From: Sasha Levin Date: Sun, 9 Oct 2022 02:12:21 +0000 (-0400) Subject: Fixes for 5.15 X-Git-Tag: v6.0.1~31^2~5 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=00fcb8d5f02ae8a34cd290fd811adcc2a405bc22;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.15 Signed-off-by: Sasha Levin --- diff --git a/queue-5.15/alsa-hda-hdmi-fix-the-converter-reuse-for-the-silent.patch b/queue-5.15/alsa-hda-hdmi-fix-the-converter-reuse-for-the-silent.patch new file mode 100644 index 00000000000..4b73ab03d86 --- /dev/null +++ b/queue-5.15/alsa-hda-hdmi-fix-the-converter-reuse-for-the-silent.patch @@ -0,0 +1,42 @@ +From a18e36e5c401221b080ff9542486ad6ebc489166 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Sep 2022 09:02:16 +0200 +Subject: ALSA: hda/hdmi: Fix the converter reuse for the silent stream + +From: Jaroslav Kysela + +[ Upstream commit 5f80d6bd2b01de4cafac3302f58456bf860322fc ] + +When the user space pcm stream uses the silent stream converter, +it is no longer allocated for the silent stream. Clear the appropriate +flag in the hdmi_pcm_open() function. The silent stream setup may +be applied in hdmi_pcm_close() (and the error path - open fcn) again. + +If the flag is not cleared, the reuse conditions for the silent +stream converter in hdmi_choose_cvt() may improperly share +this converter. + +Cc: Kai Vehmanen +Signed-off-by: Jaroslav Kysela +Link: https://lore.kernel.org/r/20220913070216.3233974-1-perex@perex.cz +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/patch_hdmi.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c +index d3da42e0e7b3..1994a83fa391 100644 +--- a/sound/pci/hda/patch_hdmi.c ++++ b/sound/pci/hda/patch_hdmi.c +@@ -1270,6 +1270,7 @@ static int hdmi_pcm_open(struct hda_pcm_stream *hinfo, + set_bit(pcm_idx, &spec->pcm_in_use); + per_pin = get_pin(spec, pin_idx); + per_pin->cvt_nid = per_cvt->cvt_nid; ++ per_pin->silent_stream = false; + hinfo->nid = per_cvt->cvt_nid; + + /* flip stripe flag for the assigned stream if supported */ +-- +2.35.1 + diff --git a/queue-5.15/arch-um-mark-the-stack-non-executable-to-fix-a-binut.patch b/queue-5.15/arch-um-mark-the-stack-non-executable-to-fix-a-binut.patch new file mode 100644 index 00000000000..10828704623 --- /dev/null +++ b/queue-5.15/arch-um-mark-the-stack-non-executable-to-fix-a-binut.patch @@ -0,0 +1,85 @@ +From 3532a3fdfcb14748bd675072b0887ec4527a2b03 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Sep 2022 14:48:55 +0800 +Subject: arch: um: Mark the stack non-executable to fix a binutils warning + +From: David Gow + +[ Upstream commit bd71558d585ac61cfd799db7f25e78dca404dd7a ] + +Since binutils 2.39, ld will print a warning if any stack section is +executable, which is the default for stack sections on files without a +.note.GNU-stack section. + +This was fixed for x86 in commit ffcf9c5700e4 ("x86: link vdso and boot with -z noexecstack --no-warn-rwx-segments"), +but remained broken for UML, resulting in several warnings: + +/usr/bin/ld: warning: arch/x86/um/vdso/vdso.o: missing .note.GNU-stack section implies executable stack +/usr/bin/ld: NOTE: This behaviour is deprecated and will be removed in a future version of the linker +/usr/bin/ld: warning: .tmp_vmlinux.kallsyms1 has a LOAD segment with RWX permissions +/usr/bin/ld: warning: .tmp_vmlinux.kallsyms1.o: missing .note.GNU-stack section implies executable stack +/usr/bin/ld: NOTE: This behaviour is deprecated and will be removed in a future version of the linker +/usr/bin/ld: warning: .tmp_vmlinux.kallsyms2 has a LOAD segment with RWX permissions +/usr/bin/ld: warning: .tmp_vmlinux.kallsyms2.o: missing .note.GNU-stack section implies executable stack +/usr/bin/ld: NOTE: This behaviour is deprecated and will be removed in a future version of the linker +/usr/bin/ld: warning: vmlinux has a LOAD segment with RWX permissions + +Link both the VDSO and vmlinux with -z noexecstack, fixing the warnings +about .note.GNU-stack sections. In addition, pass --no-warn-rwx-segments +to dodge the remaining warnings about LOAD segments with RWX permissions +in the kallsyms objects. (Note that this flag is apparently not +available on lld, so hide it behind a test for BFD, which is what the +x86 patch does.) + +Link: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ffcf9c5700e49c0aee42dcba9a12ba21338e8136 +Link: https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=ba951afb99912da01a6e8434126b8fac7aa75107 +Signed-off-by: David Gow +Reviewed-by: Lukas Straub +Tested-by: Lukas Straub +Acked-by: Randy Dunlap # build-tested +Signed-off-by: Richard Weinberger +Signed-off-by: Sasha Levin +--- + arch/um/Makefile | 8 ++++++++ + arch/x86/um/vdso/Makefile | 2 +- + 2 files changed, 9 insertions(+), 1 deletion(-) + +diff --git a/arch/um/Makefile b/arch/um/Makefile +index f2fe63bfd819..f1d4d67157be 100644 +--- a/arch/um/Makefile ++++ b/arch/um/Makefile +@@ -132,10 +132,18 @@ export LDS_ELF_FORMAT := $(ELF_FORMAT) + # The wrappers will select whether using "malloc" or the kernel allocator. + LINK_WRAPS = -Wl,--wrap,malloc -Wl,--wrap,free -Wl,--wrap,calloc + ++# Avoid binutils 2.39+ warnings by marking the stack non-executable and ++# ignorning warnings for the kallsyms sections. ++LDFLAGS_EXECSTACK = -z noexecstack ++ifeq ($(CONFIG_LD_IS_BFD),y) ++LDFLAGS_EXECSTACK += $(call ld-option,--no-warn-rwx-segments) ++endif ++ + LD_FLAGS_CMDLINE = $(foreach opt,$(KBUILD_LDFLAGS),-Wl,$(opt)) + + # Used by link-vmlinux.sh which has special support for um link + export CFLAGS_vmlinux := $(LINK-y) $(LINK_WRAPS) $(LD_FLAGS_CMDLINE) ++export LDFLAGS_vmlinux := $(LDFLAGS_EXECSTACK) + + # When cleaning we don't include .config, so we don't include + # TT or skas makefiles and don't clean skas_ptregs.h. +diff --git a/arch/x86/um/vdso/Makefile b/arch/x86/um/vdso/Makefile +index 5943387e3f35..5ca366e15c76 100644 +--- a/arch/x86/um/vdso/Makefile ++++ b/arch/x86/um/vdso/Makefile +@@ -62,7 +62,7 @@ quiet_cmd_vdso = VDSO $@ + -Wl,-T,$(filter %.lds,$^) $(filter %.o,$^) && \ + sh $(srctree)/$(src)/checkundef.sh '$(NM)' '$@' + +-VDSO_LDFLAGS = -fPIC -shared -Wl,--hash-style=sysv ++VDSO_LDFLAGS = -fPIC -shared -Wl,--hash-style=sysv -z noexecstack + GCOV_PROFILE := n + + # +-- +2.35.1 + diff --git a/queue-5.15/arm-dts-fix-moxa-sdio-compatible-remove-sdhci-misnom.patch b/queue-5.15/arm-dts-fix-moxa-sdio-compatible-remove-sdhci-misnom.patch new file mode 100644 index 00000000000..9d734a42c64 --- /dev/null +++ b/queue-5.15/arm-dts-fix-moxa-sdio-compatible-remove-sdhci-misnom.patch @@ -0,0 +1,77 @@ +From bb74521ced3d0ef63aa558951aed036a6fc8edea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Sep 2022 20:53:41 +0300 +Subject: ARM: dts: fix Moxa SDIO 'compatible', remove 'sdhci' misnomer + +From: Sergei Antonov + +[ Upstream commit 02181e68275d28cab3c3f755852770367f1bc229 ] + +Driver moxart-mmc.c has .compatible = "moxa,moxart-mmc". + +But moxart .dts/.dtsi and the documentation file moxa,moxart-dma.txt +contain compatible = "moxa,moxart-sdhci". + +Change moxart .dts/.dtsi files and moxa,moxart-dma.txt to match the driver. + +Replace 'sdhci' with 'mmc' in names too, since SDHCI is a different +controller from FTSDC010. + +Suggested-by: Arnd Bergmann +Signed-off-by: Sergei Antonov +Cc: Jonas Jensen +Link: https://lore.kernel.org/r/20220907175341.1477383-1-saproj@gmail.com' +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + Documentation/devicetree/bindings/dma/moxa,moxart-dma.txt | 4 ++-- + arch/arm/boot/dts/moxart-uc7112lx.dts | 2 +- + arch/arm/boot/dts/moxart.dtsi | 4 ++-- + 3 files changed, 5 insertions(+), 5 deletions(-) + +diff --git a/Documentation/devicetree/bindings/dma/moxa,moxart-dma.txt b/Documentation/devicetree/bindings/dma/moxa,moxart-dma.txt +index 8a9f3559335b..7e14e26676ec 100644 +--- a/Documentation/devicetree/bindings/dma/moxa,moxart-dma.txt ++++ b/Documentation/devicetree/bindings/dma/moxa,moxart-dma.txt +@@ -34,8 +34,8 @@ Example: + Use specific request line passing from dma + For example, MMC request line is 5 + +- sdhci: sdhci@98e00000 { +- compatible = "moxa,moxart-sdhci"; ++ mmc: mmc@98e00000 { ++ compatible = "moxa,moxart-mmc"; + reg = <0x98e00000 0x5C>; + interrupts = <5 0>; + clocks = <&clk_apb>; +diff --git a/arch/arm/boot/dts/moxart-uc7112lx.dts b/arch/arm/boot/dts/moxart-uc7112lx.dts +index eb5291b0ee3a..e07b807b4cec 100644 +--- a/arch/arm/boot/dts/moxart-uc7112lx.dts ++++ b/arch/arm/boot/dts/moxart-uc7112lx.dts +@@ -79,7 +79,7 @@ &clk_pll { + clocks = <&ref12>; + }; + +-&sdhci { ++&mmc { + status = "okay"; + }; + +diff --git a/arch/arm/boot/dts/moxart.dtsi b/arch/arm/boot/dts/moxart.dtsi +index f5f070a87482..764832ddfa78 100644 +--- a/arch/arm/boot/dts/moxart.dtsi ++++ b/arch/arm/boot/dts/moxart.dtsi +@@ -93,8 +93,8 @@ watchdog: watchdog@98500000 { + clock-names = "PCLK"; + }; + +- sdhci: sdhci@98e00000 { +- compatible = "moxa,moxart-sdhci"; ++ mmc: mmc@98e00000 { ++ compatible = "moxa,moxart-mmc"; + reg = <0x98e00000 0x5C>; + interrupts = <5 IRQ_TYPE_LEVEL_HIGH>; + clocks = <&clk_apb>; +-- +2.35.1 + diff --git a/queue-5.15/dmaengine-xilinx_dma-cleanup-for-fetching-xlnx-num-f.patch b/queue-5.15/dmaengine-xilinx_dma-cleanup-for-fetching-xlnx-num-f.patch new file mode 100644 index 00000000000..fe9c23e6c6a --- /dev/null +++ b/queue-5.15/dmaengine-xilinx_dma-cleanup-for-fetching-xlnx-num-f.patch @@ -0,0 +1,35 @@ +From 8016b8abea61117cf77e2aa528c306d449e3e9f5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Aug 2022 11:41:24 +0530 +Subject: dmaengine: xilinx_dma: cleanup for fetching xlnx,num-fstores property + +From: Swati Agarwal + +[ Upstream commit 462bce790e6a7e68620a4ce260cc38f7ed0255d5 ] + +Free the allocated resources for missing xlnx,num-fstores property. + +Signed-off-by: Swati Agarwal +Link: https://lore.kernel.org/r/20220817061125.4720-3-swati.agarwal@xilinx.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/xilinx/xilinx_dma.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/dma/xilinx/xilinx_dma.c b/drivers/dma/xilinx/xilinx_dma.c +index d3556b00a672..cc7d54f19fb8 100644 +--- a/drivers/dma/xilinx/xilinx_dma.c ++++ b/drivers/dma/xilinx/xilinx_dma.c +@@ -3068,7 +3068,7 @@ static int xilinx_dma_probe(struct platform_device *pdev) + if (err < 0) { + dev_err(xdev->dev, + "missing xlnx,num-fstores property\n"); +- return err; ++ goto disable_clks; + } + + err = of_property_read_u32(node, "xlnx,flush-fsync", +-- +2.35.1 + diff --git a/queue-5.15/dmaengine-xilinx_dma-fix-devm_platform_ioremap_resou.patch b/queue-5.15/dmaengine-xilinx_dma-fix-devm_platform_ioremap_resou.patch new file mode 100644 index 00000000000..2a8f936f9e8 --- /dev/null +++ b/queue-5.15/dmaengine-xilinx_dma-fix-devm_platform_ioremap_resou.patch @@ -0,0 +1,67 @@ +From f9229d12d8e1c24e091eaaed68835ddc10addf6d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Aug 2022 11:41:23 +0530 +Subject: dmaengine: xilinx_dma: Fix devm_platform_ioremap_resource error + handling + +From: Swati Agarwal + +[ Upstream commit 91df7751eb890e970afc08f50b8f0fa5ea39e03d ] + +Add missing cleanup in devm_platform_ioremap_resource(). +When probe fails remove dma channel resources and disable clocks in +accordance with the order of resources allocated . + +Signed-off-by: Swati Agarwal +Link: https://lore.kernel.org/r/20220817061125.4720-2-swati.agarwal@xilinx.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/xilinx/xilinx_dma.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +diff --git a/drivers/dma/xilinx/xilinx_dma.c b/drivers/dma/xilinx/xilinx_dma.c +index a4450bc95466..d3556b00a672 100644 +--- a/drivers/dma/xilinx/xilinx_dma.c ++++ b/drivers/dma/xilinx/xilinx_dma.c +@@ -3037,9 +3037,10 @@ static int xilinx_dma_probe(struct platform_device *pdev) + + /* Request and map I/O memory */ + xdev->regs = devm_platform_ioremap_resource(pdev, 0); +- if (IS_ERR(xdev->regs)) +- return PTR_ERR(xdev->regs); +- ++ if (IS_ERR(xdev->regs)) { ++ err = PTR_ERR(xdev->regs); ++ goto disable_clks; ++ } + /* Retrieve the DMA engine properties from the device tree */ + xdev->max_buffer_len = GENMASK(XILINX_DMA_MAX_TRANS_LEN_MAX - 1, 0); + xdev->s2mm_chan_id = xdev->dma_config->max_channels / 2; +@@ -3134,7 +3135,7 @@ static int xilinx_dma_probe(struct platform_device *pdev) + for_each_child_of_node(node, child) { + err = xilinx_dma_child_probe(xdev, child); + if (err < 0) +- goto disable_clks; ++ goto error; + } + + if (xdev->dma_config->dmatype == XDMA_TYPE_VDMA) { +@@ -3169,12 +3170,12 @@ static int xilinx_dma_probe(struct platform_device *pdev) + + return 0; + +-disable_clks: +- xdma_disable_allclks(xdev); + error: + for (i = 0; i < xdev->dma_config->max_channels; i++) + if (xdev->chan[i]) + xilinx_dma_chan_remove(xdev->chan[i]); ++disable_clks: ++ xdma_disable_allclks(xdev); + + return err; + } +-- +2.35.1 + diff --git a/queue-5.15/dmaengine-xilinx_dma-report-error-in-case-of-dma_set.patch b/queue-5.15/dmaengine-xilinx_dma-report-error-in-case-of-dma_set.patch new file mode 100644 index 00000000000..56aafe1bc8a --- /dev/null +++ b/queue-5.15/dmaengine-xilinx_dma-report-error-in-case-of-dma_set.patch @@ -0,0 +1,47 @@ +From f0ef8cc47a9ac070b8038193017a5ca02a9c8c31 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Aug 2022 11:41:25 +0530 +Subject: dmaengine: xilinx_dma: Report error in case of + dma_set_mask_and_coherent API failure + +From: Swati Agarwal + +[ Upstream commit 8f2b6bc79c32f0fa60df000ae387a790ec80eae9 ] + +The driver does not handle the failure case while calling +dma_set_mask_and_coherent API. + +In case of failure, capture the return value of API and then report an +error. + +Addresses-coverity: Unchecked return value (CHECKED_RETURN) + +Signed-off-by: Swati Agarwal +Reviewed-by: Radhey Shyam Pandey +Link: https://lore.kernel.org/r/20220817061125.4720-4-swati.agarwal@xilinx.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/xilinx/xilinx_dma.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/dma/xilinx/xilinx_dma.c b/drivers/dma/xilinx/xilinx_dma.c +index cc7d54f19fb8..4273150b68dc 100644 +--- a/drivers/dma/xilinx/xilinx_dma.c ++++ b/drivers/dma/xilinx/xilinx_dma.c +@@ -3088,7 +3088,11 @@ static int xilinx_dma_probe(struct platform_device *pdev) + xdev->ext_addr = false; + + /* Set the dma mask bits */ +- dma_set_mask_and_coherent(xdev->dev, DMA_BIT_MASK(addr_width)); ++ err = dma_set_mask_and_coherent(xdev->dev, DMA_BIT_MASK(addr_width)); ++ if (err < 0) { ++ dev_err(xdev->dev, "DMA mask error %d\n", err); ++ goto disable_clks; ++ } + + /* Initialize the DMA engine */ + xdev->common.dev = &pdev->dev; +-- +2.35.1 + diff --git a/queue-5.15/drm-amd-display-assume-an-lttpr-is-always-present-on.patch b/queue-5.15/drm-amd-display-assume-an-lttpr-is-always-present-on.patch new file mode 100644 index 00000000000..552e1defc12 --- /dev/null +++ b/queue-5.15/drm-amd-display-assume-an-lttpr-is-always-present-on.patch @@ -0,0 +1,49 @@ +From 6582572ba6f1deb934c8abb0db68a31e1926de7f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Aug 2022 15:10:43 -0400 +Subject: drm/amd/display: Assume an LTTPR is always present on fixed_vs links + +From: Michael Strauss + +[ Upstream commit 29956d0fded036a570bd8e7d4ea4b1a1730307d2 ] + +[WHY] +LTTPRs can in very rare instsances fail to increment DPCD LTTPR count. +This results in aux-i LTTPR requests to be sent to the wrong DPCD +address, which causes link training failure. + +[HOW] +Override internal repeater count if fixed_vs flag is set for a given link + +Reviewed-by: George Shen +Acked-by: Wayne Lin +Signed-off-by: Michael Strauss +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c +index 6d5dc5ab3d8c..a6ff1b17fd22 100644 +--- a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c +@@ -3703,6 +3703,14 @@ bool dp_retrieve_lttpr_cap(struct dc_link *link) + lttpr_dpcd_data[DP_PHY_REPEATER_EXTENDED_WAIT_TIMEOUT - + DP_LT_TUNABLE_PHY_REPEATER_FIELD_DATA_STRUCTURE_REV]; + ++ /* If this chip cap is set, at least one retimer must exist in the chain ++ * Override count to 1 if we receive a known bad count (0 or an invalid value) */ ++ if (link->chip_caps & EXT_DISPLAY_PATH_CAPS__DP_FIXED_VS_EN && ++ (dp_convert_to_count(link->dpcd_caps.lttpr_caps.phy_repeater_cnt) == 0)) { ++ ASSERT(0); ++ link->dpcd_caps.lttpr_caps.phy_repeater_cnt = 0x80; ++ } ++ + /* Attempt to train in LTTPR transparent mode if repeater count exceeds 8. */ + is_lttpr_present = (dp_convert_to_count(link->dpcd_caps.lttpr_caps.phy_repeater_cnt) != 0 && + link->dpcd_caps.lttpr_caps.max_lane_count > 0 && +-- +2.35.1 + diff --git a/queue-5.15/drm-amd-display-fix-double-cursor-on-non-video-rgb-m.patch b/queue-5.15/drm-amd-display-fix-double-cursor-on-non-video-rgb-m.patch new file mode 100644 index 00000000000..3aaf935722e --- /dev/null +++ b/queue-5.15/drm-amd-display-fix-double-cursor-on-non-video-rgb-m.patch @@ -0,0 +1,81 @@ +From 06fc094332436177a27d0f1395ca42fc3b2bb063 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Aug 2022 16:38:16 -0400 +Subject: drm/amd/display: Fix double cursor on non-video RGB MPO + +From: Leo Li + +[ Upstream commit b261509952bc19d1012cf732f853659be6ebc61e ] + +[Why] + +DC makes use of layer_index (zpos) when picking the HW plane to enable +HW cursor on. However, some compositors will not attach zpos information +to each DRM plane. Consequently, in amdgpu, we default layer_index to 0 +and do not update it. + +This causes said DC logic to enable HW cursor on all planes of the same +layer_index, which manifests as a double cursor issue if one of the +planes is scaled (and hence scaling the cursor as well). + +[How] + +Use DRM core helpers to calculate a normalized_zpos value for each +drm_plane_state under each crtc, within the atomic state. + +This helper will first consider existing zpos values, and if +identical/unset, fallback to plane ID ordering. + +The normalized_zpos is then passed to dc_plane_info during atomic check +for later use by the cursor logic. + +Reviewed-by: Bhawanpreet Lakha +Acked-by: Wayne Lin +Signed-off-by: Leo Li +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index e3dfea3d44a4..c826fc493e0f 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -5442,7 +5442,7 @@ fill_dc_plane_info_and_addr(struct amdgpu_device *adev, + plane_info->visible = true; + plane_info->stereo_format = PLANE_STEREO_FORMAT_NONE; + +- plane_info->layer_index = 0; ++ plane_info->layer_index = plane_state->normalized_zpos; + + ret = fill_plane_color_attributes(plane_state, plane_info->format, + &plane_info->color_space); +@@ -5509,7 +5509,7 @@ static int fill_dc_plane_attributes(struct amdgpu_device *adev, + dc_plane_state->global_alpha = plane_info.global_alpha; + dc_plane_state->global_alpha_value = plane_info.global_alpha_value; + dc_plane_state->dcc = plane_info.dcc; +- dc_plane_state->layer_index = plane_info.layer_index; // Always returns 0 ++ dc_plane_state->layer_index = plane_info.layer_index; + dc_plane_state->flip_int_enabled = true; + + /* +@@ -10828,6 +10828,14 @@ static int amdgpu_dm_atomic_check(struct drm_device *dev, + } + } + ++ /* ++ * DC consults the zpos (layer_index in DC terminology) to determine the ++ * hw plane on which to enable the hw cursor (see ++ * `dcn10_can_pipe_disable_cursor`). By now, all modified planes are in ++ * atomic state, so call drm helper to normalize zpos. ++ */ ++ drm_atomic_normalize_zpos(dev, state); ++ + /* Remove exiting planes if they are modified */ + for_each_oldnew_plane_in_state_reverse(state, plane, old_plane_state, new_plane_state, i) { + ret = dm_update_plane_state(dc, state, plane, +-- +2.35.1 + diff --git a/queue-5.15/drm-amd-display-skip-audio-setup-when-audio-stream-i.patch b/queue-5.15/drm-amd-display-skip-audio-setup-when-audio-stream-i.patch new file mode 100644 index 00000000000..628565b6ba3 --- /dev/null +++ b/queue-5.15/drm-amd-display-skip-audio-setup-when-audio-stream-i.patch @@ -0,0 +1,54 @@ +From 2dad87b309007074e89eb966826dcaa63c2bd976 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Aug 2022 19:44:50 +0800 +Subject: drm/amd/display: skip audio setup when audio stream is enabled + +From: zhikzhai + +[ Upstream commit 65fbfb02c2734cacffec5e3f492e1b4f1dabcf98 ] + +[why] +We have minimal pipe split transition method to avoid pipe +allocation outage.However, this method will invoke audio setup +which cause audio output stuck once pipe reallocate. + +[how] +skip audio setup for pipelines which audio stream has been enabled + +Reviewed-by: Charlene Liu +Acked-by: Wayne Lin +Signed-off-by: zhikzhai +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c +index 62d595ded866..46d7e75e4553 100644 +--- a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c ++++ b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c +@@ -2108,7 +2108,8 @@ static void dce110_setup_audio_dto( + continue; + if (pipe_ctx->stream->signal != SIGNAL_TYPE_HDMI_TYPE_A) + continue; +- if (pipe_ctx->stream_res.audio != NULL) { ++ if (pipe_ctx->stream_res.audio != NULL && ++ pipe_ctx->stream_res.audio->enabled == false) { + struct audio_output audio_output; + + build_audio_output(context, pipe_ctx, &audio_output); +@@ -2156,7 +2157,8 @@ static void dce110_setup_audio_dto( + if (!dc_is_dp_signal(pipe_ctx->stream->signal)) + continue; + +- if (pipe_ctx->stream_res.audio != NULL) { ++ if (pipe_ctx->stream_res.audio != NULL && ++ pipe_ctx->stream_res.audio->enabled == false) { + struct audio_output audio_output; + + build_audio_output(context, pipe_ctx, &audio_output); +-- +2.35.1 + diff --git a/queue-5.15/drm-amd-display-update-gamut-remap-if-plane-has-chan.patch b/queue-5.15/drm-amd-display-update-gamut-remap-if-plane-has-chan.patch new file mode 100644 index 00000000000..28388b9c0b8 --- /dev/null +++ b/queue-5.15/drm-amd-display-update-gamut-remap-if-plane-has-chan.patch @@ -0,0 +1,43 @@ +From 3b0fcdd424e49478b0aafae0f6c9697fe2986449 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Sep 2022 10:08:35 +0800 +Subject: drm/amd/display: update gamut remap if plane has changed + +From: Hugo Hu + +[ Upstream commit 52bb21499cf54fa65b56d97cd0d68579c90207dd ] + +[Why] +The desktop plane and full-screen game plane may have different +gamut remap coefficients, if switching between desktop and +full-screen game without updating the gamut remap will cause +incorrect color. + +[How] +Update gamut remap if planes change. + +Reviewed-by: Dmytro Laktyushkin +Acked-by: Wayne Lin +Signed-off-by: Hugo Hu +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c +index 9f8d7f92300b..0de1bbbabf9a 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c +@@ -1513,6 +1513,7 @@ static void dcn20_update_dchubp_dpp( + /* Any updates are handled in dc interface, just need + * to apply existing for plane enable / opp change */ + if (pipe_ctx->update_flags.bits.enable || pipe_ctx->update_flags.bits.opp_changed ++ || pipe_ctx->update_flags.bits.plane_changed + || pipe_ctx->stream->update_flags.bits.gamut_remap + || pipe_ctx->stream->update_flags.bits.out_csc) { + /* dpp/cm gamut remap*/ +-- +2.35.1 + diff --git a/queue-5.15/firmware-arm_scmi-add-scmi-pm-driver-remove-routine.patch b/queue-5.15/firmware-arm_scmi-add-scmi-pm-driver-remove-routine.patch new file mode 100644 index 00000000000..b5e9812a2f4 --- /dev/null +++ b/queue-5.15/firmware-arm_scmi-add-scmi-pm-driver-remove-routine.patch @@ -0,0 +1,81 @@ +From 61a9cf14449e20125f68395b20630e885f874b67 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Aug 2022 18:27:31 +0100 +Subject: firmware: arm_scmi: Add SCMI PM driver remove routine + +From: Cristian Marussi + +[ Upstream commit dea796fcab0a219830831c070b8dc367d7e0f708 ] + +Currently, when removing the SCMI PM driver not all the resources +registered with genpd subsystem are properly de-registered. + +As a side effect of this after a driver unload/load cycle you get a +splat with a few warnings like this: + + | debugfs: Directory 'BIG_CPU0' with parent 'pm_genpd' already present! + | debugfs: Directory 'BIG_CPU1' with parent 'pm_genpd' already present! + | debugfs: Directory 'LITTLE_CPU0' with parent 'pm_genpd' already present! + | debugfs: Directory 'LITTLE_CPU1' with parent 'pm_genpd' already present! + | debugfs: Directory 'LITTLE_CPU2' with parent 'pm_genpd' already present! + | debugfs: Directory 'LITTLE_CPU3' with parent 'pm_genpd' already present! + | debugfs: Directory 'BIG_SSTOP' with parent 'pm_genpd' already present! + | debugfs: Directory 'LITTLE_SSTOP' with parent 'pm_genpd' already present! + | debugfs: Directory 'DBGSYS' with parent 'pm_genpd' already present! + | debugfs: Directory 'GPUTOP' with parent 'pm_genpd' already present! + +Add a proper scmi_pm_domain_remove callback to the driver in order to +take care of all the needed cleanups not handled by devres framework. + +Link: https://lore.kernel.org/r/20220817172731.1185305-7-cristian.marussi@arm.com +Signed-off-by: Cristian Marussi +Signed-off-by: Sudeep Holla +Signed-off-by: Sasha Levin +--- + drivers/firmware/arm_scmi/scmi_pm_domain.c | 20 ++++++++++++++++++++ + 1 file changed, 20 insertions(+) + +diff --git a/drivers/firmware/arm_scmi/scmi_pm_domain.c b/drivers/firmware/arm_scmi/scmi_pm_domain.c +index d5dee625de78..0e05a79de82d 100644 +--- a/drivers/firmware/arm_scmi/scmi_pm_domain.c ++++ b/drivers/firmware/arm_scmi/scmi_pm_domain.c +@@ -112,9 +112,28 @@ static int scmi_pm_domain_probe(struct scmi_device *sdev) + scmi_pd_data->domains = domains; + scmi_pd_data->num_domains = num_domains; + ++ dev_set_drvdata(dev, scmi_pd_data); ++ + return of_genpd_add_provider_onecell(np, scmi_pd_data); + } + ++static void scmi_pm_domain_remove(struct scmi_device *sdev) ++{ ++ int i; ++ struct genpd_onecell_data *scmi_pd_data; ++ struct device *dev = &sdev->dev; ++ struct device_node *np = dev->of_node; ++ ++ of_genpd_del_provider(np); ++ ++ scmi_pd_data = dev_get_drvdata(dev); ++ for (i = 0; i < scmi_pd_data->num_domains; i++) { ++ if (!scmi_pd_data->domains[i]) ++ continue; ++ pm_genpd_remove(scmi_pd_data->domains[i]); ++ } ++} ++ + static const struct scmi_device_id scmi_id_table[] = { + { SCMI_PROTOCOL_POWER, "genpd" }, + { }, +@@ -124,6 +143,7 @@ MODULE_DEVICE_TABLE(scmi, scmi_id_table); + static struct scmi_driver scmi_power_domain_driver = { + .name = "scmi-power-domain", + .probe = scmi_pm_domain_probe, ++ .remove = scmi_pm_domain_remove, + .id_table = scmi_id_table, + }; + module_scmi_driver(scmi_power_domain_driver); +-- +2.35.1 + diff --git a/queue-5.15/firmware-arm_scmi-harden-accesses-to-the-sensor-doma.patch b/queue-5.15/firmware-arm_scmi-harden-accesses-to-the-sensor-doma.patch new file mode 100644 index 00000000000..6b5cbee690f --- /dev/null +++ b/queue-5.15/firmware-arm_scmi-harden-accesses-to-the-sensor-doma.patch @@ -0,0 +1,105 @@ +From f5b3874b025539a5ad98ab1bcc892056803ce83d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Aug 2022 18:27:28 +0100 +Subject: firmware: arm_scmi: Harden accesses to the sensor domains + +From: Cristian Marussi + +[ Upstream commit 76f89c954788763db575fb512a40bd483864f1e9 ] + +Accessing sensor domains descriptors by the index upon the SCMI drivers +requests through the SCMI sensor operations interface can potentially +lead to out-of-bound violations if the SCMI driver misbehave. + +Add an internal consistency check before any such domains descriptors +accesses. + +Link: https://lore.kernel.org/r/20220817172731.1185305-4-cristian.marussi@arm.com +Signed-off-by: Cristian Marussi +Signed-off-by: Sudeep Holla +Signed-off-by: Sasha Levin +--- + drivers/firmware/arm_scmi/sensors.c | 22 ++++++++++++++++++---- + 1 file changed, 18 insertions(+), 4 deletions(-) + +diff --git a/drivers/firmware/arm_scmi/sensors.c b/drivers/firmware/arm_scmi/sensors.c +index b479a9e29c96..1ed66d13c06c 100644 +--- a/drivers/firmware/arm_scmi/sensors.c ++++ b/drivers/firmware/arm_scmi/sensors.c +@@ -631,6 +631,10 @@ static int scmi_sensor_config_get(const struct scmi_protocol_handle *ph, + { + int ret; + struct scmi_xfer *t; ++ struct sensors_info *si = ph->get_priv(ph); ++ ++ if (sensor_id >= si->num_sensors) ++ return -EINVAL; + + ret = ph->xops->xfer_get_init(ph, SENSOR_CONFIG_GET, + sizeof(__le32), sizeof(__le32), &t); +@@ -640,7 +644,6 @@ static int scmi_sensor_config_get(const struct scmi_protocol_handle *ph, + put_unaligned_le32(sensor_id, t->tx.buf); + ret = ph->xops->do_xfer(ph, t); + if (!ret) { +- struct sensors_info *si = ph->get_priv(ph); + struct scmi_sensor_info *s = si->sensors + sensor_id; + + *sensor_config = get_unaligned_le64(t->rx.buf); +@@ -657,6 +660,10 @@ static int scmi_sensor_config_set(const struct scmi_protocol_handle *ph, + int ret; + struct scmi_xfer *t; + struct scmi_msg_sensor_config_set *msg; ++ struct sensors_info *si = ph->get_priv(ph); ++ ++ if (sensor_id >= si->num_sensors) ++ return -EINVAL; + + ret = ph->xops->xfer_get_init(ph, SENSOR_CONFIG_SET, + sizeof(*msg), 0, &t); +@@ -669,7 +676,6 @@ static int scmi_sensor_config_set(const struct scmi_protocol_handle *ph, + + ret = ph->xops->do_xfer(ph, t); + if (!ret) { +- struct sensors_info *si = ph->get_priv(ph); + struct scmi_sensor_info *s = si->sensors + sensor_id; + + s->sensor_config = sensor_config; +@@ -700,8 +706,11 @@ static int scmi_sensor_reading_get(const struct scmi_protocol_handle *ph, + int ret; + struct scmi_xfer *t; + struct scmi_msg_sensor_reading_get *sensor; ++ struct scmi_sensor_info *s; + struct sensors_info *si = ph->get_priv(ph); +- struct scmi_sensor_info *s = si->sensors + sensor_id; ++ ++ if (sensor_id >= si->num_sensors) ++ return -EINVAL; + + ret = ph->xops->xfer_get_init(ph, SENSOR_READING_GET, + sizeof(*sensor), 0, &t); +@@ -710,6 +719,7 @@ static int scmi_sensor_reading_get(const struct scmi_protocol_handle *ph, + + sensor = t->tx.buf; + sensor->id = cpu_to_le32(sensor_id); ++ s = si->sensors + sensor_id; + if (s->async) { + sensor->flags = cpu_to_le32(SENSOR_READ_ASYNC); + ret = ph->xops->do_xfer_with_response(ph, t); +@@ -764,9 +774,13 @@ scmi_sensor_reading_get_timestamped(const struct scmi_protocol_handle *ph, + int ret; + struct scmi_xfer *t; + struct scmi_msg_sensor_reading_get *sensor; ++ struct scmi_sensor_info *s; + struct sensors_info *si = ph->get_priv(ph); +- struct scmi_sensor_info *s = si->sensors + sensor_id; + ++ if (sensor_id >= si->num_sensors) ++ return -EINVAL; ++ ++ s = si->sensors + sensor_id; + if (!count || !readings || + (!s->num_axis && count > 1) || (s->num_axis && count > s->num_axis)) + return -EINVAL; +-- +2.35.1 + diff --git a/queue-5.15/firmware-arm_scmi-improve-checks-in-the-info_get-ope.patch b/queue-5.15/firmware-arm_scmi-improve-checks-in-the-info_get-ope.patch new file mode 100644 index 00000000000..e9dbe1a8d3c --- /dev/null +++ b/queue-5.15/firmware-arm_scmi-improve-checks-in-the-info_get-ope.patch @@ -0,0 +1,84 @@ +From b6dd0c117c4d7988008a99841fd02681b416c6ef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Aug 2022 18:27:27 +0100 +Subject: firmware: arm_scmi: Improve checks in the info_get operations + +From: Cristian Marussi + +[ Upstream commit 1ecb7d27b1af6705e9a4e94415b4d8cc8cf2fbfb ] + +SCMI protocols abstract and expose a number of protocol specific +resources like clocks, sensors and so on. Information about such +specific domain resources are generally exposed via an `info_get` +protocol operation. + +Improve the sanity check on these operations where needed. + +Link: https://lore.kernel.org/r/20220817172731.1185305-3-cristian.marussi@arm.com +Signed-off-by: Cristian Marussi +Signed-off-by: Sudeep Holla +Signed-off-by: Sasha Levin +--- + drivers/firmware/arm_scmi/clock.c | 6 +++++- + drivers/firmware/arm_scmi/sensors.c | 3 +++ + include/linux/scmi_protocol.h | 4 ++-- + 3 files changed, 10 insertions(+), 3 deletions(-) + +diff --git a/drivers/firmware/arm_scmi/clock.c b/drivers/firmware/arm_scmi/clock.c +index 492f3a9197ec..e76194a60edf 100644 +--- a/drivers/firmware/arm_scmi/clock.c ++++ b/drivers/firmware/arm_scmi/clock.c +@@ -315,9 +315,13 @@ static int scmi_clock_count_get(const struct scmi_protocol_handle *ph) + static const struct scmi_clock_info * + scmi_clock_info_get(const struct scmi_protocol_handle *ph, u32 clk_id) + { ++ struct scmi_clock_info *clk; + struct clock_info *ci = ph->get_priv(ph); +- struct scmi_clock_info *clk = ci->clk + clk_id; + ++ if (clk_id >= ci->num_clocks) ++ return NULL; ++ ++ clk = ci->clk + clk_id; + if (!clk->name[0]) + return NULL; + +diff --git a/drivers/firmware/arm_scmi/sensors.c b/drivers/firmware/arm_scmi/sensors.c +index cdbb287bd8bc..b479a9e29c96 100644 +--- a/drivers/firmware/arm_scmi/sensors.c ++++ b/drivers/firmware/arm_scmi/sensors.c +@@ -817,6 +817,9 @@ scmi_sensor_info_get(const struct scmi_protocol_handle *ph, u32 sensor_id) + { + struct sensors_info *si = ph->get_priv(ph); + ++ if (sensor_id >= si->num_sensors) ++ return NULL; ++ + return si->sensors + sensor_id; + } + +diff --git a/include/linux/scmi_protocol.h b/include/linux/scmi_protocol.h +index 80e781c51ddc..d22f62203ee3 100644 +--- a/include/linux/scmi_protocol.h ++++ b/include/linux/scmi_protocol.h +@@ -74,7 +74,7 @@ struct scmi_protocol_handle; + struct scmi_clk_proto_ops { + int (*count_get)(const struct scmi_protocol_handle *ph); + +- const struct scmi_clock_info *(*info_get) ++ const struct scmi_clock_info __must_check *(*info_get) + (const struct scmi_protocol_handle *ph, u32 clk_id); + int (*rate_get)(const struct scmi_protocol_handle *ph, u32 clk_id, + u64 *rate); +@@ -452,7 +452,7 @@ enum scmi_sensor_class { + */ + struct scmi_sensor_proto_ops { + int (*count_get)(const struct scmi_protocol_handle *ph); +- const struct scmi_sensor_info *(*info_get) ++ const struct scmi_sensor_info __must_check *(*info_get) + (const struct scmi_protocol_handle *ph, u32 sensor_id); + int (*trip_point_config)(const struct scmi_protocol_handle *ph, + u32 sensor_id, u8 trip_id, u64 trip_value); +-- +2.35.1 + diff --git a/queue-5.15/mm-huge_memory-minor-cleanup-for-split_huge_pages_al.patch b/queue-5.15/mm-huge_memory-minor-cleanup-for-split_huge_pages_al.patch new file mode 100644 index 00000000000..cee2d47b40b --- /dev/null +++ b/queue-5.15/mm-huge_memory-minor-cleanup-for-split_huge_pages_al.patch @@ -0,0 +1,58 @@ +From e82aa4522a50e75561e85c32d08c874cb1309143 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Jul 2022 21:21:57 +0800 +Subject: mm/huge_memory: minor cleanup for split_huge_pages_all + +From: Miaohe Lin + +[ Upstream commit a17206dac7b262e7abed5a05e34a6bd6bd0a9b06 ] + +There is nothing to do if a zone doesn't have any pages managed by the +buddy allocator. So we should check managed_zone instead. Also if a thp +is found, there's no need to traverse the subpages again. + +Link: https://lkml.kernel.org/r/20220704132201.14611-13-linmiaohe@huawei.com +Signed-off-by: Miaohe Lin +Cc: Matthew Wilcox +Cc: Muchun Song +Cc: Yang Shi +Cc: Zach O'Keefe +Signed-off-by: Andrew Morton +Stable-dep-of: 2b7aa91ba0e8 ("mm/huge_memory: use pfn_to_online_page() in split_huge_pages_all()") +Signed-off-by: Sasha Levin +--- + mm/huge_memory.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/mm/huge_memory.c b/mm/huge_memory.c +index 8cc150a88361..34d2979489fd 100644 +--- a/mm/huge_memory.c ++++ b/mm/huge_memory.c +@@ -2879,9 +2879,12 @@ static void split_huge_pages_all(void) + unsigned long total = 0, split = 0; + + pr_debug("Split all THPs\n"); +- for_each_populated_zone(zone) { ++ for_each_zone(zone) { ++ if (!managed_zone(zone)) ++ continue; + max_zone_pfn = zone_end_pfn(zone); + for (pfn = zone->zone_start_pfn; pfn < max_zone_pfn; pfn++) { ++ int nr_pages; + if (!pfn_valid(pfn)) + continue; + +@@ -2897,8 +2900,10 @@ static void split_huge_pages_all(void) + + total++; + lock_page(page); ++ nr_pages = thp_nr_pages(page); + if (!split_huge_page(page)) + split++; ++ pfn += nr_pages - 1; + unlock_page(page); + next: + put_page(page); +-- +2.35.1 + diff --git a/queue-5.15/mm-huge_memory-use-pfn_to_online_page-in-split_huge_.patch b/queue-5.15/mm-huge_memory-use-pfn_to_online_page-in-split_huge_.patch new file mode 100644 index 00000000000..bbfe9a60d3a --- /dev/null +++ b/queue-5.15/mm-huge_memory-use-pfn_to_online_page-in-split_huge_.patch @@ -0,0 +1,72 @@ +From b5ca1a496fe1123692a6e340da8510b664e40bc5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Sep 2022 13:11:50 +0900 +Subject: mm/huge_memory: use pfn_to_online_page() in split_huge_pages_all() + +From: Naoya Horiguchi + +[ Upstream commit 2b7aa91ba0e86b8643f5d3c83874c80599c731d7 ] + +NULL pointer dereference is triggered when calling thp split via debugfs +on the system with offlined memory blocks. With debug option enabled, the +following kernel messages are printed out: + + page:00000000467f4890 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x121c000 + flags: 0x17fffc00000000(node=0|zone=2|lastcpupid=0x1ffff) + raw: 0017fffc00000000 0000000000000000 dead000000000122 0000000000000000 + raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 + page dumped because: unmovable page + page:000000007d7ab72e is uninitialized and poisoned + page dumped because: VM_BUG_ON_PAGE(PagePoisoned(p)) + ------------[ cut here ]------------ + kernel BUG at include/linux/mm.h:1248! + invalid opcode: 0000 [#1] PREEMPT SMP PTI + CPU: 16 PID: 20964 Comm: bash Tainted: G I 6.0.0-rc3-foll-numa+ #41 + ... + RIP: 0010:split_huge_pages_write+0xcf4/0xe30 + +This shows that page_to_nid() in page_zone() is unexpectedly called for an +offlined memmap. + +Use pfn_to_online_page() to get struct page in PFN walker. + +Link: https://lkml.kernel.org/r/20220908041150.3430269-1-naoya.horiguchi@linux.dev +Fixes: f1dd2cd13c4b ("mm, memory_hotplug: do not associate hotadded memory to zones until online") [visible after d0dc12e86b319] +Signed-off-by: Naoya Horiguchi +Co-developed-by: David Hildenbrand +Signed-off-by: David Hildenbrand +Reviewed-by: Yang Shi +Acked-by: Michal Hocko +Reviewed-by: Miaohe Lin +Reviewed-by: Oscar Salvador +Acked-by: Kirill A. Shutemov +Cc: Matthew Wilcox +Cc: Muchun Song +Cc: [5.10+] +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + mm/huge_memory.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/mm/huge_memory.c b/mm/huge_memory.c +index 34d2979489fd..07941a1540cb 100644 +--- a/mm/huge_memory.c ++++ b/mm/huge_memory.c +@@ -2885,11 +2885,9 @@ static void split_huge_pages_all(void) + max_zone_pfn = zone_end_pfn(zone); + for (pfn = zone->zone_start_pfn; pfn < max_zone_pfn; pfn++) { + int nr_pages; +- if (!pfn_valid(pfn)) +- continue; + +- page = pfn_to_page(pfn); +- if (!get_page_unless_zero(page)) ++ page = pfn_to_online_page(pfn); ++ if (!page || !get_page_unless_zero(page)) + continue; + + if (zone != page_zone(page)) +-- +2.35.1 + diff --git a/queue-5.15/mmc-core-replace-with-already-defined-values-for-rea.patch b/queue-5.15/mmc-core-replace-with-already-defined-values-for-rea.patch new file mode 100644 index 00000000000..ac2c3bb196b --- /dev/null +++ b/queue-5.15/mmc-core-replace-with-already-defined-values-for-rea.patch @@ -0,0 +1,38 @@ +From 949804d3925ce75b880dc18cdf35de26bebfd4ee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Jul 2022 09:48:40 +0900 +Subject: mmc: core: Replace with already defined values for readability + +From: ChanWoo Lee + +[ Upstream commit e427266460826bea21b70f9b2bb29decfb2c2620 ] + +SD_ROCR_S18A is already defined and is used to check the rocr value, so +let's replace with already defined values for readability. + +Signed-off-by: ChanWoo Lee +Reviewed-by: Linus Walleij +Link: https://lore.kernel.org/r/20220706004840.24812-1-cw9316.lee@samsung.com +Signed-off-by: Ulf Hansson +Stable-dep-of: e9233917a7e5 ("mmc: core: Terminate infinite loop in SD-UHS voltage switch") +Signed-off-by: Sasha Levin +--- + drivers/mmc/core/sd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/mmc/core/sd.c b/drivers/mmc/core/sd.c +index 7e8d4abed602..eaa2679b9466 100644 +--- a/drivers/mmc/core/sd.c ++++ b/drivers/mmc/core/sd.c +@@ -863,7 +863,7 @@ int mmc_sd_get_cid(struct mmc_host *host, u32 ocr, u32 *cid, u32 *rocr) + * the CCS bit is set as well. We deliberately deviate from the spec in + * regards to this, which allows UHS-I to be supported for SDSC cards. + */ +- if (!mmc_host_is_spi(host) && rocr && (*rocr & 0x01000000)) { ++ if (!mmc_host_is_spi(host) && rocr && (*rocr & SD_ROCR_S18A)) { + err = mmc_set_uhs_voltage(host, pocr); + if (err == -EAGAIN) { + retries--; +-- +2.35.1 + diff --git a/queue-5.15/mmc-core-terminate-infinite-loop-in-sd-uhs-voltage-s.patch b/queue-5.15/mmc-core-terminate-infinite-loop-in-sd-uhs-voltage-s.patch new file mode 100644 index 00000000000..abb2ca12611 --- /dev/null +++ b/queue-5.15/mmc-core-terminate-infinite-loop-in-sd-uhs-voltage-s.patch @@ -0,0 +1,68 @@ +From 922ebc6438d792f40a16c41261b1a2b44615c50a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Sep 2022 18:40:10 -0700 +Subject: mmc: core: Terminate infinite loop in SD-UHS voltage switch + +From: Brian Norris + +[ Upstream commit e9233917a7e53980664efbc565888163c0a33c3f ] + +This loop intends to retry a max of 10 times, with some implicit +termination based on the SD_{R,}OCR_S18A bit. Unfortunately, the +termination condition depends on the value reported by the SD card +(*rocr), which may or may not correctly reflect what we asked it to do. + +Needless to say, it's not wise to rely on the card doing what we expect; +we should at least terminate the loop regardless. So, check both the +input and output values, so we ensure we will terminate regardless of +the SD card behavior. + +Note that SDIO learned a similar retry loop in commit 0797e5f1453b +("mmc: core: Fixup signal voltage switch"), but that used the 'ocr' +result, and so the current pre-terminating condition looks like: + + rocr & ocr & R4_18V_PRESENT + +(i.e., it doesn't have the same bug.) + +This addresses a number of crash reports seen on ChromeOS that look +like the following: + + ... // lots of repeated: ... + <4>[13142.846061] mmc1: Skipping voltage switch + <4>[13143.406087] mmc1: Skipping voltage switch + <4>[13143.964724] mmc1: Skipping voltage switch + <4>[13144.526089] mmc1: Skipping voltage switch + <4>[13145.086088] mmc1: Skipping voltage switch + <4>[13145.645941] mmc1: Skipping voltage switch + <3>[13146.153969] INFO: task halt:30352 blocked for more than 122 seconds. + ... + +Fixes: f2119df6b764 ("mmc: sd: add support for signal voltage switch procedure") +Cc: +Signed-off-by: Brian Norris +Reviewed-by: Guenter Roeck +Link: https://lore.kernel.org/r/20220914014010.2076169-1-briannorris@chromium.org +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/core/sd.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/mmc/core/sd.c b/drivers/mmc/core/sd.c +index eaa2679b9466..86a8a1f56583 100644 +--- a/drivers/mmc/core/sd.c ++++ b/drivers/mmc/core/sd.c +@@ -863,7 +863,8 @@ int mmc_sd_get_cid(struct mmc_host *host, u32 ocr, u32 *cid, u32 *rocr) + * the CCS bit is set as well. We deliberately deviate from the spec in + * regards to this, which allows UHS-I to be supported for SDSC cards. + */ +- if (!mmc_host_is_spi(host) && rocr && (*rocr & SD_ROCR_S18A)) { ++ if (!mmc_host_is_spi(host) && (ocr & SD_OCR_S18R) && ++ rocr && (*rocr & SD_ROCR_S18A)) { + err = mmc_set_uhs_voltage(host, pocr); + if (err == -EAGAIN) { + retries--; +-- +2.35.1 + diff --git a/queue-5.15/net-atlantic-fix-potential-memory-leak-in-aq_ndev_cl.patch b/queue-5.15/net-atlantic-fix-potential-memory-leak-in-aq_ndev_cl.patch new file mode 100644 index 00000000000..7cac1962f40 --- /dev/null +++ b/queue-5.15/net-atlantic-fix-potential-memory-leak-in-aq_ndev_cl.patch @@ -0,0 +1,42 @@ +From 4064374106c76c05e4e35ca4db8fec3bb09ade53 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Sep 2022 09:42:38 +0800 +Subject: net: atlantic: fix potential memory leak in aq_ndev_close() + +From: Jianglei Nie + +[ Upstream commit 65e5d27df61283e5390f04b09dc79cd832f95607 ] + +If aq_nic_stop() fails, aq_ndev_close() returns err without calling +aq_nic_deinit() to release the relevant memory and resource, which +will lead to a memory leak. + +We can fix it by deleting the if condition judgment and goto statement to +call aq_nic_deinit() directly after aq_nic_stop() to fix the memory leak. + +Signed-off-by: Jianglei Nie +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/aquantia/atlantic/aq_main.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_main.c b/drivers/net/ethernet/aquantia/atlantic/aq_main.c +index e22935ce9573..f069312463fb 100644 +--- a/drivers/net/ethernet/aquantia/atlantic/aq_main.c ++++ b/drivers/net/ethernet/aquantia/atlantic/aq_main.c +@@ -89,11 +89,8 @@ static int aq_ndev_close(struct net_device *ndev) + int err = 0; + + err = aq_nic_stop(aq_nic); +- if (err < 0) +- goto err_exit; + aq_nic_deinit(aq_nic, true); + +-err_exit: + return err; + } + +-- +2.35.1 + diff --git a/queue-5.15/net-ieee802154-fix-uninit-value-bug-in-dgram_sendmsg.patch b/queue-5.15/net-ieee802154-fix-uninit-value-bug-in-dgram_sendmsg.patch new file mode 100644 index 00000000000..9bfa4cf0021 --- /dev/null +++ b/queue-5.15/net-ieee802154-fix-uninit-value-bug-in-dgram_sendmsg.patch @@ -0,0 +1,173 @@ +From c403e51f3d29a5d683683a6a92da28134899fe3b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Sep 2022 20:19:27 +0800 +Subject: net/ieee802154: fix uninit value bug in dgram_sendmsg + +From: Haimin Zhang + +[ Upstream commit 94160108a70c8af17fa1484a37e05181c0e094af ] + +There is uninit value bug in dgram_sendmsg function in +net/ieee802154/socket.c when the length of valid data pointed by the +msg->msg_name isn't verified. + +We introducing a helper function ieee802154_sockaddr_check_size to +check namelen. First we check there is addr_type in ieee802154_addr_sa. +Then, we check namelen according to addr_type. + +Also fixed in raw_bind, dgram_bind, dgram_connect. + +Signed-off-by: Haimin Zhang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/net/ieee802154_netdev.h | 37 +++++++++++++++++++++++++++++ + net/ieee802154/socket.c | 42 ++++++++++++++++++--------------- + 2 files changed, 60 insertions(+), 19 deletions(-) + +diff --git a/include/net/ieee802154_netdev.h b/include/net/ieee802154_netdev.h +index d0d188c3294b..a8994f307fc3 100644 +--- a/include/net/ieee802154_netdev.h ++++ b/include/net/ieee802154_netdev.h +@@ -15,6 +15,22 @@ + #ifndef IEEE802154_NETDEVICE_H + #define IEEE802154_NETDEVICE_H + ++#define IEEE802154_REQUIRED_SIZE(struct_type, member) \ ++ (offsetof(typeof(struct_type), member) + \ ++ sizeof(((typeof(struct_type) *)(NULL))->member)) ++ ++#define IEEE802154_ADDR_OFFSET \ ++ offsetof(typeof(struct sockaddr_ieee802154), addr) ++ ++#define IEEE802154_MIN_NAMELEN (IEEE802154_ADDR_OFFSET + \ ++ IEEE802154_REQUIRED_SIZE(struct ieee802154_addr_sa, addr_type)) ++ ++#define IEEE802154_NAMELEN_SHORT (IEEE802154_ADDR_OFFSET + \ ++ IEEE802154_REQUIRED_SIZE(struct ieee802154_addr_sa, short_addr)) ++ ++#define IEEE802154_NAMELEN_LONG (IEEE802154_ADDR_OFFSET + \ ++ IEEE802154_REQUIRED_SIZE(struct ieee802154_addr_sa, hwaddr)) ++ + #include + #include + #include +@@ -165,6 +181,27 @@ static inline void ieee802154_devaddr_to_raw(void *raw, __le64 addr) + memcpy(raw, &temp, IEEE802154_ADDR_LEN); + } + ++static inline int ++ieee802154_sockaddr_check_size(struct sockaddr_ieee802154 *daddr, int len) ++{ ++ struct ieee802154_addr_sa *sa; ++ ++ sa = &daddr->addr; ++ if (len < IEEE802154_MIN_NAMELEN) ++ return -EINVAL; ++ switch (sa->addr_type) { ++ case IEEE802154_ADDR_SHORT: ++ if (len < IEEE802154_NAMELEN_SHORT) ++ return -EINVAL; ++ break; ++ case IEEE802154_ADDR_LONG: ++ if (len < IEEE802154_NAMELEN_LONG) ++ return -EINVAL; ++ break; ++ } ++ return 0; ++} ++ + static inline void ieee802154_addr_from_sa(struct ieee802154_addr *a, + const struct ieee802154_addr_sa *sa) + { +diff --git a/net/ieee802154/socket.c b/net/ieee802154/socket.c +index 7bb9ef35c570..fd5862f9e26a 100644 +--- a/net/ieee802154/socket.c ++++ b/net/ieee802154/socket.c +@@ -200,8 +200,9 @@ static int raw_bind(struct sock *sk, struct sockaddr *_uaddr, int len) + int err = 0; + struct net_device *dev = NULL; + +- if (len < sizeof(*uaddr)) +- return -EINVAL; ++ err = ieee802154_sockaddr_check_size(uaddr, len); ++ if (err < 0) ++ return err; + + uaddr = (struct sockaddr_ieee802154 *)_uaddr; + if (uaddr->family != AF_IEEE802154) +@@ -493,7 +494,8 @@ static int dgram_bind(struct sock *sk, struct sockaddr *uaddr, int len) + + ro->bound = 0; + +- if (len < sizeof(*addr)) ++ err = ieee802154_sockaddr_check_size(addr, len); ++ if (err < 0) + goto out; + + if (addr->family != AF_IEEE802154) +@@ -564,8 +566,9 @@ static int dgram_connect(struct sock *sk, struct sockaddr *uaddr, + struct dgram_sock *ro = dgram_sk(sk); + int err = 0; + +- if (len < sizeof(*addr)) +- return -EINVAL; ++ err = ieee802154_sockaddr_check_size(addr, len); ++ if (err < 0) ++ return err; + + if (addr->family != AF_IEEE802154) + return -EINVAL; +@@ -604,6 +607,7 @@ static int dgram_sendmsg(struct sock *sk, struct msghdr *msg, size_t size) + struct ieee802154_mac_cb *cb; + struct dgram_sock *ro = dgram_sk(sk); + struct ieee802154_addr dst_addr; ++ DECLARE_SOCKADDR(struct sockaddr_ieee802154*, daddr, msg->msg_name); + int hlen, tlen; + int err; + +@@ -612,10 +616,20 @@ static int dgram_sendmsg(struct sock *sk, struct msghdr *msg, size_t size) + return -EOPNOTSUPP; + } + +- if (!ro->connected && !msg->msg_name) +- return -EDESTADDRREQ; +- else if (ro->connected && msg->msg_name) +- return -EISCONN; ++ if (msg->msg_name) { ++ if (ro->connected) ++ return -EISCONN; ++ if (msg->msg_namelen < IEEE802154_MIN_NAMELEN) ++ return -EINVAL; ++ err = ieee802154_sockaddr_check_size(daddr, msg->msg_namelen); ++ if (err < 0) ++ return err; ++ ieee802154_addr_from_sa(&dst_addr, &daddr->addr); ++ } else { ++ if (!ro->connected) ++ return -EDESTADDRREQ; ++ dst_addr = ro->dst_addr; ++ } + + if (!ro->bound) + dev = dev_getfirstbyhwtype(sock_net(sk), ARPHRD_IEEE802154); +@@ -651,16 +665,6 @@ static int dgram_sendmsg(struct sock *sk, struct msghdr *msg, size_t size) + cb = mac_cb_init(skb); + cb->type = IEEE802154_FC_TYPE_DATA; + cb->ackreq = ro->want_ack; +- +- if (msg->msg_name) { +- DECLARE_SOCKADDR(struct sockaddr_ieee802154*, +- daddr, msg->msg_name); +- +- ieee802154_addr_from_sa(&dst_addr, &daddr->addr); +- } else { +- dst_addr = ro->dst_addr; +- } +- + cb->secen = ro->secen; + cb->secen_override = ro->secen_override; + cb->seclevel = ro->seclevel; +-- +2.35.1 + diff --git a/queue-5.15/net-marvell-prestera-add-support-for-for-aldrin2.patch b/queue-5.15/net-marvell-prestera-add-support-for-for-aldrin2.patch new file mode 100644 index 00000000000..1a6a24ee492 --- /dev/null +++ b/queue-5.15/net-marvell-prestera-add-support-for-for-aldrin2.patch @@ -0,0 +1,37 @@ +From 5a8d3947eab6b05e21e9a14102e71eedf4c318e5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Sep 2022 16:14:46 +0300 +Subject: net: marvell: prestera: add support for for Aldrin2 + +From: Oleksandr Mazur + +[ Upstream commit 9124dbcc2dd6c51e81f97f63f7807118c4eb140a ] + +Aldrin2 (98DX8525) is a Marvell Prestera PP, with 100G support. + +Signed-off-by: Oleksandr Mazur + +V2: + - retarget to net tree instead of net-next; + - fix missed colon in patch subject ('net marvell' vs 'net: mavell'); +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/prestera/prestera_pci.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/marvell/prestera/prestera_pci.c b/drivers/net/ethernet/marvell/prestera/prestera_pci.c +index a250d394da38..a8d7b889ebee 100644 +--- a/drivers/net/ethernet/marvell/prestera/prestera_pci.c ++++ b/drivers/net/ethernet/marvell/prestera/prestera_pci.c +@@ -815,6 +815,7 @@ static void prestera_pci_remove(struct pci_dev *pdev) + static const struct pci_device_id prestera_pci_devices[] = { + { PCI_DEVICE(PCI_VENDOR_ID_MARVELL, 0xC804) }, + { PCI_DEVICE(PCI_VENDOR_ID_MARVELL, 0xC80C) }, ++ { PCI_DEVICE(PCI_VENDOR_ID_MARVELL, 0xCC1E) }, + { } + }; + MODULE_DEVICE_TABLE(pci, prestera_pci_devices); +-- +2.35.1 + diff --git a/queue-5.15/net-mlx5-disable-irq-when-locking-lag_lock.patch b/queue-5.15/net-mlx5-disable-irq-when-locking-lag_lock.patch new file mode 100644 index 00000000000..0783c13c294 --- /dev/null +++ b/queue-5.15/net-mlx5-disable-irq-when-locking-lag_lock.patch @@ -0,0 +1,406 @@ +From 9bbe33249f7b8971a30d7b3470beb2f557787437 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Aug 2022 13:46:36 +0200 +Subject: net/mlx5: Disable irq when locking lag_lock + +From: Vlad Buslov + +[ Upstream commit 8e93f29422ffe968d7161f91acdf0d47f5323727 ] + +The lag_lock is taken from both process and softirq contexts which results +lockdep warning[0] about potential deadlock. However, just disabling +softirqs by using *_bh spinlock API is not enough since it will cause +warning in some contexts where the lock is obtained with hard irqs +disabled. To fix the issue save current irq state, disable them before +obtaining the lock an re-enable irqs from saved state after releasing it. + +[0]: + +[Sun Aug 7 13:12:29 2022] ================================ +[Sun Aug 7 13:12:29 2022] WARNING: inconsistent lock state +[Sun Aug 7 13:12:29 2022] 5.19.0_for_upstream_debug_2022_08_04_16_06 #1 Not tainted +[Sun Aug 7 13:12:29 2022] -------------------------------- +[Sun Aug 7 13:12:29 2022] inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage. +[Sun Aug 7 13:12:29 2022] swapper/0/0 [HC0[0]:SC1[1]:HE1:SE0] takes: +[Sun Aug 7 13:12:29 2022] ffffffffa06dc0d8 (lag_lock){+.?.}-{2:2}, at: mlx5_lag_is_shared_fdb+0x1f/0x120 [mlx5_core] +[Sun Aug 7 13:12:29 2022] {SOFTIRQ-ON-W} state was registered at: +[Sun Aug 7 13:12:29 2022] lock_acquire+0x1c1/0x550 +[Sun Aug 7 13:12:29 2022] _raw_spin_lock+0x2c/0x40 +[Sun Aug 7 13:12:29 2022] mlx5_lag_add_netdev+0x13b/0x480 [mlx5_core] +[Sun Aug 7 13:12:29 2022] mlx5e_nic_enable+0x114/0x470 [mlx5_core] +[Sun Aug 7 13:12:29 2022] mlx5e_attach_netdev+0x30e/0x6a0 [mlx5_core] +[Sun Aug 7 13:12:29 2022] mlx5e_resume+0x105/0x160 [mlx5_core] +[Sun Aug 7 13:12:29 2022] mlx5e_probe+0xac3/0x14f0 [mlx5_core] +[Sun Aug 7 13:12:29 2022] auxiliary_bus_probe+0x9d/0xe0 +[Sun Aug 7 13:12:29 2022] really_probe+0x1e0/0xaa0 +[Sun Aug 7 13:12:29 2022] __driver_probe_device+0x219/0x480 +[Sun Aug 7 13:12:29 2022] driver_probe_device+0x49/0x130 +[Sun Aug 7 13:12:29 2022] __driver_attach+0x1e4/0x4d0 +[Sun Aug 7 13:12:29 2022] bus_for_each_dev+0x11e/0x1a0 +[Sun Aug 7 13:12:29 2022] bus_add_driver+0x3f4/0x5a0 +[Sun Aug 7 13:12:29 2022] driver_register+0x20f/0x390 +[Sun Aug 7 13:12:29 2022] __auxiliary_driver_register+0x14e/0x260 +[Sun Aug 7 13:12:29 2022] mlx5e_init+0x38/0x90 [mlx5_core] +[Sun Aug 7 13:12:29 2022] vhost_iotlb_itree_augment_rotate+0xcb/0x180 [vhost_iotlb] +[Sun Aug 7 13:12:29 2022] do_one_initcall+0xc4/0x400 +[Sun Aug 7 13:12:29 2022] do_init_module+0x18a/0x620 +[Sun Aug 7 13:12:29 2022] load_module+0x563a/0x7040 +[Sun Aug 7 13:12:29 2022] __do_sys_finit_module+0x122/0x1d0 +[Sun Aug 7 13:12:29 2022] do_syscall_64+0x3d/0x90 +[Sun Aug 7 13:12:29 2022] entry_SYSCALL_64_after_hwframe+0x46/0xb0 +[Sun Aug 7 13:12:29 2022] irq event stamp: 3596508 +[Sun Aug 7 13:12:29 2022] hardirqs last enabled at (3596508): [] __local_bh_enable_ip+0xa2/0x100 +[Sun Aug 7 13:12:29 2022] hardirqs last disabled at (3596507): [] __local_bh_enable_ip+0xba/0x100 +[Sun Aug 7 13:12:29 2022] softirqs last enabled at (3596488): [] irq_exit_rcu+0x11a/0x170 +[Sun Aug 7 13:12:29 2022] softirqs last disabled at (3596495): [] irq_exit_rcu+0x11a/0x170 +[Sun Aug 7 13:12:29 2022] + other info that might help us debug this: +[Sun Aug 7 13:12:29 2022] Possible unsafe locking scenario: + +[Sun Aug 7 13:12:29 2022] CPU0 +[Sun Aug 7 13:12:29 2022] ---- +[Sun Aug 7 13:12:29 2022] lock(lag_lock); +[Sun Aug 7 13:12:29 2022] +[Sun Aug 7 13:12:29 2022] lock(lag_lock); +[Sun Aug 7 13:12:29 2022] + *** DEADLOCK *** + +[Sun Aug 7 13:12:29 2022] 4 locks held by swapper/0/0: +[Sun Aug 7 13:12:29 2022] #0: ffffffff84643260 (rcu_read_lock){....}-{1:2}, at: mlx5e_napi_poll+0x43/0x20a0 [mlx5_core] +[Sun Aug 7 13:12:29 2022] #1: ffffffff84643260 (rcu_read_lock){....}-{1:2}, at: netif_receive_skb_list_internal+0x2d7/0xd60 +[Sun Aug 7 13:12:29 2022] #2: ffff888144a18b58 (&br->hash_lock){+.-.}-{2:2}, at: br_fdb_update+0x301/0x570 +[Sun Aug 7 13:12:29 2022] #3: ffffffff84643260 (rcu_read_lock){....}-{1:2}, at: atomic_notifier_call_chain+0x5/0x1d0 +[Sun Aug 7 13:12:29 2022] + stack backtrace: +[Sun Aug 7 13:12:29 2022] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.19.0_for_upstream_debug_2022_08_04_16_06 #1 +[Sun Aug 7 13:12:29 2022] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 +[Sun Aug 7 13:12:29 2022] Call Trace: +[Sun Aug 7 13:12:29 2022] +[Sun Aug 7 13:12:29 2022] dump_stack_lvl+0x57/0x7d +[Sun Aug 7 13:12:29 2022] mark_lock.part.0.cold+0x5f/0x92 +[Sun Aug 7 13:12:29 2022] ? lock_chain_count+0x20/0x20 +[Sun Aug 7 13:12:29 2022] ? unwind_next_frame+0x1c4/0x1b50 +[Sun Aug 7 13:12:29 2022] ? secondary_startup_64_no_verify+0xcd/0xdb +[Sun Aug 7 13:12:29 2022] ? mlx5e_napi_poll+0x4e9/0x20a0 [mlx5_core] +[Sun Aug 7 13:12:29 2022] ? mlx5e_napi_poll+0x4e9/0x20a0 [mlx5_core] +[Sun Aug 7 13:12:29 2022] ? stack_access_ok+0x1d0/0x1d0 +[Sun Aug 7 13:12:29 2022] ? start_kernel+0x3a7/0x3c5 +[Sun Aug 7 13:12:29 2022] __lock_acquire+0x1260/0x6720 +[Sun Aug 7 13:12:29 2022] ? lock_chain_count+0x20/0x20 +[Sun Aug 7 13:12:29 2022] ? lock_chain_count+0x20/0x20 +[Sun Aug 7 13:12:29 2022] ? register_lock_class+0x1880/0x1880 +[Sun Aug 7 13:12:29 2022] ? mark_lock.part.0+0xed/0x3060 +[Sun Aug 7 13:12:29 2022] ? stack_trace_save+0x91/0xc0 +[Sun Aug 7 13:12:29 2022] lock_acquire+0x1c1/0x550 +[Sun Aug 7 13:12:29 2022] ? mlx5_lag_is_shared_fdb+0x1f/0x120 [mlx5_core] +[Sun Aug 7 13:12:29 2022] ? lockdep_hardirqs_on_prepare+0x400/0x400 +[Sun Aug 7 13:12:29 2022] ? __lock_acquire+0xd6f/0x6720 +[Sun Aug 7 13:12:29 2022] _raw_spin_lock+0x2c/0x40 +[Sun Aug 7 13:12:29 2022] ? mlx5_lag_is_shared_fdb+0x1f/0x120 [mlx5_core] +[Sun Aug 7 13:12:29 2022] mlx5_lag_is_shared_fdb+0x1f/0x120 [mlx5_core] +[Sun Aug 7 13:12:29 2022] mlx5_esw_bridge_rep_vport_num_vhca_id_get+0x1a0/0x600 [mlx5_core] +[Sun Aug 7 13:12:29 2022] ? mlx5_esw_bridge_update_work+0x90/0x90 [mlx5_core] +[Sun Aug 7 13:12:29 2022] ? lock_acquire+0x1c1/0x550 +[Sun Aug 7 13:12:29 2022] mlx5_esw_bridge_switchdev_event+0x185/0x8f0 [mlx5_core] +[Sun Aug 7 13:12:29 2022] ? mlx5_esw_bridge_port_obj_attr_set+0x3e0/0x3e0 [mlx5_core] +[Sun Aug 7 13:12:29 2022] ? check_chain_key+0x24a/0x580 +[Sun Aug 7 13:12:29 2022] atomic_notifier_call_chain+0xd7/0x1d0 +[Sun Aug 7 13:12:29 2022] br_switchdev_fdb_notify+0xea/0x100 +[Sun Aug 7 13:12:29 2022] ? br_switchdev_set_port_flag+0x310/0x310 +[Sun Aug 7 13:12:29 2022] fdb_notify+0x11b/0x150 +[Sun Aug 7 13:12:29 2022] br_fdb_update+0x34c/0x570 +[Sun Aug 7 13:12:29 2022] ? lock_chain_count+0x20/0x20 +[Sun Aug 7 13:12:29 2022] ? br_fdb_add_local+0x50/0x50 +[Sun Aug 7 13:12:29 2022] ? br_allowed_ingress+0x5f/0x1070 +[Sun Aug 7 13:12:29 2022] ? check_chain_key+0x24a/0x580 +[Sun Aug 7 13:12:29 2022] br_handle_frame_finish+0x786/0x18e0 +[Sun Aug 7 13:12:29 2022] ? check_chain_key+0x24a/0x580 +[Sun Aug 7 13:12:29 2022] ? br_handle_local_finish+0x20/0x20 +[Sun Aug 7 13:12:29 2022] ? __lock_acquire+0xd6f/0x6720 +[Sun Aug 7 13:12:29 2022] ? sctp_inet_bind_verify+0x4d/0x190 +[Sun Aug 7 13:12:29 2022] ? xlog_unpack_data+0x2e0/0x310 +[Sun Aug 7 13:12:29 2022] ? br_handle_local_finish+0x20/0x20 +[Sun Aug 7 13:12:29 2022] br_nf_hook_thresh+0x227/0x380 [br_netfilter] +[Sun Aug 7 13:12:29 2022] ? setup_pre_routing+0x460/0x460 [br_netfilter] +[Sun Aug 7 13:12:29 2022] ? br_handle_local_finish+0x20/0x20 +[Sun Aug 7 13:12:29 2022] ? br_nf_pre_routing_ipv6+0x48b/0x69c [br_netfilter] +[Sun Aug 7 13:12:29 2022] br_nf_pre_routing_finish_ipv6+0x5c2/0xbf0 [br_netfilter] +[Sun Aug 7 13:12:29 2022] ? br_handle_local_finish+0x20/0x20 +[Sun Aug 7 13:12:29 2022] br_nf_pre_routing_ipv6+0x4c6/0x69c [br_netfilter] +[Sun Aug 7 13:12:29 2022] ? br_validate_ipv6+0x9e0/0x9e0 [br_netfilter] +[Sun Aug 7 13:12:29 2022] ? br_nf_forward_arp+0xb70/0xb70 [br_netfilter] +[Sun Aug 7 13:12:29 2022] ? br_nf_pre_routing+0xacf/0x1160 [br_netfilter] +[Sun Aug 7 13:12:29 2022] br_handle_frame+0x8a9/0x1270 +[Sun Aug 7 13:12:29 2022] ? br_handle_frame_finish+0x18e0/0x18e0 +[Sun Aug 7 13:12:29 2022] ? register_lock_class+0x1880/0x1880 +[Sun Aug 7 13:12:29 2022] ? br_handle_local_finish+0x20/0x20 +[Sun Aug 7 13:12:29 2022] ? bond_handle_frame+0xf9/0xac0 [bonding] +[Sun Aug 7 13:12:29 2022] ? br_handle_frame_finish+0x18e0/0x18e0 +[Sun Aug 7 13:12:29 2022] __netif_receive_skb_core+0x7c0/0x2c70 +[Sun Aug 7 13:12:29 2022] ? check_chain_key+0x24a/0x580 +[Sun Aug 7 13:12:29 2022] ? generic_xdp_tx+0x5b0/0x5b0 +[Sun Aug 7 13:12:29 2022] ? __lock_acquire+0xd6f/0x6720 +[Sun Aug 7 13:12:29 2022] ? register_lock_class+0x1880/0x1880 +[Sun Aug 7 13:12:29 2022] ? check_chain_key+0x24a/0x580 +[Sun Aug 7 13:12:29 2022] __netif_receive_skb_list_core+0x2d7/0x8a0 +[Sun Aug 7 13:12:29 2022] ? lock_acquire+0x1c1/0x550 +[Sun Aug 7 13:12:29 2022] ? process_backlog+0x960/0x960 +[Sun Aug 7 13:12:29 2022] ? lockdep_hardirqs_on_prepare+0x129/0x400 +[Sun Aug 7 13:12:29 2022] ? kvm_clock_get_cycles+0x14/0x20 +[Sun Aug 7 13:12:29 2022] netif_receive_skb_list_internal+0x5f4/0xd60 +[Sun Aug 7 13:12:29 2022] ? do_xdp_generic+0x150/0x150 +[Sun Aug 7 13:12:29 2022] ? mlx5e_poll_rx_cq+0xf6b/0x2960 [mlx5_core] +[Sun Aug 7 13:12:29 2022] ? mlx5e_poll_ico_cq+0x3d/0x1590 [mlx5_core] +[Sun Aug 7 13:12:29 2022] napi_complete_done+0x188/0x710 +[Sun Aug 7 13:12:29 2022] mlx5e_napi_poll+0x4e9/0x20a0 [mlx5_core] +[Sun Aug 7 13:12:29 2022] ? __queue_work+0x53c/0xeb0 +[Sun Aug 7 13:12:29 2022] __napi_poll+0x9f/0x540 +[Sun Aug 7 13:12:29 2022] net_rx_action+0x420/0xb70 +[Sun Aug 7 13:12:29 2022] ? napi_threaded_poll+0x470/0x470 +[Sun Aug 7 13:12:29 2022] ? __common_interrupt+0x79/0x1a0 +[Sun Aug 7 13:12:29 2022] __do_softirq+0x271/0x92c +[Sun Aug 7 13:12:29 2022] irq_exit_rcu+0x11a/0x170 +[Sun Aug 7 13:12:29 2022] common_interrupt+0x7d/0xa0 +[Sun Aug 7 13:12:29 2022] +[Sun Aug 7 13:12:29 2022] +[Sun Aug 7 13:12:29 2022] asm_common_interrupt+0x22/0x40 +[Sun Aug 7 13:12:29 2022] RIP: 0010:default_idle+0x42/0x60 +[Sun Aug 7 13:12:29 2022] Code: c1 83 e0 07 48 c1 e9 03 83 c0 03 0f b6 14 11 38 d0 7c 04 84 d2 75 14 8b 05 6b f1 22 02 85 c0 7e 07 0f 00 2d 80 3b 4a 00 fb f4 48 c7 c7 e0 07 7e 85 e8 21 bd 40 fe eb de 66 66 2e 0f 1f 84 00 +[Sun Aug 7 13:12:29 2022] RSP: 0018:ffffffff84407e18 EFLAGS: 00000242 +[Sun Aug 7 13:12:29 2022] RAX: 0000000000000001 RBX: ffffffff84ec4a68 RCX: 1ffffffff0afc0fc +[Sun Aug 7 13:12:29 2022] RDX: 0000000000000004 RSI: 0000000000000000 RDI: ffffffff835b1fac +[Sun Aug 7 13:12:29 2022] RBP: 0000000000000000 R08: 0000000000000001 R09: ffff8884d2c44ac3 +[Sun Aug 7 13:12:29 2022] R10: ffffed109a588958 R11: 00000000ffffffff R12: 0000000000000000 +[Sun Aug 7 13:12:29 2022] R13: ffffffff84efac20 R14: 0000000000000000 R15: dffffc0000000000 +[Sun Aug 7 13:12:29 2022] ? default_idle_call+0xcc/0x460 +[Sun Aug 7 13:12:29 2022] default_idle_call+0xec/0x460 +[Sun Aug 7 13:12:29 2022] do_idle+0x394/0x450 +[Sun Aug 7 13:12:29 2022] ? arch_cpu_idle_exit+0x40/0x40 +[Sun Aug 7 13:12:29 2022] cpu_startup_entry+0x19/0x20 +[Sun Aug 7 13:12:29 2022] rest_init+0x156/0x250 +[Sun Aug 7 13:12:29 2022] arch_call_rest_init+0xf/0x15 +[Sun Aug 7 13:12:29 2022] start_kernel+0x3a7/0x3c5 +[Sun Aug 7 13:12:29 2022] secondary_startup_64_no_verify+0xcd/0xdb +[Sun Aug 7 13:12:29 2022] + +Fixes: ff9b7521468b ("net/mlx5: Bridge, support LAG") +Signed-off-by: Vlad Buslov +Reviewed-by: Mark Bloch +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/lag.c | 55 +++++++++++-------- + 1 file changed, 33 insertions(+), 22 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lag.c b/drivers/net/ethernet/mellanox/mlx5/core/lag.c +index 0fbb239559f3..5f8b7f3735b6 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/lag.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/lag.c +@@ -691,30 +691,32 @@ static void mlx5_ldev_add_netdev(struct mlx5_lag *ldev, + struct net_device *netdev) + { + unsigned int fn = PCI_FUNC(dev->pdev->devfn); ++ unsigned long flags; + + if (fn >= MLX5_MAX_PORTS) + return; + +- spin_lock(&lag_lock); ++ spin_lock_irqsave(&lag_lock, flags); + ldev->pf[fn].netdev = netdev; + ldev->tracker.netdev_state[fn].link_up = 0; + ldev->tracker.netdev_state[fn].tx_enabled = 0; +- spin_unlock(&lag_lock); ++ spin_unlock_irqrestore(&lag_lock, flags); + } + + static void mlx5_ldev_remove_netdev(struct mlx5_lag *ldev, + struct net_device *netdev) + { ++ unsigned long flags; + int i; + +- spin_lock(&lag_lock); ++ spin_lock_irqsave(&lag_lock, flags); + for (i = 0; i < MLX5_MAX_PORTS; i++) { + if (ldev->pf[i].netdev == netdev) { + ldev->pf[i].netdev = NULL; + break; + } + } +- spin_unlock(&lag_lock); ++ spin_unlock_irqrestore(&lag_lock, flags); + } + + static void mlx5_ldev_add_mdev(struct mlx5_lag *ldev, +@@ -855,12 +857,13 @@ void mlx5_lag_add_netdev(struct mlx5_core_dev *dev, + bool mlx5_lag_is_roce(struct mlx5_core_dev *dev) + { + struct mlx5_lag *ldev; ++ unsigned long flags; + bool res; + +- spin_lock(&lag_lock); ++ spin_lock_irqsave(&lag_lock, flags); + ldev = mlx5_lag_dev(dev); + res = ldev && __mlx5_lag_is_roce(ldev); +- spin_unlock(&lag_lock); ++ spin_unlock_irqrestore(&lag_lock, flags); + + return res; + } +@@ -869,12 +872,13 @@ EXPORT_SYMBOL(mlx5_lag_is_roce); + bool mlx5_lag_is_active(struct mlx5_core_dev *dev) + { + struct mlx5_lag *ldev; ++ unsigned long flags; + bool res; + +- spin_lock(&lag_lock); ++ spin_lock_irqsave(&lag_lock, flags); + ldev = mlx5_lag_dev(dev); + res = ldev && __mlx5_lag_is_active(ldev); +- spin_unlock(&lag_lock); ++ spin_unlock_irqrestore(&lag_lock, flags); + + return res; + } +@@ -883,13 +887,14 @@ EXPORT_SYMBOL(mlx5_lag_is_active); + bool mlx5_lag_is_master(struct mlx5_core_dev *dev) + { + struct mlx5_lag *ldev; ++ unsigned long flags; + bool res; + +- spin_lock(&lag_lock); ++ spin_lock_irqsave(&lag_lock, flags); + ldev = mlx5_lag_dev(dev); + res = ldev && __mlx5_lag_is_active(ldev) && + dev == ldev->pf[MLX5_LAG_P1].dev; +- spin_unlock(&lag_lock); ++ spin_unlock_irqrestore(&lag_lock, flags); + + return res; + } +@@ -898,12 +903,13 @@ EXPORT_SYMBOL(mlx5_lag_is_master); + bool mlx5_lag_is_sriov(struct mlx5_core_dev *dev) + { + struct mlx5_lag *ldev; ++ unsigned long flags; + bool res; + +- spin_lock(&lag_lock); ++ spin_lock_irqsave(&lag_lock, flags); + ldev = mlx5_lag_dev(dev); + res = ldev && __mlx5_lag_is_sriov(ldev); +- spin_unlock(&lag_lock); ++ spin_unlock_irqrestore(&lag_lock, flags); + + return res; + } +@@ -912,12 +918,13 @@ EXPORT_SYMBOL(mlx5_lag_is_sriov); + bool mlx5_lag_is_shared_fdb(struct mlx5_core_dev *dev) + { + struct mlx5_lag *ldev; ++ unsigned long flags; + bool res; + +- spin_lock(&lag_lock); ++ spin_lock_irqsave(&lag_lock, flags); + ldev = mlx5_lag_dev(dev); + res = ldev && __mlx5_lag_is_sriov(ldev) && ldev->shared_fdb; +- spin_unlock(&lag_lock); ++ spin_unlock_irqrestore(&lag_lock, flags); + + return res; + } +@@ -965,8 +972,9 @@ struct net_device *mlx5_lag_get_roce_netdev(struct mlx5_core_dev *dev) + { + struct net_device *ndev = NULL; + struct mlx5_lag *ldev; ++ unsigned long flags; + +- spin_lock(&lag_lock); ++ spin_lock_irqsave(&lag_lock, flags); + ldev = mlx5_lag_dev(dev); + + if (!(ldev && __mlx5_lag_is_roce(ldev))) +@@ -983,7 +991,7 @@ struct net_device *mlx5_lag_get_roce_netdev(struct mlx5_core_dev *dev) + dev_hold(ndev); + + unlock: +- spin_unlock(&lag_lock); ++ spin_unlock_irqrestore(&lag_lock, flags); + + return ndev; + } +@@ -993,9 +1001,10 @@ u8 mlx5_lag_get_slave_port(struct mlx5_core_dev *dev, + struct net_device *slave) + { + struct mlx5_lag *ldev; ++ unsigned long flags; + u8 port = 0; + +- spin_lock(&lag_lock); ++ spin_lock_irqsave(&lag_lock, flags); + ldev = mlx5_lag_dev(dev); + if (!(ldev && __mlx5_lag_is_roce(ldev))) + goto unlock; +@@ -1008,7 +1017,7 @@ u8 mlx5_lag_get_slave_port(struct mlx5_core_dev *dev, + port = ldev->v2p_map[port]; + + unlock: +- spin_unlock(&lag_lock); ++ spin_unlock_irqrestore(&lag_lock, flags); + return port; + } + EXPORT_SYMBOL(mlx5_lag_get_slave_port); +@@ -1017,8 +1026,9 @@ struct mlx5_core_dev *mlx5_lag_get_peer_mdev(struct mlx5_core_dev *dev) + { + struct mlx5_core_dev *peer_dev = NULL; + struct mlx5_lag *ldev; ++ unsigned long flags; + +- spin_lock(&lag_lock); ++ spin_lock_irqsave(&lag_lock, flags); + ldev = mlx5_lag_dev(dev); + if (!ldev) + goto unlock; +@@ -1028,7 +1038,7 @@ struct mlx5_core_dev *mlx5_lag_get_peer_mdev(struct mlx5_core_dev *dev) + ldev->pf[MLX5_LAG_P1].dev; + + unlock: +- spin_unlock(&lag_lock); ++ spin_unlock_irqrestore(&lag_lock, flags); + return peer_dev; + } + EXPORT_SYMBOL(mlx5_lag_get_peer_mdev); +@@ -1041,6 +1051,7 @@ int mlx5_lag_query_cong_counters(struct mlx5_core_dev *dev, + int outlen = MLX5_ST_SZ_BYTES(query_cong_statistics_out); + struct mlx5_core_dev *mdev[MLX5_MAX_PORTS]; + struct mlx5_lag *ldev; ++ unsigned long flags; + int num_ports; + int ret, i, j; + void *out; +@@ -1051,7 +1062,7 @@ int mlx5_lag_query_cong_counters(struct mlx5_core_dev *dev, + + memset(values, 0, sizeof(*values) * num_counters); + +- spin_lock(&lag_lock); ++ spin_lock_irqsave(&lag_lock, flags); + ldev = mlx5_lag_dev(dev); + if (ldev && __mlx5_lag_is_active(ldev)) { + num_ports = MLX5_MAX_PORTS; +@@ -1061,7 +1072,7 @@ int mlx5_lag_query_cong_counters(struct mlx5_core_dev *dev, + num_ports = 1; + mdev[MLX5_LAG_P1] = dev; + } +- spin_unlock(&lag_lock); ++ spin_unlock_irqrestore(&lag_lock, flags); + + for (i = 0; i < num_ports; ++i) { + u32 in[MLX5_ST_SZ_DW(query_cong_statistics_in)] = {}; +-- +2.35.1 + diff --git a/queue-5.15/perf-parse-events-identify-broken-modifiers.patch b/queue-5.15/perf-parse-events-identify-broken-modifiers.patch new file mode 100644 index 00000000000..346fbe56724 --- /dev/null +++ b/queue-5.15/perf-parse-events-identify-broken-modifiers.patch @@ -0,0 +1,108 @@ +From 788039639ef59f4c1eb8f3ac78e91184b19d87c9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Oct 2021 10:21:31 -0700 +Subject: perf parse-events: Identify broken modifiers + +From: Ian Rogers + +[ Upstream commit eabd4523395e4a8f2b049165642801f2ab8ff893 ] + +Previously the broken modifier causes a usage message to printed but +nothing else. + +After: + + $ perf stat -e 'cycles:kk' -a sleep 2 + event syntax error: 'cycles:kk' + \___ Bad modifier + Run 'perf list' for a list of valid events + + Usage: perf stat [] [] + + -e, --event event selector. use 'perf list' to list available events + + $ perf stat -e '{instructions,cycles}:kk' -a sleep 2 + event syntax error: '..ns,cycles}:kk' + \___ Bad modifier + Run 'perf list' for a list of valid events + + Usage: perf stat [] [] + + -e, --event event selector. use 'perf list' to list available events + +Signed-off-by: Ian Rogers +Acked-by: Andi Kleen +Cc: Adrian Hunter +Cc: Alexander Antonov +Cc: Alexander Shishkin +Cc: Andrew Kilroy +Cc: Andrew Morton +Cc: Changbin Du +Cc: Denys Zagorui +Cc: Fabian Hemmer +Cc: Felix Fietkau +Cc: Heiko Carstens +Cc: Ingo Molnar +Cc: Jacob Keller +Cc: Jiapeng Chong +Cc: Jin Yao +Cc: Jiri Olsa +Cc: Joakim Zhang +Cc: John Garry +Cc: Kajol Jain +Cc: Kan Liang +Cc: Kees Kook +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Nicholas Fraser +Cc: Nick Desaulniers +Cc: Paul Clarke +Cc: Peter Zijlstra +Cc: Riccardo Mancini +Cc: Sami Tolvanen +Cc: ShihCheng Tu +Cc: Song Liu +Cc: Stephane Eranian +Cc: Sumanth Korikkar +Cc: Thomas Richter +Cc: Wan Jiabing +Cc: Zhen Lei +Link: https://lore.kernel.org/r/20211015172132.1162559-21-irogers@google.com +Signed-off-by: Arnaldo Carvalho de Melo +Stable-dep-of: 71c86cda750b ("perf parse-events: Remove "not supported" hybrid cache events") +Signed-off-by: Sasha Levin +--- + tools/perf/util/parse-events.y | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/tools/perf/util/parse-events.y b/tools/perf/util/parse-events.y +index d94e48e1ff9b..467a426205a0 100644 +--- a/tools/perf/util/parse-events.y ++++ b/tools/perf/util/parse-events.y +@@ -183,6 +183,11 @@ group_def ':' PE_MODIFIER_EVENT + err = parse_events__modifier_group(list, $3); + free($3); + if (err) { ++ struct parse_events_state *parse_state = _parse_state; ++ struct parse_events_error *error = parse_state->error; ++ ++ parse_events__handle_error(error, @3.first_column, ++ strdup("Bad modifier"), NULL); + free_list_evsel(list); + YYABORT; + } +@@ -240,6 +245,11 @@ event_name PE_MODIFIER_EVENT + err = parse_events__modifier_event(list, $2, false); + free($2); + if (err) { ++ struct parse_events_state *parse_state = _parse_state; ++ struct parse_events_error *error = parse_state->error; ++ ++ parse_events__handle_error(error, @2.first_column, ++ strdup("Bad modifier"), NULL); + free_list_evsel(list); + YYABORT; + } +-- +2.35.1 + diff --git a/queue-5.15/scsi-qedf-fix-a-uaf-bug-in-__qedf_probe.patch b/queue-5.15/scsi-qedf-fix-a-uaf-bug-in-__qedf_probe.patch new file mode 100644 index 00000000000..343dd81f8f0 --- /dev/null +++ b/queue-5.15/scsi-qedf-fix-a-uaf-bug-in-__qedf_probe.patch @@ -0,0 +1,76 @@ +From af27f729f3ac1b4b428ee7fbb89e63f77eb2e3d3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Nov 2021 20:06:41 +0800 +Subject: scsi: qedf: Fix a UAF bug in __qedf_probe() + +From: Letu Ren + +[ Upstream commit fbfe96869b782364caebae0445763969ddb6ea67 ] + +In __qedf_probe(), if qedf->cdev is NULL which means +qed_ops->common->probe() failed, then the program will goto label err1, and +scsi_host_put() will free lport->host pointer. Because the memory qedf +points to is allocated by libfc_host_alloc(), it will be freed by +scsi_host_put(). However, the if statement below label err0 only checks +whether qedf is NULL but doesn't check whether the memory has been freed. +So a UAF bug can occur. + +There are two ways to reach the statements below err0. The first one is +described as before, "qedf" should be set to NULL. The second one is goto +"err0" directly. In the latter scenario qedf hasn't been changed and it has +the initial value NULL. As a result the if statement is not reachable in +any situation. + +The KASAN logs are as follows: + +[ 2.312969] BUG: KASAN: use-after-free in __qedf_probe+0x5dcf/0x6bc0 +[ 2.312969] +[ 2.312969] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 +[ 2.312969] Call Trace: +[ 2.312969] dump_stack_lvl+0x59/0x7b +[ 2.312969] print_address_description+0x7c/0x3b0 +[ 2.312969] ? __qedf_probe+0x5dcf/0x6bc0 +[ 2.312969] __kasan_report+0x160/0x1c0 +[ 2.312969] ? __qedf_probe+0x5dcf/0x6bc0 +[ 2.312969] kasan_report+0x4b/0x70 +[ 2.312969] ? kobject_put+0x25d/0x290 +[ 2.312969] kasan_check_range+0x2ca/0x310 +[ 2.312969] __qedf_probe+0x5dcf/0x6bc0 +[ 2.312969] ? selinux_kernfs_init_security+0xdc/0x5f0 +[ 2.312969] ? trace_rpm_return_int_rcuidle+0x18/0x120 +[ 2.312969] ? rpm_resume+0xa5c/0x16e0 +[ 2.312969] ? qedf_get_generic_tlv_data+0x160/0x160 +[ 2.312969] local_pci_probe+0x13c/0x1f0 +[ 2.312969] pci_device_probe+0x37e/0x6c0 + +Link: https://lore.kernel.org/r/20211112120641.16073-1-fantasquex@gmail.com +Reported-by: Zheyu Ma +Acked-by: Saurav Kashyap +Co-developed-by: Wende Tan +Signed-off-by: Wende Tan +Signed-off-by: Letu Ren +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qedf/qedf_main.c | 5 ----- + 1 file changed, 5 deletions(-) + +diff --git a/drivers/scsi/qedf/qedf_main.c b/drivers/scsi/qedf/qedf_main.c +index 544401f76c07..73c7197081ea 100644 +--- a/drivers/scsi/qedf/qedf_main.c ++++ b/drivers/scsi/qedf/qedf_main.c +@@ -3686,11 +3686,6 @@ static int __qedf_probe(struct pci_dev *pdev, int mode) + err1: + scsi_host_put(lport->host); + err0: +- if (qedf) { +- QEDF_INFO(&qedf->dbg_ctx, QEDF_LOG_DISC, "Probe done.\n"); +- +- clear_bit(QEDF_PROBING, &qedf->flags); +- } + return rc; + } + +-- +2.35.1 + diff --git a/queue-5.15/series b/queue-5.15/series index 7e24ba78f7a..2c676071c12 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -5,3 +5,29 @@ mm-gup-fix-the-fast-gup-race-against-thp-collapse.patch powerpc-64s-radix-don-t-need-to-broadcast-ipi-for-radix-pmd-collapse-flush.patch wait_on_bit-add-an-acquire-memory-barrier.patch provide-arch_test_bit_acquire-for-architectures-that-define-test_bit.patch +firmware-arm_scmi-improve-checks-in-the-info_get-ope.patch +firmware-arm_scmi-harden-accesses-to-the-sensor-doma.patch +firmware-arm_scmi-add-scmi-pm-driver-remove-routine.patch +dmaengine-xilinx_dma-fix-devm_platform_ioremap_resou.patch +dmaengine-xilinx_dma-cleanup-for-fetching-xlnx-num-f.patch +dmaengine-xilinx_dma-report-error-in-case-of-dma_set.patch +arm-dts-fix-moxa-sdio-compatible-remove-sdhci-misnom.patch +scsi-qedf-fix-a-uaf-bug-in-__qedf_probe.patch +net-ieee802154-fix-uninit-value-bug-in-dgram_sendmsg.patch +net-marvell-prestera-add-support-for-for-aldrin2.patch +alsa-hda-hdmi-fix-the-converter-reuse-for-the-silent.patch +um-cleanup-syscall_handler_t-cast-in-syscalls_32.h.patch +um-cleanup-compiler-warning-in-arch-x86-um-tls_32.c.patch +arch-um-mark-the-stack-non-executable-to-fix-a-binut.patch +net-atlantic-fix-potential-memory-leak-in-aq_ndev_cl.patch +drm-amd-display-fix-double-cursor-on-non-video-rgb-m.patch +drm-amd-display-assume-an-lttpr-is-always-present-on.patch +drm-amd-display-update-gamut-remap-if-plane-has-chan.patch +drm-amd-display-skip-audio-setup-when-audio-stream-i.patch +mmc-core-replace-with-already-defined-values-for-rea.patch +mmc-core-terminate-infinite-loop-in-sd-uhs-voltage-s.patch +perf-parse-events-identify-broken-modifiers.patch +mm-huge_memory-minor-cleanup-for-split_huge_pages_al.patch +mm-huge_memory-use-pfn_to_online_page-in-split_huge_.patch +wifi-cfg80211-fix-mcs-divisor-value.patch +net-mlx5-disable-irq-when-locking-lag_lock.patch diff --git a/queue-5.15/um-cleanup-compiler-warning-in-arch-x86-um-tls_32.c.patch b/queue-5.15/um-cleanup-compiler-warning-in-arch-x86-um-tls_32.c.patch new file mode 100644 index 00000000000..9e3c98f2385 --- /dev/null +++ b/queue-5.15/um-cleanup-compiler-warning-in-arch-x86-um-tls_32.c.patch @@ -0,0 +1,70 @@ +From f8c08e99ef4b86747f67df89a7a5c6caef0dcb88 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Aug 2022 15:29:31 +0000 +Subject: um: Cleanup compiler warning in arch/x86/um/tls_32.c + +From: Lukas Straub + +[ Upstream commit d27fff3499671dc23a08efd01cdb8b3764a391c4 ] + +arch.tls_array is statically allocated so checking for NULL doesn't +make sense. This causes the compiler warning below. + +Remove the checks to silence these warnings. + +../arch/x86/um/tls_32.c: In function 'get_free_idx': +../arch/x86/um/tls_32.c:68:13: warning: the comparison will always evaluate as 'true' for the address of 'tls_array' will never be NULL [-Waddress] + 68 | if (!t->arch.tls_array) + | ^ +In file included from ../arch/x86/um/asm/processor.h:10, + from ../include/linux/rcupdate.h:30, + from ../include/linux/rculist.h:11, + from ../include/linux/pid.h:5, + from ../include/linux/sched.h:14, + from ../arch/x86/um/tls_32.c:7: +../arch/x86/um/asm/processor_32.h:22:31: note: 'tls_array' declared here + 22 | struct uml_tls_struct tls_array[GDT_ENTRY_TLS_ENTRIES]; + | ^~~~~~~~~ +../arch/x86/um/tls_32.c: In function 'get_tls_entry': +../arch/x86/um/tls_32.c:243:13: warning: the comparison will always evaluate as 'true' for the address of 'tls_array' will never be NULL [-Waddress] + 243 | if (!t->arch.tls_array) + | ^ +../arch/x86/um/asm/processor_32.h:22:31: note: 'tls_array' declared here + 22 | struct uml_tls_struct tls_array[GDT_ENTRY_TLS_ENTRIES]; + | ^~~~~~~~~ + +Signed-off-by: Lukas Straub +Acked-by: Randy Dunlap # build-tested +Signed-off-by: Richard Weinberger +Signed-off-by: Sasha Levin +--- + arch/x86/um/tls_32.c | 6 ------ + 1 file changed, 6 deletions(-) + +diff --git a/arch/x86/um/tls_32.c b/arch/x86/um/tls_32.c +index ac8eee093f9c..66162eafd8e8 100644 +--- a/arch/x86/um/tls_32.c ++++ b/arch/x86/um/tls_32.c +@@ -65,9 +65,6 @@ static int get_free_idx(struct task_struct* task) + struct thread_struct *t = &task->thread; + int idx; + +- if (!t->arch.tls_array) +- return GDT_ENTRY_TLS_MIN; +- + for (idx = 0; idx < GDT_ENTRY_TLS_ENTRIES; idx++) + if (!t->arch.tls_array[idx].present) + return idx + GDT_ENTRY_TLS_MIN; +@@ -240,9 +237,6 @@ static int get_tls_entry(struct task_struct *task, struct user_desc *info, + { + struct thread_struct *t = &task->thread; + +- if (!t->arch.tls_array) +- goto clear; +- + if (idx < GDT_ENTRY_TLS_MIN || idx > GDT_ENTRY_TLS_MAX) + return -EINVAL; + +-- +2.35.1 + diff --git a/queue-5.15/um-cleanup-syscall_handler_t-cast-in-syscalls_32.h.patch b/queue-5.15/um-cleanup-syscall_handler_t-cast-in-syscalls_32.h.patch new file mode 100644 index 00000000000..512a2fca57c --- /dev/null +++ b/queue-5.15/um-cleanup-syscall_handler_t-cast-in-syscalls_32.h.patch @@ -0,0 +1,41 @@ +From 9055be34f18fc0e0a2aed2094f40753087d0d38a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Aug 2022 15:29:27 +0000 +Subject: um: Cleanup syscall_handler_t cast in syscalls_32.h + +From: Lukas Straub + +[ Upstream commit 61670b4d270c71219def1fbc9441debc2ac2e6e9 ] + +Like in f4f03f299a56ce4d73c5431e0327b3b6cb55ebb9 +"um: Cleanup syscall_handler_t definition/cast, fix warning", +remove the cast to to fix the compiler warning. + +Signed-off-by: Lukas Straub +Acked-by: Randy Dunlap # build-tested +Signed-off-by: Richard Weinberger +Signed-off-by: Sasha Levin +--- + arch/x86/um/shared/sysdep/syscalls_32.h | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/arch/x86/um/shared/sysdep/syscalls_32.h b/arch/x86/um/shared/sysdep/syscalls_32.h +index 68fd2cf526fd..f6e9f84397e7 100644 +--- a/arch/x86/um/shared/sysdep/syscalls_32.h ++++ b/arch/x86/um/shared/sysdep/syscalls_32.h +@@ -6,10 +6,9 @@ + #include + #include + +-typedef long syscall_handler_t(struct pt_regs); ++typedef long syscall_handler_t(struct syscall_args); + + extern syscall_handler_t *sys_call_table[]; + + #define EXECUTE_SYSCALL(syscall, regs) \ +- ((long (*)(struct syscall_args)) \ +- (*sys_call_table[syscall]))(SYSCALL_ARGS(®s->regs)) ++ ((*sys_call_table[syscall]))(SYSCALL_ARGS(®s->regs)) +-- +2.35.1 + diff --git a/queue-5.15/wifi-cfg80211-fix-mcs-divisor-value.patch b/queue-5.15/wifi-cfg80211-fix-mcs-divisor-value.patch new file mode 100644 index 00000000000..e495ad3e0c0 --- /dev/null +++ b/queue-5.15/wifi-cfg80211-fix-mcs-divisor-value.patch @@ -0,0 +1,42 @@ +From 7eb17f13467d0199d165c22ce030d9f5c27b02fb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Sep 2022 23:40:34 +0530 +Subject: wifi: cfg80211: fix MCS divisor value + +From: Tamizh Chelvam Raja + +[ Upstream commit 64e966d1e84b29c9fa916cfeaabbf4013703942e ] + +The Bitrate for HE/EHT MCS6 is calculated wrongly due to the +incorrect MCS divisor value for mcs6. Fix it with the proper +value. + +previous mcs_divisor value = (11769/6144) = 1.915527 + +fixed mcs_divisor value = (11377/6144) = 1.851725 + +Fixes: 9c97c88d2f4b ("cfg80211: Add support to calculate and report 4096-QAM HE rates") +Signed-off-by: Tamizh Chelvam Raja +Link: https://lore.kernel.org/r/20220908181034.9936-1-quic_tamizhr@quicinc.com +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/wireless/util.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/wireless/util.c b/net/wireless/util.c +index 4ddc269164f8..cb15d7f4eb05 100644 +--- a/net/wireless/util.c ++++ b/net/wireless/util.c +@@ -1353,7 +1353,7 @@ static u32 cfg80211_calculate_bitrate_he(struct rate_info *rate) + 25599, /* 4.166666... */ + 17067, /* 2.777777... */ + 12801, /* 2.083333... */ +- 11769, /* 1.851851... */ ++ 11377, /* 1.851725... */ + 10239, /* 1.666666... */ + 8532, /* 1.388888... */ + 7680, /* 1.250000... */ +-- +2.35.1 +