]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
5.18-stable patches
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sat, 23 Jul 2022 14:01:49 +0000 (16:01 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sat, 23 Jul 2022 14:01:49 +0000 (16:01 +0200)
added patches:
bus-mhi-host-pci_generic-add-telit-fn980-v1-hardware-revision.patch
bus-mhi-host-pci_generic-add-telit-fn990.patch
drm-amd-display-fix-new-dmub-notification-enabling-in-dm.patch
drm-scheduler-don-t-kill-jobs-in-interrupt-context.patch
drm-ttm-fix-locking-in-vmap-vunmap-ttm-gem-helpers.patch
lockdown-fix-kexec-lockdown-bypass-with-ima-policy.patch
mlxsw-spectrum_router-fix-ipv4-nexthop-gateway-indication.patch
mmc-sdhci-omap-fix-a-lockdep-warning-for-pm-runtime-init.patch
mtd-rawnand-gpmi-set-wait_for_ready-timeout-based-on-program-erase-times.patch
net-usb-ax88179_178a-needs-flag_send_zlp.patch
pinctrl-armada-37xx-use-raw-spinlocks-for-regmap-to-avoid-invalid-wait-context.patch
pinctrl-stm32-fix-optional-irq-support-to-gpios.patch
riscv-add-as-options-for-modules-with-assembly-compontents.patch

19 files changed:
queue-4.14/series [new file with mode: 0644]
queue-4.19/series [new file with mode: 0644]
queue-4.9/series [new file with mode: 0644]
queue-5.10/series [new file with mode: 0644]
queue-5.15/series [new file with mode: 0644]
queue-5.18/bus-mhi-host-pci_generic-add-telit-fn980-v1-hardware-revision.patch [new file with mode: 0644]
queue-5.18/bus-mhi-host-pci_generic-add-telit-fn990.patch [new file with mode: 0644]
queue-5.18/drm-amd-display-fix-new-dmub-notification-enabling-in-dm.patch [new file with mode: 0644]
queue-5.18/drm-scheduler-don-t-kill-jobs-in-interrupt-context.patch [new file with mode: 0644]
queue-5.18/drm-ttm-fix-locking-in-vmap-vunmap-ttm-gem-helpers.patch [new file with mode: 0644]
queue-5.18/lockdown-fix-kexec-lockdown-bypass-with-ima-policy.patch [new file with mode: 0644]
queue-5.18/mlxsw-spectrum_router-fix-ipv4-nexthop-gateway-indication.patch [new file with mode: 0644]
queue-5.18/mmc-sdhci-omap-fix-a-lockdep-warning-for-pm-runtime-init.patch [new file with mode: 0644]
queue-5.18/mtd-rawnand-gpmi-set-wait_for_ready-timeout-based-on-program-erase-times.patch [new file with mode: 0644]
queue-5.18/net-usb-ax88179_178a-needs-flag_send_zlp.patch [new file with mode: 0644]
queue-5.18/pinctrl-armada-37xx-use-raw-spinlocks-for-regmap-to-avoid-invalid-wait-context.patch [new file with mode: 0644]
queue-5.18/pinctrl-stm32-fix-optional-irq-support-to-gpios.patch [new file with mode: 0644]
queue-5.18/riscv-add-as-options-for-modules-with-assembly-compontents.patch [new file with mode: 0644]
queue-5.18/series [new file with mode: 0644]

diff --git a/queue-4.14/series b/queue-4.14/series
new file mode 100644 (file)
index 0000000..e69de29
diff --git a/queue-4.19/series b/queue-4.19/series
new file mode 100644 (file)
index 0000000..e3187f7
--- /dev/null
@@ -0,0 +1 @@
+riscv-add-as-options-for-modules-with-assembly-compontents.patch
diff --git a/queue-4.9/series b/queue-4.9/series
new file mode 100644 (file)
index 0000000..e69de29
diff --git a/queue-5.10/series b/queue-5.10/series
new file mode 100644 (file)
index 0000000..752fa95
--- /dev/null
@@ -0,0 +1,5 @@
+pinctrl-stm32-fix-optional-irq-support-to-gpios.patch
+riscv-add-as-options-for-modules-with-assembly-compontents.patch
+mlxsw-spectrum_router-fix-ipv4-nexthop-gateway-indication.patch
+lockdown-fix-kexec-lockdown-bypass-with-ima-policy.patch
+io_uring-use-original-task-for-req-identity-in-io_identity_cow.patch
diff --git a/queue-5.15/series b/queue-5.15/series
new file mode 100644 (file)
index 0000000..4d27de5
--- /dev/null
@@ -0,0 +1,7 @@
+pinctrl-stm32-fix-optional-irq-support-to-gpios.patch
+riscv-add-as-options-for-modules-with-assembly-compontents.patch
+mlxsw-spectrum_router-fix-ipv4-nexthop-gateway-indication.patch
+lockdown-fix-kexec-lockdown-bypass-with-ima-policy.patch
+drm-ttm-fix-locking-in-vmap-vunmap-ttm-gem-helpers.patch
+bus-mhi-host-pci_generic-add-telit-fn980-v1-hardware-revision.patch
+bus-mhi-host-pci_generic-add-telit-fn990.patch
diff --git a/queue-5.18/bus-mhi-host-pci_generic-add-telit-fn980-v1-hardware-revision.patch b/queue-5.18/bus-mhi-host-pci_generic-add-telit-fn980-v1-hardware-revision.patch
new file mode 100644 (file)
index 0000000..9b33747
--- /dev/null
@@ -0,0 +1,76 @@
+From a96ef8b504efb2ad445dfb6d54f9488c3ddf23d2 Mon Sep 17 00:00:00 2001
+From: Daniele Palmas <dnlplm@gmail.com>
+Date: Wed, 27 Apr 2022 09:26:48 +0200
+Subject: bus: mhi: host: pci_generic: add Telit FN980 v1 hardware revision
+
+From: Daniele Palmas <dnlplm@gmail.com>
+
+commit a96ef8b504efb2ad445dfb6d54f9488c3ddf23d2 upstream.
+
+Add Telit FN980 v1 hardware revision:
+
+01:00.0 Unassigned class [ff00]: Qualcomm Device [17cb:0306]
+        Subsystem: Device [1c5d:2000]
+
+Signed-off-by: Daniele Palmas <dnlplm@gmail.com>
+Reviewed-by: Manivannan Sadhasivam <mani@kernel.org>
+Link: https://lore.kernel.org/r/20220427072648.17635-1-dnlplm@gmail.com
+[mani: Added "host" to the subject]
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Signed-off-by: Fabio Porcedda <fabio.porcedda@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/bus/mhi/host/pci_generic.c |   38 +++++++++++++++++++++++++++++++++++++
+ 1 file changed, 38 insertions(+)
+
+--- a/drivers/bus/mhi/host/pci_generic.c
++++ b/drivers/bus/mhi/host/pci_generic.c
+@@ -446,10 +446,48 @@ static const struct mhi_pci_dev_info mhi
+       .sideband_wake = false,
+ };
++static const struct mhi_channel_config mhi_telit_fn980_hw_v1_channels[] = {
++      MHI_CHANNEL_CONFIG_UL(14, "QMI", 32, 0),
++      MHI_CHANNEL_CONFIG_DL(15, "QMI", 32, 0),
++      MHI_CHANNEL_CONFIG_UL(20, "IPCR", 16, 0),
++      MHI_CHANNEL_CONFIG_DL_AUTOQUEUE(21, "IPCR", 16, 0),
++      MHI_CHANNEL_CONFIG_HW_UL(100, "IP_HW0", 128, 1),
++      MHI_CHANNEL_CONFIG_HW_DL(101, "IP_HW0", 128, 2),
++};
++
++static struct mhi_event_config mhi_telit_fn980_hw_v1_events[] = {
++      MHI_EVENT_CONFIG_CTRL(0, 128),
++      MHI_EVENT_CONFIG_HW_DATA(1, 1024, 100),
++      MHI_EVENT_CONFIG_HW_DATA(2, 2048, 101)
++};
++
++static struct mhi_controller_config modem_telit_fn980_hw_v1_config = {
++      .max_channels = 128,
++      .timeout_ms = 20000,
++      .num_channels = ARRAY_SIZE(mhi_telit_fn980_hw_v1_channels),
++      .ch_cfg = mhi_telit_fn980_hw_v1_channels,
++      .num_events = ARRAY_SIZE(mhi_telit_fn980_hw_v1_events),
++      .event_cfg = mhi_telit_fn980_hw_v1_events,
++};
++
++static const struct mhi_pci_dev_info mhi_telit_fn980_hw_v1_info = {
++      .name = "telit-fn980-hwv1",
++      .fw = "qcom/sdx55m/sbl1.mbn",
++      .edl = "qcom/sdx55m/edl.mbn",
++      .config = &modem_telit_fn980_hw_v1_config,
++      .bar_num = MHI_PCI_DEFAULT_BAR_NUM,
++      .dma_data_width = 32,
++      .mru_default = 32768,
++      .sideband_wake = false,
++};
++
+ static const struct pci_device_id mhi_pci_id_table[] = {
+       /* EM919x (sdx55), use the same vid:pid as qcom-sdx55m */
+       { PCI_DEVICE_SUB(PCI_VENDOR_ID_QCOM, 0x0306, 0x18d7, 0x0200),
+               .driver_data = (kernel_ulong_t) &mhi_sierra_em919x_info },
++      /* Telit FN980 hardware revision v1 */
++      { PCI_DEVICE_SUB(PCI_VENDOR_ID_QCOM, 0x0306, 0x1C5D, 0x2000),
++              .driver_data = (kernel_ulong_t) &mhi_telit_fn980_hw_v1_info },
+       { PCI_DEVICE(PCI_VENDOR_ID_QCOM, 0x0306),
+               .driver_data = (kernel_ulong_t) &mhi_qcom_sdx55_info },
+       { PCI_DEVICE(PCI_VENDOR_ID_QCOM, 0x0304),
diff --git a/queue-5.18/bus-mhi-host-pci_generic-add-telit-fn990.patch b/queue-5.18/bus-mhi-host-pci_generic-add-telit-fn990.patch
new file mode 100644 (file)
index 0000000..957f983
--- /dev/null
@@ -0,0 +1,82 @@
+From 77fc41204734042861210b9d05338c9b8360affb Mon Sep 17 00:00:00 2001
+From: Daniele Palmas <dnlplm@gmail.com>
+Date: Mon, 2 May 2022 13:20:36 +0200
+Subject: bus: mhi: host: pci_generic: add Telit FN990
+
+From: Daniele Palmas <dnlplm@gmail.com>
+
+commit 77fc41204734042861210b9d05338c9b8360affb upstream.
+
+Add Telit FN990:
+
+01:00.0 Unassigned class [ff00]: Qualcomm Device 0308
+        Subsystem: Device 1c5d:2010
+
+Signed-off-by: Daniele Palmas <dnlplm@gmail.com>
+Reviewed-by: Manivannan Sadhasivam <mani@kernel.org>
+Link: https://lore.kernel.org/r/20220502112036.443618-1-dnlplm@gmail.com
+[mani: Added "host" to the subject]
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Signed-off-by: Fabio Porcedda <fabio.porcedda@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/bus/mhi/host/pci_generic.c |   41 +++++++++++++++++++++++++++++++++++++
+ 1 file changed, 41 insertions(+)
+
+--- a/drivers/bus/mhi/host/pci_generic.c
++++ b/drivers/bus/mhi/host/pci_generic.c
+@@ -481,6 +481,44 @@ static const struct mhi_pci_dev_info mhi
+       .sideband_wake = false,
+ };
++static const struct mhi_channel_config mhi_telit_fn990_channels[] = {
++      MHI_CHANNEL_CONFIG_UL_SBL(2, "SAHARA", 32, 0),
++      MHI_CHANNEL_CONFIG_DL_SBL(3, "SAHARA", 32, 0),
++      MHI_CHANNEL_CONFIG_UL(4, "DIAG", 64, 1),
++      MHI_CHANNEL_CONFIG_DL(5, "DIAG", 64, 1),
++      MHI_CHANNEL_CONFIG_UL(12, "MBIM", 32, 0),
++      MHI_CHANNEL_CONFIG_DL(13, "MBIM", 32, 0),
++      MHI_CHANNEL_CONFIG_UL(32, "DUN", 32, 0),
++      MHI_CHANNEL_CONFIG_DL(33, "DUN", 32, 0),
++      MHI_CHANNEL_CONFIG_HW_UL(100, "IP_HW0_MBIM", 128, 2),
++      MHI_CHANNEL_CONFIG_HW_DL(101, "IP_HW0_MBIM", 128, 3),
++};
++
++static struct mhi_event_config mhi_telit_fn990_events[] = {
++      MHI_EVENT_CONFIG_CTRL(0, 128),
++      MHI_EVENT_CONFIG_DATA(1, 128),
++      MHI_EVENT_CONFIG_HW_DATA(2, 1024, 100),
++      MHI_EVENT_CONFIG_HW_DATA(3, 2048, 101)
++};
++
++static const struct mhi_controller_config modem_telit_fn990_config = {
++      .max_channels = 128,
++      .timeout_ms = 20000,
++      .num_channels = ARRAY_SIZE(mhi_telit_fn990_channels),
++      .ch_cfg = mhi_telit_fn990_channels,
++      .num_events = ARRAY_SIZE(mhi_telit_fn990_events),
++      .event_cfg = mhi_telit_fn990_events,
++};
++
++static const struct mhi_pci_dev_info mhi_telit_fn990_info = {
++      .name = "telit-fn990",
++      .config = &modem_telit_fn990_config,
++      .bar_num = MHI_PCI_DEFAULT_BAR_NUM,
++      .dma_data_width = 32,
++      .sideband_wake = false,
++      .mru_default = 32768,
++};
++
+ static const struct pci_device_id mhi_pci_id_table[] = {
+       /* EM919x (sdx55), use the same vid:pid as qcom-sdx55m */
+       { PCI_DEVICE_SUB(PCI_VENDOR_ID_QCOM, 0x0306, 0x18d7, 0x0200),
+@@ -492,6 +530,9 @@ static const struct pci_device_id mhi_pc
+               .driver_data = (kernel_ulong_t) &mhi_qcom_sdx55_info },
+       { PCI_DEVICE(PCI_VENDOR_ID_QCOM, 0x0304),
+               .driver_data = (kernel_ulong_t) &mhi_qcom_sdx24_info },
++      /* Telit FN990 */
++      { PCI_DEVICE_SUB(PCI_VENDOR_ID_QCOM, 0x0308, 0x1c5d, 0x2010),
++              .driver_data = (kernel_ulong_t) &mhi_telit_fn990_info },
+       { PCI_DEVICE(0x1eac, 0x1001), /* EM120R-GL (sdx24) */
+               .driver_data = (kernel_ulong_t) &mhi_quectel_em1xx_info },
+       { PCI_DEVICE(0x1eac, 0x1002), /* EM160R-GL (sdx24) */
diff --git a/queue-5.18/drm-amd-display-fix-new-dmub-notification-enabling-in-dm.patch b/queue-5.18/drm-amd-display-fix-new-dmub-notification-enabling-in-dm.patch
new file mode 100644 (file)
index 0000000..f635f21
--- /dev/null
@@ -0,0 +1,97 @@
+From 2d4bd81fea1ad6ebba543bd6da3ef5179d130e6a Mon Sep 17 00:00:00 2001
+From: Stylon Wang <stylon.wang@amd.com>
+Date: Thu, 7 Jul 2022 16:23:29 +0800
+Subject: drm/amd/display: Fix new dmub notification enabling in DM
+
+From: Stylon Wang <stylon.wang@amd.com>
+
+commit 2d4bd81fea1ad6ebba543bd6da3ef5179d130e6a upstream.
+
+[Why]
+Changes from "Fix for dmub outbox notification enable" need to land
+in DM or DMUB outbox notification would be disabled.
+
+[How]
+Enable outbox notification only after interrupt are enabled and IRQ
+handlers registered. Any pending notification will be sent by DMUB
+once outbox notification is enabled.
+
+Fixes: ed7208706448 ("drm/amd/display: Fix for dmub outbox notification enable")
+Reviewed-by: Nicholas Kazlauskas <Nicholas.Kazlauskas@amd.com>
+Acked-by: Solomon Chiu <solomon.chiu@amd.com>
+Signed-off-by: Stylon Wang <stylon.wang@amd.com>
+Acked-by: Harry Wentland <harry.wentland@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c |   27 +++++++++++++++-------
+ 1 file changed, 19 insertions(+), 8 deletions(-)
+
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -1670,7 +1670,7 @@ static int amdgpu_dm_init(struct amdgpu_
+ #if defined(CONFIG_DRM_AMD_SECURE_DISPLAY)
+       adev->dm.crc_rd_wrk = amdgpu_dm_crtc_secure_display_create_work();
+ #endif
+-      if (dc_enable_dmub_notifications(adev->dm.dc)) {
++      if (dc_is_dmub_outbox_supported(adev->dm.dc)) {
+               init_completion(&adev->dm.dmub_aux_transfer_done);
+               adev->dm.dmub_notify = kzalloc(sizeof(struct dmub_notification), GFP_KERNEL);
+               if (!adev->dm.dmub_notify) {
+@@ -1708,6 +1708,13 @@ static int amdgpu_dm_init(struct amdgpu_
+               goto error;
+       }
++      /* Enable outbox notification only after IRQ handlers are registered and DMUB is alive.
++       * It is expected that DMUB will resend any pending notifications at this point, for
++       * example HPD from DPIA.
++       */
++      if (dc_is_dmub_outbox_supported(adev->dm.dc))
++              dc_enable_dmub_outbox(adev->dm.dc);
++
+       /* create fake encoders for MST */
+       dm_dp_create_fake_mst_encoders(adev);
+@@ -2701,9 +2708,6 @@ static int dm_resume(void *handle)
+                */
+               link_enc_cfg_copy(adev->dm.dc->current_state, dc_state);
+-              if (dc_enable_dmub_notifications(adev->dm.dc))
+-                      amdgpu_dm_outbox_init(adev);
+-
+               r = dm_dmub_hw_init(adev);
+               if (r)
+                       DRM_ERROR("DMUB interface failed to initialize: status=%d\n", r);
+@@ -2721,6 +2725,11 @@ static int dm_resume(void *handle)
+                       }
+               }
++              if (dc_is_dmub_outbox_supported(adev->dm.dc)) {
++                      amdgpu_dm_outbox_init(adev);
++                      dc_enable_dmub_outbox(adev->dm.dc);
++              }
++
+               WARN_ON(!dc_commit_state(dm->dc, dc_state));
+               dm_gpureset_commit_state(dm->cached_dc_state, dm);
+@@ -2742,13 +2751,15 @@ static int dm_resume(void *handle)
+       /* TODO: Remove dc_state->dccg, use dc->dccg directly. */
+       dc_resource_state_construct(dm->dc, dm_state->context);
+-      /* Re-enable outbox interrupts for DPIA. */
+-      if (dc_enable_dmub_notifications(adev->dm.dc))
+-              amdgpu_dm_outbox_init(adev);
+-
+       /* Before powering on DC we need to re-initialize DMUB. */
+       dm_dmub_hw_resume(adev);
++      /* Re-enable outbox interrupts for DPIA. */
++      if (dc_is_dmub_outbox_supported(adev->dm.dc)) {
++              amdgpu_dm_outbox_init(adev);
++              dc_enable_dmub_outbox(adev->dm.dc);
++      }
++
+       /* power on hardware */
+       dc_set_power_state(dm->dc, DC_ACPI_CM_POWER_STATE_D0);
diff --git a/queue-5.18/drm-scheduler-don-t-kill-jobs-in-interrupt-context.patch b/queue-5.18/drm-scheduler-don-t-kill-jobs-in-interrupt-context.patch
new file mode 100644 (file)
index 0000000..c8588be
--- /dev/null
@@ -0,0 +1,68 @@
+From 9b04369b060fd4885f728b7a4ab4851ffb1abb64 Mon Sep 17 00:00:00 2001
+From: Dmitry Osipenko <dmitry.osipenko@collabora.com>
+Date: Tue, 12 Apr 2022 01:15:36 +0300
+Subject: drm/scheduler: Don't kill jobs in interrupt context
+
+From: Dmitry Osipenko <dmitry.osipenko@collabora.com>
+
+commit 9b04369b060fd4885f728b7a4ab4851ffb1abb64 upstream.
+
+Interrupt context can't sleep. Drivers like Panfrost and MSM are taking
+mutex when job is released, and thus, that code can sleep. This results
+into "BUG: scheduling while atomic" if locks are contented while job is
+freed. There is no good reason for releasing scheduler's jobs in IRQ
+context, hence use normal context to fix the trouble.
+
+Cc: stable@vger.kernel.org
+Fixes: 542cff7893a3 ("drm/sched: Avoid lockdep spalt on killing a processes")
+Signed-off-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
+Signed-off-by: Andrey Grodzovsky <andrey.grodzovsky@amd.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20220411221536.283312-1-dmitry.osipenko@collabora.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/scheduler/sched_entity.c |    6 +++---
+ include/drm/gpu_scheduler.h              |    4 ++--
+ 2 files changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/gpu/drm/scheduler/sched_entity.c
++++ b/drivers/gpu/drm/scheduler/sched_entity.c
+@@ -190,7 +190,7 @@ long drm_sched_entity_flush(struct drm_s
+ }
+ EXPORT_SYMBOL(drm_sched_entity_flush);
+-static void drm_sched_entity_kill_jobs_irq_work(struct irq_work *wrk)
++static void drm_sched_entity_kill_jobs_work(struct work_struct *wrk)
+ {
+       struct drm_sched_job *job = container_of(wrk, typeof(*job), work);
+@@ -207,8 +207,8 @@ static void drm_sched_entity_kill_jobs_c
+       struct drm_sched_job *job = container_of(cb, struct drm_sched_job,
+                                                finish_cb);
+-      init_irq_work(&job->work, drm_sched_entity_kill_jobs_irq_work);
+-      irq_work_queue(&job->work);
++      INIT_WORK(&job->work, drm_sched_entity_kill_jobs_work);
++      schedule_work(&job->work);
+ }
+ static struct dma_fence *
+--- a/include/drm/gpu_scheduler.h
++++ b/include/drm/gpu_scheduler.h
+@@ -28,7 +28,7 @@
+ #include <linux/dma-fence.h>
+ #include <linux/completion.h>
+ #include <linux/xarray.h>
+-#include <linux/irq_work.h>
++#include <linux/workqueue.h>
+ #define MAX_WAIT_SCHED_ENTITY_Q_EMPTY msecs_to_jiffies(1000)
+@@ -294,7 +294,7 @@ struct drm_sched_job {
+        */
+       union {
+               struct dma_fence_cb             finish_cb;
+-              struct irq_work                 work;
++              struct work_struct              work;
+       };
+       uint64_t                        id;
diff --git a/queue-5.18/drm-ttm-fix-locking-in-vmap-vunmap-ttm-gem-helpers.patch b/queue-5.18/drm-ttm-fix-locking-in-vmap-vunmap-ttm-gem-helpers.patch
new file mode 100644 (file)
index 0000000..3d634a7
--- /dev/null
@@ -0,0 +1,58 @@
+From dbd0da2453c694f2f74651834d90fb280b57f151 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Christian=20K=C3=B6nig?= <christian.koenig@amd.com>
+Date: Fri, 15 Jul 2022 09:57:22 +0200
+Subject: drm/ttm: fix locking in vmap/vunmap TTM GEM helpers
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Christian König <christian.koenig@amd.com>
+
+commit dbd0da2453c694f2f74651834d90fb280b57f151 upstream.
+
+I've stumbled over this while reviewing patches for DMA-buf and it looks
+like we completely messed the locking up here.
+
+In general most TTM function should only be called while holding the
+appropriate BO resv lock. Without this we could break the internal
+buffer object state here.
+
+Only compile tested!
+
+Signed-off-by: Christian König <christian.koenig@amd.com>
+Fixes: 43676605f890 ("drm/ttm: Add vmap/vunmap to TTM and TTM GEM helpers")
+Cc: stable@vger.kernel.org
+Reviewed-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20220715111533.467012-1-christian.koenig@amd.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/drm_gem_ttm_helper.c |    9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/drm_gem_ttm_helper.c
++++ b/drivers/gpu/drm/drm_gem_ttm_helper.c
+@@ -64,8 +64,13 @@ int drm_gem_ttm_vmap(struct drm_gem_obje
+                    struct iosys_map *map)
+ {
+       struct ttm_buffer_object *bo = drm_gem_ttm_of_gem(gem);
++      int ret;
+-      return ttm_bo_vmap(bo, map);
++      dma_resv_lock(gem->resv, NULL);
++      ret = ttm_bo_vmap(bo, map);
++      dma_resv_unlock(gem->resv);
++
++      return ret;
+ }
+ EXPORT_SYMBOL(drm_gem_ttm_vmap);
+@@ -82,7 +87,9 @@ void drm_gem_ttm_vunmap(struct drm_gem_o
+ {
+       struct ttm_buffer_object *bo = drm_gem_ttm_of_gem(gem);
++      dma_resv_lock(gem->resv, NULL);
+       ttm_bo_vunmap(bo, map);
++      dma_resv_unlock(gem->resv);
+ }
+ EXPORT_SYMBOL(drm_gem_ttm_vunmap);
diff --git a/queue-5.18/lockdown-fix-kexec-lockdown-bypass-with-ima-policy.patch b/queue-5.18/lockdown-fix-kexec-lockdown-bypass-with-ima-policy.patch
new file mode 100644 (file)
index 0000000..8a1e953
--- /dev/null
@@ -0,0 +1,57 @@
+From 543ce63b664e2c2f9533d089a4664b559c3e6b5b Mon Sep 17 00:00:00 2001
+From: Eric Snowberg <eric.snowberg@oracle.com>
+Date: Wed, 20 Jul 2022 12:40:27 -0400
+Subject: lockdown: Fix kexec lockdown bypass with ima policy
+
+From: Eric Snowberg <eric.snowberg@oracle.com>
+
+commit 543ce63b664e2c2f9533d089a4664b559c3e6b5b upstream.
+
+The lockdown LSM is primarily used in conjunction with UEFI Secure Boot.
+This LSM may also be used on machines without UEFI.  It can also be
+enabled when UEFI Secure Boot is disabled.  One of lockdown's features
+is to prevent kexec from loading untrusted kernels.  Lockdown can be
+enabled through a bootparam or after the kernel has booted through
+securityfs.
+
+If IMA appraisal is used with the "ima_appraise=log" boot param,
+lockdown can be defeated with kexec on any machine when Secure Boot is
+disabled or unavailable.  IMA prevents setting "ima_appraise=log" from
+the boot param when Secure Boot is enabled, but this does not cover
+cases where lockdown is used without Secure Boot.
+
+To defeat lockdown, boot without Secure Boot and add ima_appraise=log to
+the kernel command line; then:
+
+  $ echo "integrity" > /sys/kernel/security/lockdown
+  $ echo "appraise func=KEXEC_KERNEL_CHECK appraise_type=imasig" > \
+    /sys/kernel/security/ima/policy
+  $ kexec -ls unsigned-kernel
+
+Add a call to verify ima appraisal is set to "enforce" whenever lockdown
+is enabled.  This fixes CVE-2022-21505.
+
+Cc: stable@vger.kernel.org
+Fixes: 29d3c1c8dfe7 ("kexec: Allow kexec_file() with appropriate IMA policy when locked down")
+Signed-off-by: Eric Snowberg <eric.snowberg@oracle.com>
+Acked-by: Mimi Zohar <zohar@linux.ibm.com>
+Reviewed-by: John Haxby <john.haxby@oracle.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ security/integrity/ima/ima_policy.c |    4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/security/integrity/ima/ima_policy.c
++++ b/security/integrity/ima/ima_policy.c
+@@ -2181,6 +2181,10 @@ bool ima_appraise_signature(enum kernel_
+       if (id >= READING_MAX_ID)
+               return false;
++      if (id == READING_KEXEC_IMAGE && !(ima_appraise & IMA_APPRAISE_ENFORCE)
++          && security_locked_down(LOCKDOWN_KEXEC))
++              return false;
++
+       func = read_idmap[id] ?: FILE_CHECK;
+       rcu_read_lock();
diff --git a/queue-5.18/mlxsw-spectrum_router-fix-ipv4-nexthop-gateway-indication.patch b/queue-5.18/mlxsw-spectrum_router-fix-ipv4-nexthop-gateway-indication.patch
new file mode 100644 (file)
index 0000000..b76a442
--- /dev/null
@@ -0,0 +1,44 @@
+From e5ec6a2513383fe2ecc2ee3b5f51d97acbbcd4d8 Mon Sep 17 00:00:00 2001
+From: Ido Schimmel <idosch@nvidia.com>
+Date: Tue, 19 Jul 2022 15:26:26 +0300
+Subject: mlxsw: spectrum_router: Fix IPv4 nexthop gateway indication
+
+From: Ido Schimmel <idosch@nvidia.com>
+
+commit e5ec6a2513383fe2ecc2ee3b5f51d97acbbcd4d8 upstream.
+
+mlxsw needs to distinguish nexthops with a gateway from connected
+nexthops in order to write the former to the adjacency table of the
+device. The check used to rely on the fact that nexthops with a gateway
+have a 'link' scope whereas connected nexthops have a 'host' scope. This
+is no longer correct after commit 747c14307214 ("ip: fix dflt addr
+selection for connected nexthop").
+
+Fix that by instead checking the address family of the gateway IP. This
+is a more direct way and also consistent with the IPv6 counterpart in
+mlxsw_sp_rt6_is_gateway().
+
+Cc: stable@vger.kernel.org
+Fixes: 747c14307214 ("ip: fix dflt addr selection for connected nexthop")
+Fixes: 597cfe4fc339 ("nexthop: Add support for IPv4 nexthops")
+Signed-off-by: Ido Schimmel <idosch@nvidia.com>
+Reviewed-by: Amit Cohen <amcohen@nvidia.com>
+Reviewed-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
+@@ -5387,7 +5387,7 @@ static bool mlxsw_sp_fi_is_gateway(const
+ {
+       const struct fib_nh *nh = fib_info_nh(fi, 0);
+-      return nh->fib_nh_scope == RT_SCOPE_LINK ||
++      return nh->fib_nh_gw_family ||
+              mlxsw_sp_nexthop4_ipip_type(mlxsw_sp, nh, NULL);
+ }
diff --git a/queue-5.18/mmc-sdhci-omap-fix-a-lockdep-warning-for-pm-runtime-init.patch b/queue-5.18/mmc-sdhci-omap-fix-a-lockdep-warning-for-pm-runtime-init.patch
new file mode 100644 (file)
index 0000000..ed095a1
--- /dev/null
@@ -0,0 +1,66 @@
+From 51189eb9ddc88851edc42f539a0f9862fd0630c2 Mon Sep 17 00:00:00 2001
+From: Tony Lindgren <tony@atomide.com>
+Date: Wed, 22 Jun 2022 08:12:15 +0300
+Subject: mmc: sdhci-omap: Fix a lockdep warning for PM runtime init
+
+From: Tony Lindgren <tony@atomide.com>
+
+commit 51189eb9ddc88851edc42f539a0f9862fd0630c2 upstream.
+
+We need runtime PM enabled early in probe before sdhci_setup_host() for
+sdhci_omap_set_capabilities(). But on the first runtime resume we must
+not call sdhci_runtime_resume_host() as sdhci_setup_host() has not been
+called yet. Let's check for an initialized controller like we already do
+for context restore to fix a lockdep warning.
+
+Fixes: f433e8aac6b9 ("mmc: sdhci-omap: Implement PM runtime functions")
+Reported-by: Yegor Yefremov <yegorslists@googlemail.com>
+Suggested-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20220622051215.34063-1-tony@atomide.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mmc/host/sdhci-omap.c |   14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+--- a/drivers/mmc/host/sdhci-omap.c
++++ b/drivers/mmc/host/sdhci-omap.c
+@@ -1303,8 +1303,9 @@ static int sdhci_omap_probe(struct platf
+       /*
+        * omap_device_pm_domain has callbacks to enable the main
+        * functional clock, interface clock and also configure the
+-       * SYSCONFIG register of omap devices. The callback will be invoked
+-       * as part of pm_runtime_get_sync.
++       * SYSCONFIG register to clear any boot loader set voltage
++       * capabilities before calling sdhci_setup_host(). The
++       * callback will be invoked as part of pm_runtime_get_sync.
+        */
+       pm_runtime_use_autosuspend(dev);
+       pm_runtime_set_autosuspend_delay(dev, 50);
+@@ -1446,7 +1447,8 @@ static int __maybe_unused sdhci_omap_run
+       struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
+       struct sdhci_omap_host *omap_host = sdhci_pltfm_priv(pltfm_host);
+-      sdhci_runtime_suspend_host(host);
++      if (omap_host->con != -EINVAL)
++              sdhci_runtime_suspend_host(host);
+       sdhci_omap_context_save(omap_host);
+@@ -1463,10 +1465,10 @@ static int __maybe_unused sdhci_omap_run
+       pinctrl_pm_select_default_state(dev);
+-      if (omap_host->con != -EINVAL)
++      if (omap_host->con != -EINVAL) {
+               sdhci_omap_context_restore(omap_host);
+-
+-      sdhci_runtime_resume_host(host, 0);
++              sdhci_runtime_resume_host(host, 0);
++      }
+       return 0;
+ }
diff --git a/queue-5.18/mtd-rawnand-gpmi-set-wait_for_ready-timeout-based-on-program-erase-times.patch b/queue-5.18/mtd-rawnand-gpmi-set-wait_for_ready-timeout-based-on-program-erase-times.patch
new file mode 100644 (file)
index 0000000..a5ba07f
--- /dev/null
@@ -0,0 +1,71 @@
+From 0fddf9ad06fd9f439f137139861556671673e31c Mon Sep 17 00:00:00 2001
+From: Sascha Hauer <s.hauer@pengutronix.de>
+Date: Fri, 1 Jul 2022 13:03:41 +0200
+Subject: mtd: rawnand: gpmi: Set WAIT_FOR_READY timeout based on program/erase times
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Sascha Hauer <s.hauer@pengutronix.de>
+
+commit 0fddf9ad06fd9f439f137139861556671673e31c upstream.
+
+06781a5026350 Fixes the calculation of the DEVICE_BUSY_TIMEOUT register
+value from busy_timeout_cycles. busy_timeout_cycles is calculated wrong
+though: It is calculated based on the maximum page read time, but the
+timeout is also used for page write and block erase operations which
+require orders of magnitude bigger timeouts.
+
+Fix this by calculating busy_timeout_cycles from the maximum of
+tBERS_max and tPROG_max.
+
+This is for now the easiest and most obvious way to fix the driver.
+There's room for improvements though: The NAND_OP_WAITRDY_INSTR tells us
+the desired timeout for the current operation, so we could program the
+timeout dynamically for each operation instead of setting a fixed
+timeout. Also we could wire up the interrupt handler to actually detect
+and forward timeouts occurred when waiting for the chip being ready.
+
+As a sidenote I verified that the change in 06781a5026350 is really
+correct. I wired up the interrupt handler in my tree and measured the
+time between starting the operation and the timeout interrupt handler
+coming in. The time increases 41us with each step in the timeout
+register which corresponds to 4096 clock cycles with the 99MHz clock
+that I have.
+
+Fixes: 06781a5026350 ("mtd: rawnand: gpmi: Fix setting busy timeout setting")
+Fixes: b1206122069aa ("mtd: rawniand: gpmi: use core timings instead of an empirical derivation")
+Cc: stable@vger.kernel.org
+Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
+Acked-by: Han Xu <han.xu@nxp.com>
+Tested-by: Tomasz Moń <tomasz.mon@camlingroup.com>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c |    6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
++++ b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
+@@ -655,9 +655,10 @@ static int gpmi_nfc_compute_timings(stru
+       unsigned int tRP_ps;
+       bool use_half_period;
+       int sample_delay_ps, sample_delay_factor;
+-      u16 busy_timeout_cycles;
++      unsigned int busy_timeout_cycles;
+       u8 wrn_dly_sel;
+       unsigned long clk_rate, min_rate;
++      u64 busy_timeout_ps;
+       if (sdr->tRC_min >= 30000) {
+               /* ONFI non-EDO modes [0-3] */
+@@ -690,7 +691,8 @@ static int gpmi_nfc_compute_timings(stru
+       addr_setup_cycles = TO_CYCLES(sdr->tALS_min, period_ps);
+       data_setup_cycles = TO_CYCLES(sdr->tDS_min, period_ps);
+       data_hold_cycles = TO_CYCLES(sdr->tDH_min, period_ps);
+-      busy_timeout_cycles = TO_CYCLES(sdr->tWB_max + sdr->tR_max, period_ps);
++      busy_timeout_ps = max(sdr->tBERS_max, sdr->tPROG_max);
++      busy_timeout_cycles = TO_CYCLES(busy_timeout_ps, period_ps);
+       hw->timing0 = BF_GPMI_TIMING0_ADDRESS_SETUP(addr_setup_cycles) |
+                     BF_GPMI_TIMING0_DATA_HOLD(data_hold_cycles) |
diff --git a/queue-5.18/net-usb-ax88179_178a-needs-flag_send_zlp.patch b/queue-5.18/net-usb-ax88179_178a-needs-flag_send_zlp.patch
new file mode 100644 (file)
index 0000000..9d0e1b0
--- /dev/null
@@ -0,0 +1,166 @@
+From 36a15e1cb134c0395261ba1940762703f778438c Mon Sep 17 00:00:00 2001
+From: Jose Alonso <joalonsof@gmail.com>
+Date: Mon, 13 Jun 2022 15:32:44 -0300
+Subject: net: usb: ax88179_178a needs FLAG_SEND_ZLP
+
+From: Jose Alonso <joalonsof@gmail.com>
+
+commit 36a15e1cb134c0395261ba1940762703f778438c upstream.
+
+The extra byte inserted by usbnet.c when
+ (length % dev->maxpacket == 0) is causing problems to device.
+
+This patch sets FLAG_SEND_ZLP to avoid this.
+
+Tested with: 0b95:1790 ASIX Electronics Corp. AX88179 Gigabit Ethernet
+
+Problems observed:
+======================================================================
+1) Using ssh/sshfs. The remote sshd daemon can abort with the message:
+   "message authentication code incorrect"
+   This happens because the tcp message sent is corrupted during the
+   USB "Bulk out". The device calculate the tcp checksum and send a
+   valid tcp message to the remote sshd. Then the encryption detects
+   the error and aborts.
+2) NETDEV WATCHDOG: ... (ax88179_178a): transmit queue 0 timed out
+3) Stop normal work without any log message.
+   The "Bulk in" continue receiving packets normally.
+   The host sends "Bulk out" and the device responds with -ECONNRESET.
+   (The netusb.c code tx_complete ignore -ECONNRESET)
+Under normal conditions these errors take days to happen and in
+intense usage take hours.
+
+A test with ping gives packet loss, showing that something is wrong:
+ping -4 -s 462 {destination}   # 462 = 512 - 42 - 8
+Not all packets fail.
+My guess is that the device tries to find another packet starting
+at the extra byte and will fail or not depending on the next
+bytes (old buffer content).
+======================================================================
+
+Signed-off-by: Jose Alonso <joalonsof@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/usb/ax88179_178a.c |   26 +++++++++++++-------------
+ 1 file changed, 13 insertions(+), 13 deletions(-)
+
+--- a/drivers/net/usb/ax88179_178a.c
++++ b/drivers/net/usb/ax88179_178a.c
+@@ -1801,7 +1801,7 @@ static const struct driver_info ax88179_
+       .link_reset = ax88179_link_reset,
+       .reset = ax88179_reset,
+       .stop = ax88179_stop,
+-      .flags = FLAG_ETHER | FLAG_FRAMING_AX,
++      .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP,
+       .rx_fixup = ax88179_rx_fixup,
+       .tx_fixup = ax88179_tx_fixup,
+ };
+@@ -1814,7 +1814,7 @@ static const struct driver_info ax88178a
+       .link_reset = ax88179_link_reset,
+       .reset = ax88179_reset,
+       .stop = ax88179_stop,
+-      .flags = FLAG_ETHER | FLAG_FRAMING_AX,
++      .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP,
+       .rx_fixup = ax88179_rx_fixup,
+       .tx_fixup = ax88179_tx_fixup,
+ };
+@@ -1827,7 +1827,7 @@ static const struct driver_info cypress_
+       .link_reset = ax88179_link_reset,
+       .reset = ax88179_reset,
+       .stop = ax88179_stop,
+-      .flags = FLAG_ETHER | FLAG_FRAMING_AX,
++      .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP,
+       .rx_fixup = ax88179_rx_fixup,
+       .tx_fixup = ax88179_tx_fixup,
+ };
+@@ -1840,7 +1840,7 @@ static const struct driver_info dlink_du
+       .link_reset = ax88179_link_reset,
+       .reset = ax88179_reset,
+       .stop = ax88179_stop,
+-      .flags = FLAG_ETHER | FLAG_FRAMING_AX,
++      .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP,
+       .rx_fixup = ax88179_rx_fixup,
+       .tx_fixup = ax88179_tx_fixup,
+ };
+@@ -1853,7 +1853,7 @@ static const struct driver_info sitecom_
+       .link_reset = ax88179_link_reset,
+       .reset = ax88179_reset,
+       .stop = ax88179_stop,
+-      .flags = FLAG_ETHER | FLAG_FRAMING_AX,
++      .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP,
+       .rx_fixup = ax88179_rx_fixup,
+       .tx_fixup = ax88179_tx_fixup,
+ };
+@@ -1866,7 +1866,7 @@ static const struct driver_info samsung_
+       .link_reset = ax88179_link_reset,
+       .reset = ax88179_reset,
+       .stop = ax88179_stop,
+-      .flags = FLAG_ETHER | FLAG_FRAMING_AX,
++      .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP,
+       .rx_fixup = ax88179_rx_fixup,
+       .tx_fixup = ax88179_tx_fixup,
+ };
+@@ -1879,7 +1879,7 @@ static const struct driver_info lenovo_i
+       .link_reset = ax88179_link_reset,
+       .reset = ax88179_reset,
+       .stop = ax88179_stop,
+-      .flags = FLAG_ETHER | FLAG_FRAMING_AX,
++      .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP,
+       .rx_fixup = ax88179_rx_fixup,
+       .tx_fixup = ax88179_tx_fixup,
+ };
+@@ -1892,7 +1892,7 @@ static const struct driver_info belkin_i
+       .link_reset = ax88179_link_reset,
+       .reset  = ax88179_reset,
+       .stop   = ax88179_stop,
+-      .flags  = FLAG_ETHER | FLAG_FRAMING_AX,
++      .flags  = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP,
+       .rx_fixup = ax88179_rx_fixup,
+       .tx_fixup = ax88179_tx_fixup,
+ };
+@@ -1905,7 +1905,7 @@ static const struct driver_info toshiba_
+       .link_reset = ax88179_link_reset,
+       .reset  = ax88179_reset,
+       .stop = ax88179_stop,
+-      .flags  = FLAG_ETHER | FLAG_FRAMING_AX,
++      .flags  = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP,
+       .rx_fixup = ax88179_rx_fixup,
+       .tx_fixup = ax88179_tx_fixup,
+ };
+@@ -1918,7 +1918,7 @@ static const struct driver_info mct_info
+       .link_reset = ax88179_link_reset,
+       .reset  = ax88179_reset,
+       .stop   = ax88179_stop,
+-      .flags  = FLAG_ETHER | FLAG_FRAMING_AX,
++      .flags  = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP,
+       .rx_fixup = ax88179_rx_fixup,
+       .tx_fixup = ax88179_tx_fixup,
+ };
+@@ -1931,7 +1931,7 @@ static const struct driver_info at_umc20
+       .link_reset = ax88179_link_reset,
+       .reset  = ax88179_reset,
+       .stop   = ax88179_stop,
+-      .flags  = FLAG_ETHER | FLAG_FRAMING_AX,
++      .flags  = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP,
+       .rx_fixup = ax88179_rx_fixup,
+       .tx_fixup = ax88179_tx_fixup,
+ };
+@@ -1944,7 +1944,7 @@ static const struct driver_info at_umc20
+       .link_reset = ax88179_link_reset,
+       .reset  = ax88179_reset,
+       .stop   = ax88179_stop,
+-      .flags  = FLAG_ETHER | FLAG_FRAMING_AX,
++      .flags  = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP,
+       .rx_fixup = ax88179_rx_fixup,
+       .tx_fixup = ax88179_tx_fixup,
+ };
+@@ -1957,7 +1957,7 @@ static const struct driver_info at_umc20
+       .link_reset = ax88179_link_reset,
+       .reset  = ax88179_reset,
+       .stop   = ax88179_stop,
+-      .flags  = FLAG_ETHER | FLAG_FRAMING_AX,
++      .flags  = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP,
+       .rx_fixup = ax88179_rx_fixup,
+       .tx_fixup = ax88179_tx_fixup,
+ };
diff --git a/queue-5.18/pinctrl-armada-37xx-use-raw-spinlocks-for-regmap-to-avoid-invalid-wait-context.patch b/queue-5.18/pinctrl-armada-37xx-use-raw-spinlocks-for-regmap-to-avoid-invalid-wait-context.patch
new file mode 100644 (file)
index 0000000..1b42559
--- /dev/null
@@ -0,0 +1,86 @@
+From 4546760619cfa9b718fe2059ceb07101cf9ff61e Mon Sep 17 00:00:00 2001
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+Date: Sun, 17 Jul 2022 02:37:45 +0300
+Subject: pinctrl: armada-37xx: use raw spinlocks for regmap to avoid invalid wait context
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+commit 4546760619cfa9b718fe2059ceb07101cf9ff61e upstream.
+
+The irqchip->irq_set_type method is called by __irq_set_trigger() under
+the desc->lock raw spinlock.
+
+The armada-37xx implementation, armada_37xx_irq_set_type(), uses an MMIO
+regmap created by of_syscon_register(), which uses plain spinlocks
+(the kind that are sleepable on RT).
+
+Therefore, this is an invalid locking scheme for which we get a kernel
+splat stating just that ("[ BUG: Invalid wait context ]"), because the
+context in which the plain spinlock may sleep is atomic due to the raw
+spinlock. We need to go raw spinlocks all the way.
+
+Make this driver create its own MMIO regmap, with use_raw_spinlock=true,
+and stop relying on syscon to provide it.
+
+This patch depends on commit 67021f25d952 ("regmap: teach regmap to use
+raw spinlocks if requested in the config").
+
+Cc: <stable@vger.kernel.org> # 5.15+
+Fixes: 2f227605394b ("pinctrl: armada-37xx: Add irqchip support")
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Link: https://lore.kernel.org/r/20220716233745.1704677-3-vladimir.oltean@nxp.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pinctrl/mvebu/pinctrl-armada-37xx.c |   27 +++++++++++++++++++++------
+ 1 file changed, 21 insertions(+), 6 deletions(-)
+
+--- a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c
++++ b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c
+@@ -1121,25 +1121,40 @@ static const struct of_device_id armada_
+       { },
+ };
++static const struct regmap_config armada_37xx_pinctrl_regmap_config = {
++      .reg_bits = 32,
++      .val_bits = 32,
++      .reg_stride = 4,
++      .use_raw_spinlock = true,
++};
++
+ static int __init armada_37xx_pinctrl_probe(struct platform_device *pdev)
+ {
+       struct armada_37xx_pinctrl *info;
+       struct device *dev = &pdev->dev;
+-      struct device_node *np = dev->of_node;
+       struct regmap *regmap;
++      void __iomem *base;
+       int ret;
++      base = devm_platform_get_and_ioremap_resource(pdev, 0, NULL);
++      if (IS_ERR(base)) {
++              dev_err(dev, "failed to ioremap base address: %pe\n", base);
++              return PTR_ERR(base);
++      }
++
++      regmap = devm_regmap_init_mmio(dev, base,
++                                     &armada_37xx_pinctrl_regmap_config);
++      if (IS_ERR(regmap)) {
++              dev_err(dev, "failed to create regmap: %pe\n", regmap);
++              return PTR_ERR(regmap);
++      }
++
+       info = devm_kzalloc(dev, sizeof(*info), GFP_KERNEL);
+       if (!info)
+               return -ENOMEM;
+       info->dev = dev;
+-
+-      regmap = syscon_node_to_regmap(np);
+-      if (IS_ERR(regmap))
+-              return dev_err_probe(dev, PTR_ERR(regmap), "cannot get regmap\n");
+       info->regmap = regmap;
+-
+       info->data = of_device_get_match_data(dev);
+       ret = armada_37xx_pinctrl_register(pdev, info);
diff --git a/queue-5.18/pinctrl-stm32-fix-optional-irq-support-to-gpios.patch b/queue-5.18/pinctrl-stm32-fix-optional-irq-support-to-gpios.patch
new file mode 100644 (file)
index 0000000..9e118b7
--- /dev/null
@@ -0,0 +1,63 @@
+From a1d4ef1adf8bbd302067534ead671a94759687ed Mon Sep 17 00:00:00 2001
+From: Fabien Dessenne <fabien.dessenne@foss.st.com>
+Date: Mon, 27 Jun 2022 16:23:50 +0200
+Subject: pinctrl: stm32: fix optional IRQ support to gpios
+
+From: Fabien Dessenne <fabien.dessenne@foss.st.com>
+
+commit a1d4ef1adf8bbd302067534ead671a94759687ed upstream.
+
+To act as an interrupt controller, a gpio bank relies on the
+"interrupt-parent" of the pin controller.
+When this optional "interrupt-parent" misses, do not create any IRQ domain.
+
+This fixes a "NULL pointer in stm32_gpio_domain_alloc()" kernel crash when
+the interrupt-parent = <exti> property is not declared in the Device Tree.
+
+Fixes: 0eb9f683336d ("pinctrl: Add IRQ support to STM32 gpios")
+Signed-off-by: Fabien Dessenne <fabien.dessenne@foss.st.com>
+Link: https://lore.kernel.org/r/20220627142350.742973-1-fabien.dessenne@foss.st.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pinctrl/stm32/pinctrl-stm32.c |   20 ++++++++++++--------
+ 1 file changed, 12 insertions(+), 8 deletions(-)
+
+
+--- a/drivers/pinctrl/stm32/pinctrl-stm32.c
++++ b/drivers/pinctrl/stm32/pinctrl-stm32.c
+@@ -1299,15 +1299,17 @@ static int stm32_gpiolib_register_bank(s
+       bank->bank_ioport_nr = bank_ioport_nr;
+       spin_lock_init(&bank->lock);
+-      /* create irq hierarchical domain */
+-      bank->fwnode = of_node_to_fwnode(np);
++      if (pctl->domain) {
++              /* create irq hierarchical domain */
++              bank->fwnode = of_node_to_fwnode(np);
++
++              bank->domain = irq_domain_create_hierarchy(pctl->domain, 0, STM32_GPIO_IRQ_LINE,
++                                                         bank->fwnode, &stm32_gpio_domain_ops,
++                                                         bank);
+-      bank->domain = irq_domain_create_hierarchy(pctl->domain, 0,
+-                                      STM32_GPIO_IRQ_LINE, bank->fwnode,
+-                                      &stm32_gpio_domain_ops, bank);
+-
+-      if (!bank->domain)
+-              return -ENODEV;
++              if (!bank->domain)
++                      return -ENODEV;
++      }
+       err = gpiochip_add_data(&bank->gpio_chip, bank);
+       if (err) {
+@@ -1466,6 +1468,8 @@ int stm32_pctl_probe(struct platform_dev
+       pctl->domain = stm32_pctrl_get_irq_domain(np);
+       if (IS_ERR(pctl->domain))
+               return PTR_ERR(pctl->domain);
++      if (!pctl->domain)
++              dev_warn(dev, "pinctrl without interrupt support\n");
+       /* hwspinlock is optional */
+       hwlock_id = of_hwspin_lock_get_id(pdev->dev.of_node, 0);
diff --git a/queue-5.18/riscv-add-as-options-for-modules-with-assembly-compontents.patch b/queue-5.18/riscv-add-as-options-for-modules-with-assembly-compontents.patch
new file mode 100644 (file)
index 0000000..49c015a
--- /dev/null
@@ -0,0 +1,48 @@
+From c1f6eff304e4dfa4558b6a8c6b2d26a91db6c998 Mon Sep 17 00:00:00 2001
+From: Ben Dooks <ben.dooks@codethink.co.uk>
+Date: Sun, 29 May 2022 16:22:00 +0100
+Subject: riscv: add as-options for modules with assembly compontents
+
+From: Ben Dooks <ben.dooks@codethink.co.uk>
+
+commit c1f6eff304e4dfa4558b6a8c6b2d26a91db6c998 upstream.
+
+When trying to load modules built for RISC-V which include assembly files
+the kernel loader errors with "unexpected relocation type 'R_RISCV_ALIGN'"
+due to R_RISCV_ALIGN relocations being generated by the assembler.
+
+The R_RISCV_ALIGN relocations can be removed at the expense of code space
+by adding -mno-relax to gcc and as.  In commit 7a8e7da42250138
+("RISC-V: Fixes to module loading") -mno-relax is added to the build
+variable KBUILD_CFLAGS_MODULE. See [1] for more info.
+
+The issue is that when kbuild builds a .S file, it invokes gcc with
+the -mno-relax flag, but this is not being passed through to the
+assembler. Adding -Wa,-mno-relax to KBUILD_AFLAGS_MODULE ensures that
+the assembler is invoked correctly. This may have now been fixed in
+gcc[2] and this addition should not stop newer gcc and as from working.
+
+[1] https://github.com/riscv/riscv-elf-psabi-doc/issues/183
+[2] https://github.com/gcc-mirror/gcc/commit/3b0a7d624e64eeb81e4d5e8c62c46d86ef521857
+
+Signed-off-by: Ben Dooks <ben.dooks@codethink.co.uk>
+Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
+Link: https://lore.kernel.org/r/20220529152200.609809-1-ben.dooks@codethink.co.uk
+Fixes: ab1ef68e5401 ("RISC-V: Add sections of PLT and GOT for kernel module")
+Cc: stable@vger.kernel.org
+Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/riscv/Makefile |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/riscv/Makefile
++++ b/arch/riscv/Makefile
+@@ -73,6 +73,7 @@ ifeq ($(CONFIG_PERF_EVENTS),y)
+ endif
+ KBUILD_CFLAGS_MODULE += $(call cc-option,-mno-relax)
++KBUILD_AFLAGS_MODULE += $(call as-option,-Wa$(comma)-mno-relax)
+ # GCC versions that support the "-mstrict-align" option default to allowing
+ # unaligned accesses.  While unaligned accesses are explicitly allowed in the
diff --git a/queue-5.18/series b/queue-5.18/series
new file mode 100644 (file)
index 0000000..2c63914
--- /dev/null
@@ -0,0 +1,13 @@
+pinctrl-armada-37xx-use-raw-spinlocks-for-regmap-to-avoid-invalid-wait-context.patch
+pinctrl-stm32-fix-optional-irq-support-to-gpios.patch
+riscv-add-as-options-for-modules-with-assembly-compontents.patch
+mlxsw-spectrum_router-fix-ipv4-nexthop-gateway-indication.patch
+lockdown-fix-kexec-lockdown-bypass-with-ima-policy.patch
+mmc-sdhci-omap-fix-a-lockdep-warning-for-pm-runtime-init.patch
+mtd-rawnand-gpmi-set-wait_for_ready-timeout-based-on-program-erase-times.patch
+drm-ttm-fix-locking-in-vmap-vunmap-ttm-gem-helpers.patch
+drm-amd-display-fix-new-dmub-notification-enabling-in-dm.patch
+drm-scheduler-don-t-kill-jobs-in-interrupt-context.patch
+net-usb-ax88179_178a-needs-flag_send_zlp.patch
+bus-mhi-host-pci_generic-add-telit-fn980-v1-hardware-revision.patch
+bus-mhi-host-pci_generic-add-telit-fn990.patch