmpe_client_info *ci, enum stmpe_partnum partnum) + + void stmpe_remove(struct stmpe *stmpe) + { +- if (!IS_ERR(stmpe->vio)) ++ if (!IS_ERR(stmpe->vio) && regulator_is_enabled(stmpe->vio)) + regulator_disable(stmpe->vio); +- if (!IS_ERR(stmpe->vcc)) ++ if (!IS_ERR(stmpe->vcc) && regulator_is_enabled(stmpe->vcc)) + regulator_disable(stmpe->vcc); + + __stmpe_disable(stmpe, STMPE_BLOCK_ADC); +-- +2.39.2 + diff --git a/queue-6.4/mfd-wcd934x-fix-an-error-handling-path-in-wcd934x_sl.patch b/queue-6.4/mfd-wcd934x-fix-an-error-handling-path-in-wcd934x_sl.patch new file mode 100644 index 00000000000..acca673f4de --- /dev/null +++ b/queue-6.4/mfd-wcd934x-fix-an-error-handling-path-in-wcd934x_sl.patch @@ -0,0 +1,54 @@ +From d8c5a2af4aae914e1879a21853f0fcbe63ca1a21 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 20 May 2023 09:10:54 +0200 +Subject: mfd: wcd934x: Fix an error handling path in wcd934x_slim_probe() + +From: Christophe JAILLET + +[ Upstream commit f190b4891a3f9fac123a7afd378d4143a2723313 ] + +If devm_gpiod_get_optional() fails, some resources need to be released, as +already done in the .remove() function. + +While at it, remove the unneeded error code from a dev_err_probe() call. +It is already added in a human readable way by dev_err_probe() itself. + +Fixes: 6a0ee2a61a31 ("mfd: wcd934x: Replace legacy gpio interface for gpiod") +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/02d8447f6d1df52cc8357aae698152e9a9be67c6.1684565021.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/wcd934x.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/drivers/mfd/wcd934x.c b/drivers/mfd/wcd934x.c +index 07e884087f2c7..281470d6b0b99 100644 +--- a/drivers/mfd/wcd934x.c ++++ b/drivers/mfd/wcd934x.c +@@ -258,8 +258,9 @@ static int wcd934x_slim_probe(struct slim_device *sdev) + usleep_range(600, 650); + reset_gpio = devm_gpiod_get_optional(dev, "reset", GPIOD_OUT_LOW); + if (IS_ERR(reset_gpio)) { +- return dev_err_probe(dev, PTR_ERR(reset_gpio), +- "Failed to get reset gpio: err = %ld\n", PTR_ERR(reset_gpio)); ++ ret = dev_err_probe(dev, PTR_ERR(reset_gpio), ++ "Failed to get reset gpio\n"); ++ goto err_disable_regulators; + } + msleep(20); + gpiod_set_value(reset_gpio, 1); +@@ -269,6 +270,10 @@ static int wcd934x_slim_probe(struct slim_device *sdev) + dev_set_drvdata(dev, ddata); + + return 0; ++ ++err_disable_regulators: ++ regulator_bulk_disable(WCD934X_MAX_SUPPLY, ddata->supplies); ++ return ret; + } + + static void wcd934x_slim_remove(struct slim_device *sdev) +-- +2.39.2 + diff --git a/queue-6.4/misc-fastrpc-check-return-value-of-devm_kasprintf.patch b/queue-6.4/misc-fastrpc-check-return-value-of-devm_kasprintf.patch new file mode 100644 index 00000000000..fbad77daeff --- /dev/null +++ b/queue-6.4/misc-fastrpc-check-return-value-of-devm_kasprintf.patch @@ -0,0 +1,39 @@ +From c5544b9db03572cd8105b8b23d704165fbd484de Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Jun 2023 13:25:46 +0300 +Subject: misc: fastrpc: check return value of devm_kasprintf() + +From: Claudiu Beznea + +[ Upstream commit af2e19d82a116bc622eea84c9faadd5f7e20bec4 ] + +devm_kasprintf() returns a pointer to dynamically allocated memory. +Pointer could be NULL in case allocation fails. Check pointer validity. +Identified with coccinelle (kmerr.cocci script). + +Fixes: 3abe3ab3cdab ("misc: fastrpc: add secure domain support") +Signed-off-by: Claudiu Beznea +Link: https://lore.kernel.org/r/20230615102546.581899-1-claudiu.beznea@microchip.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/misc/fastrpc.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c +index 30d4d0476248f..9051551d99373 100644 +--- a/drivers/misc/fastrpc.c ++++ b/drivers/misc/fastrpc.c +@@ -2225,6 +2225,9 @@ static int fastrpc_device_register(struct device *dev, struct fastrpc_channel_ct + fdev->miscdev.fops = &fastrpc_fops; + fdev->miscdev.name = devm_kasprintf(dev, GFP_KERNEL, "fastrpc-%s%s", + domain, is_secured ? "-secure" : ""); ++ if (!fdev->miscdev.name) ++ return -ENOMEM; ++ + err = misc_register(&fdev->miscdev); + if (!err) { + if (is_secured) +-- +2.39.2 + diff --git a/queue-6.4/mlxsw-minimal-fix-potential-memory-leak-in-mlxsw_m_l.patch b/queue-6.4/mlxsw-minimal-fix-potential-memory-leak-in-mlxsw_m_l.patch new file mode 100644 index 00000000000..de2352e3f04 --- /dev/null +++ b/queue-6.4/mlxsw-minimal-fix-potential-memory-leak-in-mlxsw_m_l.patch @@ -0,0 +1,40 @@ +From 250ee84c4275bb563a0558438e41d7be71238c8c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Jun 2023 09:26:47 +0800 +Subject: mlxsw: minimal: fix potential memory leak in mlxsw_m_linecards_init + +From: Zhengchao Shao + +[ Upstream commit 08fc75735fda3be97194bfbf3c899c87abb3d0fe ] + +The line cards array is not freed in the error path of +mlxsw_m_linecards_init(), which can lead to a memory leak. Fix by +freeing the array in the error path, thereby making the error path +identical to mlxsw_m_linecards_fini(). + +Fixes: 01328e23a476 ("mlxsw: minimal: Extend module to port mapping with slot index") +Signed-off-by: Zhengchao Shao +Reviewed-by: Petr Machata +Reviewed-by: Ido Schimmel +Link: https://lore.kernel.org/r/20230630012647.1078002-1-shaozhengchao@huawei.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlxsw/minimal.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/mellanox/mlxsw/minimal.c b/drivers/net/ethernet/mellanox/mlxsw/minimal.c +index 6b56eadd736e5..6b98c3287b497 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/minimal.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/minimal.c +@@ -417,6 +417,7 @@ static int mlxsw_m_linecards_init(struct mlxsw_m *mlxsw_m) + err_kmalloc_array: + for (i--; i >= 0; i--) + kfree(mlxsw_m->line_cards[i]); ++ kfree(mlxsw_m->line_cards); + err_kcalloc: + kfree(mlxsw_m->ports); + return err; +-- +2.39.2 + diff --git a/queue-6.4/net-bridge-keep-ports-without-iff_unicast_flt-in-br_.patch b/queue-6.4/net-bridge-keep-ports-without-iff_unicast_flt-in-br_.patch new file mode 100644 index 00000000000..7ece3ab33b2 --- /dev/null +++ b/queue-6.4/net-bridge-keep-ports-without-iff_unicast_flt-in-br_.patch @@ -0,0 +1,198 @@ +From 79422008b833505c44a398796a4e50bbbb79a8d2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Jun 2023 19:41:18 +0300 +Subject: net: bridge: keep ports without IFF_UNICAST_FLT in BR_PROMISC mode + +From: Vladimir Oltean + +[ Upstream commit 6ca3c005d0604e8d2b439366e3923ea58db99641 ] + +According to the synchronization rules for .ndo_get_stats() as seen in +Documentation/networking/netdevices.rst, acquiring a plain spin_lock() +should not be illegal, but the bridge driver implementation makes it so. + +After running these commands, I am being faced with the following +lockdep splat: + +$ ip link add link swp0 name macsec0 type macsec encrypt on && ip link set swp0 up +$ ip link add dev br0 type bridge vlan_filtering 1 && ip link set br0 up +$ ip link set macsec0 master br0 && ip link set macsec0 up + + ======================================================== + WARNING: possible irq lock inversion dependency detected + 6.4.0-04295-g31b577b4bd4a #603 Not tainted + -------------------------------------------------------- + swapper/1/0 just changed the state of lock: + ffff6bd348724cd8 (&br->lock){+.-.}-{3:3}, at: br_forward_delay_timer_expired+0x34/0x198 + but this lock took another, SOFTIRQ-unsafe lock in the past: + (&ocelot->stats_lock){+.+.}-{3:3} + + and interrupts could create inverse lock ordering between them. + + other info that might help us debug this: + Chain exists of: + &br->lock --> &br->hash_lock --> &ocelot->stats_lock + + Possible interrupt unsafe locking scenario: + + CPU0 CPU1 + ---- ---- + lock(&ocelot->stats_lock); + local_irq_disable(); + lock(&br->lock); + lock(&br->hash_lock); + + lock(&br->lock); + + *** DEADLOCK *** + +(details about the 3 locks skipped) + +swp0 is instantiated by drivers/net/dsa/ocelot/felix.c, and this +only matters to the extent that its .ndo_get_stats64() method calls +spin_lock(&ocelot->stats_lock). + +Documentation/locking/lockdep-design.rst says: + +| A lock is irq-safe means it was ever used in an irq context, while a lock +| is irq-unsafe means it was ever acquired with irq enabled. + +(...) + +| Furthermore, the following usage based lock dependencies are not allowed +| between any two lock-classes:: +| +| -> +| -> + +Lockdep marks br->hash_lock as softirq-safe, because it is sometimes +taken in softirq context (for example br_fdb_update() which runs in +NET_RX softirq), and when it's not in softirq context it blocks softirqs +by using spin_lock_bh(). + +Lockdep marks ocelot->stats_lock as softirq-unsafe, because it never +blocks softirqs from running, and it is never taken from softirq +context. So it can always be interrupted by softirqs. + +There is a call path through which a function that holds br->hash_lock: +fdb_add_hw_addr() will call a function that acquires ocelot->stats_lock: +ocelot_port_get_stats64(). This can be seen below: + +ocelot_port_get_stats64+0x3c/0x1e0 +felix_get_stats64+0x20/0x38 +dsa_slave_get_stats64+0x3c/0x60 +dev_get_stats+0x74/0x2c8 +rtnl_fill_stats+0x4c/0x150 +rtnl_fill_ifinfo+0x5cc/0x7b8 +rtmsg_ifinfo_build_skb+0xe4/0x150 +rtmsg_ifinfo+0x5c/0xb0 +__dev_notify_flags+0x58/0x200 +__dev_set_promiscuity+0xa0/0x1f8 +dev_set_promiscuity+0x30/0x70 +macsec_dev_change_rx_flags+0x68/0x88 +__dev_set_promiscuity+0x1a8/0x1f8 +__dev_set_rx_mode+0x74/0xa8 +dev_uc_add+0x74/0xa0 +fdb_add_hw_addr+0x68/0xd8 +fdb_add_local+0xc4/0x110 +br_fdb_add_local+0x54/0x88 +br_add_if+0x338/0x4a0 +br_add_slave+0x20/0x38 +do_setlink+0x3a4/0xcb8 +rtnl_newlink+0x758/0x9d0 +rtnetlink_rcv_msg+0x2f0/0x550 +netlink_rcv_skb+0x128/0x148 +rtnetlink_rcv+0x24/0x38 + +the plain English explanation for it is: + +The macsec0 bridge port is created without p->flags & BR_PROMISC, +because it is what br_manage_promisc() decides for a VLAN filtering +bridge with a single auto port. + +As part of the br_add_if() procedure, br_fdb_add_local() is called for +the MAC address of the device, and this results in a call to +dev_uc_add() for macsec0 while the softirq-safe br->hash_lock is taken. + +Because macsec0 does not have IFF_UNICAST_FLT, dev_uc_add() ends up +calling __dev_set_promiscuity() for macsec0, which is propagated by its +implementation, macsec_dev_change_rx_flags(), to the lower device: swp0. +This triggers the call path: + +dev_set_promiscuity(swp0) +-> rtmsg_ifinfo() + -> dev_get_stats() + -> ocelot_port_get_stats64() + +with a calling context that lockdep doesn't like (br->hash_lock held). + +Normally we don't see this, because even though many drivers that can be +bridge ports don't support IFF_UNICAST_FLT, we need a driver that + +(a) doesn't support IFF_UNICAST_FLT, *and* +(b) it forwards the IFF_PROMISC flag to another driver, and +(c) *that* driver implements ndo_get_stats64() using a softirq-unsafe + spinlock. + +Condition (b) is necessary because the first __dev_set_rx_mode() calls +__dev_set_promiscuity() with "bool notify=false", and thus, the +rtmsg_ifinfo() code path won't be entered. + +The same criteria also hold true for DSA switches which don't report +IFF_UNICAST_FLT. When the DSA master uses a spin_lock() in its +ndo_get_stats64() method, the same lockdep splat can be seen. + +I think the deadlock possibility is real, even though I didn't reproduce +it, and I'm thinking of the following situation to support that claim: + +fdb_add_hw_addr() runs on a CPU A, in a context with softirqs locally +disabled and br->hash_lock held, and may end up attempting to acquire +ocelot->stats_lock. + +In parallel, ocelot->stats_lock is currently held by a thread B (say, +ocelot_check_stats_work()), which is interrupted while holding it by a +softirq which attempts to lock br->hash_lock. + +Thread B cannot make progress because br->hash_lock is held by A. Whereas +thread A cannot make progress because ocelot->stats_lock is held by B. + +When taking the issue at face value, the bridge can avoid that problem +by simply making the ports promiscuous from a code path with a saner +calling context (br->hash_lock not held). A bridge port without +IFF_UNICAST_FLT is going to become promiscuous as soon as we call +dev_uc_add() on it (which we do unconditionally), so why not be +preemptive and make it promiscuous right from the beginning, so as to +not be taken by surprise. + +With this, we've broken the links between code that holds br->hash_lock +or br->lock and code that calls into the ndo_change_rx_flags() or +ndo_get_stats64() ops of the bridge port. + +Fixes: 2796d0c648c9 ("bridge: Automatically manage port promiscuous mode.") +Signed-off-by: Vladimir Oltean +Reviewed-by: Ido Schimmel +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/bridge/br_if.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c +index 3f04b40f60568..2450690f98cfa 100644 +--- a/net/bridge/br_if.c ++++ b/net/bridge/br_if.c +@@ -166,8 +166,9 @@ void br_manage_promisc(struct net_bridge *br) + * This lets us disable promiscuous mode and write + * this config to hw. + */ +- if (br->auto_cnt == 0 || +- (br->auto_cnt == 1 && br_auto_port(p))) ++ if ((p->dev->priv_flags & IFF_UNICAST_FLT) && ++ (br->auto_cnt == 0 || ++ (br->auto_cnt == 1 && br_auto_port(p)))) + br_port_clear_promisc(p); + else + br_port_set_promisc(p); +-- +2.39.2 + diff --git a/queue-6.4/net-dsa-felix-don-t-drop-ptp-frames-with-tag_8021q-w.patch b/queue-6.4/net-dsa-felix-don-t-drop-ptp-frames-with-tag_8021q-w.patch new file mode 100644 index 00000000000..1e1a6e5355e --- /dev/null +++ b/queue-6.4/net-dsa-felix-don-t-drop-ptp-frames-with-tag_8021q-w.patch @@ -0,0 +1,71 @@ +From f480e8b3437f17949221f0ded7bba5a9fd796339 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Jun 2023 19:31:14 +0300 +Subject: net: dsa: felix: don't drop PTP frames with tag_8021q when RX + timestamping is disabled + +From: Vladimir Oltean + +[ Upstream commit 2edcfcbb3c5946609be1d8875473a240b170673b ] + +The driver implements a workaround for the fact that it doesn't have an +IRQ source to tell it whether PTP frames are available through the +extraction registers, for those frames to be processed and passed +towards the network stack. That workaround is to configure the switch, +through felix_hwtstamp_set() -> felix_update_trapping_destinations(), +to create two copies of PTP packets: one sent over Ethernet to the DSA +master, and one to be consumed through the aforementioned CPU extraction +queue registers. + +The reason why we want PTP packets to be consumed through the CPU +extraction registers in the first place is because we want to see their +hardware RX timestamp. With tag_8021q, that is only visible that way, +and it isn't visible with the copy of the packet that's transmitted over +Ethernet. + +The problem with the workaround implementation is that it drops the +packet received over Ethernet, in expectation of its copy being present +in the CPU extraction registers. However, if felix_hwtstamp_set() hasn't +run (aka PTP RX timestamping is disabled), the driver will drop the +original PTP frame and there will be no copy of it in the CPU extraction +registers. So, the network stack will simply not see any PTP frame. + +Look at the port's trapping configuration to see whether the driver has +previously enabled the CPU extraction registers. If it hasn't, just +don't RX timestamp the frame and let it be passed up the stack by DSA, +which is perfectly fine. + +Fixes: 0a6f17c6ae21 ("net: dsa: tag_ocelot_8021q: add support for PTP timestamping") +Signed-off-by: Vladimir Oltean +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/ocelot/felix.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/drivers/net/dsa/ocelot/felix.c b/drivers/net/dsa/ocelot/felix.c +index 80861ac090ae3..70c0e2b1936b3 100644 +--- a/drivers/net/dsa/ocelot/felix.c ++++ b/drivers/net/dsa/ocelot/felix.c +@@ -1725,6 +1725,18 @@ static bool felix_rxtstamp(struct dsa_switch *ds, int port, + u32 tstamp_hi; + u64 tstamp; + ++ switch (type & PTP_CLASS_PMASK) { ++ case PTP_CLASS_L2: ++ if (!(ocelot->ports[port]->trap_proto & OCELOT_PROTO_PTP_L2)) ++ return false; ++ break; ++ case PTP_CLASS_IPV4: ++ case PTP_CLASS_IPV6: ++ if (!(ocelot->ports[port]->trap_proto & OCELOT_PROTO_PTP_L4)) ++ return false; ++ break; ++ } ++ + /* If the "no XTR IRQ" workaround is in use, tell DSA to defer this skb + * for RX timestamping. Then free it, and poll for its copy through + * MMIO in the CPU port module, and inject that into the stack from +-- +2.39.2 + diff --git a/queue-6.4/net-dsa-sja1105-always-enable-the-incl_srcpt-option.patch b/queue-6.4/net-dsa-sja1105-always-enable-the-incl_srcpt-option.patch new file mode 100644 index 00000000000..e80055438f8 --- /dev/null +++ b/queue-6.4/net-dsa-sja1105-always-enable-the-incl_srcpt-option.patch @@ -0,0 +1,77 @@ +From 777973494b33a0ad17e1c99c171c4fc2b294ae56 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Jun 2023 12:42:06 +0300 +Subject: net: dsa: sja1105: always enable the INCL_SRCPT option + +From: Vladimir Oltean + +[ Upstream commit b4638af8885af93cd70351081da1909c59342440 ] + +Link-local traffic on bridged SJA1105 ports is sometimes tagged by the +hardware with source port information (when the port is under a VLAN +aware bridge). + +The tag_8021q source port identification has become more loose +("imprecise") and will report a plausible rather than exact bridge port, +when under a bridge (be it VLAN-aware or VLAN-unaware). But link-local +traffic always needs to know the precise source port. + +Modify the driver logic (and therefore: the tagging protocol itself) to +always include the source port information with link-local packets, +regardless of whether the port is standalone, under a VLAN-aware or +VLAN-unaware bridge. This makes it possible for the tagging driver to +give priority to that information over the tag_8021q VLAN header. + +The big drawback with INCL_SRCPT is that it makes it impossible to +distinguish between an original MAC DA of 01:80:C2:XX:YY:ZZ and +01:80:C2:AA:BB:ZZ, because the tagger just patches MAC DA bytes 3 and 4 +with zeroes. Only if PTP RX timestamping is enabled, the switch will +generate a META follow-up frame containing the RX timestamp and the +original bytes 3 and 4 of the MAC DA. Those will be used to patch up the +original packet. Nonetheless, in the absence of PTP RX timestamping, we +have to live with this limitation, since it is more important to have +the more precise source port information for link-local traffic. + +Fixes: d7f9787a763f ("net: dsa: tag_8021q: add support for imprecise RX based on the VBID") +Fixes: 91495f21fcec ("net: dsa: tag_8021q: replace the SVL bridging with VLAN-unaware IVL bridging") +Signed-off-by: Vladimir Oltean +Reviewed-by: Simon Horman +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/sja1105/sja1105_main.c | 9 ++------- + 1 file changed, 2 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/dsa/sja1105/sja1105_main.c b/drivers/net/dsa/sja1105/sja1105_main.c +index b70dcf32a26dc..8bd61f2ebb2ad 100644 +--- a/drivers/net/dsa/sja1105/sja1105_main.c ++++ b/drivers/net/dsa/sja1105/sja1105_main.c +@@ -866,11 +866,11 @@ static int sja1105_init_general_params(struct sja1105_private *priv) + .hostprio = 7, + .mac_fltres1 = SJA1105_LINKLOCAL_FILTER_A, + .mac_flt1 = SJA1105_LINKLOCAL_FILTER_A_MASK, +- .incl_srcpt1 = false, ++ .incl_srcpt1 = true, + .send_meta1 = false, + .mac_fltres0 = SJA1105_LINKLOCAL_FILTER_B, + .mac_flt0 = SJA1105_LINKLOCAL_FILTER_B_MASK, +- .incl_srcpt0 = false, ++ .incl_srcpt0 = true, + .send_meta0 = false, + /* Default to an invalid value */ + .mirr_port = priv->ds->num_ports, +@@ -2407,11 +2407,6 @@ int sja1105_vlan_filtering(struct dsa_switch *ds, int port, bool enabled, + general_params->tpid = tpid; + /* EtherType used to identify outer tagged (S-tag) VLAN traffic */ + general_params->tpid2 = tpid2; +- /* When VLAN filtering is on, we need to at least be able to +- * decode management traffic through the "backup plan". +- */ +- general_params->incl_srcpt1 = enabled; +- general_params->incl_srcpt0 = enabled; + + for (port = 0; port < ds->num_ports; port++) { + if (dsa_is_unused_port(ds, port)) +-- +2.39.2 + diff --git a/queue-6.4/net-dsa-sja1105-always-enable-the-send_meta-options.patch b/queue-6.4/net-dsa-sja1105-always-enable-the-send_meta-options.patch new file mode 100644 index 00000000000..dd598e3e593 --- /dev/null +++ b/queue-6.4/net-dsa-sja1105-always-enable-the-send_meta-options.patch @@ -0,0 +1,315 @@ +From 64ee6ca1dd3284a0e17393dd8d682567e476c860 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Jul 2023 01:05:45 +0300 +Subject: net: dsa: sja1105: always enable the send_meta options + +From: Vladimir Oltean + +[ Upstream commit a372d66af48506d9f7aaae2a474cd18f14d98cb8 ] + +incl_srcpt has the limitation, mentioned in commit b4638af8885a ("net: +dsa: sja1105: always enable the INCL_SRCPT option"), that frames with a +MAC DA of 01:80:c2:xx:yy:zz will be received as 01:80:c2:00:00:zz unless +PTP RX timestamping is enabled. + +The incl_srcpt option was initially unconditionally enabled, then that +changed with commit 42824463d38d ("net: dsa: sja1105: Limit use of +incl_srcpt to bridge+vlan mode"), then again with b4638af8885a ("net: +dsa: sja1105: always enable the INCL_SRCPT option"). Bottom line is that +it now needs to be always enabled, otherwise the driver does not have a +reliable source of information regarding source_port and switch_id for +link-local traffic (tag_8021q VLANs may be imprecise since now they +identify an entire bridging domain when ports are not standalone). + +If we accept that PTP RX timestamping (and therefore, meta frame +generation) is always enabled in hardware, then that limitation could be +avoided and packets with any MAC DA can be properly received, because +meta frames do contain the original bytes from the MAC DA of their +associated link-local packet. + +This change enables meta frame generation unconditionally, which also +has the nice side effects of simplifying the switch control path +(a switch reset is no longer required on hwtstamping settings change) +and the tagger data path (it no longer needs to be informed whether to +expect meta frames or not - it always does). + +Fixes: 227d07a07ef1 ("net: dsa: sja1105: Add support for traffic through standalone ports") +Signed-off-by: Vladimir Oltean +Reviewed-by: Simon Horman +Reviewed-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/sja1105/sja1105.h | 2 +- + drivers/net/dsa/sja1105/sja1105_main.c | 5 ++- + drivers/net/dsa/sja1105/sja1105_ptp.c | 48 +++----------------------- + include/linux/dsa/sja1105.h | 4 --- + net/dsa/tag_sja1105.c | 45 ------------------------ + 5 files changed, 7 insertions(+), 97 deletions(-) + +diff --git a/drivers/net/dsa/sja1105/sja1105.h b/drivers/net/dsa/sja1105/sja1105.h +index fb1549a5fe321..dee35ba924ad2 100644 +--- a/drivers/net/dsa/sja1105/sja1105.h ++++ b/drivers/net/dsa/sja1105/sja1105.h +@@ -252,6 +252,7 @@ struct sja1105_private { + unsigned long ucast_egress_floods; + unsigned long bcast_egress_floods; + unsigned long hwts_tx_en; ++ unsigned long hwts_rx_en; + const struct sja1105_info *info; + size_t max_xfer_len; + struct spi_device *spidev; +@@ -289,7 +290,6 @@ struct sja1105_spi_message { + /* From sja1105_main.c */ + enum sja1105_reset_reason { + SJA1105_VLAN_FILTERING = 0, +- SJA1105_RX_HWTSTAMPING, + SJA1105_AGEING_TIME, + SJA1105_SCHEDULING, + SJA1105_BEST_EFFORT_POLICING, +diff --git a/drivers/net/dsa/sja1105/sja1105_main.c b/drivers/net/dsa/sja1105/sja1105_main.c +index 8bd61f2ebb2ad..947e8f7c09880 100644 +--- a/drivers/net/dsa/sja1105/sja1105_main.c ++++ b/drivers/net/dsa/sja1105/sja1105_main.c +@@ -867,11 +867,11 @@ static int sja1105_init_general_params(struct sja1105_private *priv) + .mac_fltres1 = SJA1105_LINKLOCAL_FILTER_A, + .mac_flt1 = SJA1105_LINKLOCAL_FILTER_A_MASK, + .incl_srcpt1 = true, +- .send_meta1 = false, ++ .send_meta1 = true, + .mac_fltres0 = SJA1105_LINKLOCAL_FILTER_B, + .mac_flt0 = SJA1105_LINKLOCAL_FILTER_B_MASK, + .incl_srcpt0 = true, +- .send_meta0 = false, ++ .send_meta0 = true, + /* Default to an invalid value */ + .mirr_port = priv->ds->num_ports, + /* No TTEthernet */ +@@ -2215,7 +2215,6 @@ static int sja1105_reload_cbs(struct sja1105_private *priv) + + static const char * const sja1105_reset_reasons[] = { + [SJA1105_VLAN_FILTERING] = "VLAN filtering", +- [SJA1105_RX_HWTSTAMPING] = "RX timestamping", + [SJA1105_AGEING_TIME] = "Ageing time", + [SJA1105_SCHEDULING] = "Time-aware scheduling", + [SJA1105_BEST_EFFORT_POLICING] = "Best-effort policing", +diff --git a/drivers/net/dsa/sja1105/sja1105_ptp.c b/drivers/net/dsa/sja1105/sja1105_ptp.c +index 30fb2cc40164b..a7d41e7813982 100644 +--- a/drivers/net/dsa/sja1105/sja1105_ptp.c ++++ b/drivers/net/dsa/sja1105/sja1105_ptp.c +@@ -58,35 +58,10 @@ enum sja1105_ptp_clk_mode { + #define ptp_data_to_sja1105(d) \ + container_of((d), struct sja1105_private, ptp_data) + +-/* Must be called only while the RX timestamping state of the tagger +- * is turned off +- */ +-static int sja1105_change_rxtstamping(struct sja1105_private *priv, +- bool on) +-{ +- struct sja1105_ptp_data *ptp_data = &priv->ptp_data; +- struct sja1105_general_params_entry *general_params; +- struct sja1105_table *table; +- +- table = &priv->static_config.tables[BLK_IDX_GENERAL_PARAMS]; +- general_params = table->entries; +- general_params->send_meta1 = on; +- general_params->send_meta0 = on; +- +- ptp_cancel_worker_sync(ptp_data->clock); +- skb_queue_purge(&ptp_data->skb_txtstamp_queue); +- skb_queue_purge(&ptp_data->skb_rxtstamp_queue); +- +- return sja1105_static_config_reload(priv, SJA1105_RX_HWTSTAMPING); +-} +- + int sja1105_hwtstamp_set(struct dsa_switch *ds, int port, struct ifreq *ifr) + { +- struct sja1105_tagger_data *tagger_data = sja1105_tagger_data(ds); + struct sja1105_private *priv = ds->priv; + struct hwtstamp_config config; +- bool rx_on; +- int rc; + + if (copy_from_user(&config, ifr->ifr_data, sizeof(config))) + return -EFAULT; +@@ -104,26 +79,13 @@ int sja1105_hwtstamp_set(struct dsa_switch *ds, int port, struct ifreq *ifr) + + switch (config.rx_filter) { + case HWTSTAMP_FILTER_NONE: +- rx_on = false; ++ priv->hwts_rx_en &= ~BIT(port); + break; + default: +- rx_on = true; ++ priv->hwts_rx_en |= BIT(port); + break; + } + +- if (rx_on != tagger_data->rxtstamp_get_state(ds)) { +- tagger_data->rxtstamp_set_state(ds, false); +- +- rc = sja1105_change_rxtstamping(priv, rx_on); +- if (rc < 0) { +- dev_err(ds->dev, +- "Failed to change RX timestamping: %d\n", rc); +- return rc; +- } +- if (rx_on) +- tagger_data->rxtstamp_set_state(ds, true); +- } +- + if (copy_to_user(ifr->ifr_data, &config, sizeof(config))) + return -EFAULT; + return 0; +@@ -131,7 +93,6 @@ int sja1105_hwtstamp_set(struct dsa_switch *ds, int port, struct ifreq *ifr) + + int sja1105_hwtstamp_get(struct dsa_switch *ds, int port, struct ifreq *ifr) + { +- struct sja1105_tagger_data *tagger_data = sja1105_tagger_data(ds); + struct sja1105_private *priv = ds->priv; + struct hwtstamp_config config; + +@@ -140,7 +101,7 @@ int sja1105_hwtstamp_get(struct dsa_switch *ds, int port, struct ifreq *ifr) + config.tx_type = HWTSTAMP_TX_ON; + else + config.tx_type = HWTSTAMP_TX_OFF; +- if (tagger_data->rxtstamp_get_state(ds)) ++ if (priv->hwts_rx_en & BIT(port)) + config.rx_filter = HWTSTAMP_FILTER_PTP_V2_L2_EVENT; + else + config.rx_filter = HWTSTAMP_FILTER_NONE; +@@ -413,11 +374,10 @@ static long sja1105_rxtstamp_work(struct ptp_clock_info *ptp) + + bool sja1105_rxtstamp(struct dsa_switch *ds, int port, struct sk_buff *skb) + { +- struct sja1105_tagger_data *tagger_data = sja1105_tagger_data(ds); + struct sja1105_private *priv = ds->priv; + struct sja1105_ptp_data *ptp_data = &priv->ptp_data; + +- if (!tagger_data->rxtstamp_get_state(ds)) ++ if (!(priv->hwts_rx_en & BIT(port))) + return false; + + /* We need to read the full PTP clock to reconstruct the Rx +diff --git a/include/linux/dsa/sja1105.h b/include/linux/dsa/sja1105.h +index 159e43171cccf..c177322f793d6 100644 +--- a/include/linux/dsa/sja1105.h ++++ b/include/linux/dsa/sja1105.h +@@ -48,13 +48,9 @@ struct sja1105_deferred_xmit_work { + + /* Global tagger data */ + struct sja1105_tagger_data { +- /* Tagger to switch */ + void (*xmit_work_fn)(struct kthread_work *work); + void (*meta_tstamp_handler)(struct dsa_switch *ds, int port, u8 ts_id, + enum sja1110_meta_tstamp dir, u64 tstamp); +- /* Switch to tagger */ +- bool (*rxtstamp_get_state)(struct dsa_switch *ds); +- void (*rxtstamp_set_state)(struct dsa_switch *ds, bool on); + }; + + struct sja1105_skb_cb { +diff --git a/net/dsa/tag_sja1105.c b/net/dsa/tag_sja1105.c +index ec48165673edb..ade3eeb2f3e6d 100644 +--- a/net/dsa/tag_sja1105.c ++++ b/net/dsa/tag_sja1105.c +@@ -58,11 +58,8 @@ + #define SJA1110_TX_TRAILER_LEN 4 + #define SJA1110_MAX_PADDING_LEN 15 + +-#define SJA1105_HWTS_RX_EN 0 +- + struct sja1105_tagger_private { + struct sja1105_tagger_data data; /* Must be first */ +- unsigned long state; + /* Protects concurrent access to the meta state machine + * from taggers running on multiple ports on SMP systems + */ +@@ -392,10 +389,6 @@ static struct sk_buff + + priv = sja1105_tagger_private(ds); + +- if (!test_bit(SJA1105_HWTS_RX_EN, &priv->state)) +- /* Do normal processing. */ +- return skb; +- + spin_lock(&priv->meta_lock); + /* Was this a link-local frame instead of the meta + * that we were expecting? +@@ -431,12 +424,6 @@ static struct sk_buff + + priv = sja1105_tagger_private(ds); + +- /* Drop the meta frame if we're not in the right state +- * to process it. +- */ +- if (!test_bit(SJA1105_HWTS_RX_EN, &priv->state)) +- return NULL; +- + spin_lock(&priv->meta_lock); + + stampable_skb = priv->stampable_skb; +@@ -472,30 +459,6 @@ static struct sk_buff + return skb; + } + +-static bool sja1105_rxtstamp_get_state(struct dsa_switch *ds) +-{ +- struct sja1105_tagger_private *priv = sja1105_tagger_private(ds); +- +- return test_bit(SJA1105_HWTS_RX_EN, &priv->state); +-} +- +-static void sja1105_rxtstamp_set_state(struct dsa_switch *ds, bool on) +-{ +- struct sja1105_tagger_private *priv = sja1105_tagger_private(ds); +- +- if (on) +- set_bit(SJA1105_HWTS_RX_EN, &priv->state); +- else +- clear_bit(SJA1105_HWTS_RX_EN, &priv->state); +- +- /* Initialize the meta state machine to a known state */ +- if (!priv->stampable_skb) +- return; +- +- kfree_skb(priv->stampable_skb); +- priv->stampable_skb = NULL; +-} +- + static bool sja1105_skb_has_tag_8021q(const struct sk_buff *skb) + { + u16 tpid = ntohs(eth_hdr(skb)->h_proto); +@@ -552,9 +515,6 @@ static struct sk_buff *sja1105_rcv(struct sk_buff *skb, + */ + source_port = hdr->h_dest[3]; + switch_id = hdr->h_dest[4]; +- /* Clear the DMAC bytes that were mangled by the switch */ +- hdr->h_dest[3] = 0; +- hdr->h_dest[4] = 0; + } else if (is_meta) { + sja1105_meta_unpack(skb, &meta); + source_port = meta.source_port; +@@ -785,7 +745,6 @@ static void sja1105_disconnect(struct dsa_switch *ds) + + static int sja1105_connect(struct dsa_switch *ds) + { +- struct sja1105_tagger_data *tagger_data; + struct sja1105_tagger_private *priv; + struct kthread_worker *xmit_worker; + int err; +@@ -805,10 +764,6 @@ static int sja1105_connect(struct dsa_switch *ds) + } + + priv->xmit_worker = xmit_worker; +- /* Export functions for switch driver use */ +- tagger_data = &priv->data; +- tagger_data->rxtstamp_get_state = sja1105_rxtstamp_get_state; +- tagger_data->rxtstamp_set_state = sja1105_rxtstamp_set_state; + ds->tagger_data = priv; + + return 0; +-- +2.39.2 + diff --git a/queue-6.4/net-dsa-tag_sja1105-always-prefer-source-port-inform.patch b/queue-6.4/net-dsa-tag_sja1105-always-prefer-source-port-inform.patch new file mode 100644 index 00000000000..59118fdd1f1 --- /dev/null +++ b/queue-6.4/net-dsa-tag_sja1105-always-prefer-source-port-inform.patch @@ -0,0 +1,104 @@ +From 588c69882a60013cae6453290e103167c3eeed57 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Jun 2023 12:42:07 +0300 +Subject: net: dsa: tag_sja1105: always prefer source port information from + INCL_SRCPT + +From: Vladimir Oltean + +[ Upstream commit c1ae02d876898b1b8ca1e12c6f84d7b406263800 ] + +Currently the sja1105 tagging protocol prefers using the source port +information from the VLAN header if that is available, falling back to +the INCL_SRCPT option if it isn't. The VLAN header is available for all +frames except for META frames initiated by the switch (containing RX +timestamps), and thus, the "if (is_link_local)" branch is practically +dead. + +The tag_8021q source port identification has become more loose +("imprecise") and will report a plausible rather than exact bridge port, +when under a bridge (be it VLAN-aware or VLAN-unaware). But link-local +traffic always needs to know the precise source port. With incorrect +source port reporting, for example PTP traffic over 2 bridged ports will +all be seen on sockets opened on the first such port, which is incorrect. + +Now that the tagging protocol has been changed to make link-local frames +always contain source port information, we can reverse the order of the +checks so that we always give precedence to that information (which is +always precise) in lieu of the tag_8021q VID which is only precise for a +standalone port. + +Fixes: d7f9787a763f ("net: dsa: tag_8021q: add support for imprecise RX based on the VBID") +Fixes: 91495f21fcec ("net: dsa: tag_8021q: replace the SVL bridging with VLAN-unaware IVL bridging") +Signed-off-by: Vladimir Oltean +Reviewed-by: Simon Horman +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/dsa/tag_sja1105.c | 38 +++++++++++++++++++++++++++++--------- + 1 file changed, 29 insertions(+), 9 deletions(-) + +diff --git a/net/dsa/tag_sja1105.c b/net/dsa/tag_sja1105.c +index a5f3b73da417f..92a626a05e829 100644 +--- a/net/dsa/tag_sja1105.c ++++ b/net/dsa/tag_sja1105.c +@@ -545,10 +545,7 @@ static struct sk_buff *sja1105_rcv(struct sk_buff *skb, + is_link_local = sja1105_is_link_local(skb); + is_meta = sja1105_is_meta_frame(skb); + +- if (sja1105_skb_has_tag_8021q(skb)) { +- /* Normal traffic path. */ +- sja1105_vlan_rcv(skb, &source_port, &switch_id, &vbid, &vid); +- } else if (is_link_local) { ++ if (is_link_local) { + /* Management traffic path. Switch embeds the switch ID and + * port ID into bytes of the destination MAC, courtesy of + * the incl_srcpt options. +@@ -562,16 +559,39 @@ static struct sk_buff *sja1105_rcv(struct sk_buff *skb, + sja1105_meta_unpack(skb, &meta); + source_port = meta.source_port; + switch_id = meta.switch_id; +- } else { ++ } ++ ++ /* Normal data plane traffic and link-local frames are tagged with ++ * a tag_8021q VLAN which we have to strip ++ */ ++ if (sja1105_skb_has_tag_8021q(skb)) { ++ int tmp_source_port = -1, tmp_switch_id = -1; ++ ++ sja1105_vlan_rcv(skb, &tmp_source_port, &tmp_switch_id, &vbid, ++ &vid); ++ /* Preserve the source information from the INCL_SRCPT option, ++ * if available. This allows us to not overwrite a valid source ++ * port and switch ID with zeroes when receiving link-local ++ * frames from a VLAN-unaware bridged port (non-zero vbid) or a ++ * VLAN-aware bridged port (non-zero vid). ++ */ ++ if (source_port == -1) ++ source_port = tmp_source_port; ++ if (switch_id == -1) ++ switch_id = tmp_switch_id; ++ } else if (source_port == -1 && switch_id == -1) { ++ /* Packets with no source information have no chance of ++ * getting accepted, drop them straight away. ++ */ + return NULL; + } + +- if (vbid >= 1) ++ if (source_port != -1 && switch_id != -1) ++ skb->dev = dsa_master_find_slave(netdev, switch_id, source_port); ++ else if (vbid >= 1) + skb->dev = dsa_tag_8021q_find_port_by_vbid(netdev, vbid); +- else if (source_port == -1 || switch_id == -1) +- skb->dev = dsa_find_designated_bridge_port_by_vid(netdev, vid); + else +- skb->dev = dsa_master_find_slave(netdev, switch_id, source_port); ++ skb->dev = dsa_find_designated_bridge_port_by_vid(netdev, vid); + if (!skb->dev) { + netdev_warn(netdev, "Couldn't decode source port\n"); + return NULL; +-- +2.39.2 + diff --git a/queue-6.4/net-dsa-tag_sja1105-fix-mac-da-patching-from-meta-fr.patch b/queue-6.4/net-dsa-tag_sja1105-fix-mac-da-patching-from-meta-fr.patch new file mode 100644 index 00000000000..82923ed7758 --- /dev/null +++ b/queue-6.4/net-dsa-tag_sja1105-fix-mac-da-patching-from-meta-fr.patch @@ -0,0 +1,46 @@ +From 96c8a566f0f76c4c5807ca914901701e184c70d0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Jul 2023 01:05:44 +0300 +Subject: net: dsa: tag_sja1105: fix MAC DA patching from meta frames + +From: Vladimir Oltean + +[ Upstream commit 1dcf6efd5f0c1f4496b3ef7ec5a7db104a53b38c ] + +The SJA1105 manual says that at offset 4 into the meta frame payload we +have "MAC destination byte 2" and at offset 5 we have "MAC destination +byte 1". These are counted from the LSB, so byte 1 is h_dest[ETH_HLEN-2] +aka h_dest[4] and byte 2 is h_dest[ETH_HLEN-3] aka h_dest[3]. + +The sja1105_meta_unpack() function decodes these the other way around, +so a frame with MAC DA 01:80:c2:11:22:33 is received by the network +stack as having 01:80:c2:22:11:33. + +Fixes: e53e18a6fe4d ("net: dsa: sja1105: Receive and decode meta frames") +Signed-off-by: Vladimir Oltean +Reviewed-by: Simon Horman +Reviewed-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/dsa/tag_sja1105.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/dsa/tag_sja1105.c b/net/dsa/tag_sja1105.c +index db0a6ac674708..ec48165673edb 100644 +--- a/net/dsa/tag_sja1105.c ++++ b/net/dsa/tag_sja1105.c +@@ -118,8 +118,8 @@ static void sja1105_meta_unpack(const struct sk_buff *skb, + * a unified unpacking command for both device series. + */ + packing(buf, &meta->tstamp, 31, 0, 4, UNPACK, 0); +- packing(buf + 4, &meta->dmac_byte_4, 7, 0, 1, UNPACK, 0); +- packing(buf + 5, &meta->dmac_byte_3, 7, 0, 1, UNPACK, 0); ++ packing(buf + 4, &meta->dmac_byte_3, 7, 0, 1, UNPACK, 0); ++ packing(buf + 5, &meta->dmac_byte_4, 7, 0, 1, UNPACK, 0); + packing(buf + 6, &meta->source_port, 7, 0, 1, UNPACK, 0); + packing(buf + 7, &meta->switch_id, 7, 0, 1, UNPACK, 0); + } +-- +2.39.2 + diff --git a/queue-6.4/net-dsa-tag_sja1105-fix-source-port-decoding-in-vlan.patch b/queue-6.4/net-dsa-tag_sja1105-fix-source-port-decoding-in-vlan.patch new file mode 100644 index 00000000000..679c4656517 --- /dev/null +++ b/queue-6.4/net-dsa-tag_sja1105-fix-source-port-decoding-in-vlan.patch @@ -0,0 +1,62 @@ +From b0527ea4d94928e61465c238f3ab5c76c026bb79 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 1 Jul 2023 01:20:10 +0300 +Subject: net: dsa: tag_sja1105: fix source port decoding in vlan_filtering=0 + bridge mode + +From: Vladimir Oltean + +[ Upstream commit a398b9ea0c3b791b7a0f4c6029a62cf628f97f22 ] + +There was a regression introduced by the blamed commit, where pinging to +a VLAN-unaware bridge would fail with the repeated message "Couldn't +decode source port" coming from the tagging protocol driver. + +When receiving packets with a bridge_vid as determined by +dsa_tag_8021q_bridge_join(), dsa_8021q_rcv() will decode: +- source_port = 0 (which isn't really valid, more like "don't know") +- switch_id = 0 (which isn't really valid, more like "don't know") +- vbid = value in range 1-7 + +Since the blamed patch has reversed the order of the checks, we are now +going to believe that source_port != -1 and switch_id != -1, so they're +valid, but they aren't. + +The minimal solution to the problem is to only populate source_port and +switch_id with what dsa_8021q_rcv() came up with, if the vbid is zero, +i.e. the source port information is trustworthy. + +Fixes: c1ae02d87689 ("net: dsa: tag_sja1105: always prefer source port information from INCL_SRCPT") +Signed-off-by: Vladimir Oltean +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/dsa/tag_sja1105.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/net/dsa/tag_sja1105.c b/net/dsa/tag_sja1105.c +index 92a626a05e829..db0a6ac674708 100644 +--- a/net/dsa/tag_sja1105.c ++++ b/net/dsa/tag_sja1105.c +@@ -573,11 +573,14 @@ static struct sk_buff *sja1105_rcv(struct sk_buff *skb, + * if available. This allows us to not overwrite a valid source + * port and switch ID with zeroes when receiving link-local + * frames from a VLAN-unaware bridged port (non-zero vbid) or a +- * VLAN-aware bridged port (non-zero vid). ++ * VLAN-aware bridged port (non-zero vid). Furthermore, the ++ * tag_8021q source port information is only of trust when the ++ * vbid is 0 (precise port). Otherwise, tmp_source_port and ++ * tmp_switch_id will be zeroes. + */ +- if (source_port == -1) ++ if (vbid == 0 && source_port == -1) + source_port = tmp_source_port; +- if (switch_id == -1) ++ if (vbid == 0 && switch_id == -1) + switch_id = tmp_switch_id; + } else if (source_port == -1 && switch_id == -1) { + /* Packets with no source information have no chance of +-- +2.39.2 + diff --git a/queue-6.4/net-dsa-vsc73xx-fix-mtu-configuration.patch b/queue-6.4/net-dsa-vsc73xx-fix-mtu-configuration.patch new file mode 100644 index 00000000000..cd6533b76c6 --- /dev/null +++ b/queue-6.4/net-dsa-vsc73xx-fix-mtu-configuration.patch @@ -0,0 +1,54 @@ +From 39f24189be667ad69f458a642cd89c23c2eee139 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Jun 2023 21:43:27 +0200 +Subject: net: dsa: vsc73xx: fix MTU configuration + +From: Pawel Dembicki + +[ Upstream commit 3cf62c8177adb0db9e15c8b898c44f997acf3ebf ] + +Switch in MAXLEN register stores the maximum size of a data frame. +The MTU size is 18 bytes smaller than the frame size. + +The current settings are causing problems with packet forwarding. +This patch fixes the MTU settings to proper values. + +Fixes: fb77ffc6ec86 ("net: dsa: vsc73xx: make the MTU configurable") +Reviewed-by: Linus Walleij +Signed-off-by: Pawel Dembicki +Reviewed-by: Vladimir Oltean +Link: https://lore.kernel.org/r/20230628194327.1765644-1-paweldembicki@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/vitesse-vsc73xx-core.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/dsa/vitesse-vsc73xx-core.c b/drivers/net/dsa/vitesse-vsc73xx-core.c +index ae55167ce0a6f..ef1a4a7c47b23 100644 +--- a/drivers/net/dsa/vitesse-vsc73xx-core.c ++++ b/drivers/net/dsa/vitesse-vsc73xx-core.c +@@ -1025,17 +1025,17 @@ static int vsc73xx_change_mtu(struct dsa_switch *ds, int port, int new_mtu) + struct vsc73xx *vsc = ds->priv; + + return vsc73xx_write(vsc, VSC73XX_BLOCK_MAC, port, +- VSC73XX_MAXLEN, new_mtu); ++ VSC73XX_MAXLEN, new_mtu + ETH_HLEN + ETH_FCS_LEN); + } + + /* According to application not "VSC7398 Jumbo Frames" setting +- * up the MTU to 9.6 KB does not affect the performance on standard ++ * up the frame size to 9.6 KB does not affect the performance on standard + * frames. It is clear from the application note that + * "9.6 kilobytes" == 9600 bytes. + */ + static int vsc73xx_get_max_mtu(struct dsa_switch *ds, int port) + { +- return 9600; ++ return 9600 - ETH_HLEN - ETH_FCS_LEN; + } + + static const struct dsa_switch_ops vsc73xx_ds_ops = { +-- +2.39.2 + diff --git a/queue-6.4/net-fix-net_dev_start_xmit-trace-event-vs-skb_transp.patch b/queue-6.4/net-fix-net_dev_start_xmit-trace-event-vs-skb_transp.patch new file mode 100644 index 00000000000..2ba34e8ae81 --- /dev/null +++ b/queue-6.4/net-fix-net_dev_start_xmit-trace-event-vs-skb_transp.patch @@ -0,0 +1,72 @@ +From fd0041be14c6a0fe431d9431faa29adf65726d40 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 1 Jul 2023 02:48:24 +0000 +Subject: net: fix net_dev_start_xmit trace event vs skb_transport_offset() + +From: Eric Dumazet + +[ Upstream commit f88fcb1d7d961b4b402d675109726f94db87571c ] + +After blamed commit, we must be more careful about using +skb_transport_offset(), as reminded us by syzbot: + +WARNING: CPU: 0 PID: 10 at include/linux/skbuff.h:2868 skb_transport_offset include/linux/skbuff.h:2977 [inline] +WARNING: CPU: 0 PID: 10 at include/linux/skbuff.h:2868 perf_trace_net_dev_start_xmit+0x89a/0xce0 include/trace/events/net.h:14 +Modules linked in: +CPU: 0 PID: 10 Comm: kworker/u4:1 Not tainted 6.1.30-syzkaller #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023 +Workqueue: bat_events batadv_iv_send_outstanding_bat_ogm_packet +RIP: 0010:skb_transport_header include/linux/skbuff.h:2868 [inline] +RIP: 0010:skb_transport_offset include/linux/skbuff.h:2977 [inline] +RIP: 0010:perf_trace_net_dev_start_xmit+0x89a/0xce0 include/trace/events/net.h:14 +Code: 8b 04 25 28 00 00 00 48 3b 84 24 c0 00 00 00 0f 85 4e 04 00 00 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc e8 56 22 01 fd <0f> 0b e9 f6 fc ff ff 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 86 f9 ff +RSP: 0018:ffffc900002bf700 EFLAGS: 00010293 +RAX: ffffffff8485d8ca RBX: 000000000000ffff RCX: ffff888100914280 +RDX: 0000000000000000 RSI: 000000000000ffff RDI: 000000000000ffff +RBP: ffffc900002bf818 R08: ffffffff8485d5b6 R09: fffffbfff0f8fb5e +R10: 0000000000000000 R11: dffffc0000000001 R12: 1ffff110217d8f67 +R13: ffff88810bec7b3a R14: dffffc0000000000 R15: dffffc0000000000 +FS: 0000000000000000(0000) GS:ffff8881f6a00000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 00007f96cf6d52f0 CR3: 000000012224c000 CR4: 0000000000350ef0 +Call Trace: + +[] trace_net_dev_start_xmit include/trace/events/net.h:14 [inline] +[] xmit_one net/core/dev.c:3643 [inline] +[] dev_hard_start_xmit+0x705/0x980 net/core/dev.c:3660 +[] __dev_queue_xmit+0x16b2/0x3370 net/core/dev.c:4324 +[] dev_queue_xmit include/linux/netdevice.h:3030 [inline] +[] batadv_send_skb_packet+0x3f3/0x680 net/batman-adv/send.c:108 +[] batadv_send_broadcast_skb+0x24/0x30 net/batman-adv/send.c:127 +[] batadv_iv_ogm_send_to_if net/batman-adv/bat_iv_ogm.c:393 [inline] +[] batadv_iv_ogm_emit net/batman-adv/bat_iv_ogm.c:421 [inline] +[] batadv_iv_send_outstanding_bat_ogm_packet+0x69a/0x840 net/batman-adv/bat_iv_ogm.c:1701 +[] process_one_work+0x8ac/0x1170 kernel/workqueue.c:2289 +[] worker_thread+0xaa8/0x12d0 kernel/workqueue.c:2436 + +Fixes: 66e4c8d95008 ("net: warn if transport header was not set") +Signed-off-by: Eric Dumazet +Reported-by: syzbot +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/trace/events/net.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/include/trace/events/net.h b/include/trace/events/net.h +index da611a7aaf970..f667c76a3b022 100644 +--- a/include/trace/events/net.h ++++ b/include/trace/events/net.h +@@ -51,7 +51,8 @@ TRACE_EVENT(net_dev_start_xmit, + __entry->network_offset = skb_network_offset(skb); + __entry->transport_offset_valid = + skb_transport_header_was_set(skb); +- __entry->transport_offset = skb_transport_offset(skb); ++ __entry->transport_offset = skb_transport_header_was_set(skb) ? ++ skb_transport_offset(skb) : 0; + __entry->tx_flags = skb_shinfo(skb)->tx_flags; + __entry->gso_size = skb_shinfo(skb)->gso_size; + __entry->gso_segs = skb_shinfo(skb)->gso_segs; +-- +2.39.2 + diff --git a/queue-6.4/net-mscc-ocelot-don-t-keep-ptp-configuration-of-all-.patch b/queue-6.4/net-mscc-ocelot-don-t-keep-ptp-configuration-of-all-.patch new file mode 100644 index 00000000000..bac86bdca07 --- /dev/null +++ b/queue-6.4/net-mscc-ocelot-don-t-keep-ptp-configuration-of-all-.patch @@ -0,0 +1,203 @@ +From 27b241d5b6bb12a6e12bd56bbd0ed19ce676122e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Jun 2023 19:31:13 +0300 +Subject: net: mscc: ocelot: don't keep PTP configuration of all ports in + single structure + +From: Vladimir Oltean + +[ Upstream commit 45d0fcb5bc9558d0bf3d2fa7fabc5d8a88d35439 ] + +In a future change, the driver will need to determine whether PTP RX +timestamping is enabled on a port (including whether traps were set up +on that port in particular) and that is currently not possible. + +The driver supports different RX filters (L2, L4) and kinds of TX +timestamping (one-step, two-step) on its ports, but it saves all +configuration in a single struct hwtstamp_config that is global to the +switch. So, the latest timestamping configuration on one port +(including a request to disable timestamping) affects what gets reported +for all ports, even though the configuration itself is still individual +to each port. + +The port timestamping configurations are only coupled because of the +common structure, so replace the hwtstamp_config with a mask of trapped +protocols saved per port. We also have the ptp_cmd to distinguish +between one-step and two-step PTP timestamping, so with those 2 bits of +information we can fully reconstruct a descriptive struct +hwtstamp_config for each port, during the SIOCGHWTSTAMP ioctl. + +Fixes: 4e3b0468e6d7 ("net: mscc: PTP Hardware Clock (PHC) support") +Fixes: 96ca08c05838 ("net: mscc: ocelot: set up traps for PTP packets") +Signed-off-by: Vladimir Oltean +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mscc/ocelot.c | 1 - + drivers/net/ethernet/mscc/ocelot_ptp.c | 61 +++++++++++++++++--------- + include/soc/mscc/ocelot.h | 10 +++-- + 3 files changed, 48 insertions(+), 24 deletions(-) + +diff --git a/drivers/net/ethernet/mscc/ocelot.c b/drivers/net/ethernet/mscc/ocelot.c +index 1f5f00b304418..2fa833d041baa 100644 +--- a/drivers/net/ethernet/mscc/ocelot.c ++++ b/drivers/net/ethernet/mscc/ocelot.c +@@ -2925,7 +2925,6 @@ int ocelot_init(struct ocelot *ocelot) + } + } + +- mutex_init(&ocelot->ptp_lock); + mutex_init(&ocelot->mact_lock); + mutex_init(&ocelot->fwd_domain_lock); + mutex_init(&ocelot->tas_lock); +diff --git a/drivers/net/ethernet/mscc/ocelot_ptp.c b/drivers/net/ethernet/mscc/ocelot_ptp.c +index 673bfd70867a6..cb32234a5bf1b 100644 +--- a/drivers/net/ethernet/mscc/ocelot_ptp.c ++++ b/drivers/net/ethernet/mscc/ocelot_ptp.c +@@ -439,8 +439,12 @@ static int ocelot_ipv6_ptp_trap_del(struct ocelot *ocelot, int port) + static int ocelot_setup_ptp_traps(struct ocelot *ocelot, int port, + bool l2, bool l4) + { ++ struct ocelot_port *ocelot_port = ocelot->ports[port]; + int err; + ++ ocelot_port->trap_proto &= ~(OCELOT_PROTO_PTP_L2 | ++ OCELOT_PROTO_PTP_L4); ++ + if (l2) + err = ocelot_l2_ptp_trap_add(ocelot, port); + else +@@ -464,6 +468,11 @@ static int ocelot_setup_ptp_traps(struct ocelot *ocelot, int port, + if (err) + return err; + ++ if (l2) ++ ocelot_port->trap_proto |= OCELOT_PROTO_PTP_L2; ++ if (l4) ++ ocelot_port->trap_proto |= OCELOT_PROTO_PTP_L4; ++ + return 0; + + err_ipv6: +@@ -474,10 +483,38 @@ static int ocelot_setup_ptp_traps(struct ocelot *ocelot, int port, + return err; + } + ++static int ocelot_traps_to_ptp_rx_filter(unsigned int proto) ++{ ++ if ((proto & OCELOT_PROTO_PTP_L2) && (proto & OCELOT_PROTO_PTP_L4)) ++ return HWTSTAMP_FILTER_PTP_V2_EVENT; ++ else if (proto & OCELOT_PROTO_PTP_L2) ++ return HWTSTAMP_FILTER_PTP_V2_L2_EVENT; ++ else if (proto & OCELOT_PROTO_PTP_L4) ++ return HWTSTAMP_FILTER_PTP_V2_L4_EVENT; ++ ++ return HWTSTAMP_FILTER_NONE; ++} ++ + int ocelot_hwstamp_get(struct ocelot *ocelot, int port, struct ifreq *ifr) + { +- return copy_to_user(ifr->ifr_data, &ocelot->hwtstamp_config, +- sizeof(ocelot->hwtstamp_config)) ? -EFAULT : 0; ++ struct ocelot_port *ocelot_port = ocelot->ports[port]; ++ struct hwtstamp_config cfg = {}; ++ ++ switch (ocelot_port->ptp_cmd) { ++ case IFH_REW_OP_TWO_STEP_PTP: ++ cfg.tx_type = HWTSTAMP_TX_ON; ++ break; ++ case IFH_REW_OP_ORIGIN_PTP: ++ cfg.tx_type = HWTSTAMP_TX_ONESTEP_SYNC; ++ break; ++ default: ++ cfg.tx_type = HWTSTAMP_TX_OFF; ++ break; ++ } ++ ++ cfg.rx_filter = ocelot_traps_to_ptp_rx_filter(ocelot_port->trap_proto); ++ ++ return copy_to_user(ifr->ifr_data, &cfg, sizeof(cfg)) ? -EFAULT : 0; + } + EXPORT_SYMBOL(ocelot_hwstamp_get); + +@@ -509,8 +546,6 @@ int ocelot_hwstamp_set(struct ocelot *ocelot, int port, struct ifreq *ifr) + return -ERANGE; + } + +- mutex_lock(&ocelot->ptp_lock); +- + switch (cfg.rx_filter) { + case HWTSTAMP_FILTER_NONE: + break; +@@ -531,28 +566,14 @@ int ocelot_hwstamp_set(struct ocelot *ocelot, int port, struct ifreq *ifr) + l4 = true; + break; + default: +- mutex_unlock(&ocelot->ptp_lock); + return -ERANGE; + } + + err = ocelot_setup_ptp_traps(ocelot, port, l2, l4); +- if (err) { +- mutex_unlock(&ocelot->ptp_lock); ++ if (err) + return err; +- } +- +- if (l2 && l4) +- cfg.rx_filter = HWTSTAMP_FILTER_PTP_V2_EVENT; +- else if (l2) +- cfg.rx_filter = HWTSTAMP_FILTER_PTP_V2_L2_EVENT; +- else if (l4) +- cfg.rx_filter = HWTSTAMP_FILTER_PTP_V2_L4_EVENT; +- else +- cfg.rx_filter = HWTSTAMP_FILTER_NONE; + +- /* Commit back the result & save it */ +- memcpy(&ocelot->hwtstamp_config, &cfg, sizeof(cfg)); +- mutex_unlock(&ocelot->ptp_lock); ++ cfg.rx_filter = ocelot_traps_to_ptp_rx_filter(ocelot_port->trap_proto); + + return copy_to_user(ifr->ifr_data, &cfg, sizeof(cfg)) ? -EFAULT : 0; + } +diff --git a/include/soc/mscc/ocelot.h b/include/soc/mscc/ocelot.h +index cb8fbb2418795..22aae505c813b 100644 +--- a/include/soc/mscc/ocelot.h ++++ b/include/soc/mscc/ocelot.h +@@ -730,6 +730,11 @@ enum macaccess_entry_type { + ENTRYTYPE_MACv6, + }; + ++enum ocelot_proto { ++ OCELOT_PROTO_PTP_L2 = BIT(0), ++ OCELOT_PROTO_PTP_L4 = BIT(1), ++}; ++ + #define OCELOT_QUIRK_PCS_PERFORMS_RATE_ADAPTATION BIT(0) + #define OCELOT_QUIRK_QSGMII_PORTS_MUST_BE_UP BIT(1) + +@@ -775,6 +780,8 @@ struct ocelot_port { + unsigned int ptp_skbs_in_flight; + struct sk_buff_head tx_skbs; + ++ unsigned int trap_proto; ++ + u16 mrp_ring_id; + + u8 ptp_cmd; +@@ -868,12 +875,9 @@ struct ocelot { + u8 mm_supported:1; + struct ptp_clock *ptp_clock; + struct ptp_clock_info ptp_info; +- struct hwtstamp_config hwtstamp_config; + unsigned int ptp_skbs_in_flight; + /* Protects the 2-step TX timestamp ID logic */ + spinlock_t ts_id_lock; +- /* Protects the PTP interface state */ +- struct mutex ptp_lock; + /* Protects the PTP clock */ + spinlock_t ptp_clock_lock; + struct ptp_pin_desc ptp_pins[OCELOT_PTP_PINS_NUM]; +-- +2.39.2 + diff --git a/queue-6.4/net-mscc-ocelot-don-t-report-that-rx-timestamping-is.patch b/queue-6.4/net-mscc-ocelot-don-t-report-that-rx-timestamping-is.patch new file mode 100644 index 00000000000..c4f66396a47 --- /dev/null +++ b/queue-6.4/net-mscc-ocelot-don-t-report-that-rx-timestamping-is.patch @@ -0,0 +1,49 @@ +From d8225dbddc010c37d6d26e87a68a47eaa703a8a9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Jun 2023 19:31:12 +0300 +Subject: net: mscc: ocelot: don't report that RX timestamping is enabled by + default + +From: Vladimir Oltean + +[ Upstream commit 4fd44b82b7aceaa35c2901c6546d2c4198e0799d ] + +PTP RX timestamping should be enabled when the user requests it, not by +default. If it is enabled by default, it can be problematic when the +ocelot driver is a DSA master, and it sidesteps what DSA tries to avoid +through __dsa_master_hwtstamp_validate(). + +Additionally, after the change which made ocelot trap PTP packets only +to the CPU at ocelot_hwtstamp_set() time, it is no longer even true that +RX timestamping is enabled by default, because until ocelot_hwtstamp_set() +is called, the PTP traps are actually not set up. So the rx_filter field +of ocelot->hwtstamp_config reflects an incorrect reality. + +Fixes: 96ca08c05838 ("net: mscc: ocelot: set up traps for PTP packets") +Fixes: 4e3b0468e6d7 ("net: mscc: PTP Hardware Clock (PHC) support") +Signed-off-by: Vladimir Oltean +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mscc/ocelot_ptp.c | 5 ----- + 1 file changed, 5 deletions(-) + +diff --git a/drivers/net/ethernet/mscc/ocelot_ptp.c b/drivers/net/ethernet/mscc/ocelot_ptp.c +index 2180ae94c7447..673bfd70867a6 100644 +--- a/drivers/net/ethernet/mscc/ocelot_ptp.c ++++ b/drivers/net/ethernet/mscc/ocelot_ptp.c +@@ -824,11 +824,6 @@ int ocelot_init_timestamp(struct ocelot *ocelot, + + ocelot_write(ocelot, PTP_CFG_MISC_PTP_EN, PTP_CFG_MISC); + +- /* There is no device reconfiguration, PTP Rx stamping is always +- * enabled. +- */ +- ocelot->hwtstamp_config.rx_filter = HWTSTAMP_FILTER_PTP_V2_EVENT; +- + return 0; + } + EXPORT_SYMBOL(ocelot_init_timestamp); +-- +2.39.2 + diff --git a/queue-6.4/net-sched-act_ipt-add-sanity-checks-on-skb-before-ca.patch b/queue-6.4/net-sched-act_ipt-add-sanity-checks-on-skb-before-ca.patch new file mode 100644 index 00000000000..29034f13245 --- /dev/null +++ b/queue-6.4/net-sched-act_ipt-add-sanity-checks-on-skb-before-ca.patch @@ -0,0 +1,91 @@ +From 729bf094b7aa56b2f2fbf39514d0999b1af165eb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Jun 2023 14:38:12 +0200 +Subject: net/sched: act_ipt: add sanity checks on skb before calling target + +From: Florian Westphal + +[ Upstream commit b2dc32dcba08bf55cec600caa76f4afd2e3614df ] + +Netfilter targets make assumptions on the skb state, for example +iphdr is supposed to be in the linear area. + +This is normally done by IP stack, but in act_ipt case no +such checks are made. + +Some targets can even assume that skb_dst will be valid. +Make a minimum effort to check for this: + +- Don't call the targets eval function for non-ipv4 skbs. +- Don't call the targets eval function for POSTROUTING + emulation when the skb has no dst set. + +v3: use skb_protocol helper (Davide Caratti) + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Florian Westphal +Reviewed-by: Simon Horman +Acked-by: Jamal Hadi Salim +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/sched/act_ipt.c | 33 +++++++++++++++++++++++++++++++++ + 1 file changed, 33 insertions(+) + +diff --git a/net/sched/act_ipt.c b/net/sched/act_ipt.c +index ea7f151e7dd29..a6b522b512dc3 100644 +--- a/net/sched/act_ipt.c ++++ b/net/sched/act_ipt.c +@@ -230,6 +230,26 @@ static int tcf_xt_init(struct net *net, struct nlattr *nla, + a, &act_xt_ops, tp, flags); + } + ++static bool tcf_ipt_act_check(struct sk_buff *skb) ++{ ++ const struct iphdr *iph; ++ unsigned int nhoff, len; ++ ++ if (!pskb_may_pull(skb, sizeof(struct iphdr))) ++ return false; ++ ++ nhoff = skb_network_offset(skb); ++ iph = ip_hdr(skb); ++ if (iph->ihl < 5 || iph->version != 4) ++ return false; ++ ++ len = skb_ip_totlen(skb); ++ if (skb->len < nhoff + len || len < (iph->ihl * 4u)) ++ return false; ++ ++ return pskb_may_pull(skb, iph->ihl * 4u); ++} ++ + TC_INDIRECT_SCOPE int tcf_ipt_act(struct sk_buff *skb, + const struct tc_action *a, + struct tcf_result *res) +@@ -244,9 +264,22 @@ TC_INDIRECT_SCOPE int tcf_ipt_act(struct sk_buff *skb, + .pf = NFPROTO_IPV4, + }; + ++ if (skb_protocol(skb, false) != htons(ETH_P_IP)) ++ return TC_ACT_UNSPEC; ++ + if (skb_unclone(skb, GFP_ATOMIC)) + return TC_ACT_UNSPEC; + ++ if (!tcf_ipt_act_check(skb)) ++ return TC_ACT_UNSPEC; ++ ++ if (state.hook == NF_INET_POST_ROUTING) { ++ if (!skb_dst(skb)) ++ return TC_ACT_UNSPEC; ++ ++ state.out = skb->dev; ++ } ++ + spin_lock(&ipt->tcf_lock); + + tcf_lastuse_update(&ipt->tcf_tm); +-- +2.39.2 + diff --git a/queue-6.4/net-sched-act_ipt-add-sanity-checks-on-table-name-an.patch b/queue-6.4/net-sched-act_ipt-add-sanity-checks-on-table-name-an.patch new file mode 100644 index 00000000000..960b4871bc2 --- /dev/null +++ b/queue-6.4/net-sched-act_ipt-add-sanity-checks-on-table-name-an.patch @@ -0,0 +1,102 @@ +From 420f98997693e6b6d433f2a717af450ee7b5ed45 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Jun 2023 14:38:11 +0200 +Subject: net/sched: act_ipt: add sanity checks on table name and hook + locations + +From: Florian Westphal + +[ Upstream commit b4ee93380b3c891fea996af8d1d3ca0e36ad31f0 ] + +Looks like "tc" hard-codes "mangle" as the only supported table +name, but on kernel side there are no checks. + +This is wrong. Not all xtables targets are safe to call from tc. +E.g. "nat" targets assume skb has a conntrack object assigned to it. +Normally those get called from netfilter nat core which consults the +nat table to obtain the address mapping. + +"tc" userspace either sets PRE or POSTROUTING as hook number, but there +is no validation of this on kernel side, so update netlink policy to +reject bogus numbers. Some targets may assume skb_dst is set for +input/forward hooks, so prevent those from being used. + +act_ipt uses the hook number in two places: +1. the state hook number, this is fine as-is +2. to set par.hook_mask + +The latter is a bit mask, so update the assignment to make +xt_check_target() to the right thing. + +Followup patch adds required checks for the skb/packet headers before +calling the targets evaluation function. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Florian Westphal +Reviewed-by: Simon Horman +Acked-by: Jamal Hadi Salim +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/sched/act_ipt.c | 27 ++++++++++++++++++++------- + 1 file changed, 20 insertions(+), 7 deletions(-) + +diff --git a/net/sched/act_ipt.c b/net/sched/act_ipt.c +index 5d96ffebd40f0..ea7f151e7dd29 100644 +--- a/net/sched/act_ipt.c ++++ b/net/sched/act_ipt.c +@@ -48,7 +48,7 @@ static int ipt_init_target(struct net *net, struct xt_entry_target *t, + par.entryinfo = &e; + par.target = target; + par.targinfo = t->data; +- par.hook_mask = hook; ++ par.hook_mask = 1 << hook; + par.family = NFPROTO_IPV4; + + ret = xt_check_target(&par, t->u.target_size - sizeof(*t), 0, false); +@@ -85,7 +85,8 @@ static void tcf_ipt_release(struct tc_action *a) + + static const struct nla_policy ipt_policy[TCA_IPT_MAX + 1] = { + [TCA_IPT_TABLE] = { .type = NLA_STRING, .len = IFNAMSIZ }, +- [TCA_IPT_HOOK] = { .type = NLA_U32 }, ++ [TCA_IPT_HOOK] = NLA_POLICY_RANGE(NLA_U32, NF_INET_PRE_ROUTING, ++ NF_INET_NUMHOOKS), + [TCA_IPT_INDEX] = { .type = NLA_U32 }, + [TCA_IPT_TARG] = { .len = sizeof(struct xt_entry_target) }, + }; +@@ -158,15 +159,27 @@ static int __tcf_ipt_init(struct net *net, unsigned int id, struct nlattr *nla, + return -EEXIST; + } + } ++ ++ err = -EINVAL; + hook = nla_get_u32(tb[TCA_IPT_HOOK]); ++ switch (hook) { ++ case NF_INET_PRE_ROUTING: ++ break; ++ case NF_INET_POST_ROUTING: ++ break; ++ default: ++ goto err1; ++ } ++ ++ if (tb[TCA_IPT_TABLE]) { ++ /* mangle only for now */ ++ if (nla_strcmp(tb[TCA_IPT_TABLE], "mangle")) ++ goto err1; ++ } + +- err = -ENOMEM; +- tname = kmalloc(IFNAMSIZ, GFP_KERNEL); ++ tname = kstrdup("mangle", GFP_KERNEL); + if (unlikely(!tname)) + goto err1; +- if (tb[TCA_IPT_TABLE] == NULL || +- nla_strscpy(tname, tb[TCA_IPT_TABLE], IFNAMSIZ) >= IFNAMSIZ) +- strcpy(tname, "mangle"); + + t = kmemdup(td, td->u.target_size, GFP_KERNEL); + if (unlikely(!t)) +-- +2.39.2 + diff --git a/queue-6.4/net-sched-act_ipt-zero-skb-cb-before-calling-target.patch b/queue-6.4/net-sched-act_ipt-zero-skb-cb-before-calling-target.patch new file mode 100644 index 00000000000..80623286c43 --- /dev/null +++ b/queue-6.4/net-sched-act_ipt-zero-skb-cb-before-calling-target.patch @@ -0,0 +1,101 @@ +From 98a58b19aed0dd13d79a0c5abff50ffdb962fea5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Jun 2023 14:38:13 +0200 +Subject: net/sched: act_ipt: zero skb->cb before calling target + +From: Florian Westphal + +[ Upstream commit 93d75d475c5dc3404292976147d063ee4d808592 ] + +xtables relies on skb being owned by ip stack, i.e. with ipv4 +check in place skb->cb is supposed to be IPCB. + +I don't see an immediate problem (REJECT target cannot be used anymore +now that PRE/POSTROUTING hook validation has been fixed), but better be +safe than sorry. + +A much better patch would be to either mark act_ipt as +"depends on BROKEN" or remove it altogether. I plan to do this +for -next in the near future. + +This tc extension is broken in the sense that tc lacks an +equivalent of NF_STOLEN verdict. + +With NF_STOLEN, target function takes complete ownership of skb, caller +cannot dereference it anymore. + +ACT_STOLEN cannot be used for this: it has a different meaning, caller +is allowed to dereference the skb. + +At this time NF_STOLEN won't be returned by any targets as far as I can +see, but this may change in the future. + +It might be possible to work around this via list of allowed +target extensions known to only return DROP or ACCEPT verdicts, but this +is error prone/fragile. + +Existing selftest only validates xt_LOG and act_ipt is restricted +to ipv4 so I don't think this action is used widely. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Florian Westphal +Reviewed-by: Simon Horman +Acked-by: Jamal Hadi Salim +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/sched/act_ipt.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/net/sched/act_ipt.c b/net/sched/act_ipt.c +index a6b522b512dc3..598d6e299152a 100644 +--- a/net/sched/act_ipt.c ++++ b/net/sched/act_ipt.c +@@ -21,6 +21,7 @@ + #include + #include + #include ++#include + + #include + +@@ -254,6 +255,7 @@ TC_INDIRECT_SCOPE int tcf_ipt_act(struct sk_buff *skb, + const struct tc_action *a, + struct tcf_result *res) + { ++ char saved_cb[sizeof_field(struct sk_buff, cb)]; + int ret = 0, result = 0; + struct tcf_ipt *ipt = to_ipt(a); + struct xt_action_param par; +@@ -280,6 +282,8 @@ TC_INDIRECT_SCOPE int tcf_ipt_act(struct sk_buff *skb, + state.out = skb->dev; + } + ++ memcpy(saved_cb, skb->cb, sizeof(saved_cb)); ++ + spin_lock(&ipt->tcf_lock); + + tcf_lastuse_update(&ipt->tcf_tm); +@@ -292,6 +296,9 @@ TC_INDIRECT_SCOPE int tcf_ipt_act(struct sk_buff *skb, + par.state = &state; + par.target = ipt->tcfi_t->u.kernel.target; + par.targinfo = ipt->tcfi_t->data; ++ ++ memset(IPCB(skb), 0, sizeof(struct inet_skb_parm)); ++ + ret = par.target->target(skb, &par); + + switch (ret) { +@@ -312,6 +319,9 @@ TC_INDIRECT_SCOPE int tcf_ipt_act(struct sk_buff *skb, + break; + } + spin_unlock(&ipt->tcf_lock); ++ ++ memcpy(skb->cb, saved_cb, sizeof(skb->cb)); ++ + return result; + + } +-- +2.39.2 + diff --git a/queue-6.4/net-sched-act_pedit-add-size-check-for-tca_pedit_par.patch b/queue-6.4/net-sched-act_pedit-add-size-check-for-tca_pedit_par.patch new file mode 100644 index 00000000000..cccebb8f034 --- /dev/null +++ b/queue-6.4/net-sched-act_pedit-add-size-check-for-tca_pedit_par.patch @@ -0,0 +1,57 @@ +From cf54be45d5b89997ef03f2b427af7b13387db40f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Jul 2023 19:08:42 +0800 +Subject: net/sched: act_pedit: Add size check for TCA_PEDIT_PARMS_EX + +From: Lin Ma + +[ Upstream commit 30c45b5361d39b4b793780ffac5538090b9e2eb1 ] + +The attribute TCA_PEDIT_PARMS_EX is not be included in pedit_policy and +one malicious user could fake a TCA_PEDIT_PARMS_EX whose length is +smaller than the intended sizeof(struct tc_pedit). Hence, the +dereference in tcf_pedit_init() could access dirty heap data. + +static int tcf_pedit_init(...) +{ + // ... + pattr = tb[TCA_PEDIT_PARMS]; // TCA_PEDIT_PARMS is included + if (!pattr) + pattr = tb[TCA_PEDIT_PARMS_EX]; // but this is not + + // ... + parm = nla_data(pattr); + + index = parm->index; // parm is able to be smaller than 4 bytes + // and this dereference gets dirty skb_buff + // data created in netlink_sendmsg +} + +This commit adds TCA_PEDIT_PARMS_EX length in pedit_policy which avoid +the above case, just like the TCA_PEDIT_PARMS. + +Fixes: 71d0ed7079df ("net/act_pedit: Support using offset relative to the conventional network headers") +Signed-off-by: Lin Ma +Reviewed-by: Pedro Tammela +Link: https://lore.kernel.org/r/20230703110842.590282-1-linma@zju.edu.cn +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/sched/act_pedit.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c +index c819b812a899c..399d4643a940e 100644 +--- a/net/sched/act_pedit.c ++++ b/net/sched/act_pedit.c +@@ -29,6 +29,7 @@ static struct tc_action_ops act_pedit_ops; + + static const struct nla_policy pedit_policy[TCA_PEDIT_MAX + 1] = { + [TCA_PEDIT_PARMS] = { .len = sizeof(struct tc_pedit) }, ++ [TCA_PEDIT_PARMS_EX] = { .len = sizeof(struct tc_pedit) }, + [TCA_PEDIT_KEYS_EX] = { .type = NLA_NESTED }, + }; + +-- +2.39.2 + diff --git a/queue-6.4/ntfs-fix-panic-about-slab-out-of-bounds-caused-by-nt.patch b/queue-6.4/ntfs-fix-panic-about-slab-out-of-bounds-caused-by-nt.patch new file mode 100644 index 00000000000..7961c71402b --- /dev/null +++ b/queue-6.4/ntfs-fix-panic-about-slab-out-of-bounds-caused-by-nt.patch @@ -0,0 +1,52 @@ +From 8785b4d3457ed09c52e0a75b5bb037c6f8d277a3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Dec 2022 00:28:07 +0800 +Subject: ntfs: Fix panic about slab-out-of-bounds caused by ntfs_listxattr() + +From: Zeng Heng + +[ Upstream commit 3c675ddffb17a8b1e32efad5c983254af18b12c2 ] + +Here is a BUG report from syzbot: + +BUG: KASAN: slab-out-of-bounds in ntfs_list_ea fs/ntfs3/xattr.c:191 [inline] +BUG: KASAN: slab-out-of-bounds in ntfs_listxattr+0x401/0x570 fs/ntfs3/xattr.c:710 +Read of size 1 at addr ffff888021acaf3d by task syz-executor128/3632 + +Call Trace: + ntfs_list_ea fs/ntfs3/xattr.c:191 [inline] + ntfs_listxattr+0x401/0x570 fs/ntfs3/xattr.c:710 + vfs_listxattr fs/xattr.c:457 [inline] + listxattr+0x293/0x2d0 fs/xattr.c:804 + +Fix the logic of ea_all iteration. When the ea->name_len is 0, +return immediately, or Add2Ptr() would visit invalid memory +in the next loop. + +Fixes: be71b5cba2e6 ("fs/ntfs3: Add attrib operations") +Reported-by: syzbot+9fcea5ef6dc4dc72d334@syzkaller.appspotmail.com +Signed-off-by: Zeng Heng +[almaz.alexandrovich@paragon-software.com: lines of the patch have changed] +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/xattr.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/fs/ntfs3/xattr.c b/fs/ntfs3/xattr.c +index c3de60a4543fa..fd02fcf4d4091 100644 +--- a/fs/ntfs3/xattr.c ++++ b/fs/ntfs3/xattr.c +@@ -214,6 +214,9 @@ static ssize_t ntfs_list_ea(struct ntfs_inode *ni, char *buffer, + ea = Add2Ptr(ea_all, off); + ea_size = unpacked_ea_size(ea); + ++ if (!ea->name_len) ++ break; ++ + if (buffer) { + if (ret + ea->name_len + 1 > bytes_per_buffer) { + err = -ERANGE; +-- +2.39.2 + diff --git a/queue-6.4/nvmem-imx-ocotp-reverse-mac-addresses-on-all-i.mx-de.patch b/queue-6.4/nvmem-imx-ocotp-reverse-mac-addresses-on-all-i.mx-de.patch new file mode 100644 index 00000000000..4bfe7cf8d65 --- /dev/null +++ b/queue-6.4/nvmem-imx-ocotp-reverse-mac-addresses-on-all-i.mx-de.patch @@ -0,0 +1,81 @@ +From 6120bcb86b35560bd2d05bf8e88f15d5c51d7fde Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 11 Jun 2023 15:03:06 +0100 +Subject: nvmem: imx-ocotp: Reverse MAC addresses on all i.MX derivates + +From: Alexander Stein + +[ Upstream commit 8a00fc606312c68b98add8fe8e6f7a013ce29e78 ] + +Not just i.MX8M, but all i.MX6/7 (and subtypes) need to reverse the +MAC address read from fuses. Exceptions are i.MX6SLL and i.MX7ULP which +do not support ethernet at all. + +Fixes: d0221a780cbc ("nvmem: imx-ocotp: add support for post processing") +Signed-off-by: Alexander Stein +Tested-by: Richard Leitner # imx6q +Signed-off-by: Srinivas Kandagatla +Message-ID: <20230611140330.154222-3-srinivas.kandagatla@linaro.org> +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/nvmem/imx-ocotp.c | 8 +------- + 1 file changed, 1 insertion(+), 7 deletions(-) + +diff --git a/drivers/nvmem/imx-ocotp.c b/drivers/nvmem/imx-ocotp.c +index ac0edb6398f1e..c1af271052276 100644 +--- a/drivers/nvmem/imx-ocotp.c ++++ b/drivers/nvmem/imx-ocotp.c +@@ -97,7 +97,6 @@ struct ocotp_params { + unsigned int bank_address_words; + void (*set_timing)(struct ocotp_priv *priv); + struct ocotp_ctrl_reg ctrl; +- bool reverse_mac_address; + }; + + static int imx_ocotp_wait_for_busy(struct ocotp_priv *priv, u32 flags) +@@ -545,7 +544,6 @@ static const struct ocotp_params imx8mq_params = { + .bank_address_words = 0, + .set_timing = imx_ocotp_set_imx6_timing, + .ctrl = IMX_OCOTP_BM_CTRL_DEFAULT, +- .reverse_mac_address = true, + }; + + static const struct ocotp_params imx8mm_params = { +@@ -553,7 +551,6 @@ static const struct ocotp_params imx8mm_params = { + .bank_address_words = 0, + .set_timing = imx_ocotp_set_imx6_timing, + .ctrl = IMX_OCOTP_BM_CTRL_DEFAULT, +- .reverse_mac_address = true, + }; + + static const struct ocotp_params imx8mn_params = { +@@ -561,7 +558,6 @@ static const struct ocotp_params imx8mn_params = { + .bank_address_words = 0, + .set_timing = imx_ocotp_set_imx6_timing, + .ctrl = IMX_OCOTP_BM_CTRL_DEFAULT, +- .reverse_mac_address = true, + }; + + static const struct ocotp_params imx8mp_params = { +@@ -569,7 +565,6 @@ static const struct ocotp_params imx8mp_params = { + .bank_address_words = 0, + .set_timing = imx_ocotp_set_imx6_timing, + .ctrl = IMX_OCOTP_BM_CTRL_8MP, +- .reverse_mac_address = true, + }; + + static const struct of_device_id imx_ocotp_dt_ids[] = { +@@ -624,8 +619,7 @@ static int imx_ocotp_probe(struct platform_device *pdev) + imx_ocotp_nvmem_config.size = 4 * priv->params->nregs; + imx_ocotp_nvmem_config.dev = dev; + imx_ocotp_nvmem_config.priv = priv; +- if (priv->params->reverse_mac_address) +- imx_ocotp_nvmem_config.layout = &imx_ocotp_layout; ++ imx_ocotp_nvmem_config.layout = &imx_ocotp_layout; + + priv->config = &imx_ocotp_nvmem_config; + +-- +2.39.2 + diff --git a/queue-6.4/nvmem-rmem-use-nvmem_devid_auto.patch b/queue-6.4/nvmem-rmem-use-nvmem_devid_auto.patch new file mode 100644 index 00000000000..c0358298967 --- /dev/null +++ b/queue-6.4/nvmem-rmem-use-nvmem_devid_auto.patch @@ -0,0 +1,41 @@ +From 61a22f1a057534d1a8d625f9ba6a1dd8a5b53017 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 11 Jun 2023 15:03:09 +0100 +Subject: nvmem: rmem: Use NVMEM_DEVID_AUTO + +From: Phil Elwell + +[ Upstream commit 09dd7b993eddb3b48634fd5ddf27aa799785a9ee ] + +It is reasonable to declare multiple nvmem blocks. Unless a unique 'id' +is passed in for each block there may be name clashes. + +Avoid this by using the magic token NVMEM_DEVID_AUTO. + +Fixes: 5a3fa75a4d9c ("nvmem: Add driver to expose reserved memory as nvmem") +Signed-off-by: Phil Elwell +Signed-off-by: Ivan T. Ivanov +Reviewed-by: Stefan Wahren +Signed-off-by: Srinivas Kandagatla +Message-ID: <20230611140330.154222-6-srinivas.kandagatla@linaro.org> +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/nvmem/rmem.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/nvmem/rmem.c b/drivers/nvmem/rmem.c +index 80cb187f14817..752d0bf4445ee 100644 +--- a/drivers/nvmem/rmem.c ++++ b/drivers/nvmem/rmem.c +@@ -71,6 +71,7 @@ static int rmem_probe(struct platform_device *pdev) + config.dev = dev; + config.priv = priv; + config.name = "rmem"; ++ config.id = NVMEM_DEVID_AUTO; + config.size = mem->size; + config.reg_read = rmem_read; + +-- +2.39.2 + diff --git a/queue-6.4/nvmem-sunplus-ocotp-release-otp-clk-before-return.patch b/queue-6.4/nvmem-sunplus-ocotp-release-otp-clk-before-return.patch new file mode 100644 index 00000000000..84a875bfd7f --- /dev/null +++ b/queue-6.4/nvmem-sunplus-ocotp-release-otp-clk-before-return.patch @@ -0,0 +1,59 @@ +From 9691d43fa41f72252a3e94dd1785b9e81d56c88b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 May 2023 16:52:36 +0800 +Subject: nvmem: sunplus-ocotp: release otp->clk before return + +From: Yi Yingao + +[ Upstream commit 095bb8ba45f28ed15296eb5b7662e03e57d5e34e ] + +Smatch reports: +drivers/nvmem/sunplus-ocotp.c:205 sp_ocotp_probe() +warn: 'otp->clk' from clk_prepare() not released on lines: 196. + +In the function sp_ocotp_probe(struct platform_device *pdev), otp->clk may +not be released before return. + +To fix this issue, using function clk_unprepare() to release otp->clk. + +Fixes: 8747ec2e9762 ("nvmem: Add driver for OCOTP in Sunplus SP7021") +Signed-off-by: Yi Yingao +Reviewed-by: Dongliang Mu +Message-ID: <20230509085237.5917-1-m202271736@hust.edu.cn> +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/nvmem/sunplus-ocotp.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/drivers/nvmem/sunplus-ocotp.c b/drivers/nvmem/sunplus-ocotp.c +index 52b928a7a6d58..f85350b17d672 100644 +--- a/drivers/nvmem/sunplus-ocotp.c ++++ b/drivers/nvmem/sunplus-ocotp.c +@@ -192,9 +192,11 @@ static int sp_ocotp_probe(struct platform_device *pdev) + sp_ocotp_nvmem_config.dev = dev; + + nvmem = devm_nvmem_register(dev, &sp_ocotp_nvmem_config); +- if (IS_ERR(nvmem)) +- return dev_err_probe(&pdev->dev, PTR_ERR(nvmem), ++ if (IS_ERR(nvmem)) { ++ ret = dev_err_probe(&pdev->dev, PTR_ERR(nvmem), + "register nvmem device fail\n"); ++ goto err; ++ } + + platform_set_drvdata(pdev, nvmem); + +@@ -203,6 +205,9 @@ static int sp_ocotp_probe(struct platform_device *pdev) + (int)OTP_WORD_SIZE, (int)QAC628_OTP_SIZE); + + return 0; ++err: ++ clk_unprepare(otp->clk); ++ return ret; + } + + static const struct of_device_id sp_ocotp_dt_ids[] = { +-- +2.39.2 + diff --git a/queue-6.4/octeontx-af-fix-hardware-timestamp-configuration.patch b/queue-6.4/octeontx-af-fix-hardware-timestamp-configuration.patch new file mode 100644 index 00000000000..2185a0e6b67 --- /dev/null +++ b/queue-6.4/octeontx-af-fix-hardware-timestamp-configuration.patch @@ -0,0 +1,42 @@ +From ff852d3a7c3abbf8c2bd1607db3101d6aad4a8b7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Jul 2023 09:56:53 +0530 +Subject: octeontx-af: fix hardware timestamp configuration + +From: Hariprasad Kelam + +[ Upstream commit 14bb236b29922c4f57d8c05bfdbcb82677f917c9 ] + +MAC block on CN10K (RPM) supports hardware timestamp configuration. The +previous patch which added timestamp configuration support has a bug. +Though the netdev driver requests to disable timestamp configuration, +the driver is always enabling it. + +This patch fixes the same. + +Fixes: d1489208681d ("octeontx2-af: cn10k: RPM hardware timestamp configuration") +Signed-off-by: Hariprasad Kelam +Signed-off-by: Sunil Goutham +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c +index 4b8559ac0404f..095b2cc4a6999 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c +@@ -763,7 +763,7 @@ static int rvu_cgx_ptp_rx_cfg(struct rvu *rvu, u16 pcifunc, bool enable) + cgxd = rvu_cgx_pdata(cgx_id, rvu); + + mac_ops = get_mac_ops(cgxd); +- mac_ops->mac_enadis_ptp_config(cgxd, lmac_id, true); ++ mac_ops->mac_enadis_ptp_config(cgxd, lmac_id, enable); + /* If PTP is enabled then inform NPC that packets to be + * parsed by this PF will have their data shifted by 8 bytes + * and if PTP is disabled then no shift is required +-- +2.39.2 + diff --git a/queue-6.4/octeontx2-af-add-validation-before-accessing-cgx-and.patch b/queue-6.4/octeontx2-af-add-validation-before-accessing-cgx-and.patch new file mode 100644 index 00000000000..12f91dd4442 --- /dev/null +++ b/queue-6.4/octeontx2-af-add-validation-before-accessing-cgx-and.patch @@ -0,0 +1,63 @@ +From 6f30c568f863455f5246959022a050716b94da38 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Jun 2023 11:58:44 +0530 +Subject: octeontx2-af: Add validation before accessing cgx and lmac + +From: Hariprasad Kelam + +[ Upstream commit 79ebb53772c95d3a6ae51b3c65f9985fdd430df6 ] + +with the addition of new MAC blocks like CN10K RPM and CN10KB +RPM_USX, LMACs are noncontiguous and CGX blocks are also +noncontiguous. But during RVU driver initialization, the driver +is assuming they are contiguous and trying to access +cgx or lmac with their id which is resulting in kernel panic. + +This patch fixes the issue by adding proper checks. + +[ 23.219150] pc : cgx_lmac_read+0x38/0x70 +[ 23.219154] lr : rvu_program_channels+0x3f0/0x498 +[ 23.223852] sp : ffff000100d6fc80 +[ 23.227158] x29: ffff000100d6fc80 x28: ffff00010009f880 x27: +000000000000005a +[ 23.234288] x26: ffff000102586768 x25: 0000000000002500 x24: +fffffffffff0f000 + +Fixes: 91c6945ea1f9 ("octeontx2-af: cn10k: Add RPM MAC support") +Signed-off-by: Hariprasad Kelam +Signed-off-by: Sunil Goutham +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/af/cgx.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/cgx.c b/drivers/net/ethernet/marvell/octeontx2/af/cgx.c +index bd77152bb8d7c..f4bdca662d616 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/cgx.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/cgx.c +@@ -169,6 +169,9 @@ void cgx_lmac_write(int cgx_id, int lmac_id, u64 offset, u64 val) + { + struct cgx *cgx_dev = cgx_get_pdata(cgx_id); + ++ /* Software must not access disabled LMAC registers */ ++ if (!is_lmac_valid(cgx_dev, lmac_id)) ++ return; + cgx_write(cgx_dev, lmac_id, offset, val); + } + +@@ -176,6 +179,10 @@ u64 cgx_lmac_read(int cgx_id, int lmac_id, u64 offset) + { + struct cgx *cgx_dev = cgx_get_pdata(cgx_id); + ++ /* Software must not access disabled LMAC registers */ ++ if (!is_lmac_valid(cgx_dev, lmac_id)) ++ return 0; ++ + return cgx_read(cgx_dev, lmac_id, offset); + } + +-- +2.39.2 + diff --git a/queue-6.4/octeontx2-af-cn10kb-fix-interrupt-csr-addresses.patch b/queue-6.4/octeontx2-af-cn10kb-fix-interrupt-csr-addresses.patch new file mode 100644 index 00000000000..4bff8a383a8 --- /dev/null +++ b/queue-6.4/octeontx2-af-cn10kb-fix-interrupt-csr-addresses.patch @@ -0,0 +1,58 @@ +From a11892a35bb4a51ce4c508893fd2209b45ae8693 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Jun 2023 11:58:42 +0530 +Subject: octeontx2-af: cn10kb: fix interrupt csr addresses + +From: Hariprasad Kelam + +[ Upstream commit 4c5a331cacda995e995a7857f0e44e8937d98d2c ] + +The current design is that, for asynchronous events like link_up and +link_down firmware raises the interrupt to kernel. The previous patch +which added RPM_USX driver has a bug where it uses old csr addresses +for configuring interrupts. Which is resulting in losing interrupts +from source firmware. + +This patch fixes the issue by correcting csr addresses. + +Fixes: b9d0fedc6234 ("octeontx2-af: cn10kb: Add RPM_USX MAC support") +Signed-off-by: Hariprasad Kelam +Signed-off-by: Sunil Goutham +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/af/rpm.c | 2 +- + drivers/net/ethernet/marvell/octeontx2/af/rpm.h | 3 ++- + 2 files changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rpm.c b/drivers/net/ethernet/marvell/octeontx2/af/rpm.c +index de0d88dd10d65..a433f92c51eae 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rpm.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rpm.c +@@ -47,7 +47,7 @@ static struct mac_ops rpm2_mac_ops = { + .int_set_reg = RPM2_CMRX_SW_INT_ENA_W1S, + .irq_offset = 1, + .int_ena_bit = BIT_ULL(0), +- .lmac_fwi = RPM_LMAC_FWI, ++ .lmac_fwi = RPM2_LMAC_FWI, + .non_contiguous_serdes_lane = true, + .rx_stats_cnt = 43, + .tx_stats_cnt = 34, +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rpm.h b/drivers/net/ethernet/marvell/octeontx2/af/rpm.h +index 22147b4c21370..be294eebab265 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rpm.h ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rpm.h +@@ -94,7 +94,8 @@ + + /* CN10KB CSR Declaration */ + #define RPM2_CMRX_SW_INT 0x1b0 +-#define RPM2_CMRX_SW_INT_ENA_W1S 0x1b8 ++#define RPM2_CMRX_SW_INT_ENA_W1S 0x1c8 ++#define RPM2_LMAC_FWI 0x12 + #define RPM2_CMR_CHAN_MSK_OR 0x3120 + #define RPM2_CMR_RX_OVR_BP_EN BIT_ULL(2) + #define RPM2_CMR_RX_OVR_BP_BP BIT_ULL(1) +-- +2.39.2 + diff --git a/queue-6.4/octeontx2-af-fix-mapping-for-nix-block-from-cgx-conn.patch b/queue-6.4/octeontx2-af-fix-mapping-for-nix-block-from-cgx-conn.patch new file mode 100644 index 00000000000..01eca337f9f --- /dev/null +++ b/queue-6.4/octeontx2-af-fix-mapping-for-nix-block-from-cgx-conn.patch @@ -0,0 +1,74 @@ +From 92a49ff16377d95343612e4800c1d6002060706c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Jun 2023 11:58:43 +0530 +Subject: octeontx2-af: Fix mapping for NIX block from CGX connection + +From: Hariprasad Kelam + +[ Upstream commit 2e7bc57b976bb016c6569a54d95c1b8d88f9450a ] + +Firmware configures NIX block mapping for all MAC blocks. +The current implementation reads the configuration and +creates the mapping between RVU PF and NIX blocks. But +this configuration is only valid for silicons that support +multiple blocks. For all other silicons, all MAC blocks +map to NIX0. + +This patch corrects the mapping by adding a check for the same. + +Fixes: c5a73b632b90 ("octeontx2-af: Map NIX block from CGX connection") +Signed-off-by: Hariprasad Kelam +Signed-off-by: Sunil Goutham +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/af/rvu.h | 11 +++++++++++ + drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c | 2 +- + 2 files changed, 12 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu.h b/drivers/net/ethernet/marvell/octeontx2/af/rvu.h +index d655bf04a483d..68ff3244a84a2 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu.h ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu.h +@@ -23,6 +23,7 @@ + #define PCI_DEVID_OCTEONTX2_LBK 0xA061 + + /* Subsystem Device ID */ ++#define PCI_SUBSYS_DEVID_98XX 0xB100 + #define PCI_SUBSYS_DEVID_96XX 0xB200 + #define PCI_SUBSYS_DEVID_CN10K_A 0xB900 + #define PCI_SUBSYS_DEVID_CNF10K_B 0xBC00 +@@ -669,6 +670,16 @@ static inline u16 rvu_nix_chan_cpt(struct rvu *rvu, u8 chan) + return rvu->hw->cpt_chan_base + chan; + } + ++static inline bool is_rvu_supports_nix1(struct rvu *rvu) ++{ ++ struct pci_dev *pdev = rvu->pdev; ++ ++ if (pdev->subsystem_device == PCI_SUBSYS_DEVID_98XX) ++ return true; ++ ++ return false; ++} ++ + /* Function Prototypes + * RVU + */ +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c +index 83b342fa8d753..48611e6032284 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c +@@ -114,7 +114,7 @@ static void rvu_map_cgx_nix_block(struct rvu *rvu, int pf, + p2x = cgx_lmac_get_p2x(cgx_id, lmac_id); + /* Firmware sets P2X_SELECT as either NIX0 or NIX1 */ + pfvf->nix_blkaddr = BLKADDR_NIX0; +- if (p2x == CMR_P2X_SEL_NIX1) ++ if (is_rvu_supports_nix1(rvu) && p2x == CMR_P2X_SEL_NIX1) + pfvf->nix_blkaddr = BLKADDR_NIX1; + } + +-- +2.39.2 + diff --git a/queue-6.4/octeontx2-af-reset-mac-features-in-flr.patch b/queue-6.4/octeontx2-af-reset-mac-features-in-flr.patch new file mode 100644 index 00000000000..0ebe97214a7 --- /dev/null +++ b/queue-6.4/octeontx2-af-reset-mac-features-in-flr.patch @@ -0,0 +1,275 @@ +From fd088009fbc452be49e88fb957011e9dda98923d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Jun 2023 11:58:45 +0530 +Subject: octeontx2-af: Reset MAC features in FLR + +From: Hariprasad Kelam + +[ Upstream commit 2e3e94c2f5dc98a8a0e93850407064bc5389c306 ] + +AF driver configures MAC features like internal loopback and PFC upon +receiving the request from PF and its VF netdev. But these +features are not getting reset in FLR. This patch fixes the issue by +resetting the same. + +Fixes: 23999b30ae67 ("octeontx2-af: Enable or disable CGX internal loopback") +Fixes: 1121f6b02e7a ("octeontx2-af: Priority flow control configuration support") +Signed-off-by: Hariprasad Kelam +Signed-off-by: Sunil Goutham +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../net/ethernet/marvell/octeontx2/af/cgx.c | 26 ++++++++++++++-- + .../net/ethernet/marvell/octeontx2/af/cgx.h | 2 ++ + .../marvell/octeontx2/af/lmac_common.h | 3 ++ + .../net/ethernet/marvell/octeontx2/af/rpm.c | 30 +++++++++++++++++-- + .../net/ethernet/marvell/octeontx2/af/rpm.h | 2 ++ + .../net/ethernet/marvell/octeontx2/af/rvu.c | 1 + + .../net/ethernet/marvell/octeontx2/af/rvu.h | 1 + + .../ethernet/marvell/octeontx2/af/rvu_cgx.c | 18 +++++++++++ + 8 files changed, 77 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/cgx.c b/drivers/net/ethernet/marvell/octeontx2/af/cgx.c +index f4bdca662d616..592037f4e55b6 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/cgx.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/cgx.c +@@ -537,14 +537,15 @@ static u32 cgx_get_lmac_fifo_len(void *cgxd, int lmac_id) + int cgx_lmac_internal_loopback(void *cgxd, int lmac_id, bool enable) + { + struct cgx *cgx = cgxd; +- u8 lmac_type; ++ struct lmac *lmac; + u64 cfg; + + if (!is_lmac_valid(cgx, lmac_id)) + return -ENODEV; + +- lmac_type = cgx->mac_ops->get_lmac_type(cgx, lmac_id); +- if (lmac_type == LMAC_MODE_SGMII || lmac_type == LMAC_MODE_QSGMII) { ++ lmac = lmac_pdata(lmac_id, cgx); ++ if (lmac->lmac_type == LMAC_MODE_SGMII || ++ lmac->lmac_type == LMAC_MODE_QSGMII) { + cfg = cgx_read(cgx, lmac_id, CGXX_GMP_PCS_MRX_CTL); + if (enable) + cfg |= CGXX_GMP_PCS_MRX_CTL_LBK; +@@ -1563,6 +1564,23 @@ int cgx_lmac_linkup_start(void *cgxd) + return 0; + } + ++int cgx_lmac_reset(void *cgxd, int lmac_id, u8 pf_req_flr) ++{ ++ struct cgx *cgx = cgxd; ++ u64 cfg; ++ ++ if (!is_lmac_valid(cgx, lmac_id)) ++ return -ENODEV; ++ ++ /* Resetting PFC related CSRs */ ++ cfg = 0xff; ++ cgx_write(cgxd, lmac_id, CGXX_CMRX_RX_LOGL_XON, cfg); ++ ++ if (pf_req_flr) ++ cgx_lmac_internal_loopback(cgxd, lmac_id, false); ++ return 0; ++} ++ + static int cgx_configure_interrupt(struct cgx *cgx, struct lmac *lmac, + int cnt, bool req_free) + { +@@ -1682,6 +1700,7 @@ static int cgx_lmac_init(struct cgx *cgx) + cgx->lmac_idmap[lmac->lmac_id] = lmac; + set_bit(lmac->lmac_id, &cgx->lmac_bmap); + cgx->mac_ops->mac_pause_frm_config(cgx, lmac->lmac_id, true); ++ lmac->lmac_type = cgx->mac_ops->get_lmac_type(cgx, lmac->lmac_id); + } + + return cgx_lmac_verify_fwi_version(cgx); +@@ -1778,6 +1797,7 @@ static struct mac_ops cgx_mac_ops = { + .mac_tx_enable = cgx_lmac_tx_enable, + .pfc_config = cgx_lmac_pfc_config, + .mac_get_pfc_frm_cfg = cgx_lmac_get_pfc_frm_cfg, ++ .mac_reset = cgx_lmac_reset, + }; + + static int cgx_probe(struct pci_dev *pdev, const struct pci_device_id *id) +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/cgx.h b/drivers/net/ethernet/marvell/octeontx2/af/cgx.h +index 5a20d93004c71..5741141796880 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/cgx.h ++++ b/drivers/net/ethernet/marvell/octeontx2/af/cgx.h +@@ -35,6 +35,7 @@ + #define CGXX_CMRX_INT_ENA_W1S 0x058 + #define CGXX_CMRX_RX_ID_MAP 0x060 + #define CGXX_CMRX_RX_STAT0 0x070 ++#define CGXX_CMRX_RX_LOGL_XON 0x100 + #define CGXX_CMRX_RX_LMACS 0x128 + #define CGXX_CMRX_RX_DMAC_CTL0 (0x1F8 + mac_ops->csr_offset) + #define CGX_DMAC_CTL0_CAM_ENABLE BIT_ULL(3) +@@ -181,4 +182,5 @@ int cgx_lmac_get_pfc_frm_cfg(void *cgxd, int lmac_id, u8 *tx_pause, + u8 *rx_pause); + int verify_lmac_fc_cfg(void *cgxd, int lmac_id, u8 tx_pause, u8 rx_pause, + int pfvf_idx); ++int cgx_lmac_reset(void *cgxd, int lmac_id, u8 pf_req_flr); + #endif /* CGX_H */ +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/lmac_common.h b/drivers/net/ethernet/marvell/octeontx2/af/lmac_common.h +index 39aaf0e4467dc..0b4cba03f2e83 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/lmac_common.h ++++ b/drivers/net/ethernet/marvell/octeontx2/af/lmac_common.h +@@ -24,6 +24,7 @@ + * @cgx: parent cgx port + * @mcast_filters_count: Number of multicast filters installed + * @lmac_id: lmac port id ++ * @lmac_type: lmac type like SGMII/XAUI + * @cmd_pend: flag set before new command is started + * flag cleared after command response is received + * @name: lmac port name +@@ -43,6 +44,7 @@ struct lmac { + struct cgx *cgx; + u8 mcast_filters_count; + u8 lmac_id; ++ u8 lmac_type; + bool cmd_pend; + char *name; + }; +@@ -125,6 +127,7 @@ struct mac_ops { + + int (*mac_get_pfc_frm_cfg)(void *cgxd, int lmac_id, + u8 *tx_pause, u8 *rx_pause); ++ int (*mac_reset)(void *cgxd, int lmac_id, u8 pf_req_flr); + + /* FEC stats */ + int (*get_fec_stats)(void *cgxd, int lmac_id, +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rpm.c b/drivers/net/ethernet/marvell/octeontx2/af/rpm.c +index a433f92c51eae..b4fcb20c3f4fd 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rpm.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rpm.c +@@ -37,6 +37,7 @@ static struct mac_ops rpm_mac_ops = { + .mac_tx_enable = rpm_lmac_tx_enable, + .pfc_config = rpm_lmac_pfc_config, + .mac_get_pfc_frm_cfg = rpm_lmac_get_pfc_frm_cfg, ++ .mac_reset = rpm_lmac_reset, + }; + + static struct mac_ops rpm2_mac_ops = { +@@ -68,6 +69,7 @@ static struct mac_ops rpm2_mac_ops = { + .mac_tx_enable = rpm_lmac_tx_enable, + .pfc_config = rpm_lmac_pfc_config, + .mac_get_pfc_frm_cfg = rpm_lmac_get_pfc_frm_cfg, ++ .mac_reset = rpm_lmac_reset, + }; + + bool is_dev_rpm2(void *rpmd) +@@ -537,14 +539,15 @@ u32 rpm2_get_lmac_fifo_len(void *rpmd, int lmac_id) + int rpm_lmac_internal_loopback(void *rpmd, int lmac_id, bool enable) + { + rpm_t *rpm = rpmd; +- u8 lmac_type; ++ struct lmac *lmac; + u64 cfg; + + if (!is_lmac_valid(rpm, lmac_id)) + return -ENODEV; +- lmac_type = rpm->mac_ops->get_lmac_type(rpm, lmac_id); + +- if (lmac_type == LMAC_MODE_QSGMII || lmac_type == LMAC_MODE_SGMII) { ++ lmac = lmac_pdata(lmac_id, rpm); ++ if (lmac->lmac_type == LMAC_MODE_QSGMII || ++ lmac->lmac_type == LMAC_MODE_SGMII) { + dev_err(&rpm->pdev->dev, "loopback not supported for LPC mode\n"); + return 0; + } +@@ -713,3 +716,24 @@ int rpm_get_fec_stats(void *rpmd, int lmac_id, struct cgx_fec_stats_rsp *rsp) + + return 0; + } ++ ++int rpm_lmac_reset(void *rpmd, int lmac_id, u8 pf_req_flr) ++{ ++ u64 rx_logl_xon, cfg; ++ rpm_t *rpm = rpmd; ++ ++ if (!is_lmac_valid(rpm, lmac_id)) ++ return -ENODEV; ++ ++ /* Resetting PFC related CSRs */ ++ rx_logl_xon = is_dev_rpm2(rpm) ? RPM2_CMRX_RX_LOGL_XON : ++ RPMX_CMRX_RX_LOGL_XON; ++ cfg = 0xff; ++ ++ rpm_write(rpm, lmac_id, rx_logl_xon, cfg); ++ ++ if (pf_req_flr) ++ rpm_lmac_internal_loopback(rpm, lmac_id, false); ++ ++ return 0; ++} +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rpm.h b/drivers/net/ethernet/marvell/octeontx2/af/rpm.h +index be294eebab265..b79cfbc6f8770 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rpm.h ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rpm.h +@@ -74,6 +74,7 @@ + #define RPMX_MTI_MAC100X_CL01_PAUSE_QUANTA 0x80A8 + #define RPMX_MTI_MAC100X_CL89_PAUSE_QUANTA 0x8108 + #define RPM_DEFAULT_PAUSE_TIME 0x7FF ++#define RPMX_CMRX_RX_LOGL_XON 0x4100 + + #define RPMX_MTI_MAC100X_XIF_MODE 0x8100 + #define RPMX_ONESTEP_ENABLE BIT_ULL(5) +@@ -132,4 +133,5 @@ int rpm_lmac_get_pfc_frm_cfg(void *rpmd, int lmac_id, u8 *tx_pause, + int rpm2_get_nr_lmacs(void *rpmd); + bool is_dev_rpm2(void *rpmd); + int rpm_get_fec_stats(void *cgxd, int lmac_id, struct cgx_fec_stats_rsp *rsp); ++int rpm_lmac_reset(void *rpmd, int lmac_id, u8 pf_req_flr); + #endif /* RPM_H */ +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu.c +index 9f673bda9dbdd..b26b013216933 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu.c +@@ -2629,6 +2629,7 @@ static void __rvu_flr_handler(struct rvu *rvu, u16 pcifunc) + * Since LF is detached use LF number as -1. + */ + rvu_npc_free_mcam_entries(rvu, pcifunc, -1); ++ rvu_mac_reset(rvu, pcifunc); + + mutex_unlock(&rvu->flr_lock); + } +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu.h b/drivers/net/ethernet/marvell/octeontx2/af/rvu.h +index 68ff3244a84a2..be279cd1fd729 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu.h ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu.h +@@ -875,6 +875,7 @@ int rvu_cgx_config_tx(void *cgxd, int lmac_id, bool enable); + int rvu_cgx_prio_flow_ctrl_cfg(struct rvu *rvu, u16 pcifunc, u8 tx_pause, u8 rx_pause, + u16 pfc_en); + int rvu_cgx_cfg_pause_frm(struct rvu *rvu, u16 pcifunc, u8 tx_pause, u8 rx_pause); ++void rvu_mac_reset(struct rvu *rvu, u16 pcifunc); + u32 rvu_cgx_get_lmac_fifolen(struct rvu *rvu, int cgx, int lmac); + int npc_get_nixlf_mcam_index(struct npc_mcam *mcam, u16 pcifunc, int nixlf, + int type); +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c +index 48611e6032284..4b8559ac0404f 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c +@@ -1250,3 +1250,21 @@ int rvu_mbox_handler_cgx_prio_flow_ctrl_cfg(struct rvu *rvu, + mac_ops->mac_get_pfc_frm_cfg(cgxd, lmac_id, &rsp->tx_pause, &rsp->rx_pause); + return err; + } ++ ++void rvu_mac_reset(struct rvu *rvu, u16 pcifunc) ++{ ++ int pf = rvu_get_pf(pcifunc); ++ struct mac_ops *mac_ops; ++ struct cgx *cgxd; ++ u8 cgx, lmac; ++ ++ if (!is_pf_cgxmapped(rvu, pf)) ++ return; ++ ++ rvu_get_cgx_lmac_id(rvu->pf2cgxlmac_map[pf], &cgx, &lmac); ++ cgxd = rvu_cgx_pdata(cgx, rvu); ++ mac_ops = get_mac_ops(cgxd); ++ ++ if (mac_ops->mac_reset(cgxd, lmac, !is_vf(pcifunc))) ++ dev_err(rvu->dev, "Failed to reset MAC\n"); ++} +-- +2.39.2 + diff --git a/queue-6.4/perf-bpf-move-the-declaration-of-struct-rq.patch b/queue-6.4/perf-bpf-move-the-declaration-of-struct-rq.patch new file mode 100644 index 00000000000..0cb1da54bad --- /dev/null +++ b/queue-6.4/perf-bpf-move-the-declaration-of-struct-rq.patch @@ -0,0 +1,72 @@ +From 660b359c2200b4d839765db2779af847dbc646ff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jun 2023 21:14:03 -0700 +Subject: perf bpf: Move the declaration of struct rq + +From: Ian Rogers + +[ Upstream commit 5c45b210479bffe068d38902fcdcb52c4c60a264 ] + +struct rq is defined in vmlinux.h when the vmlinux.h is generated, +this causes a redefinition failure if it is declared in +lock_contention.bpf.c. Move the definition to vmlinux.h for +consistency with the generated version. + +Fixes: 760ebc45746b ("perf lock contention: Add empty 'struct rq' to satisfy libbpf 'runqueue' type verification") +Signed-off-by: Ian Rogers +Acked-by: Andrii Nakryiko +Acked-by: Namhyung Kim +Acked-by: Jiri Olsa +Cc: James Clark +Cc: Mark Rutland +Cc: Yang Jihong +Cc: Peter Zijlstra +Cc: Adrian Hunter +Cc: Arnaldo Carvalho de Melo +Cc: Alexander Shishkin +Cc: Tiezhu Yang +Cc: Ingo Molnar +Cc: bpf@vger.kernel.org +Link: https://lore.kernel.org/r/20230623041405.4039475-3-irogers@google.com +Signed-off-by: Namhyung Kim +Signed-off-by: Sasha Levin +--- + tools/perf/util/bpf_skel/lock_contention.bpf.c | 2 -- + tools/perf/util/bpf_skel/vmlinux.h | 10 ++++++++++ + 2 files changed, 10 insertions(+), 2 deletions(-) + +diff --git a/tools/perf/util/bpf_skel/lock_contention.bpf.c b/tools/perf/util/bpf_skel/lock_contention.bpf.c +index 1d48226ae75d4..8d3cfbb3cc65b 100644 +--- a/tools/perf/util/bpf_skel/lock_contention.bpf.c ++++ b/tools/perf/util/bpf_skel/lock_contention.bpf.c +@@ -416,8 +416,6 @@ int contention_end(u64 *ctx) + return 0; + } + +-struct rq {}; +- + extern struct rq runqueues __ksym; + + struct rq___old { +diff --git a/tools/perf/util/bpf_skel/vmlinux.h b/tools/perf/util/bpf_skel/vmlinux.h +index c7ed51b0c1ef9..ab84a6e1da5ee 100644 +--- a/tools/perf/util/bpf_skel/vmlinux.h ++++ b/tools/perf/util/bpf_skel/vmlinux.h +@@ -171,4 +171,14 @@ struct bpf_perf_event_data_kern { + struct perf_sample_data *data; + struct perf_event *event; + } __attribute__((preserve_access_index)); ++ ++/* ++ * If 'struct rq' isn't defined for lock_contention.bpf.c, for the sake of ++ * rq___old and rq___new, then the type for the 'runqueue' variable ends up ++ * being a forward declaration (BTF_KIND_FWD) while the kernel has it defined ++ * (BTF_KIND_STRUCT). The definition appears in vmlinux.h rather than ++ * lock_contention.bpf.c for consistency with a generated vmlinux.h. ++ */ ++struct rq {}; ++ + #endif // __VMLINUX_H +-- +2.39.2 + diff --git a/queue-6.4/phy-qcom-qmp-combo-fix-display-port-phy-configuratio.patch b/queue-6.4/phy-qcom-qmp-combo-fix-display-port-phy-configuratio.patch new file mode 100644 index 00000000000..b384888c64e --- /dev/null +++ b/queue-6.4/phy-qcom-qmp-combo-fix-display-port-phy-configuratio.patch @@ -0,0 +1,78 @@ +From f68b8703bd4cdd93659f5a7d78009ce1b543c331 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Jun 2023 11:39:58 +0200 +Subject: phy: qcom: qmp-combo: fix Display Port PHY configuration for SM8550 + +From: Neil Armstrong + +[ Upstream commit 6cd52a2a06774c6c454ffef084c3d9b17618ca23 ] + +The SM8550 PHY also uses a different offset for the CMN_STATUS reg, +use the right one for the v6 Display Port configuration. + +Fixes: 49742e9edab3 ("phy: qcom-qmp-combo: Add support for SM8550") +Signed-off-by: Neil Armstrong +Reviewed-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20230601-topic-sm8550-upstream-dp-phy-init-fix-v1-1-4e9da9f97991@linaro.org +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/qualcomm/phy-qcom-qmp-combo.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/phy/qualcomm/phy-qcom-qmp-combo.c b/drivers/phy/qualcomm/phy-qcom-qmp-combo.c +index 87b17e5877ab8..1fdcc81661ed8 100644 +--- a/drivers/phy/qualcomm/phy-qcom-qmp-combo.c ++++ b/drivers/phy/qualcomm/phy-qcom-qmp-combo.c +@@ -2142,6 +2142,7 @@ static void qmp_v4_configure_dp_tx(struct qmp_combo *qmp) + static int qmp_v456_configure_dp_phy(struct qmp_combo *qmp, + unsigned int com_resetm_ctrl_reg, + unsigned int com_c_ready_status_reg, ++ unsigned int com_cmn_status_reg, + unsigned int dp_phy_status_reg) + { + const struct phy_configure_opts_dp *dp_opts = &qmp->dp_opts; +@@ -2198,14 +2199,14 @@ static int qmp_v456_configure_dp_phy(struct qmp_combo *qmp, + 10000)) + return -ETIMEDOUT; + +- if (readl_poll_timeout(qmp->dp_serdes + QSERDES_V4_COM_CMN_STATUS, ++ if (readl_poll_timeout(qmp->dp_serdes + com_cmn_status_reg, + status, + ((status & BIT(0)) > 0), + 500, + 10000)) + return -ETIMEDOUT; + +- if (readl_poll_timeout(qmp->dp_serdes + QSERDES_V4_COM_CMN_STATUS, ++ if (readl_poll_timeout(qmp->dp_serdes + com_cmn_status_reg, + status, + ((status & BIT(1)) > 0), + 500, +@@ -2241,6 +2242,7 @@ static int qmp_v4_configure_dp_phy(struct qmp_combo *qmp) + + ret = qmp_v456_configure_dp_phy(qmp, QSERDES_V4_COM_RESETSM_CNTRL, + QSERDES_V4_COM_C_READY_STATUS, ++ QSERDES_V4_COM_CMN_STATUS, + QSERDES_V4_DP_PHY_STATUS); + if (ret < 0) + return ret; +@@ -2305,6 +2307,7 @@ static int qmp_v5_configure_dp_phy(struct qmp_combo *qmp) + + ret = qmp_v456_configure_dp_phy(qmp, QSERDES_V4_COM_RESETSM_CNTRL, + QSERDES_V4_COM_C_READY_STATUS, ++ QSERDES_V4_COM_CMN_STATUS, + QSERDES_V4_DP_PHY_STATUS); + if (ret < 0) + return ret; +@@ -2364,6 +2367,7 @@ static int qmp_v6_configure_dp_phy(struct qmp_combo *qmp) + + ret = qmp_v456_configure_dp_phy(qmp, QSERDES_V6_COM_RESETSM_CNTRL, + QSERDES_V6_COM_C_READY_STATUS, ++ QSERDES_V6_COM_CMN_STATUS, + QSERDES_V6_DP_PHY_STATUS); + if (ret < 0) + return ret; +-- +2.39.2 + diff --git a/queue-6.4/phy-tegra-xusb-check-return-value-of-devm_kzalloc.patch b/queue-6.4/phy-tegra-xusb-check-return-value-of-devm_kzalloc.patch new file mode 100644 index 00000000000..8269da398bc --- /dev/null +++ b/queue-6.4/phy-tegra-xusb-check-return-value-of-devm_kzalloc.patch @@ -0,0 +1,40 @@ +From ae531944186f6b940ab632511aa4af0866c3e396 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 May 2023 10:39:50 +0300 +Subject: phy: tegra: xusb: check return value of devm_kzalloc() + +From: Claudiu Beznea + +[ Upstream commit 44faada0f38fc333d392af04c343b0e23f8f5d81 ] + +devm_kzalloc() returns a pointer to dynamically allocated memory. +Pointer could be NULL in case allocation fails. Check pointer validity. +Identified with coccinelle (kmerr.cocci script). + +Fixes: f67213cee2b3 ("phy: tegra: xusb: Add usb-role-switch support") +Signed-off-by: Claudiu Beznea +Acked-by: Thierry Reding +Link: https://lore.kernel.org/r/20230531073950.145339-1-claudiu.beznea@microchip.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/tegra/xusb.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/phy/tegra/xusb.c b/drivers/phy/tegra/xusb.c +index b5bad46a04a38..a296b87dced18 100644 +--- a/drivers/phy/tegra/xusb.c ++++ b/drivers/phy/tegra/xusb.c +@@ -676,6 +676,9 @@ static int tegra_xusb_setup_usb_role_switch(struct tegra_xusb_port *port) + port->dev.driver = devm_kzalloc(&port->dev, + sizeof(struct device_driver), + GFP_KERNEL); ++ if (!port->dev.driver) ++ return -ENOMEM; ++ + port->dev.driver->owner = THIS_MODULE; + + port->usb_role_sw = usb_role_switch_register(&port->dev, +-- +2.39.2 + diff --git a/queue-6.4/power-supply-rt9467-make-charger-enable-control-as-l.patch b/queue-6.4/power-supply-rt9467-make-charger-enable-control-as-l.patch new file mode 100644 index 00000000000..751f5269c06 --- /dev/null +++ b/queue-6.4/power-supply-rt9467-make-charger-enable-control-as-l.patch @@ -0,0 +1,40 @@ +From 977ab01a9bbfa5758cca00a75245812ce08ea8a7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Jun 2023 14:24:36 +0800 +Subject: power: supply: rt9467: Make charger-enable control as logic level + +From: ChiYuan Huang + +[ Upstream commit 5d80a86a99d524b0d89ff3906c6200b9f57b66f8 ] + +The current coding make 'charger-enable-gpio' control as real hardware +level. This conflicts with the default binding example. For driver +behavior, no need to use real hardware level, just logic level is +enough. This change can make this flexibility keep in dts gpio active +level about this pin. + +Fixes: 6f7f70e3a8dd ("power: supply: rt9467: Add Richtek RT9467 charger driver") +Signed-off-by: ChiYuan Huang +Reviewed-by: Krzysztof Kozlowski +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + drivers/power/supply/rt9467-charger.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/power/supply/rt9467-charger.c b/drivers/power/supply/rt9467-charger.c +index ea33693b69779..b0b9ff8667459 100644 +--- a/drivers/power/supply/rt9467-charger.c ++++ b/drivers/power/supply/rt9467-charger.c +@@ -1192,7 +1192,7 @@ static int rt9467_charger_probe(struct i2c_client *i2c) + i2c_set_clientdata(i2c, data); + + /* Default pull charge enable gpio to make 'CHG_EN' by SW control only */ +- ceb_gpio = devm_gpiod_get_optional(dev, "charge-enable", GPIOD_OUT_LOW); ++ ceb_gpio = devm_gpiod_get_optional(dev, "charge-enable", GPIOD_OUT_HIGH); + if (IS_ERR(ceb_gpio)) + return dev_err_probe(dev, PTR_ERR(ceb_gpio), + "Failed to config charge enable gpio\n"); +-- +2.39.2 + diff --git a/queue-6.4/powerpc-allow-ppc_early_debug_cpm-only-when-serial_c.patch b/queue-6.4/powerpc-allow-ppc_early_debug_cpm-only-when-serial_c.patch new file mode 100644 index 00000000000..822d1ab3c6b --- /dev/null +++ b/queue-6.4/powerpc-allow-ppc_early_debug_cpm-only-when-serial_c.patch @@ -0,0 +1,46 @@ +From 431eee4c72d4a879c30adf6a1ed4068e098a051b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Jun 2023 22:47:12 -0700 +Subject: powerpc: allow PPC_EARLY_DEBUG_CPM only when SERIAL_CPM=y +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Randy Dunlap + +[ Upstream commit 39f49684036d24af800ff194c33c7b2653c591d7 ] + +In a randconfig with CONFIG_SERIAL_CPM=m and +CONFIG_PPC_EARLY_DEBUG_CPM=y, there is a build error: +ERROR: modpost: "udbg_putc" [drivers/tty/serial/cpm_uart/cpm_uart.ko] undefined! + +Prevent the build error by allowing PPC_EARLY_DEBUG_CPM only when +SERIAL_CPM=y. + +Fixes: c374e00e17f1 ("[POWERPC] Add early debug console for CPM serial ports.") +Signed-off-by: Randy Dunlap +Reviewed-by: Pali Rohár +Reviewed-by: Christophe Leroy +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20230701054714.30512-1-rdunlap@infradead.org +Signed-off-by: Sasha Levin +--- + arch/powerpc/Kconfig.debug | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/powerpc/Kconfig.debug b/arch/powerpc/Kconfig.debug +index 6aaf8dc60610d..2a54fadbeaf51 100644 +--- a/arch/powerpc/Kconfig.debug ++++ b/arch/powerpc/Kconfig.debug +@@ -240,7 +240,7 @@ config PPC_EARLY_DEBUG_40x + + config PPC_EARLY_DEBUG_CPM + bool "Early serial debugging for Freescale CPM-based serial ports" +- depends on SERIAL_CPM ++ depends on SERIAL_CPM=y + help + Select this to enable early debugging for Freescale chips + using a CPM-based serial port. This assumes that the bootwrapper +-- +2.39.2 + diff --git a/queue-6.4/powerpc-dts-turris1x.dts-fix-pcie-mem-size-for-pci2-.patch b/queue-6.4/powerpc-dts-turris1x.dts-fix-pcie-mem-size-for-pci2-.patch new file mode 100644 index 00000000000..6fe8df74a3b --- /dev/null +++ b/queue-6.4/powerpc-dts-turris1x.dts-fix-pcie-mem-size-for-pci2-.patch @@ -0,0 +1,59 @@ +From fc16269bdee2bd5f3250b16e1b2464d704034490 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 May 2023 19:28:18 +0200 +Subject: powerpc: dts: turris1x.dts: Fix PCIe MEM size for pci2 node +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pali Rohár + +[ Upstream commit abaa02fc944f2f9f2c2e1925ddaceaf35c48528c ] + +Freescale PCIe controllers on their PCIe Root Ports do not have any +mappable PCI BAR allocate from PCIe MEM. + +Information about 1MB window on BAR0 of PCIe Root Port was misleading +because Freescale PCIe controllers have at BAR0 position different register +PEXCSRBAR, and kernel correctly skipts BAR0 for these Freescale PCIe Root +Ports. + +So update comment about P2020 PCIe Root Port and decrease PCIe MEM size +required for PCIe controller (pci2 node) on which is on-board xHCI +controller. + +lspci confirms that on P2020 PCIe Root Port is no PCI BAR and /proc/iomem +sees that only c0000000-c000ffff and c0010000-c0011fff ranges are used. + +Fixes: 54c15ec3b738 ("powerpc: dts: Add DTS file for CZ.NIC Turris 1.x routers") +Signed-off-by: Pali Rohár +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20230505172818.18416-1-pali@kernel.org +Signed-off-by: Sasha Levin +--- + arch/powerpc/boot/dts/turris1x.dts | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/powerpc/boot/dts/turris1x.dts b/arch/powerpc/boot/dts/turris1x.dts +index 6612160c19d59..dff1ea074d9d9 100644 +--- a/arch/powerpc/boot/dts/turris1x.dts ++++ b/arch/powerpc/boot/dts/turris1x.dts +@@ -476,12 +476,12 @@ pci2: pcie@ffe08000 { + * channel 1 (but only USB 2.0 subset) to USB 2.0 pins on mPCIe + * slot 1 (CN5), channels 2 and 3 to connector P600. + * +- * P2020 PCIe Root Port uses 1MB of PCIe MEM and xHCI controller ++ * P2020 PCIe Root Port does not use PCIe MEM and xHCI controller + * uses 64kB + 8kB of PCIe MEM. No PCIe IO is used or required. +- * So allocate 2MB of PCIe MEM for this PCIe bus. ++ * So allocate 128kB of PCIe MEM for this PCIe bus. + */ + reg = <0 0xffe08000 0 0x1000>; +- ranges = <0x02000000 0x0 0xc0000000 0 0xc0000000 0x0 0x00200000>, /* MEM */ ++ ranges = <0x02000000 0x0 0xc0000000 0 0xc0000000 0x0 0x00020000>, /* MEM */ + <0x01000000 0x0 0x00000000 0 0xffc20000 0x0 0x00010000>; /* IO */ + + pcie@0 { +-- +2.39.2 + diff --git a/queue-6.4/pptp-fix-fib-lookup-calls.patch b/queue-6.4/pptp-fix-fib-lookup-calls.patch new file mode 100644 index 00000000000..e1c85629c91 --- /dev/null +++ b/queue-6.4/pptp-fix-fib-lookup-calls.patch @@ -0,0 +1,116 @@ +From 5a163ebf01b5cd967fbb2b10b66bc76e30a38a70 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Jul 2023 19:14:46 +0200 +Subject: pptp: Fix fib lookup calls. + +From: Guillaume Nault + +[ Upstream commit 84bef5b6037c15180ef88ac4216dc621d16df1a6 ] + +PPTP uses pppox sockets (struct pppox_sock). These sockets don't embed +an inet_sock structure, so it's invalid to call inet_sk() on them. + +Therefore, the ip_route_output_ports() call in pptp_connect() has two +problems: + + * The tos variable is set with RT_CONN_FLAGS(sk), which calls + inet_sk() on the pppox socket. + + * ip_route_output_ports() tries to retrieve routing flags using + inet_sk_flowi_flags(), which is also going to call inet_sk() on the + pppox socket. + +While PPTP doesn't use inet sockets, it's actually really layered on +top of IP and therefore needs a proper way to do fib lookups. So let's +define pptp_route_output() to get a struct rtable from a pptp socket. +Let's also replace the ip_route_output_ports() call of pptp_xmit() for +consistency. + +In practice, this means that: + + * pptp_connect() sets ->flowi4_tos and ->flowi4_flags to zero instead + of using bits of unrelated struct pppox_sock fields. + + * pptp_xmit() now respects ->sk_mark and ->sk_uid. + + * pptp_xmit() now calls the security_sk_classify_flow() security + hook, thus allowing to set ->flowic_secid. + + * pptp_xmit() now passes the pppox socket to xfrm_lookup_route(). + +Found by code inspection. + +Fixes: 00959ade36ac ("PPTP: PPP over IPv4 (Point-to-Point Tunneling Protocol)") +Signed-off-by: Guillaume Nault +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ppp/pptp.c | 31 ++++++++++++++++++++----------- + 1 file changed, 20 insertions(+), 11 deletions(-) + +diff --git a/drivers/net/ppp/pptp.c b/drivers/net/ppp/pptp.c +index 0fe78826c8fa4..32183f24e63ff 100644 +--- a/drivers/net/ppp/pptp.c ++++ b/drivers/net/ppp/pptp.c +@@ -24,6 +24,7 @@ + #include + #include + #include ++#include + #include + + #include +@@ -128,6 +129,23 @@ static void del_chan(struct pppox_sock *sock) + spin_unlock(&chan_lock); + } + ++static struct rtable *pptp_route_output(struct pppox_sock *po, ++ struct flowi4 *fl4) ++{ ++ struct sock *sk = &po->sk; ++ struct net *net; ++ ++ net = sock_net(sk); ++ flowi4_init_output(fl4, sk->sk_bound_dev_if, sk->sk_mark, 0, ++ RT_SCOPE_UNIVERSE, IPPROTO_GRE, 0, ++ po->proto.pptp.dst_addr.sin_addr.s_addr, ++ po->proto.pptp.src_addr.sin_addr.s_addr, ++ 0, 0, sock_net_uid(net, sk)); ++ security_sk_classify_flow(sk, flowi4_to_flowi_common(fl4)); ++ ++ return ip_route_output_flow(net, fl4, sk); ++} ++ + static int pptp_xmit(struct ppp_channel *chan, struct sk_buff *skb) + { + struct sock *sk = (struct sock *) chan->private; +@@ -151,11 +169,7 @@ static int pptp_xmit(struct ppp_channel *chan, struct sk_buff *skb) + if (sk_pppox(po)->sk_state & PPPOX_DEAD) + goto tx_error; + +- rt = ip_route_output_ports(net, &fl4, NULL, +- opt->dst_addr.sin_addr.s_addr, +- opt->src_addr.sin_addr.s_addr, +- 0, 0, IPPROTO_GRE, +- RT_TOS(0), sk->sk_bound_dev_if); ++ rt = pptp_route_output(po, &fl4); + if (IS_ERR(rt)) + goto tx_error; + +@@ -438,12 +452,7 @@ static int pptp_connect(struct socket *sock, struct sockaddr *uservaddr, + po->chan.private = sk; + po->chan.ops = &pptp_chan_ops; + +- rt = ip_route_output_ports(sock_net(sk), &fl4, sk, +- opt->dst_addr.sin_addr.s_addr, +- opt->src_addr.sin_addr.s_addr, +- 0, 0, +- IPPROTO_GRE, RT_CONN_FLAGS(sk), +- sk->sk_bound_dev_if); ++ rt = pptp_route_output(po, &fl4); + if (IS_ERR(rt)) { + error = -EHOSTUNREACH; + goto end; +-- +2.39.2 + diff --git a/queue-6.4/pwm-ab8500-fix-error-code-in-probe.patch b/queue-6.4/pwm-ab8500-fix-error-code-in-probe.patch new file mode 100644 index 00000000000..b823a933d83 --- /dev/null +++ b/queue-6.4/pwm-ab8500-fix-error-code-in-probe.patch @@ -0,0 +1,41 @@ +From 35497101a8715d8479d918db1bb9c37991cc0972 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 May 2023 14:07:42 +0300 +Subject: pwm: ab8500: Fix error code in probe() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Dan Carpenter + +[ Upstream commit cdcffafc4d845cc0c6392cba168c7a942734cce7 ] + +This code accidentally return positive EINVAL instead of negative +-EINVAL. + +Fixes: eb41f334589d ("pwm: ab8500: Fix register offset calculation to not depend on probe order") +Signed-off-by: Dan Carpenter +Reviewed-by: Uwe Kleine-König +Reviewed-by: Linus Walleij +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-ab8500.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pwm/pwm-ab8500.c b/drivers/pwm/pwm-ab8500.c +index 507ff0d5f7bd8..583a7d69c7415 100644 +--- a/drivers/pwm/pwm-ab8500.c ++++ b/drivers/pwm/pwm-ab8500.c +@@ -190,7 +190,7 @@ static int ab8500_pwm_probe(struct platform_device *pdev) + int err; + + if (pdev->id < 1 || pdev->id > 31) +- return dev_err_probe(&pdev->dev, EINVAL, "Invalid device id %d\n", pdev->id); ++ return dev_err_probe(&pdev->dev, -EINVAL, "Invalid device id %d\n", pdev->id); + + /* + * Nothing to be done in probe, this is required to get the +-- +2.39.2 + diff --git a/queue-6.4/pwm-imx-tpm-force-real_period-to-be-zero-in-suspend.patch b/queue-6.4/pwm-imx-tpm-force-real_period-to-be-zero-in-suspend.patch new file mode 100644 index 00000000000..77f1b8f191b --- /dev/null +++ b/queue-6.4/pwm-imx-tpm-force-real_period-to-be-zero-in-suspend.patch @@ -0,0 +1,48 @@ +From 53fb2ee7b37048043dc2af4a0ea9cbe92ed90aaf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 May 2023 14:58:39 +0800 +Subject: pwm: imx-tpm: force 'real_period' to be zero in suspend +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Fancy Fang + +[ Upstream commit 661dfb7f46298e53f6c3deaa772fa527aae86193 ] + +During suspend, all the tpm registers will lose values. +So the 'real_period' value of struct 'imx_tpm_pwm_chip' +should be forced to be zero to force the period update +code can be executed after system resume back. + +Signed-off-by: Fancy Fang +Signed-off-by: Clark Wang +Acked-by: Uwe Kleine-König +Fixes: 738a1cfec2ed ("pwm: Add i.MX TPM PWM driver support") +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-imx-tpm.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/pwm/pwm-imx-tpm.c b/drivers/pwm/pwm-imx-tpm.c +index 5e2b452ee5f2e..98ab65c896850 100644 +--- a/drivers/pwm/pwm-imx-tpm.c ++++ b/drivers/pwm/pwm-imx-tpm.c +@@ -397,6 +397,13 @@ static int __maybe_unused pwm_imx_tpm_suspend(struct device *dev) + if (tpm->enable_count > 0) + return -EBUSY; + ++ /* ++ * Force 'real_period' to be zero to force period update code ++ * can be executed after system resume back, since suspend causes ++ * the period related registers to become their reset values. ++ */ ++ tpm->real_period = 0; ++ + clk_disable_unprepare(tpm->clk); + + return 0; +-- +2.39.2 + diff --git a/queue-6.4/pwm-mtk_disp-fix-the-disable-flow-of-disp_pwm.patch b/queue-6.4/pwm-mtk_disp-fix-the-disable-flow-of-disp_pwm.patch new file mode 100644 index 00000000000..60f4c5de097 --- /dev/null +++ b/queue-6.4/pwm-mtk_disp-fix-the-disable-flow-of-disp_pwm.patch @@ -0,0 +1,57 @@ +From 7d1c29f7914ec7b12974cd4d73a2c032c7d5b301 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 May 2023 11:10:01 +0800 +Subject: pwm: mtk_disp: Fix the disable flow of disp_pwm +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Shuijing Li + +[ Upstream commit bc13d60e4e1e945b34769a4a4c2b172e8552abe5 ] + +There is a flow error in the original mtk_disp_pwm_apply() function. +If this function is called when the clock is disabled, there will be a +chance to operate the disp_pwm register, resulting in disp_pwm exception. +Fix this accordingly. + +Fixes: 888a623db5d0 ("pwm: mtk-disp: Implement atomic API .apply()") +Signed-off-by: Shuijing Li +Reviewed-by: Matthias Brugger +Tested-by: Fei Shao +Acked-by: Uwe Kleine-König +Reviewed-by: Alexandre Mergnat +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-mtk-disp.c | 13 +++++-------- + 1 file changed, 5 insertions(+), 8 deletions(-) + +diff --git a/drivers/pwm/pwm-mtk-disp.c b/drivers/pwm/pwm-mtk-disp.c +index 79e321e96f56a..2401b67332417 100644 +--- a/drivers/pwm/pwm-mtk-disp.c ++++ b/drivers/pwm/pwm-mtk-disp.c +@@ -79,14 +79,11 @@ static int mtk_disp_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm, + if (state->polarity != PWM_POLARITY_NORMAL) + return -EINVAL; + +- if (!state->enabled) { +- mtk_disp_pwm_update_bits(mdp, DISP_PWM_EN, mdp->data->enable_mask, +- 0x0); +- +- if (mdp->enabled) { +- clk_disable_unprepare(mdp->clk_mm); +- clk_disable_unprepare(mdp->clk_main); +- } ++ if (!state->enabled && mdp->enabled) { ++ mtk_disp_pwm_update_bits(mdp, DISP_PWM_EN, ++ mdp->data->enable_mask, 0x0); ++ clk_disable_unprepare(mdp->clk_mm); ++ clk_disable_unprepare(mdp->clk_main); + + mdp->enabled = false; + return 0; +-- +2.39.2 + diff --git a/queue-6.4/pwm-sysfs-do-not-apply-state-to-already-disabled-pwm.patch b/queue-6.4/pwm-sysfs-do-not-apply-state-to-already-disabled-pwm.patch new file mode 100644 index 00000000000..7f788860e97 --- /dev/null +++ b/queue-6.4/pwm-sysfs-do-not-apply-state-to-already-disabled-pwm.patch @@ -0,0 +1,90 @@ +From 23d0cf6768979bcfa8c550a8ff72e26fcc556236 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 May 2023 18:47:36 +0200 +Subject: pwm: sysfs: Do not apply state to already disabled PWMs +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Marek Vasut + +[ Upstream commit 38ba83598633373f47951384cfc389181c8d1bed ] + +If the PWM is exported but not enabled, do not call pwm_class_apply_state(). +First of all, in this case, period may still be unconfigured and this would +make pwm_class_apply_state() return -EINVAL, and then suspend would fail. +Second, it makes little sense to apply state onto PWM that is not enabled +before suspend. + +Failing case: +" +$ echo 1 > /sys/class/pwm/pwmchip4/export +$ echo mem > /sys/power/state +... +pwm pwmchip4: PM: dpm_run_callback(): pwm_class_suspend+0x1/0xa8 returns -22 +pwm pwmchip4: PM: failed to suspend: error -22 +PM: Some devices failed to suspend, or early wake event detected +" + +Working case: +" +$ echo 1 > /sys/class/pwm/pwmchip4/export +$ echo 100 > /sys/class/pwm/pwmchip4/pwm1/period +$ echo 10 > /sys/class/pwm/pwmchip4/pwm1/duty_cycle +$ echo mem > /sys/power/state +... +" + +Do not call pwm_class_apply_state() in case the PWM is disabled +to fix this issue. + +Fixes: 7fd4edc57bbae ("pwm: sysfs: Add suspend/resume support") +Signed-off-by: Marek Vasut +Fixes: ef2bf4997f7d ("pwm: Improve args checking in pwm_apply_state()") +Reviewed-by: Brian Norris +Reviewed-by: Uwe Kleine-König +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + drivers/pwm/sysfs.c | 17 +++++++++++++++++ + 1 file changed, 17 insertions(+) + +diff --git a/drivers/pwm/sysfs.c b/drivers/pwm/sysfs.c +index 1a106ec329392..8d1254761e4dd 100644 +--- a/drivers/pwm/sysfs.c ++++ b/drivers/pwm/sysfs.c +@@ -424,6 +424,13 @@ static int pwm_class_resume_npwm(struct device *parent, unsigned int npwm) + if (!export) + continue; + ++ /* If pwmchip was not enabled before suspend, do nothing. */ ++ if (!export->suspend.enabled) { ++ /* release lock taken in pwm_class_get_state */ ++ mutex_unlock(&export->lock); ++ continue; ++ } ++ + state.enabled = export->suspend.enabled; + ret = pwm_class_apply_state(export, pwm, &state); + if (ret < 0) +@@ -448,7 +455,17 @@ static int pwm_class_suspend(struct device *parent) + if (!export) + continue; + ++ /* ++ * If pwmchip was not enabled before suspend, save ++ * state for resume time and do nothing else. ++ */ + export->suspend = state; ++ if (!state.enabled) { ++ /* release lock taken in pwm_class_get_state */ ++ mutex_unlock(&export->lock); ++ continue; ++ } ++ + state.enabled = false; + ret = pwm_class_apply_state(export, pwm, &state); + if (ret < 0) { +-- +2.39.2 + diff --git a/queue-6.4/revert-usb-common-usb-conn-gpio-set-last-role-to-unk.patch b/queue-6.4/revert-usb-common-usb-conn-gpio-set-last-role-to-unk.patch new file mode 100644 index 00000000000..01863953a20 --- /dev/null +++ b/queue-6.4/revert-usb-common-usb-conn-gpio-set-last-role-to-unk.patch @@ -0,0 +1,98 @@ +From e66778240eec2164bfc761f608a096f190670635 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Jun 2023 11:30:35 +0200 +Subject: Revert "usb: common: usb-conn-gpio: Set last role to unknown before + initial detection" + +From: Greg Kroah-Hartman + +[ Upstream commit df49f2a0ac4a34c0cb4b5c233fcfa0add644c43c ] + +This reverts commit edd60d24bd858cef165274e4cd6cab43bdc58d15. + +Heikki reports that this should not be a global flag just to work around +one broken driver and should be fixed differently, so revert it. + +Reported-by: Heikki Krogerus +Fixes: edd60d24bd85 ("usb: common: usb-conn-gpio: Set last role to unknown before initial detection") +Link: https://lore.kernel.org/r/ZImE4L3YgABnCIsP@kuha.fi.intel.com +Cc: Prashanth K +Cc: AngeloGioacchino Del Regno +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/cdns3/core.c | 2 -- + drivers/usb/common/usb-conn-gpio.c | 3 --- + drivers/usb/musb/jz4740.c | 2 -- + drivers/usb/roles/intel-xhci-usb-role-switch.c | 2 -- + include/linux/usb/role.h | 1 - + 5 files changed, 10 deletions(-) + +diff --git a/drivers/usb/cdns3/core.c b/drivers/usb/cdns3/core.c +index 69d2921f2d3b5..dbcdf3b24b477 100644 +--- a/drivers/usb/cdns3/core.c ++++ b/drivers/usb/cdns3/core.c +@@ -252,8 +252,6 @@ static enum usb_role cdns_hw_role_state_machine(struct cdns *cdns) + if (!vbus) + role = USB_ROLE_NONE; + break; +- default: +- break; + } + + dev_dbg(cdns->dev, "role %d -> %d\n", cdns->role, role); +diff --git a/drivers/usb/common/usb-conn-gpio.c b/drivers/usb/common/usb-conn-gpio.c +index 30bdb81934bc8..e20874caba363 100644 +--- a/drivers/usb/common/usb-conn-gpio.c ++++ b/drivers/usb/common/usb-conn-gpio.c +@@ -257,9 +257,6 @@ static int usb_conn_probe(struct platform_device *pdev) + platform_set_drvdata(pdev, info); + device_set_wakeup_capable(&pdev->dev, true); + +- /* Set last role to unknown before performing the initial detection */ +- info->last_role = USB_ROLE_UNKNOWN; +- + /* Perform initial detection */ + usb_conn_queue_dwork(info, 0); + +diff --git a/drivers/usb/musb/jz4740.c b/drivers/usb/musb/jz4740.c +index 6d880c4cce36e..5aabdd7e2511d 100644 +--- a/drivers/usb/musb/jz4740.c ++++ b/drivers/usb/musb/jz4740.c +@@ -95,8 +95,6 @@ static int jz4740_musb_role_switch_set(struct usb_role_switch *sw, + case USB_ROLE_HOST: + atomic_notifier_call_chain(&phy->notifier, USB_EVENT_ID, phy); + break; +- default: +- break; + } + + return 0; +diff --git a/drivers/usb/roles/intel-xhci-usb-role-switch.c b/drivers/usb/roles/intel-xhci-usb-role-switch.c +index 4d6a3dd06e011..5c96e929acea0 100644 +--- a/drivers/usb/roles/intel-xhci-usb-role-switch.c ++++ b/drivers/usb/roles/intel-xhci-usb-role-switch.c +@@ -97,8 +97,6 @@ static int intel_xhci_usb_set_role(struct usb_role_switch *sw, + val |= SW_VBUS_VALID; + drd_config = DRD_CONFIG_STATIC_DEVICE; + break; +- default: +- break; + } + val |= SW_IDPIN_EN; + if (data->enable_sw_switch) { +diff --git a/include/linux/usb/role.h b/include/linux/usb/role.h +index 65e790a28913e..b5deafd91f67b 100644 +--- a/include/linux/usb/role.h ++++ b/include/linux/usb/role.h +@@ -11,7 +11,6 @@ enum usb_role { + USB_ROLE_NONE, + USB_ROLE_HOST, + USB_ROLE_DEVICE, +- USB_ROLE_UNKNOWN, + }; + + typedef int (*usb_role_switch_set_t)(struct usb_role_switch *sw, +-- +2.39.2 + diff --git a/queue-6.4/risc-v-fix-order-of-ipi-enablement-vs-rcu-startup.patch b/queue-6.4/risc-v-fix-order-of-ipi-enablement-vs-rcu-startup.patch new file mode 100644 index 00000000000..c79c7ebc8cf --- /dev/null +++ b/queue-6.4/risc-v-fix-order-of-ipi-enablement-vs-rcu-startup.patch @@ -0,0 +1,54 @@ +From 80241db3373d54810e7bbacc7aea9394850312cc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Jul 2023 19:31:26 +0100 +Subject: risc-v: Fix order of IPI enablement vs RCU startup + +From: Marc Zyngier + +[ Upstream commit 6259f3443c6a376aa077816ac92e9ddeb0817d09 ] + +Conor reports that risc-v tries to enable IPIs before telling the +core code to enable RCU. With the introduction of the mapple tree +as a backing store for the irq descriptors, this results in +a very shouty boot sequence, as RCU is legitimately upset. + +Restore some sanity by moving the risc_ipi_enable() call after +notify_cpu_starting(), which explicitly enables RCU on the calling +CPU. + +Fixes: 832f15f42646 ("RISC-V: Treat IPIs as normal Linux IRQs") +Reported-by: Conor Dooley +Signed-off-by: Marc Zyngier +Link: https://lore.kernel.org/r/20230703-dupe-frying-79ae2ccf94eb@spud +Cc: Anup Patel +Cc: Palmer Dabbelt +Cc: Linus Torvalds +Tested-by: Conor Dooley +Link: https://lore.kernel.org/r/20230703183126.1567625-1-maz@kernel.org +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + arch/riscv/kernel/smpboot.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/arch/riscv/kernel/smpboot.c b/arch/riscv/kernel/smpboot.c +index 445a4efee267d..6765f1ce79625 100644 +--- a/arch/riscv/kernel/smpboot.c ++++ b/arch/riscv/kernel/smpboot.c +@@ -161,10 +161,11 @@ asmlinkage __visible void smp_callin(void) + mmgrab(mm); + current->active_mm = mm; + +- riscv_ipi_enable(); +- + store_cpu_topology(curr_cpuid); + notify_cpu_starting(curr_cpuid); ++ ++ riscv_ipi_enable(); ++ + numa_add_cpu(curr_cpuid); + set_cpu_online(curr_cpuid, 1); + probe_vendor_features(curr_cpuid); +-- +2.39.2 + diff --git a/queue-6.4/riscv-move-memblock_allow_resize-after-linear-mappin.patch b/queue-6.4/riscv-move-memblock_allow_resize-after-linear-mappin.patch new file mode 100644 index 00000000000..05683911c13 --- /dev/null +++ b/queue-6.4/riscv-move-memblock_allow_resize-after-linear-mappin.patch @@ -0,0 +1,109 @@ +From be5e13a01655d9dc0dfe33245847628631fec91c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Jun 2023 21:19:07 +0800 +Subject: riscv: move memblock_allow_resize() after linear mapping is ready + +From: Woody Zhang + +[ Upstream commit 85fadc0d04119c2fe4a20287767ab904c6d21ba1 ] + +The initial memblock metadata is accessed from kernel image mapping. The +regions arrays need to "reallocated" from memblock and accessed through +linear mapping to cover more memblock regions. So the resizing should +not be allowed until linear mapping is ready. Note that there are +memblock allocations when building linear mapping. + +This patch is similar to 24cc61d8cb5a ("arm64: memblock: don't permit +memblock resizing until linear mapping is up"). + +In following log, many memblock regions are reserved before +create_linear_mapping_page_table(). And then it triggered reallocation +of memblock.reserved.regions and memcpy the old array in kernel image +mapping to the new array in linear mapping which caused a page fault. + +[ 0.000000] memblock_reserve: [0x00000000bf01f000-0x00000000bf01ffff] early_init_fdt_scan_reserved_mem+0x28c/0x2c6 +[ 0.000000] memblock_reserve: [0x00000000bf021000-0x00000000bf021fff] early_init_fdt_scan_reserved_mem+0x28c/0x2c6 +[ 0.000000] memblock_reserve: [0x00000000bf023000-0x00000000bf023fff] early_init_fdt_scan_reserved_mem+0x28c/0x2c6 +[ 0.000000] memblock_reserve: [0x00000000bf025000-0x00000000bf025fff] early_init_fdt_scan_reserved_mem+0x28c/0x2c6 +[ 0.000000] memblock_reserve: [0x00000000bf027000-0x00000000bf027fff] early_init_fdt_scan_reserved_mem+0x28c/0x2c6 +[ 0.000000] memblock_reserve: [0x00000000bf029000-0x00000000bf029fff] early_init_fdt_scan_reserved_mem+0x28c/0x2c6 +[ 0.000000] memblock_reserve: [0x00000000bf02b000-0x00000000bf02bfff] early_init_fdt_scan_reserved_mem+0x28c/0x2c6 +[ 0.000000] memblock_reserve: [0x00000000bf02d000-0x00000000bf02dfff] early_init_fdt_scan_reserved_mem+0x28c/0x2c6 +[ 0.000000] memblock_reserve: [0x00000000bf02f000-0x00000000bf02ffff] early_init_fdt_scan_reserved_mem+0x28c/0x2c6 +[ 0.000000] memblock_reserve: [0x00000000bf030000-0x00000000bf030fff] early_init_fdt_scan_reserved_mem+0x28c/0x2c6 +[ 0.000000] OF: reserved mem: 0x0000000080000000..0x000000008007ffff (512 KiB) map non-reusable mmode_resv0@80000000 +[ 0.000000] memblock_reserve: [0x00000000bf000000-0x00000000bf001fed] paging_init+0x19a/0x5ae +[ 0.000000] memblock_phys_alloc_range: 4096 bytes align=0x1000 from=0x0000000000000000 max_addr=0x0000000000000000 alloc_pmd_fixmap+0x14/0x1c +[ 0.000000] memblock_reserve: [0x000000017ffff000-0x000000017fffffff] memblock_alloc_range_nid+0xb8/0x128 +[ 0.000000] memblock: reserved is doubled to 256 at [0x000000017fffd000-0x000000017fffe7ff] +[ 0.000000] Unable to handle kernel paging request at virtual address ff600000ffffd000 +[ 0.000000] Oops [#1] +[ 0.000000] Modules linked in: +[ 0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 6.4.0-rc1-00011-g99a670b2069c #66 +[ 0.000000] Hardware name: riscv-virtio,qemu (DT) +[ 0.000000] epc : __memcpy+0x60/0xf8 +[ 0.000000] ra : memblock_double_array+0x192/0x248 +[ 0.000000] epc : ffffffff8081d214 ra : ffffffff80a3dfc0 sp : ffffffff81403bd0 +[ 0.000000] gp : ffffffff814fbb38 tp : ffffffff8140dac0 t0 : 0000000001600000 +[ 0.000000] t1 : 0000000000000000 t2 : 000000008f001000 s0 : ffffffff81403c60 +[ 0.000000] s1 : ffffffff80c0bc98 a0 : ff600000ffffd000 a1 : ffffffff80c0bcd8 +[ 0.000000] a2 : 0000000000000c00 a3 : ffffffff80c0c8d8 a4 : 0000000080000000 +[ 0.000000] a5 : 0000000000080000 a6 : 0000000000000000 a7 : 0000000080200000 +[ 0.000000] s2 : ff600000ffffd000 s3 : 0000000000002000 s4 : 0000000000000c00 +[ 0.000000] s5 : ffffffff80c0bc60 s6 : ffffffff80c0bcc8 s7 : 0000000000000000 +[ 0.000000] s8 : ffffffff814fd0a8 s9 : 000000017fffe7ff s10: 0000000000000000 +[ 0.000000] s11: 0000000000001000 t3 : 0000000000001000 t4 : 0000000000000000 +[ 0.000000] t5 : 000000008f003000 t6 : ff600000ffffd000 +[ 0.000000] status: 0000000200000100 badaddr: ff600000ffffd000 cause: 000000000000000f +[ 0.000000] [] __memcpy+0x60/0xf8 +[ 0.000000] [] memblock_add_range.isra.14+0x12c/0x162 +[ 0.000000] [] memblock_reserve+0x6e/0x8c +[ 0.000000] [] memblock_alloc_range_nid+0xb8/0x128 +[ 0.000000] [] memblock_phys_alloc_range+0x5e/0x6a +[ 0.000000] [] alloc_pmd_fixmap+0x14/0x1c +[ 0.000000] [] alloc_p4d_fixmap+0xc/0x14 +[ 0.000000] [] create_pgd_mapping+0x98/0x17c +[ 0.000000] [] create_linear_mapping_range.constprop.10+0xe4/0x112 +[ 0.000000] [] paging_init+0x3ec/0x5ae +[ 0.000000] [] setup_arch+0xb2/0x576 +[ 0.000000] [] start_kernel+0x72/0x57e +[ 0.000000] Code: b303 0285 b383 0305 be03 0385 be83 0405 bf03 0485 (b023) 00ef +[ 0.000000] ---[ end trace 0000000000000000 ]--- +[ 0.000000] Kernel panic - not syncing: Attempted to kill the idle task! +[ 0.000000] ---[ end Kernel panic - not syncing: Attempted to kill the idle task! ]--- + +Fixes: 671f9a3e2e24 ("RISC-V: Setup initial page tables in two stages") +Signed-off-by: Woody Zhang +Tested-by: Song Shuai +Link: https://lore.kernel.org/r/tencent_FBB94CE615C5CCE7701CD39C15CCE0EE9706@qq.com +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + arch/riscv/mm/init.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/arch/riscv/mm/init.c b/arch/riscv/mm/init.c +index 4fa420faa7808..1306149aad57a 100644 +--- a/arch/riscv/mm/init.c ++++ b/arch/riscv/mm/init.c +@@ -267,7 +267,6 @@ static void __init setup_bootmem(void) + dma_contiguous_reserve(dma32_phys_limit); + if (IS_ENABLED(CONFIG_64BIT)) + hugetlb_cma_reserve(PUD_SHIFT - PAGE_SHIFT); +- memblock_allow_resize(); + } + + #ifdef CONFIG_MMU +@@ -1370,6 +1369,9 @@ void __init paging_init(void) + { + setup_bootmem(); + setup_vm_final(); ++ ++ /* Depend on that Linear Mapping is ready */ ++ memblock_allow_resize(); + } + + void __init misc_mem_init(void) +-- +2.39.2 + diff --git a/queue-6.4/rtc-st-lpc-release-some-resources-in-st_rtc_probe-in.patch b/queue-6.4/rtc-st-lpc-release-some-resources-in-st_rtc_probe-in.patch new file mode 100644 index 00000000000..19cfda20468 --- /dev/null +++ b/queue-6.4/rtc-st-lpc-release-some-resources-in-st_rtc_probe-in.patch @@ -0,0 +1,40 @@ +From 7c3ef88f9f6ef7b14dd0607be0623712fc4ad683 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Jun 2023 21:11:42 +0200 +Subject: rtc: st-lpc: Release some resources in st_rtc_probe() in case of + error + +From: Christophe JAILLET + +[ Upstream commit 06c6e1b01d9261f03629cefd1f3553503291e6cf ] + +If an error occurs after clk_get(), the corresponding resources should be +released. + +Use devm_clk_get() to fix it. + +Fixes: b5b2bdfc2893 ("rtc: st: Add new driver for ST's LPC RTC") +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/866af6adbc7454a7b4505eb6c28fbdc86ccff39e.1686251455.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-st-lpc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/rtc/rtc-st-lpc.c b/drivers/rtc/rtc-st-lpc.c +index 0f8e4231098ef..d04d46f9cc65a 100644 +--- a/drivers/rtc/rtc-st-lpc.c ++++ b/drivers/rtc/rtc-st-lpc.c +@@ -228,7 +228,7 @@ static int st_rtc_probe(struct platform_device *pdev) + enable_irq_wake(rtc->irq); + disable_irq(rtc->irq); + +- rtc->clk = clk_get(&pdev->dev, NULL); ++ rtc->clk = devm_clk_get(&pdev->dev, NULL); + if (IS_ERR(rtc->clk)) { + dev_err(&pdev->dev, "Unable to request clock\n"); + return PTR_ERR(rtc->clk); +-- +2.39.2 + diff --git a/queue-6.4/rtla-hwnoise-reduce-runtime-to-75.patch b/queue-6.4/rtla-hwnoise-reduce-runtime-to-75.patch new file mode 100644 index 00000000000..a1dd6e69ad4 --- /dev/null +++ b/queue-6.4/rtla-hwnoise-reduce-runtime-to-75.patch @@ -0,0 +1,52 @@ +From dd9ea04419dd9d3dedf0b5630efd45dd59231de1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Jun 2023 18:12:22 +0200 +Subject: rtla/hwnoise: Reduce runtime to 75% + +From: Daniel Bristot de Oliveira + +[ Upstream commit 7bc4d3089a50050d4df0af63423a5d907c3bdb1a ] + +osnoise runs 100% of time by default. It makes sense because osnoise +is preemptive. hwnoise checks preemption once a second, so it +reduces system progress. + +Reduce runtime to 75% to avoid problems by default. I added a Fixes +as it might avoid problems for first time users as it lands on distros. + +Link: https://lkml.kernel.org/r/af0b7113ffc00031b9af4bb40ef5889a27dadf8c.1686066600.git.bristot@kernel.org + +Cc: William White +Cc: Jonathan Corbet +Tested-by: Juri Lelli +Fixes: 1f428356c38d ("rtla: Add hwnoise tool") +Signed-off-by: Daniel Bristot de Oliveira +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +--- + tools/tracing/rtla/src/osnoise_top.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/tools/tracing/rtla/src/osnoise_top.c b/tools/tracing/rtla/src/osnoise_top.c +index 562f2e4b18c57..3ece8c09ecd95 100644 +--- a/tools/tracing/rtla/src/osnoise_top.c ++++ b/tools/tracing/rtla/src/osnoise_top.c +@@ -340,8 +340,14 @@ struct osnoise_top_params *osnoise_top_parse_args(int argc, char **argv) + if (!params) + exit(1); + +- if (strcmp(argv[0], "hwnoise") == 0) ++ if (strcmp(argv[0], "hwnoise") == 0) { + params->mode = MODE_HWNOISE; ++ /* ++ * Reduce CPU usage for 75% to avoid killing the system. ++ */ ++ params->runtime = 750000; ++ params->period = 1000000; ++ } + + while (1) { + static struct option long_options[] = { +-- +2.39.2 + diff --git a/queue-6.4/s390-qeth-fix-vipa-deletion.patch b/queue-6.4/s390-qeth-fix-vipa-deletion.patch new file mode 100644 index 00000000000..7a81c55aae5 --- /dev/null +++ b/queue-6.4/s390-qeth-fix-vipa-deletion.patch @@ -0,0 +1,42 @@ +From 063fa6586b32df07713594c112c99b2c17f8c624 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Jul 2023 16:41:21 +0200 +Subject: s390/qeth: Fix vipa deletion + +From: Thorsten Winkler + +[ Upstream commit 80de809bd35e2a8999edf9f5aaa2d8de18921f11 ] + +Change boolean parameter of function "qeth_l3_vipa_store" inside the +"qeth_l3_dev_vipa_del4_store" function from "true" to "false" because +"true" is used for adding a virtual ip address and "false" for deleting. + +Fixes: 2390166a6b45 ("s390/qeth: clean up L3 sysfs code") + +Reviewed-by: Alexandra Winter +Reviewed-by: Wenjia Zhang +Signed-off-by: Thorsten Winkler +Signed-off-by: Alexandra Winter +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/s390/net/qeth_l3_sys.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/s390/net/qeth_l3_sys.c b/drivers/s390/net/qeth_l3_sys.c +index 9f90a860ca2c9..a6b64228ead25 100644 +--- a/drivers/s390/net/qeth_l3_sys.c ++++ b/drivers/s390/net/qeth_l3_sys.c +@@ -625,7 +625,7 @@ static QETH_DEVICE_ATTR(vipa_add4, add4, 0644, + static ssize_t qeth_l3_dev_vipa_del4_store(struct device *dev, + struct device_attribute *attr, const char *buf, size_t count) + { +- return qeth_l3_vipa_store(dev, buf, true, count, QETH_PROT_IPV4); ++ return qeth_l3_vipa_store(dev, buf, false, count, QETH_PROT_IPV4); + } + + static QETH_DEVICE_ATTR(vipa_del4, del4, 0200, NULL, +-- +2.39.2 + diff --git a/queue-6.4/sctp-fix-potential-deadlock-on-net-sctp.addr_wq_lock.patch b/queue-6.4/sctp-fix-potential-deadlock-on-net-sctp.addr_wq_lock.patch new file mode 100644 index 00000000000..0afdebef197 --- /dev/null +++ b/queue-6.4/sctp-fix-potential-deadlock-on-net-sctp.addr_wq_lock.patch @@ -0,0 +1,57 @@ +From 37fbe7f54cc71ead2ee33480df258fa8a27ad486 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Jun 2023 12:03:40 +0000 +Subject: sctp: fix potential deadlock on &net->sctp.addr_wq_lock + +From: Chengfeng Ye + +[ Upstream commit 6feb37b3b06e9049e20dcf7e23998f92c9c5be9a ] + +As &net->sctp.addr_wq_lock is also acquired by the timer +sctp_addr_wq_timeout_handler() in protocal.c, the same lock acquisition +at sctp_auto_asconf_init() seems should disable irq since it is called +from sctp_accept() under process context. + +Possible deadlock scenario: +sctp_accept() + -> sctp_sock_migrate() + -> sctp_auto_asconf_init() + -> spin_lock(&net->sctp.addr_wq_lock) + + -> sctp_addr_wq_timeout_handler() + -> spin_lock_bh(&net->sctp.addr_wq_lock); (deadlock here) + +This flaw was found using an experimental static analysis tool we are +developing for irq-related deadlock. + +The tentative patch fix the potential deadlock by spin_lock_bh(). + +Signed-off-by: Chengfeng Ye +Fixes: 34e5b0118685 ("sctp: delay auto_asconf init until binding the first addr") +Acked-by: Xin Long +Link: https://lore.kernel.org/r/20230627120340.19432-1-dg573847474@gmail.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/sctp/socket.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/sctp/socket.c b/net/sctp/socket.c +index a68e1d541b128..ee15eff6364ee 100644 +--- a/net/sctp/socket.c ++++ b/net/sctp/socket.c +@@ -364,9 +364,9 @@ static void sctp_auto_asconf_init(struct sctp_sock *sp) + struct net *net = sock_net(&sp->inet.sk); + + if (net->sctp.default_auto_asconf) { +- spin_lock(&net->sctp.addr_wq_lock); ++ spin_lock_bh(&net->sctp.addr_wq_lock); + list_add_tail(&sp->auto_asconf_list, &net->sctp.auto_asconf_splist); +- spin_unlock(&net->sctp.addr_wq_lock); ++ spin_unlock_bh(&net->sctp.addr_wq_lock); + sp->do_auto_asconf = 1; + } + } +-- +2.39.2 + diff --git a/queue-6.4/serial-8250-lock-port-for-stop_rx-in-omap8250_irq.patch b/queue-6.4/serial-8250-lock-port-for-stop_rx-in-omap8250_irq.patch new file mode 100644 index 00000000000..f8e5c08672b --- /dev/null +++ b/queue-6.4/serial-8250-lock-port-for-stop_rx-in-omap8250_irq.patch @@ -0,0 +1,39 @@ +From 6fe7b79bb3922576e745975552da1e45b2ec1983 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 May 2023 11:37:54 +0206 +Subject: serial: 8250: lock port for stop_rx() in omap8250_irq() + +From: John Ogness + +[ Upstream commit ca73a892c5bec4b08a2fa22b3015e98ed905abb7 ] + +The uarts_ops stop_rx() callback expects that the port->lock is +taken and interrupts are disabled. + +Fixes: 1fe0e1fa3209 ("serial: 8250_omap: Handle optional overrun-throttle-ms property") +Signed-off-by: John Ogness +Reviewed-by: Tony Lindgren +Link: https://lore.kernel.org/r/20230525093159.223817-4-john.ogness@linutronix.de +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/8250/8250_omap.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c +index 05dc568bd3898..05704d8c56566 100644 +--- a/drivers/tty/serial/8250/8250_omap.c ++++ b/drivers/tty/serial/8250/8250_omap.c +@@ -651,7 +651,9 @@ static irqreturn_t omap8250_irq(int irq, void *dev_id) + + up->ier = port->serial_in(port, UART_IER); + if (up->ier & (UART_IER_RLSI | UART_IER_RDI)) { ++ spin_lock(&port->lock); + port->ops->stop_rx(port); ++ spin_unlock(&port->lock); + } else { + /* Keep restarting the timer until + * the input overrun subsides. +-- +2.39.2 + diff --git a/queue-6.4/serial-8250-lock-port-for-uart_ier-access-in-omap825.patch b/queue-6.4/serial-8250-lock-port-for-uart_ier-access-in-omap825.patch new file mode 100644 index 00000000000..15713993445 --- /dev/null +++ b/queue-6.4/serial-8250-lock-port-for-uart_ier-access-in-omap825.patch @@ -0,0 +1,57 @@ +From 46857fd9e163e0221fd1564da51babc00be227a2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 May 2023 11:37:58 +0206 +Subject: serial: 8250: lock port for UART_IER access in omap8250_irq() + +From: John Ogness + +[ Upstream commit 25614735a647693c1260f253dc3ab32127697806 ] + +omap8250_irq() accesses UART_IER. This register is modified twice +by each console write (serial8250_console_write()) under the port +lock. omap8250_irq() must also take the port lock to guanentee +synchronized access to UART_IER. + +Since the port lock is already being taken for the stop_rx() callback +and since it is safe to call cancel_delayed_work() while holding the +port lock, simply extend the port lock region to include UART_IER +access. + +Fixes: 1fe0e1fa3209 ("serial: 8250_omap: Handle optional overrun-throttle-ms property") +Signed-off-by: John Ogness +Reviewed-by: Tony Lindgren +Link: https://lore.kernel.org/r/20230525093159.223817-8-john.ogness@linutronix.de +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/8250/8250_omap.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c +index 05704d8c56566..0a90ddc0bdf66 100644 +--- a/drivers/tty/serial/8250/8250_omap.c ++++ b/drivers/tty/serial/8250/8250_omap.c +@@ -649,17 +649,18 @@ static irqreturn_t omap8250_irq(int irq, void *dev_id) + if ((lsr & UART_LSR_OE) && up->overrun_backoff_time_ms > 0) { + unsigned long delay; + ++ /* Synchronize UART_IER access against the console. */ ++ spin_lock(&port->lock); + up->ier = port->serial_in(port, UART_IER); + if (up->ier & (UART_IER_RLSI | UART_IER_RDI)) { +- spin_lock(&port->lock); + port->ops->stop_rx(port); +- spin_unlock(&port->lock); + } else { + /* Keep restarting the timer until + * the input overrun subsides. + */ + cancel_delayed_work(&up->overrun_backoff); + } ++ spin_unlock(&port->lock); + + delay = msecs_to_jiffies(up->overrun_backoff_time_ms); + schedule_delayed_work(&up->overrun_backoff, delay); +-- +2.39.2 + diff --git a/queue-6.4/serial-8250-omap-fix-freeing-of-resources-on-failed-.patch b/queue-6.4/serial-8250-omap-fix-freeing-of-resources-on-failed-.patch new file mode 100644 index 00000000000..28db5fd7fcc --- /dev/null +++ b/queue-6.4/serial-8250-omap-fix-freeing-of-resources-on-failed-.patch @@ -0,0 +1,42 @@ +From 7ebf7ae08debb85c532c05127810a86646721ca3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 May 2023 11:20:11 +0300 +Subject: serial: 8250: omap: Fix freeing of resources on failed register +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Tony Lindgren + +[ Upstream commit b9ab22c2bc8652324a803b3e2be69838920b4025 ] + +If serial8250_register_8250_port() fails, the SoC can hang as the +deferred PMQoS work will still run as is not flushed and removed. + +Fixes: 61929cf0169d ("tty: serial: Add 8250-core based omap driver") +Signed-off-by: Tony Lindgren +Reviewed-by: Ilpo Järvinen +Link: https://lore.kernel.org/r/20230508082014.23083-2-tony@atomide.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/8250/8250_omap.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c +index 734f092ef839a..05dc568bd3898 100644 +--- a/drivers/tty/serial/8250/8250_omap.c ++++ b/drivers/tty/serial/8250/8250_omap.c +@@ -1532,7 +1532,9 @@ static int omap8250_probe(struct platform_device *pdev) + err: + pm_runtime_dont_use_autosuspend(&pdev->dev); + pm_runtime_put_sync(&pdev->dev); ++ flush_work(&priv->qos_work); + pm_runtime_disable(&pdev->dev); ++ cpu_latency_qos_remove_request(&priv->pm_qos_request); + return ret; + } + +-- +2.39.2 + diff --git a/queue-6.4/serial-8250_omap-use-force_suspend-and-resume-for-sy.patch b/queue-6.4/serial-8250_omap-use-force_suspend-and-resume-for-sy.patch new file mode 100644 index 00000000000..ad1534453e3 --- /dev/null +++ b/queue-6.4/serial-8250_omap-use-force_suspend-and-resume-for-sy.patch @@ -0,0 +1,78 @@ +From 06e6f1ae22db9d1364acb4e7b65c6f4a6ecd7ab3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Jun 2023 07:59:19 +0300 +Subject: serial: 8250_omap: Use force_suspend and resume for system suspend + +From: Tony Lindgren + +[ Upstream commit 20a41a62618df85f3a2981008edec5cadd785e0a ] + +We should not rely on autosuspend timeout for system suspend. Instead, +let's use force_suspend and force_resume functions. Otherwise the serial +port controller device may not be idled on suspend. + +As we are doing a register write on suspend to configure the serial port, +we still need to runtime PM resume the port on suspend. + +While at it, let's switch to pm_runtime_resume_and_get() and check for +errors returned. And let's add the missing line break before return to the +suspend function while at it. + +Fixes: 09d8b2bdbc5c ("serial: 8250: omap: Provide ability to enable/disable UART as wakeup source") +Signed-off-by: Tony Lindgren +Tested-by: Dhruva Gole +Message-ID: <20230614045922.4798-1-tony@atomide.com> +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/8250/8250_omap.c | 20 +++++++++++++++----- + 1 file changed, 15 insertions(+), 5 deletions(-) + +diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c +index 0a90ddc0bdf66..b758e9b613c74 100644 +--- a/drivers/tty/serial/8250/8250_omap.c ++++ b/drivers/tty/serial/8250/8250_omap.c +@@ -1584,25 +1584,35 @@ static int omap8250_suspend(struct device *dev) + { + struct omap8250_priv *priv = dev_get_drvdata(dev); + struct uart_8250_port *up = serial8250_get_port(priv->line); ++ int err; + + serial8250_suspend_port(priv->line); + +- pm_runtime_get_sync(dev); ++ err = pm_runtime_resume_and_get(dev); ++ if (err) ++ return err; + if (!device_may_wakeup(dev)) + priv->wer = 0; + serial_out(up, UART_OMAP_WER, priv->wer); +- pm_runtime_mark_last_busy(dev); +- pm_runtime_put_autosuspend(dev); +- ++ err = pm_runtime_force_suspend(dev); + flush_work(&priv->qos_work); +- return 0; ++ ++ return err; + } + + static int omap8250_resume(struct device *dev) + { + struct omap8250_priv *priv = dev_get_drvdata(dev); ++ int err; + ++ err = pm_runtime_force_resume(dev); ++ if (err) ++ return err; + serial8250_resume_port(priv->line); ++ /* Paired with pm_runtime_resume_and_get() in omap8250_suspend() */ ++ pm_runtime_mark_last_busy(dev); ++ pm_runtime_put_autosuspend(dev); ++ + return 0; + } + #else +-- +2.39.2 + diff --git a/queue-6.4/serial-core-lock-port-for-start_rx-in-uart_resume_po.patch b/queue-6.4/serial-core-lock-port-for-start_rx-in-uart_resume_po.patch new file mode 100644 index 00000000000..39a60fa5987 --- /dev/null +++ b/queue-6.4/serial-core-lock-port-for-start_rx-in-uart_resume_po.patch @@ -0,0 +1,44 @@ +From 6878c1c4d8c4c77f9c897bf5b2798d75906226b7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 May 2023 11:37:55 +0206 +Subject: serial: core: lock port for start_rx() in uart_resume_port() + +From: John Ogness + +[ Upstream commit 51e45fba14bf08b66bca764a083c7f2e2ff62f01 ] + +The only user of the start_rx() callback (qcom_geni) directly calls +its own stop_rx() callback. Since stop_rx() requires that the +port->lock is taken and interrupts are disabled, the start_rx() +callback has the same requirement. + +Fixes: cfab87c2c271 ("serial: core: Introduce callback for start_rx and do stop_rx in suspend only if this callback implementation is present.") +Signed-off-by: John Ogness +Reviewed-by: Douglas Anderson +Link: https://lore.kernel.org/r/20230525093159.223817-5-john.ogness@linutronix.de +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/serial_core.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c +index a664778492c46..ea4a70055ad9f 100644 +--- a/drivers/tty/serial/serial_core.c ++++ b/drivers/tty/serial/serial_core.c +@@ -2430,8 +2430,11 @@ int uart_resume_port(struct uart_driver *drv, struct uart_port *uport) + if (console_suspend_enabled) + uart_change_pm(state, UART_PM_STATE_ON); + uport->ops->set_termios(uport, &termios, NULL); +- if (!console_suspend_enabled && uport->ops->start_rx) ++ if (!console_suspend_enabled && uport->ops->start_rx) { ++ spin_lock_irq(&uport->lock); + uport->ops->start_rx(uport); ++ spin_unlock_irq(&uport->lock); ++ } + if (console_suspend_enabled) + console_start(uport->cons); + } +-- +2.39.2 + diff --git a/queue-6.4/serial-core-lock-port-for-stop_rx-in-uart_suspend_po.patch b/queue-6.4/serial-core-lock-port-for-stop_rx-in-uart_suspend_po.patch new file mode 100644 index 00000000000..91b984e5b56 --- /dev/null +++ b/queue-6.4/serial-core-lock-port-for-stop_rx-in-uart_suspend_po.patch @@ -0,0 +1,42 @@ +From ae9f07cff1a8d4e034673a77b8c3e3e5c5561739 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 May 2023 11:37:53 +0206 +Subject: serial: core: lock port for stop_rx() in uart_suspend_port() + +From: John Ogness + +[ Upstream commit abcb0cf1f5b2d99b1d117a4dbce334120e358d6d ] + +The uarts_ops stop_rx() callback expects that the port->lock is +taken and interrupts are disabled. + +Fixes: c9d2325cdb92 ("serial: core: Do stop_rx in suspend path for console if console_suspend is disabled") +Signed-off-by: John Ogness +Reviewed-by: Douglas Anderson +Link: https://lore.kernel.org/r/20230525093159.223817-3-john.ogness@linutronix.de +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/serial_core.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c +index 54e82f476a2cc..a664778492c46 100644 +--- a/drivers/tty/serial/serial_core.c ++++ b/drivers/tty/serial/serial_core.c +@@ -2333,8 +2333,11 @@ int uart_suspend_port(struct uart_driver *drv, struct uart_port *uport) + * able to Re-start_rx later. + */ + if (!console_suspend_enabled && uart_console(uport)) { +- if (uport->ops->start_rx) ++ if (uport->ops->start_rx) { ++ spin_lock_irq(&uport->lock); + uport->ops->stop_rx(uport); ++ spin_unlock_irq(&uport->lock); ++ } + goto unlock; + } + +-- +2.39.2 + diff --git a/queue-6.4/series b/queue-6.4/series index dd842639c21..1ff09660584 100644 --- a/queue-6.4/series +++ b/queue-6.4/series @@ -545,3 +545,174 @@ smb-client-fix-shared-dfs-root-mounts-with-different.patch ksmbd-avoid-field-overflow-warning.patch arm64-sme-use-str-p-to-clear-ffr-context-field-in-st.patch x86-efi-make-efi_set_virtual_address_map-ibt-safe.patch +w1-w1_therm-fix-locking-behavior-in-convert_t.patch +w1-fix-loop-in-w1_fini.patch +dt-bindings-power-reset-qcom-pon-only-allow-reboot-m.patch +f2fs-do-not-allow-to-defragment-files-have-fi_compre.patch +sh-j2-use-ioremap-to-translate-device-tree-address-i.patch +cpufreq-tegra194-fix-an-error-handling-path-in-tegra.patch +usb-extend-pci-resume-function-to-handle-pm-events.patch +xhci-improve-the-xhci-system-resume-time.patch +usb-dwc2-fix-some-error-handling-paths.patch +serial-8250-omap-fix-freeing-of-resources-on-failed-.patch +interconnect-qcom-rpm-rename-icc-provider-num_clocks.patch +interconnect-qcom-rpm-don-t-use-clk_get_optional-for.patch +clk-qcom-gcc-ipq5332-use-floor-ops-for-sdcc-clocks.patch +clk-qcom-mmcc-msm8974-remove-oxili_ocmemgx_clk.patch +clk-qcom-camcc-sc7180-add-parent-dependency-to-all-c.patch +clk-qcom-gcc-ipq6018-use-floor-ops-for-sdcc-clocks.patch +clk-qcom-gcc-qcm2290-mark-rcgs-shared-where-applicab.patch +media-usb-check-az6007_read-return-value.patch +media-amphion-drop-repeated-codec-data-for-vc1l-form.patch +media-amphion-drop-repeated-codec-data-for-vc1g-form.patch +media-common-saa7146-avoid-a-leak-in-vmalloc_to_sg.patch +media-videodev2.h-fix-p_s32-and-p_s64-pointer-types.patch +media-amphion-initiate-a-drain-of-the-capture-queue-.patch +media-videodev2.h-fix-struct-v4l2_input-tuner-index-.patch +media-usb-siano-fix-warning-due-to-null-work_func_t-.patch +media-i2c-imx296-fix-error-checking-in-imx296_read_t.patch +media-i2c-correct-format-propagation-for-st-mipid02.patch +media-renesas-fdp1-identify-r-car-gen2-versions.patch +media-hi846-fix-usage-of-pm_runtime_get_if_in_use.patch +media-mediatek-vcodec-using-decoder-status-instead-o.patch +clk-qcom-ipq6018-fix-networking-resets.patch +clk-qcom-dispcc-qcm2290-fix-bi_tcxo_ao-handling.patch +clk-qcom-dispcc-qcm2290-fix-gpll0_out_div-handling.patch +clk-qcom-ipq5332-fix-the-src-parameter-in-ftbl_gcc_a.patch +clk-qcom-ipq5332-fix-the-order-of-sleep_clk-and-xo-c.patch +clk-qcom-mmcc-msm8974-use-clk_rcg2_shared_ops-for-md.patch +staging-vchiq_arm-mark-vchiq_platform_init-static.patch +soundwire-qcom-use-consistently-ctrl-as-state-variab.patch +soundwire-qcom-fix-unbalanced-pm_runtime_put.patch +soundwire-debugfs-fix-unbalanced-pm_runtime_put.patch +usb-dwc3-qcom-fix-potential-memory-leak.patch +usb-gadget-u_serial-add-null-pointer-check-in-gseria.patch +extcon-fix-kernel-doc-of-property-fields-to-avoid-wa.patch +extcon-fix-kernel-doc-of-property-capability-fields-.patch +usb-phy-phy-tahvo-fix-memory-leak-in-tahvo_usb_probe.patch +usb-hide-unused-usbfs_notify_suspend-resume-function.patch +usb-misc-eud-fix-eud-sysfs-path-use-qcom_eud.patch +serial-core-lock-port-for-stop_rx-in-uart_suspend_po.patch +serial-8250-lock-port-for-stop_rx-in-omap8250_irq.patch +serial-core-lock-port-for-start_rx-in-uart_resume_po.patch +serial-8250-lock-port-for-uart_ier-access-in-omap825.patch +kernfs-fix-missing-kernfs_idr_lock-to-remove-an-id-f.patch +lkdtm-replace-ll_rw_block-with-submit_bh.patch +i3c-master-svc-fix-cpu-schedule-in-spin-lock.patch +coresight-fix-loss-of-connection-info-when-a-module-.patch +coresight-etm4x-fix-missing-trctraceidr-file-in-sysf.patch +power-supply-rt9467-make-charger-enable-control-as-l.patch +mfd-rt5033-drop-rt5033-battery-sub-device.patch +media-venus-helpers-fix-align-of-non-power-of-two.patch +media-atomisp-gc0310-fix-double-free-in-gc0310_remov.patch +media-atomisp-gmin_platform-fix-out_len-in-gmin_get_.patch +media-atomisp-ov2680-stop-using-half-pixelclock-for-.patch +sh-avoid-using-irq0-on-sh3-and-sh4.patch +gfs2-fix-duplicate-should_fault_in_pages-call.patch +f2fs-fix-potential-deadlock-due-to-unpaired-node_wri.patch +f2fs-fix-to-avoid-null-pointer-dereference-f2fs_writ.patch +f2fs-support-errors-remount-ro-continue-panic-mounto.patch +f2fs-fix-the-wrong-condition-to-determine-atomic-con.patch +f2fs-flush-error-flags-in-workqueue.patch +kvm-s390-fix-kvm_s390_get_cmma_bits-for-gfns-in-mems.patch +usb-dwc3-qcom-release-the-correct-resources-in-dwc3_.patch +usb-dwc3-qcom-fix-an-error-handling-path-in-dwc3_qco.patch +usb-common-usb-conn-gpio-set-last-role-to-unknown-be.patch +usb-dwc3-meson-g12a-fix-an-error-handling-path-in-dw.patch +rtla-hwnoise-reduce-runtime-to-75.patch +mfd-wcd934x-fix-an-error-handling-path-in-wcd934x_sl.patch +mfd-intel-lpss-add-missing-check-for-platform_get_re.patch +revert-usb-common-usb-conn-gpio-set-last-role-to-unk.patch +serial-8250_omap-use-force_suspend-and-resume-for-sy.patch +drivers-fwnode-fix-fwnode_irq_get-_byname.patch +cdx-fix-driver-managed-dma-support.patch +nvmem-sunplus-ocotp-release-otp-clk-before-return.patch +nvmem-imx-ocotp-reverse-mac-addresses-on-all-i.mx-de.patch +test_firmware-return-enomem-instead-of-enospc-on-fai.patch +nvmem-rmem-use-nvmem_devid_auto.patch +bus-fsl-mc-don-t-assume-child-devices-are-all-fsl-mc.patch +mfd-stmfx-fix-error-path-in-stmfx_chip_init.patch +mfd-stmfx-nullify-stmfx-vdd-in-case-of-error.patch +kvm-s390-vsie-fix-the-length-of-apcb-bitmap.patch +kvm-s390-diag-fix-racy-access-of-physical-cpu-number.patch +cpufreq-mediatek-correct-voltages-for-mt7622-and-mt7.patch +misc-fastrpc-check-return-value-of-devm_kasprintf.patch +clk-qcom-mmcc-msm8974-fix-mdss_gdsc-power-flags.patch +hwtracing-hisi_ptt-fix-potential-sleep-in-atomic-con.patch +phy-qcom-qmp-combo-fix-display-port-phy-configuratio.patch +mfd-stmpe-only-disable-the-regulators-if-they-are-en.patch +phy-tegra-xusb-check-return-value-of-devm_kzalloc.patch +lib-bitmap-drop-optimization-of-bitmap_-from-to-_arr.patch +pwm-imx-tpm-force-real_period-to-be-zero-in-suspend.patch +pwm-sysfs-do-not-apply-state-to-already-disabled-pwm.patch +pwm-ab8500-fix-error-code-in-probe.patch +pwm-mtk_disp-fix-the-disable-flow-of-disp_pwm.patch +md-raid10-fix-the-condition-to-call-bio_end_io_acct.patch +perf-bpf-move-the-declaration-of-struct-rq.patch +blk-throttle-fix-io-statistics-for-cgroup-v1.patch +rtc-st-lpc-release-some-resources-in-st_rtc_probe-in.patch +drm-i915-psr-use-hw.adjusted-mode-when-calculating-i.patch +drm-i915-guc-slpc-apply-min-softlimit-correctly.patch +f2fs-check-return-value-of-freeze_super.patch +virtio-vdpa-fix-unchecked-call-to-null-set_vq_affini.patch +tools-virtio-fix-build-break-for-aarch64.patch +media-tc358746-select-config_generic_phy.patch +media-cec-i2c-ch7322-also-select-regmap.patch +sctp-fix-potential-deadlock-on-net-sctp.addr_wq_lock.patch +net-sched-act_ipt-add-sanity-checks-on-table-name-an.patch +net-sched-act_ipt-add-sanity-checks-on-skb-before-ca.patch +net-sched-act_ipt-zero-skb-cb-before-calling-target.patch +spi-spi-geni-qcom-enable-spi_controller_must_tx-for-.patch +net-mscc-ocelot-don-t-report-that-rx-timestamping-is.patch +net-mscc-ocelot-don-t-keep-ptp-configuration-of-all-.patch +net-dsa-felix-don-t-drop-ptp-frames-with-tag_8021q-w.patch +net-dsa-sja1105-always-enable-the-incl_srcpt-option.patch +net-dsa-tag_sja1105-always-prefer-source-port-inform.patch +add-module_firmware-for-firmware_tg357766.patch +bluetooth-fix-invalid-bdaddr-quirk-for-non-persisten.patch +bluetooth-fix-use-bdaddr-property-quirk.patch +bluetooth-hci_bcm-do-not-mark-valid-bd_addr-as-inval.patch +bluetooth-iso-use-hci_sync-for-setting-cig-parameter.patch +bluetooth-mgmt-fix-marking-scan_rsp-as-not-connectab.patch +sfc-support-for-devlink-port-requires-mae-access.patch +ibmvnic-do-not-reset-dql-stats-on-non_fatal-err.patch +net-dsa-vsc73xx-fix-mtu-configuration.patch +mlxsw-minimal-fix-potential-memory-leak-in-mlxsw_m_l.patch +spi-bcm-qspi-return-error-if-neither-hif_mspi-nor-ms.patch +drm-amdgpu-fix-number-of-fence-calculations.patch +drm-amd-don-t-try-to-enable-secure-display-ta-multip.patch +mailbox-ti-msgmgr-fill-non-message-tx-data-fields-wi.patch +f2fs-fix-error-path-handling-in-truncate_dnode.patch +octeontx2-af-cn10kb-fix-interrupt-csr-addresses.patch +octeontx2-af-fix-mapping-for-nix-block-from-cgx-conn.patch +octeontx2-af-add-validation-before-accessing-cgx-and.patch +octeontx2-af-reset-mac-features-in-flr.patch +ntfs-fix-panic-about-slab-out-of-bounds-caused-by-nt.patch +powerpc-allow-ppc_early_debug_cpm-only-when-serial_c.patch +powerpc-dts-turris1x.dts-fix-pcie-mem-size-for-pci2-.patch +net-bridge-keep-ports-without-iff_unicast_flt-in-br_.patch +net-dsa-tag_sja1105-fix-source-port-decoding-in-vlan.patch +net-fix-net_dev_start_xmit-trace-event-vs-skb_transp.patch +tcp-annotate-data-races-in-__tcp_oow_rate_limited.patch +vduse-fix-null-pointer-dereference.patch +bpf-btf-warn-but-return-no-error-for-null-btf-from-_.patch +xsk-honor-so_bindtodevice-on-bind.patch +net-sched-act_pedit-add-size-check-for-tca_pedit_par.patch +drm-i915-psr-fix-bdw-psr-aux-ch-data-register-offset.patch +fanotify-disallow-mount-sb-marks-on-kernel-internal-.patch +riscv-move-memblock_allow_resize-after-linear-mappin.patch +pptp-fix-fib-lookup-calls.patch +net-dsa-tag_sja1105-fix-mac-da-patching-from-meta-fr.patch +net-dsa-sja1105-always-enable-the-send_meta-options.patch +octeontx-af-fix-hardware-timestamp-configuration.patch +afs-fix-accidental-truncation-when-storing-data.patch +s390-qeth-fix-vipa-deletion.patch +risc-v-fix-order-of-ipi-enablement-vs-rcu-startup.patch +sh-dma-fix-dma-channel-offset-calculation.patch +apparmor-fix-missing-error-check-for-rhashtable_inse.patch +apparmor-add-missing-failure-check-in-compute_xmatch.patch +apparmor-fix-policy_compat-permission-remap-with-ext.patch +apparmor-fix-profile-verification-and-enable-it.patch +i2c-xiic-don-t-try-to-handle-more-interrupt-events-a.patch +writeback-account-the-number-of-pages-written-back.patch +lib-dhry-fix-sleeping-allocations-inside-non-preempt.patch diff --git a/queue-6.4/sfc-support-for-devlink-port-requires-mae-access.patch b/queue-6.4/sfc-support-for-devlink-port-requires-mae-access.patch new file mode 100644 index 00000000000..e273da6ffaf --- /dev/null +++ b/queue-6.4/sfc-support-for-devlink-port-requires-mae-access.patch @@ -0,0 +1,39 @@ +From 7ec233b6627ef165869c96bf8fc883f4f4ae7ec6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Jun 2023 13:32:20 +0100 +Subject: sfc: support for devlink port requires MAE access + +From: Martin Habets + +[ Upstream commit 915057ae79692d47f9fb3504785855be49abaea4 ] + +On systems without MAE permission efx->mae is not initialised, +and trying to lookup an mport results in a NULL pointer +dereference. + +Fixes: 25414b2a64ae ("sfc: add devlink port support for ef100") +Signed-off-by: Martin Habets +Reviewed-by: Jacob Keller +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/sfc/efx_devlink.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/ethernet/sfc/efx_devlink.c b/drivers/net/ethernet/sfc/efx_devlink.c +index ef9971cbb695d..0384b134e1242 100644 +--- a/drivers/net/ethernet/sfc/efx_devlink.c ++++ b/drivers/net/ethernet/sfc/efx_devlink.c +@@ -622,6 +622,9 @@ static struct devlink_port *ef100_set_devlink_port(struct efx_nic *efx, u32 idx) + u32 id; + int rc; + ++ if (!efx->mae) ++ return NULL; ++ + if (efx_mae_lookup_mport(efx, idx, &id)) { + /* This should not happen. */ + if (idx == MAE_MPORT_DESC_VF_IDX_NULL) +-- +2.39.2 + diff --git a/queue-6.4/sh-avoid-using-irq0-on-sh3-and-sh4.patch b/queue-6.4/sh-avoid-using-irq0-on-sh3-and-sh4.patch new file mode 100644 index 00000000000..17f0a29a139 --- /dev/null +++ b/queue-6.4/sh-avoid-using-irq0-on-sh3-and-sh4.patch @@ -0,0 +1,123 @@ +From fce023e79d3dda8be9a814ef0e0b87e28a1eddd0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Jun 2023 23:22:17 +0300 +Subject: sh: Avoid using IRQ0 on SH3 and SH4 + +From: Sergey Shtylyov + +[ Upstream commit a8ac2961148e8c720dc760f2e06627cd5c55a154 ] + +IRQ0 is no longer returned by platform_get_irq() and its ilk -- they now +return -EINVAL instead. However, the kernel code supporting SH3/4-based +SoCs still maps the IRQ #s starting at 0 -- modify that code to start the +IRQ #s from 16 instead. + +The patch should mostly affect the AP-SH4A-3A/AP-SH4AD-0A boards as they +indeed are using IRQ0 for the SMSC911x compatible Ethernet chip. + +Fixes: ce753ad1549c ("platform: finally disallow IRQ0 in platform_get_irq() and its ilk") +Signed-off-by: Sergey Shtylyov +Reviewed-by: Geert Uytterhoeven +Tested-by: Geert Uytterhoeven +Reviewed-by: John Paul Adrian Glaubitz +Tested-by: John Paul Adrian Glaubitz +Link: https://lore.kernel.org/r/71105dbf-cdb0-72e1-f9eb-eeda8e321696@omp.ru +Signed-off-by: John Paul Adrian Glaubitz +Signed-off-by: Sasha Levin +--- + arch/sh/include/mach-common/mach/highlander.h | 2 +- + arch/sh/include/mach-common/mach/r2d.h | 2 +- + arch/sh/include/mach-dreamcast/mach/sysasic.h | 2 +- + arch/sh/include/mach-se/mach/se7724.h | 2 +- + arch/sh/kernel/cpu/sh3/entry.S | 4 ++-- + include/linux/sh_intc.h | 6 +++--- + 6 files changed, 9 insertions(+), 9 deletions(-) + +diff --git a/arch/sh/include/mach-common/mach/highlander.h b/arch/sh/include/mach-common/mach/highlander.h +index fb44c299d0337..b12c795584225 100644 +--- a/arch/sh/include/mach-common/mach/highlander.h ++++ b/arch/sh/include/mach-common/mach/highlander.h +@@ -176,7 +176,7 @@ + #define IVDR_CK_ON 4 /* iVDR Clock ON */ + #endif + +-#define HL_FPGA_IRQ_BASE 200 ++#define HL_FPGA_IRQ_BASE (200 + 16) + #define HL_NR_IRL 15 + + #define IRQ_AX88796 (HL_FPGA_IRQ_BASE + 0) +diff --git a/arch/sh/include/mach-common/mach/r2d.h b/arch/sh/include/mach-common/mach/r2d.h +index 0d7e483c7d3f5..69bc1907c5637 100644 +--- a/arch/sh/include/mach-common/mach/r2d.h ++++ b/arch/sh/include/mach-common/mach/r2d.h +@@ -47,7 +47,7 @@ + + #define IRLCNTR1 (PA_BCR + 0) /* Interrupt Control Register1 */ + +-#define R2D_FPGA_IRQ_BASE 100 ++#define R2D_FPGA_IRQ_BASE (100 + 16) + + #define IRQ_VOYAGER (R2D_FPGA_IRQ_BASE + 0) + #define IRQ_EXT (R2D_FPGA_IRQ_BASE + 1) +diff --git a/arch/sh/include/mach-dreamcast/mach/sysasic.h b/arch/sh/include/mach-dreamcast/mach/sysasic.h +index ed69ce7f20301..3b27be9a527ea 100644 +--- a/arch/sh/include/mach-dreamcast/mach/sysasic.h ++++ b/arch/sh/include/mach-dreamcast/mach/sysasic.h +@@ -22,7 +22,7 @@ + takes. + */ + +-#define HW_EVENT_IRQ_BASE 48 ++#define HW_EVENT_IRQ_BASE (48 + 16) + + /* IRQ 13 */ + #define HW_EVENT_VSYNC (HW_EVENT_IRQ_BASE + 5) /* VSync */ +diff --git a/arch/sh/include/mach-se/mach/se7724.h b/arch/sh/include/mach-se/mach/se7724.h +index 1fe28820dfa95..ea6c46633b337 100644 +--- a/arch/sh/include/mach-se/mach/se7724.h ++++ b/arch/sh/include/mach-se/mach/se7724.h +@@ -37,7 +37,7 @@ + #define IRQ2_IRQ evt2irq(0x640) + + /* Bits in IRQ012 registers */ +-#define SE7724_FPGA_IRQ_BASE 220 ++#define SE7724_FPGA_IRQ_BASE (220 + 16) + + /* IRQ0 */ + #define IRQ0_BASE SE7724_FPGA_IRQ_BASE +diff --git a/arch/sh/kernel/cpu/sh3/entry.S b/arch/sh/kernel/cpu/sh3/entry.S +index e48b3dd996f58..b1f5b3c58a018 100644 +--- a/arch/sh/kernel/cpu/sh3/entry.S ++++ b/arch/sh/kernel/cpu/sh3/entry.S +@@ -470,9 +470,9 @@ ENTRY(handle_interrupt) + mov r4, r0 ! save vector->jmp table offset for later + + shlr2 r4 ! vector to IRQ# conversion +- add #-0x10, r4 + +- cmp/pz r4 ! is it a valid IRQ? ++ mov #0x10, r5 ++ cmp/hs r5, r4 ! is it a valid IRQ? + bt 10f + + /* +diff --git a/include/linux/sh_intc.h b/include/linux/sh_intc.h +index 37ad81058d6ae..27ae79191bdc3 100644 +--- a/include/linux/sh_intc.h ++++ b/include/linux/sh_intc.h +@@ -13,9 +13,9 @@ + /* + * Convert back and forth between INTEVT and IRQ values. + */ +-#ifdef CONFIG_CPU_HAS_INTEVT +-#define evt2irq(evt) (((evt) >> 5) - 16) +-#define irq2evt(irq) (((irq) + 16) << 5) ++#ifdef CONFIG_CPU_HAS_INTEVT /* Avoid IRQ0 (invalid for platform devices) */ ++#define evt2irq(evt) ((evt) >> 5) ++#define irq2evt(irq) ((irq) << 5) + #else + #define evt2irq(evt) (evt) + #define irq2evt(irq) (irq) +-- +2.39.2 + diff --git a/queue-6.4/sh-dma-fix-dma-channel-offset-calculation.patch b/queue-6.4/sh-dma-fix-dma-channel-offset-calculation.patch new file mode 100644 index 00000000000..a17175bad8e --- /dev/null +++ b/queue-6.4/sh-dma-fix-dma-channel-offset-calculation.patch @@ -0,0 +1,103 @@ +From e852fdc1f45541995e59b7b9f95730e3f127a1eb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 27 May 2023 18:44:50 +0200 +Subject: sh: dma: Fix DMA channel offset calculation + +From: Artur Rojek + +[ Upstream commit e82e47584847129a20b8c9f4a1dcde09374fb0e0 ] + +Various SoCs of the SH3, SH4 and SH4A family, which use this driver, +feature a differing number of DMA channels, which can be distributed +between up to two DMAC modules. The existing implementation fails to +correctly accommodate for all those variations, resulting in wrong +channel offset calculations and leading to kernel panics. + +Rewrite dma_base_addr() in order to properly calculate channel offsets +in a DMAC module. Fix dmaor_read_reg() and dmaor_write_reg(), so that +the correct DMAC module base is selected for the DMAOR register. + +Fixes: 7f47c7189b3e8f19 ("sh: dma: More legacy cpu dma chainsawing.") +Signed-off-by: Artur Rojek +Reviewed-by: Geert Uytterhoeven +Reviewed-by: John Paul Adrian Glaubitz +Link: https://lore.kernel.org/r/20230527164452.64797-2-contact@artur-rojek.eu +Signed-off-by: John Paul Adrian Glaubitz +Signed-off-by: Sasha Levin +--- + arch/sh/drivers/dma/dma-sh.c | 37 +++++++++++++++++++++++------------- + 1 file changed, 24 insertions(+), 13 deletions(-) + +diff --git a/arch/sh/drivers/dma/dma-sh.c b/arch/sh/drivers/dma/dma-sh.c +index 96c626c2cd0a4..306fba1564e5e 100644 +--- a/arch/sh/drivers/dma/dma-sh.c ++++ b/arch/sh/drivers/dma/dma-sh.c +@@ -18,6 +18,18 @@ + #include + #include + ++/* ++ * Some of the SoCs feature two DMAC modules. In such a case, the channels are ++ * distributed equally among them. ++ */ ++#ifdef SH_DMAC_BASE1 ++#define SH_DMAC_NR_MD_CH (CONFIG_NR_ONCHIP_DMA_CHANNELS / 2) ++#else ++#define SH_DMAC_NR_MD_CH CONFIG_NR_ONCHIP_DMA_CHANNELS ++#endif ++ ++#define SH_DMAC_CH_SZ 0x10 ++ + /* + * Define the default configuration for dual address memory-memory transfer. + * The 0x400 value represents auto-request, external->external. +@@ -29,7 +41,7 @@ static unsigned long dma_find_base(unsigned int chan) + unsigned long base = SH_DMAC_BASE0; + + #ifdef SH_DMAC_BASE1 +- if (chan >= 6) ++ if (chan >= SH_DMAC_NR_MD_CH) + base = SH_DMAC_BASE1; + #endif + +@@ -40,13 +52,13 @@ static unsigned long dma_base_addr(unsigned int chan) + { + unsigned long base = dma_find_base(chan); + +- /* Normalize offset calculation */ +- if (chan >= 9) +- chan -= 6; +- if (chan >= 4) +- base += 0x10; ++ chan = (chan % SH_DMAC_NR_MD_CH) * SH_DMAC_CH_SZ; ++ ++ /* DMAOR is placed inside the channel register space. Step over it. */ ++ if (chan >= DMAOR) ++ base += SH_DMAC_CH_SZ; + +- return base + (chan * 0x10); ++ return base + chan; + } + + #ifdef CONFIG_SH_DMA_IRQ_MULTI +@@ -250,12 +262,11 @@ static int sh_dmac_get_dma_residue(struct dma_channel *chan) + #define NR_DMAOR 1 + #endif + +-/* +- * DMAOR bases are broken out amongst channel groups. DMAOR0 manages +- * channels 0 - 5, DMAOR1 6 - 11 (optional). +- */ +-#define dmaor_read_reg(n) __raw_readw(dma_find_base((n)*6)) +-#define dmaor_write_reg(n, data) __raw_writew(data, dma_find_base(n)*6) ++#define dmaor_read_reg(n) __raw_readw(dma_find_base((n) * \ ++ SH_DMAC_NR_MD_CH) + DMAOR) ++#define dmaor_write_reg(n, data) __raw_writew(data, \ ++ dma_find_base((n) * \ ++ SH_DMAC_NR_MD_CH) + DMAOR) + + static inline int dmaor_reset(int no) + { +-- +2.39.2 + diff --git a/queue-6.4/sh-j2-use-ioremap-to-translate-device-tree-address-i.patch b/queue-6.4/sh-j2-use-ioremap-to-translate-device-tree-address-i.patch new file mode 100644 index 00000000000..8bfd6a9e8dd --- /dev/null +++ b/queue-6.4/sh-j2-use-ioremap-to-translate-device-tree-address-i.patch @@ -0,0 +1,44 @@ +From 90185d00dbbf2f2d832cff6274be3f9820ddd836 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 May 2023 14:57:41 +0200 +Subject: sh: j2: Use ioremap() to translate device tree address into kernel + memory + +From: John Paul Adrian Glaubitz + +[ Upstream commit bc9d1f0cecd2407cfb2364a7d4be2f52d1d46a9d ] + +Addresses the following warning when building j2_defconfig: + +arch/sh/kernel/cpu/sh2/probe.c: In function 'scan_cache': +arch/sh/kernel/cpu/sh2/probe.c:24:16: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast] + 24 | j2_ccr_base = (u32 __iomem *)of_flat_dt_translate_address(node); + | + +Fixes: 5a846abad07f ("sh: add support for J-Core J2 processor") +Reviewed-by: Geert Uytterhoeven +Tested-by: Rob Landley +Signed-off-by: John Paul Adrian Glaubitz +Link: https://lore.kernel.org/r/20230503125746.331835-1-glaubitz@physik.fu-berlin.de +Signed-off-by: John Paul Adrian Glaubitz +Signed-off-by: Sasha Levin +--- + arch/sh/kernel/cpu/sh2/probe.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/sh/kernel/cpu/sh2/probe.c b/arch/sh/kernel/cpu/sh2/probe.c +index d342ea08843f6..70a07f4f2142f 100644 +--- a/arch/sh/kernel/cpu/sh2/probe.c ++++ b/arch/sh/kernel/cpu/sh2/probe.c +@@ -21,7 +21,7 @@ static int __init scan_cache(unsigned long node, const char *uname, + if (!of_flat_dt_is_compatible(node, "jcore,cache")) + return 0; + +- j2_ccr_base = (u32 __iomem *)of_flat_dt_translate_address(node); ++ j2_ccr_base = ioremap(of_flat_dt_translate_address(node), 4); + + return 1; + } +-- +2.39.2 + diff --git a/queue-6.4/soundwire-debugfs-fix-unbalanced-pm_runtime_put.patch b/queue-6.4/soundwire-debugfs-fix-unbalanced-pm_runtime_put.patch new file mode 100644 index 00000000000..6ebfc9ed65c --- /dev/null +++ b/queue-6.4/soundwire-debugfs-fix-unbalanced-pm_runtime_put.patch @@ -0,0 +1,42 @@ +From 492291e4edeb86cf5319912aadf3cfd404306014 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 May 2023 18:37:50 +0200 +Subject: soundwire: debugfs: fix unbalanced pm_runtime_put() + +From: Krzysztof Kozlowski + +[ Upstream commit 217f5e0de397fafc94d25a8f7baf71920bea4a04 ] + +If pm_runtime_resume_and_get() failed with -EACCES, the driver continued +execution and finally called pm_runtime_put_autosuspend(). Since +pm_runtime_resume_and_get() drops the usage counter on every error, this +lead to double decrement of that counter. + +Fixes: b275bf45ba1d ("soundwire: debugfs: Switch to sdw_read_no_pm") +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20230517163750.997629-2-krzysztof.kozlowski@linaro.org +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/soundwire/debugfs.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/soundwire/debugfs.c b/drivers/soundwire/debugfs.c +index dea782e0edc4b..c3a1a359ee5c3 100644 +--- a/drivers/soundwire/debugfs.c ++++ b/drivers/soundwire/debugfs.c +@@ -56,8 +56,9 @@ static int sdw_slave_reg_show(struct seq_file *s_file, void *data) + if (!buf) + return -ENOMEM; + +- ret = pm_runtime_resume_and_get(&slave->dev); ++ ret = pm_runtime_get_sync(&slave->dev); + if (ret < 0 && ret != -EACCES) { ++ pm_runtime_put_noidle(&slave->dev); + kfree(buf); + return ret; + } +-- +2.39.2 + diff --git a/queue-6.4/soundwire-qcom-fix-unbalanced-pm_runtime_put.patch b/queue-6.4/soundwire-qcom-fix-unbalanced-pm_runtime_put.patch new file mode 100644 index 00000000000..fcfb3e6e524 --- /dev/null +++ b/queue-6.4/soundwire-qcom-fix-unbalanced-pm_runtime_put.patch @@ -0,0 +1,86 @@ +From d3fa8f7ed58b0fe96e2ef113aa9fcba0580b50a6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 May 2023 18:37:49 +0200 +Subject: soundwire: qcom: fix unbalanced pm_runtime_put() + +From: Krzysztof Kozlowski + +[ Upstream commit 9f9914b178a7935d2d94ee3e1bf55f2b42b18528 ] + +This reverts commit 57ed510b0547 ("soundwire: qcom: use +pm_runtime_resume_and_get()") which introduced unbalanced +pm_runtime_put(), when device did not have runtime PM enabled. + +If pm_runtime_resume_and_get() failed with -EACCES, the driver continued +execution and finally called pm_runtime_put_autosuspend(). Since +pm_runtime_resume_and_get() drops the usage counter on every error, this +lead to double decrement of that counter visible in certain debugfs +actions on unattached devices (still in reset state): + + $ cat /sys/kernel/debug/soundwire/master-0-0/sdw:0:0217:f001:00:0/registers + qcom-soundwire 3210000.soundwire-controller: swrm_wait_for_wr_fifo_avail err write overflow + soundwire sdw-master-0: trf on Slave 1 failed:-5 read addr e36 count 1 + soundwire sdw:0:0217:f001:00:0: Runtime PM usage count underflow! + +Fixes: 57ed510b0547 ("soundwire: qcom: use pm_runtime_resume_and_get()") +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20230517163750.997629-1-krzysztof.kozlowski@linaro.org +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/soundwire/qcom.c | 15 +++++++++------ + 1 file changed, 9 insertions(+), 6 deletions(-) + +diff --git a/drivers/soundwire/qcom.c b/drivers/soundwire/qcom.c +index 7c75c6e3fab54..bd39e78788590 100644 +--- a/drivers/soundwire/qcom.c ++++ b/drivers/soundwire/qcom.c +@@ -535,11 +535,12 @@ static irqreturn_t qcom_swrm_wake_irq_handler(int irq, void *dev_id) + struct qcom_swrm_ctrl *ctrl = dev_id; + int ret; + +- ret = pm_runtime_resume_and_get(ctrl->dev); ++ ret = pm_runtime_get_sync(ctrl->dev); + if (ret < 0 && ret != -EACCES) { + dev_err_ratelimited(ctrl->dev, +- "pm_runtime_resume_and_get failed in %s, ret %d\n", ++ "pm_runtime_get_sync failed in %s, ret %d\n", + __func__, ret); ++ pm_runtime_put_noidle(ctrl->dev); + return ret; + } + +@@ -1090,11 +1091,12 @@ static int qcom_swrm_startup(struct snd_pcm_substream *substream, + struct snd_soc_dai *codec_dai; + int ret, i; + +- ret = pm_runtime_resume_and_get(ctrl->dev); ++ ret = pm_runtime_get_sync(ctrl->dev); + if (ret < 0 && ret != -EACCES) { + dev_err_ratelimited(ctrl->dev, +- "pm_runtime_resume_and_get failed in %s, ret %d\n", ++ "pm_runtime_get_sync failed in %s, ret %d\n", + __func__, ret); ++ pm_runtime_put_noidle(ctrl->dev); + return ret; + } + +@@ -1295,11 +1297,12 @@ static int swrm_reg_show(struct seq_file *s_file, void *data) + struct qcom_swrm_ctrl *ctrl = s_file->private; + int reg, reg_val, ret; + +- ret = pm_runtime_resume_and_get(ctrl->dev); ++ ret = pm_runtime_get_sync(ctrl->dev); + if (ret < 0 && ret != -EACCES) { + dev_err_ratelimited(ctrl->dev, +- "pm_runtime_resume_and_get failed in %s, ret %d\n", ++ "pm_runtime_get_sync failed in %s, ret %d\n", + __func__, ret); ++ pm_runtime_put_noidle(ctrl->dev); + return ret; + } + +-- +2.39.2 + diff --git a/queue-6.4/soundwire-qcom-use-consistently-ctrl-as-state-variab.patch b/queue-6.4/soundwire-qcom-use-consistently-ctrl-as-state-variab.patch new file mode 100644 index 00000000000..43b17f562f9 --- /dev/null +++ b/queue-6.4/soundwire-qcom-use-consistently-ctrl-as-state-variab.patch @@ -0,0 +1,441 @@ +From 163819f2fc605e8118df72da08c58303ed004e94 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Apr 2023 11:54:44 +0200 +Subject: soundwire: qcom: use consistently 'ctrl' as state variable name + +From: Krzysztof Kozlowski + +[ Upstream commit 6f76e79153d588ebb00becbfc200ec3b983e353e ] + +The pointer to 'struct qcom_swrm_ctrl' was called sometimes 'swrm' and +sometimes 'ctrl' variable. Choose one - 'ctrl' - so the code will be +consistent and easier to read. + +No functional change. + +Reviewed-by: Srinivas Kandagagatla +Tested-by: Srinivas Kandagagatla +Reviewed-by: Konrad Dybcio +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20230418095447.577001-5-krzysztof.kozlowski@linaro.org +Signed-off-by: Vinod Koul +Stable-dep-of: 9f9914b178a7 ("soundwire: qcom: fix unbalanced pm_runtime_put()") +Signed-off-by: Sasha Levin +--- + drivers/soundwire/qcom.c | 168 +++++++++++++++++++-------------------- + 1 file changed, 84 insertions(+), 84 deletions(-) + +diff --git a/drivers/soundwire/qcom.c b/drivers/soundwire/qcom.c +index 280455f047a36..7c75c6e3fab54 100644 +--- a/drivers/soundwire/qcom.c ++++ b/drivers/soundwire/qcom.c +@@ -278,14 +278,14 @@ static u32 swrm_get_packed_reg_val(u8 *cmd_id, u8 cmd_data, + return val; + } + +-static int swrm_wait_for_rd_fifo_avail(struct qcom_swrm_ctrl *swrm) ++static int swrm_wait_for_rd_fifo_avail(struct qcom_swrm_ctrl *ctrl) + { + u32 fifo_outstanding_data, value; + int fifo_retry_count = SWR_OVERFLOW_RETRY_COUNT; + + do { + /* Check for fifo underflow during read */ +- swrm->reg_read(swrm, SWRM_CMD_FIFO_STATUS, &value); ++ ctrl->reg_read(ctrl, SWRM_CMD_FIFO_STATUS, &value); + fifo_outstanding_data = FIELD_GET(SWRM_RD_CMD_FIFO_CNT_MASK, value); + + /* Check if read data is available in read fifo */ +@@ -296,39 +296,39 @@ static int swrm_wait_for_rd_fifo_avail(struct qcom_swrm_ctrl *swrm) + } while (fifo_retry_count--); + + if (fifo_outstanding_data == 0) { +- dev_err_ratelimited(swrm->dev, "%s err read underflow\n", __func__); ++ dev_err_ratelimited(ctrl->dev, "%s err read underflow\n", __func__); + return -EIO; + } + + return 0; + } + +-static int swrm_wait_for_wr_fifo_avail(struct qcom_swrm_ctrl *swrm) ++static int swrm_wait_for_wr_fifo_avail(struct qcom_swrm_ctrl *ctrl) + { + u32 fifo_outstanding_cmds, value; + int fifo_retry_count = SWR_OVERFLOW_RETRY_COUNT; + + do { + /* Check for fifo overflow during write */ +- swrm->reg_read(swrm, SWRM_CMD_FIFO_STATUS, &value); ++ ctrl->reg_read(ctrl, SWRM_CMD_FIFO_STATUS, &value); + fifo_outstanding_cmds = FIELD_GET(SWRM_WR_CMD_FIFO_CNT_MASK, value); + + /* Check for space in write fifo before writing */ +- if (fifo_outstanding_cmds < swrm->wr_fifo_depth) ++ if (fifo_outstanding_cmds < ctrl->wr_fifo_depth) + return 0; + + usleep_range(500, 510); + } while (fifo_retry_count--); + +- if (fifo_outstanding_cmds == swrm->wr_fifo_depth) { +- dev_err_ratelimited(swrm->dev, "%s err write overflow\n", __func__); ++ if (fifo_outstanding_cmds == ctrl->wr_fifo_depth) { ++ dev_err_ratelimited(ctrl->dev, "%s err write overflow\n", __func__); + return -EIO; + } + + return 0; + } + +-static int qcom_swrm_cmd_fifo_wr_cmd(struct qcom_swrm_ctrl *swrm, u8 cmd_data, ++static int qcom_swrm_cmd_fifo_wr_cmd(struct qcom_swrm_ctrl *ctrl, u8 cmd_data, + u8 dev_addr, u16 reg_addr) + { + +@@ -341,20 +341,20 @@ static int qcom_swrm_cmd_fifo_wr_cmd(struct qcom_swrm_ctrl *swrm, u8 cmd_data, + val = swrm_get_packed_reg_val(&cmd_id, cmd_data, + dev_addr, reg_addr); + } else { +- val = swrm_get_packed_reg_val(&swrm->wcmd_id, cmd_data, ++ val = swrm_get_packed_reg_val(&ctrl->wcmd_id, cmd_data, + dev_addr, reg_addr); + } + +- if (swrm_wait_for_wr_fifo_avail(swrm)) ++ if (swrm_wait_for_wr_fifo_avail(ctrl)) + return SDW_CMD_FAIL_OTHER; + + if (cmd_id == SWR_BROADCAST_CMD_ID) +- reinit_completion(&swrm->broadcast); ++ reinit_completion(&ctrl->broadcast); + + /* Its assumed that write is okay as we do not get any status back */ +- swrm->reg_write(swrm, SWRM_CMD_FIFO_WR_CMD, val); ++ ctrl->reg_write(ctrl, SWRM_CMD_FIFO_WR_CMD, val); + +- if (swrm->version <= SWRM_VERSION_1_3_0) ++ if (ctrl->version <= SWRM_VERSION_1_3_0) + usleep_range(150, 155); + + if (cmd_id == SWR_BROADCAST_CMD_ID) { +@@ -362,7 +362,7 @@ static int qcom_swrm_cmd_fifo_wr_cmd(struct qcom_swrm_ctrl *swrm, u8 cmd_data, + * sleep for 10ms for MSM soundwire variant to allow broadcast + * command to complete. + */ +- ret = wait_for_completion_timeout(&swrm->broadcast, ++ ret = wait_for_completion_timeout(&ctrl->broadcast, + msecs_to_jiffies(TIMEOUT_MS)); + if (!ret) + ret = SDW_CMD_IGNORED; +@@ -375,41 +375,41 @@ static int qcom_swrm_cmd_fifo_wr_cmd(struct qcom_swrm_ctrl *swrm, u8 cmd_data, + return ret; + } + +-static int qcom_swrm_cmd_fifo_rd_cmd(struct qcom_swrm_ctrl *swrm, ++static int qcom_swrm_cmd_fifo_rd_cmd(struct qcom_swrm_ctrl *ctrl, + u8 dev_addr, u16 reg_addr, + u32 len, u8 *rval) + { + u32 cmd_data, cmd_id, val, retry_attempt = 0; + +- val = swrm_get_packed_reg_val(&swrm->rcmd_id, len, dev_addr, reg_addr); ++ val = swrm_get_packed_reg_val(&ctrl->rcmd_id, len, dev_addr, reg_addr); + + /* + * Check for outstanding cmd wrt. write fifo depth to avoid + * overflow as read will also increase write fifo cnt. + */ +- swrm_wait_for_wr_fifo_avail(swrm); ++ swrm_wait_for_wr_fifo_avail(ctrl); + + /* wait for FIFO RD to complete to avoid overflow */ + usleep_range(100, 105); +- swrm->reg_write(swrm, SWRM_CMD_FIFO_RD_CMD, val); ++ ctrl->reg_write(ctrl, SWRM_CMD_FIFO_RD_CMD, val); + /* wait for FIFO RD CMD complete to avoid overflow */ + usleep_range(250, 255); + +- if (swrm_wait_for_rd_fifo_avail(swrm)) ++ if (swrm_wait_for_rd_fifo_avail(ctrl)) + return SDW_CMD_FAIL_OTHER; + + do { +- swrm->reg_read(swrm, SWRM_CMD_FIFO_RD_FIFO_ADDR, &cmd_data); ++ ctrl->reg_read(ctrl, SWRM_CMD_FIFO_RD_FIFO_ADDR, &cmd_data); + rval[0] = cmd_data & 0xFF; + cmd_id = FIELD_GET(SWRM_RD_FIFO_CMD_ID_MASK, cmd_data); + +- if (cmd_id != swrm->rcmd_id) { ++ if (cmd_id != ctrl->rcmd_id) { + if (retry_attempt < (MAX_FIFO_RD_RETRY - 1)) { + /* wait 500 us before retry on fifo read failure */ + usleep_range(500, 505); +- swrm->reg_write(swrm, SWRM_CMD_FIFO_CMD, ++ ctrl->reg_write(ctrl, SWRM_CMD_FIFO_CMD, + SWRM_CMD_FIFO_FLUSH); +- swrm->reg_write(swrm, SWRM_CMD_FIFO_RD_CMD, val); ++ ctrl->reg_write(ctrl, SWRM_CMD_FIFO_RD_CMD, val); + } + retry_attempt++; + } else { +@@ -418,9 +418,9 @@ static int qcom_swrm_cmd_fifo_rd_cmd(struct qcom_swrm_ctrl *swrm, + + } while (retry_attempt < MAX_FIFO_RD_RETRY); + +- dev_err(swrm->dev, "failed to read fifo: reg: 0x%x, rcmd_id: 0x%x,\ ++ dev_err(ctrl->dev, "failed to read fifo: reg: 0x%x, rcmd_id: 0x%x,\ + dev_num: 0x%x, cmd_data: 0x%x\n", +- reg_addr, swrm->rcmd_id, dev_addr, cmd_data); ++ reg_addr, ctrl->rcmd_id, dev_addr, cmd_data); + + return SDW_CMD_IGNORED; + } +@@ -532,39 +532,39 @@ static int qcom_swrm_enumerate(struct sdw_bus *bus) + + static irqreturn_t qcom_swrm_wake_irq_handler(int irq, void *dev_id) + { +- struct qcom_swrm_ctrl *swrm = dev_id; ++ struct qcom_swrm_ctrl *ctrl = dev_id; + int ret; + +- ret = pm_runtime_resume_and_get(swrm->dev); ++ ret = pm_runtime_resume_and_get(ctrl->dev); + if (ret < 0 && ret != -EACCES) { +- dev_err_ratelimited(swrm->dev, ++ dev_err_ratelimited(ctrl->dev, + "pm_runtime_resume_and_get failed in %s, ret %d\n", + __func__, ret); + return ret; + } + +- if (swrm->wake_irq > 0) { +- if (!irqd_irq_disabled(irq_get_irq_data(swrm->wake_irq))) +- disable_irq_nosync(swrm->wake_irq); ++ if (ctrl->wake_irq > 0) { ++ if (!irqd_irq_disabled(irq_get_irq_data(ctrl->wake_irq))) ++ disable_irq_nosync(ctrl->wake_irq); + } + +- pm_runtime_mark_last_busy(swrm->dev); +- pm_runtime_put_autosuspend(swrm->dev); ++ pm_runtime_mark_last_busy(ctrl->dev); ++ pm_runtime_put_autosuspend(ctrl->dev); + + return IRQ_HANDLED; + } + + static irqreturn_t qcom_swrm_irq_handler(int irq, void *dev_id) + { +- struct qcom_swrm_ctrl *swrm = dev_id; ++ struct qcom_swrm_ctrl *ctrl = dev_id; + u32 value, intr_sts, intr_sts_masked, slave_status; + u32 i; + int devnum; + int ret = IRQ_HANDLED; +- clk_prepare_enable(swrm->hclk); ++ clk_prepare_enable(ctrl->hclk); + +- swrm->reg_read(swrm, SWRM_INTERRUPT_STATUS, &intr_sts); +- intr_sts_masked = intr_sts & swrm->intr_mask; ++ ctrl->reg_read(ctrl, SWRM_INTERRUPT_STATUS, &intr_sts); ++ intr_sts_masked = intr_sts & ctrl->intr_mask; + + do { + for (i = 0; i < SWRM_INTERRUPT_MAX; i++) { +@@ -574,80 +574,80 @@ static irqreturn_t qcom_swrm_irq_handler(int irq, void *dev_id) + + switch (value) { + case SWRM_INTERRUPT_STATUS_SLAVE_PEND_IRQ: +- devnum = qcom_swrm_get_alert_slave_dev_num(swrm); ++ devnum = qcom_swrm_get_alert_slave_dev_num(ctrl); + if (devnum < 0) { +- dev_err_ratelimited(swrm->dev, ++ dev_err_ratelimited(ctrl->dev, + "no slave alert found.spurious interrupt\n"); + } else { +- sdw_handle_slave_status(&swrm->bus, swrm->status); ++ sdw_handle_slave_status(&ctrl->bus, ctrl->status); + } + + break; + case SWRM_INTERRUPT_STATUS_NEW_SLAVE_ATTACHED: + case SWRM_INTERRUPT_STATUS_CHANGE_ENUM_SLAVE_STATUS: +- dev_dbg_ratelimited(swrm->dev, "SWR new slave attached\n"); +- swrm->reg_read(swrm, SWRM_MCP_SLV_STATUS, &slave_status); +- if (swrm->slave_status == slave_status) { +- dev_dbg(swrm->dev, "Slave status not changed %x\n", ++ dev_dbg_ratelimited(ctrl->dev, "SWR new slave attached\n"); ++ ctrl->reg_read(ctrl, SWRM_MCP_SLV_STATUS, &slave_status); ++ if (ctrl->slave_status == slave_status) { ++ dev_dbg(ctrl->dev, "Slave status not changed %x\n", + slave_status); + } else { +- qcom_swrm_get_device_status(swrm); +- qcom_swrm_enumerate(&swrm->bus); +- sdw_handle_slave_status(&swrm->bus, swrm->status); ++ qcom_swrm_get_device_status(ctrl); ++ qcom_swrm_enumerate(&ctrl->bus); ++ sdw_handle_slave_status(&ctrl->bus, ctrl->status); + } + break; + case SWRM_INTERRUPT_STATUS_MASTER_CLASH_DET: +- dev_err_ratelimited(swrm->dev, ++ dev_err_ratelimited(ctrl->dev, + "%s: SWR bus clsh detected\n", + __func__); +- swrm->intr_mask &= ~SWRM_INTERRUPT_STATUS_MASTER_CLASH_DET; +- swrm->reg_write(swrm, SWRM_INTERRUPT_CPU_EN, swrm->intr_mask); ++ ctrl->intr_mask &= ~SWRM_INTERRUPT_STATUS_MASTER_CLASH_DET; ++ ctrl->reg_write(ctrl, SWRM_INTERRUPT_CPU_EN, ctrl->intr_mask); + break; + case SWRM_INTERRUPT_STATUS_RD_FIFO_OVERFLOW: +- swrm->reg_read(swrm, SWRM_CMD_FIFO_STATUS, &value); +- dev_err_ratelimited(swrm->dev, ++ ctrl->reg_read(ctrl, SWRM_CMD_FIFO_STATUS, &value); ++ dev_err_ratelimited(ctrl->dev, + "%s: SWR read FIFO overflow fifo status 0x%x\n", + __func__, value); + break; + case SWRM_INTERRUPT_STATUS_RD_FIFO_UNDERFLOW: +- swrm->reg_read(swrm, SWRM_CMD_FIFO_STATUS, &value); +- dev_err_ratelimited(swrm->dev, ++ ctrl->reg_read(ctrl, SWRM_CMD_FIFO_STATUS, &value); ++ dev_err_ratelimited(ctrl->dev, + "%s: SWR read FIFO underflow fifo status 0x%x\n", + __func__, value); + break; + case SWRM_INTERRUPT_STATUS_WR_CMD_FIFO_OVERFLOW: +- swrm->reg_read(swrm, SWRM_CMD_FIFO_STATUS, &value); +- dev_err(swrm->dev, ++ ctrl->reg_read(ctrl, SWRM_CMD_FIFO_STATUS, &value); ++ dev_err(ctrl->dev, + "%s: SWR write FIFO overflow fifo status %x\n", + __func__, value); +- swrm->reg_write(swrm, SWRM_CMD_FIFO_CMD, 0x1); ++ ctrl->reg_write(ctrl, SWRM_CMD_FIFO_CMD, 0x1); + break; + case SWRM_INTERRUPT_STATUS_CMD_ERROR: +- swrm->reg_read(swrm, SWRM_CMD_FIFO_STATUS, &value); +- dev_err_ratelimited(swrm->dev, ++ ctrl->reg_read(ctrl, SWRM_CMD_FIFO_STATUS, &value); ++ dev_err_ratelimited(ctrl->dev, + "%s: SWR CMD error, fifo status 0x%x, flushing fifo\n", + __func__, value); +- swrm->reg_write(swrm, SWRM_CMD_FIFO_CMD, 0x1); ++ ctrl->reg_write(ctrl, SWRM_CMD_FIFO_CMD, 0x1); + break; + case SWRM_INTERRUPT_STATUS_DOUT_PORT_COLLISION: +- dev_err_ratelimited(swrm->dev, ++ dev_err_ratelimited(ctrl->dev, + "%s: SWR Port collision detected\n", + __func__); +- swrm->intr_mask &= ~SWRM_INTERRUPT_STATUS_DOUT_PORT_COLLISION; +- swrm->reg_write(swrm, +- SWRM_INTERRUPT_CPU_EN, swrm->intr_mask); ++ ctrl->intr_mask &= ~SWRM_INTERRUPT_STATUS_DOUT_PORT_COLLISION; ++ ctrl->reg_write(ctrl, ++ SWRM_INTERRUPT_CPU_EN, ctrl->intr_mask); + break; + case SWRM_INTERRUPT_STATUS_READ_EN_RD_VALID_MISMATCH: +- dev_err_ratelimited(swrm->dev, ++ dev_err_ratelimited(ctrl->dev, + "%s: SWR read enable valid mismatch\n", + __func__); +- swrm->intr_mask &= ++ ctrl->intr_mask &= + ~SWRM_INTERRUPT_STATUS_READ_EN_RD_VALID_MISMATCH; +- swrm->reg_write(swrm, +- SWRM_INTERRUPT_CPU_EN, swrm->intr_mask); ++ ctrl->reg_write(ctrl, ++ SWRM_INTERRUPT_CPU_EN, ctrl->intr_mask); + break; + case SWRM_INTERRUPT_STATUS_SPECIAL_CMD_ID_FINISHED: +- complete(&swrm->broadcast); ++ complete(&ctrl->broadcast); + break; + case SWRM_INTERRUPT_STATUS_BUS_RESET_FINISHED_V2: + break; +@@ -656,19 +656,19 @@ static irqreturn_t qcom_swrm_irq_handler(int irq, void *dev_id) + case SWRM_INTERRUPT_STATUS_EXT_CLK_STOP_WAKEUP: + break; + default: +- dev_err_ratelimited(swrm->dev, ++ dev_err_ratelimited(ctrl->dev, + "%s: SWR unknown interrupt value: %d\n", + __func__, value); + ret = IRQ_NONE; + break; + } + } +- swrm->reg_write(swrm, SWRM_INTERRUPT_CLEAR, intr_sts); +- swrm->reg_read(swrm, SWRM_INTERRUPT_STATUS, &intr_sts); +- intr_sts_masked = intr_sts & swrm->intr_mask; ++ ctrl->reg_write(ctrl, SWRM_INTERRUPT_CLEAR, intr_sts); ++ ctrl->reg_read(ctrl, SWRM_INTERRUPT_STATUS, &intr_sts); ++ intr_sts_masked = intr_sts & ctrl->intr_mask; + } while (intr_sts_masked); + +- clk_disable_unprepare(swrm->hclk); ++ clk_disable_unprepare(ctrl->hclk); + return ret; + } + +@@ -1292,23 +1292,23 @@ static int qcom_swrm_get_port_config(struct qcom_swrm_ctrl *ctrl) + #ifdef CONFIG_DEBUG_FS + static int swrm_reg_show(struct seq_file *s_file, void *data) + { +- struct qcom_swrm_ctrl *swrm = s_file->private; ++ struct qcom_swrm_ctrl *ctrl = s_file->private; + int reg, reg_val, ret; + +- ret = pm_runtime_resume_and_get(swrm->dev); ++ ret = pm_runtime_resume_and_get(ctrl->dev); + if (ret < 0 && ret != -EACCES) { +- dev_err_ratelimited(swrm->dev, ++ dev_err_ratelimited(ctrl->dev, + "pm_runtime_resume_and_get failed in %s, ret %d\n", + __func__, ret); + return ret; + } + + for (reg = 0; reg <= SWR_MSTR_MAX_REG_ADDR; reg += 4) { +- swrm->reg_read(swrm, reg, ®_val); ++ ctrl->reg_read(ctrl, reg, ®_val); + seq_printf(s_file, "0x%.3x: 0x%.2x\n", reg, reg_val); + } +- pm_runtime_mark_last_busy(swrm->dev); +- pm_runtime_put_autosuspend(swrm->dev); ++ pm_runtime_mark_last_busy(ctrl->dev); ++ pm_runtime_put_autosuspend(ctrl->dev); + + + return 0; +@@ -1489,13 +1489,13 @@ static int qcom_swrm_remove(struct platform_device *pdev) + return 0; + } + +-static bool swrm_wait_for_frame_gen_enabled(struct qcom_swrm_ctrl *swrm) ++static bool swrm_wait_for_frame_gen_enabled(struct qcom_swrm_ctrl *ctrl) + { + int retry = SWRM_LINK_STATUS_RETRY_CNT; + int comp_sts; + + do { +- swrm->reg_read(swrm, SWRM_COMP_STATUS, &comp_sts); ++ ctrl->reg_read(ctrl, SWRM_COMP_STATUS, &comp_sts); + + if (comp_sts & SWRM_FRM_GEN_ENABLED) + return true; +@@ -1503,7 +1503,7 @@ static bool swrm_wait_for_frame_gen_enabled(struct qcom_swrm_ctrl *swrm) + usleep_range(500, 510); + } while (retry--); + +- dev_err(swrm->dev, "%s: link status not %s\n", __func__, ++ dev_err(ctrl->dev, "%s: link status not %s\n", __func__, + comp_sts & SWRM_FRM_GEN_ENABLED ? "connected" : "disconnected"); + + return false; +-- +2.39.2 + diff --git a/queue-6.4/spi-bcm-qspi-return-error-if-neither-hif_mspi-nor-ms.patch b/queue-6.4/spi-bcm-qspi-return-error-if-neither-hif_mspi-nor-ms.patch new file mode 100644 index 00000000000..5f6646c236e --- /dev/null +++ b/queue-6.4/spi-bcm-qspi-return-error-if-neither-hif_mspi-nor-ms.patch @@ -0,0 +1,58 @@ +From 6f4878e068180ee7e47d1146f3ba999571f50668 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Jun 2023 15:43:05 +0200 +Subject: spi: bcm-qspi: return error if neither hif_mspi nor mspi is available + +From: Jonas Gorski + +[ Upstream commit 7c1f23ad34fcdace50275a6aa1e1969b41c6233f ] + +If neither a "hif_mspi" nor "mspi" resource is present, the driver will +just early exit in probe but still return success. Apart from not doing +anything meaningful, this would then also lead to a null pointer access +on removal, as platform_get_drvdata() would return NULL, which it would +then try to dereference when trying to unregister the spi master. + +Fix this by unconditionally calling devm_ioremap_resource(), as it can +handle a NULL res and will then return a viable ERR_PTR() if we get one. + +The "return 0;" was previously a "goto qspi_resource_err;" where then +ret was returned, but since ret was still initialized to 0 at this place +this was a valid conversion in 63c5395bb7a9 ("spi: bcm-qspi: Fix +use-after-free on unbind"). The issue was not introduced by this commit, +only made more obvious. + +Fixes: fa236a7ef240 ("spi: bcm-qspi: Add Broadcom MSPI driver") +Signed-off-by: Jonas Gorski +Reviewed-by: Kamal Dasu +Link: https://lore.kernel.org/r/20230629134306.95823-1-jonas.gorski@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-bcm-qspi.c | 10 +++------- + 1 file changed, 3 insertions(+), 7 deletions(-) + +diff --git a/drivers/spi/spi-bcm-qspi.c b/drivers/spi/spi-bcm-qspi.c +index 6b46a3b67c416..d91dfbe47aa50 100644 +--- a/drivers/spi/spi-bcm-qspi.c ++++ b/drivers/spi/spi-bcm-qspi.c +@@ -1543,13 +1543,9 @@ int bcm_qspi_probe(struct platform_device *pdev, + res = platform_get_resource_byname(pdev, IORESOURCE_MEM, + "mspi"); + +- if (res) { +- qspi->base[MSPI] = devm_ioremap_resource(dev, res); +- if (IS_ERR(qspi->base[MSPI])) +- return PTR_ERR(qspi->base[MSPI]); +- } else { +- return 0; +- } ++ qspi->base[MSPI] = devm_ioremap_resource(dev, res); ++ if (IS_ERR(qspi->base[MSPI])) ++ return PTR_ERR(qspi->base[MSPI]); + + res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "bspi"); + if (res) { +-- +2.39.2 + diff --git a/queue-6.4/spi-spi-geni-qcom-enable-spi_controller_must_tx-for-.patch b/queue-6.4/spi-spi-geni-qcom-enable-spi_controller_must_tx-for-.patch new file mode 100644 index 00000000000..c0b9b7983ab --- /dev/null +++ b/queue-6.4/spi-spi-geni-qcom-enable-spi_controller_must_tx-for-.patch @@ -0,0 +1,42 @@ +From ed1d080b26ffc33136bded12bf8443c94eb1c590 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Jun 2023 12:58:47 +0300 +Subject: spi: spi-geni-qcom: enable SPI_CONTROLLER_MUST_TX for GPI DMA mode + +From: Dmitry Baryshkov + +[ Upstream commit d10005837be83906bbd2078c3b4f9dfcbd6c95b6 ] + +The GPI DMA mode requires for TX DMA to be prepared. Force SPI core to +provide TX buffer even if the caller didn't provide one by setting the +SPI_CONTROLLER_MUST_TX flag. + +Fixes: b59c122484ec ("spi: spi-geni-qcom: Add support for GPI dma") +Signed-off-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20230629095847.3648597-1-dmitry.baryshkov@linaro.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-geni-qcom.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/spi/spi-geni-qcom.c b/drivers/spi/spi-geni-qcom.c +index 26ce959d98dfa..1df9d4844a68d 100644 +--- a/drivers/spi/spi-geni-qcom.c ++++ b/drivers/spi/spi-geni-qcom.c +@@ -1097,6 +1097,12 @@ static int spi_geni_probe(struct platform_device *pdev) + if (mas->cur_xfer_mode == GENI_SE_FIFO) + spi->set_cs = spi_geni_set_cs; + ++ /* ++ * TX is required per GSI spec, see setup_gsi_xfer(). ++ */ ++ if (mas->cur_xfer_mode == GENI_GPI_DMA) ++ spi->flags = SPI_CONTROLLER_MUST_TX; ++ + ret = request_irq(mas->irq, geni_spi_isr, 0, dev_name(dev), spi); + if (ret) + goto spi_geni_release_dma; +-- +2.39.2 + diff --git a/queue-6.4/staging-vchiq_arm-mark-vchiq_platform_init-static.patch b/queue-6.4/staging-vchiq_arm-mark-vchiq_platform_init-static.patch new file mode 100644 index 00000000000..f3ef5c5462c --- /dev/null +++ b/queue-6.4/staging-vchiq_arm-mark-vchiq_platform_init-static.patch @@ -0,0 +1,72 @@ +From 999ecd0fba0c0e527294c9434416c9c87ac06f3b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 May 2023 22:25:55 +0200 +Subject: staging: vchiq_arm: mark vchiq_platform_init() static + +From: Arnd Bergmann + +[ Upstream commit e152c58d7a48194d6b530d8e004d650fd01568b6 ] + +This function has no callers from other files, and the declaration +was removed a while ago, causing a W=1 warning: + +drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:465:5: error: no previous prototype for 'vchiq_platform_init' + +Marking it static solves this problem but introduces a new warning +since gcc determines that 'g_fragments_base' is never initialized +in some kernel configurations: + +In file included from include/linux/string.h:254, + from include/linux/bitmap.h:11, + from include/linux/cpumask.h:12, + from include/linux/mm_types_task.h:14, + from include/linux/mm_types.h:5, + from include/linux/buildid.h:5, + from include/linux/module.h:14, + from drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:8: +In function 'memcpy_to_page', + inlined from 'free_pagelist' at drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:433:4: +include/linux/fortify-string.h:57:33: error: argument 2 null where non-null expected [-Werror=nonnull] +include/linux/highmem.h:427:9: note: in expansion of macro 'memcpy' + 427 | memcpy(to + offset, from, len); + | ^~~~~~ + +Add a NULL pointer check for this in addition to the static annotation +to avoid both. + +Fixes: 89cc4218f640 ("staging: vchiq_arm: drop unnecessary declarations") +Signed-off-by: Arnd Bergmann +Reviewed-by: Florian Fainelli +Reviewed-by: Umang Jain +Link: https://lore.kernel.org/r/20230516202603.560554-1-arnd@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c +index 90a3958d1f297..aa2313f3bcab8 100644 +--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c ++++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c +@@ -415,7 +415,7 @@ free_pagelist(struct vchiq_instance *instance, struct vchiq_pagelist_info *pagel + pagelistinfo->scatterlist_mapped = 0; + + /* Deal with any partial cache lines (fragments) */ +- if (pagelist->type >= PAGELIST_READ_WITH_FRAGMENTS) { ++ if (pagelist->type >= PAGELIST_READ_WITH_FRAGMENTS && g_fragments_base) { + char *fragments = g_fragments_base + + (pagelist->type - PAGELIST_READ_WITH_FRAGMENTS) * + g_fragments_size; +@@ -462,7 +462,7 @@ free_pagelist(struct vchiq_instance *instance, struct vchiq_pagelist_info *pagel + cleanup_pagelistinfo(instance, pagelistinfo); + } + +-int vchiq_platform_init(struct platform_device *pdev, struct vchiq_state *state) ++static int vchiq_platform_init(struct platform_device *pdev, struct vchiq_state *state) + { + struct device *dev = &pdev->dev; + struct vchiq_drvdata *drvdata = platform_get_drvdata(pdev); +-- +2.39.2 + diff --git a/queue-6.4/tcp-annotate-data-races-in-__tcp_oow_rate_limited.patch b/queue-6.4/tcp-annotate-data-races-in-__tcp_oow_rate_limited.patch new file mode 100644 index 00000000000..bb50b8a5dac --- /dev/null +++ b/queue-6.4/tcp-annotate-data-races-in-__tcp_oow_rate_limited.patch @@ -0,0 +1,55 @@ +From 876a4f0035d10e9ca90b89461192ed9a2a6c7588 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Jun 2023 16:41:50 +0000 +Subject: tcp: annotate data races in __tcp_oow_rate_limited() + +From: Eric Dumazet + +[ Upstream commit 998127cdb4699b9d470a9348ffe9f1154346be5f ] + +request sockets are lockless, __tcp_oow_rate_limited() could be called +on the same object from different cpus. This is harmless. + +Add READ_ONCE()/WRITE_ONCE() annotations to avoid a KCSAN report. + +Fixes: 4ce7e93cb3fe ("tcp: rate limit ACK sent by SYN_RECV request sockets") +Signed-off-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_input.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index bf8b22218dd46..57f1e4883b761 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -3590,8 +3590,11 @@ static int tcp_ack_update_window(struct sock *sk, const struct sk_buff *skb, u32 + static bool __tcp_oow_rate_limited(struct net *net, int mib_idx, + u32 *last_oow_ack_time) + { +- if (*last_oow_ack_time) { +- s32 elapsed = (s32)(tcp_jiffies32 - *last_oow_ack_time); ++ /* Paired with the WRITE_ONCE() in this function. */ ++ u32 val = READ_ONCE(*last_oow_ack_time); ++ ++ if (val) { ++ s32 elapsed = (s32)(tcp_jiffies32 - val); + + if (0 <= elapsed && + elapsed < READ_ONCE(net->ipv4.sysctl_tcp_invalid_ratelimit)) { +@@ -3600,7 +3603,10 @@ static bool __tcp_oow_rate_limited(struct net *net, int mib_idx, + } + } + +- *last_oow_ack_time = tcp_jiffies32; ++ /* Paired with the prior READ_ONCE() and with itself, ++ * as we might be lockless. ++ */ ++ WRITE_ONCE(*last_oow_ack_time, tcp_jiffies32); + + return false; /* not rate-limited: go ahead, send dupack now! */ + } +-- +2.39.2 + diff --git a/queue-6.4/test_firmware-return-enomem-instead-of-enospc-on-fai.patch b/queue-6.4/test_firmware-return-enomem-instead-of-enospc-on-fai.patch new file mode 100644 index 00000000000..a85d934b157 --- /dev/null +++ b/queue-6.4/test_firmware-return-enomem-instead-of-enospc-on-fai.patch @@ -0,0 +1,111 @@ +From 5b43e8bb70637956654b94c6d841559cbc7c26c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Jun 2023 09:08:10 +0200 +Subject: test_firmware: return ENOMEM instead of ENOSPC on failed memory + allocation + +From: Mirsad Goran Todorovac + +[ Upstream commit 7dae593cd226a0bca61201cf85ceb9335cf63682 ] + +In a couple of situations like + + name = kstrndup(buf, count, GFP_KERNEL); + if (!name) + return -ENOSPC; + +the error is not actually "No space left on device", but "Out of memory". + +It is semantically correct to return -ENOMEM in all failed kstrndup() +and kzalloc() cases in this driver, as it is not a problem with disk +space, but with kernel memory allocator failing allocation. + +The semantically correct should be: + + name = kstrndup(buf, count, GFP_KERNEL); + if (!name) + return -ENOMEM; + +Cc: Dan Carpenter +Cc: Takashi Iwai +Cc: Kees Cook +Cc: "Luis R. Rodriguez" +Cc: Scott Branden +Cc: Hans de Goede +Cc: Brian Norris +Fixes: c92316bf8e948 ("test_firmware: add batched firmware tests") +Fixes: 0a8adf584759c ("test: add firmware_class loader test") +Fixes: 548193cba2a7d ("test_firmware: add support for firmware_request_platform") +Fixes: eb910947c82f9 ("test: firmware_class: add asynchronous request trigger") +Fixes: 061132d2b9c95 ("test_firmware: add test custom fallback trigger") +Fixes: 7feebfa487b92 ("test_firmware: add support for request_firmware_into_buf") +Signed-off-by: Mirsad Goran Todorovac +Reviewed-by: Dan Carpenter +Message-ID: <20230606070808.9300-1-mirsad.todorovac@alu.unizg.hr> +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + lib/test_firmware.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/lib/test_firmware.c b/lib/test_firmware.c +index 1d7d480b8eeb3..add4699fc6cd4 100644 +--- a/lib/test_firmware.c ++++ b/lib/test_firmware.c +@@ -214,7 +214,7 @@ static int __kstrncpy(char **dst, const char *name, size_t count, gfp_t gfp) + { + *dst = kstrndup(name, count, gfp); + if (!*dst) +- return -ENOSPC; ++ return -ENOMEM; + return count; + } + +@@ -671,7 +671,7 @@ static ssize_t trigger_request_store(struct device *dev, + + name = kstrndup(buf, count, GFP_KERNEL); + if (!name) +- return -ENOSPC; ++ return -ENOMEM; + + pr_info("loading '%s'\n", name); + +@@ -719,7 +719,7 @@ static ssize_t trigger_request_platform_store(struct device *dev, + + name = kstrndup(buf, count, GFP_KERNEL); + if (!name) +- return -ENOSPC; ++ return -ENOMEM; + + pr_info("inserting test platform fw '%s'\n", name); + efi_embedded_fw.name = name; +@@ -772,7 +772,7 @@ static ssize_t trigger_async_request_store(struct device *dev, + + name = kstrndup(buf, count, GFP_KERNEL); + if (!name) +- return -ENOSPC; ++ return -ENOMEM; + + pr_info("loading '%s'\n", name); + +@@ -817,7 +817,7 @@ static ssize_t trigger_custom_fallback_store(struct device *dev, + + name = kstrndup(buf, count, GFP_KERNEL); + if (!name) +- return -ENOSPC; ++ return -ENOMEM; + + pr_info("loading '%s' using custom fallback mechanism\n", name); + +@@ -868,7 +868,7 @@ static int test_fw_run_batch_request(void *data) + + test_buf = kzalloc(TEST_FIRMWARE_BUF_SIZE, GFP_KERNEL); + if (!test_buf) +- return -ENOSPC; ++ return -ENOMEM; + + if (test_fw_config->partial) + req->rc = request_partial_firmware_into_buf +-- +2.39.2 + diff --git a/queue-6.4/tools-virtio-fix-build-break-for-aarch64.patch b/queue-6.4/tools-virtio-fix-build-break-for-aarch64.patch new file mode 100644 index 00000000000..3eef843a272 --- /dev/null +++ b/queue-6.4/tools-virtio-fix-build-break-for-aarch64.patch @@ -0,0 +1,48 @@ +From 9c8a81cd2105a8ba3bdabc9ce1b162e1ce194b13 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Mar 2023 12:00:24 +0800 +Subject: tools/virtio: fix build break for aarch64 + +From: Peng Fan + +[ Upstream commit 77b894f220cbd04301b3d941df8247106e67f8e4 ] + +"-mfunction-return=thunk -mindirect-branch-register" are only valid +for x86. So introduce compiler operation check to avoid such issues + +Fixes: 0d0ed4006127 ("tools/virtio: enable to build with retpoline") +Signed-off-by: Peng Fan +Message-Id: <20230323040024.3809108-1-peng.fan@oss.nxp.com> +Signed-off-by: Michael S. Tsirkin +Signed-off-by: Sasha Levin +--- + tools/virtio/Makefile | 13 ++++++++++++- + 1 file changed, 12 insertions(+), 1 deletion(-) + +diff --git a/tools/virtio/Makefile b/tools/virtio/Makefile +index 7b7139d97d742..d128925980e05 100644 +--- a/tools/virtio/Makefile ++++ b/tools/virtio/Makefile +@@ -4,7 +4,18 @@ test: virtio_test vringh_test + virtio_test: virtio_ring.o virtio_test.o + vringh_test: vringh_test.o vringh.o virtio_ring.o + +-CFLAGS += -g -O2 -Werror -Wno-maybe-uninitialized -Wall -I. -I../include/ -I ../../usr/include/ -Wno-pointer-sign -fno-strict-overflow -fno-strict-aliasing -fno-common -MMD -U_FORTIFY_SOURCE -include ../../include/linux/kconfig.h -mfunction-return=thunk -fcf-protection=none -mindirect-branch-register ++try-run = $(shell set -e; \ ++ if ($(1)) >/dev/null 2>&1; \ ++ then echo "$(2)"; \ ++ else echo "$(3)"; \ ++ fi) ++ ++__cc-option = $(call try-run,\ ++ $(1) -Werror $(2) -c -x c /dev/null -o /dev/null,$(2),) ++cc-option = $(call __cc-option, $(CC),$(1)) ++ ++CFLAGS += -g -O2 -Werror -Wno-maybe-uninitialized -Wall -I. -I../include/ -I ../../usr/include/ -Wno-pointer-sign -fno-strict-overflow -fno-strict-aliasing -fno-common -MMD -U_FORTIFY_SOURCE -include ../../include/linux/kconfig.h $(call cc-option,-mfunction-return=thunk) $(call cc-option,-fcf-protection=none) $(call cc-option,-mindirect-branch-register) ++ + CFLAGS += -pthread + LDFLAGS += -pthread + vpath %.c ../../drivers/virtio ../../drivers/vhost +-- +2.39.2 + diff --git a/queue-6.4/usb-common-usb-conn-gpio-set-last-role-to-unknown-be.patch b/queue-6.4/usb-common-usb-conn-gpio-set-last-role-to-unknown-be.patch new file mode 100644 index 00000000000..186f089bcf7 --- /dev/null +++ b/queue-6.4/usb-common-usb-conn-gpio-set-last-role-to-unknown-be.patch @@ -0,0 +1,104 @@ +From bcb0b16f0636a6b20c5cd836e804b326ec0a2ed6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 May 2023 20:11:14 +0530 +Subject: usb: common: usb-conn-gpio: Set last role to unknown before initial + detection + +From: Prashanth K + +[ Upstream commit edd60d24bd858cef165274e4cd6cab43bdc58d15 ] + +Currently if we bootup a device without cable connected, then +usb-conn-gpio won't call set_role() since last_role is same as +current role. This happens because during probe last_role gets +initialised to zero. + +To avoid this, added a new constant in enum usb_role, last_role +is set to USB_ROLE_UNKNOWN before performing initial detection. + +While at it, also handle default case for the usb_role switch +in cdns3, intel-xhci-usb-role-switch & musb/jz4740 to avoid +build warnings. + +Fixes: 4602f3bff266 ("usb: common: add USB GPIO based connection detection driver") +Signed-off-by: Prashanth K +Reviewed-by: AngeloGioacchino Del Regno +Message-ID: <1685544074-17337-1-git-send-email-quic_prashk@quicinc.com> +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/cdns3/core.c | 2 ++ + drivers/usb/common/usb-conn-gpio.c | 3 +++ + drivers/usb/musb/jz4740.c | 2 ++ + drivers/usb/roles/intel-xhci-usb-role-switch.c | 2 ++ + include/linux/usb/role.h | 1 + + 5 files changed, 10 insertions(+) + +diff --git a/drivers/usb/cdns3/core.c b/drivers/usb/cdns3/core.c +index dbcdf3b24b477..69d2921f2d3b5 100644 +--- a/drivers/usb/cdns3/core.c ++++ b/drivers/usb/cdns3/core.c +@@ -252,6 +252,8 @@ static enum usb_role cdns_hw_role_state_machine(struct cdns *cdns) + if (!vbus) + role = USB_ROLE_NONE; + break; ++ default: ++ break; + } + + dev_dbg(cdns->dev, "role %d -> %d\n", cdns->role, role); +diff --git a/drivers/usb/common/usb-conn-gpio.c b/drivers/usb/common/usb-conn-gpio.c +index e20874caba363..30bdb81934bc8 100644 +--- a/drivers/usb/common/usb-conn-gpio.c ++++ b/drivers/usb/common/usb-conn-gpio.c +@@ -257,6 +257,9 @@ static int usb_conn_probe(struct platform_device *pdev) + platform_set_drvdata(pdev, info); + device_set_wakeup_capable(&pdev->dev, true); + ++ /* Set last role to unknown before performing the initial detection */ ++ info->last_role = USB_ROLE_UNKNOWN; ++ + /* Perform initial detection */ + usb_conn_queue_dwork(info, 0); + +diff --git a/drivers/usb/musb/jz4740.c b/drivers/usb/musb/jz4740.c +index 5aabdd7e2511d..6d880c4cce36e 100644 +--- a/drivers/usb/musb/jz4740.c ++++ b/drivers/usb/musb/jz4740.c +@@ -95,6 +95,8 @@ static int jz4740_musb_role_switch_set(struct usb_role_switch *sw, + case USB_ROLE_HOST: + atomic_notifier_call_chain(&phy->notifier, USB_EVENT_ID, phy); + break; ++ default: ++ break; + } + + return 0; +diff --git a/drivers/usb/roles/intel-xhci-usb-role-switch.c b/drivers/usb/roles/intel-xhci-usb-role-switch.c +index 5c96e929acea0..4d6a3dd06e011 100644 +--- a/drivers/usb/roles/intel-xhci-usb-role-switch.c ++++ b/drivers/usb/roles/intel-xhci-usb-role-switch.c +@@ -97,6 +97,8 @@ static int intel_xhci_usb_set_role(struct usb_role_switch *sw, + val |= SW_VBUS_VALID; + drd_config = DRD_CONFIG_STATIC_DEVICE; + break; ++ default: ++ break; + } + val |= SW_IDPIN_EN; + if (data->enable_sw_switch) { +diff --git a/include/linux/usb/role.h b/include/linux/usb/role.h +index b5deafd91f67b..65e790a28913e 100644 +--- a/include/linux/usb/role.h ++++ b/include/linux/usb/role.h +@@ -11,6 +11,7 @@ enum usb_role { + USB_ROLE_NONE, + USB_ROLE_HOST, + USB_ROLE_DEVICE, ++ USB_ROLE_UNKNOWN, + }; + + typedef int (*usb_role_switch_set_t)(struct usb_role_switch *sw, +-- +2.39.2 + diff --git a/queue-6.4/usb-dwc2-fix-some-error-handling-paths.patch b/queue-6.4/usb-dwc2-fix-some-error-handling-paths.patch new file mode 100644 index 00000000000..fe120d50f1b --- /dev/null +++ b/queue-6.4/usb-dwc2-fix-some-error-handling-paths.patch @@ -0,0 +1,81 @@ +From 93a73e221bca0f8d682378a48cb78512a5406d10 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 May 2023 19:15:08 +0200 +Subject: usb: dwc2: Fix some error handling paths + +From: Christophe JAILLET + +[ Upstream commit ada050c69108bc34be13ecc11f7fad0f20ebadc4 ] + +dwc2_driver_probe() calls dwc2_lowlevel_hw_init() which deassert some reset +lines. +Should an error happen in dwc2_lowlevel_hw_init() after calling +reset_control_deassert() or in the probe after calling +dwc2_lowlevel_hw_init(), the reset lines remain deasserted. + +Add some devm_add_action_or_reset() calls to re-assert the lines if needed. + +Update the remove function accordingly. + +This change is compile-tested only. + +Fixes: 83f8da562f8b ("usb: dwc2: Add reset control to dwc2") +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/c64537b5339342bd00f7c2152b8fc23792b9f95a.1683306479.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc2/platform.c | 16 +++++++++++++--- + 1 file changed, 13 insertions(+), 3 deletions(-) + +diff --git a/drivers/usb/dwc2/platform.c b/drivers/usb/dwc2/platform.c +index 5aee284018c00..5cf025511cce6 100644 +--- a/drivers/usb/dwc2/platform.c ++++ b/drivers/usb/dwc2/platform.c +@@ -203,6 +203,11 @@ int dwc2_lowlevel_hw_disable(struct dwc2_hsotg *hsotg) + return ret; + } + ++static void dwc2_reset_control_assert(void *data) ++{ ++ reset_control_assert(data); ++} ++ + static int dwc2_lowlevel_hw_init(struct dwc2_hsotg *hsotg) + { + int i, ret; +@@ -213,6 +218,10 @@ static int dwc2_lowlevel_hw_init(struct dwc2_hsotg *hsotg) + "error getting reset control\n"); + + reset_control_deassert(hsotg->reset); ++ ret = devm_add_action_or_reset(hsotg->dev, dwc2_reset_control_assert, ++ hsotg->reset); ++ if (ret) ++ return ret; + + hsotg->reset_ecc = devm_reset_control_get_optional(hsotg->dev, "dwc2-ecc"); + if (IS_ERR(hsotg->reset_ecc)) +@@ -220,6 +229,10 @@ static int dwc2_lowlevel_hw_init(struct dwc2_hsotg *hsotg) + "error getting reset control for ecc\n"); + + reset_control_deassert(hsotg->reset_ecc); ++ ret = devm_add_action_or_reset(hsotg->dev, dwc2_reset_control_assert, ++ hsotg->reset_ecc); ++ if (ret) ++ return ret; + + /* + * Attempt to find a generic PHY, then look for an old style +@@ -339,9 +352,6 @@ static int dwc2_driver_remove(struct platform_device *dev) + if (hsotg->ll_hw_enabled) + dwc2_lowlevel_hw_disable(hsotg); + +- reset_control_assert(hsotg->reset); +- reset_control_assert(hsotg->reset_ecc); +- + return 0; + } + +-- +2.39.2 + diff --git a/queue-6.4/usb-dwc3-meson-g12a-fix-an-error-handling-path-in-dw.patch b/queue-6.4/usb-dwc3-meson-g12a-fix-an-error-handling-path-in-dw.patch new file mode 100644 index 00000000000..394cf91fe55 --- /dev/null +++ b/queue-6.4/usb-dwc3-meson-g12a-fix-an-error-handling-path-in-dw.patch @@ -0,0 +1,51 @@ +From 76e64e6f2a5fa54ac7fb9481c56ca6ddb7fd1ed4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Jun 2023 15:32:52 +0200 +Subject: usb: dwc3-meson-g12a: Fix an error handling path in + dwc3_meson_g12a_probe() + +From: Christophe JAILLET + +[ Upstream commit 01052b91c9808e3c3b068ae2721cb728ec9aa4c0 ] + +If dwc3_meson_g12a_otg_init() fails, resources allocated by the previous +of_platform_populate() call should be released, as already done in the +error handling path. + +Fixes: 1e355f21d3fb ("usb: dwc3: Add Amlogic A1 DWC3 glue") +Signed-off-by: Christophe JAILLET +Reviewed-by: Martin Blumenstingl +Reviewed-by: Neil Armstrong +Message-ID: <9d28466de1808ccc756b4cc25fc72c482d133d13.1686403934.git.christophe.jaillet@wanadoo.fr> +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc3/dwc3-meson-g12a.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/usb/dwc3/dwc3-meson-g12a.c b/drivers/usb/dwc3/dwc3-meson-g12a.c +index b282ad0e69c6d..eaea944ebd2ce 100644 +--- a/drivers/usb/dwc3/dwc3-meson-g12a.c ++++ b/drivers/usb/dwc3/dwc3-meson-g12a.c +@@ -805,7 +805,7 @@ static int dwc3_meson_g12a_probe(struct platform_device *pdev) + + ret = dwc3_meson_g12a_otg_init(pdev, priv); + if (ret) +- goto err_phys_power; ++ goto err_plat_depopulate; + + pm_runtime_set_active(dev); + pm_runtime_enable(dev); +@@ -813,6 +813,9 @@ static int dwc3_meson_g12a_probe(struct platform_device *pdev) + + return 0; + ++err_plat_depopulate: ++ of_platform_depopulate(dev); ++ + err_phys_power: + for (i = 0 ; i < PHY_COUNT ; ++i) + phy_power_off(priv->phys[i]); +-- +2.39.2 + diff --git a/queue-6.4/usb-dwc3-qcom-fix-an-error-handling-path-in-dwc3_qco.patch b/queue-6.4/usb-dwc3-qcom-fix-an-error-handling-path-in-dwc3_qco.patch new file mode 100644 index 00000000000..ebd6d791326 --- /dev/null +++ b/queue-6.4/usb-dwc3-qcom-fix-an-error-handling-path-in-dwc3_qco.patch @@ -0,0 +1,43 @@ +From bcb76a1048a16c1ada04c3cc9fe901a7d3af9a74 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 4 Jun 2023 16:56:34 +0200 +Subject: usb: dwc3: qcom: Fix an error handling path in dwc3_qcom_probe() + +From: Christophe JAILLET + +[ Upstream commit 4a944da707123686d372ec01ea60056902fadf35 ] + +If dwc3_qcom_create_urs_usb_platdev() fails, some resources still need to +be released, as already done in the other error handling path of the +probe. + +Fixes: c25c210f590e ("usb: dwc3: qcom: add URS Host support for sdm845 ACPI boot") +Signed-off-by: Christophe JAILLET +Reviewed-by: Andrew Halaney +Message-ID: +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc3/dwc3-qcom.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/usb/dwc3/dwc3-qcom.c b/drivers/usb/dwc3/dwc3-qcom.c +index 9c01e963ae467..72c22851d7eef 100644 +--- a/drivers/usb/dwc3/dwc3-qcom.c ++++ b/drivers/usb/dwc3/dwc3-qcom.c +@@ -865,9 +865,10 @@ static int dwc3_qcom_probe(struct platform_device *pdev) + if (IS_ERR_OR_NULL(qcom->urs_usb)) { + dev_err(dev, "failed to create URS USB platdev\n"); + if (!qcom->urs_usb) +- return -ENODEV; ++ ret = -ENODEV; + else +- return PTR_ERR(qcom->urs_usb); ++ ret = PTR_ERR(qcom->urs_usb); ++ goto clk_disable; + } + } + } +-- +2.39.2 + diff --git a/queue-6.4/usb-dwc3-qcom-fix-potential-memory-leak.patch b/queue-6.4/usb-dwc3-qcom-fix-potential-memory-leak.patch new file mode 100644 index 00000000000..6ceb16de6f7 --- /dev/null +++ b/queue-6.4/usb-dwc3-qcom-fix-potential-memory-leak.patch @@ -0,0 +1,53 @@ +From 6e4aa24ff85ab7aab2b6871c8eb48d0ec875f8ff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 May 2023 20:25:18 +0300 +Subject: usb: dwc3: qcom: Fix potential memory leak + +From: Vladislav Efanov + +[ Upstream commit 097fb3ee710d4de83b8d4f5589e8ee13e0f0541e ] + +Function dwc3_qcom_probe() allocates memory for resource structure +which is pointed by parent_res pointer. This memory is not +freed. This leads to memory leak. Use stack memory to prevent +memory leak. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 2bc02355f8ba ("usb: dwc3: qcom: Add support for booting with ACPI") +Signed-off-by: Vladislav Efanov +Acked-by: Shawn Guo +Link: https://lore.kernel.org/r/20230517172518.442591-1-VEfanov@ispras.ru +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc3/dwc3-qcom.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/usb/dwc3/dwc3-qcom.c b/drivers/usb/dwc3/dwc3-qcom.c +index 79b22abf97276..482260182d656 100644 +--- a/drivers/usb/dwc3/dwc3-qcom.c ++++ b/drivers/usb/dwc3/dwc3-qcom.c +@@ -800,6 +800,7 @@ static int dwc3_qcom_probe(struct platform_device *pdev) + struct device *dev = &pdev->dev; + struct dwc3_qcom *qcom; + struct resource *res, *parent_res = NULL; ++ struct resource local_res; + int ret, i; + bool ignore_pipe_clk; + bool wakeup_source; +@@ -851,9 +852,8 @@ static int dwc3_qcom_probe(struct platform_device *pdev) + if (np) { + parent_res = res; + } else { +- parent_res = kmemdup(res, sizeof(struct resource), GFP_KERNEL); +- if (!parent_res) +- return -ENOMEM; ++ memcpy(&local_res, res, sizeof(struct resource)); ++ parent_res = &local_res; + + parent_res->start = res->start + + qcom->acpi_pdata->qscratch_base_offset; +-- +2.39.2 + diff --git a/queue-6.4/usb-dwc3-qcom-release-the-correct-resources-in-dwc3_.patch b/queue-6.4/usb-dwc3-qcom-release-the-correct-resources-in-dwc3_.patch new file mode 100644 index 00000000000..06efc192db6 --- /dev/null +++ b/queue-6.4/usb-dwc3-qcom-release-the-correct-resources-in-dwc3_.patch @@ -0,0 +1,50 @@ +From 05f62516175c584a75ab16a792f736b22df9d1d7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 4 Jun 2023 17:04:37 +0200 +Subject: usb: dwc3: qcom: Release the correct resources in dwc3_qcom_remove() + +From: Christophe JAILLET + +[ Upstream commit 8fd95da2cfb5046c4bb5a3cdc9eb7963ba8b10dd ] + +In the probe, some resources are allocated with +dwc3_qcom_of_register_core() or dwc3_qcom_acpi_register_core(). The +corresponding resources are already coorectly freed in the error handling +path of the probe, but not in the remove function. + +Fix it. + +Fixes: 2bc02355f8ba ("usb: dwc3: qcom: Add support for booting with ACPI") +Signed-off-by: Christophe JAILLET +Reviewed-by: Andrew Halaney +Message-ID: +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc3/dwc3-qcom.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/usb/dwc3/dwc3-qcom.c b/drivers/usb/dwc3/dwc3-qcom.c +index 482260182d656..9c01e963ae467 100644 +--- a/drivers/usb/dwc3/dwc3-qcom.c ++++ b/drivers/usb/dwc3/dwc3-qcom.c +@@ -950,11 +950,15 @@ static int dwc3_qcom_probe(struct platform_device *pdev) + static int dwc3_qcom_remove(struct platform_device *pdev) + { + struct dwc3_qcom *qcom = platform_get_drvdata(pdev); ++ struct device_node *np = pdev->dev.of_node; + struct device *dev = &pdev->dev; + int i; + + device_remove_software_node(&qcom->dwc3->dev); +- of_platform_depopulate(dev); ++ if (np) ++ of_platform_depopulate(&pdev->dev); ++ else ++ platform_device_put(pdev); + + for (i = qcom->num_clocks - 1; i >= 0; i--) { + clk_disable_unprepare(qcom->clks[i]); +-- +2.39.2 + diff --git a/queue-6.4/usb-extend-pci-resume-function-to-handle-pm-events.patch b/queue-6.4/usb-extend-pci-resume-function-to-handle-pm-events.patch new file mode 100644 index 00000000000..8cf9286cc35 --- /dev/null +++ b/queue-6.4/usb-extend-pci-resume-function-to-handle-pm-events.patch @@ -0,0 +1,320 @@ +From 878ea5d60ed9db19c5be557cc71aa7888d7ec0ad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Apr 2023 19:30:55 +0530 +Subject: USB: Extend pci resume function to handle PM events + +From: Basavaraj Natikar + +[ Upstream commit 1f7d5520719dd1fed1a2947679f6cc26a55f1e6b ] + +Currently, the pci_resume method has only a flag indicating whether the +system is resuming from hibernation. In order to handle all PM events like +AUTO_RESUME (runtime resume from device in D3), RESUME (system resume from +s2idle, S3 or S4 states) etc change the pci_resume method to handle all PM +events. + +Signed-off-by: Basavaraj Natikar +Acked-by: Alan Stern +Acked-by: Mathias Nyman +Link: https://lore.kernel.org/r/20230428140056.1318981-2-Basavaraj.Natikar@amd.com +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: 1c024241d018 ("xhci: Improve the XHCI system resume time") +Signed-off-by: Sasha Levin +--- + drivers/usb/core/hcd-pci.c | 24 +++++++++++++----------- + drivers/usb/host/ehci-pci.c | 3 ++- + drivers/usb/host/ohci-pci.c | 8 +++++++- + drivers/usb/host/uhci-pci.c | 7 ++++--- + drivers/usb/host/xhci-histb.c | 2 +- + drivers/usb/host/xhci-pci.c | 4 ++-- + drivers/usb/host/xhci-plat.c | 4 ++-- + drivers/usb/host/xhci-tegra.c | 2 +- + drivers/usb/host/xhci.c | 3 ++- + drivers/usb/host/xhci.h | 2 +- + include/linux/usb/hcd.h | 2 +- + 11 files changed, 36 insertions(+), 25 deletions(-) + +diff --git a/drivers/usb/core/hcd-pci.c b/drivers/usb/core/hcd-pci.c +index ab2f3737764e4..990280688b254 100644 +--- a/drivers/usb/core/hcd-pci.c ++++ b/drivers/usb/core/hcd-pci.c +@@ -415,12 +415,15 @@ static int check_root_hub_suspended(struct device *dev) + return 0; + } + +-static int suspend_common(struct device *dev, bool do_wakeup) ++static int suspend_common(struct device *dev, pm_message_t msg) + { + struct pci_dev *pci_dev = to_pci_dev(dev); + struct usb_hcd *hcd = pci_get_drvdata(pci_dev); ++ bool do_wakeup; + int retval; + ++ do_wakeup = PMSG_IS_AUTO(msg) ? true : device_may_wakeup(dev); ++ + /* Root hub suspend should have stopped all downstream traffic, + * and all bus master traffic. And done so for both the interface + * and the stub usb_device (which we check here). But maybe it +@@ -447,7 +450,7 @@ static int suspend_common(struct device *dev, bool do_wakeup) + (retval == 0 && do_wakeup && hcd->shared_hcd && + HCD_WAKEUP_PENDING(hcd->shared_hcd))) { + if (hcd->driver->pci_resume) +- hcd->driver->pci_resume(hcd, false); ++ hcd->driver->pci_resume(hcd, msg); + retval = -EBUSY; + } + if (retval) +@@ -470,7 +473,7 @@ static int suspend_common(struct device *dev, bool do_wakeup) + return retval; + } + +-static int resume_common(struct device *dev, int event) ++static int resume_common(struct device *dev, pm_message_t msg) + { + struct pci_dev *pci_dev = to_pci_dev(dev); + struct usb_hcd *hcd = pci_get_drvdata(pci_dev); +@@ -498,12 +501,11 @@ static int resume_common(struct device *dev, int event) + * No locking is needed because PCI controller drivers do not + * get unbound during system resume. + */ +- if (pci_dev->class == CL_EHCI && event != PM_EVENT_AUTO_RESUME) ++ if (pci_dev->class == CL_EHCI && msg.event != PM_EVENT_AUTO_RESUME) + for_each_companion(pci_dev, hcd, + ehci_wait_for_companions); + +- retval = hcd->driver->pci_resume(hcd, +- event == PM_EVENT_RESTORE); ++ retval = hcd->driver->pci_resume(hcd, msg); + if (retval) { + dev_err(dev, "PCI post-resume error %d!\n", retval); + usb_hc_died(hcd); +@@ -516,7 +518,7 @@ static int resume_common(struct device *dev, int event) + + static int hcd_pci_suspend(struct device *dev) + { +- return suspend_common(dev, device_may_wakeup(dev)); ++ return suspend_common(dev, PMSG_SUSPEND); + } + + static int hcd_pci_suspend_noirq(struct device *dev) +@@ -577,12 +579,12 @@ static int hcd_pci_resume_noirq(struct device *dev) + + static int hcd_pci_resume(struct device *dev) + { +- return resume_common(dev, PM_EVENT_RESUME); ++ return resume_common(dev, PMSG_RESUME); + } + + static int hcd_pci_restore(struct device *dev) + { +- return resume_common(dev, PM_EVENT_RESTORE); ++ return resume_common(dev, PMSG_RESTORE); + } + + #else +@@ -600,7 +602,7 @@ static int hcd_pci_runtime_suspend(struct device *dev) + { + int retval; + +- retval = suspend_common(dev, true); ++ retval = suspend_common(dev, PMSG_AUTO_SUSPEND); + if (retval == 0) + powermac_set_asic(to_pci_dev(dev), 0); + dev_dbg(dev, "hcd_pci_runtime_suspend: %d\n", retval); +@@ -612,7 +614,7 @@ static int hcd_pci_runtime_resume(struct device *dev) + int retval; + + powermac_set_asic(to_pci_dev(dev), 1); +- retval = resume_common(dev, PM_EVENT_AUTO_RESUME); ++ retval = resume_common(dev, PMSG_AUTO_RESUME); + dev_dbg(dev, "hcd_pci_runtime_resume: %d\n", retval); + return retval; + } +diff --git a/drivers/usb/host/ehci-pci.c b/drivers/usb/host/ehci-pci.c +index 4b148fe5e43b2..889dc44262711 100644 +--- a/drivers/usb/host/ehci-pci.c ++++ b/drivers/usb/host/ehci-pci.c +@@ -354,10 +354,11 @@ static int ehci_pci_setup(struct usb_hcd *hcd) + * Also they depend on separate root hub suspend/resume. + */ + +-static int ehci_pci_resume(struct usb_hcd *hcd, bool hibernated) ++static int ehci_pci_resume(struct usb_hcd *hcd, pm_message_t msg) + { + struct ehci_hcd *ehci = hcd_to_ehci(hcd); + struct pci_dev *pdev = to_pci_dev(hcd->self.controller); ++ bool hibernated = (msg.event == PM_EVENT_RESTORE); + + if (ehci_resume(hcd, hibernated) != 0) + (void) ehci_pci_reinit(ehci, pdev); +diff --git a/drivers/usb/host/ohci-pci.c b/drivers/usb/host/ohci-pci.c +index d7b4f40f9ff4e..900ea0d368e03 100644 +--- a/drivers/usb/host/ohci-pci.c ++++ b/drivers/usb/host/ohci-pci.c +@@ -301,6 +301,12 @@ static struct pci_driver ohci_pci_driver = { + #endif + }; + ++#ifdef CONFIG_PM ++static int ohci_pci_resume(struct usb_hcd *hcd, pm_message_t msg) ++{ ++ return ohci_resume(hcd, msg.event == PM_EVENT_RESTORE); ++} ++#endif + static int __init ohci_pci_init(void) + { + if (usb_disabled()) +@@ -311,7 +317,7 @@ static int __init ohci_pci_init(void) + #ifdef CONFIG_PM + /* Entries for the PCI suspend/resume callbacks are special */ + ohci_pci_hc_driver.pci_suspend = ohci_suspend; +- ohci_pci_hc_driver.pci_resume = ohci_resume; ++ ohci_pci_hc_driver.pci_resume = ohci_pci_resume; + #endif + + return pci_register_driver(&ohci_pci_driver); +diff --git a/drivers/usb/host/uhci-pci.c b/drivers/usb/host/uhci-pci.c +index 7bd2fddde770a..5edf6a08cf82c 100644 +--- a/drivers/usb/host/uhci-pci.c ++++ b/drivers/usb/host/uhci-pci.c +@@ -169,7 +169,7 @@ static void uhci_shutdown(struct pci_dev *pdev) + + #ifdef CONFIG_PM + +-static int uhci_pci_resume(struct usb_hcd *hcd, bool hibernated); ++static int uhci_pci_resume(struct usb_hcd *hcd, pm_message_t state); + + static int uhci_pci_suspend(struct usb_hcd *hcd, bool do_wakeup) + { +@@ -204,14 +204,15 @@ static int uhci_pci_suspend(struct usb_hcd *hcd, bool do_wakeup) + + /* Check for race with a wakeup request */ + if (do_wakeup && HCD_WAKEUP_PENDING(hcd)) { +- uhci_pci_resume(hcd, false); ++ uhci_pci_resume(hcd, PMSG_SUSPEND); + rc = -EBUSY; + } + return rc; + } + +-static int uhci_pci_resume(struct usb_hcd *hcd, bool hibernated) ++static int uhci_pci_resume(struct usb_hcd *hcd, pm_message_t msg) + { ++ bool hibernated = (msg.event == PM_EVENT_RESTORE); + struct uhci_hcd *uhci = hcd_to_uhci(hcd); + + dev_dbg(uhci_dev(uhci), "%s\n", __func__); +diff --git a/drivers/usb/host/xhci-histb.c b/drivers/usb/host/xhci-histb.c +index 08369857686e7..91ce97821de51 100644 +--- a/drivers/usb/host/xhci-histb.c ++++ b/drivers/usb/host/xhci-histb.c +@@ -367,7 +367,7 @@ static int __maybe_unused xhci_histb_resume(struct device *dev) + if (!device_may_wakeup(dev)) + xhci_histb_host_enable(histb); + +- return xhci_resume(xhci, 0); ++ return xhci_resume(xhci, PMSG_RESUME); + } + + static const struct dev_pm_ops xhci_histb_pm_ops = { +diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c +index 79b3691f373f3..69a5cb7eba381 100644 +--- a/drivers/usb/host/xhci-pci.c ++++ b/drivers/usb/host/xhci-pci.c +@@ -832,7 +832,7 @@ static int xhci_pci_suspend(struct usb_hcd *hcd, bool do_wakeup) + return ret; + } + +-static int xhci_pci_resume(struct usb_hcd *hcd, bool hibernated) ++static int xhci_pci_resume(struct usb_hcd *hcd, pm_message_t msg) + { + struct xhci_hcd *xhci = hcd_to_xhci(hcd); + struct pci_dev *pdev = to_pci_dev(hcd->self.controller); +@@ -867,7 +867,7 @@ static int xhci_pci_resume(struct usb_hcd *hcd, bool hibernated) + if (xhci->quirks & XHCI_PME_STUCK_QUIRK) + xhci_pme_quirk(hcd); + +- retval = xhci_resume(xhci, hibernated); ++ retval = xhci_resume(xhci, msg); + return retval; + } + +diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c +index b0c8e8efc43b6..f36633fa83624 100644 +--- a/drivers/usb/host/xhci-plat.c ++++ b/drivers/usb/host/xhci-plat.c +@@ -478,7 +478,7 @@ static int __maybe_unused xhci_plat_resume(struct device *dev) + if (ret) + return ret; + +- ret = xhci_resume(xhci, 0); ++ ret = xhci_resume(xhci, PMSG_RESUME); + if (ret) + return ret; + +@@ -507,7 +507,7 @@ static int __maybe_unused xhci_plat_runtime_resume(struct device *dev) + struct usb_hcd *hcd = dev_get_drvdata(dev); + struct xhci_hcd *xhci = hcd_to_xhci(hcd); + +- return xhci_resume(xhci, 0); ++ return xhci_resume(xhci, PMSG_AUTO_RESUME); + } + + const struct dev_pm_ops xhci_plat_pm_ops = { +diff --git a/drivers/usb/host/xhci-tegra.c b/drivers/usb/host/xhci-tegra.c +index c75d932441436..8a9c7deb7686e 100644 +--- a/drivers/usb/host/xhci-tegra.c ++++ b/drivers/usb/host/xhci-tegra.c +@@ -2272,7 +2272,7 @@ static int tegra_xusb_exit_elpg(struct tegra_xusb *tegra, bool runtime) + if (wakeup) + tegra_xhci_disable_phy_sleepwalk(tegra); + +- err = xhci_resume(xhci, 0); ++ err = xhci_resume(xhci, runtime ? PMSG_AUTO_RESUME : PMSG_RESUME); + if (err < 0) { + dev_err(tegra->dev, "failed to resume XHCI: %d\n", err); + goto disable_phy; +diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c +index 78790dc13c5f1..65d54c8a24928 100644 +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -960,8 +960,9 @@ EXPORT_SYMBOL_GPL(xhci_suspend); + * This is called when the machine transition from S3/S4 mode. + * + */ +-int xhci_resume(struct xhci_hcd *xhci, bool hibernated) ++int xhci_resume(struct xhci_hcd *xhci, pm_message_t msg) + { ++ bool hibernated = (msg.event == PM_EVENT_RESTORE); + u32 command, temp = 0; + struct usb_hcd *hcd = xhci_to_hcd(xhci); + int retval = 0; +diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h +index 6b690ec91ff3a..f845c15073ba4 100644 +--- a/drivers/usb/host/xhci.h ++++ b/drivers/usb/host/xhci.h +@@ -2140,7 +2140,7 @@ int xhci_disable_slot(struct xhci_hcd *xhci, u32 slot_id); + int xhci_ext_cap_init(struct xhci_hcd *xhci); + + int xhci_suspend(struct xhci_hcd *xhci, bool do_wakeup); +-int xhci_resume(struct xhci_hcd *xhci, bool hibernated); ++int xhci_resume(struct xhci_hcd *xhci, pm_message_t msg); + + irqreturn_t xhci_irq(struct usb_hcd *hcd); + irqreturn_t xhci_msi_irq(int irq, void *hcd); +diff --git a/include/linux/usb/hcd.h b/include/linux/usb/hcd.h +index 0c7eff91adf4e..4e9623e8492b3 100644 +--- a/include/linux/usb/hcd.h ++++ b/include/linux/usb/hcd.h +@@ -267,7 +267,7 @@ struct hc_driver { + int (*pci_suspend)(struct usb_hcd *hcd, bool do_wakeup); + + /* called after entering D0 (etc), before resuming the hub */ +- int (*pci_resume)(struct usb_hcd *hcd, bool hibernated); ++ int (*pci_resume)(struct usb_hcd *hcd, pm_message_t state); + + /* called just before hibernate final D3 state, allows host to poweroff parts */ + int (*pci_poweroff_late)(struct usb_hcd *hcd, bool do_wakeup); +-- +2.39.2 + diff --git a/queue-6.4/usb-gadget-u_serial-add-null-pointer-check-in-gseria.patch b/queue-6.4/usb-gadget-u_serial-add-null-pointer-check-in-gseria.patch new file mode 100644 index 00000000000..f5096a09082 --- /dev/null +++ b/queue-6.4/usb-gadget-u_serial-add-null-pointer-check-in-gseria.patch @@ -0,0 +1,56 @@ +From 705333452795018e2d679a40c7b792484bcb1dda Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 May 2023 14:48:37 +0530 +Subject: usb: gadget: u_serial: Add null pointer check in gserial_suspend + +From: Prashanth K + +[ Upstream commit 2f6ecb89fe8feb2b60a53325b0eeb9866d88909a ] + +Consider a case where gserial_disconnect has already cleared +gser->ioport. And if gserial_suspend gets called afterwards, +it will lead to accessing of gser->ioport and thus causing +null pointer dereference. + +Avoid this by adding a null pointer check. Added a static +spinlock to prevent gser->ioport from becoming null after +the newly added null pointer check. + +Fixes: aba3a8d01d62 ("usb: gadget: u_serial: add suspend resume callbacks") +Signed-off-by: Prashanth K +Link: https://lore.kernel.org/r/1683278317-11774-1-git-send-email-quic_prashk@quicinc.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/function/u_serial.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +diff --git a/drivers/usb/gadget/function/u_serial.c b/drivers/usb/gadget/function/u_serial.c +index a0ca47fbff0fc..e5d522d54f6a3 100644 +--- a/drivers/usb/gadget/function/u_serial.c ++++ b/drivers/usb/gadget/function/u_serial.c +@@ -1420,10 +1420,19 @@ EXPORT_SYMBOL_GPL(gserial_disconnect); + + void gserial_suspend(struct gserial *gser) + { +- struct gs_port *port = gser->ioport; ++ struct gs_port *port; + unsigned long flags; + +- spin_lock_irqsave(&port->port_lock, flags); ++ spin_lock_irqsave(&serial_port_lock, flags); ++ port = gser->ioport; ++ ++ if (!port) { ++ spin_unlock_irqrestore(&serial_port_lock, flags); ++ return; ++ } ++ ++ spin_lock(&port->port_lock); ++ spin_unlock(&serial_port_lock); + port->suspended = true; + spin_unlock_irqrestore(&port->port_lock, flags); + } +-- +2.39.2 + diff --git a/queue-6.4/usb-hide-unused-usbfs_notify_suspend-resume-function.patch b/queue-6.4/usb-hide-unused-usbfs_notify_suspend-resume-function.patch new file mode 100644 index 00000000000..5b1d17de420 --- /dev/null +++ b/queue-6.4/usb-hide-unused-usbfs_notify_suspend-resume-function.patch @@ -0,0 +1,52 @@ +From 186cb9314d793f656f2e93bfe62c67fd8ca1992d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 May 2023 22:17:42 +0200 +Subject: usb: hide unused usbfs_notify_suspend/resume functions + +From: Arnd Bergmann + +[ Upstream commit 8e6bd945e6dde64fbc60ec3fe252164493a8d3a2 ] + +The declaration is in an #ifdef, which causes warnings when building +with 'make W=1' and without CONFIG_PM: + +drivers/usb/core/devio.c:742:6: error: no previous prototype for 'usbfs_notify_suspend' +drivers/usb/core/devio.c:747:6: error: no previous prototype for 'usbfs_notify_resume' + +Use the same #ifdef check around the function definitions to avoid +the warnings and slightly shrink the USB core. + +Fixes: 7794f486ed0b ("usbfs: Add ioctls for runtime power management") +Signed-off-by: Arnd Bergmann +Reviewed-by: Sebastian Reichel +Acked-by: Alan Stern +Link: https://lore.kernel.org/r/20230516202103.558301-1-arnd@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/core/devio.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c +index fcf68818e9992..cbad2af5fd882 100644 +--- a/drivers/usb/core/devio.c ++++ b/drivers/usb/core/devio.c +@@ -746,6 +746,7 @@ static int driver_resume(struct usb_interface *intf) + return 0; + } + ++#ifdef CONFIG_PM + /* The following routines apply to the entire device, not interfaces */ + void usbfs_notify_suspend(struct usb_device *udev) + { +@@ -764,6 +765,7 @@ void usbfs_notify_resume(struct usb_device *udev) + } + mutex_unlock(&usbfs_mutex); + } ++#endif + + struct usb_driver usbfs_driver = { + .name = "usbfs", +-- +2.39.2 + diff --git a/queue-6.4/usb-misc-eud-fix-eud-sysfs-path-use-qcom_eud.patch b/queue-6.4/usb-misc-eud-fix-eud-sysfs-path-use-qcom_eud.patch new file mode 100644 index 00000000000..1d5757e524c --- /dev/null +++ b/queue-6.4/usb-misc-eud-fix-eud-sysfs-path-use-qcom_eud.patch @@ -0,0 +1,42 @@ +From e16e95bd1c9c03c05ec1948e1cfe5e2716ad49f0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 May 2023 02:47:51 +0530 +Subject: usb: misc: eud: Fix eud sysfs path (use 'qcom_eud') + +From: Bhupesh Sharma + +[ Upstream commit f16135918b5f8b510db014ecf0a069e34c02382e ] + +The eud sysfs enablement path is currently mentioned in the +Documentation as: + /sys/bus/platform/drivers/eud/.../enable + +Instead it should be: + /sys/bus/platform/drivers/qcom_eud/.../enable + +Fix the same. + +Fixes: 9a1bf58ccd44 ("usb: misc: eud: Add driver support for Embedded USB Debugger(EUD)") +Reviewed-by: Konrad Dybcio +Acked-by: Manivannan Sadhasivam +Signed-off-by: Bhupesh Sharma +Link: https://lore.kernel.org/r/20230517211756.2483552-2-bhupesh.sharma@linaro.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + Documentation/ABI/testing/sysfs-driver-eud | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/Documentation/ABI/testing/sysfs-driver-eud b/Documentation/ABI/testing/sysfs-driver-eud +index 83f3872182a40..2bab0db2d2f0f 100644 +--- a/Documentation/ABI/testing/sysfs-driver-eud ++++ b/Documentation/ABI/testing/sysfs-driver-eud +@@ -1,4 +1,4 @@ +-What: /sys/bus/platform/drivers/eud/.../enable ++What: /sys/bus/platform/drivers/qcom_eud/.../enable + Date: February 2022 + Contact: Souradeep Chowdhury + Description: +-- +2.39.2 + diff --git a/queue-6.4/usb-phy-phy-tahvo-fix-memory-leak-in-tahvo_usb_probe.patch b/queue-6.4/usb-phy-phy-tahvo-fix-memory-leak-in-tahvo_usb_probe.patch new file mode 100644 index 00000000000..f89ef0cf0af --- /dev/null +++ b/queue-6.4/usb-phy-phy-tahvo-fix-memory-leak-in-tahvo_usb_probe.patch @@ -0,0 +1,43 @@ +From bfb98ec8a87fb0ae1232d899e2cfebd0f0780428 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Apr 2023 22:08:31 +0800 +Subject: usb: phy: phy-tahvo: fix memory leak in tahvo_usb_probe() + +From: Li Yang + +[ Upstream commit 342161c11403ea00e9febc16baab1d883d589d04 ] + +Smatch reports: +drivers/usb/phy/phy-tahvo.c: tahvo_usb_probe() +warn: missing unwind goto? + +After geting irq, if ret < 0, it will return without error handling to +free memory. +Just add error handling to fix this problem. + +Fixes: 0d45a1373e66 ("usb: phy: tahvo: add IRQ check") +Signed-off-by: Li Yang +Reviewed-by: Dongliang Mu +Link: https://lore.kernel.org/r/20230420140832.9110-1-lidaxian@hust.edu.cn +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/phy/phy-tahvo.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/phy/phy-tahvo.c b/drivers/usb/phy/phy-tahvo.c +index 47562d49dfc1b..5cac31c6029b3 100644 +--- a/drivers/usb/phy/phy-tahvo.c ++++ b/drivers/usb/phy/phy-tahvo.c +@@ -391,7 +391,7 @@ static int tahvo_usb_probe(struct platform_device *pdev) + + tu->irq = ret = platform_get_irq(pdev, 0); + if (ret < 0) +- return ret; ++ goto err_remove_phy; + ret = request_threaded_irq(tu->irq, NULL, tahvo_usb_vbus_interrupt, + IRQF_ONESHOT, + "tahvo-vbus", tu); +-- +2.39.2 + diff --git a/queue-6.4/vduse-fix-null-pointer-dereference.patch b/queue-6.4/vduse-fix-null-pointer-dereference.patch new file mode 100644 index 00000000000..a795eebc691 --- /dev/null +++ b/queue-6.4/vduse-fix-null-pointer-dereference.patch @@ -0,0 +1,94 @@ +From 2d7cf658d4076966bd0521a9972cb0db8552be4e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jun 2023 22:48:51 +0200 +Subject: vduse: fix NULL pointer dereference + +From: Maxime Coquelin + +[ Upstream commit f06cf1e1a503169280467d12d2ec89bf2c30ace7 ] + +vduse_vdpa_set_vq_affinity callback can be called +with NULL value as cpu_mask when deleting the vduse +device. + +This patch resets virtqueue's IRQ affinity mask value +to set all CPUs instead of dereferencing NULL cpu_mask. + +[ 4760.952149] BUG: kernel NULL pointer dereference, address: 0000000000000000 +[ 4760.959110] #PF: supervisor read access in kernel mode +[ 4760.964247] #PF: error_code(0x0000) - not-present page +[ 4760.969385] PGD 0 P4D 0 +[ 4760.971927] Oops: 0000 [#1] PREEMPT SMP PTI +[ 4760.976112] CPU: 13 PID: 2346 Comm: vdpa Not tainted 6.4.0-rc6+ #4 +[ 4760.982291] Hardware name: Dell Inc. PowerEdge R640/0W23H8, BIOS 2.8.1 06/26/2020 +[ 4760.989769] RIP: 0010:memcpy_orig+0xc5/0x130 +[ 4760.994049] Code: 16 f8 4c 89 07 4c 89 4f 08 4c 89 54 17 f0 4c 89 5c 17 f8 c3 cc cc cc cc 66 66 2e 0f 1f 84 00 00 00 00 00 66 90 83 fa 08 72 1b <4c> 8b 06 4c 8b 4c 16 f8 4c 89 07 4c 89 4c 17 f8 c3 cc cc cc cc 66 +[ 4761.012793] RSP: 0018:ffffb1d565abb830 EFLAGS: 00010246 +[ 4761.018020] RAX: ffff9f4bf6b27898 RBX: ffff9f4be23969c0 RCX: ffff9f4bcadf6400 +[ 4761.025152] RDX: 0000000000000008 RSI: 0000000000000000 RDI: ffff9f4bf6b27898 +[ 4761.032286] RBP: 0000000000000000 R08: 0000000000000008 R09: 0000000000000000 +[ 4761.039416] R10: 0000000000000000 R11: 0000000000000600 R12: 0000000000000000 +[ 4761.046549] R13: 0000000000000000 R14: 0000000000000080 R15: ffffb1d565abbb10 +[ 4761.053680] FS: 00007f64c2ec2740(0000) GS:ffff9f635f980000(0000) knlGS:0000000000000000 +[ 4761.061765] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 4761.067513] CR2: 0000000000000000 CR3: 0000001875270006 CR4: 00000000007706e0 +[ 4761.074645] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +[ 4761.081775] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +[ 4761.088909] PKRU: 55555554 +[ 4761.091620] Call Trace: +[ 4761.094074] +[ 4761.096180] ? __die+0x1f/0x70 +[ 4761.099238] ? page_fault_oops+0x171/0x4f0 +[ 4761.103340] ? exc_page_fault+0x7b/0x180 +[ 4761.107265] ? asm_exc_page_fault+0x22/0x30 +[ 4761.111460] ? memcpy_orig+0xc5/0x130 +[ 4761.115126] vduse_vdpa_set_vq_affinity+0x3e/0x50 [vduse] +[ 4761.120533] virtnet_clean_affinity.part.0+0x3d/0x90 [virtio_net] +[ 4761.126635] remove_vq_common+0x1a4/0x250 [virtio_net] +[ 4761.131781] virtnet_remove+0x5d/0x70 [virtio_net] +[ 4761.136580] virtio_dev_remove+0x3a/0x90 +[ 4761.140509] device_release_driver_internal+0x19b/0x200 +[ 4761.145742] bus_remove_device+0xc2/0x130 +[ 4761.149755] device_del+0x158/0x3e0 +[ 4761.153245] ? kernfs_find_ns+0x35/0xc0 +[ 4761.157086] device_unregister+0x13/0x60 +[ 4761.161010] unregister_virtio_device+0x11/0x20 +[ 4761.165543] device_release_driver_internal+0x19b/0x200 +[ 4761.170770] bus_remove_device+0xc2/0x130 +[ 4761.174782] device_del+0x158/0x3e0 +[ 4761.178276] ? __pfx_vdpa_name_match+0x10/0x10 [vdpa] +[ 4761.183336] device_unregister+0x13/0x60 +[ 4761.187260] vdpa_nl_cmd_dev_del_set_doit+0x63/0xe0 [vdpa] + +Fixes: 28f6288eb63d ("vduse: Support set_vq_affinity callback") +Cc: xieyongji@bytedance.com +Signed-off-by: Maxime Coquelin +Message-Id: <20230622204851.318125-1-maxime.coquelin@redhat.com> +Signed-off-by: Michael S. Tsirkin +Acked-by: Jason Wang +Reviewed-by: Xie Yongji +Signed-off-by: Sasha Levin +--- + drivers/vdpa/vdpa_user/vduse_dev.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/vdpa/vdpa_user/vduse_dev.c b/drivers/vdpa/vdpa_user/vduse_dev.c +index 5f5c21674fdce..0d84e6a9c3cca 100644 +--- a/drivers/vdpa/vdpa_user/vduse_dev.c ++++ b/drivers/vdpa/vdpa_user/vduse_dev.c +@@ -726,7 +726,11 @@ static int vduse_vdpa_set_vq_affinity(struct vdpa_device *vdpa, u16 idx, + { + struct vduse_dev *dev = vdpa_to_vduse(vdpa); + +- cpumask_copy(&dev->vqs[idx]->irq_affinity, cpu_mask); ++ if (cpu_mask) ++ cpumask_copy(&dev->vqs[idx]->irq_affinity, cpu_mask); ++ else ++ cpumask_setall(&dev->vqs[idx]->irq_affinity); ++ + return 0; + } + +-- +2.39.2 + diff --git a/queue-6.4/virtio-vdpa-fix-unchecked-call-to-null-set_vq_affini.patch b/queue-6.4/virtio-vdpa-fix-unchecked-call-to-null-set_vq_affini.patch new file mode 100644 index 00000000000..7942d51c615 --- /dev/null +++ b/queue-6.4/virtio-vdpa-fix-unchecked-call-to-null-set_vq_affini.patch @@ -0,0 +1,41 @@ +From a950f379add9efcf3507df24e7b5c08ff599c89a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 May 2023 16:50:52 +0300 +Subject: virtio-vdpa: Fix unchecked call to NULL set_vq_affinity + +From: Dragos Tatulea + +[ Upstream commit fe37efba475375caa2dbc71cb06f53f7086277ef ] + +The referenced patch calls set_vq_affinity without checking if the op is +valid. This patch adds the check. + +Fixes: 3dad56823b53 ("virtio-vdpa: Support interrupt affinity spreading mechanism") +Reviewed-by: Gal Pressman +Signed-off-by: Dragos Tatulea +Message-Id: <20230504135053.2283816-1-dtatulea@nvidia.com> +Signed-off-by: Michael S. Tsirkin +Reviewed-by: Feng Liu +Signed-off-by: Sasha Levin +--- + drivers/virtio/virtio_vdpa.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/virtio/virtio_vdpa.c b/drivers/virtio/virtio_vdpa.c +index eb6aee8c06b2c..989e2d7184ce4 100644 +--- a/drivers/virtio/virtio_vdpa.c ++++ b/drivers/virtio/virtio_vdpa.c +@@ -385,7 +385,9 @@ static int virtio_vdpa_find_vqs(struct virtio_device *vdev, unsigned int nvqs, + err = PTR_ERR(vqs[i]); + goto err_setup_vq; + } +- ops->set_vq_affinity(vdpa, i, &masks[i]); ++ ++ if (ops->set_vq_affinity) ++ ops->set_vq_affinity(vdpa, i, &masks[i]); + } + + cb.callback = virtio_vdpa_config_cb; +-- +2.39.2 + diff --git a/queue-6.4/w1-fix-loop-in-w1_fini.patch b/queue-6.4/w1-fix-loop-in-w1_fini.patch new file mode 100644 index 00000000000..a91b5cdfd7c --- /dev/null +++ b/queue-6.4/w1-fix-loop-in-w1_fini.patch @@ -0,0 +1,43 @@ +From 73e4f1a9a5f4310e13ac2167e74efa86d1ca7937 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 May 2021 17:17:45 +0300 +Subject: w1: fix loop in w1_fini() + +From: Dan Carpenter + +[ Upstream commit 83f3fcf96fcc7e5405b37d9424c7ef26bfa203f8 ] + +The __w1_remove_master_device() function calls: + + list_del(&dev->w1_master_entry); + +So presumably this can cause an endless loop. + +Fixes: 7785925dd8e0 ("[PATCH] w1: cleanups.") +Signed-off-by: Dan Carpenter +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Sasha Levin +--- + drivers/w1/w1.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/w1/w1.c b/drivers/w1/w1.c +index 9d199fed96287..2c766bdc68cc5 100644 +--- a/drivers/w1/w1.c ++++ b/drivers/w1/w1.c +@@ -1263,10 +1263,10 @@ static int __init w1_init(void) + + static void __exit w1_fini(void) + { +- struct w1_master *dev; ++ struct w1_master *dev, *n; + + /* Set netlink removal messages and some cleanup */ +- list_for_each_entry(dev, &w1_masters, w1_master_entry) ++ list_for_each_entry_safe(dev, n, &w1_masters, w1_master_entry) + __w1_remove_master_device(dev); + + w1_fini_netlink(); +-- +2.39.2 + diff --git a/queue-6.4/w1-w1_therm-fix-locking-behavior-in-convert_t.patch b/queue-6.4/w1-w1_therm-fix-locking-behavior-in-convert_t.patch new file mode 100644 index 00000000000..5b3fb8efe82 --- /dev/null +++ b/queue-6.4/w1-w1_therm-fix-locking-behavior-in-convert_t.patch @@ -0,0 +1,91 @@ +From 350fc635494ec8305aa5652e1175b7953ab38fdf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Apr 2023 13:21:52 +0200 +Subject: w1: w1_therm: fix locking behavior in convert_t + +From: Stefan Wahren + +[ Upstream commit dca5480ab7b77a889088ab7cac81934604510ac7 ] + +The commit 67b392f7b8ed ("w1_therm: optimizing temperature read timings") +accidentially inverted the logic for lock handling of the bus mutex. + +Before: + pullup -> release lock before sleep + no pullup -> release lock after sleep + +After: + pullup -> release lock after sleep + no pullup -> release lock before sleep + +This cause spurious measurements of 85 degree (powerup value) on the +Tarragon board with connected 1-w temperature sensor +(w1_therm.w1_strong_pull=0). + +In the meantime a new feature for polling the conversion +completion has been integrated in these branches with +commit 021da53e65fd ("w1: w1_therm: Add sysfs entries to control +conversion time and driver features"). But this feature isn't +available for parasite power mode, so handle this separately. + +Link: https://lore.kernel.org/regressions/2023042645-attentive-amends-7b0b@gregkh/T/ +Fixes: 67b392f7b8ed ("w1_therm: optimizing temperature read timings") +Signed-off-by: Stefan Wahren +Link: https://lore.kernel.org/r/20230427112152.12313-1-stefan.wahren@i2se.com +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Sasha Levin +--- + drivers/w1/slaves/w1_therm.c | 31 ++++++++++++++----------------- + 1 file changed, 14 insertions(+), 17 deletions(-) + +diff --git a/drivers/w1/slaves/w1_therm.c b/drivers/w1/slaves/w1_therm.c +index 067692626cf07..99c58bd9d2df0 100644 +--- a/drivers/w1/slaves/w1_therm.c ++++ b/drivers/w1/slaves/w1_therm.c +@@ -1159,29 +1159,26 @@ static int convert_t(struct w1_slave *sl, struct therm_info *info) + + w1_write_8(dev_master, W1_CONVERT_TEMP); + +- if (strong_pullup) { /*some device need pullup */ ++ if (SLAVE_FEATURES(sl) & W1_THERM_POLL_COMPLETION) { ++ ret = w1_poll_completion(dev_master, W1_POLL_CONVERT_TEMP); ++ if (ret) { ++ dev_dbg(&sl->dev, "%s: Timeout\n", __func__); ++ goto mt_unlock; ++ } ++ mutex_unlock(&dev_master->bus_mutex); ++ } else if (!strong_pullup) { /*no device need pullup */ + sleep_rem = msleep_interruptible(t_conv); + if (sleep_rem != 0) { + ret = -EINTR; + goto mt_unlock; + } + mutex_unlock(&dev_master->bus_mutex); +- } else { /*no device need pullup */ +- if (SLAVE_FEATURES(sl) & W1_THERM_POLL_COMPLETION) { +- ret = w1_poll_completion(dev_master, W1_POLL_CONVERT_TEMP); +- if (ret) { +- dev_dbg(&sl->dev, "%s: Timeout\n", __func__); +- goto mt_unlock; +- } +- mutex_unlock(&dev_master->bus_mutex); +- } else { +- /* Fixed delay */ +- mutex_unlock(&dev_master->bus_mutex); +- sleep_rem = msleep_interruptible(t_conv); +- if (sleep_rem != 0) { +- ret = -EINTR; +- goto dec_refcnt; +- } ++ } else { /*some device need pullup */ ++ mutex_unlock(&dev_master->bus_mutex); ++ sleep_rem = msleep_interruptible(t_conv); ++ if (sleep_rem != 0) { ++ ret = -EINTR; ++ goto dec_refcnt; + } + } + ret = read_scratchpad(sl, info); +-- +2.39.2 + diff --git a/queue-6.4/writeback-account-the-number-of-pages-written-back.patch b/queue-6.4/writeback-account-the-number-of-pages-written-back.patch new file mode 100644 index 00000000000..f23053a72c5 --- /dev/null +++ b/queue-6.4/writeback-account-the-number-of-pages-written-back.patch @@ -0,0 +1,78 @@ +From 878deaa007290b73ff069bb3cd493ace626df12c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Jun 2023 19:55:48 +0100 +Subject: writeback: account the number of pages written back + +From: Matthew Wilcox (Oracle) + +[ Upstream commit 8344a3d44be3d18671e18c4ba23bb03dd21e14ad ] + +nr_to_write is a count of pages, so we need to decrease it by the number +of pages in the folio we just wrote, not by 1. Most callers specify +either LONG_MAX or 1, so are unaffected, but writeback_sb_inodes() might +end up writing 512x as many pages as it asked for. + +Dave added: + +: XFS is the only filesystem this would affect, right? AFAIA, nothing +: else enables large folios and uses writeback through +: write_cache_pages() at this point... +: +: In which case, I'd be surprised if much difference, if any, gets +: noticed by anyone. + +Link: https://lkml.kernel.org/r/20230628185548.981888-1-willy@infradead.org +Fixes: 793917d997df ("mm/readahead: Add large folio readahead") +Signed-off-by: Matthew Wilcox (Oracle) +Reviewed-by: Christoph Hellwig +Cc: Jan Kara +Cc: Dave Chinner +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + mm/page-writeback.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/mm/page-writeback.c b/mm/page-writeback.c +index db79439990073..6faa09f1783b3 100644 +--- a/mm/page-writeback.c ++++ b/mm/page-writeback.c +@@ -2434,6 +2434,7 @@ int write_cache_pages(struct address_space *mapping, + + for (i = 0; i < nr_folios; i++) { + struct folio *folio = fbatch.folios[i]; ++ unsigned long nr; + + done_index = folio->index; + +@@ -2471,6 +2472,7 @@ int write_cache_pages(struct address_space *mapping, + + trace_wbc_writepage(wbc, inode_to_bdi(mapping->host)); + error = writepage(folio, wbc, data); ++ nr = folio_nr_pages(folio); + if (unlikely(error)) { + /* + * Handle errors according to the type of +@@ -2489,8 +2491,7 @@ int write_cache_pages(struct address_space *mapping, + error = 0; + } else if (wbc->sync_mode != WB_SYNC_ALL) { + ret = error; +- done_index = folio->index + +- folio_nr_pages(folio); ++ done_index = folio->index + nr; + done = 1; + break; + } +@@ -2504,7 +2505,8 @@ int write_cache_pages(struct address_space *mapping, + * keep going until we have written all the pages + * we tagged for writeback prior to entering this loop. + */ +- if (--wbc->nr_to_write <= 0 && ++ wbc->nr_to_write -= nr; ++ if (wbc->nr_to_write <= 0 && + wbc->sync_mode == WB_SYNC_NONE) { + done = 1; + break; +-- +2.39.2 + diff --git a/queue-6.4/xhci-improve-the-xhci-system-resume-time.patch b/queue-6.4/xhci-improve-the-xhci-system-resume-time.patch new file mode 100644 index 00000000000..cf21db728fb --- /dev/null +++ b/queue-6.4/xhci-improve-the-xhci-system-resume-time.patch @@ -0,0 +1,47 @@ +From 96546d6f2828d88301ccc5052221e4fb5cc21de4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Apr 2023 19:30:56 +0530 +Subject: xhci: Improve the XHCI system resume time + +From: Basavaraj Natikar + +[ Upstream commit 1c024241d018cf9fc17aa8d95c3fe77d671d7142 ] + +Avoid extra 120ms delay during system resume. + +The xHC controller may signal wake up to 120ms before showing which usb +device caused the wake on the xHC port registers. + +The xhci driver therefore checks for port activity up to 120ms during +resume, making sure that the hub driver can see the port change, and +won't immediately runtime suspend back due to no port activity. + +This is however only needed for runtime resume as system resume will +resume all child hubs and other child usb devices anyway. + +Fixes: 253f588c70f6 ("xhci: Improve detection of device initiated wake signal.") +Signed-off-by: Basavaraj Natikar +Acked-by: Mathias Nyman +Link: https://lore.kernel.org/r/20230428140056.1318981-3-Basavaraj.Natikar@amd.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/host/xhci.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c +index 65d54c8a24928..b81313ffeb768 100644 +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -1117,7 +1117,7 @@ int xhci_resume(struct xhci_hcd *xhci, pm_message_t msg) + * the first wake signalling failed, give it that chance. + */ + pending_portevent = xhci_pending_portevent(xhci); +- if (!pending_portevent) { ++ if (!pending_portevent && msg.event == PM_EVENT_AUTO_RESUME) { + msleep(120); + pending_portevent = xhci_pending_portevent(xhci); + } +-- +2.39.2 + diff --git a/queue-6.4/xsk-honor-so_bindtodevice-on-bind.patch b/queue-6.4/xsk-honor-so_bindtodevice-on-bind.patch new file mode 100644 index 00000000000..396fb4763fe --- /dev/null +++ b/queue-6.4/xsk-honor-so_bindtodevice-on-bind.patch @@ -0,0 +1,101 @@ +From 4fd3910f2b9218996cc6dff025e440a526f3715d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Jul 2023 19:53:29 +0200 +Subject: xsk: Honor SO_BINDTODEVICE on bind + +From: Ilya Maximets + +[ Upstream commit f7306acec9aae9893d15e745c8791124d42ab10a ] + +Initial creation of an AF_XDP socket requires CAP_NET_RAW capability. A +privileged process might create the socket and pass it to a non-privileged +process for later use. However, that process will be able to bind the socket +to any network interface. Even though it will not be able to receive any +traffic without modification of the BPF map, the situation is not ideal. + +Sockets already have a mechanism that can be used to restrict what interface +they can be attached to. That is SO_BINDTODEVICE. + +To change the SO_BINDTODEVICE binding the process will need CAP_NET_RAW. + +Make xsk_bind() honor the SO_BINDTODEVICE in order to allow safer workflow +when non-privileged process is using AF_XDP. + +The intended workflow is following: + + 1. First process creates a bare socket with socket(AF_XDP, ...). + 2. First process loads the XSK program to the interface. + 3. First process adds the socket fd to a BPF map. + 4. First process ties socket fd to a particular interface using + SO_BINDTODEVICE. + 5. First process sends socket fd to a second process. + 6. Second process allocates UMEM. + 7. Second process binds socket to the interface with bind(...). + 8. Second process sends/receives the traffic. + +All the steps above are possible today if the first process is privileged +and the second one has sufficient RLIMIT_MEMLOCK and no capabilities. +However, the second process will be able to bind the socket to any interface +it wants on step 7 and send traffic from it. With the proposed change, the +second process will be able to bind the socket only to a specific interface +chosen by the first process at step 4. + +Fixes: 965a99098443 ("xsk: add support for bind for Rx") +Signed-off-by: Ilya Maximets +Signed-off-by: Daniel Borkmann +Acked-by: Magnus Karlsson +Acked-by: John Fastabend +Acked-by: Jason Wang +Link: https://lore.kernel.org/bpf/20230703175329.3259672-1-i.maximets@ovn.org +Signed-off-by: Sasha Levin +--- + Documentation/networking/af_xdp.rst | 9 +++++++++ + net/xdp/xsk.c | 5 +++++ + 2 files changed, 14 insertions(+) + +diff --git a/Documentation/networking/af_xdp.rst b/Documentation/networking/af_xdp.rst +index 247c6c4127e94..1cc35de336a41 100644 +--- a/Documentation/networking/af_xdp.rst ++++ b/Documentation/networking/af_xdp.rst +@@ -433,6 +433,15 @@ start N bytes into the buffer leaving the first N bytes for the + application to use. The final option is the flags field, but it will + be dealt with in separate sections for each UMEM flag. + ++SO_BINDTODEVICE setsockopt ++-------------------------- ++ ++This is a generic SOL_SOCKET option that can be used to tie AF_XDP ++socket to a particular network interface. It is useful when a socket ++is created by a privileged process and passed to a non-privileged one. ++Once the option is set, kernel will refuse attempts to bind that socket ++to a different interface. Updating the value requires CAP_NET_RAW. ++ + XDP_STATISTICS getsockopt + ------------------------- + +diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c +index cc1e7f15fa731..32dd55b9ce8a8 100644 +--- a/net/xdp/xsk.c ++++ b/net/xdp/xsk.c +@@ -886,6 +886,7 @@ static int xsk_bind(struct socket *sock, struct sockaddr *addr, int addr_len) + struct sock *sk = sock->sk; + struct xdp_sock *xs = xdp_sk(sk); + struct net_device *dev; ++ int bound_dev_if; + u32 flags, qid; + int err = 0; + +@@ -899,6 +900,10 @@ static int xsk_bind(struct socket *sock, struct sockaddr *addr, int addr_len) + XDP_USE_NEED_WAKEUP)) + return -EINVAL; + ++ bound_dev_if = READ_ONCE(sk->sk_bound_dev_if); ++ if (bound_dev_if && bound_dev_if != sxdp->sxdp_ifindex) ++ return -EINVAL; ++ + rtnl_lock(); + mutex_lock(&xs->mutex); + if (xs->state != XSK_READY) { +-- +2.39.2 + -- 2.47.3