From: Sasha Levin Date: Thu, 13 Jul 2023 02:10:03 +0000 (-0400) Subject: Fixes for 6.1 X-Git-Tag: v6.1.39~109 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=0f8bbbe9e235f23d13c97029bd651d204e607647;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 6.1 Signed-off-by: Sasha Levin --- diff --git a/queue-6.1/add-module_firmware-for-firmware_tg357766.patch b/queue-6.1/add-module_firmware-for-firmware_tg357766.patch new file mode 100644 index 00000000000..3b2333b3d2e --- /dev/null +++ b/queue-6.1/add-module_firmware-for-firmware_tg357766.patch @@ -0,0 +1,37 @@ +From 1c1d54a893ef858457dfd61d6d8271a978c2f1a7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Jun 2023 02:13:32 +0200 +Subject: Add MODULE_FIRMWARE() for FIRMWARE_TG357766. + +From: Tobias Heider + +[ Upstream commit 046f753da6143ee16452966915087ec8b0de3c70 ] + +Fixes a bug where on the M1 mac mini initramfs-tools fails to +include the necessary firmware into the initrd. + +Fixes: c4dab50697ff ("tg3: Download 57766 EEE service patch firmware") +Signed-off-by: Tobias Heider +Reviewed-by: Michael Chan +Link: https://lore.kernel.org/r/ZJt7LKzjdz8+dClx@tobhe.de +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/tg3.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c +index af9ea5e4371b3..9609041016776 100644 +--- a/drivers/net/ethernet/broadcom/tg3.c ++++ b/drivers/net/ethernet/broadcom/tg3.c +@@ -224,6 +224,7 @@ MODULE_AUTHOR("David S. Miller (davem@redhat.com) and Jeff Garzik (jgarzik@pobox + MODULE_DESCRIPTION("Broadcom Tigon3 ethernet driver"); + MODULE_LICENSE("GPL"); + MODULE_FIRMWARE(FIRMWARE_TG3); ++MODULE_FIRMWARE(FIRMWARE_TG357766); + MODULE_FIRMWARE(FIRMWARE_TG3TSO); + MODULE_FIRMWARE(FIRMWARE_TG3TSO5); + +-- +2.39.2 + diff --git a/queue-6.1/afs-fix-accidental-truncation-when-storing-data.patch b/queue-6.1/afs-fix-accidental-truncation-when-storing-data.patch new file mode 100644 index 00000000000..e53d8541d6a --- /dev/null +++ b/queue-6.1/afs-fix-accidental-truncation-when-storing-data.patch @@ -0,0 +1,74 @@ +From be71acb51401334077fe8b975fd5f358fc08ea51 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Jul 2023 20:22:15 +0100 +Subject: afs: Fix accidental truncation when storing data + +From: David Howells + +[ Upstream commit 03275585cabd0240944f19f33d7584a1b099a3a8 ] + +When an AFS FS.StoreData RPC call is made, amongst other things it is +given the resultant file size to be. On the server, this is processed +by truncating the file to new size and then writing the data. + +Now, kafs has a lock (vnode->io_lock) that serves to serialise +operations against a specific vnode (ie. inode), but the parameters for +the op are set before the lock is taken. This allows two writebacks +(say sync and kswapd) to race - and if writes are ongoing the writeback +for a later write could occur before the writeback for an earlier one if +the latter gets interrupted. + +Note that afs_writepages() cannot take i_mutex and only takes a shared +lock on vnode->validate_lock. + +Also note that the server does the truncation and the write inside a +lock, so there's no problem at that end. + +Fix this by moving the calculation for the proposed new i_size inside +the vnode->io_lock. Also reset the iterator (which we might have read +from) and update the mtime setting there. + +Fixes: bd80d8a80e12 ("afs: Use ITER_XARRAY for writing") +Reported-by: Marc Dionne +Signed-off-by: David Howells +Reviewed-by: Jeffrey Altman +Reviewed-by: Marc Dionne +cc: linux-afs@lists.infradead.org +cc: linux-fsdevel@vger.kernel.org +Link: https://lore.kernel.org/r/3526895.1687960024@warthog.procyon.org.uk/ +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + fs/afs/write.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/fs/afs/write.c b/fs/afs/write.c +index 08fd456dde67c..3ecc212b62099 100644 +--- a/fs/afs/write.c ++++ b/fs/afs/write.c +@@ -381,17 +381,19 @@ static int afs_store_data(struct afs_vnode *vnode, struct iov_iter *iter, loff_t + afs_op_set_vnode(op, 0, vnode); + op->file[0].dv_delta = 1; + op->file[0].modification = true; +- op->store.write_iter = iter; + op->store.pos = pos; + op->store.size = size; +- op->store.i_size = max(pos + size, vnode->netfs.remote_i_size); + op->store.laundering = laundering; +- op->mtime = vnode->netfs.inode.i_mtime; + op->flags |= AFS_OPERATION_UNINTR; + op->ops = &afs_store_data_operation; + + try_next_key: + afs_begin_vnode_operation(op); ++ ++ op->store.write_iter = iter; ++ op->store.i_size = max(pos + size, vnode->netfs.remote_i_size); ++ op->mtime = vnode->netfs.inode.i_mtime; ++ + afs_wait_for_operation(op); + + switch (op->error) { +-- +2.39.2 + diff --git a/queue-6.1/apparmor-fix-missing-error-check-for-rhashtable_inse.patch b/queue-6.1/apparmor-fix-missing-error-check-for-rhashtable_inse.patch new file mode 100644 index 00000000000..5ff747396ab --- /dev/null +++ b/queue-6.1/apparmor-fix-missing-error-check-for-rhashtable_inse.patch @@ -0,0 +1,47 @@ +From b06d7de1b7d6463536ca4a4a152f958d6b2c3be3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Apr 2023 19:05:49 +0000 +Subject: apparmor: fix missing error check for rhashtable_insert_fast + +From: Danila Chernetsov + +[ Upstream commit 000518bc5aef25d3f703592a0296d578c98b1517 ] + + rhashtable_insert_fast() could return err value when memory allocation is + failed. but unpack_profile() do not check values and this always returns + success value. This patch just adds error check code. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: e025be0f26d5 ("apparmor: support querying extended trusted helper extra data") + +Signed-off-by: Danila Chernetsov +Signed-off-by: John Johansen +Signed-off-by: Sasha Levin +--- + security/apparmor/policy_unpack.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c +index 9d26bbb901338..9c3fec2c7cf6b 100644 +--- a/security/apparmor/policy_unpack.c ++++ b/security/apparmor/policy_unpack.c +@@ -917,8 +917,13 @@ static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name) + goto fail; + } + +- rhashtable_insert_fast(profile->data, &data->head, +- profile->data->p); ++ if (rhashtable_insert_fast(profile->data, &data->head, ++ profile->data->p)) { ++ kfree_sensitive(data->key); ++ kfree_sensitive(data); ++ info = "failed to insert data to table"; ++ goto fail; ++ } + } + + if (!unpack_nameX(e, AA_STRUCTEND, NULL)) { +-- +2.39.2 + diff --git a/queue-6.1/blk-cgroup-don-t-update-io-stat-for-root-cgroup.patch b/queue-6.1/blk-cgroup-don-t-update-io-stat-for-root-cgroup.patch new file mode 100644 index 00000000000..f0b9b508778 --- /dev/null +++ b/queue-6.1/blk-cgroup-don-t-update-io-stat-for-root-cgroup.patch @@ -0,0 +1,49 @@ +From 527c91479bffb990d54c25cab35fdc3629d3f774 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Feb 2023 10:18:04 +0800 +Subject: blk-cgroup: don't update io stat for root cgroup + +From: Ming Lei + +[ Upstream commit 0416f3be58c6b1ea066cd52e354b857693feb01e ] + +We source root cgroup stats from the system-wide stats, see blkcg_print_stat +and blkcg_rstat_flush, so don't update io state for root cgroup. + +Fixes blkg leak issue introduced in commit 3b8cc6298724 ("blk-cgroup: Optimize blkcg_rstat_flush()") +which starts to grab blkg's reference when adding iostat_cpu into percpu +blkcg list, but this state won't be consumed by blkcg_rstat_flush() where +the blkg reference is dropped. + +Tested-by: Bart van Assche +Reported-by: Bart van Assche +Fixes: 3b8cc6298724 ("blk-cgroup: Optimize blkcg_rstat_flush()") +Cc: Tejun Heo +Cc: Waiman Long +Signed-off-by: Ming Lei +Link: https://lore.kernel.org/r/20230202021804.278582-1-ming.lei@redhat.com +Signed-off-by: Jens Axboe +Stable-dep-of: ad7c3b41e86b ("blk-throttle: Fix io statistics for cgroup v1") +Signed-off-by: Sasha Levin +--- + block/blk-cgroup.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c +index 2c7be256ff879..5ee0ae8ddbf6f 100644 +--- a/block/blk-cgroup.c ++++ b/block/blk-cgroup.c +@@ -2008,6 +2008,10 @@ void blk_cgroup_bio_start(struct bio *bio) + struct blkg_iostat_set *bis; + unsigned long flags; + ++ /* Root-level stats are sourced from system-wide IO stats */ ++ if (!cgroup_parent(blkcg->css.cgroup)) ++ return; ++ + cpu = get_cpu(); + bis = per_cpu_ptr(bio->bi_blkg->iostat_cpu, cpu); + flags = u64_stats_update_begin_irqsave(&bis->sync); +-- +2.39.2 + diff --git a/queue-6.1/blk-cgroup-optimize-blkcg_rstat_flush.patch b/queue-6.1/blk-cgroup-optimize-blkcg_rstat_flush.patch new file mode 100644 index 00000000000..88612e272ae --- /dev/null +++ b/queue-6.1/blk-cgroup-optimize-blkcg_rstat_flush.patch @@ -0,0 +1,244 @@ +From a7c7dbac32b9fc615ba132dbac34a467192964dc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Nov 2022 20:59:01 -0400 +Subject: blk-cgroup: Optimize blkcg_rstat_flush() + +From: Waiman Long + +[ Upstream commit 3b8cc6298724021da845f2f9fd7dd4b6829a6817 ] + +For a system with many CPUs and block devices, the time to do +blkcg_rstat_flush() from cgroup_rstat_flush() can be rather long. It +can be especially problematic as interrupt is disabled during the flush. +It was reported that it might take seconds to complete in some extreme +cases leading to hard lockup messages. + +As it is likely that not all the percpu blkg_iostat_set's has been +updated since the last flush, those stale blkg_iostat_set's don't need +to be flushed in this case. This patch optimizes blkcg_rstat_flush() +by keeping a lockless list of recently updated blkg_iostat_set's in a +newly added percpu blkcg->lhead pointer. + +The blkg_iostat_set is added to a lockless list on the update side +in blk_cgroup_bio_start(). It is removed from the lockless list when +flushed in blkcg_rstat_flush(). Due to racing, it is possible that +blk_iostat_set's in the lockless list may have no new IO stats to be +flushed, but that is OK. + +To protect against destruction of blkg, a percpu reference is gotten +when putting into the lockless list and put back when removed. + +When booting up an instrumented test kernel with this patch on a +2-socket 96-thread system with cgroup v2, out of the 2051 calls to +cgroup_rstat_flush() after bootup, 1788 of the calls were exited +immediately because of empty lockless list. After an all-cpu kernel +build, the ratio became 6295424/6340513. That was more than 99%. + +Signed-off-by: Waiman Long +Acked-by: Tejun Heo +Link: https://lore.kernel.org/r/20221105005902.407297-3-longman@redhat.com +Signed-off-by: Jens Axboe +Stable-dep-of: ad7c3b41e86b ("blk-throttle: Fix io statistics for cgroup v1") +Signed-off-by: Sasha Levin +--- + block/blk-cgroup.c | 76 ++++++++++++++++++++++++++++++++++++++++++---- + block/blk-cgroup.h | 10 ++++++ + 2 files changed, 80 insertions(+), 6 deletions(-) + +diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c +index 60f366f98fa2b..2c7be256ff879 100644 +--- a/block/blk-cgroup.c ++++ b/block/blk-cgroup.c +@@ -60,6 +60,37 @@ static struct workqueue_struct *blkcg_punt_bio_wq; + + #define BLKG_DESTROY_BATCH_SIZE 64 + ++/* ++ * Lockless lists for tracking IO stats update ++ * ++ * New IO stats are stored in the percpu iostat_cpu within blkcg_gq (blkg). ++ * There are multiple blkg's (one for each block device) attached to each ++ * blkcg. The rstat code keeps track of which cpu has IO stats updated, ++ * but it doesn't know which blkg has the updated stats. If there are many ++ * block devices in a system, the cost of iterating all the blkg's to flush ++ * out the IO stats can be high. To reduce such overhead, a set of percpu ++ * lockless lists (lhead) per blkcg are used to track the set of recently ++ * updated iostat_cpu's since the last flush. An iostat_cpu will be put ++ * onto the lockless list on the update side [blk_cgroup_bio_start()] if ++ * not there yet and then removed when being flushed [blkcg_rstat_flush()]. ++ * References to blkg are gotten and then put back in the process to ++ * protect against blkg removal. ++ * ++ * Return: 0 if successful or -ENOMEM if allocation fails. ++ */ ++static int init_blkcg_llists(struct blkcg *blkcg) ++{ ++ int cpu; ++ ++ blkcg->lhead = alloc_percpu_gfp(struct llist_head, GFP_KERNEL); ++ if (!blkcg->lhead) ++ return -ENOMEM; ++ ++ for_each_possible_cpu(cpu) ++ init_llist_head(per_cpu_ptr(blkcg->lhead, cpu)); ++ return 0; ++} ++ + /** + * blkcg_css - find the current css + * +@@ -237,8 +268,10 @@ static struct blkcg_gq *blkg_alloc(struct blkcg *blkcg, struct gendisk *disk, + blkg->blkcg = blkcg; + + u64_stats_init(&blkg->iostat.sync); +- for_each_possible_cpu(cpu) ++ for_each_possible_cpu(cpu) { + u64_stats_init(&per_cpu_ptr(blkg->iostat_cpu, cpu)->sync); ++ per_cpu_ptr(blkg->iostat_cpu, cpu)->blkg = blkg; ++ } + + for (i = 0; i < BLKCG_MAX_POLS; i++) { + struct blkcg_policy *pol = blkcg_policy[i]; +@@ -831,7 +864,9 @@ static void blkcg_iostat_update(struct blkcg_gq *blkg, struct blkg_iostat *cur, + static void blkcg_rstat_flush(struct cgroup_subsys_state *css, int cpu) + { + struct blkcg *blkcg = css_to_blkcg(css); +- struct blkcg_gq *blkg; ++ struct llist_head *lhead = per_cpu_ptr(blkcg->lhead, cpu); ++ struct llist_node *lnode; ++ struct blkg_iostat_set *bisc, *next_bisc; + + /* Root-level stats are sourced from system-wide IO stats */ + if (!cgroup_parent(css->cgroup)) +@@ -839,12 +874,21 @@ static void blkcg_rstat_flush(struct cgroup_subsys_state *css, int cpu) + + rcu_read_lock(); + +- hlist_for_each_entry_rcu(blkg, &blkcg->blkg_list, blkcg_node) { ++ lnode = llist_del_all(lhead); ++ if (!lnode) ++ goto out; ++ ++ /* ++ * Iterate only the iostat_cpu's queued in the lockless list. ++ */ ++ llist_for_each_entry_safe(bisc, next_bisc, lnode, lnode) { ++ struct blkcg_gq *blkg = bisc->blkg; + struct blkcg_gq *parent = blkg->parent; +- struct blkg_iostat_set *bisc = per_cpu_ptr(blkg->iostat_cpu, cpu); + struct blkg_iostat cur; + unsigned int seq; + ++ WRITE_ONCE(bisc->lqueued, false); ++ + /* fetch the current per-cpu values */ + do { + seq = u64_stats_fetch_begin(&bisc->sync); +@@ -857,8 +901,10 @@ static void blkcg_rstat_flush(struct cgroup_subsys_state *css, int cpu) + if (parent && parent->parent) + blkcg_iostat_update(parent, &blkg->iostat.cur, + &blkg->iostat.last); ++ percpu_ref_put(&blkg->refcnt); + } + ++out: + rcu_read_unlock(); + } + +@@ -1136,6 +1182,7 @@ static void blkcg_css_free(struct cgroup_subsys_state *css) + + mutex_unlock(&blkcg_pol_mutex); + ++ free_percpu(blkcg->lhead); + kfree(blkcg); + } + +@@ -1158,6 +1205,9 @@ blkcg_css_alloc(struct cgroup_subsys_state *parent_css) + } + } + ++ if (init_blkcg_llists(blkcg)) ++ goto free_blkcg; ++ + for (i = 0; i < BLKCG_MAX_POLS ; i++) { + struct blkcg_policy *pol = blkcg_policy[i]; + struct blkcg_policy_data *cpd; +@@ -1199,7 +1249,8 @@ blkcg_css_alloc(struct cgroup_subsys_state *parent_css) + for (i--; i >= 0; i--) + if (blkcg->cpd[i]) + blkcg_policy[i]->cpd_free_fn(blkcg->cpd[i]); +- ++ free_percpu(blkcg->lhead); ++free_blkcg: + if (blkcg != &blkcg_root) + kfree(blkcg); + unlock: +@@ -1952,6 +2003,7 @@ static int blk_cgroup_io_type(struct bio *bio) + + void blk_cgroup_bio_start(struct bio *bio) + { ++ struct blkcg *blkcg = bio->bi_blkg->blkcg; + int rwd = blk_cgroup_io_type(bio), cpu; + struct blkg_iostat_set *bis; + unsigned long flags; +@@ -1970,9 +2022,21 @@ void blk_cgroup_bio_start(struct bio *bio) + } + bis->cur.ios[rwd]++; + ++ /* ++ * If the iostat_cpu isn't in a lockless list, put it into the ++ * list to indicate that a stat update is pending. ++ */ ++ if (!READ_ONCE(bis->lqueued)) { ++ struct llist_head *lhead = this_cpu_ptr(blkcg->lhead); ++ ++ llist_add(&bis->lnode, lhead); ++ WRITE_ONCE(bis->lqueued, true); ++ percpu_ref_get(&bis->blkg->refcnt); ++ } ++ + u64_stats_update_end_irqrestore(&bis->sync, flags); + if (cgroup_subsys_on_dfl(io_cgrp_subsys)) +- cgroup_rstat_updated(bio->bi_blkg->blkcg->css.cgroup, cpu); ++ cgroup_rstat_updated(blkcg->css.cgroup, cpu); + put_cpu(); + } + +diff --git a/block/blk-cgroup.h b/block/blk-cgroup.h +index aa2b286bc825f..1e94e404eaa80 100644 +--- a/block/blk-cgroup.h ++++ b/block/blk-cgroup.h +@@ -18,6 +18,7 @@ + #include + #include + #include ++#include + + struct blkcg_gq; + struct blkg_policy_data; +@@ -43,6 +44,9 @@ struct blkg_iostat { + + struct blkg_iostat_set { + struct u64_stats_sync sync; ++ struct blkcg_gq *blkg; ++ struct llist_node lnode; ++ int lqueued; /* queued in llist */ + struct blkg_iostat cur; + struct blkg_iostat last; + }; +@@ -97,6 +101,12 @@ struct blkcg { + struct blkcg_policy_data *cpd[BLKCG_MAX_POLS]; + + struct list_head all_blkcgs_node; ++ ++ /* ++ * List of updated percpu blkg_iostat_set's since the last flush. ++ */ ++ struct llist_head __percpu *lhead; ++ + #ifdef CONFIG_BLK_CGROUP_FC_APPID + char fc_app_id[FC_APPID_LEN]; + #endif +-- +2.39.2 + diff --git a/queue-6.1/blk-throttle-fix-io-statistics-for-cgroup-v1.patch b/queue-6.1/blk-throttle-fix-io-statistics-for-cgroup-v1.patch new file mode 100644 index 00000000000..6d9c2c98a7a --- /dev/null +++ b/queue-6.1/blk-throttle-fix-io-statistics-for-cgroup-v1.patch @@ -0,0 +1,95 @@ +From a664cdf1cba90269e240aeb587e2c528a51090cd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 May 2023 01:06:31 +0800 +Subject: blk-throttle: Fix io statistics for cgroup v1 + +From: Jinke Han + +[ Upstream commit ad7c3b41e86b59943a903d23c7b037d820e6270c ] + +After commit f382fb0bcef4 ("block: remove legacy IO schedulers"), +blkio.throttle.io_serviced and blkio.throttle.io_service_bytes become +the only stable io stats interface of cgroup v1, and these statistics +are done in the blk-throttle code. But the current code only counts the +bios that are actually throttled. When the user does not add the throttle +limit, the io stats for cgroup v1 has nothing. I fix it according to the +statistical method of v2, and made it count all ios accurately. + +Fixes: a7b36ee6ba29 ("block: move blk-throtl fast path inline") +Tested-by: Andrea Righi +Signed-off-by: Jinke Han +Acked-by: Muchun Song +Acked-by: Tejun Heo +Link: https://lore.kernel.org/r/20230507170631.89607-1-hanjinke.666@bytedance.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-cgroup.c | 6 ++++-- + block/blk-throttle.c | 6 ------ + block/blk-throttle.h | 9 +++++++++ + 3 files changed, 13 insertions(+), 8 deletions(-) + +diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c +index 5ee0ae8ddbf6f..e812e48d5bb8a 100644 +--- a/block/blk-cgroup.c ++++ b/block/blk-cgroup.c +@@ -2008,6 +2008,9 @@ void blk_cgroup_bio_start(struct bio *bio) + struct blkg_iostat_set *bis; + unsigned long flags; + ++ if (!cgroup_subsys_on_dfl(io_cgrp_subsys)) ++ return; ++ + /* Root-level stats are sourced from system-wide IO stats */ + if (!cgroup_parent(blkcg->css.cgroup)) + return; +@@ -2039,8 +2042,7 @@ void blk_cgroup_bio_start(struct bio *bio) + } + + u64_stats_update_end_irqrestore(&bis->sync, flags); +- if (cgroup_subsys_on_dfl(io_cgrp_subsys)) +- cgroup_rstat_updated(blkcg->css.cgroup, cpu); ++ cgroup_rstat_updated(blkcg->css.cgroup, cpu); + put_cpu(); + } + +diff --git a/block/blk-throttle.c b/block/blk-throttle.c +index f1bc600c4ded6..d88147d1358fc 100644 +--- a/block/blk-throttle.c ++++ b/block/blk-throttle.c +@@ -2167,12 +2167,6 @@ bool __blk_throtl_bio(struct bio *bio) + + rcu_read_lock(); + +- if (!cgroup_subsys_on_dfl(io_cgrp_subsys)) { +- blkg_rwstat_add(&tg->stat_bytes, bio->bi_opf, +- bio->bi_iter.bi_size); +- blkg_rwstat_add(&tg->stat_ios, bio->bi_opf, 1); +- } +- + spin_lock_irq(&q->queue_lock); + + throtl_update_latency_buckets(td); +diff --git a/block/blk-throttle.h b/block/blk-throttle.h +index ef4b7a4de987d..d1ccbfe9f7978 100644 +--- a/block/blk-throttle.h ++++ b/block/blk-throttle.h +@@ -185,6 +185,15 @@ static inline bool blk_should_throtl(struct bio *bio) + struct throtl_grp *tg = blkg_to_tg(bio->bi_blkg); + int rw = bio_data_dir(bio); + ++ if (!cgroup_subsys_on_dfl(io_cgrp_subsys)) { ++ if (!bio_flagged(bio, BIO_CGROUP_ACCT)) { ++ bio_set_flag(bio, BIO_CGROUP_ACCT); ++ blkg_rwstat_add(&tg->stat_bytes, bio->bi_opf, ++ bio->bi_iter.bi_size); ++ } ++ blkg_rwstat_add(&tg->stat_ios, bio->bi_opf, 1); ++ } ++ + /* iops limit is always counted */ + if (tg->has_rules_iops[rw]) + return true; +-- +2.39.2 + diff --git a/queue-6.1/bluetooth-fix-invalid-bdaddr-quirk-for-non-persisten.patch b/queue-6.1/bluetooth-fix-invalid-bdaddr-quirk-for-non-persisten.patch new file mode 100644 index 00000000000..315ef11f342 --- /dev/null +++ b/queue-6.1/bluetooth-fix-invalid-bdaddr-quirk-for-non-persisten.patch @@ -0,0 +1,68 @@ +From 96d7b761c0c6087cd05f68ca1a58db608849169f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 May 2023 11:04:23 +0200 +Subject: Bluetooth: fix invalid-bdaddr quirk for non-persistent setup + +From: Johan Hovold + +[ Upstream commit 0cb7365850bacb8c2a9975cae672d65714d8daa1 ] + +Devices that lack persistent storage for the device address can indicate +this by setting the HCI_QUIRK_INVALID_BDADDR which causes the controller +to be marked as unconfigured until user space has set a valid address. + +Once configured, the device address must be set on every setup for +controllers with HCI_QUIRK_NON_PERSISTENT_SETUP to avoid marking the +controller as unconfigured and requiring the address to be set again. + +Fixes: 740011cfe948 ("Bluetooth: Add new quirk for non-persistent setup settings") +Signed-off-by: Johan Hovold +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/bluetooth/hci_sync.c | 28 +++++++++++----------------- + 1 file changed, 11 insertions(+), 17 deletions(-) + +diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c +index 1805ddee0cd02..37131a36700a1 100644 +--- a/net/bluetooth/hci_sync.c ++++ b/net/bluetooth/hci_sync.c +@@ -4567,23 +4567,17 @@ static int hci_dev_setup_sync(struct hci_dev *hdev) + invalid_bdaddr = test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks); + + if (!ret) { +- if (test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) { +- if (!bacmp(&hdev->public_addr, BDADDR_ANY)) +- hci_dev_get_bd_addr_from_property(hdev); +- +- if (bacmp(&hdev->public_addr, BDADDR_ANY) && +- hdev->set_bdaddr) { +- ret = hdev->set_bdaddr(hdev, +- &hdev->public_addr); +- +- /* If setting of the BD_ADDR from the device +- * property succeeds, then treat the address +- * as valid even if the invalid BD_ADDR +- * quirk indicates otherwise. +- */ +- if (!ret) +- invalid_bdaddr = false; +- } ++ if (test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks) && ++ !bacmp(&hdev->public_addr, BDADDR_ANY)) ++ hci_dev_get_bd_addr_from_property(hdev); ++ ++ if ((invalid_bdaddr || ++ test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) && ++ bacmp(&hdev->public_addr, BDADDR_ANY) && ++ hdev->set_bdaddr) { ++ ret = hdev->set_bdaddr(hdev, &hdev->public_addr); ++ if (!ret) ++ invalid_bdaddr = false; + } + } + +-- +2.39.2 + diff --git a/queue-6.1/bluetooth-fix-use-bdaddr-property-quirk.patch b/queue-6.1/bluetooth-fix-use-bdaddr-property-quirk.patch new file mode 100644 index 00000000000..d3e4c906724 --- /dev/null +++ b/queue-6.1/bluetooth-fix-use-bdaddr-property-quirk.patch @@ -0,0 +1,67 @@ +From b5ef8fa54bf7cc8962c4f9a9d0b340eb77f1e7fa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 May 2023 11:04:24 +0200 +Subject: Bluetooth: fix use-bdaddr-property quirk + +From: Johan Hovold + +[ Upstream commit 6945795bc81ab7be22750ecfb365056688f2fada ] + +Devices that lack persistent storage for the device address can indicate +this by setting the HCI_QUIRK_INVALID_BDADDR which causes the controller +to be marked as unconfigured until user space has set a valid address. + +The related HCI_QUIRK_USE_BDADDR_PROPERTY was later added to similarly +indicate that the device lacks a valid address but that one may be +specified in the devicetree. + +As is clear from commit 7a0e5b15ca45 ("Bluetooth: Add quirk for reading +BD_ADDR from fwnode property") that added and documented this quirk and +commits like de79a9df1692 ("Bluetooth: btqcomsmd: use +HCI_QUIRK_USE_BDADDR_PROPERTY"), the device address of controllers with +this flag should be treated as invalid until user space has had a chance +to configure the controller in case the devicetree property is missing. + +As it does not make sense to allow controllers with invalid addresses, +restore the original semantics, which also makes sure that the +implementation is consistent (e.g. get_missing_options() indicates that +the address must be set) and matches the documentation (including +comments in the code, such as, "In case any of them is set, the +controller has to start up as unconfigured."). + +Fixes: e668eb1e1578 ("Bluetooth: hci_core: Don't stop BT if the BD address missing in dts") +Signed-off-by: Johan Hovold +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/bluetooth/hci_sync.c | 8 +++----- + 1 file changed, 3 insertions(+), 5 deletions(-) + +diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c +index 37131a36700a1..9f9299b44f0bf 100644 +--- a/net/bluetooth/hci_sync.c ++++ b/net/bluetooth/hci_sync.c +@@ -4564,16 +4564,14 @@ static int hci_dev_setup_sync(struct hci_dev *hdev) + * BD_ADDR invalid before creating the HCI device or in + * its setup callback. + */ +- invalid_bdaddr = test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks); +- ++ invalid_bdaddr = test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) || ++ test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks); + if (!ret) { + if (test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks) && + !bacmp(&hdev->public_addr, BDADDR_ANY)) + hci_dev_get_bd_addr_from_property(hdev); + +- if ((invalid_bdaddr || +- test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) && +- bacmp(&hdev->public_addr, BDADDR_ANY) && ++ if (invalid_bdaddr && bacmp(&hdev->public_addr, BDADDR_ANY) && + hdev->set_bdaddr) { + ret = hdev->set_bdaddr(hdev, &hdev->public_addr); + if (!ret) +-- +2.39.2 + diff --git a/queue-6.1/bluetooth-hci_bcm-do-not-mark-valid-bd_addr-as-inval.patch b/queue-6.1/bluetooth-hci_bcm-do-not-mark-valid-bd_addr-as-inval.patch new file mode 100644 index 00000000000..07d7862a014 --- /dev/null +++ b/queue-6.1/bluetooth-hci_bcm-do-not-mark-valid-bd_addr-as-inval.patch @@ -0,0 +1,51 @@ +From cd1f79e8e3d6e096366179826040f03e90cfa838 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Jun 2023 10:19:12 +0200 +Subject: Bluetooth: hci_bcm: do not mark valid bd_addr as invalid + +From: Johan Hovold + +[ Upstream commit 56b7f325db139c9255b1eb1d1e741576d5f8fa34 ] + +A recent commit restored the original (and still documented) semantics +for the HCI_QUIRK_USE_BDADDR_PROPERTY quirk so that the device address +is considered invalid unless an address is provided by firmware. + +This specifically means that this flag must only be set for devices with +invalid addresses, but the Broadcom driver has so far been setting this +flag unconditionally. + +Fortunately the driver already checks for invalid addresses during setup +and sets the HCI_QUIRK_INVALID_BDADDR flag. Use this flag to indicate +when the address can be overridden by firmware (long term, this should +probably just always be allowed). + +Fixes: 6945795bc81a ("Bluetooth: fix use-bdaddr-property quirk") +Reported-by: Marek Szyprowski +Link: https://lore.kernel.org/lkml/ecef83c8-497f-4011-607b-a63c24764867@samsung.com +Signed-off-by: Johan Hovold +Tested-by: Marek Szyprowski +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/hci_bcm.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/bluetooth/hci_bcm.c b/drivers/bluetooth/hci_bcm.c +index 2b6c0e1922cb3..207611132b8ef 100644 +--- a/drivers/bluetooth/hci_bcm.c ++++ b/drivers/bluetooth/hci_bcm.c +@@ -641,7 +641,8 @@ static int bcm_setup(struct hci_uart *hu) + * Allow the bootloader to set a valid address through the + * device tree. + */ +- set_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hu->hdev->quirks); ++ if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hu->hdev->quirks)) ++ set_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hu->hdev->quirks); + + if (!bcm_request_irq(bcm)) + err = bcm_setup_sleep(hu); +-- +2.39.2 + diff --git a/queue-6.1/bluetooth-iso-use-hci_sync-for-setting-cig-parameter.patch b/queue-6.1/bluetooth-iso-use-hci_sync-for-setting-cig-parameter.patch new file mode 100644 index 00000000000..0d1fc5da57a --- /dev/null +++ b/queue-6.1/bluetooth-iso-use-hci_sync-for-setting-cig-parameter.patch @@ -0,0 +1,117 @@ +From 14414fdf4989f9af2ae01d133e5927449c169e1f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Jun 2023 09:34:43 +0300 +Subject: Bluetooth: ISO: use hci_sync for setting CIG parameters + +From: Pauli Virtanen + +[ Upstream commit 6b9545dc9f8ff01d8bc1229103960d9cd265343f ] + +When reconfiguring CIG after disconnection of the last CIS, LE Remove +CIG shall be sent before LE Set CIG Parameters. Otherwise, it fails +because CIG is in the inactive state and not configurable (Core v5.3 +Vol 6 Part B Sec. 4.5.14.3). This ordering is currently wrong under +suitable timing conditions, because LE Remove CIG is sent via the +hci_sync queue and may be delayed, but Set CIG Parameters is via +hci_send_cmd. + +Make the ordering well-defined by sending also Set CIG Parameters via +hci_sync. + +Fixes: 26afbd826ee3 ("Bluetooth: Add initial implementation of CIS connections") +Signed-off-by: Pauli Virtanen +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/bluetooth/hci_conn.c | 47 +++++++++++++++++++++++++++++++++------- + 1 file changed, 39 insertions(+), 8 deletions(-) + +diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c +index ab9f00252dc2a..fef09d2121384 100644 +--- a/net/bluetooth/hci_conn.c ++++ b/net/bluetooth/hci_conn.c +@@ -770,6 +770,11 @@ static void le_conn_timeout(struct work_struct *work) + hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM); + } + ++struct iso_cig_params { ++ struct hci_cp_le_set_cig_params cp; ++ struct hci_cis_params cis[0x1f]; ++}; ++ + struct iso_list_data { + union { + u8 cig; +@@ -781,10 +786,7 @@ struct iso_list_data { + u16 sync_handle; + }; + int count; +- struct { +- struct hci_cp_le_set_cig_params cp; +- struct hci_cis_params cis[0x11]; +- } pdu; ++ struct iso_cig_params pdu; + }; + + static void bis_list(struct hci_conn *conn, void *data) +@@ -1705,10 +1707,33 @@ static int hci_le_create_big(struct hci_conn *conn, struct bt_iso_qos *qos) + return hci_send_cmd(hdev, HCI_OP_LE_CREATE_BIG, sizeof(cp), &cp); + } + ++static void set_cig_params_complete(struct hci_dev *hdev, void *data, int err) ++{ ++ struct iso_cig_params *pdu = data; ++ ++ bt_dev_dbg(hdev, ""); ++ ++ if (err) ++ bt_dev_err(hdev, "Unable to set CIG parameters: %d", err); ++ ++ kfree(pdu); ++} ++ ++static int set_cig_params_sync(struct hci_dev *hdev, void *data) ++{ ++ struct iso_cig_params *pdu = data; ++ u32 plen; ++ ++ plen = sizeof(pdu->cp) + pdu->cp.num_cis * sizeof(pdu->cis[0]); ++ return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_CIG_PARAMS, plen, pdu, ++ HCI_CMD_TIMEOUT); ++} ++ + static bool hci_le_set_cig_params(struct hci_conn *conn, struct bt_iso_qos *qos) + { + struct hci_dev *hdev = conn->hdev; + struct iso_list_data data; ++ struct iso_cig_params *pdu; + + memset(&data, 0, sizeof(data)); + +@@ -1779,12 +1804,18 @@ static bool hci_le_set_cig_params(struct hci_conn *conn, struct bt_iso_qos *qos) + if (qos->cis == BT_ISO_QOS_CIS_UNSET || !data.pdu.cp.num_cis) + return false; + +- if (hci_send_cmd(hdev, HCI_OP_LE_SET_CIG_PARAMS, +- sizeof(data.pdu.cp) + +- (data.pdu.cp.num_cis * sizeof(*data.pdu.cis)), +- &data.pdu) < 0) ++ pdu = kzalloc(sizeof(*pdu), GFP_KERNEL); ++ if (!pdu) + return false; + ++ memcpy(pdu, &data.pdu, sizeof(*pdu)); ++ ++ if (hci_cmd_sync_queue(hdev, set_cig_params_sync, pdu, ++ set_cig_params_complete) < 0) { ++ kfree(pdu); ++ return false; ++ } ++ + return true; + } + +-- +2.39.2 + diff --git a/queue-6.1/bluetooth-mgmt-add-cis-feature-bits-to-controller-in.patch b/queue-6.1/bluetooth-mgmt-add-cis-feature-bits-to-controller-in.patch new file mode 100644 index 00000000000..4714e640da3 --- /dev/null +++ b/queue-6.1/bluetooth-mgmt-add-cis-feature-bits-to-controller-in.patch @@ -0,0 +1,70 @@ +From 78a5b7b9a2a323d2d77f855b44d6dd33dca55b28 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Jan 2023 20:37:01 +0200 +Subject: Bluetooth: MGMT: add CIS feature bits to controller information + +From: Pauli Virtanen + +[ Upstream commit 2394186a2cefb9a45a029281a55749804dd8c556 ] + +Userspace needs to know whether the adapter has feature support for +Connected Isochronous Stream - Central/Peripheral, so it can set up +LE Audio features accordingly. + +Expose these feature bits as settings in MGMT controller info. + +Signed-off-by: Pauli Virtanen +Signed-off-by: Luiz Augusto von Dentz +Stable-dep-of: 73f55453ea52 ("Bluetooth: MGMT: Fix marking SCAN_RSP as not connectable") +Signed-off-by: Sasha Levin +--- + include/net/bluetooth/mgmt.h | 2 ++ + net/bluetooth/mgmt.c | 12 ++++++++++++ + 2 files changed, 14 insertions(+) + +diff --git a/include/net/bluetooth/mgmt.h b/include/net/bluetooth/mgmt.h +index 743f6f59dff81..e18a927669c0a 100644 +--- a/include/net/bluetooth/mgmt.h ++++ b/include/net/bluetooth/mgmt.h +@@ -109,6 +109,8 @@ struct mgmt_rp_read_index_list { + #define MGMT_SETTING_STATIC_ADDRESS 0x00008000 + #define MGMT_SETTING_PHY_CONFIGURATION 0x00010000 + #define MGMT_SETTING_WIDEBAND_SPEECH 0x00020000 ++#define MGMT_SETTING_CIS_CENTRAL 0x00040000 ++#define MGMT_SETTING_CIS_PERIPHERAL 0x00080000 + + #define MGMT_OP_READ_INFO 0x0004 + #define MGMT_READ_INFO_SIZE 0 +diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c +index fc4ba0884da96..815f2abe918ef 100644 +--- a/net/bluetooth/mgmt.c ++++ b/net/bluetooth/mgmt.c +@@ -859,6 +859,12 @@ static u32 get_supported_settings(struct hci_dev *hdev) + hdev->set_bdaddr) + settings |= MGMT_SETTING_CONFIGURATION; + ++ if (cis_central_capable(hdev)) ++ settings |= MGMT_SETTING_CIS_CENTRAL; ++ ++ if (cis_peripheral_capable(hdev)) ++ settings |= MGMT_SETTING_CIS_PERIPHERAL; ++ + settings |= MGMT_SETTING_PHY_CONFIGURATION; + + return settings; +@@ -932,6 +938,12 @@ static u32 get_current_settings(struct hci_dev *hdev) + if (hci_dev_test_flag(hdev, HCI_WIDEBAND_SPEECH_ENABLED)) + settings |= MGMT_SETTING_WIDEBAND_SPEECH; + ++ if (cis_central_capable(hdev)) ++ settings |= MGMT_SETTING_CIS_CENTRAL; ++ ++ if (cis_peripheral_capable(hdev)) ++ settings |= MGMT_SETTING_CIS_PERIPHERAL; ++ + return settings; + } + +-- +2.39.2 + diff --git a/queue-6.1/bluetooth-mgmt-fix-marking-scan_rsp-as-not-connectab.patch b/queue-6.1/bluetooth-mgmt-fix-marking-scan_rsp-as-not-connectab.patch new file mode 100644 index 00000000000..8a23725f4a6 --- /dev/null +++ b/queue-6.1/bluetooth-mgmt-fix-marking-scan_rsp-as-not-connectab.patch @@ -0,0 +1,73 @@ +From e5a97ce5b2a6dcbb52d4104a841ecca0053b01b5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Jun 2023 12:33:47 -0700 +Subject: Bluetooth: MGMT: Fix marking SCAN_RSP as not connectable + +From: Luiz Augusto von Dentz + +[ Upstream commit 73f55453ea5236a586a7f1b3d5e2ee051d655351 ] + +When receiving a scan response there is no way to know if the remote +device is connectable or not, so when it cannot be merged don't +make any assumption and instead just mark it with a new flag defined as +MGMT_DEV_FOUND_SCAN_RSP so userspace can tell it is a standalone +SCAN_RSP. + +Link: https://lore.kernel.org/linux-bluetooth/CABBYNZ+CYMsDSPTxBn09Js3BcdC-x7vZFfyLJ3ppZGGwJKmUTw@mail.gmail.com/ +Fixes: c70a7e4cc8d2 ("Bluetooth: Add support for Not Connectable flag for Device Found events") +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + include/net/bluetooth/mgmt.h | 1 + + net/bluetooth/hci_event.c | 15 +++++---------- + 2 files changed, 6 insertions(+), 10 deletions(-) + +diff --git a/include/net/bluetooth/mgmt.h b/include/net/bluetooth/mgmt.h +index a5801649f6196..5e68b3dd44222 100644 +--- a/include/net/bluetooth/mgmt.h ++++ b/include/net/bluetooth/mgmt.h +@@ -979,6 +979,7 @@ struct mgmt_ev_auth_failed { + #define MGMT_DEV_FOUND_NOT_CONNECTABLE BIT(2) + #define MGMT_DEV_FOUND_INITIATED_CONN BIT(3) + #define MGMT_DEV_FOUND_NAME_REQUEST_FAILED BIT(4) ++#define MGMT_DEV_FOUND_SCAN_RSP BIT(5) + + #define MGMT_EV_DEVICE_FOUND 0x0012 + struct mgmt_ev_device_found { +diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c +index 21416ccc30ab2..b272cc1f36481 100644 +--- a/net/bluetooth/hci_event.c ++++ b/net/bluetooth/hci_event.c +@@ -6307,23 +6307,18 @@ static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr, + return; + } + +- /* When receiving non-connectable or scannable undirected +- * advertising reports, this means that the remote device is +- * not connectable and then clearly indicate this in the +- * device found event. +- * +- * When receiving a scan response, then there is no way to ++ /* When receiving a scan response, then there is no way to + * know if the remote device is connectable or not. However + * since scan responses are merged with a previously seen + * advertising report, the flags field from that report + * will be used. + * +- * In the really unlikely case that a controller get confused +- * and just sends a scan response event, then it is marked as +- * not connectable as well. ++ * In the unlikely case that a controller just sends a scan ++ * response event that doesn't match the pending report, then ++ * it is marked as a standalone SCAN_RSP. + */ + if (type == LE_ADV_SCAN_RSP) +- flags = MGMT_DEV_FOUND_NOT_CONNECTABLE; ++ flags = MGMT_DEV_FOUND_SCAN_RSP; + + /* If there's nothing pending either store the data from this + * event or send an immediate device found event if the data +-- +2.39.2 + diff --git a/queue-6.1/bluetooth-mgmt-use-bit-macro-when-defining-bitfields.patch b/queue-6.1/bluetooth-mgmt-use-bit-macro-when-defining-bitfields.patch new file mode 100644 index 00000000000..913de0b9eba --- /dev/null +++ b/queue-6.1/bluetooth-mgmt-use-bit-macro-when-defining-bitfields.patch @@ -0,0 +1,127 @@ +From b6ed3a726e918e40715ffad3cca946081188586b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Feb 2023 14:28:55 -0800 +Subject: Bluetooth: MGMT: Use BIT macro when defining bitfields + +From: Luiz Augusto von Dentz + +[ Upstream commit a80d2c545ded86d0350b9a870735565d8b749786 ] + +This makes use of BIT macro when defining bitfields which makes it +clearer what bit it is toggling. + +Signed-off-by: Luiz Augusto von Dentz +Stable-dep-of: 73f55453ea52 ("Bluetooth: MGMT: Fix marking SCAN_RSP as not connectable") +Signed-off-by: Sasha Levin +--- + include/net/bluetooth/mgmt.h | 80 ++++++++++++++++++------------------ + 1 file changed, 40 insertions(+), 40 deletions(-) + +diff --git a/include/net/bluetooth/mgmt.h b/include/net/bluetooth/mgmt.h +index e18a927669c0a..a5801649f6196 100644 +--- a/include/net/bluetooth/mgmt.h ++++ b/include/net/bluetooth/mgmt.h +@@ -91,26 +91,26 @@ struct mgmt_rp_read_index_list { + #define MGMT_MAX_NAME_LENGTH (HCI_MAX_NAME_LENGTH + 1) + #define MGMT_MAX_SHORT_NAME_LENGTH (HCI_MAX_SHORT_NAME_LENGTH + 1) + +-#define MGMT_SETTING_POWERED 0x00000001 +-#define MGMT_SETTING_CONNECTABLE 0x00000002 +-#define MGMT_SETTING_FAST_CONNECTABLE 0x00000004 +-#define MGMT_SETTING_DISCOVERABLE 0x00000008 +-#define MGMT_SETTING_BONDABLE 0x00000010 +-#define MGMT_SETTING_LINK_SECURITY 0x00000020 +-#define MGMT_SETTING_SSP 0x00000040 +-#define MGMT_SETTING_BREDR 0x00000080 +-#define MGMT_SETTING_HS 0x00000100 +-#define MGMT_SETTING_LE 0x00000200 +-#define MGMT_SETTING_ADVERTISING 0x00000400 +-#define MGMT_SETTING_SECURE_CONN 0x00000800 +-#define MGMT_SETTING_DEBUG_KEYS 0x00001000 +-#define MGMT_SETTING_PRIVACY 0x00002000 +-#define MGMT_SETTING_CONFIGURATION 0x00004000 +-#define MGMT_SETTING_STATIC_ADDRESS 0x00008000 +-#define MGMT_SETTING_PHY_CONFIGURATION 0x00010000 +-#define MGMT_SETTING_WIDEBAND_SPEECH 0x00020000 +-#define MGMT_SETTING_CIS_CENTRAL 0x00040000 +-#define MGMT_SETTING_CIS_PERIPHERAL 0x00080000 ++#define MGMT_SETTING_POWERED BIT(0) ++#define MGMT_SETTING_CONNECTABLE BIT(1) ++#define MGMT_SETTING_FAST_CONNECTABLE BIT(2) ++#define MGMT_SETTING_DISCOVERABLE BIT(3) ++#define MGMT_SETTING_BONDABLE BIT(4) ++#define MGMT_SETTING_LINK_SECURITY BIT(5) ++#define MGMT_SETTING_SSP BIT(6) ++#define MGMT_SETTING_BREDR BIT(7) ++#define MGMT_SETTING_HS BIT(8) ++#define MGMT_SETTING_LE BIT(9) ++#define MGMT_SETTING_ADVERTISING BIT(10) ++#define MGMT_SETTING_SECURE_CONN BIT(11) ++#define MGMT_SETTING_DEBUG_KEYS BIT(12) ++#define MGMT_SETTING_PRIVACY BIT(13) ++#define MGMT_SETTING_CONFIGURATION BIT(14) ++#define MGMT_SETTING_STATIC_ADDRESS BIT(15) ++#define MGMT_SETTING_PHY_CONFIGURATION BIT(16) ++#define MGMT_SETTING_WIDEBAND_SPEECH BIT(17) ++#define MGMT_SETTING_CIS_CENTRAL BIT(18) ++#define MGMT_SETTING_CIS_PERIPHERAL BIT(19) + + #define MGMT_OP_READ_INFO 0x0004 + #define MGMT_READ_INFO_SIZE 0 +@@ -635,21 +635,21 @@ struct mgmt_rp_get_phy_configuration { + } __packed; + #define MGMT_GET_PHY_CONFIGURATION_SIZE 0 + +-#define MGMT_PHY_BR_1M_1SLOT 0x00000001 +-#define MGMT_PHY_BR_1M_3SLOT 0x00000002 +-#define MGMT_PHY_BR_1M_5SLOT 0x00000004 +-#define MGMT_PHY_EDR_2M_1SLOT 0x00000008 +-#define MGMT_PHY_EDR_2M_3SLOT 0x00000010 +-#define MGMT_PHY_EDR_2M_5SLOT 0x00000020 +-#define MGMT_PHY_EDR_3M_1SLOT 0x00000040 +-#define MGMT_PHY_EDR_3M_3SLOT 0x00000080 +-#define MGMT_PHY_EDR_3M_5SLOT 0x00000100 +-#define MGMT_PHY_LE_1M_TX 0x00000200 +-#define MGMT_PHY_LE_1M_RX 0x00000400 +-#define MGMT_PHY_LE_2M_TX 0x00000800 +-#define MGMT_PHY_LE_2M_RX 0x00001000 +-#define MGMT_PHY_LE_CODED_TX 0x00002000 +-#define MGMT_PHY_LE_CODED_RX 0x00004000 ++#define MGMT_PHY_BR_1M_1SLOT BIT(0) ++#define MGMT_PHY_BR_1M_3SLOT BIT(1) ++#define MGMT_PHY_BR_1M_5SLOT BIT(2) ++#define MGMT_PHY_EDR_2M_1SLOT BIT(3) ++#define MGMT_PHY_EDR_2M_3SLOT BIT(4) ++#define MGMT_PHY_EDR_2M_5SLOT BIT(5) ++#define MGMT_PHY_EDR_3M_1SLOT BIT(6) ++#define MGMT_PHY_EDR_3M_3SLOT BIT(7) ++#define MGMT_PHY_EDR_3M_5SLOT BIT(8) ++#define MGMT_PHY_LE_1M_TX BIT(9) ++#define MGMT_PHY_LE_1M_RX BIT(10) ++#define MGMT_PHY_LE_2M_TX BIT(11) ++#define MGMT_PHY_LE_2M_RX BIT(12) ++#define MGMT_PHY_LE_CODED_TX BIT(13) ++#define MGMT_PHY_LE_CODED_RX BIT(14) + + #define MGMT_PHY_BREDR_MASK (MGMT_PHY_BR_1M_1SLOT | MGMT_PHY_BR_1M_3SLOT | \ + MGMT_PHY_BR_1M_5SLOT | MGMT_PHY_EDR_2M_1SLOT | \ +@@ -974,11 +974,11 @@ struct mgmt_ev_auth_failed { + __u8 status; + } __packed; + +-#define MGMT_DEV_FOUND_CONFIRM_NAME 0x01 +-#define MGMT_DEV_FOUND_LEGACY_PAIRING 0x02 +-#define MGMT_DEV_FOUND_NOT_CONNECTABLE 0x04 +-#define MGMT_DEV_FOUND_INITIATED_CONN 0x08 +-#define MGMT_DEV_FOUND_NAME_REQUEST_FAILED 0x10 ++#define MGMT_DEV_FOUND_CONFIRM_NAME BIT(0) ++#define MGMT_DEV_FOUND_LEGACY_PAIRING BIT(1) ++#define MGMT_DEV_FOUND_NOT_CONNECTABLE BIT(2) ++#define MGMT_DEV_FOUND_INITIATED_CONN BIT(3) ++#define MGMT_DEV_FOUND_NAME_REQUEST_FAILED BIT(4) + + #define MGMT_EV_DEVICE_FOUND 0x0012 + struct mgmt_ev_device_found { +-- +2.39.2 + diff --git a/queue-6.1/bpf-btf-warn-but-return-no-error-for-null-btf-from-_.patch b/queue-6.1/bpf-btf-warn-but-return-no-error-for-null-btf-from-_.patch new file mode 100644 index 00000000000..9c01da0fdda --- /dev/null +++ b/queue-6.1/bpf-btf-warn-but-return-no-error-for-null-btf-from-_.patch @@ -0,0 +1,57 @@ +From d81e84be3d99f41869ab77db2b1c224fe972bb36 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 1 Jul 2023 17:14:47 +0000 +Subject: bpf, btf: Warn but return no error for NULL btf from + __register_btf_kfunc_id_set() + +From: SeongJae Park + +[ Upstream commit 3de4d22cc9ac7c9f38e10edcf54f9a8891a9c2aa ] + +__register_btf_kfunc_id_set() assumes .BTF to be part of the module's .ko +file if CONFIG_DEBUG_INFO_BTF is enabled. If that's not the case, the +function prints an error message and return an error. As a result, such +modules cannot be loaded. + +However, the section could be stripped out during a build process. It would +be better to let the modules loaded, because their basic functionalities +have no problem [0], though the BTF functionalities will not be supported. +Make the function to lower the level of the message from error to warn, and +return no error. + + [0] https://lore.kernel.org/bpf/20220219082037.ow2kbq5brktf4f2u@apollo.legion + +Fixes: c446fdacb10d ("bpf: fix register_btf_kfunc_id_set for !CONFIG_DEBUG_INFO_BTF") +Reported-by: Alexander Egorenkov +Suggested-by: Kumar Kartikeya Dwivedi +Signed-off-by: SeongJae Park +Signed-off-by: Daniel Borkmann +Acked-by: Jiri Olsa +Link: https://lore.kernel.org/bpf/87y228q66f.fsf@oc8242746057.ibm.com +Link: https://lore.kernel.org/bpf/20220219082037.ow2kbq5brktf4f2u@apollo.legion +Link: https://lore.kernel.org/bpf/20230701171447.56464-1-sj@kernel.org +Signed-off-by: Sasha Levin +--- + kernel/bpf/btf.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c +index 8220caa488c54..fb78bb26786fc 100644 +--- a/kernel/bpf/btf.c ++++ b/kernel/bpf/btf.c +@@ -7469,10 +7469,8 @@ int register_btf_kfunc_id_set(enum bpf_prog_type prog_type, + pr_err("missing vmlinux BTF, cannot register kfuncs\n"); + return -ENOENT; + } +- if (kset->owner && IS_ENABLED(CONFIG_DEBUG_INFO_BTF_MODULES)) { +- pr_err("missing module BTF, cannot register kfuncs\n"); +- return -ENOENT; +- } ++ if (kset->owner && IS_ENABLED(CONFIG_DEBUG_INFO_BTF_MODULES)) ++ pr_warn("missing module BTF, cannot register kfuncs\n"); + return 0; + } + if (IS_ERR(btf)) +-- +2.39.2 + diff --git a/queue-6.1/bus-fsl-mc-don-t-assume-child-devices-are-all-fsl-mc.patch b/queue-6.1/bus-fsl-mc-don-t-assume-child-devices-are-all-fsl-mc.patch new file mode 100644 index 00000000000..aaaece3b395 --- /dev/null +++ b/queue-6.1/bus-fsl-mc-don-t-assume-child-devices-are-all-fsl-mc.patch @@ -0,0 +1,99 @@ +From 9e6090352b3fbfbd14b522b6bfb376cf1a87698a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Jun 2023 19:07:18 +0300 +Subject: bus: fsl-mc: don't assume child devices are all fsl-mc devices + +From: Laurentiu Tudor + +[ Upstream commit 303c9c63abb9390e906052863f82bb4e9824e5c0 ] + +Changes in VFIO caused a pseudo-device to be created as child of +fsl-mc devices causing a crash [1] when trying to bind a fsl-mc +device to VFIO. Fix this by checking the device type when enumerating +fsl-mc child devices. + +[1] +Modules linked in: +Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP +CPU: 6 PID: 1289 Comm: sh Not tainted 6.2.0-rc5-00047-g7c46948a6e9c #2 +Hardware name: NXP Layerscape LX2160ARDB (DT) +pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) +pc : mc_send_command+0x24/0x1f0 +lr : dprc_get_obj_region+0xfc/0x1c0 +sp : ffff80000a88b900 +x29: ffff80000a88b900 x28: ffff48a9429e1400 x27: 00000000000002b2 +x26: ffff48a9429e1718 x25: 0000000000000000 x24: 0000000000000000 +x23: ffffd59331ba3918 x22: ffffd59331ba3000 x21: 0000000000000000 +x20: ffff80000a88b9b8 x19: 0000000000000000 x18: 0000000000000001 +x17: 7270642f636d2d6c x16: 73662e3030303030 x15: ffffffffffffffff +x14: ffffd59330f1d668 x13: ffff48a8727dc389 x12: ffff48a8727dc386 +x11: 0000000000000002 x10: 00008ceaf02f35d4 x9 : 0000000000000012 +x8 : 0000000000000000 x7 : 0000000000000006 x6 : ffff80000a88bab0 +x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff80000a88b9e8 +x2 : ffff80000a88b9e8 x1 : 0000000000000000 x0 : ffff48a945142b80 +Call trace: + mc_send_command+0x24/0x1f0 + dprc_get_obj_region+0xfc/0x1c0 + fsl_mc_device_add+0x340/0x590 + fsl_mc_obj_device_add+0xd0/0xf8 + dprc_scan_objects+0x1c4/0x340 + dprc_scan_container+0x38/0x60 + vfio_fsl_mc_probe+0x9c/0xf8 + fsl_mc_driver_probe+0x24/0x70 + really_probe+0xbc/0x2a8 + __driver_probe_device+0x78/0xe0 + device_driver_attach+0x30/0x68 + bind_store+0xa8/0x130 + drv_attr_store+0x24/0x38 + sysfs_kf_write+0x44/0x60 + kernfs_fop_write_iter+0x128/0x1b8 + vfs_write+0x334/0x448 + ksys_write+0x68/0xf0 + __arm64_sys_write+0x1c/0x28 + invoke_syscall+0x44/0x108 + el0_svc_common.constprop.1+0x94/0xf8 + do_el0_svc+0x38/0xb0 + el0_svc+0x20/0x50 + el0t_64_sync_handler+0x98/0xc0 + el0t_64_sync+0x174/0x178 +Code: aa0103f4 a9025bf5 d5384100 b9400801 (79401260) +---[ end trace 0000000000000000 ]--- + +Fixes: 3c28a76124b2 ("vfio: Add struct device to vfio_device") +Signed-off-by: Laurentiu Tudor +Tested-by: Ioana Ciornei +Reviewed-by: Ioana Ciornei +Message-ID: <20230613160718.29500-1-laurentiu.tudor@nxp.com> +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/bus/fsl-mc/dprc-driver.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/bus/fsl-mc/dprc-driver.c b/drivers/bus/fsl-mc/dprc-driver.c +index 5e70f9775a0e3..d1e2d2987dd38 100644 +--- a/drivers/bus/fsl-mc/dprc-driver.c ++++ b/drivers/bus/fsl-mc/dprc-driver.c +@@ -46,6 +46,9 @@ static int __fsl_mc_device_remove_if_not_in_mc(struct device *dev, void *data) + struct fsl_mc_child_objs *objs; + struct fsl_mc_device *mc_dev; + ++ if (!dev_is_fsl_mc(dev)) ++ return 0; ++ + mc_dev = to_fsl_mc_device(dev); + objs = data; + +@@ -65,6 +68,9 @@ static int __fsl_mc_device_remove_if_not_in_mc(struct device *dev, void *data) + + static int __fsl_mc_device_remove(struct device *dev, void *data) + { ++ if (!dev_is_fsl_mc(dev)) ++ return 0; ++ + fsl_mc_device_remove(to_fsl_mc_device(dev)); + return 0; + } +-- +2.39.2 + diff --git a/queue-6.1/clk-qcom-camcc-sc7180-add-parent-dependency-to-all-c.patch b/queue-6.1/clk-qcom-camcc-sc7180-add-parent-dependency-to-all-c.patch new file mode 100644 index 00000000000..8d02bfc3ca7 --- /dev/null +++ b/queue-6.1/clk-qcom-camcc-sc7180-add-parent-dependency-to-all-c.patch @@ -0,0 +1,88 @@ +From 4e03e3603d14d23b08acabcaacb27701161fcfab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 May 2023 19:59:32 +0530 +Subject: clk: qcom: camcc-sc7180: Add parent dependency to all camera GDSCs + +From: Taniya Das + +[ Upstream commit 3e4d179532423f299554cd0dedabdd9d2fdd238d ] + +Camera titan top GDSC is a parent supply to all other camera GDSCs. Titan +top GDSC is required to be enabled before enabling any other camera GDSCs +and it should be disabled only after all other camera GDSCs are disabled. +Ensure this behavior by marking titan top GDSC as parent of all other +camera GDSCs. + +Fixes: 15d09e830bbc ("clk: qcom: camcc: Add camera clock controller driver for SC7180") +Signed-off-by: Taniya Das +Acked-by: Stephen Boyd +Reviewed-by: Bryan O'Donoghue +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230501142932.13049-1-quic_tdas@quicinc.com +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/camcc-sc7180.c | 19 ++++++++++++------- + 1 file changed, 12 insertions(+), 7 deletions(-) + +diff --git a/drivers/clk/qcom/camcc-sc7180.c b/drivers/clk/qcom/camcc-sc7180.c +index e2b4804695f37..8a4ba7a19ed12 100644 +--- a/drivers/clk/qcom/camcc-sc7180.c ++++ b/drivers/clk/qcom/camcc-sc7180.c +@@ -1480,12 +1480,21 @@ static struct clk_branch cam_cc_sys_tmr_clk = { + }, + }; + ++static struct gdsc titan_top_gdsc = { ++ .gdscr = 0xb134, ++ .pd = { ++ .name = "titan_top_gdsc", ++ }, ++ .pwrsts = PWRSTS_OFF_ON, ++}; ++ + static struct gdsc bps_gdsc = { + .gdscr = 0x6004, + .pd = { + .name = "bps_gdsc", + }, + .pwrsts = PWRSTS_OFF_ON, ++ .parent = &titan_top_gdsc.pd, + .flags = HW_CTRL, + }; + +@@ -1495,6 +1504,7 @@ static struct gdsc ife_0_gdsc = { + .name = "ife_0_gdsc", + }, + .pwrsts = PWRSTS_OFF_ON, ++ .parent = &titan_top_gdsc.pd, + }; + + static struct gdsc ife_1_gdsc = { +@@ -1503,6 +1513,7 @@ static struct gdsc ife_1_gdsc = { + .name = "ife_1_gdsc", + }, + .pwrsts = PWRSTS_OFF_ON, ++ .parent = &titan_top_gdsc.pd, + }; + + static struct gdsc ipe_0_gdsc = { +@@ -1512,15 +1523,9 @@ static struct gdsc ipe_0_gdsc = { + }, + .pwrsts = PWRSTS_OFF_ON, + .flags = HW_CTRL, ++ .parent = &titan_top_gdsc.pd, + }; + +-static struct gdsc titan_top_gdsc = { +- .gdscr = 0xb134, +- .pd = { +- .name = "titan_top_gdsc", +- }, +- .pwrsts = PWRSTS_OFF_ON, +-}; + + static struct clk_hw *cam_cc_sc7180_hws[] = { + [CAM_CC_PLL2_OUT_EARLY] = &cam_cc_pll2_out_early.hw, +-- +2.39.2 + diff --git a/queue-6.1/clk-qcom-dispcc-qcm2290-fix-bi_tcxo_ao-handling.patch b/queue-6.1/clk-qcom-dispcc-qcm2290-fix-bi_tcxo_ao-handling.patch new file mode 100644 index 00000000000..e34924f2f5a --- /dev/null +++ b/queue-6.1/clk-qcom-dispcc-qcm2290-fix-bi_tcxo_ao-handling.patch @@ -0,0 +1,57 @@ +From 4da8f32a2876ebfb31b9b92c7305aca9a353ffd8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Apr 2023 13:06:35 +0200 +Subject: clk: qcom: dispcc-qcm2290: Fix BI_TCXO_AO handling + +From: Konrad Dybcio + +[ Upstream commit 92dfee0fc889b5b00ffb6b1de87ce64c483bcb7b ] + +BI_TCXO_AO (.fw_name = "bi_tcxo_ao") was previously made to reuse the +same parent enum entry as BI_TCXO (.fw_name = "bi_tcxo") in parent_map_2. + +Resolve it by introducing its own entry in the parent enum and +correctly assigning it in disp_cc_parent_map_2[]. + +Fixes: cc517ea3333f ("clk: qcom: Add display clock controller driver for QCM2290") +Signed-off-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230412-topic-qcm_dispcc-v2-1-bce7dd512fe4@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/dispcc-qcm2290.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/clk/qcom/dispcc-qcm2290.c b/drivers/clk/qcom/dispcc-qcm2290.c +index 24755dc841f9d..4a4993470852b 100644 +--- a/drivers/clk/qcom/dispcc-qcm2290.c ++++ b/drivers/clk/qcom/dispcc-qcm2290.c +@@ -23,6 +23,7 @@ + + enum { + P_BI_TCXO, ++ P_BI_TCXO_AO, + P_DISP_CC_PLL0_OUT_MAIN, + P_DSI0_PHY_PLL_OUT_BYTECLK, + P_DSI0_PHY_PLL_OUT_DSICLK, +@@ -81,7 +82,7 @@ static const struct clk_parent_data disp_cc_parent_data_1[] = { + }; + + static const struct parent_map disp_cc_parent_map_2[] = { +- { P_BI_TCXO, 0 }, ++ { P_BI_TCXO_AO, 0 }, + { P_GPLL0_OUT_MAIN, 4 }, + }; + +@@ -150,7 +151,7 @@ static struct clk_regmap_div disp_cc_mdss_byte0_div_clk_src = { + }; + + static const struct freq_tbl ftbl_disp_cc_mdss_ahb_clk_src[] = { +- F(19200000, P_BI_TCXO, 1, 0, 0), ++ F(19200000, P_BI_TCXO_AO, 1, 0, 0), + F(37500000, P_GPLL0_OUT_MAIN, 8, 0, 0), + F(75000000, P_GPLL0_OUT_MAIN, 4, 0, 0), + { } +-- +2.39.2 + diff --git a/queue-6.1/clk-qcom-dispcc-qcm2290-fix-gpll0_out_div-handling.patch b/queue-6.1/clk-qcom-dispcc-qcm2290-fix-gpll0_out_div-handling.patch new file mode 100644 index 00000000000..dc19f00a5dc --- /dev/null +++ b/queue-6.1/clk-qcom-dispcc-qcm2290-fix-gpll0_out_div-handling.patch @@ -0,0 +1,60 @@ +From f0ab3f917f58eade5f247b76d51bd1c46be0d5d4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Apr 2023 13:06:36 +0200 +Subject: clk: qcom: dispcc-qcm2290: Fix GPLL0_OUT_DIV handling + +From: Konrad Dybcio + +[ Upstream commit 63d56adf04b5795e54440dc5b7afddecb2966863 ] + +GPLL0_OUT_DIV (.fw_name = "gcc_disp_gpll0_div_clk_src") was previously +made to reuse the same parent enum entry as GPLL0_OUT_MAIN +(.fw_name = "gcc_disp_gpll0_clk_src") in parent_map_2. + +Resolve it by introducing its own entry in the parent enum and +correctly assigning it in disp_cc_parent_map_2[]. + +Fixes: cc517ea3333f ("clk: qcom: Add display clock controller driver for QCM2290") +Signed-off-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230412-topic-qcm_dispcc-v2-2-bce7dd512fe4@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/dispcc-qcm2290.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/clk/qcom/dispcc-qcm2290.c b/drivers/clk/qcom/dispcc-qcm2290.c +index 4a4993470852b..5cec98c4e8372 100644 +--- a/drivers/clk/qcom/dispcc-qcm2290.c ++++ b/drivers/clk/qcom/dispcc-qcm2290.c +@@ -27,6 +27,7 @@ enum { + P_DISP_CC_PLL0_OUT_MAIN, + P_DSI0_PHY_PLL_OUT_BYTECLK, + P_DSI0_PHY_PLL_OUT_DSICLK, ++ P_GPLL0_OUT_DIV, + P_GPLL0_OUT_MAIN, + P_SLEEP_CLK, + }; +@@ -83,7 +84,7 @@ static const struct clk_parent_data disp_cc_parent_data_1[] = { + + static const struct parent_map disp_cc_parent_map_2[] = { + { P_BI_TCXO_AO, 0 }, +- { P_GPLL0_OUT_MAIN, 4 }, ++ { P_GPLL0_OUT_DIV, 4 }, + }; + + static const struct clk_parent_data disp_cc_parent_data_2[] = { +@@ -152,8 +153,8 @@ static struct clk_regmap_div disp_cc_mdss_byte0_div_clk_src = { + + static const struct freq_tbl ftbl_disp_cc_mdss_ahb_clk_src[] = { + F(19200000, P_BI_TCXO_AO, 1, 0, 0), +- F(37500000, P_GPLL0_OUT_MAIN, 8, 0, 0), +- F(75000000, P_GPLL0_OUT_MAIN, 4, 0, 0), ++ F(37500000, P_GPLL0_OUT_DIV, 8, 0, 0), ++ F(75000000, P_GPLL0_OUT_DIV, 4, 0, 0), + { } + }; + +-- +2.39.2 + diff --git a/queue-6.1/clk-qcom-gcc-ipq6018-use-floor-ops-for-sdcc-clocks.patch b/queue-6.1/clk-qcom-gcc-ipq6018-use-floor-ops-for-sdcc-clocks.patch new file mode 100644 index 00000000000..865d4dc43e5 --- /dev/null +++ b/queue-6.1/clk-qcom-gcc-ipq6018-use-floor-ops-for-sdcc-clocks.patch @@ -0,0 +1,37 @@ +From 5b57b2f33c26ac3ed253c1ae4662c77248a9f08f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Apr 2023 12:11:49 +0300 +Subject: clk: qcom: gcc-ipq6018: Use floor ops for sdcc clocks + +From: Mantas Pucka + +[ Upstream commit 56e5ae0116aef87273cf1812d608645b076e4f02 ] + +SDCC clocks must be rounded down to avoid overclocking the controller. + +Fixes: d9db07f088af ("clk: qcom: Add ipq6018 Global Clock Controller support") +Signed-off-by: Mantas Pucka +Reviewed-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/1682413909-24927-1-git-send-email-mantas@8devices.com +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/gcc-ipq6018.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/qcom/gcc-ipq6018.c b/drivers/clk/qcom/gcc-ipq6018.c +index 3f9c2f61a5d93..5c5d1b04ea7af 100644 +--- a/drivers/clk/qcom/gcc-ipq6018.c ++++ b/drivers/clk/qcom/gcc-ipq6018.c +@@ -1654,7 +1654,7 @@ static struct clk_rcg2 sdcc1_apps_clk_src = { + .name = "sdcc1_apps_clk_src", + .parent_data = gcc_xo_gpll0_gpll2_gpll0_out_main_div2, + .num_parents = 4, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_floor_ops, + }, + }; + +-- +2.39.2 + diff --git a/queue-6.1/clk-qcom-gcc-qcm2290-mark-rcgs-shared-where-applicab.patch b/queue-6.1/clk-qcom-gcc-qcm2290-mark-rcgs-shared-where-applicab.patch new file mode 100644 index 00000000000..52b69d003ed --- /dev/null +++ b/queue-6.1/clk-qcom-gcc-qcm2290-mark-rcgs-shared-where-applicab.patch @@ -0,0 +1,307 @@ +From 14cf730f73e061d8bf9d90d9234a6c9b407fbe64 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Apr 2023 19:48:07 +0200 +Subject: clk: qcom: gcc-qcm2290: Mark RCGs shared where applicable + +From: Konrad Dybcio + +[ Upstream commit 7bf654a0d95e75b415f454e10627309d650762d0 ] + +The vast majority of shared RCGs were not marked as such. Fix it. + +Fixes: 496d1a13d405 ("clk: qcom: Add Global Clock Controller driver for QCM2290") +Signed-off-by: Konrad Dybcio +Acked-by: Shawn Guo +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230403174807.345185-1-konrad.dybcio@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/gcc-qcm2290.c | 62 +++++++++++++++++----------------- + 1 file changed, 31 insertions(+), 31 deletions(-) + +diff --git a/drivers/clk/qcom/gcc-qcm2290.c b/drivers/clk/qcom/gcc-qcm2290.c +index 096deff2ba257..48995e50c6bd7 100644 +--- a/drivers/clk/qcom/gcc-qcm2290.c ++++ b/drivers/clk/qcom/gcc-qcm2290.c +@@ -650,7 +650,7 @@ static struct clk_rcg2 gcc_usb30_prim_mock_utmi_clk_src = { + .name = "gcc_usb30_prim_mock_utmi_clk_src", + .parent_data = gcc_parents_0, + .num_parents = ARRAY_SIZE(gcc_parents_0), +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -686,7 +686,7 @@ static struct clk_rcg2 gcc_camss_axi_clk_src = { + .name = "gcc_camss_axi_clk_src", + .parent_data = gcc_parents_4, + .num_parents = ARRAY_SIZE(gcc_parents_4), +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -706,7 +706,7 @@ static struct clk_rcg2 gcc_camss_cci_clk_src = { + .name = "gcc_camss_cci_clk_src", + .parent_data = gcc_parents_9, + .num_parents = ARRAY_SIZE(gcc_parents_9), +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -728,7 +728,7 @@ static struct clk_rcg2 gcc_camss_csi0phytimer_clk_src = { + .name = "gcc_camss_csi0phytimer_clk_src", + .parent_data = gcc_parents_5, + .num_parents = ARRAY_SIZE(gcc_parents_5), +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -742,7 +742,7 @@ static struct clk_rcg2 gcc_camss_csi1phytimer_clk_src = { + .name = "gcc_camss_csi1phytimer_clk_src", + .parent_data = gcc_parents_5, + .num_parents = ARRAY_SIZE(gcc_parents_5), +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -764,7 +764,7 @@ static struct clk_rcg2 gcc_camss_mclk0_clk_src = { + .parent_data = gcc_parents_3, + .num_parents = ARRAY_SIZE(gcc_parents_3), + .flags = CLK_OPS_PARENT_ENABLE, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -779,7 +779,7 @@ static struct clk_rcg2 gcc_camss_mclk1_clk_src = { + .parent_data = gcc_parents_3, + .num_parents = ARRAY_SIZE(gcc_parents_3), + .flags = CLK_OPS_PARENT_ENABLE, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -794,7 +794,7 @@ static struct clk_rcg2 gcc_camss_mclk2_clk_src = { + .parent_data = gcc_parents_3, + .num_parents = ARRAY_SIZE(gcc_parents_3), + .flags = CLK_OPS_PARENT_ENABLE, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -809,7 +809,7 @@ static struct clk_rcg2 gcc_camss_mclk3_clk_src = { + .parent_data = gcc_parents_3, + .num_parents = ARRAY_SIZE(gcc_parents_3), + .flags = CLK_OPS_PARENT_ENABLE, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -830,7 +830,7 @@ static struct clk_rcg2 gcc_camss_ope_ahb_clk_src = { + .name = "gcc_camss_ope_ahb_clk_src", + .parent_data = gcc_parents_6, + .num_parents = ARRAY_SIZE(gcc_parents_6), +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -854,7 +854,7 @@ static struct clk_rcg2 gcc_camss_ope_clk_src = { + .parent_data = gcc_parents_6, + .num_parents = ARRAY_SIZE(gcc_parents_6), + .flags = CLK_SET_RATE_PARENT, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -888,7 +888,7 @@ static struct clk_rcg2 gcc_camss_tfe_0_clk_src = { + .name = "gcc_camss_tfe_0_clk_src", + .parent_data = gcc_parents_7, + .num_parents = ARRAY_SIZE(gcc_parents_7), +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -912,7 +912,7 @@ static struct clk_rcg2 gcc_camss_tfe_0_csid_clk_src = { + .name = "gcc_camss_tfe_0_csid_clk_src", + .parent_data = gcc_parents_8, + .num_parents = ARRAY_SIZE(gcc_parents_8), +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -926,7 +926,7 @@ static struct clk_rcg2 gcc_camss_tfe_1_clk_src = { + .name = "gcc_camss_tfe_1_clk_src", + .parent_data = gcc_parents_7, + .num_parents = ARRAY_SIZE(gcc_parents_7), +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -940,7 +940,7 @@ static struct clk_rcg2 gcc_camss_tfe_1_csid_clk_src = { + .name = "gcc_camss_tfe_1_csid_clk_src", + .parent_data = gcc_parents_8, + .num_parents = ARRAY_SIZE(gcc_parents_8), +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -963,7 +963,7 @@ static struct clk_rcg2 gcc_camss_tfe_cphy_rx_clk_src = { + .parent_data = gcc_parents_10, + .num_parents = ARRAY_SIZE(gcc_parents_10), + .flags = CLK_OPS_PARENT_ENABLE, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -984,7 +984,7 @@ static struct clk_rcg2 gcc_camss_top_ahb_clk_src = { + .name = "gcc_camss_top_ahb_clk_src", + .parent_data = gcc_parents_4, + .num_parents = ARRAY_SIZE(gcc_parents_4), +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -1006,7 +1006,7 @@ static struct clk_rcg2 gcc_gp1_clk_src = { + .name = "gcc_gp1_clk_src", + .parent_data = gcc_parents_2, + .num_parents = ARRAY_SIZE(gcc_parents_2), +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -1020,7 +1020,7 @@ static struct clk_rcg2 gcc_gp2_clk_src = { + .name = "gcc_gp2_clk_src", + .parent_data = gcc_parents_2, + .num_parents = ARRAY_SIZE(gcc_parents_2), +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -1034,7 +1034,7 @@ static struct clk_rcg2 gcc_gp3_clk_src = { + .name = "gcc_gp3_clk_src", + .parent_data = gcc_parents_2, + .num_parents = ARRAY_SIZE(gcc_parents_2), +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -1054,7 +1054,7 @@ static struct clk_rcg2 gcc_pdm2_clk_src = { + .name = "gcc_pdm2_clk_src", + .parent_data = gcc_parents_0, + .num_parents = ARRAY_SIZE(gcc_parents_0), +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -1082,7 +1082,7 @@ static struct clk_init_data gcc_qupv3_wrap0_s0_clk_src_init = { + .name = "gcc_qupv3_wrap0_s0_clk_src", + .parent_data = gcc_parents_1, + .num_parents = ARRAY_SIZE(gcc_parents_1), +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }; + + static struct clk_rcg2 gcc_qupv3_wrap0_s0_clk_src = { +@@ -1098,7 +1098,7 @@ static struct clk_init_data gcc_qupv3_wrap0_s1_clk_src_init = { + .name = "gcc_qupv3_wrap0_s1_clk_src", + .parent_data = gcc_parents_1, + .num_parents = ARRAY_SIZE(gcc_parents_1), +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }; + + static struct clk_rcg2 gcc_qupv3_wrap0_s1_clk_src = { +@@ -1114,7 +1114,7 @@ static struct clk_init_data gcc_qupv3_wrap0_s2_clk_src_init = { + .name = "gcc_qupv3_wrap0_s2_clk_src", + .parent_data = gcc_parents_1, + .num_parents = ARRAY_SIZE(gcc_parents_1), +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }; + + static struct clk_rcg2 gcc_qupv3_wrap0_s2_clk_src = { +@@ -1130,7 +1130,7 @@ static struct clk_init_data gcc_qupv3_wrap0_s3_clk_src_init = { + .name = "gcc_qupv3_wrap0_s3_clk_src", + .parent_data = gcc_parents_1, + .num_parents = ARRAY_SIZE(gcc_parents_1), +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }; + + static struct clk_rcg2 gcc_qupv3_wrap0_s3_clk_src = { +@@ -1146,7 +1146,7 @@ static struct clk_init_data gcc_qupv3_wrap0_s4_clk_src_init = { + .name = "gcc_qupv3_wrap0_s4_clk_src", + .parent_data = gcc_parents_1, + .num_parents = ARRAY_SIZE(gcc_parents_1), +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }; + + static struct clk_rcg2 gcc_qupv3_wrap0_s4_clk_src = { +@@ -1162,7 +1162,7 @@ static struct clk_init_data gcc_qupv3_wrap0_s5_clk_src_init = { + .name = "gcc_qupv3_wrap0_s5_clk_src", + .parent_data = gcc_parents_1, + .num_parents = ARRAY_SIZE(gcc_parents_1), +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }; + + static struct clk_rcg2 gcc_qupv3_wrap0_s5_clk_src = { +@@ -1219,7 +1219,7 @@ static struct clk_rcg2 gcc_sdcc1_ice_core_clk_src = { + .name = "gcc_sdcc1_ice_core_clk_src", + .parent_data = gcc_parents_0, + .num_parents = ARRAY_SIZE(gcc_parents_0), +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -1266,7 +1266,7 @@ static struct clk_rcg2 gcc_usb30_prim_master_clk_src = { + .name = "gcc_usb30_prim_master_clk_src", + .parent_data = gcc_parents_0, + .num_parents = ARRAY_SIZE(gcc_parents_0), +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -1280,7 +1280,7 @@ static struct clk_rcg2 gcc_usb3_prim_phy_aux_clk_src = { + .name = "gcc_usb3_prim_phy_aux_clk_src", + .parent_data = gcc_parents_13, + .num_parents = ARRAY_SIZE(gcc_parents_13), +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -1303,7 +1303,7 @@ static struct clk_rcg2 gcc_video_venus_clk_src = { + .parent_data = gcc_parents_14, + .num_parents = ARRAY_SIZE(gcc_parents_14), + .flags = CLK_SET_RATE_PARENT, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +-- +2.39.2 + diff --git a/queue-6.1/clk-qcom-ipq6018-fix-networking-resets.patch b/queue-6.1/clk-qcom-ipq6018-fix-networking-resets.patch new file mode 100644 index 00000000000..253c1618fea --- /dev/null +++ b/queue-6.1/clk-qcom-ipq6018-fix-networking-resets.patch @@ -0,0 +1,72 @@ +From 843ec451583b377b34400d97665377fb51461359 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 May 2023 21:08:55 +0200 +Subject: clk: qcom: ipq6018: fix networking resets + +From: Robert Marko + +[ Upstream commit 349b5bed539b491b7894a5186a895751fd8ba6c7 ] + +Networking resets in IPQ6018 all use bitmask as they require multiple +bits to be set and cleared instead of a single bit. + +So, current networking resets have the same register and bit 0 set which +is clearly incorrect. + +Fixes: d9db07f088af ("clk: qcom: Add ipq6018 Global Clock Controller support") +Signed-off-by: Robert Marko +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230526190855.2941291-2-robimarko@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/gcc-ipq6018.c | 32 ++++++++++++++++---------------- + 1 file changed, 16 insertions(+), 16 deletions(-) + +diff --git a/drivers/clk/qcom/gcc-ipq6018.c b/drivers/clk/qcom/gcc-ipq6018.c +index 5c5d1b04ea7af..cde62a11f5736 100644 +--- a/drivers/clk/qcom/gcc-ipq6018.c ++++ b/drivers/clk/qcom/gcc-ipq6018.c +@@ -4517,24 +4517,24 @@ static const struct qcom_reset_map gcc_ipq6018_resets[] = { + [GCC_PCIE0_AHB_ARES] = { 0x75040, 5 }, + [GCC_PCIE0_AXI_MASTER_STICKY_ARES] = { 0x75040, 6 }, + [GCC_PCIE0_AXI_SLAVE_STICKY_ARES] = { 0x75040, 7 }, +- [GCC_PPE_FULL_RESET] = { 0x68014, 0 }, +- [GCC_UNIPHY0_SOFT_RESET] = { 0x56004, 0 }, ++ [GCC_PPE_FULL_RESET] = { .reg = 0x68014, .bitmask = 0xf0000 }, ++ [GCC_UNIPHY0_SOFT_RESET] = { .reg = 0x56004, .bitmask = 0x3ff2 }, + [GCC_UNIPHY0_XPCS_RESET] = { 0x56004, 2 }, +- [GCC_UNIPHY1_SOFT_RESET] = { 0x56104, 0 }, ++ [GCC_UNIPHY1_SOFT_RESET] = { .reg = 0x56104, .bitmask = 0x32 }, + [GCC_UNIPHY1_XPCS_RESET] = { 0x56104, 2 }, +- [GCC_EDMA_HW_RESET] = { 0x68014, 0 }, +- [GCC_NSSPORT1_RESET] = { 0x68014, 0 }, +- [GCC_NSSPORT2_RESET] = { 0x68014, 0 }, +- [GCC_NSSPORT3_RESET] = { 0x68014, 0 }, +- [GCC_NSSPORT4_RESET] = { 0x68014, 0 }, +- [GCC_NSSPORT5_RESET] = { 0x68014, 0 }, +- [GCC_UNIPHY0_PORT1_ARES] = { 0x56004, 0 }, +- [GCC_UNIPHY0_PORT2_ARES] = { 0x56004, 0 }, +- [GCC_UNIPHY0_PORT3_ARES] = { 0x56004, 0 }, +- [GCC_UNIPHY0_PORT4_ARES] = { 0x56004, 0 }, +- [GCC_UNIPHY0_PORT5_ARES] = { 0x56004, 0 }, +- [GCC_UNIPHY0_PORT_4_5_RESET] = { 0x56004, 0 }, +- [GCC_UNIPHY0_PORT_4_RESET] = { 0x56004, 0 }, ++ [GCC_EDMA_HW_RESET] = { .reg = 0x68014, .bitmask = 0x300000 }, ++ [GCC_NSSPORT1_RESET] = { .reg = 0x68014, .bitmask = 0x1000003 }, ++ [GCC_NSSPORT2_RESET] = { .reg = 0x68014, .bitmask = 0x200000c }, ++ [GCC_NSSPORT3_RESET] = { .reg = 0x68014, .bitmask = 0x4000030 }, ++ [GCC_NSSPORT4_RESET] = { .reg = 0x68014, .bitmask = 0x8000300 }, ++ [GCC_NSSPORT5_RESET] = { .reg = 0x68014, .bitmask = 0x10000c00 }, ++ [GCC_UNIPHY0_PORT1_ARES] = { .reg = 0x56004, .bitmask = 0x30 }, ++ [GCC_UNIPHY0_PORT2_ARES] = { .reg = 0x56004, .bitmask = 0xc0 }, ++ [GCC_UNIPHY0_PORT3_ARES] = { .reg = 0x56004, .bitmask = 0x300 }, ++ [GCC_UNIPHY0_PORT4_ARES] = { .reg = 0x56004, .bitmask = 0xc00 }, ++ [GCC_UNIPHY0_PORT5_ARES] = { .reg = 0x56004, .bitmask = 0x3000 }, ++ [GCC_UNIPHY0_PORT_4_5_RESET] = { .reg = 0x56004, .bitmask = 0x3c02 }, ++ [GCC_UNIPHY0_PORT_4_RESET] = { .reg = 0x56004, .bitmask = 0xc02 }, + [GCC_LPASS_BCR] = {0x1F000, 0}, + [GCC_UBI32_TBU_BCR] = {0x65000, 0}, + [GCC_LPASS_TBU_BCR] = {0x6C000, 0}, +-- +2.39.2 + diff --git a/queue-6.1/clk-qcom-mmcc-msm8974-fix-mdss_gdsc-power-flags.patch b/queue-6.1/clk-qcom-mmcc-msm8974-fix-mdss_gdsc-power-flags.patch new file mode 100644 index 00000000000..4d9d8e09fad --- /dev/null +++ b/queue-6.1/clk-qcom-mmcc-msm8974-fix-mdss_gdsc-power-flags.patch @@ -0,0 +1,40 @@ +From 4b4bfa748b1d7d78eae6ddd4be884402da305065 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 7 May 2023 20:53:35 +0300 +Subject: clk: qcom: mmcc-msm8974: fix MDSS_GDSC power flags + +From: Dmitry Baryshkov + +[ Upstream commit 4e13c7a55cf752887f2b8d8008711dbbc64ea796 ] + +Using PWRSTS_RET on msm8974's MDSS_GDSC causes display to stop working. +The gdsc doesn't fully come out of retention mode. Change it's pwrsts +flags to PWRSTS_OFF_ON. + +Fixes: d399723950c4 ("clk: qcom: gdsc: Fix the handling of PWRSTS_RET support") +Signed-off-by: Dmitry Baryshkov +Reviewed-by: Rajendra Nayak +Tested-by: Luca Weiss +Link: https://lore.kernel.org/r/20230507175335.2321503-2-dmitry.baryshkov@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/mmcc-msm8974.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/qcom/mmcc-msm8974.c b/drivers/clk/qcom/mmcc-msm8974.c +index d2fec5d5b22e2..82f6bad144a9a 100644 +--- a/drivers/clk/qcom/mmcc-msm8974.c ++++ b/drivers/clk/qcom/mmcc-msm8974.c +@@ -2384,7 +2384,7 @@ static struct gdsc mdss_gdsc = { + .pd = { + .name = "mdss", + }, +- .pwrsts = PWRSTS_RET_ON, ++ .pwrsts = PWRSTS_OFF_ON, + }; + + static struct gdsc camss_jpeg_gdsc = { +-- +2.39.2 + diff --git a/queue-6.1/clk-qcom-mmcc-msm8974-move-clock-parent-tables-down.patch b/queue-6.1/clk-qcom-mmcc-msm8974-move-clock-parent-tables-down.patch new file mode 100644 index 00000000000..920602ebf69 --- /dev/null +++ b/queue-6.1/clk-qcom-mmcc-msm8974-move-clock-parent-tables-down.patch @@ -0,0 +1,214 @@ +From acdbb1acc7382b5c65a72241ea2a90dcfedd1480 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 4 Dec 2022 14:45:04 +0200 +Subject: clk: qcom: mmcc-msm8974: move clock parent tables down + +From: Dmitry Baryshkov + +[ Upstream commit 28c6c02527757a4b3c63b30d77f7e7d5c112c085 ] + +Move clock parent tables down, after the PLL declarataions, so that we +can use pll hw clock fields in the next commit. + +Reviewed-by: Neil Armstrong +Reviewed-by: Konrad Dybcio +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20221204124508.1415713-8-dmitry.baryshkov@linaro.org +Stable-dep-of: 853c064b5749 ("clk: qcom: mmcc-msm8974: remove oxili_ocmemgx_clk") +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/mmcc-msm8974.c | 170 ++++++++++++++++---------------- + 1 file changed, 85 insertions(+), 85 deletions(-) + +diff --git a/drivers/clk/qcom/mmcc-msm8974.c b/drivers/clk/qcom/mmcc-msm8974.c +index 9008df2305df5..57f1a351c8f67 100644 +--- a/drivers/clk/qcom/mmcc-msm8974.c ++++ b/drivers/clk/qcom/mmcc-msm8974.c +@@ -42,6 +42,91 @@ enum { + P_DSI1PLL_BYTE, + }; + ++static struct clk_pll mmpll0 = { ++ .l_reg = 0x0004, ++ .m_reg = 0x0008, ++ .n_reg = 0x000c, ++ .config_reg = 0x0014, ++ .mode_reg = 0x0000, ++ .status_reg = 0x001c, ++ .status_bit = 17, ++ .clkr.hw.init = &(struct clk_init_data){ ++ .name = "mmpll0", ++ .parent_names = (const char *[]){ "xo" }, ++ .num_parents = 1, ++ .ops = &clk_pll_ops, ++ }, ++}; ++ ++static struct clk_regmap mmpll0_vote = { ++ .enable_reg = 0x0100, ++ .enable_mask = BIT(0), ++ .hw.init = &(struct clk_init_data){ ++ .name = "mmpll0_vote", ++ .parent_names = (const char *[]){ "mmpll0" }, ++ .num_parents = 1, ++ .ops = &clk_pll_vote_ops, ++ }, ++}; ++ ++static struct clk_pll mmpll1 = { ++ .l_reg = 0x0044, ++ .m_reg = 0x0048, ++ .n_reg = 0x004c, ++ .config_reg = 0x0050, ++ .mode_reg = 0x0040, ++ .status_reg = 0x005c, ++ .status_bit = 17, ++ .clkr.hw.init = &(struct clk_init_data){ ++ .name = "mmpll1", ++ .parent_names = (const char *[]){ "xo" }, ++ .num_parents = 1, ++ .ops = &clk_pll_ops, ++ }, ++}; ++ ++static struct clk_regmap mmpll1_vote = { ++ .enable_reg = 0x0100, ++ .enable_mask = BIT(1), ++ .hw.init = &(struct clk_init_data){ ++ .name = "mmpll1_vote", ++ .parent_names = (const char *[]){ "mmpll1" }, ++ .num_parents = 1, ++ .ops = &clk_pll_vote_ops, ++ }, ++}; ++ ++static struct clk_pll mmpll2 = { ++ .l_reg = 0x4104, ++ .m_reg = 0x4108, ++ .n_reg = 0x410c, ++ .config_reg = 0x4110, ++ .mode_reg = 0x4100, ++ .status_reg = 0x411c, ++ .clkr.hw.init = &(struct clk_init_data){ ++ .name = "mmpll2", ++ .parent_names = (const char *[]){ "xo" }, ++ .num_parents = 1, ++ .ops = &clk_pll_ops, ++ }, ++}; ++ ++static struct clk_pll mmpll3 = { ++ .l_reg = 0x0084, ++ .m_reg = 0x0088, ++ .n_reg = 0x008c, ++ .config_reg = 0x0090, ++ .mode_reg = 0x0080, ++ .status_reg = 0x009c, ++ .status_bit = 17, ++ .clkr.hw.init = &(struct clk_init_data){ ++ .name = "mmpll3", ++ .parent_names = (const char *[]){ "xo" }, ++ .num_parents = 1, ++ .ops = &clk_pll_ops, ++ }, ++}; ++ + static const struct parent_map mmcc_xo_mmpll0_mmpll1_gpll0_map[] = { + { P_XO, 0 }, + { P_MMPLL0, 1 }, +@@ -160,91 +245,6 @@ static const char * const mmcc_xo_dsibyte_hdmi_edp_gpll0[] = { + "dsi1pllbyte", + }; + +-static struct clk_pll mmpll0 = { +- .l_reg = 0x0004, +- .m_reg = 0x0008, +- .n_reg = 0x000c, +- .config_reg = 0x0014, +- .mode_reg = 0x0000, +- .status_reg = 0x001c, +- .status_bit = 17, +- .clkr.hw.init = &(struct clk_init_data){ +- .name = "mmpll0", +- .parent_names = (const char *[]){ "xo" }, +- .num_parents = 1, +- .ops = &clk_pll_ops, +- }, +-}; +- +-static struct clk_regmap mmpll0_vote = { +- .enable_reg = 0x0100, +- .enable_mask = BIT(0), +- .hw.init = &(struct clk_init_data){ +- .name = "mmpll0_vote", +- .parent_names = (const char *[]){ "mmpll0" }, +- .num_parents = 1, +- .ops = &clk_pll_vote_ops, +- }, +-}; +- +-static struct clk_pll mmpll1 = { +- .l_reg = 0x0044, +- .m_reg = 0x0048, +- .n_reg = 0x004c, +- .config_reg = 0x0050, +- .mode_reg = 0x0040, +- .status_reg = 0x005c, +- .status_bit = 17, +- .clkr.hw.init = &(struct clk_init_data){ +- .name = "mmpll1", +- .parent_names = (const char *[]){ "xo" }, +- .num_parents = 1, +- .ops = &clk_pll_ops, +- }, +-}; +- +-static struct clk_regmap mmpll1_vote = { +- .enable_reg = 0x0100, +- .enable_mask = BIT(1), +- .hw.init = &(struct clk_init_data){ +- .name = "mmpll1_vote", +- .parent_names = (const char *[]){ "mmpll1" }, +- .num_parents = 1, +- .ops = &clk_pll_vote_ops, +- }, +-}; +- +-static struct clk_pll mmpll2 = { +- .l_reg = 0x4104, +- .m_reg = 0x4108, +- .n_reg = 0x410c, +- .config_reg = 0x4110, +- .mode_reg = 0x4100, +- .status_reg = 0x411c, +- .clkr.hw.init = &(struct clk_init_data){ +- .name = "mmpll2", +- .parent_names = (const char *[]){ "xo" }, +- .num_parents = 1, +- .ops = &clk_pll_ops, +- }, +-}; +- +-static struct clk_pll mmpll3 = { +- .l_reg = 0x0084, +- .m_reg = 0x0088, +- .n_reg = 0x008c, +- .config_reg = 0x0090, +- .mode_reg = 0x0080, +- .status_reg = 0x009c, +- .status_bit = 17, +- .clkr.hw.init = &(struct clk_init_data){ +- .name = "mmpll3", +- .parent_names = (const char *[]){ "xo" }, +- .num_parents = 1, +- .ops = &clk_pll_ops, +- }, +-}; +- + static struct clk_rcg2 mmss_ahb_clk_src = { + .cmd_rcgr = 0x5000, + .hid_width = 5, +-- +2.39.2 + diff --git a/queue-6.1/clk-qcom-mmcc-msm8974-remove-oxili_ocmemgx_clk.patch b/queue-6.1/clk-qcom-mmcc-msm8974-remove-oxili_ocmemgx_clk.patch new file mode 100644 index 00000000000..18d45e190e9 --- /dev/null +++ b/queue-6.1/clk-qcom-mmcc-msm8974-remove-oxili_ocmemgx_clk.patch @@ -0,0 +1,73 @@ +From 50ff6ced61a43846c26ee164d0cca2c1854431d8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 May 2023 18:33:19 +0300 +Subject: clk: qcom: mmcc-msm8974: remove oxili_ocmemgx_clk + +From: Dmitry Baryshkov + +[ Upstream commit 853c064b57491d739bfd0cc35ff75c5ea9c5e8f5 ] + +After the internal discussions, it looks like this clock is managed by +RPM itself. Linux kernel should not touch it on its own, as this causes +disagreement with RPM. Shutting down this clock causes the OCMEM<->GPU +interface to stop working, resulting in GPU hangchecks/timeouts. + +Fixes: d8b212014e69 ("clk: qcom: Add support for MSM8974's multimedia clock controller (MMCC)") +Suggested-by: Konrad Dybcio +Signed-off-by: Dmitry Baryshkov +Tested-by: Luca Weiss +Reviewed-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230508153319.2371645-1-dmitry.baryshkov@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/mmcc-msm8974.c | 19 ------------------- + 1 file changed, 19 deletions(-) + +diff --git a/drivers/clk/qcom/mmcc-msm8974.c b/drivers/clk/qcom/mmcc-msm8974.c +index 4273fce9a4a4c..b90a9f362f5f7 100644 +--- a/drivers/clk/qcom/mmcc-msm8974.c ++++ b/drivers/clk/qcom/mmcc-msm8974.c +@@ -2204,23 +2204,6 @@ static struct clk_branch ocmemcx_ocmemnoc_clk = { + }, + }; + +-static struct clk_branch oxili_ocmemgx_clk = { +- .halt_reg = 0x402c, +- .clkr = { +- .enable_reg = 0x402c, +- .enable_mask = BIT(0), +- .hw.init = &(struct clk_init_data){ +- .name = "oxili_ocmemgx_clk", +- .parent_data = (const struct clk_parent_data[]){ +- { .fw_name = "gfx3d_clk_src", .name = "gfx3d_clk_src" }, +- }, +- .num_parents = 1, +- .flags = CLK_SET_RATE_PARENT, +- .ops = &clk_branch2_ops, +- }, +- }, +-}; +- + static struct clk_branch ocmemnoc_clk = { + .halt_reg = 0x50b4, + .clkr = { +@@ -2512,7 +2495,6 @@ static struct clk_regmap *mmcc_msm8226_clocks[] = { + [MMSS_MMSSNOC_AXI_CLK] = &mmss_mmssnoc_axi_clk.clkr, + [MMSS_S0_AXI_CLK] = &mmss_s0_axi_clk.clkr, + [OCMEMCX_AHB_CLK] = &ocmemcx_ahb_clk.clkr, +- [OXILI_OCMEMGX_CLK] = &oxili_ocmemgx_clk.clkr, + [OXILI_GFX3D_CLK] = &oxili_gfx3d_clk.clkr, + [OXILICX_AHB_CLK] = &oxilicx_ahb_clk.clkr, + [OXILICX_AXI_CLK] = &oxilicx_axi_clk.clkr, +@@ -2670,7 +2652,6 @@ static struct clk_regmap *mmcc_msm8974_clocks[] = { + [MMSS_S0_AXI_CLK] = &mmss_s0_axi_clk.clkr, + [OCMEMCX_AHB_CLK] = &ocmemcx_ahb_clk.clkr, + [OCMEMCX_OCMEMNOC_CLK] = &ocmemcx_ocmemnoc_clk.clkr, +- [OXILI_OCMEMGX_CLK] = &oxili_ocmemgx_clk.clkr, + [OCMEMNOC_CLK] = &ocmemnoc_clk.clkr, + [OXILI_GFX3D_CLK] = &oxili_gfx3d_clk.clkr, + [OXILICX_AHB_CLK] = &oxilicx_ahb_clk.clkr, +-- +2.39.2 + diff --git a/queue-6.1/clk-qcom-mmcc-msm8974-use-array_size-instead-of-spec.patch b/queue-6.1/clk-qcom-mmcc-msm8974-use-array_size-instead-of-spec.patch new file mode 100644 index 00000000000..521d3dedb97 --- /dev/null +++ b/queue-6.1/clk-qcom-mmcc-msm8974-use-array_size-instead-of-spec.patch @@ -0,0 +1,364 @@ +From 5c16010e3212a0536cae7c625df9e7dd51b959ab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 4 Dec 2022 14:45:03 +0200 +Subject: clk: qcom: mmcc-msm8974: use ARRAY_SIZE instead of specifying + num_parents + +From: Dmitry Baryshkov + +[ Upstream commit 4e74e921ea0c576682ffd7981af1d4a73ceaca11 ] + +Use ARRAY_SIZE() instead of manually specifying num_parents. This makes +adding/removing entries to/from parent_data easy and errorproof. + +Reviewed-by: Neil Armstrong +Reviewed-by: Konrad Dybcio +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20221204124508.1415713-7-dmitry.baryshkov@linaro.org +Stable-dep-of: 853c064b5749 ("clk: qcom: mmcc-msm8974: remove oxili_ocmemgx_clk") +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/mmcc-msm8974.c | 74 ++++++++++++++++----------------- + 1 file changed, 37 insertions(+), 37 deletions(-) + +diff --git a/drivers/clk/qcom/mmcc-msm8974.c b/drivers/clk/qcom/mmcc-msm8974.c +index f74662925a582..9008df2305df5 100644 +--- a/drivers/clk/qcom/mmcc-msm8974.c ++++ b/drivers/clk/qcom/mmcc-msm8974.c +@@ -252,7 +252,7 @@ static struct clk_rcg2 mmss_ahb_clk_src = { + .clkr.hw.init = &(struct clk_init_data){ + .name = "mmss_ahb_clk_src", + .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0, +- .num_parents = 4, ++ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0), + .ops = &clk_rcg2_ops, + }, + }; +@@ -289,7 +289,7 @@ static struct clk_rcg2 mmss_axi_clk_src = { + .clkr.hw.init = &(struct clk_init_data){ + .name = "mmss_axi_clk_src", + .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0, +- .num_parents = 4, ++ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0), + .ops = &clk_rcg2_ops, + }, + }; +@@ -313,7 +313,7 @@ static struct clk_rcg2 ocmemnoc_clk_src = { + .clkr.hw.init = &(struct clk_init_data){ + .name = "ocmemnoc_clk_src", + .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0, +- .num_parents = 4, ++ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0), + .ops = &clk_rcg2_ops, + }, + }; +@@ -332,7 +332,7 @@ static struct clk_rcg2 csi0_clk_src = { + .clkr.hw.init = &(struct clk_init_data){ + .name = "csi0_clk_src", + .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0, +- .num_parents = 4, ++ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0), + .ops = &clk_rcg2_ops, + }, + }; +@@ -345,7 +345,7 @@ static struct clk_rcg2 csi1_clk_src = { + .clkr.hw.init = &(struct clk_init_data){ + .name = "csi1_clk_src", + .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0, +- .num_parents = 4, ++ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0), + .ops = &clk_rcg2_ops, + }, + }; +@@ -358,7 +358,7 @@ static struct clk_rcg2 csi2_clk_src = { + .clkr.hw.init = &(struct clk_init_data){ + .name = "csi2_clk_src", + .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0, +- .num_parents = 4, ++ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0), + .ops = &clk_rcg2_ops, + }, + }; +@@ -371,7 +371,7 @@ static struct clk_rcg2 csi3_clk_src = { + .clkr.hw.init = &(struct clk_init_data){ + .name = "csi3_clk_src", + .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0, +- .num_parents = 4, ++ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0), + .ops = &clk_rcg2_ops, + }, + }; +@@ -418,7 +418,7 @@ static struct clk_rcg2 vfe0_clk_src = { + .clkr.hw.init = &(struct clk_init_data){ + .name = "vfe0_clk_src", + .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0, +- .num_parents = 4, ++ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0), + .ops = &clk_rcg2_ops, + }, + }; +@@ -431,7 +431,7 @@ static struct clk_rcg2 vfe1_clk_src = { + .clkr.hw.init = &(struct clk_init_data){ + .name = "vfe1_clk_src", + .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0, +- .num_parents = 4, ++ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0), + .ops = &clk_rcg2_ops, + }, + }; +@@ -472,7 +472,7 @@ static struct clk_rcg2 mdp_clk_src = { + .clkr.hw.init = &(struct clk_init_data){ + .name = "mdp_clk_src", + .parent_names = mmcc_xo_mmpll0_dsi_hdmi_gpll0, +- .num_parents = 6, ++ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_dsi_hdmi_gpll0), + .ops = &clk_rcg2_ops, + }, + }; +@@ -495,7 +495,7 @@ static struct clk_rcg2 jpeg0_clk_src = { + .clkr.hw.init = &(struct clk_init_data){ + .name = "jpeg0_clk_src", + .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0, +- .num_parents = 4, ++ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0), + .ops = &clk_rcg2_ops, + }, + }; +@@ -508,7 +508,7 @@ static struct clk_rcg2 jpeg1_clk_src = { + .clkr.hw.init = &(struct clk_init_data){ + .name = "jpeg1_clk_src", + .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0, +- .num_parents = 4, ++ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0), + .ops = &clk_rcg2_ops, + }, + }; +@@ -521,7 +521,7 @@ static struct clk_rcg2 jpeg2_clk_src = { + .clkr.hw.init = &(struct clk_init_data){ + .name = "jpeg2_clk_src", + .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0, +- .num_parents = 4, ++ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0), + .ops = &clk_rcg2_ops, + }, + }; +@@ -534,7 +534,7 @@ static struct clk_rcg2 pclk0_clk_src = { + .clkr.hw.init = &(struct clk_init_data){ + .name = "pclk0_clk_src", + .parent_names = mmcc_xo_dsi_hdmi_edp_gpll0, +- .num_parents = 6, ++ .num_parents = ARRAY_SIZE(mmcc_xo_dsi_hdmi_edp_gpll0), + .ops = &clk_pixel_ops, + .flags = CLK_SET_RATE_PARENT, + }, +@@ -548,7 +548,7 @@ static struct clk_rcg2 pclk1_clk_src = { + .clkr.hw.init = &(struct clk_init_data){ + .name = "pclk1_clk_src", + .parent_names = mmcc_xo_dsi_hdmi_edp_gpll0, +- .num_parents = 6, ++ .num_parents = ARRAY_SIZE(mmcc_xo_dsi_hdmi_edp_gpll0), + .ops = &clk_pixel_ops, + .flags = CLK_SET_RATE_PARENT, + }, +@@ -581,7 +581,7 @@ static struct clk_rcg2 vcodec0_clk_src = { + .clkr.hw.init = &(struct clk_init_data){ + .name = "vcodec0_clk_src", + .parent_names = mmcc_xo_mmpll0_1_3_gpll0, +- .num_parents = 5, ++ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_1_3_gpll0), + .ops = &clk_rcg2_ops, + }, + }; +@@ -599,7 +599,7 @@ static struct clk_rcg2 cci_clk_src = { + .clkr.hw.init = &(struct clk_init_data){ + .name = "cci_clk_src", + .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0, +- .num_parents = 4, ++ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0), + .ops = &clk_rcg2_ops, + }, + }; +@@ -623,7 +623,7 @@ static struct clk_rcg2 camss_gp0_clk_src = { + .clkr.hw.init = &(struct clk_init_data){ + .name = "camss_gp0_clk_src", + .parent_names = mmcc_xo_mmpll0_1_gpll1_0, +- .num_parents = 5, ++ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_1_gpll1_0), + .ops = &clk_rcg2_ops, + }, + }; +@@ -637,7 +637,7 @@ static struct clk_rcg2 camss_gp1_clk_src = { + .clkr.hw.init = &(struct clk_init_data){ + .name = "camss_gp1_clk_src", + .parent_names = mmcc_xo_mmpll0_1_gpll1_0, +- .num_parents = 5, ++ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_1_gpll1_0), + .ops = &clk_rcg2_ops, + }, + }; +@@ -672,7 +672,7 @@ static struct clk_rcg2 mclk0_clk_src = { + .clkr.hw.init = &(struct clk_init_data){ + .name = "mclk0_clk_src", + .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0, +- .num_parents = 4, ++ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0), + .ops = &clk_rcg2_ops, + }, + }; +@@ -685,7 +685,7 @@ static struct clk_rcg2 mclk1_clk_src = { + .clkr.hw.init = &(struct clk_init_data){ + .name = "mclk1_clk_src", + .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0, +- .num_parents = 4, ++ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0), + .ops = &clk_rcg2_ops, + }, + }; +@@ -698,7 +698,7 @@ static struct clk_rcg2 mclk2_clk_src = { + .clkr.hw.init = &(struct clk_init_data){ + .name = "mclk2_clk_src", + .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0, +- .num_parents = 4, ++ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0), + .ops = &clk_rcg2_ops, + }, + }; +@@ -711,7 +711,7 @@ static struct clk_rcg2 mclk3_clk_src = { + .clkr.hw.init = &(struct clk_init_data){ + .name = "mclk3_clk_src", + .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0, +- .num_parents = 4, ++ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0), + .ops = &clk_rcg2_ops, + }, + }; +@@ -730,7 +730,7 @@ static struct clk_rcg2 csi0phytimer_clk_src = { + .clkr.hw.init = &(struct clk_init_data){ + .name = "csi0phytimer_clk_src", + .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0, +- .num_parents = 4, ++ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0), + .ops = &clk_rcg2_ops, + }, + }; +@@ -743,7 +743,7 @@ static struct clk_rcg2 csi1phytimer_clk_src = { + .clkr.hw.init = &(struct clk_init_data){ + .name = "csi1phytimer_clk_src", + .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0, +- .num_parents = 4, ++ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0), + .ops = &clk_rcg2_ops, + }, + }; +@@ -756,7 +756,7 @@ static struct clk_rcg2 csi2phytimer_clk_src = { + .clkr.hw.init = &(struct clk_init_data){ + .name = "csi2phytimer_clk_src", + .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0, +- .num_parents = 4, ++ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0), + .ops = &clk_rcg2_ops, + }, + }; +@@ -787,7 +787,7 @@ static struct clk_rcg2 cpp_clk_src = { + .clkr.hw.init = &(struct clk_init_data){ + .name = "cpp_clk_src", + .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0, +- .num_parents = 4, ++ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0), + .ops = &clk_rcg2_ops, + }, + }; +@@ -805,7 +805,7 @@ static struct clk_rcg2 byte0_clk_src = { + .clkr.hw.init = &(struct clk_init_data){ + .name = "byte0_clk_src", + .parent_names = mmcc_xo_dsibyte_hdmi_edp_gpll0, +- .num_parents = 6, ++ .num_parents = ARRAY_SIZE(mmcc_xo_dsibyte_hdmi_edp_gpll0), + .ops = &clk_byte2_ops, + .flags = CLK_SET_RATE_PARENT, + }, +@@ -819,7 +819,7 @@ static struct clk_rcg2 byte1_clk_src = { + .clkr.hw.init = &(struct clk_init_data){ + .name = "byte1_clk_src", + .parent_names = mmcc_xo_dsibyte_hdmi_edp_gpll0, +- .num_parents = 6, ++ .num_parents = ARRAY_SIZE(mmcc_xo_dsibyte_hdmi_edp_gpll0), + .ops = &clk_byte2_ops, + .flags = CLK_SET_RATE_PARENT, + }, +@@ -838,7 +838,7 @@ static struct clk_rcg2 edpaux_clk_src = { + .clkr.hw.init = &(struct clk_init_data){ + .name = "edpaux_clk_src", + .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0, +- .num_parents = 4, ++ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0), + .ops = &clk_rcg2_ops, + }, + }; +@@ -857,7 +857,7 @@ static struct clk_rcg2 edplink_clk_src = { + .clkr.hw.init = &(struct clk_init_data){ + .name = "edplink_clk_src", + .parent_names = mmcc_xo_dsi_hdmi_edp_gpll0, +- .num_parents = 6, ++ .num_parents = ARRAY_SIZE(mmcc_xo_dsi_hdmi_edp_gpll0), + .ops = &clk_rcg2_ops, + .flags = CLK_SET_RATE_PARENT, + }, +@@ -877,7 +877,7 @@ static struct clk_rcg2 edppixel_clk_src = { + .clkr.hw.init = &(struct clk_init_data){ + .name = "edppixel_clk_src", + .parent_names = mmcc_xo_dsi_hdmi_edp, +- .num_parents = 6, ++ .num_parents = ARRAY_SIZE(mmcc_xo_dsi_hdmi_edp), + .ops = &clk_edp_pixel_ops, + }, + }; +@@ -895,7 +895,7 @@ static struct clk_rcg2 esc0_clk_src = { + .clkr.hw.init = &(struct clk_init_data){ + .name = "esc0_clk_src", + .parent_names = mmcc_xo_dsibyte_hdmi_edp_gpll0, +- .num_parents = 6, ++ .num_parents = ARRAY_SIZE(mmcc_xo_dsibyte_hdmi_edp_gpll0), + .ops = &clk_rcg2_ops, + }, + }; +@@ -908,7 +908,7 @@ static struct clk_rcg2 esc1_clk_src = { + .clkr.hw.init = &(struct clk_init_data){ + .name = "esc1_clk_src", + .parent_names = mmcc_xo_dsibyte_hdmi_edp_gpll0, +- .num_parents = 6, ++ .num_parents = ARRAY_SIZE(mmcc_xo_dsibyte_hdmi_edp_gpll0), + .ops = &clk_rcg2_ops, + }, + }; +@@ -926,7 +926,7 @@ static struct clk_rcg2 extpclk_clk_src = { + .clkr.hw.init = &(struct clk_init_data){ + .name = "extpclk_clk_src", + .parent_names = mmcc_xo_dsi_hdmi_edp_gpll0, +- .num_parents = 6, ++ .num_parents = ARRAY_SIZE(mmcc_xo_dsi_hdmi_edp_gpll0), + .ops = &clk_byte_ops, + .flags = CLK_SET_RATE_PARENT, + }, +@@ -945,7 +945,7 @@ static struct clk_rcg2 hdmi_clk_src = { + .clkr.hw.init = &(struct clk_init_data){ + .name = "hdmi_clk_src", + .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0, +- .num_parents = 4, ++ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0), + .ops = &clk_rcg2_ops, + }, + }; +@@ -963,7 +963,7 @@ static struct clk_rcg2 vsync_clk_src = { + .clkr.hw.init = &(struct clk_init_data){ + .name = "vsync_clk_src", + .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0, +- .num_parents = 4, ++ .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0), + .ops = &clk_rcg2_ops, + }, + }; +-- +2.39.2 + diff --git a/queue-6.1/clk-qcom-mmcc-msm8974-use-clk_rcg2_shared_ops-for-md.patch b/queue-6.1/clk-qcom-mmcc-msm8974-use-clk_rcg2_shared_ops-for-md.patch new file mode 100644 index 00000000000..f9804a88f43 --- /dev/null +++ b/queue-6.1/clk-qcom-mmcc-msm8974-use-clk_rcg2_shared_ops-for-md.patch @@ -0,0 +1,41 @@ +From 7823e3c9258a23e9e6129d4f5b0689aee6e96ae0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 7 May 2023 20:53:34 +0300 +Subject: clk: qcom: mmcc-msm8974: use clk_rcg2_shared_ops for mdp_clk_src + clock + +From: Dmitry Baryshkov + +[ Upstream commit 8fd492e77ff71f68f7311c22f7bc960182465cd7 ] + +The mdp_clk_src clock should not be turned off. Instead it should be +'parked' to the XO, as most of other mdp_clk_src clocks. Fix that by +using the clk_rcg2_shared_ops. + +Fixes: d8b212014e69 ("clk: qcom: Add support for MSM8974's multimedia clock controller (MMCC)") +Signed-off-by: Dmitry Baryshkov +Tested-by: Luca Weiss +Acked-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230507175335.2321503-1-dmitry.baryshkov@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/mmcc-msm8974.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/qcom/mmcc-msm8974.c b/drivers/clk/qcom/mmcc-msm8974.c +index b90a9f362f5f7..d2fec5d5b22e2 100644 +--- a/drivers/clk/qcom/mmcc-msm8974.c ++++ b/drivers/clk/qcom/mmcc-msm8974.c +@@ -485,7 +485,7 @@ static struct clk_rcg2 mdp_clk_src = { + .name = "mdp_clk_src", + .parent_data = mmcc_xo_mmpll0_dsi_hdmi_gpll0, + .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_dsi_hdmi_gpll0), +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +-- +2.39.2 + diff --git a/queue-6.1/clk-qcom-mmcc-msm8974-use-parent_hws-_data-instead-o.patch b/queue-6.1/clk-qcom-mmcc-msm8974-use-parent_hws-_data-instead-o.patch new file mode 100644 index 00000000000..0d1ce66ec0e --- /dev/null +++ b/queue-6.1/clk-qcom-mmcc-msm8974-use-parent_hws-_data-instead-o.patch @@ -0,0 +1,1476 @@ +From b406fa7418a18c782f5d928908d8dd593cd191be Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 4 Dec 2022 14:45:05 +0200 +Subject: clk: qcom: mmcc-msm8974: use parent_hws/_data instead of parent_names + +From: Dmitry Baryshkov + +[ Upstream commit a174d29a59ec9462d3e72fd00a9fd05054c4ab20 ] + +Convert the clock driver to specify parent data rather than parent +names, to actually bind using 'clock-names' specified in the DTS rather +than global clock names. Use parent_hws where possible to refer parent +clocks directly, skipping the lookup. + +Note, the system names for xo clocks were changed from "xo" to +"xo_board" to follow the example of other platforms. This switches the +clocks to use DT-provided "xo_board" clock instead of manually +registered "xo" clock and allows us to drop qcom_cc_register_board_clk() +call from the driver at some point. + +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20221204124508.1415713-9-dmitry.baryshkov@linaro.org +Stable-dep-of: 853c064b5749 ("clk: qcom: mmcc-msm8974: remove oxili_ocmemgx_clk") +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/mmcc-msm8974.c | 516 ++++++++++++++++---------------- + 1 file changed, 264 insertions(+), 252 deletions(-) + +diff --git a/drivers/clk/qcom/mmcc-msm8974.c b/drivers/clk/qcom/mmcc-msm8974.c +index 57f1a351c8f67..4273fce9a4a4c 100644 +--- a/drivers/clk/qcom/mmcc-msm8974.c ++++ b/drivers/clk/qcom/mmcc-msm8974.c +@@ -52,7 +52,9 @@ static struct clk_pll mmpll0 = { + .status_bit = 17, + .clkr.hw.init = &(struct clk_init_data){ + .name = "mmpll0", +- .parent_names = (const char *[]){ "xo" }, ++ .parent_data = (const struct clk_parent_data[]){ ++ { .fw_name = "xo", .name = "xo_board" }, ++ }, + .num_parents = 1, + .ops = &clk_pll_ops, + }, +@@ -63,7 +65,9 @@ static struct clk_regmap mmpll0_vote = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "mmpll0_vote", +- .parent_names = (const char *[]){ "mmpll0" }, ++ .parent_hws = (const struct clk_hw*[]){ ++ &mmpll0.clkr.hw ++ }, + .num_parents = 1, + .ops = &clk_pll_vote_ops, + }, +@@ -79,7 +83,9 @@ static struct clk_pll mmpll1 = { + .status_bit = 17, + .clkr.hw.init = &(struct clk_init_data){ + .name = "mmpll1", +- .parent_names = (const char *[]){ "xo" }, ++ .parent_data = (const struct clk_parent_data[]){ ++ { .fw_name = "xo", .name = "xo_board" }, ++ }, + .num_parents = 1, + .ops = &clk_pll_ops, + }, +@@ -90,7 +96,9 @@ static struct clk_regmap mmpll1_vote = { + .enable_mask = BIT(1), + .hw.init = &(struct clk_init_data){ + .name = "mmpll1_vote", +- .parent_names = (const char *[]){ "mmpll1" }, ++ .parent_hws = (const struct clk_hw*[]){ ++ &mmpll1.clkr.hw ++ }, + .num_parents = 1, + .ops = &clk_pll_vote_ops, + }, +@@ -105,7 +113,9 @@ static struct clk_pll mmpll2 = { + .status_reg = 0x411c, + .clkr.hw.init = &(struct clk_init_data){ + .name = "mmpll2", +- .parent_names = (const char *[]){ "xo" }, ++ .parent_data = (const struct clk_parent_data[]){ ++ { .fw_name = "xo", .name = "xo_board" }, ++ }, + .num_parents = 1, + .ops = &clk_pll_ops, + }, +@@ -121,7 +131,9 @@ static struct clk_pll mmpll3 = { + .status_bit = 17, + .clkr.hw.init = &(struct clk_init_data){ + .name = "mmpll3", +- .parent_names = (const char *[]){ "xo" }, ++ .parent_data = (const struct clk_parent_data[]){ ++ { .fw_name = "xo", .name = "xo_board" }, ++ }, + .num_parents = 1, + .ops = &clk_pll_ops, + }, +@@ -134,11 +146,11 @@ static const struct parent_map mmcc_xo_mmpll0_mmpll1_gpll0_map[] = { + { P_GPLL0, 5 } + }; + +-static const char * const mmcc_xo_mmpll0_mmpll1_gpll0[] = { +- "xo", +- "mmpll0_vote", +- "mmpll1_vote", +- "mmss_gpll0_vote", ++static const struct clk_parent_data mmcc_xo_mmpll0_mmpll1_gpll0[] = { ++ { .fw_name = "xo", .name = "xo_board" }, ++ { .hw = &mmpll0_vote.hw }, ++ { .hw = &mmpll1_vote.hw }, ++ { .fw_name = "mmss_gpll0_vote", .name = "mmss_gpll0_vote" }, + }; + + static const struct parent_map mmcc_xo_mmpll0_dsi_hdmi_gpll0_map[] = { +@@ -150,13 +162,13 @@ static const struct parent_map mmcc_xo_mmpll0_dsi_hdmi_gpll0_map[] = { + { P_DSI1PLL, 3 } + }; + +-static const char * const mmcc_xo_mmpll0_dsi_hdmi_gpll0[] = { +- "xo", +- "mmpll0_vote", +- "hdmipll", +- "mmss_gpll0_vote", +- "dsi0pll", +- "dsi1pll", ++static const struct clk_parent_data mmcc_xo_mmpll0_dsi_hdmi_gpll0[] = { ++ { .fw_name = "xo", .name = "xo_board" }, ++ { .hw = &mmpll0_vote.hw }, ++ { .fw_name = "hdmipll", .name = "hdmipll" }, ++ { .fw_name = "mmss_gpll0_vote", .name = "mmss_gpll0_vote" }, ++ { .fw_name = "dsi0pll", .name = "dsi0pll" }, ++ { .fw_name = "dsi1pll", .name = "dsi1pll" }, + }; + + static const struct parent_map mmcc_xo_mmpll0_1_3_gpll0_map[] = { +@@ -167,12 +179,12 @@ static const struct parent_map mmcc_xo_mmpll0_1_3_gpll0_map[] = { + { P_MMPLL3, 3 } + }; + +-static const char * const mmcc_xo_mmpll0_1_3_gpll0[] = { +- "xo", +- "mmpll0_vote", +- "mmpll1_vote", +- "mmss_gpll0_vote", +- "mmpll3", ++static const struct clk_parent_data mmcc_xo_mmpll0_1_3_gpll0[] = { ++ { .fw_name = "xo", .name = "xo_board" }, ++ { .hw = &mmpll0_vote.hw }, ++ { .hw = &mmpll1_vote.hw }, ++ { .fw_name = "mmss_gpll0_vote", .name = "mmss_gpll0_vote" }, ++ { .hw = &mmpll3.clkr.hw }, + }; + + static const struct parent_map mmcc_xo_mmpll0_1_gpll1_0_map[] = { +@@ -183,12 +195,12 @@ static const struct parent_map mmcc_xo_mmpll0_1_gpll1_0_map[] = { + { P_GPLL1, 4 } + }; + +-static const char * const mmcc_xo_mmpll0_1_gpll1_0[] = { +- "xo", +- "mmpll0_vote", +- "mmpll1_vote", +- "mmss_gpll0_vote", +- "gpll1_vote", ++static const struct clk_parent_data mmcc_xo_mmpll0_1_gpll1_0[] = { ++ { .fw_name = "xo", .name = "xo_board" }, ++ { .hw = &mmpll0_vote.hw }, ++ { .hw = &mmpll1_vote.hw }, ++ { .fw_name = "mmss_gpll0_vote", .name = "mmss_gpll0_vote" }, ++ { .fw_name = "gpll1_vote", .name = "gpll1_vote" }, + }; + + static const struct parent_map mmcc_xo_dsi_hdmi_edp_map[] = { +@@ -200,13 +212,13 @@ static const struct parent_map mmcc_xo_dsi_hdmi_edp_map[] = { + { P_DSI1PLL, 2 } + }; + +-static const char * const mmcc_xo_dsi_hdmi_edp[] = { +- "xo", +- "edp_link_clk", +- "hdmipll", +- "edp_vco_div", +- "dsi0pll", +- "dsi1pll", ++static const struct clk_parent_data mmcc_xo_dsi_hdmi_edp[] = { ++ { .fw_name = "xo", .name = "xo_board" }, ++ { .fw_name = "edp_link_clk", .name = "edp_link_clk" }, ++ { .fw_name = "hdmipll", .name = "hdmipll" }, ++ { .fw_name = "edp_vco_div", .name = "edp_vco_div" }, ++ { .fw_name = "dsi0pll", .name = "dsi0pll" }, ++ { .fw_name = "dsi1pll", .name = "dsi1pll" }, + }; + + static const struct parent_map mmcc_xo_dsi_hdmi_edp_gpll0_map[] = { +@@ -218,13 +230,13 @@ static const struct parent_map mmcc_xo_dsi_hdmi_edp_gpll0_map[] = { + { P_DSI1PLL, 2 } + }; + +-static const char * const mmcc_xo_dsi_hdmi_edp_gpll0[] = { +- "xo", +- "edp_link_clk", +- "hdmipll", +- "gpll0_vote", +- "dsi0pll", +- "dsi1pll", ++static const struct clk_parent_data mmcc_xo_dsi_hdmi_edp_gpll0[] = { ++ { .fw_name = "xo", .name = "xo_board" }, ++ { .fw_name = "edp_link_clk", .name = "edp_link_clk" }, ++ { .fw_name = "hdmipll", .name = "hdmipll" }, ++ { .fw_name = "gpll0_vote", .name = "gpll0_vote" }, ++ { .fw_name = "dsi0pll", .name = "dsi0pll" }, ++ { .fw_name = "dsi1pll", .name = "dsi1pll" }, + }; + + static const struct parent_map mmcc_xo_dsibyte_hdmi_edp_gpll0_map[] = { +@@ -236,13 +248,13 @@ static const struct parent_map mmcc_xo_dsibyte_hdmi_edp_gpll0_map[] = { + { P_DSI1PLL_BYTE, 2 } + }; + +-static const char * const mmcc_xo_dsibyte_hdmi_edp_gpll0[] = { +- "xo", +- "edp_link_clk", +- "hdmipll", +- "gpll0_vote", +- "dsi0pllbyte", +- "dsi1pllbyte", ++static const struct clk_parent_data mmcc_xo_dsibyte_hdmi_edp_gpll0[] = { ++ { .fw_name = "xo", .name = "xo_board" }, ++ { .fw_name = "edp_link_clk", .name = "edp_link_clk" }, ++ { .fw_name = "hdmipll", .name = "hdmipll" }, ++ { .fw_name = "gpll0_vote", .name = "gpll0_vote" }, ++ { .fw_name = "dsi0pllbyte", .name = "dsi0pllbyte" }, ++ { .fw_name = "dsi1pllbyte", .name = "dsi1pllbyte" }, + }; + + static struct clk_rcg2 mmss_ahb_clk_src = { +@@ -251,7 +263,7 @@ static struct clk_rcg2 mmss_ahb_clk_src = { + .parent_map = mmcc_xo_mmpll0_mmpll1_gpll0_map, + .clkr.hw.init = &(struct clk_init_data){ + .name = "mmss_ahb_clk_src", +- .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0, ++ .parent_data = mmcc_xo_mmpll0_mmpll1_gpll0, + .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0), + .ops = &clk_rcg2_ops, + }, +@@ -288,7 +300,7 @@ static struct clk_rcg2 mmss_axi_clk_src = { + .freq_tbl = ftbl_mmss_axi_clk, + .clkr.hw.init = &(struct clk_init_data){ + .name = "mmss_axi_clk_src", +- .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0, ++ .parent_data = mmcc_xo_mmpll0_mmpll1_gpll0, + .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0), + .ops = &clk_rcg2_ops, + }, +@@ -312,7 +324,7 @@ static struct clk_rcg2 ocmemnoc_clk_src = { + .freq_tbl = ftbl_ocmemnoc_clk, + .clkr.hw.init = &(struct clk_init_data){ + .name = "ocmemnoc_clk_src", +- .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0, ++ .parent_data = mmcc_xo_mmpll0_mmpll1_gpll0, + .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0), + .ops = &clk_rcg2_ops, + }, +@@ -331,7 +343,7 @@ static struct clk_rcg2 csi0_clk_src = { + .freq_tbl = ftbl_camss_csi0_3_clk, + .clkr.hw.init = &(struct clk_init_data){ + .name = "csi0_clk_src", +- .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0, ++ .parent_data = mmcc_xo_mmpll0_mmpll1_gpll0, + .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0), + .ops = &clk_rcg2_ops, + }, +@@ -344,7 +356,7 @@ static struct clk_rcg2 csi1_clk_src = { + .freq_tbl = ftbl_camss_csi0_3_clk, + .clkr.hw.init = &(struct clk_init_data){ + .name = "csi1_clk_src", +- .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0, ++ .parent_data = mmcc_xo_mmpll0_mmpll1_gpll0, + .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0), + .ops = &clk_rcg2_ops, + }, +@@ -357,7 +369,7 @@ static struct clk_rcg2 csi2_clk_src = { + .freq_tbl = ftbl_camss_csi0_3_clk, + .clkr.hw.init = &(struct clk_init_data){ + .name = "csi2_clk_src", +- .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0, ++ .parent_data = mmcc_xo_mmpll0_mmpll1_gpll0, + .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0), + .ops = &clk_rcg2_ops, + }, +@@ -370,7 +382,7 @@ static struct clk_rcg2 csi3_clk_src = { + .freq_tbl = ftbl_camss_csi0_3_clk, + .clkr.hw.init = &(struct clk_init_data){ + .name = "csi3_clk_src", +- .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0, ++ .parent_data = mmcc_xo_mmpll0_mmpll1_gpll0, + .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0), + .ops = &clk_rcg2_ops, + }, +@@ -417,7 +429,7 @@ static struct clk_rcg2 vfe0_clk_src = { + .freq_tbl = ftbl_camss_vfe_vfe0_1_clk, + .clkr.hw.init = &(struct clk_init_data){ + .name = "vfe0_clk_src", +- .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0, ++ .parent_data = mmcc_xo_mmpll0_mmpll1_gpll0, + .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0), + .ops = &clk_rcg2_ops, + }, +@@ -430,7 +442,7 @@ static struct clk_rcg2 vfe1_clk_src = { + .freq_tbl = ftbl_camss_vfe_vfe0_1_clk, + .clkr.hw.init = &(struct clk_init_data){ + .name = "vfe1_clk_src", +- .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0, ++ .parent_data = mmcc_xo_mmpll0_mmpll1_gpll0, + .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0), + .ops = &clk_rcg2_ops, + }, +@@ -471,7 +483,7 @@ static struct clk_rcg2 mdp_clk_src = { + .freq_tbl = ftbl_mdss_mdp_clk, + .clkr.hw.init = &(struct clk_init_data){ + .name = "mdp_clk_src", +- .parent_names = mmcc_xo_mmpll0_dsi_hdmi_gpll0, ++ .parent_data = mmcc_xo_mmpll0_dsi_hdmi_gpll0, + .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_dsi_hdmi_gpll0), + .ops = &clk_rcg2_ops, + }, +@@ -494,7 +506,7 @@ static struct clk_rcg2 jpeg0_clk_src = { + .freq_tbl = ftbl_camss_jpeg_jpeg0_2_clk, + .clkr.hw.init = &(struct clk_init_data){ + .name = "jpeg0_clk_src", +- .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0, ++ .parent_data = mmcc_xo_mmpll0_mmpll1_gpll0, + .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0), + .ops = &clk_rcg2_ops, + }, +@@ -507,7 +519,7 @@ static struct clk_rcg2 jpeg1_clk_src = { + .freq_tbl = ftbl_camss_jpeg_jpeg0_2_clk, + .clkr.hw.init = &(struct clk_init_data){ + .name = "jpeg1_clk_src", +- .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0, ++ .parent_data = mmcc_xo_mmpll0_mmpll1_gpll0, + .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0), + .ops = &clk_rcg2_ops, + }, +@@ -520,7 +532,7 @@ static struct clk_rcg2 jpeg2_clk_src = { + .freq_tbl = ftbl_camss_jpeg_jpeg0_2_clk, + .clkr.hw.init = &(struct clk_init_data){ + .name = "jpeg2_clk_src", +- .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0, ++ .parent_data = mmcc_xo_mmpll0_mmpll1_gpll0, + .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0), + .ops = &clk_rcg2_ops, + }, +@@ -533,7 +545,7 @@ static struct clk_rcg2 pclk0_clk_src = { + .parent_map = mmcc_xo_dsi_hdmi_edp_gpll0_map, + .clkr.hw.init = &(struct clk_init_data){ + .name = "pclk0_clk_src", +- .parent_names = mmcc_xo_dsi_hdmi_edp_gpll0, ++ .parent_data = mmcc_xo_dsi_hdmi_edp_gpll0, + .num_parents = ARRAY_SIZE(mmcc_xo_dsi_hdmi_edp_gpll0), + .ops = &clk_pixel_ops, + .flags = CLK_SET_RATE_PARENT, +@@ -547,7 +559,7 @@ static struct clk_rcg2 pclk1_clk_src = { + .parent_map = mmcc_xo_dsi_hdmi_edp_gpll0_map, + .clkr.hw.init = &(struct clk_init_data){ + .name = "pclk1_clk_src", +- .parent_names = mmcc_xo_dsi_hdmi_edp_gpll0, ++ .parent_data = mmcc_xo_dsi_hdmi_edp_gpll0, + .num_parents = ARRAY_SIZE(mmcc_xo_dsi_hdmi_edp_gpll0), + .ops = &clk_pixel_ops, + .flags = CLK_SET_RATE_PARENT, +@@ -580,7 +592,7 @@ static struct clk_rcg2 vcodec0_clk_src = { + .freq_tbl = ftbl_venus0_vcodec0_clk, + .clkr.hw.init = &(struct clk_init_data){ + .name = "vcodec0_clk_src", +- .parent_names = mmcc_xo_mmpll0_1_3_gpll0, ++ .parent_data = mmcc_xo_mmpll0_1_3_gpll0, + .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_1_3_gpll0), + .ops = &clk_rcg2_ops, + }, +@@ -598,7 +610,7 @@ static struct clk_rcg2 cci_clk_src = { + .freq_tbl = ftbl_camss_cci_cci_clk, + .clkr.hw.init = &(struct clk_init_data){ + .name = "cci_clk_src", +- .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0, ++ .parent_data = mmcc_xo_mmpll0_mmpll1_gpll0, + .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0), + .ops = &clk_rcg2_ops, + }, +@@ -622,7 +634,7 @@ static struct clk_rcg2 camss_gp0_clk_src = { + .freq_tbl = ftbl_camss_gp0_1_clk, + .clkr.hw.init = &(struct clk_init_data){ + .name = "camss_gp0_clk_src", +- .parent_names = mmcc_xo_mmpll0_1_gpll1_0, ++ .parent_data = mmcc_xo_mmpll0_1_gpll1_0, + .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_1_gpll1_0), + .ops = &clk_rcg2_ops, + }, +@@ -636,7 +648,7 @@ static struct clk_rcg2 camss_gp1_clk_src = { + .freq_tbl = ftbl_camss_gp0_1_clk, + .clkr.hw.init = &(struct clk_init_data){ + .name = "camss_gp1_clk_src", +- .parent_names = mmcc_xo_mmpll0_1_gpll1_0, ++ .parent_data = mmcc_xo_mmpll0_1_gpll1_0, + .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_1_gpll1_0), + .ops = &clk_rcg2_ops, + }, +@@ -671,7 +683,7 @@ static struct clk_rcg2 mclk0_clk_src = { + .freq_tbl = ftbl_camss_mclk0_3_clk, + .clkr.hw.init = &(struct clk_init_data){ + .name = "mclk0_clk_src", +- .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0, ++ .parent_data = mmcc_xo_mmpll0_mmpll1_gpll0, + .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0), + .ops = &clk_rcg2_ops, + }, +@@ -684,7 +696,7 @@ static struct clk_rcg2 mclk1_clk_src = { + .freq_tbl = ftbl_camss_mclk0_3_clk, + .clkr.hw.init = &(struct clk_init_data){ + .name = "mclk1_clk_src", +- .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0, ++ .parent_data = mmcc_xo_mmpll0_mmpll1_gpll0, + .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0), + .ops = &clk_rcg2_ops, + }, +@@ -697,7 +709,7 @@ static struct clk_rcg2 mclk2_clk_src = { + .freq_tbl = ftbl_camss_mclk0_3_clk, + .clkr.hw.init = &(struct clk_init_data){ + .name = "mclk2_clk_src", +- .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0, ++ .parent_data = mmcc_xo_mmpll0_mmpll1_gpll0, + .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0), + .ops = &clk_rcg2_ops, + }, +@@ -710,7 +722,7 @@ static struct clk_rcg2 mclk3_clk_src = { + .freq_tbl = ftbl_camss_mclk0_3_clk, + .clkr.hw.init = &(struct clk_init_data){ + .name = "mclk3_clk_src", +- .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0, ++ .parent_data = mmcc_xo_mmpll0_mmpll1_gpll0, + .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0), + .ops = &clk_rcg2_ops, + }, +@@ -729,7 +741,7 @@ static struct clk_rcg2 csi0phytimer_clk_src = { + .freq_tbl = ftbl_camss_phy0_2_csi0_2phytimer_clk, + .clkr.hw.init = &(struct clk_init_data){ + .name = "csi0phytimer_clk_src", +- .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0, ++ .parent_data = mmcc_xo_mmpll0_mmpll1_gpll0, + .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0), + .ops = &clk_rcg2_ops, + }, +@@ -742,7 +754,7 @@ static struct clk_rcg2 csi1phytimer_clk_src = { + .freq_tbl = ftbl_camss_phy0_2_csi0_2phytimer_clk, + .clkr.hw.init = &(struct clk_init_data){ + .name = "csi1phytimer_clk_src", +- .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0, ++ .parent_data = mmcc_xo_mmpll0_mmpll1_gpll0, + .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0), + .ops = &clk_rcg2_ops, + }, +@@ -755,7 +767,7 @@ static struct clk_rcg2 csi2phytimer_clk_src = { + .freq_tbl = ftbl_camss_phy0_2_csi0_2phytimer_clk, + .clkr.hw.init = &(struct clk_init_data){ + .name = "csi2phytimer_clk_src", +- .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0, ++ .parent_data = mmcc_xo_mmpll0_mmpll1_gpll0, + .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0), + .ops = &clk_rcg2_ops, + }, +@@ -786,7 +798,7 @@ static struct clk_rcg2 cpp_clk_src = { + .freq_tbl = ftbl_camss_vfe_cpp_clk, + .clkr.hw.init = &(struct clk_init_data){ + .name = "cpp_clk_src", +- .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0, ++ .parent_data = mmcc_xo_mmpll0_mmpll1_gpll0, + .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0), + .ops = &clk_rcg2_ops, + }, +@@ -804,7 +816,7 @@ static struct clk_rcg2 byte0_clk_src = { + .freq_tbl = byte_freq_tbl, + .clkr.hw.init = &(struct clk_init_data){ + .name = "byte0_clk_src", +- .parent_names = mmcc_xo_dsibyte_hdmi_edp_gpll0, ++ .parent_data = mmcc_xo_dsibyte_hdmi_edp_gpll0, + .num_parents = ARRAY_SIZE(mmcc_xo_dsibyte_hdmi_edp_gpll0), + .ops = &clk_byte2_ops, + .flags = CLK_SET_RATE_PARENT, +@@ -818,7 +830,7 @@ static struct clk_rcg2 byte1_clk_src = { + .freq_tbl = byte_freq_tbl, + .clkr.hw.init = &(struct clk_init_data){ + .name = "byte1_clk_src", +- .parent_names = mmcc_xo_dsibyte_hdmi_edp_gpll0, ++ .parent_data = mmcc_xo_dsibyte_hdmi_edp_gpll0, + .num_parents = ARRAY_SIZE(mmcc_xo_dsibyte_hdmi_edp_gpll0), + .ops = &clk_byte2_ops, + .flags = CLK_SET_RATE_PARENT, +@@ -837,7 +849,7 @@ static struct clk_rcg2 edpaux_clk_src = { + .freq_tbl = ftbl_mdss_edpaux_clk, + .clkr.hw.init = &(struct clk_init_data){ + .name = "edpaux_clk_src", +- .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0, ++ .parent_data = mmcc_xo_mmpll0_mmpll1_gpll0, + .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0), + .ops = &clk_rcg2_ops, + }, +@@ -856,7 +868,7 @@ static struct clk_rcg2 edplink_clk_src = { + .freq_tbl = ftbl_mdss_edplink_clk, + .clkr.hw.init = &(struct clk_init_data){ + .name = "edplink_clk_src", +- .parent_names = mmcc_xo_dsi_hdmi_edp_gpll0, ++ .parent_data = mmcc_xo_dsi_hdmi_edp_gpll0, + .num_parents = ARRAY_SIZE(mmcc_xo_dsi_hdmi_edp_gpll0), + .ops = &clk_rcg2_ops, + .flags = CLK_SET_RATE_PARENT, +@@ -876,7 +888,7 @@ static struct clk_rcg2 edppixel_clk_src = { + .freq_tbl = edp_pixel_freq_tbl, + .clkr.hw.init = &(struct clk_init_data){ + .name = "edppixel_clk_src", +- .parent_names = mmcc_xo_dsi_hdmi_edp, ++ .parent_data = mmcc_xo_dsi_hdmi_edp, + .num_parents = ARRAY_SIZE(mmcc_xo_dsi_hdmi_edp), + .ops = &clk_edp_pixel_ops, + }, +@@ -894,7 +906,7 @@ static struct clk_rcg2 esc0_clk_src = { + .freq_tbl = ftbl_mdss_esc0_1_clk, + .clkr.hw.init = &(struct clk_init_data){ + .name = "esc0_clk_src", +- .parent_names = mmcc_xo_dsibyte_hdmi_edp_gpll0, ++ .parent_data = mmcc_xo_dsibyte_hdmi_edp_gpll0, + .num_parents = ARRAY_SIZE(mmcc_xo_dsibyte_hdmi_edp_gpll0), + .ops = &clk_rcg2_ops, + }, +@@ -907,7 +919,7 @@ static struct clk_rcg2 esc1_clk_src = { + .freq_tbl = ftbl_mdss_esc0_1_clk, + .clkr.hw.init = &(struct clk_init_data){ + .name = "esc1_clk_src", +- .parent_names = mmcc_xo_dsibyte_hdmi_edp_gpll0, ++ .parent_data = mmcc_xo_dsibyte_hdmi_edp_gpll0, + .num_parents = ARRAY_SIZE(mmcc_xo_dsibyte_hdmi_edp_gpll0), + .ops = &clk_rcg2_ops, + }, +@@ -925,7 +937,7 @@ static struct clk_rcg2 extpclk_clk_src = { + .freq_tbl = extpclk_freq_tbl, + .clkr.hw.init = &(struct clk_init_data){ + .name = "extpclk_clk_src", +- .parent_names = mmcc_xo_dsi_hdmi_edp_gpll0, ++ .parent_data = mmcc_xo_dsi_hdmi_edp_gpll0, + .num_parents = ARRAY_SIZE(mmcc_xo_dsi_hdmi_edp_gpll0), + .ops = &clk_byte_ops, + .flags = CLK_SET_RATE_PARENT, +@@ -944,7 +956,7 @@ static struct clk_rcg2 hdmi_clk_src = { + .freq_tbl = ftbl_mdss_hdmi_clk, + .clkr.hw.init = &(struct clk_init_data){ + .name = "hdmi_clk_src", +- .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0, ++ .parent_data = mmcc_xo_mmpll0_mmpll1_gpll0, + .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0), + .ops = &clk_rcg2_ops, + }, +@@ -962,7 +974,7 @@ static struct clk_rcg2 vsync_clk_src = { + .freq_tbl = ftbl_mdss_vsync_clk, + .clkr.hw.init = &(struct clk_init_data){ + .name = "vsync_clk_src", +- .parent_names = mmcc_xo_mmpll0_mmpll1_gpll0, ++ .parent_data = mmcc_xo_mmpll0_mmpll1_gpll0, + .num_parents = ARRAY_SIZE(mmcc_xo_mmpll0_mmpll1_gpll0), + .ops = &clk_rcg2_ops, + }, +@@ -975,8 +987,8 @@ static struct clk_branch camss_cci_cci_ahb_clk = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "camss_cci_cci_ahb_clk", +- .parent_names = (const char *[]){ +- "mmss_ahb_clk_src", ++ .parent_hws = (const struct clk_hw*[]){ ++ &mmss_ahb_clk_src.clkr.hw + }, + .num_parents = 1, + .ops = &clk_branch2_ops, +@@ -991,8 +1003,8 @@ static struct clk_branch camss_cci_cci_clk = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "camss_cci_cci_clk", +- .parent_names = (const char *[]){ +- "cci_clk_src", ++ .parent_hws = (const struct clk_hw*[]){ ++ &cci_clk_src.clkr.hw + }, + .num_parents = 1, + .flags = CLK_SET_RATE_PARENT, +@@ -1008,8 +1020,8 @@ static struct clk_branch camss_csi0_ahb_clk = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "camss_csi0_ahb_clk", +- .parent_names = (const char *[]){ +- "mmss_ahb_clk_src", ++ .parent_hws = (const struct clk_hw*[]){ ++ &mmss_ahb_clk_src.clkr.hw + }, + .num_parents = 1, + .ops = &clk_branch2_ops, +@@ -1024,8 +1036,8 @@ static struct clk_branch camss_csi0_clk = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "camss_csi0_clk", +- .parent_names = (const char *[]){ +- "csi0_clk_src", ++ .parent_hws = (const struct clk_hw*[]){ ++ &csi0_clk_src.clkr.hw + }, + .num_parents = 1, + .flags = CLK_SET_RATE_PARENT, +@@ -1041,8 +1053,8 @@ static struct clk_branch camss_csi0phy_clk = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "camss_csi0phy_clk", +- .parent_names = (const char *[]){ +- "csi0_clk_src", ++ .parent_hws = (const struct clk_hw*[]){ ++ &csi0_clk_src.clkr.hw + }, + .num_parents = 1, + .flags = CLK_SET_RATE_PARENT, +@@ -1058,8 +1070,8 @@ static struct clk_branch camss_csi0pix_clk = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "camss_csi0pix_clk", +- .parent_names = (const char *[]){ +- "csi0_clk_src", ++ .parent_hws = (const struct clk_hw*[]){ ++ &csi0_clk_src.clkr.hw + }, + .num_parents = 1, + .flags = CLK_SET_RATE_PARENT, +@@ -1075,8 +1087,8 @@ static struct clk_branch camss_csi0rdi_clk = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "camss_csi0rdi_clk", +- .parent_names = (const char *[]){ +- "csi0_clk_src", ++ .parent_hws = (const struct clk_hw*[]){ ++ &csi0_clk_src.clkr.hw + }, + .num_parents = 1, + .flags = CLK_SET_RATE_PARENT, +@@ -1092,8 +1104,8 @@ static struct clk_branch camss_csi1_ahb_clk = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "camss_csi1_ahb_clk", +- .parent_names = (const char *[]){ +- "mmss_ahb_clk_src", ++ .parent_hws = (const struct clk_hw*[]){ ++ &mmss_ahb_clk_src.clkr.hw + }, + .num_parents = 1, + .ops = &clk_branch2_ops, +@@ -1108,8 +1120,8 @@ static struct clk_branch camss_csi1_clk = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "camss_csi1_clk", +- .parent_names = (const char *[]){ +- "csi1_clk_src", ++ .parent_hws = (const struct clk_hw*[]){ ++ &csi1_clk_src.clkr.hw + }, + .num_parents = 1, + .flags = CLK_SET_RATE_PARENT, +@@ -1125,8 +1137,8 @@ static struct clk_branch camss_csi1phy_clk = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "camss_csi1phy_clk", +- .parent_names = (const char *[]){ +- "csi1_clk_src", ++ .parent_hws = (const struct clk_hw*[]){ ++ &csi1_clk_src.clkr.hw + }, + .num_parents = 1, + .flags = CLK_SET_RATE_PARENT, +@@ -1142,8 +1154,8 @@ static struct clk_branch camss_csi1pix_clk = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "camss_csi1pix_clk", +- .parent_names = (const char *[]){ +- "csi1_clk_src", ++ .parent_hws = (const struct clk_hw*[]){ ++ &csi1_clk_src.clkr.hw + }, + .num_parents = 1, + .flags = CLK_SET_RATE_PARENT, +@@ -1159,8 +1171,8 @@ static struct clk_branch camss_csi1rdi_clk = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "camss_csi1rdi_clk", +- .parent_names = (const char *[]){ +- "csi1_clk_src", ++ .parent_hws = (const struct clk_hw*[]){ ++ &csi1_clk_src.clkr.hw + }, + .num_parents = 1, + .flags = CLK_SET_RATE_PARENT, +@@ -1176,8 +1188,8 @@ static struct clk_branch camss_csi2_ahb_clk = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "camss_csi2_ahb_clk", +- .parent_names = (const char *[]){ +- "mmss_ahb_clk_src", ++ .parent_hws = (const struct clk_hw*[]){ ++ &mmss_ahb_clk_src.clkr.hw + }, + .num_parents = 1, + .ops = &clk_branch2_ops, +@@ -1192,8 +1204,8 @@ static struct clk_branch camss_csi2_clk = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "camss_csi2_clk", +- .parent_names = (const char *[]){ +- "csi2_clk_src", ++ .parent_hws = (const struct clk_hw*[]){ ++ &csi2_clk_src.clkr.hw + }, + .num_parents = 1, + .flags = CLK_SET_RATE_PARENT, +@@ -1209,8 +1221,8 @@ static struct clk_branch camss_csi2phy_clk = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "camss_csi2phy_clk", +- .parent_names = (const char *[]){ +- "csi2_clk_src", ++ .parent_hws = (const struct clk_hw*[]){ ++ &csi2_clk_src.clkr.hw + }, + .num_parents = 1, + .flags = CLK_SET_RATE_PARENT, +@@ -1226,8 +1238,8 @@ static struct clk_branch camss_csi2pix_clk = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "camss_csi2pix_clk", +- .parent_names = (const char *[]){ +- "csi2_clk_src", ++ .parent_hws = (const struct clk_hw*[]){ ++ &csi2_clk_src.clkr.hw + }, + .num_parents = 1, + .flags = CLK_SET_RATE_PARENT, +@@ -1243,8 +1255,8 @@ static struct clk_branch camss_csi2rdi_clk = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "camss_csi2rdi_clk", +- .parent_names = (const char *[]){ +- "csi2_clk_src", ++ .parent_hws = (const struct clk_hw*[]){ ++ &csi2_clk_src.clkr.hw + }, + .num_parents = 1, + .flags = CLK_SET_RATE_PARENT, +@@ -1260,8 +1272,8 @@ static struct clk_branch camss_csi3_ahb_clk = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "camss_csi3_ahb_clk", +- .parent_names = (const char *[]){ +- "mmss_ahb_clk_src", ++ .parent_hws = (const struct clk_hw*[]){ ++ &mmss_ahb_clk_src.clkr.hw + }, + .num_parents = 1, + .ops = &clk_branch2_ops, +@@ -1276,8 +1288,8 @@ static struct clk_branch camss_csi3_clk = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "camss_csi3_clk", +- .parent_names = (const char *[]){ +- "csi3_clk_src", ++ .parent_hws = (const struct clk_hw*[]){ ++ &csi3_clk_src.clkr.hw + }, + .num_parents = 1, + .flags = CLK_SET_RATE_PARENT, +@@ -1293,8 +1305,8 @@ static struct clk_branch camss_csi3phy_clk = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "camss_csi3phy_clk", +- .parent_names = (const char *[]){ +- "csi3_clk_src", ++ .parent_hws = (const struct clk_hw*[]){ ++ &csi3_clk_src.clkr.hw + }, + .num_parents = 1, + .flags = CLK_SET_RATE_PARENT, +@@ -1310,8 +1322,8 @@ static struct clk_branch camss_csi3pix_clk = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "camss_csi3pix_clk", +- .parent_names = (const char *[]){ +- "csi3_clk_src", ++ .parent_hws = (const struct clk_hw*[]){ ++ &csi3_clk_src.clkr.hw + }, + .num_parents = 1, + .flags = CLK_SET_RATE_PARENT, +@@ -1327,8 +1339,8 @@ static struct clk_branch camss_csi3rdi_clk = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "camss_csi3rdi_clk", +- .parent_names = (const char *[]){ +- "csi3_clk_src", ++ .parent_hws = (const struct clk_hw*[]){ ++ &csi3_clk_src.clkr.hw + }, + .num_parents = 1, + .flags = CLK_SET_RATE_PARENT, +@@ -1344,8 +1356,8 @@ static struct clk_branch camss_csi_vfe0_clk = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "camss_csi_vfe0_clk", +- .parent_names = (const char *[]){ +- "vfe0_clk_src", ++ .parent_hws = (const struct clk_hw*[]){ ++ &vfe0_clk_src.clkr.hw + }, + .num_parents = 1, + .flags = CLK_SET_RATE_PARENT, +@@ -1361,8 +1373,8 @@ static struct clk_branch camss_csi_vfe1_clk = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "camss_csi_vfe1_clk", +- .parent_names = (const char *[]){ +- "vfe1_clk_src", ++ .parent_hws = (const struct clk_hw*[]){ ++ &vfe1_clk_src.clkr.hw + }, + .num_parents = 1, + .flags = CLK_SET_RATE_PARENT, +@@ -1378,8 +1390,8 @@ static struct clk_branch camss_gp0_clk = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "camss_gp0_clk", +- .parent_names = (const char *[]){ +- "camss_gp0_clk_src", ++ .parent_hws = (const struct clk_hw*[]){ ++ &camss_gp0_clk_src.clkr.hw + }, + .num_parents = 1, + .flags = CLK_SET_RATE_PARENT, +@@ -1395,8 +1407,8 @@ static struct clk_branch camss_gp1_clk = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "camss_gp1_clk", +- .parent_names = (const char *[]){ +- "camss_gp1_clk_src", ++ .parent_hws = (const struct clk_hw*[]){ ++ &camss_gp1_clk_src.clkr.hw + }, + .num_parents = 1, + .flags = CLK_SET_RATE_PARENT, +@@ -1412,8 +1424,8 @@ static struct clk_branch camss_ispif_ahb_clk = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "camss_ispif_ahb_clk", +- .parent_names = (const char *[]){ +- "mmss_ahb_clk_src", ++ .parent_hws = (const struct clk_hw*[]){ ++ &mmss_ahb_clk_src.clkr.hw + }, + .num_parents = 1, + .ops = &clk_branch2_ops, +@@ -1428,8 +1440,8 @@ static struct clk_branch camss_jpeg_jpeg0_clk = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "camss_jpeg_jpeg0_clk", +- .parent_names = (const char *[]){ +- "jpeg0_clk_src", ++ .parent_hws = (const struct clk_hw*[]){ ++ &jpeg0_clk_src.clkr.hw + }, + .num_parents = 1, + .flags = CLK_SET_RATE_PARENT, +@@ -1445,8 +1457,8 @@ static struct clk_branch camss_jpeg_jpeg1_clk = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "camss_jpeg_jpeg1_clk", +- .parent_names = (const char *[]){ +- "jpeg1_clk_src", ++ .parent_hws = (const struct clk_hw*[]){ ++ &jpeg1_clk_src.clkr.hw + }, + .num_parents = 1, + .flags = CLK_SET_RATE_PARENT, +@@ -1462,8 +1474,8 @@ static struct clk_branch camss_jpeg_jpeg2_clk = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "camss_jpeg_jpeg2_clk", +- .parent_names = (const char *[]){ +- "jpeg2_clk_src", ++ .parent_hws = (const struct clk_hw*[]){ ++ &jpeg2_clk_src.clkr.hw + }, + .num_parents = 1, + .flags = CLK_SET_RATE_PARENT, +@@ -1479,8 +1491,8 @@ static struct clk_branch camss_jpeg_jpeg_ahb_clk = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "camss_jpeg_jpeg_ahb_clk", +- .parent_names = (const char *[]){ +- "mmss_ahb_clk_src", ++ .parent_hws = (const struct clk_hw*[]){ ++ &mmss_ahb_clk_src.clkr.hw + }, + .num_parents = 1, + .ops = &clk_branch2_ops, +@@ -1495,8 +1507,8 @@ static struct clk_branch camss_jpeg_jpeg_axi_clk = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "camss_jpeg_jpeg_axi_clk", +- .parent_names = (const char *[]){ +- "mmss_axi_clk_src", ++ .parent_hws = (const struct clk_hw*[]){ ++ &mmss_axi_clk_src.clkr.hw + }, + .num_parents = 1, + .ops = &clk_branch2_ops, +@@ -1511,8 +1523,8 @@ static struct clk_branch camss_jpeg_jpeg_ocmemnoc_clk = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "camss_jpeg_jpeg_ocmemnoc_clk", +- .parent_names = (const char *[]){ +- "ocmemnoc_clk_src", ++ .parent_hws = (const struct clk_hw*[]){ ++ &ocmemnoc_clk_src.clkr.hw + }, + .num_parents = 1, + .flags = CLK_SET_RATE_PARENT, +@@ -1528,8 +1540,8 @@ static struct clk_branch camss_mclk0_clk = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "camss_mclk0_clk", +- .parent_names = (const char *[]){ +- "mclk0_clk_src", ++ .parent_hws = (const struct clk_hw*[]){ ++ &mclk0_clk_src.clkr.hw + }, + .num_parents = 1, + .flags = CLK_SET_RATE_PARENT, +@@ -1545,8 +1557,8 @@ static struct clk_branch camss_mclk1_clk = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "camss_mclk1_clk", +- .parent_names = (const char *[]){ +- "mclk1_clk_src", ++ .parent_hws = (const struct clk_hw*[]){ ++ &mclk1_clk_src.clkr.hw + }, + .num_parents = 1, + .flags = CLK_SET_RATE_PARENT, +@@ -1562,8 +1574,8 @@ static struct clk_branch camss_mclk2_clk = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "camss_mclk2_clk", +- .parent_names = (const char *[]){ +- "mclk2_clk_src", ++ .parent_hws = (const struct clk_hw*[]){ ++ &mclk2_clk_src.clkr.hw + }, + .num_parents = 1, + .flags = CLK_SET_RATE_PARENT, +@@ -1579,8 +1591,8 @@ static struct clk_branch camss_mclk3_clk = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "camss_mclk3_clk", +- .parent_names = (const char *[]){ +- "mclk3_clk_src", ++ .parent_hws = (const struct clk_hw*[]){ ++ &mclk3_clk_src.clkr.hw + }, + .num_parents = 1, + .flags = CLK_SET_RATE_PARENT, +@@ -1596,8 +1608,8 @@ static struct clk_branch camss_micro_ahb_clk = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "camss_micro_ahb_clk", +- .parent_names = (const char *[]){ +- "mmss_ahb_clk_src", ++ .parent_hws = (const struct clk_hw*[]){ ++ &mmss_ahb_clk_src.clkr.hw + }, + .num_parents = 1, + .ops = &clk_branch2_ops, +@@ -1612,8 +1624,8 @@ static struct clk_branch camss_phy0_csi0phytimer_clk = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "camss_phy0_csi0phytimer_clk", +- .parent_names = (const char *[]){ +- "csi0phytimer_clk_src", ++ .parent_hws = (const struct clk_hw*[]){ ++ &csi0phytimer_clk_src.clkr.hw + }, + .num_parents = 1, + .flags = CLK_SET_RATE_PARENT, +@@ -1629,8 +1641,8 @@ static struct clk_branch camss_phy1_csi1phytimer_clk = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "camss_phy1_csi1phytimer_clk", +- .parent_names = (const char *[]){ +- "csi1phytimer_clk_src", ++ .parent_hws = (const struct clk_hw*[]){ ++ &csi1phytimer_clk_src.clkr.hw + }, + .num_parents = 1, + .flags = CLK_SET_RATE_PARENT, +@@ -1646,8 +1658,8 @@ static struct clk_branch camss_phy2_csi2phytimer_clk = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "camss_phy2_csi2phytimer_clk", +- .parent_names = (const char *[]){ +- "csi2phytimer_clk_src", ++ .parent_hws = (const struct clk_hw*[]){ ++ &csi2phytimer_clk_src.clkr.hw + }, + .num_parents = 1, + .flags = CLK_SET_RATE_PARENT, +@@ -1663,8 +1675,8 @@ static struct clk_branch camss_top_ahb_clk = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "camss_top_ahb_clk", +- .parent_names = (const char *[]){ +- "mmss_ahb_clk_src", ++ .parent_hws = (const struct clk_hw*[]){ ++ &mmss_ahb_clk_src.clkr.hw + }, + .num_parents = 1, + .ops = &clk_branch2_ops, +@@ -1679,8 +1691,8 @@ static struct clk_branch camss_vfe_cpp_ahb_clk = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "camss_vfe_cpp_ahb_clk", +- .parent_names = (const char *[]){ +- "mmss_ahb_clk_src", ++ .parent_hws = (const struct clk_hw*[]){ ++ &mmss_ahb_clk_src.clkr.hw + }, + .num_parents = 1, + .ops = &clk_branch2_ops, +@@ -1695,8 +1707,8 @@ static struct clk_branch camss_vfe_cpp_clk = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "camss_vfe_cpp_clk", +- .parent_names = (const char *[]){ +- "cpp_clk_src", ++ .parent_hws = (const struct clk_hw*[]){ ++ &cpp_clk_src.clkr.hw + }, + .num_parents = 1, + .flags = CLK_SET_RATE_PARENT, +@@ -1712,8 +1724,8 @@ static struct clk_branch camss_vfe_vfe0_clk = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "camss_vfe_vfe0_clk", +- .parent_names = (const char *[]){ +- "vfe0_clk_src", ++ .parent_hws = (const struct clk_hw*[]){ ++ &vfe0_clk_src.clkr.hw + }, + .num_parents = 1, + .flags = CLK_SET_RATE_PARENT, +@@ -1729,8 +1741,8 @@ static struct clk_branch camss_vfe_vfe1_clk = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "camss_vfe_vfe1_clk", +- .parent_names = (const char *[]){ +- "vfe1_clk_src", ++ .parent_hws = (const struct clk_hw*[]){ ++ &vfe1_clk_src.clkr.hw + }, + .num_parents = 1, + .flags = CLK_SET_RATE_PARENT, +@@ -1746,8 +1758,8 @@ static struct clk_branch camss_vfe_vfe_ahb_clk = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "camss_vfe_vfe_ahb_clk", +- .parent_names = (const char *[]){ +- "mmss_ahb_clk_src", ++ .parent_hws = (const struct clk_hw*[]){ ++ &mmss_ahb_clk_src.clkr.hw + }, + .num_parents = 1, + .ops = &clk_branch2_ops, +@@ -1762,8 +1774,8 @@ static struct clk_branch camss_vfe_vfe_axi_clk = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "camss_vfe_vfe_axi_clk", +- .parent_names = (const char *[]){ +- "mmss_axi_clk_src", ++ .parent_hws = (const struct clk_hw*[]){ ++ &mmss_axi_clk_src.clkr.hw + }, + .num_parents = 1, + .ops = &clk_branch2_ops, +@@ -1778,8 +1790,8 @@ static struct clk_branch camss_vfe_vfe_ocmemnoc_clk = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "camss_vfe_vfe_ocmemnoc_clk", +- .parent_names = (const char *[]){ +- "ocmemnoc_clk_src", ++ .parent_hws = (const struct clk_hw*[]){ ++ &ocmemnoc_clk_src.clkr.hw + }, + .num_parents = 1, + .flags = CLK_SET_RATE_PARENT, +@@ -1795,8 +1807,8 @@ static struct clk_branch mdss_ahb_clk = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "mdss_ahb_clk", +- .parent_names = (const char *[]){ +- "mmss_ahb_clk_src", ++ .parent_hws = (const struct clk_hw*[]){ ++ &mmss_ahb_clk_src.clkr.hw + }, + .num_parents = 1, + .ops = &clk_branch2_ops, +@@ -1811,8 +1823,8 @@ static struct clk_branch mdss_axi_clk = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "mdss_axi_clk", +- .parent_names = (const char *[]){ +- "mmss_axi_clk_src", ++ .parent_hws = (const struct clk_hw*[]){ ++ &mmss_axi_clk_src.clkr.hw + }, + .num_parents = 1, + .flags = CLK_SET_RATE_PARENT, +@@ -1828,8 +1840,8 @@ static struct clk_branch mdss_byte0_clk = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "mdss_byte0_clk", +- .parent_names = (const char *[]){ +- "byte0_clk_src", ++ .parent_hws = (const struct clk_hw*[]){ ++ &byte0_clk_src.clkr.hw + }, + .num_parents = 1, + .flags = CLK_SET_RATE_PARENT, +@@ -1845,8 +1857,8 @@ static struct clk_branch mdss_byte1_clk = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "mdss_byte1_clk", +- .parent_names = (const char *[]){ +- "byte1_clk_src", ++ .parent_hws = (const struct clk_hw*[]){ ++ &byte1_clk_src.clkr.hw + }, + .num_parents = 1, + .flags = CLK_SET_RATE_PARENT, +@@ -1862,8 +1874,8 @@ static struct clk_branch mdss_edpaux_clk = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "mdss_edpaux_clk", +- .parent_names = (const char *[]){ +- "edpaux_clk_src", ++ .parent_hws = (const struct clk_hw*[]){ ++ &edpaux_clk_src.clkr.hw + }, + .num_parents = 1, + .flags = CLK_SET_RATE_PARENT, +@@ -1879,8 +1891,8 @@ static struct clk_branch mdss_edplink_clk = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "mdss_edplink_clk", +- .parent_names = (const char *[]){ +- "edplink_clk_src", ++ .parent_hws = (const struct clk_hw*[]){ ++ &edplink_clk_src.clkr.hw + }, + .num_parents = 1, + .flags = CLK_SET_RATE_PARENT, +@@ -1896,8 +1908,8 @@ static struct clk_branch mdss_edppixel_clk = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "mdss_edppixel_clk", +- .parent_names = (const char *[]){ +- "edppixel_clk_src", ++ .parent_hws = (const struct clk_hw*[]){ ++ &edppixel_clk_src.clkr.hw + }, + .num_parents = 1, + .flags = CLK_SET_RATE_PARENT, +@@ -1913,8 +1925,8 @@ static struct clk_branch mdss_esc0_clk = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "mdss_esc0_clk", +- .parent_names = (const char *[]){ +- "esc0_clk_src", ++ .parent_hws = (const struct clk_hw*[]){ ++ &esc0_clk_src.clkr.hw + }, + .num_parents = 1, + .flags = CLK_SET_RATE_PARENT, +@@ -1930,8 +1942,8 @@ static struct clk_branch mdss_esc1_clk = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "mdss_esc1_clk", +- .parent_names = (const char *[]){ +- "esc1_clk_src", ++ .parent_hws = (const struct clk_hw*[]){ ++ &esc1_clk_src.clkr.hw + }, + .num_parents = 1, + .flags = CLK_SET_RATE_PARENT, +@@ -1947,8 +1959,8 @@ static struct clk_branch mdss_extpclk_clk = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "mdss_extpclk_clk", +- .parent_names = (const char *[]){ +- "extpclk_clk_src", ++ .parent_hws = (const struct clk_hw*[]){ ++ &extpclk_clk_src.clkr.hw + }, + .num_parents = 1, + .flags = CLK_SET_RATE_PARENT, +@@ -1964,8 +1976,8 @@ static struct clk_branch mdss_hdmi_ahb_clk = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "mdss_hdmi_ahb_clk", +- .parent_names = (const char *[]){ +- "mmss_ahb_clk_src", ++ .parent_hws = (const struct clk_hw*[]){ ++ &mmss_ahb_clk_src.clkr.hw + }, + .num_parents = 1, + .ops = &clk_branch2_ops, +@@ -1980,8 +1992,8 @@ static struct clk_branch mdss_hdmi_clk = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "mdss_hdmi_clk", +- .parent_names = (const char *[]){ +- "hdmi_clk_src", ++ .parent_hws = (const struct clk_hw*[]){ ++ &hdmi_clk_src.clkr.hw + }, + .num_parents = 1, + .flags = CLK_SET_RATE_PARENT, +@@ -1997,8 +2009,8 @@ static struct clk_branch mdss_mdp_clk = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "mdss_mdp_clk", +- .parent_names = (const char *[]){ +- "mdp_clk_src", ++ .parent_hws = (const struct clk_hw*[]){ ++ &mdp_clk_src.clkr.hw + }, + .num_parents = 1, + .flags = CLK_SET_RATE_PARENT, +@@ -2014,8 +2026,8 @@ static struct clk_branch mdss_mdp_lut_clk = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "mdss_mdp_lut_clk", +- .parent_names = (const char *[]){ +- "mdp_clk_src", ++ .parent_hws = (const struct clk_hw*[]){ ++ &mdp_clk_src.clkr.hw + }, + .num_parents = 1, + .flags = CLK_SET_RATE_PARENT, +@@ -2031,8 +2043,8 @@ static struct clk_branch mdss_pclk0_clk = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "mdss_pclk0_clk", +- .parent_names = (const char *[]){ +- "pclk0_clk_src", ++ .parent_hws = (const struct clk_hw*[]){ ++ &pclk0_clk_src.clkr.hw + }, + .num_parents = 1, + .flags = CLK_SET_RATE_PARENT, +@@ -2048,8 +2060,8 @@ static struct clk_branch mdss_pclk1_clk = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "mdss_pclk1_clk", +- .parent_names = (const char *[]){ +- "pclk1_clk_src", ++ .parent_hws = (const struct clk_hw*[]){ ++ &pclk1_clk_src.clkr.hw + }, + .num_parents = 1, + .flags = CLK_SET_RATE_PARENT, +@@ -2065,8 +2077,8 @@ static struct clk_branch mdss_vsync_clk = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "mdss_vsync_clk", +- .parent_names = (const char *[]){ +- "vsync_clk_src", ++ .parent_hws = (const struct clk_hw*[]){ ++ &vsync_clk_src.clkr.hw + }, + .num_parents = 1, + .flags = CLK_SET_RATE_PARENT, +@@ -2082,8 +2094,8 @@ static struct clk_branch mmss_misc_ahb_clk = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "mmss_misc_ahb_clk", +- .parent_names = (const char *[]){ +- "mmss_ahb_clk_src", ++ .parent_hws = (const struct clk_hw*[]){ ++ &mmss_ahb_clk_src.clkr.hw + }, + .num_parents = 1, + .ops = &clk_branch2_ops, +@@ -2098,8 +2110,8 @@ static struct clk_branch mmss_mmssnoc_ahb_clk = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "mmss_mmssnoc_ahb_clk", +- .parent_names = (const char *[]){ +- "mmss_ahb_clk_src", ++ .parent_hws = (const struct clk_hw*[]){ ++ &mmss_ahb_clk_src.clkr.hw + }, + .num_parents = 1, + .ops = &clk_branch2_ops, +@@ -2115,8 +2127,8 @@ static struct clk_branch mmss_mmssnoc_bto_ahb_clk = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "mmss_mmssnoc_bto_ahb_clk", +- .parent_names = (const char *[]){ +- "mmss_ahb_clk_src", ++ .parent_hws = (const struct clk_hw*[]){ ++ &mmss_ahb_clk_src.clkr.hw + }, + .num_parents = 1, + .ops = &clk_branch2_ops, +@@ -2132,8 +2144,8 @@ static struct clk_branch mmss_mmssnoc_axi_clk = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "mmss_mmssnoc_axi_clk", +- .parent_names = (const char *[]){ +- "mmss_axi_clk_src", ++ .parent_hws = (const struct clk_hw*[]){ ++ &mmss_axi_clk_src.clkr.hw + }, + .num_parents = 1, + .flags = CLK_SET_RATE_PARENT | CLK_IGNORE_UNUSED, +@@ -2149,8 +2161,8 @@ static struct clk_branch mmss_s0_axi_clk = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "mmss_s0_axi_clk", +- .parent_names = (const char *[]){ +- "mmss_axi_clk_src", ++ .parent_hws = (const struct clk_hw*[]){ ++ &mmss_axi_clk_src.clkr.hw + }, + .num_parents = 1, + .ops = &clk_branch2_ops, +@@ -2166,8 +2178,8 @@ static struct clk_branch ocmemcx_ahb_clk = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "ocmemcx_ahb_clk", +- .parent_names = (const char *[]){ +- "mmss_ahb_clk_src", ++ .parent_hws = (const struct clk_hw*[]){ ++ &mmss_ahb_clk_src.clkr.hw + }, + .num_parents = 1, + .ops = &clk_branch2_ops, +@@ -2182,8 +2194,8 @@ static struct clk_branch ocmemcx_ocmemnoc_clk = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "ocmemcx_ocmemnoc_clk", +- .parent_names = (const char *[]){ +- "ocmemnoc_clk_src", ++ .parent_hws = (const struct clk_hw*[]){ ++ &ocmemnoc_clk_src.clkr.hw + }, + .num_parents = 1, + .flags = CLK_SET_RATE_PARENT, +@@ -2199,8 +2211,8 @@ static struct clk_branch oxili_ocmemgx_clk = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "oxili_ocmemgx_clk", +- .parent_names = (const char *[]){ +- "gfx3d_clk_src", ++ .parent_data = (const struct clk_parent_data[]){ ++ { .fw_name = "gfx3d_clk_src", .name = "gfx3d_clk_src" }, + }, + .num_parents = 1, + .flags = CLK_SET_RATE_PARENT, +@@ -2216,8 +2228,8 @@ static struct clk_branch ocmemnoc_clk = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "ocmemnoc_clk", +- .parent_names = (const char *[]){ +- "ocmemnoc_clk_src", ++ .parent_hws = (const struct clk_hw*[]){ ++ &ocmemnoc_clk_src.clkr.hw + }, + .num_parents = 1, + .flags = CLK_SET_RATE_PARENT, +@@ -2233,8 +2245,8 @@ static struct clk_branch oxili_gfx3d_clk = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "oxili_gfx3d_clk", +- .parent_names = (const char *[]){ +- "gfx3d_clk_src", ++ .parent_data = (const struct clk_parent_data[]){ ++ { .fw_name = "gfx3d_clk_src", .name = "gfx3d_clk_src" }, + }, + .num_parents = 1, + .flags = CLK_SET_RATE_PARENT, +@@ -2250,8 +2262,8 @@ static struct clk_branch oxilicx_ahb_clk = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "oxilicx_ahb_clk", +- .parent_names = (const char *[]){ +- "mmss_ahb_clk_src", ++ .parent_hws = (const struct clk_hw*[]){ ++ &mmss_ahb_clk_src.clkr.hw + }, + .num_parents = 1, + .ops = &clk_branch2_ops, +@@ -2266,8 +2278,8 @@ static struct clk_branch oxilicx_axi_clk = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "oxilicx_axi_clk", +- .parent_names = (const char *[]){ +- "mmss_axi_clk_src", ++ .parent_hws = (const struct clk_hw*[]){ ++ &mmss_axi_clk_src.clkr.hw + }, + .num_parents = 1, + .ops = &clk_branch2_ops, +@@ -2282,8 +2294,8 @@ static struct clk_branch venus0_ahb_clk = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "venus0_ahb_clk", +- .parent_names = (const char *[]){ +- "mmss_ahb_clk_src", ++ .parent_hws = (const struct clk_hw*[]){ ++ &mmss_ahb_clk_src.clkr.hw + }, + .num_parents = 1, + .ops = &clk_branch2_ops, +@@ -2298,8 +2310,8 @@ static struct clk_branch venus0_axi_clk = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "venus0_axi_clk", +- .parent_names = (const char *[]){ +- "mmss_axi_clk_src", ++ .parent_hws = (const struct clk_hw*[]){ ++ &mmss_axi_clk_src.clkr.hw + }, + .num_parents = 1, + .ops = &clk_branch2_ops, +@@ -2314,8 +2326,8 @@ static struct clk_branch venus0_ocmemnoc_clk = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "venus0_ocmemnoc_clk", +- .parent_names = (const char *[]){ +- "ocmemnoc_clk_src", ++ .parent_hws = (const struct clk_hw*[]){ ++ &ocmemnoc_clk_src.clkr.hw + }, + .num_parents = 1, + .flags = CLK_SET_RATE_PARENT, +@@ -2331,8 +2343,8 @@ static struct clk_branch venus0_vcodec0_clk = { + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "venus0_vcodec0_clk", +- .parent_names = (const char *[]){ +- "vcodec0_clk_src", ++ .parent_hws = (const struct clk_hw*[]){ ++ &vcodec0_clk_src.clkr.hw + }, + .num_parents = 1, + .flags = CLK_SET_RATE_PARENT, +-- +2.39.2 + diff --git a/queue-6.1/clk-qcom-reset-support-resetting-multiple-bits.patch b/queue-6.1/clk-qcom-reset-support-resetting-multiple-bits.patch new file mode 100644 index 00000000000..feff1e87158 --- /dev/null +++ b/queue-6.1/clk-qcom-reset-support-resetting-multiple-bits.patch @@ -0,0 +1,72 @@ +From 77dee81895f920cb18d770b39b2373caa7526c07 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Nov 2022 14:28:59 +0100 +Subject: clk: qcom: reset: support resetting multiple bits + +From: Robert Marko + +[ Upstream commit 4a5210893625f89723ea210d7c630b730abb37ad ] + +This patch adds the support for giving the complete bitmask +in reset structure and reset operation will use this bitmask +for all reset operations. + +Currently, reset structure only takes a single bit for each reset +and then calculates the bitmask by using the BIT() macro. + +However, this is not sufficient anymore for newer SoC-s like IPQ8074, +IPQ6018 and more, since their networking resets require multiple bits +to be asserted in order to properly reset the HW block completely. + +So, in order to allow asserting multiple bits add "bitmask" field to +qcom_reset_map, and then use that bitmask value if its populated in the +driver, if its not populated, then we just default to existing behaviour +and calculate the bitmask on the fly. + +Signed-off-by: Robert Marko +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20221107132901.489240-1-robimarko@gmail.com +Stable-dep-of: 349b5bed539b ("clk: qcom: ipq6018: fix networking resets") +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/reset.c | 4 ++-- + drivers/clk/qcom/reset.h | 1 + + 2 files changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/clk/qcom/reset.c b/drivers/clk/qcom/reset.c +index 2a16adb572d2b..0e914ec7aeae1 100644 +--- a/drivers/clk/qcom/reset.c ++++ b/drivers/clk/qcom/reset.c +@@ -30,7 +30,7 @@ qcom_reset_assert(struct reset_controller_dev *rcdev, unsigned long id) + + rst = to_qcom_reset_controller(rcdev); + map = &rst->reset_map[id]; +- mask = BIT(map->bit); ++ mask = map->bitmask ? map->bitmask : BIT(map->bit); + + return regmap_update_bits(rst->regmap, map->reg, mask, mask); + } +@@ -44,7 +44,7 @@ qcom_reset_deassert(struct reset_controller_dev *rcdev, unsigned long id) + + rst = to_qcom_reset_controller(rcdev); + map = &rst->reset_map[id]; +- mask = BIT(map->bit); ++ mask = map->bitmask ? map->bitmask : BIT(map->bit); + + return regmap_update_bits(rst->regmap, map->reg, mask, 0); + } +diff --git a/drivers/clk/qcom/reset.h b/drivers/clk/qcom/reset.h +index b8c113582072b..9a47c838d9b1b 100644 +--- a/drivers/clk/qcom/reset.h ++++ b/drivers/clk/qcom/reset.h +@@ -12,6 +12,7 @@ struct qcom_reset_map { + unsigned int reg; + u8 bit; + u8 udelay; ++ u32 bitmask; + }; + + struct regmap; +-- +2.39.2 + diff --git a/queue-6.1/coresight-fix-loss-of-connection-info-when-a-module-.patch b/queue-6.1/coresight-fix-loss-of-connection-info-when-a-module-.patch new file mode 100644 index 00000000000..25a8f6c5977 --- /dev/null +++ b/queue-6.1/coresight-fix-loss-of-connection-info-when-a-module-.patch @@ -0,0 +1,69 @@ +From 83d12a7c912ef3ea830a9c16ee02a2daf746453f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Apr 2023 15:35:28 +0100 +Subject: coresight: Fix loss of connection info when a module is unloaded + +From: James Clark + +[ Upstream commit c45b2835e7b205783bdfe08cc98fa86a7c5eeb74 ] + +child_fwnode should be a read only property based on the DT or ACPI. If +it's cleared on the parent device when a child is unloaded, then when +the child is loaded again the connection won't be remade. + +child_dev should be cleared instead which signifies that the connection +should be remade when the child_fwnode registers a new coresight_device. + +Similarly the reference count shouldn't be decremented as long as the +parent device exists. The correct place to drop the reference is in +coresight_release_platform_data() which is already done. + +Reproducible on Juno with the following steps: + + # load all coresight modules. + $ cd /sys/bus/coresight/devices/ + $ echo 1 > tmc_etr0/enable_sink + $ echo 1 > etm0/enable_source + # Works fine ^ + + $ echo 0 > etm0/enable_source + $ rmmod coresight-funnel + $ modprobe coresight-funnel + $ echo 1 > etm0/enable_source + -bash: echo: write error: Invalid argument + +Fixes: 37ea1ffddffa ("coresight: Use fwnode handle instead of device names") +Fixes: 2af89ebacf29 ("coresight: Clear the connection field properly") +Tested-by: Suzuki K Poulose +Reviewed-by: Mike Leach +Signed-off-by: James Clark +Signed-off-by: Suzuki K Poulose +Link: https://lore.kernel.org/r/20230425143542.2305069-2-james.clark@arm.com +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/coresight/coresight-core.c | 9 ++------- + 1 file changed, 2 insertions(+), 7 deletions(-) + +diff --git a/drivers/hwtracing/coresight/coresight-core.c b/drivers/hwtracing/coresight/coresight-core.c +index f3068175ca9d9..bcb08fadccf21 100644 +--- a/drivers/hwtracing/coresight/coresight-core.c ++++ b/drivers/hwtracing/coresight/coresight-core.c +@@ -1446,13 +1446,8 @@ static int coresight_remove_match(struct device *dev, void *data) + if (csdev->dev.fwnode == conn->child_fwnode) { + iterator->orphan = true; + coresight_remove_links(iterator, conn); +- /* +- * Drop the reference to the handle for the remote +- * device acquired in parsing the connections from +- * platform data. +- */ +- fwnode_handle_put(conn->child_fwnode); +- conn->child_fwnode = NULL; ++ ++ conn->child_dev = NULL; + /* No need to continue */ + break; + } +-- +2.39.2 + diff --git a/queue-6.1/cpufreq-mediatek-correct-voltages-for-mt7622-and-mt7.patch b/queue-6.1/cpufreq-mediatek-correct-voltages-for-mt7622-and-mt7.patch new file mode 100644 index 00000000000..1c16c6968ac --- /dev/null +++ b/queue-6.1/cpufreq-mediatek-correct-voltages-for-mt7622-and-mt7.patch @@ -0,0 +1,65 @@ +From cc5b7f331ce2fafb7cbfeca928532656235162df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Jun 2023 15:18:12 +0100 +Subject: cpufreq: mediatek: correct voltages for MT7622 and MT7623 + +From: Daniel Golle + +[ Upstream commit f85534113f5ae90a52521cdb9e9977a43ee42626 ] + +The MT6380 regulator typically used together with MT7622 does not +support the current maximum processor and SRAM voltage in the cpufreq +driver (1360000uV). +For MT7622 limit processor and SRAM supply voltages to 1350000uV to +avoid having the tracking algorithm request unsupported voltages from +the regulator. + +On MT7623 there is no separate SRAM supply and the maximum voltage used +is 1300000uV. Create dedicated platform data for MT7623 to cover that +case as well. + +Fixes: 0883426fd07e3 ("cpufreq: mediatek: Raise proc and sram max voltage for MT7622/7623") +Suggested-by: Jia-wei Chang +Signed-off-by: Daniel Golle +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/mediatek-cpufreq.c | 13 ++++++++++--- + 1 file changed, 10 insertions(+), 3 deletions(-) + +diff --git a/drivers/cpufreq/mediatek-cpufreq.c b/drivers/cpufreq/mediatek-cpufreq.c +index 9a39a7ccfae96..fef68cb2b38f7 100644 +--- a/drivers/cpufreq/mediatek-cpufreq.c ++++ b/drivers/cpufreq/mediatek-cpufreq.c +@@ -696,9 +696,16 @@ static const struct mtk_cpufreq_platform_data mt2701_platform_data = { + static const struct mtk_cpufreq_platform_data mt7622_platform_data = { + .min_volt_shift = 100000, + .max_volt_shift = 200000, +- .proc_max_volt = 1360000, ++ .proc_max_volt = 1350000, + .sram_min_volt = 0, +- .sram_max_volt = 1360000, ++ .sram_max_volt = 1350000, ++ .ccifreq_supported = false, ++}; ++ ++static const struct mtk_cpufreq_platform_data mt7623_platform_data = { ++ .min_volt_shift = 100000, ++ .max_volt_shift = 200000, ++ .proc_max_volt = 1300000, + .ccifreq_supported = false, + }; + +@@ -734,7 +741,7 @@ static const struct of_device_id mtk_cpufreq_machines[] __initconst = { + { .compatible = "mediatek,mt2701", .data = &mt2701_platform_data }, + { .compatible = "mediatek,mt2712", .data = &mt2701_platform_data }, + { .compatible = "mediatek,mt7622", .data = &mt7622_platform_data }, +- { .compatible = "mediatek,mt7623", .data = &mt7622_platform_data }, ++ { .compatible = "mediatek,mt7623", .data = &mt7623_platform_data }, + { .compatible = "mediatek,mt8167", .data = &mt8516_platform_data }, + { .compatible = "mediatek,mt817x", .data = &mt2701_platform_data }, + { .compatible = "mediatek,mt8173", .data = &mt2701_platform_data }, +-- +2.39.2 + diff --git a/queue-6.1/device-property-clarify-description-of-returned-valu.patch b/queue-6.1/device-property-clarify-description-of-returned-valu.patch new file mode 100644 index 00000000000..f873d15ae5a --- /dev/null +++ b/queue-6.1/device-property-clarify-description-of-returned-valu.patch @@ -0,0 +1,382 @@ +From 8b3d63a7f43c48ce69521f3d32c0231f4e9c0ea2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Feb 2023 15:33:44 +0200 +Subject: device property: Clarify description of returned value in some + functions + +From: Andy Shevchenko + +[ Upstream commit 295209ca7b5b3aa6375d6190311b2ae804dbcf65 ] + +Some of the functions do not provide Return: section on absence of which +kernel-doc complains. Besides that several functions return the fwnode +handle with incremented reference count. Add a respective note to make sure +that the caller decrements it when it's not needed anymore. + +While at it, unify the style of the Return: sections. + +Reported-by: Daniel Kaehn +Signed-off-by: Andy Shevchenko +Acked-by: Sakari Ailus +Acked-by: Rafael J. Wysocki +Link: https://lore.kernel.org/r/20230217133344.79278-1-andriy.shevchenko@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: 39d422555e43 ("drivers: fwnode: fix fwnode_irq_get[_byname]()") +Signed-off-by: Sasha Levin +--- + drivers/base/property.c | 124 +++++++++++++++++++++++++++++----------- + 1 file changed, 90 insertions(+), 34 deletions(-) + +diff --git a/drivers/base/property.c b/drivers/base/property.c +index f2f7829ad36b9..868adeac2a843 100644 +--- a/drivers/base/property.c ++++ b/drivers/base/property.c +@@ -30,6 +30,8 @@ EXPORT_SYMBOL_GPL(dev_fwnode); + * @propname: Name of the property + * + * Check if property @propname is present in the device firmware description. ++ * ++ * Return: true if property @propname is present. Otherwise, returns false. + */ + bool device_property_present(struct device *dev, const char *propname) + { +@@ -41,6 +43,8 @@ EXPORT_SYMBOL_GPL(device_property_present); + * fwnode_property_present - check if a property of a firmware node is present + * @fwnode: Firmware node whose property to check + * @propname: Name of the property ++ * ++ * Return: true if property @propname is present. Otherwise, returns false. + */ + bool fwnode_property_present(const struct fwnode_handle *fwnode, + const char *propname) +@@ -500,10 +504,10 @@ EXPORT_SYMBOL_GPL(fwnode_property_match_string); + * Obtain a reference based on a named property in an fwnode, with + * integer arguments. + * +- * Caller is responsible to call fwnode_handle_put() on the returned +- * args->fwnode pointer. ++ * The caller is responsible for calling fwnode_handle_put() on the returned ++ * @args->fwnode pointer. + * +- * Returns: %0 on success ++ * Return: %0 on success + * %-ENOENT when the index is out of bounds, the index has an empty + * reference or the property was not found + * %-EINVAL on parse error +@@ -539,8 +543,11 @@ EXPORT_SYMBOL_GPL(fwnode_property_get_reference_args); + * + * @index can be used when the named reference holds a table of references. + * +- * Returns pointer to the reference fwnode, or ERR_PTR. Caller is responsible to +- * call fwnode_handle_put() on the returned fwnode pointer. ++ * The caller is responsible for calling fwnode_handle_put() on the returned ++ * fwnode pointer. ++ * ++ * Return: a pointer to the reference fwnode, when found. Otherwise, ++ * returns an error pointer. + */ + struct fwnode_handle *fwnode_find_reference(const struct fwnode_handle *fwnode, + const char *name, +@@ -559,7 +566,7 @@ EXPORT_SYMBOL_GPL(fwnode_find_reference); + * fwnode_get_name - Return the name of a node + * @fwnode: The firmware node + * +- * Returns a pointer to the node name. ++ * Return: a pointer to the node name, or %NULL. + */ + const char *fwnode_get_name(const struct fwnode_handle *fwnode) + { +@@ -571,7 +578,7 @@ EXPORT_SYMBOL_GPL(fwnode_get_name); + * fwnode_get_name_prefix - Return the prefix of node for printing purposes + * @fwnode: The firmware node + * +- * Returns the prefix of a node, intended to be printed right before the node. ++ * Return: the prefix of a node, intended to be printed right before the node. + * The prefix works also as a separator between the nodes. + */ + const char *fwnode_get_name_prefix(const struct fwnode_handle *fwnode) +@@ -583,7 +590,10 @@ const char *fwnode_get_name_prefix(const struct fwnode_handle *fwnode) + * fwnode_get_parent - Return parent firwmare node + * @fwnode: Firmware whose parent is retrieved + * +- * Return parent firmware node of the given node if possible or %NULL if no ++ * The caller is responsible for calling fwnode_handle_put() on the returned ++ * fwnode pointer. ++ * ++ * Return: parent firmware node of the given node if possible or %NULL if no + * parent was available. + */ + struct fwnode_handle *fwnode_get_parent(const struct fwnode_handle *fwnode) +@@ -600,8 +610,12 @@ EXPORT_SYMBOL_GPL(fwnode_get_parent); + * on the passed node, making it suitable for iterating through a + * node's parents. + * +- * Returns a node pointer with refcount incremented, use +- * fwnode_handle_put() on it when done. ++ * The caller is responsible for calling fwnode_handle_put() on the returned ++ * fwnode pointer. Note that this function also puts a reference to @fwnode ++ * unconditionally. ++ * ++ * Return: parent firmware node of the given node if possible or %NULL if no ++ * parent was available. + */ + struct fwnode_handle *fwnode_get_next_parent(struct fwnode_handle *fwnode) + { +@@ -621,8 +635,10 @@ EXPORT_SYMBOL_GPL(fwnode_get_next_parent); + * firmware node that has a corresponding struct device and returns that struct + * device. + * +- * The caller of this function is expected to call put_device() on the returned +- * device when they are done. ++ * The caller is responsible for calling put_device() on the returned device ++ * pointer. ++ * ++ * Return: a pointer to the device of the @fwnode's closest ancestor. + */ + struct device *fwnode_get_next_parent_dev(struct fwnode_handle *fwnode) + { +@@ -643,7 +659,7 @@ struct device *fwnode_get_next_parent_dev(struct fwnode_handle *fwnode) + * fwnode_count_parents - Return the number of parents a node has + * @fwnode: The node the parents of which are to be counted + * +- * Returns the number of parents a node has. ++ * Return: the number of parents a node has. + */ + unsigned int fwnode_count_parents(const struct fwnode_handle *fwnode) + { +@@ -662,12 +678,12 @@ EXPORT_SYMBOL_GPL(fwnode_count_parents); + * @fwnode: The node the parent of which is requested + * @depth: Distance of the parent from the node + * +- * Returns the nth parent of a node. If there is no parent at the requested ++ * The caller is responsible for calling fwnode_handle_put() on the returned ++ * fwnode pointer. ++ * ++ * Return: the nth parent of a node. If there is no parent at the requested + * @depth, %NULL is returned. If @depth is 0, the functionality is equivalent to + * fwnode_handle_get(). For @depth == 1, it is fwnode_get_parent() and so on. +- * +- * The caller is responsible for calling fwnode_handle_put() for the returned +- * node. + */ + struct fwnode_handle *fwnode_get_nth_parent(struct fwnode_handle *fwnode, + unsigned int depth) +@@ -692,7 +708,7 @@ EXPORT_SYMBOL_GPL(fwnode_get_nth_parent); + * + * A node is considered an ancestor of itself too. + * +- * Returns true if @ancestor is an ancestor of @child. Otherwise, returns false. ++ * Return: true if @ancestor is an ancestor of @child. Otherwise, returns false. + */ + bool fwnode_is_ancestor_of(struct fwnode_handle *ancestor, struct fwnode_handle *child) + { +@@ -717,6 +733,10 @@ bool fwnode_is_ancestor_of(struct fwnode_handle *ancestor, struct fwnode_handle + * fwnode_get_next_child_node - Return the next child node handle for a node + * @fwnode: Firmware node to find the next child node for. + * @child: Handle to one of the node's child nodes or a %NULL handle. ++ * ++ * The caller is responsible for calling fwnode_handle_put() on the returned ++ * fwnode pointer. Note that this function also puts a reference to @child ++ * unconditionally. + */ + struct fwnode_handle * + fwnode_get_next_child_node(const struct fwnode_handle *fwnode, +@@ -727,10 +747,13 @@ fwnode_get_next_child_node(const struct fwnode_handle *fwnode, + EXPORT_SYMBOL_GPL(fwnode_get_next_child_node); + + /** +- * fwnode_get_next_available_child_node - Return the next +- * available child node handle for a node ++ * fwnode_get_next_available_child_node - Return the next available child node handle for a node + * @fwnode: Firmware node to find the next child node for. + * @child: Handle to one of the node's child nodes or a %NULL handle. ++ * ++ * The caller is responsible for calling fwnode_handle_put() on the returned ++ * fwnode pointer. Note that this function also puts a reference to @child ++ * unconditionally. + */ + struct fwnode_handle * + fwnode_get_next_available_child_node(const struct fwnode_handle *fwnode, +@@ -754,7 +777,11 @@ EXPORT_SYMBOL_GPL(fwnode_get_next_available_child_node); + /** + * device_get_next_child_node - Return the next child node handle for a device + * @dev: Device to find the next child node for. +- * @child: Handle to one of the device's child nodes or a null handle. ++ * @child: Handle to one of the device's child nodes or a %NULL handle. ++ * ++ * The caller is responsible for calling fwnode_handle_put() on the returned ++ * fwnode pointer. Note that this function also puts a reference to @child ++ * unconditionally. + */ + struct fwnode_handle *device_get_next_child_node(struct device *dev, + struct fwnode_handle *child) +@@ -779,6 +806,9 @@ EXPORT_SYMBOL_GPL(device_get_next_child_node); + * fwnode_get_named_child_node - Return first matching named child node handle + * @fwnode: Firmware node to find the named child node for. + * @childname: String to match child node name against. ++ * ++ * The caller is responsible for calling fwnode_handle_put() on the returned ++ * fwnode pointer. + */ + struct fwnode_handle * + fwnode_get_named_child_node(const struct fwnode_handle *fwnode, +@@ -792,6 +822,9 @@ EXPORT_SYMBOL_GPL(fwnode_get_named_child_node); + * device_get_named_child_node - Return first matching named child node handle + * @dev: Device to find the named child node for. + * @childname: String to match child node name against. ++ * ++ * The caller is responsible for calling fwnode_handle_put() on the returned ++ * fwnode pointer. + */ + struct fwnode_handle *device_get_named_child_node(struct device *dev, + const char *childname) +@@ -804,7 +837,10 @@ EXPORT_SYMBOL_GPL(device_get_named_child_node); + * fwnode_handle_get - Obtain a reference to a device node + * @fwnode: Pointer to the device node to obtain the reference to. + * +- * Returns the fwnode handle. ++ * The caller is responsible for calling fwnode_handle_put() on the returned ++ * fwnode pointer. ++ * ++ * Return: the fwnode handle. + */ + struct fwnode_handle *fwnode_handle_get(struct fwnode_handle *fwnode) + { +@@ -833,6 +869,8 @@ EXPORT_SYMBOL_GPL(fwnode_handle_put); + * fwnode_device_is_available - check if a device is available for use + * @fwnode: Pointer to the fwnode of the device. + * ++ * Return: true if device is available for use. Otherwise, returns false. ++ * + * For fwnode node types that don't implement the .device_is_available() + * operation, this function returns true. + */ +@@ -851,6 +889,8 @@ EXPORT_SYMBOL_GPL(fwnode_device_is_available); + /** + * device_get_child_node_count - return the number of child nodes for device + * @dev: Device to cound the child nodes for ++ * ++ * Return: the number of child nodes for a given device. + */ + unsigned int device_get_child_node_count(struct device *dev) + { +@@ -926,7 +966,7 @@ EXPORT_SYMBOL_GPL(device_get_phy_mode); + * @fwnode: Pointer to the firmware node + * @index: Index of the IO range + * +- * Returns a pointer to the mapped memory. ++ * Return: a pointer to the mapped memory. + */ + void __iomem *fwnode_iomap(struct fwnode_handle *fwnode, int index) + { +@@ -939,8 +979,8 @@ EXPORT_SYMBOL(fwnode_iomap); + * @fwnode: Pointer to the firmware node + * @index: Zero-based index of the IRQ + * +- * Returns Linux IRQ number on success. Other values are determined +- * accordingly to acpi_/of_ irq_get() operation. ++ * Return: Linux IRQ number on success. Other values are determined ++ * according to acpi_irq_get() or of_irq_get() operation. + */ + int fwnode_irq_get(const struct fwnode_handle *fwnode, unsigned int index) + { +@@ -959,8 +999,7 @@ EXPORT_SYMBOL(fwnode_irq_get); + * number of the IRQ resource corresponding to the index of the matched + * string. + * +- * Return: +- * Linux IRQ number on success, or negative errno otherwise. ++ * Return: Linux IRQ number on success, or negative errno otherwise. + */ + int fwnode_irq_get_byname(const struct fwnode_handle *fwnode, const char *name) + { +@@ -982,7 +1021,11 @@ EXPORT_SYMBOL(fwnode_irq_get_byname); + * @fwnode: Pointer to the parent firmware node + * @prev: Previous endpoint node or %NULL to get the first + * +- * Returns an endpoint firmware node pointer or %NULL if no more endpoints ++ * The caller is responsible for calling fwnode_handle_put() on the returned ++ * fwnode pointer. Note that this function also puts a reference to @prev ++ * unconditionally. ++ * ++ * Return: an endpoint firmware node pointer or %NULL if no more endpoints + * are available. + */ + struct fwnode_handle * +@@ -1022,6 +1065,9 @@ EXPORT_SYMBOL_GPL(fwnode_graph_get_next_endpoint); + * fwnode_graph_get_port_parent - Return the device fwnode of a port endpoint + * @endpoint: Endpoint firmware node of the port + * ++ * The caller is responsible for calling fwnode_handle_put() on the returned ++ * fwnode pointer. ++ * + * Return: the firmware node of the device the @endpoint belongs to. + */ + struct fwnode_handle * +@@ -1043,6 +1089,9 @@ EXPORT_SYMBOL_GPL(fwnode_graph_get_port_parent); + * @fwnode: Endpoint firmware node pointing to the remote endpoint + * + * Extracts firmware node of a remote device the @fwnode points to. ++ * ++ * The caller is responsible for calling fwnode_handle_put() on the returned ++ * fwnode pointer. + */ + struct fwnode_handle * + fwnode_graph_get_remote_port_parent(const struct fwnode_handle *fwnode) +@@ -1063,6 +1112,9 @@ EXPORT_SYMBOL_GPL(fwnode_graph_get_remote_port_parent); + * @fwnode: Endpoint firmware node pointing to the remote endpoint + * + * Extracts firmware node of a remote port the @fwnode points to. ++ * ++ * The caller is responsible for calling fwnode_handle_put() on the returned ++ * fwnode pointer. + */ + struct fwnode_handle * + fwnode_graph_get_remote_port(const struct fwnode_handle *fwnode) +@@ -1076,6 +1128,9 @@ EXPORT_SYMBOL_GPL(fwnode_graph_get_remote_port); + * @fwnode: Endpoint firmware node pointing to the remote endpoint + * + * Extracts firmware node of a remote endpoint the @fwnode points to. ++ * ++ * The caller is responsible for calling fwnode_handle_put() on the returned ++ * fwnode pointer. + */ + struct fwnode_handle * + fwnode_graph_get_remote_endpoint(const struct fwnode_handle *fwnode) +@@ -1103,8 +1158,11 @@ static bool fwnode_graph_remote_available(struct fwnode_handle *ep) + * @endpoint: identifier of the endpoint node under the port node + * @flags: fwnode lookup flags + * +- * Return the fwnode handle of the local endpoint corresponding the port and +- * endpoint IDs or NULL if not found. ++ * The caller is responsible for calling fwnode_handle_put() on the returned ++ * fwnode pointer. ++ * ++ * Return: the fwnode handle of the local endpoint corresponding the port and ++ * endpoint IDs or %NULL if not found. + * + * If FWNODE_GRAPH_ENDPOINT_NEXT is passed in @flags and the specified endpoint + * has not been found, look for the closest endpoint ID greater than the +@@ -1112,9 +1170,6 @@ static bool fwnode_graph_remote_available(struct fwnode_handle *ep) + * + * Does not return endpoints that belong to disabled devices or endpoints that + * are unconnected, unless FWNODE_GRAPH_DEVICE_DISABLED is passed in @flags. +- * +- * The returned endpoint needs to be released by calling fwnode_handle_put() on +- * it when it is not needed any more. + */ + struct fwnode_handle * + fwnode_graph_get_endpoint_by_id(const struct fwnode_handle *fwnode, +@@ -1320,7 +1375,8 @@ EXPORT_SYMBOL_GPL(fwnode_connection_find_match); + * @fwnode and other device nodes. @match will be used to convert the + * connection description to data the caller is expecting to be returned + * through the @matches array. +- * If @matches is NULL @matches_len is ignored and the total number of resolved ++ * ++ * If @matches is %NULL @matches_len is ignored and the total number of resolved + * matches is returned. + * + * Return: Number of matches resolved, or negative errno. +-- +2.39.2 + diff --git a/queue-6.1/device-property-fix-documentation-for-fwnode_get_nex.patch b/queue-6.1/device-property-fix-documentation-for-fwnode_get_nex.patch new file mode 100644 index 00000000000..2bab55d919b --- /dev/null +++ b/queue-6.1/device-property-fix-documentation-for-fwnode_get_nex.patch @@ -0,0 +1,41 @@ +From 00e28d7b115250f43a2907f16a95848c9b2fd8c7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Dec 2022 15:22:18 +0400 +Subject: device property: Fix documentation for fwnode_get_next_parent() + +From: Miaoqian Lin + +[ Upstream commit f18caf261398a7f2de4fa3f600deb87072fe7b8d ] + +Use fwnode_handle_put() on the node pointer to release the refcount. +Change fwnode_handle_node() to fwnode_handle_put(). + +Fixes: 233872585de1 ("device property: Add fwnode_get_next_parent()") +Reviewed-by: Andy Shevchenko +Reviewed-by: Daniel Scally +Acked-by: Sakari Ailus +Signed-off-by: Miaoqian Lin +Link: https://lore.kernel.org/r/20221207112219.2652411-1-linmq006@gmail.com +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: 39d422555e43 ("drivers: fwnode: fix fwnode_irq_get[_byname]()") +Signed-off-by: Sasha Levin +--- + drivers/base/property.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/base/property.c b/drivers/base/property.c +index 7f338cb4fb7b8..f2f7829ad36b9 100644 +--- a/drivers/base/property.c ++++ b/drivers/base/property.c +@@ -601,7 +601,7 @@ EXPORT_SYMBOL_GPL(fwnode_get_parent); + * node's parents. + * + * Returns a node pointer with refcount incremented, use +- * fwnode_handle_node() on it when done. ++ * fwnode_handle_put() on it when done. + */ + struct fwnode_handle *fwnode_get_next_parent(struct fwnode_handle *fwnode) + { +-- +2.39.2 + diff --git a/queue-6.1/drivers-fwnode-fix-fwnode_irq_get-_byname.patch b/queue-6.1/drivers-fwnode-fix-fwnode_irq_get-_byname.patch new file mode 100644 index 00000000000..d10f33db259 --- /dev/null +++ b/queue-6.1/drivers-fwnode-fix-fwnode_irq_get-_byname.patch @@ -0,0 +1,75 @@ +From 99cd537e190bc9bd7daaa2f39d3a84b71af21800 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 May 2023 09:22:33 +0300 +Subject: drivers: fwnode: fix fwnode_irq_get[_byname]() + +From: Matti Vaittinen + +[ Upstream commit 39d422555e43379516d4d13f5b7162a3dee6e646 ] + +The fwnode_irq_get() and the fwnode_irq_get_byname() return 0 upon +device-tree IRQ mapping failure. This is contradicting the +fwnode_irq_get_byname() function documentation and can potentially be a +source of errors like: + +int probe(...) { + ... + + irq = fwnode_irq_get_byname(); + if (irq <= 0) + return irq; + + ... +} + +Here we do correctly check the return value from fwnode_irq_get_byname() +but the driver probe will now return success. (There was already one +such user in-tree). + +Change the fwnode_irq_get_byname() to work as documented and make also the +fwnode_irq_get() follow same common convention returning a negative errno +upon failure. + +Fixes: ca0acb511c21 ("device property: Add fwnode_irq_get_byname") +Suggested-by: Sakari Ailus +Suggested-by: Jonathan Cameron +Signed-off-by: Matti Vaittinen +Reviewed-by: Andy Shevchenko +Reviewed-by: Jonathan Cameron + +Message-ID: <3e64fe592dc99e27ef9a0b247fc49fa26b6b8a58.1685340157.git.mazziesaccount@gmail.com> +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/base/property.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/drivers/base/property.c b/drivers/base/property.c +index 868adeac2a843..b0c40d9734847 100644 +--- a/drivers/base/property.c ++++ b/drivers/base/property.c +@@ -979,12 +979,18 @@ EXPORT_SYMBOL(fwnode_iomap); + * @fwnode: Pointer to the firmware node + * @index: Zero-based index of the IRQ + * +- * Return: Linux IRQ number on success. Other values are determined +- * according to acpi_irq_get() or of_irq_get() operation. ++ * Return: Linux IRQ number on success. Negative errno on failure. + */ + int fwnode_irq_get(const struct fwnode_handle *fwnode, unsigned int index) + { +- return fwnode_call_int_op(fwnode, irq_get, index); ++ int ret; ++ ++ ret = fwnode_call_int_op(fwnode, irq_get, index); ++ /* We treat mapping errors as invalid case */ ++ if (ret == 0) ++ return -EINVAL; ++ ++ return ret; + } + EXPORT_SYMBOL(fwnode_irq_get); + +-- +2.39.2 + diff --git a/queue-6.1/drm-amd-don-t-try-to-enable-secure-display-ta-multip.patch b/queue-6.1/drm-amd-don-t-try-to-enable-secure-display-ta-multip.patch new file mode 100644 index 00000000000..b27fe564eec --- /dev/null +++ b/queue-6.1/drm-amd-don-t-try-to-enable-secure-display-ta-multip.patch @@ -0,0 +1,40 @@ +From 1f573a57e2fd690e6a4d38b72a7f403e9db64620 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jun 2023 22:18:39 -0500 +Subject: drm/amd: Don't try to enable secure display TA multiple times + +From: Mario Limonciello + +[ Upstream commit 5c6d52ff4b61e5267b25be714eb5a9ba2a338199 ] + +If the securedisplay TA failed to load the first time, it's unlikely +to work again after a suspend/resume cycle or reset cycle and it appears +to be causing problems in futher attempts. + +Fixes: e42dfa66d592 ("drm/amdgpu: Add secure display TA load for Renoir") +Reported-by: Filip Hejsek +Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/2633 +Signed-off-by: Mario Limonciello +Acked-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +index a3cd816f98a14..0af9fb4098e8a 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +@@ -1959,6 +1959,8 @@ static int psp_securedisplay_initialize(struct psp_context *psp) + psp_securedisplay_parse_resp_status(psp, securedisplay_cmd->status); + dev_err(psp->adev->dev, "SECUREDISPLAY: query securedisplay TA failed. ret 0x%x\n", + securedisplay_cmd->securedisplay_out_message.query_ta.query_cmd_ret); ++ /* don't try again */ ++ psp->securedisplay_context.context.bin_desc.size_bytes = 0; + } + + return 0; +-- +2.39.2 + diff --git a/queue-6.1/drm-amdgpu-fix-number-of-fence-calculations.patch b/queue-6.1/drm-amdgpu-fix-number-of-fence-calculations.patch new file mode 100644 index 00000000000..09c94f4d0f2 --- /dev/null +++ b/queue-6.1/drm-amdgpu-fix-number-of-fence-calculations.patch @@ -0,0 +1,63 @@ +From 202ee51e08d4cf8a1a209bae02e60eb3d9bd46ae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jun 2023 13:18:13 +0200 +Subject: drm/amdgpu: fix number of fence calculations +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Christian König + +[ Upstream commit 570b295248b00c3cf4cf59e397de5cb2361e10c2 ] + +Since adding gang submit we need to take the gang size into account +while reserving fences. + +Signed-off-by: Christian König +Fixes: 4624459c84d7 ("drm/amdgpu: add gang submit frontend v6") +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c +index 365e3fb6a9e5b..b60b6e6149bf7 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c +@@ -129,9 +129,6 @@ static int amdgpu_cs_p1_user_fence(struct amdgpu_cs_parser *p, + bo = amdgpu_bo_ref(gem_to_amdgpu_bo(gobj)); + p->uf_entry.priority = 0; + p->uf_entry.tv.bo = &bo->tbo; +- /* One for TTM and two for the CS job */ +- p->uf_entry.tv.num_shared = 3; +- + drm_gem_object_put(gobj); + + size = amdgpu_bo_size(bo); +@@ -883,15 +880,19 @@ static int amdgpu_cs_parser_bos(struct amdgpu_cs_parser *p, + + mutex_lock(&p->bo_list->bo_list_mutex); + +- /* One for TTM and one for the CS job */ ++ /* One for TTM and one for each CS job */ + amdgpu_bo_list_for_each_entry(e, p->bo_list) +- e->tv.num_shared = 2; ++ e->tv.num_shared = 1 + p->gang_size; ++ p->uf_entry.tv.num_shared = 1 + p->gang_size; + + amdgpu_bo_list_get_list(p->bo_list, &p->validated); + + INIT_LIST_HEAD(&duplicates); + amdgpu_vm_get_pd_bo(&fpriv->vm, &p->validated, &p->vm_pd); + ++ /* Two for VM updates, one for TTM and one for each CS job */ ++ p->vm_pd.tv.num_shared = 3 + p->gang_size; ++ + if (p->uf_entry.tv.bo && !ttm_to_amdgpu_bo(p->uf_entry.tv.bo)->parent) + list_add(&p->uf_entry.tv.head, &p->validated); + +-- +2.39.2 + diff --git a/queue-6.1/drm-i915-guc-slpc-apply-min-softlimit-correctly.patch b/queue-6.1/drm-i915-guc-slpc-apply-min-softlimit-correctly.patch new file mode 100644 index 00000000000..28d0d0055ba --- /dev/null +++ b/queue-6.1/drm-i915-guc-slpc-apply-min-softlimit-correctly.patch @@ -0,0 +1,53 @@ +From cd39c8b610ed29150612e36364fdaac7380def97 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jun 2023 18:42:57 -0700 +Subject: drm/i915/guc/slpc: Apply min softlimit correctly + +From: Vinay Belgaumkar + +[ Upstream commit 3e49de73fb89272dea01ba420c7ccbcf6b96aed7 ] + +The scenario being fixed here is depicted in the following sequence- + +modprobe i915 +echo 1 > /sys/class/drm/card0/gt/gt0/slpc_ignore_eff_freq +echo 300 > /sys/class/drm/card0/gt_min_freq_mhz (RPn) +cat /sys/class/drm/card0/gt_cur_freq_mhz --> cur == RPn as expected +echo 1 > /sys/kernel/debug/dri/0/gt0/reset --> reset +cat /sys/class/drm/card0/gt_min_freq_mhz --> cached freq is RPn +cat /sys/class/drm/card0/gt_cur_freq_mhz --> it's not RPn, but RPe!! + +When SLPC reinitializes, it sets SLPC min freq to efficient frequency. +Even if we disable efficient freq post that, we should restore the cached +min freq (via H2G) for it to take effect. + +v2: Clarify commit message (Ashutosh) + +Fixes: 95ccf312a1e4 ("drm/i915/guc/slpc: Allow SLPC to use efficient frequency") +Reviewed-by: Ashutosh Dixit +Signed-off-by: Vinay Belgaumkar +Signed-off-by: Daniele Ceraolo Spurio +Link: https://patchwork.freedesktop.org/patch/msgid/20230621014257.1769564-1-vinay.belgaumkar@intel.com +(cherry picked from commit da86b2b13f1d1ca26745b951ac94421f3137539a) +Signed-off-by: Tvrtko Ursulin +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/gt/uc/intel_guc_slpc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/i915/gt/uc/intel_guc_slpc.c b/drivers/gpu/drm/i915/gt/uc/intel_guc_slpc.c +index fdd895f73f9f1..72ba1c758ca79 100644 +--- a/drivers/gpu/drm/i915/gt/uc/intel_guc_slpc.c ++++ b/drivers/gpu/drm/i915/gt/uc/intel_guc_slpc.c +@@ -580,7 +580,7 @@ static int slpc_set_softlimits(struct intel_guc_slpc *slpc) + if (unlikely(ret)) + return ret; + slpc_to_gt(slpc)->defaults.min_freq = slpc->min_freq_softlimit; +- } else if (slpc->min_freq_softlimit != slpc->min_freq) { ++ } else { + return intel_guc_slpc_set_min_freq(slpc, + slpc->min_freq_softlimit); + } +-- +2.39.2 + diff --git a/queue-6.1/drm-i915-psr-use-hw.adjusted-mode-when-calculating-i.patch b/queue-6.1/drm-i915-psr-use-hw.adjusted-mode-when-calculating-i.patch new file mode 100644 index 00000000000..36053381b58 --- /dev/null +++ b/queue-6.1/drm-i915-psr-use-hw.adjusted-mode-when-calculating-i.patch @@ -0,0 +1,52 @@ +From e38104c8b3c6a71a8c4233629035bf4616b46135 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jun 2023 14:17:45 +0300 +Subject: drm/i915/psr: Use hw.adjusted mode when calculating io/fast wake + times +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jouni Högander + +[ Upstream commit 5311892a0ad1d301aafd53ca0154091b3eb407ea ] + +Encoder compute config is changing hw.adjusted mode. Uapi.adjusted mode +doesn't get updated before psr compute config gets called. This causes io +and fast wake line calculation using adjusted mode containing values before +encoder adjustments. Fix this by using hw.adjusted mode instead of +uapi.adjusted mode. + +Cc: Stanislav Lisovskiy + +Signed-off-by: Jouni Högander +Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/8475 +Fixes: cb42e8ede5b4 ("drm/i915/psr: Use calculated io and fast wake lines") +Reviewed-by: Mika Kahola +Link: https://patchwork.freedesktop.org/patch/msgid/20230620111745.2870706-1-jouni.hogander@intel.com +(cherry picked from commit ef0af9db2a21257885116949f471fe5565b2f0ab) +Signed-off-by: Tvrtko Ursulin +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/display/intel_psr.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/i915/display/intel_psr.c b/drivers/gpu/drm/i915/display/intel_psr.c +index bf18423c7a005..e2d7c0a6802aa 100644 +--- a/drivers/gpu/drm/i915/display/intel_psr.c ++++ b/drivers/gpu/drm/i915/display/intel_psr.c +@@ -857,9 +857,9 @@ static bool _compute_psr2_wake_times(struct intel_dp *intel_dp, + } + + io_wake_lines = intel_usecs_to_scanlines( +- &crtc_state->uapi.adjusted_mode, io_wake_time); ++ &crtc_state->hw.adjusted_mode, io_wake_time); + fast_wake_lines = intel_usecs_to_scanlines( +- &crtc_state->uapi.adjusted_mode, fast_wake_time); ++ &crtc_state->hw.adjusted_mode, fast_wake_time); + + if (io_wake_lines > max_wake_lines || + fast_wake_lines > max_wake_lines) +-- +2.39.2 + diff --git a/queue-6.1/dt-bindings-power-reset-qcom-pon-only-allow-reboot-m.patch b/queue-6.1/dt-bindings-power-reset-qcom-pon-only-allow-reboot-m.patch new file mode 100644 index 00000000000..262599f4876 --- /dev/null +++ b/queue-6.1/dt-bindings-power-reset-qcom-pon-only-allow-reboot-m.patch @@ -0,0 +1,53 @@ +From cfcc0992266ac8da707d131bb9560e31cab271ae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Apr 2023 12:41:06 +0200 +Subject: dt-bindings: power: reset: qcom-pon: Only allow reboot-mode + pre-pmk8350 + +From: Konrad Dybcio + +[ Upstream commit d41dab4c031edaa460a484113394327aa52dc0bd ] + +As pointed out by Shazad [1], PMICs using a separate HLOS+PBS scheme +(so PMK8350 and newer) are expected to pass reboot mode data through SDAM, +as the reboot mode registers are absent in the HLOS reg space. + +Limit the reboot-mode.yaml inclusion to PMICs without a separate PBS +region. + +[1] https://lore.kernel.org/linux-arm-msm/12f13183-c381-25f7-459e-62e0c2b19498@quicinc.com/ + +Fixes: 03fccdc76dce ("dt-bindings: power: reset: qcom-pon: Add new compatible "qcom,pmk8350-pon"") +Signed-off-by: Konrad Dybcio +Acked-by: Rob Herring +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + Documentation/devicetree/bindings/power/reset/qcom,pon.yaml | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/Documentation/devicetree/bindings/power/reset/qcom,pon.yaml b/Documentation/devicetree/bindings/power/reset/qcom,pon.yaml +index d96170eecbd22..0b1eca734d3b1 100644 +--- a/Documentation/devicetree/bindings/power/reset/qcom,pon.yaml ++++ b/Documentation/devicetree/bindings/power/reset/qcom,pon.yaml +@@ -56,7 +56,6 @@ required: + unevaluatedProperties: false + + allOf: +- - $ref: reboot-mode.yaml# + - if: + properties: + compatible: +@@ -66,6 +65,9 @@ allOf: + - qcom,pms405-pon + - qcom,pm8998-pon + then: ++ allOf: ++ - $ref: reboot-mode.yaml# ++ + properties: + reg: + maxItems: 1 +-- +2.39.2 + diff --git a/queue-6.1/extcon-fix-kernel-doc-of-property-capability-fields-.patch b/queue-6.1/extcon-fix-kernel-doc-of-property-capability-fields-.patch new file mode 100644 index 00000000000..72b8a2a46f0 --- /dev/null +++ b/queue-6.1/extcon-fix-kernel-doc-of-property-capability-fields-.patch @@ -0,0 +1,46 @@ +From aefc608180ab29e3d722da0458ed446fc305b9cb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Mar 2023 16:39:53 +0200 +Subject: extcon: Fix kernel doc of property capability fields to avoid + warnings + +From: Andy Shevchenko + +[ Upstream commit 73346b9965ebda2feb7fef8629e9b28baee820e3 ] + +Kernel documentation has to be synchronized with a code, otherwise +the validator is not happy: + + Function parameter or member 'usb_bits' not described in 'extcon_cable' + Function parameter or member 'chg_bits' not described in 'extcon_cable' + Function parameter or member 'jack_bits' not described in 'extcon_cable' + Function parameter or member 'disp_bits' not described in 'extcon_cable' + +Describe the fields added in the past. + +Fixes: ceaa98f442cf ("extcon: Add the support for the capability of each property") +Signed-off-by: Andy Shevchenko +Signed-off-by: Chanwoo Choi +Signed-off-by: Sasha Levin +--- + drivers/extcon/extcon.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/extcon/extcon.c b/drivers/extcon/extcon.c +index 01fd920685c2c..7141dd0d407d8 100644 +--- a/drivers/extcon/extcon.c ++++ b/drivers/extcon/extcon.c +@@ -210,6 +210,10 @@ static const struct __extcon_info { + * @chg_propval: the array of charger connector properties + * @jack_propval: the array of jack connector properties + * @disp_propval: the array of display connector properties ++ * @usb_bits: the bit array of the USB connector property capabilities ++ * @chg_bits: the bit array of the charger connector property capabilities ++ * @jack_bits: the bit array of the jack connector property capabilities ++ * @disp_bits: the bit array of the display connector property capabilities + */ + struct extcon_cable { + struct extcon_dev *edev; +-- +2.39.2 + diff --git a/queue-6.1/extcon-fix-kernel-doc-of-property-fields-to-avoid-wa.patch b/queue-6.1/extcon-fix-kernel-doc-of-property-fields-to-avoid-wa.patch new file mode 100644 index 00000000000..b218694caaf --- /dev/null +++ b/queue-6.1/extcon-fix-kernel-doc-of-property-fields-to-avoid-wa.patch @@ -0,0 +1,45 @@ +From de0f1ab292a4a300977d550ff73752b008ed3b1d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Mar 2023 16:39:52 +0200 +Subject: extcon: Fix kernel doc of property fields to avoid warnings + +From: Andy Shevchenko + +[ Upstream commit 7e77e0b7a9f4cdf91cb0950749b40c840ea63efc ] + +Kernel documentation has to be synchronized with a code, otherwise +the validator is not happy: + + Function parameter or member 'usb_propval' not described in 'extcon_cable' + Function parameter or member 'chg_propval' not described in 'extcon_cable' + Function parameter or member 'jack_propval' not described in 'extcon_cable' + Function parameter or member 'disp_propval' not described in 'extcon_cable' + +Describe the fields added in the past. + +Fixes: 067c1652e7a7 ("extcon: Add the support for extcon property according to extcon type") +Signed-off-by: Andy Shevchenko +Signed-off-by: Chanwoo Choi +Signed-off-by: Sasha Levin +--- + drivers/extcon/extcon.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/extcon/extcon.c b/drivers/extcon/extcon.c +index e1c71359b6051..01fd920685c2c 100644 +--- a/drivers/extcon/extcon.c ++++ b/drivers/extcon/extcon.c +@@ -206,6 +206,10 @@ static const struct __extcon_info { + * @attr_name: "name" sysfs entry + * @attr_state: "state" sysfs entry + * @attrs: the array pointing to attr_name and attr_state for attr_g ++ * @usb_propval: the array of USB connector properties ++ * @chg_propval: the array of charger connector properties ++ * @jack_propval: the array of jack connector properties ++ * @disp_propval: the array of display connector properties + */ + struct extcon_cable { + struct extcon_dev *edev; +-- +2.39.2 + diff --git a/queue-6.1/f2fs-check-return-value-of-freeze_super.patch b/queue-6.1/f2fs-check-return-value-of-freeze_super.patch new file mode 100644 index 00000000000..1fd0c205001 --- /dev/null +++ b/queue-6.1/f2fs-check-return-value-of-freeze_super.patch @@ -0,0 +1,39 @@ +From 9b946fdbf7cdb4ff9ee08c7db7927cbc5db65a98 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Jun 2023 14:19:01 +0800 +Subject: f2fs: check return value of freeze_super() + +From: Chao Yu + +[ Upstream commit 8bec7dd1b3f7d7769d433d67bde404de948a2d95 ] + +freeze_super() can fail, it needs to check its return value and do +error handling in f2fs_resize_fs(). + +Fixes: 04f0b2eaa3b3 ("f2fs: ioctl for removing a range from F2FS") +Fixes: b4b10061ef98 ("f2fs: refactor resize_fs to avoid meta updates in progress") +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/gc.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c +index 3de887d07c060..aa4d513daa8f8 100644 +--- a/fs/f2fs/gc.c ++++ b/fs/f2fs/gc.c +@@ -2186,7 +2186,9 @@ int f2fs_resize_fs(struct file *filp, __u64 block_count) + if (err) + return err; + +- freeze_super(sbi->sb); ++ err = freeze_super(sbi->sb); ++ if (err) ++ return err; + + if (f2fs_readonly(sbi->sb)) { + thaw_super(sbi->sb); +-- +2.39.2 + diff --git a/queue-6.1/f2fs-do-not-allow-to-defragment-files-have-fi_compre.patch b/queue-6.1/f2fs-do-not-allow-to-defragment-files-have-fi_compre.patch new file mode 100644 index 00000000000..93a775a9bcf --- /dev/null +++ b/queue-6.1/f2fs-do-not-allow-to-defragment-files-have-fi_compre.patch @@ -0,0 +1,49 @@ +From 88a00c360eaf69e8c81073b09dcb5ca52aba261b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Apr 2023 00:47:11 +0800 +Subject: f2fs: do not allow to defragment files have FI_COMPRESS_RELEASED + +From: Yangtao Li + +[ Upstream commit 7cd2e5f75b86a1befa99834f3ed1d735eeff69e6 ] + +If a file has FI_COMPRESS_RELEASED, all writes for it should not be +allowed. + +Fixes: 5fdb322ff2c2 ("f2fs: add F2FS_IOC_DECOMPRESS_FILE and F2FS_IOC_COMPRESS_FILE") +Signed-off-by: Qi Han +Signed-off-by: Yangtao Li +Reviewed-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/file.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c +index dbad2db68f1bc..370c40858b42f 100644 +--- a/fs/f2fs/file.c ++++ b/fs/f2fs/file.c +@@ -2588,6 +2588,11 @@ static int f2fs_defragment_range(struct f2fs_sb_info *sbi, + + inode_lock(inode); + ++ if (is_inode_flag_set(inode, FI_COMPRESS_RELEASED)) { ++ err = -EINVAL; ++ goto unlock_out; ++ } ++ + /* if in-place-update policy is enabled, don't waste time here */ + set_inode_flag(inode, FI_OPU_WRITE); + if (f2fs_should_update_inplace(inode, NULL)) { +@@ -2712,6 +2717,7 @@ static int f2fs_defragment_range(struct f2fs_sb_info *sbi, + clear_inode_flag(inode, FI_SKIP_WRITES); + out: + clear_inode_flag(inode, FI_OPU_WRITE); ++unlock_out: + inode_unlock(inode); + if (!err) + range->len = (u64)total << PAGE_SHIFT; +-- +2.39.2 + diff --git a/queue-6.1/f2fs-fix-error-path-handling-in-truncate_dnode.patch b/queue-6.1/f2fs-fix-error-path-handling-in-truncate_dnode.patch new file mode 100644 index 00000000000..25f6b5d4fc0 --- /dev/null +++ b/queue-6.1/f2fs-fix-error-path-handling-in-truncate_dnode.patch @@ -0,0 +1,39 @@ +From 9aadadd22512620a51ae34210180259ed712c18c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Jun 2023 09:41:02 +0800 +Subject: f2fs: fix error path handling in truncate_dnode() + +From: Chao Yu + +[ Upstream commit 0135c482fa97e2fd8245cb462784112a00ed1211 ] + +If truncate_node() fails in truncate_dnode(), it missed to call +f2fs_put_page(), fix it. + +Fixes: 7735730d39d7 ("f2fs: fix to propagate error from __get_meta_page()") +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/node.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c +index 07419c3e42a52..a010b4bc36d2c 100644 +--- a/fs/f2fs/node.c ++++ b/fs/f2fs/node.c +@@ -941,8 +941,10 @@ static int truncate_dnode(struct dnode_of_data *dn) + dn->ofs_in_node = 0; + f2fs_truncate_data_blocks(dn); + err = truncate_node(dn); +- if (err) ++ if (err) { ++ f2fs_put_page(page, 1); + return err; ++ } + + return 1; + } +-- +2.39.2 + diff --git a/queue-6.1/f2fs-fix-potential-deadlock-due-to-unpaired-node_wri.patch b/queue-6.1/f2fs-fix-potential-deadlock-due-to-unpaired-node_wri.patch new file mode 100644 index 00000000000..eb01c4eac11 --- /dev/null +++ b/queue-6.1/f2fs-fix-potential-deadlock-due-to-unpaired-node_wri.patch @@ -0,0 +1,108 @@ +From 4c345f909fdf1363d3da790a1341096fac3f3ac1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 14 May 2023 16:07:23 +0800 +Subject: f2fs: fix potential deadlock due to unpaired node_write lock use + +From: Chao Yu + +[ Upstream commit f082c6b205a06953f26c40bdc7621cc5a58ceb7c ] + +If S_NOQUOTA is cleared from inode during data page writeback of quota +file, it may miss to unlock node_write lock, result in potential +deadlock, fix to use the lock in paired. + +Kworker Thread +- writepage + if (IS_NOQUOTA()) + f2fs_down_read(&sbi->node_write); + - vfs_cleanup_quota_inode + - inode->i_flags &= ~S_NOQUOTA; + if (IS_NOQUOTA()) + f2fs_up_read(&sbi->node_write); + +Fixes: 79963d967b49 ("f2fs: shrink node_write lock coverage") +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/compress.c | 7 ++++--- + fs/f2fs/data.c | 7 ++++--- + 2 files changed, 8 insertions(+), 6 deletions(-) + +diff --git a/fs/f2fs/compress.c b/fs/f2fs/compress.c +index b160863eca141..e50d5848c1001 100644 +--- a/fs/f2fs/compress.c ++++ b/fs/f2fs/compress.c +@@ -1235,6 +1235,7 @@ static int f2fs_write_compressed_pages(struct compress_ctx *cc, + unsigned int last_index = cc->cluster_size - 1; + loff_t psize; + int i, err; ++ bool quota_inode = IS_NOQUOTA(inode); + + /* we should bypass data pages to proceed the kworkder jobs */ + if (unlikely(f2fs_cp_error(sbi))) { +@@ -1242,7 +1243,7 @@ static int f2fs_write_compressed_pages(struct compress_ctx *cc, + goto out_free; + } + +- if (IS_NOQUOTA(inode)) { ++ if (quota_inode) { + /* + * We need to wait for node_write to avoid block allocation during + * checkpoint. This can only happen to quota writes which can cause +@@ -1364,7 +1365,7 @@ static int f2fs_write_compressed_pages(struct compress_ctx *cc, + set_inode_flag(inode, FI_FIRST_BLOCK_WRITTEN); + + f2fs_put_dnode(&dn); +- if (IS_NOQUOTA(inode)) ++ if (quota_inode) + f2fs_up_read(&sbi->node_write); + else + f2fs_unlock_op(sbi); +@@ -1390,7 +1391,7 @@ static int f2fs_write_compressed_pages(struct compress_ctx *cc, + out_put_dnode: + f2fs_put_dnode(&dn); + out_unlock_op: +- if (IS_NOQUOTA(inode)) ++ if (quota_inode) + f2fs_up_read(&sbi->node_write); + else + f2fs_unlock_op(sbi); +diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c +index 36db9aab47790..c230824ab5e6e 100644 +--- a/fs/f2fs/data.c ++++ b/fs/f2fs/data.c +@@ -2759,6 +2759,7 @@ int f2fs_write_single_data_page(struct page *page, int *submitted, + loff_t psize = (loff_t)(page->index + 1) << PAGE_SHIFT; + unsigned offset = 0; + bool need_balance_fs = false; ++ bool quota_inode = IS_NOQUOTA(inode); + int err = 0; + struct f2fs_io_info fio = { + .sbi = sbi, +@@ -2816,19 +2817,19 @@ int f2fs_write_single_data_page(struct page *page, int *submitted, + goto out; + + /* Dentry/quota blocks are controlled by checkpoint */ +- if (S_ISDIR(inode->i_mode) || IS_NOQUOTA(inode)) { ++ if (S_ISDIR(inode->i_mode) || quota_inode) { + /* + * We need to wait for node_write to avoid block allocation during + * checkpoint. This can only happen to quota writes which can cause + * the below discard race condition. + */ +- if (IS_NOQUOTA(inode)) ++ if (quota_inode) + f2fs_down_read(&sbi->node_write); + + fio.need_lock = LOCK_DONE; + err = f2fs_do_write_data_page(&fio); + +- if (IS_NOQUOTA(inode)) ++ if (quota_inode) + f2fs_up_read(&sbi->node_write); + + goto done; +-- +2.39.2 + diff --git a/queue-6.1/f2fs-fix-to-avoid-null-pointer-dereference-f2fs_writ.patch b/queue-6.1/f2fs-fix-to-avoid-null-pointer-dereference-f2fs_writ.patch new file mode 100644 index 00000000000..70c378dc504 --- /dev/null +++ b/queue-6.1/f2fs-fix-to-avoid-null-pointer-dereference-f2fs_writ.patch @@ -0,0 +1,161 @@ +From 187167ba3fca48210bf32c20943f6be8ab0747a2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 May 2023 14:17:25 +0800 +Subject: f2fs: fix to avoid NULL pointer dereference f2fs_write_end_io() + +From: Chao Yu + +[ Upstream commit d8189834d4348ae608083e1f1f53792cfcc2a9bc ] + +butt3rflyh4ck reports a bug as below: + +When a thread always calls F2FS_IOC_RESIZE_FS to resize fs, if resize fs is +failed, f2fs kernel thread would invoke callback function to update f2fs io +info, it would call f2fs_write_end_io and may trigger null-ptr-deref in +NODE_MAPPING. + +general protection fault, probably for non-canonical address +KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037] +RIP: 0010:NODE_MAPPING fs/f2fs/f2fs.h:1972 [inline] +RIP: 0010:f2fs_write_end_io+0x727/0x1050 fs/f2fs/data.c:370 + + bio_endio+0x5af/0x6c0 block/bio.c:1608 + req_bio_endio block/blk-mq.c:761 [inline] + blk_update_request+0x5cc/0x1690 block/blk-mq.c:906 + blk_mq_end_request+0x59/0x4c0 block/blk-mq.c:1023 + lo_complete_rq+0x1c6/0x280 drivers/block/loop.c:370 + blk_complete_reqs+0xad/0xe0 block/blk-mq.c:1101 + __do_softirq+0x1d4/0x8ef kernel/softirq.c:571 + run_ksoftirqd kernel/softirq.c:939 [inline] + run_ksoftirqd+0x31/0x60 kernel/softirq.c:931 + smpboot_thread_fn+0x659/0x9e0 kernel/smpboot.c:164 + kthread+0x33e/0x440 kernel/kthread.c:379 + ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308 + +The root cause is below race case can cause leaving dirty metadata +in f2fs after filesystem is remount as ro: + +Thread A Thread B +- f2fs_ioc_resize_fs + - f2fs_readonly --- return false + - f2fs_resize_fs + - f2fs_remount + - write_checkpoint + - set f2fs as ro + - free_segment_range + - update meta_inode's data + +Then, if f2fs_put_super() fails to write_checkpoint due to readonly +status, and meta_inode's dirty data will be writebacked after node_inode +is put, finally, f2fs_write_end_io will access NULL pointer on +sbi->node_inode. + +Thread A IRQ context +- f2fs_put_super + - write_checkpoint fails + - iput(node_inode) + - node_inode = NULL + - iput(meta_inode) + - write_inode_now + - f2fs_write_meta_page + - f2fs_write_end_io + - NODE_MAPPING(sbi) + : access NULL pointer on node_inode + +Fixes: b4b10061ef98 ("f2fs: refactor resize_fs to avoid meta updates in progress") +Reported-by: butt3rflyh4ck +Closes: https://lore.kernel.org/r/1684480657-2375-1-git-send-email-yangtiezhu@loongson.cn +Tested-by: butt3rflyh4ck +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/f2fs.h | 2 +- + fs/f2fs/file.c | 2 +- + fs/f2fs/gc.c | 21 ++++++++++++++++++--- + 3 files changed, 20 insertions(+), 5 deletions(-) + +diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h +index 8d7dc76e6f935..4d1e48c676fab 100644 +--- a/fs/f2fs/f2fs.h ++++ b/fs/f2fs/f2fs.h +@@ -3817,7 +3817,7 @@ void f2fs_stop_gc_thread(struct f2fs_sb_info *sbi); + block_t f2fs_start_bidx_of_node(unsigned int node_ofs, struct inode *inode); + int f2fs_gc(struct f2fs_sb_info *sbi, struct f2fs_gc_control *gc_control); + void f2fs_build_gc_manager(struct f2fs_sb_info *sbi); +-int f2fs_resize_fs(struct f2fs_sb_info *sbi, __u64 block_count); ++int f2fs_resize_fs(struct file *filp, __u64 block_count); + int __init f2fs_create_garbage_collection_cache(void); + void f2fs_destroy_garbage_collection_cache(void); + +diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c +index 370c40858b42f..7b94f047cbf79 100644 +--- a/fs/f2fs/file.c ++++ b/fs/f2fs/file.c +@@ -3279,7 +3279,7 @@ static int f2fs_ioc_resize_fs(struct file *filp, unsigned long arg) + sizeof(block_count))) + return -EFAULT; + +- return f2fs_resize_fs(sbi, block_count); ++ return f2fs_resize_fs(filp, block_count); + } + + static int f2fs_ioc_enable_verity(struct file *filp, unsigned long arg) +diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c +index 7e497f5b349ce..3de887d07c060 100644 +--- a/fs/f2fs/gc.c ++++ b/fs/f2fs/gc.c +@@ -2110,8 +2110,9 @@ static void update_fs_metadata(struct f2fs_sb_info *sbi, int secs) + } + } + +-int f2fs_resize_fs(struct f2fs_sb_info *sbi, __u64 block_count) ++int f2fs_resize_fs(struct file *filp, __u64 block_count) + { ++ struct f2fs_sb_info *sbi = F2FS_I_SB(file_inode(filp)); + __u64 old_block_count, shrunk_blocks; + struct cp_control cpc = { CP_RESIZE, 0, 0, 0 }; + unsigned int secs; +@@ -2149,12 +2150,18 @@ int f2fs_resize_fs(struct f2fs_sb_info *sbi, __u64 block_count) + return -EINVAL; + } + ++ err = mnt_want_write_file(filp); ++ if (err) ++ return err; ++ + shrunk_blocks = old_block_count - block_count; + secs = div_u64(shrunk_blocks, BLKS_PER_SEC(sbi)); + + /* stop other GC */ +- if (!f2fs_down_write_trylock(&sbi->gc_lock)) +- return -EAGAIN; ++ if (!f2fs_down_write_trylock(&sbi->gc_lock)) { ++ err = -EAGAIN; ++ goto out_drop_write; ++ } + + /* stop CP to protect MAIN_SEC in free_segment_range */ + f2fs_lock_op(sbi); +@@ -2174,10 +2181,18 @@ int f2fs_resize_fs(struct f2fs_sb_info *sbi, __u64 block_count) + out_unlock: + f2fs_unlock_op(sbi); + f2fs_up_write(&sbi->gc_lock); ++out_drop_write: ++ mnt_drop_write_file(filp); + if (err) + return err; + + freeze_super(sbi->sb); ++ ++ if (f2fs_readonly(sbi->sb)) { ++ thaw_super(sbi->sb); ++ return -EROFS; ++ } ++ + f2fs_down_write(&sbi->gc_lock); + f2fs_down_write(&sbi->cp_global_sem); + +-- +2.39.2 + diff --git a/queue-6.1/fanotify-disallow-mount-sb-marks-on-kernel-internal-.patch b/queue-6.1/fanotify-disallow-mount-sb-marks-on-kernel-internal-.patch new file mode 100644 index 00000000000..5d42e7773a4 --- /dev/null +++ b/queue-6.1/fanotify-disallow-mount-sb-marks-on-kernel-internal-.patch @@ -0,0 +1,54 @@ +From a001136e4aa6e16a8177b57185e78aefc6ae797f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Jun 2023 07:20:44 +0300 +Subject: fanotify: disallow mount/sb marks on kernel internal pseudo fs + +From: Amir Goldstein + +[ Upstream commit 69562eb0bd3e6bb8e522a7b254334e0fb30dff0c ] + +Hopefully, nobody is trying to abuse mount/sb marks for watching all +anonymous pipes/inodes. + +I cannot think of a good reason to allow this - it looks like an +oversight that dated back to the original fanotify API. + +Link: https://lore.kernel.org/linux-fsdevel/20230628101132.kvchg544mczxv2pm@quack3/ +Fixes: 0ff21db9fcc3 ("fanotify: hooks the fanotify_mark syscall to the vfsmount code") +Signed-off-by: Amir Goldstein +Reviewed-by: Christian Brauner +Signed-off-by: Jan Kara +Message-Id: <20230629042044.25723-1-amir73il@gmail.com> +Signed-off-by: Sasha Levin +--- + fs/notify/fanotify/fanotify_user.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +diff --git a/fs/notify/fanotify/fanotify_user.c b/fs/notify/fanotify/fanotify_user.c +index 4546da4a54f95..9df5db0f10ff2 100644 +--- a/fs/notify/fanotify/fanotify_user.c ++++ b/fs/notify/fanotify/fanotify_user.c +@@ -1574,6 +1574,20 @@ static int fanotify_events_supported(struct fsnotify_group *group, + path->mnt->mnt_sb->s_type->fs_flags & FS_DISALLOW_NOTIFY_PERM) + return -EINVAL; + ++ /* ++ * mount and sb marks are not allowed on kernel internal pseudo fs, ++ * like pipe_mnt, because that would subscribe to events on all the ++ * anonynous pipes in the system. ++ * ++ * SB_NOUSER covers all of the internal pseudo fs whose objects are not ++ * exposed to user's mount namespace, but there are other SB_KERNMOUNT ++ * fs, like nsfs, debugfs, for which the value of allowing sb and mount ++ * mark is questionable. For now we leave them alone. ++ */ ++ if (mark_type != FAN_MARK_INODE && ++ path->mnt->mnt_sb->s_flags & SB_NOUSER) ++ return -EINVAL; ++ + /* + * We shouldn't have allowed setting dirent events and the directory + * flags FAN_ONDIR and FAN_EVENT_ON_CHILD in mask of non-dir inode, +-- +2.39.2 + diff --git a/queue-6.1/gfs2-fix-duplicate-should_fault_in_pages-call.patch b/queue-6.1/gfs2-fix-duplicate-should_fault_in_pages-call.patch new file mode 100644 index 00000000000..30a21e9db48 --- /dev/null +++ b/queue-6.1/gfs2-fix-duplicate-should_fault_in_pages-call.patch @@ -0,0 +1,43 @@ +From 7c4e1b7b2443c10f55da810ca1dd5dbd1b5327a0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Jun 2023 12:26:23 -0500 +Subject: gfs2: Fix duplicate should_fault_in_pages() call + +From: Bob Peterson + +[ Upstream commit c8ed1b35931245087968fd95b2ec3dfc50f77769 ] + +In gfs2_file_buffered_write(), we currently jump from the second call of +function should_fault_in_pages() to above the first call, so +should_fault_in_pages() is getting called twice in a row, causing it to +accidentally fall back to single-page writes rather than trying the more +efficient multi-page writes first. + +Fix that by moving the retry label to the correct place, behind the +first call to should_fault_in_pages(). + +Fixes: e1fa9ea85ce8 ("gfs2: Stop using glock holder auto-demotion for now") +Signed-off-by: Bob Peterson +Signed-off-by: Andreas Gruenbacher +Signed-off-by: Sasha Levin +--- + fs/gfs2/file.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/gfs2/file.c b/fs/gfs2/file.c +index bc6cd5f4b1077..c367f1678d5dc 100644 +--- a/fs/gfs2/file.c ++++ b/fs/gfs2/file.c +@@ -1029,8 +1029,8 @@ static ssize_t gfs2_file_buffered_write(struct kiocb *iocb, + } + + gfs2_holder_init(ip->i_gl, LM_ST_EXCLUSIVE, 0, gh); +-retry: + if (should_fault_in_pages(from, iocb, &prev_count, &window_size)) { ++retry: + window_size -= fault_in_iov_iter_readable(from, window_size); + if (!window_size) { + ret = -EFAULT; +-- +2.39.2 + diff --git a/queue-6.1/hwtracing-hisi_ptt-fix-potential-sleep-in-atomic-con.patch b/queue-6.1/hwtracing-hisi_ptt-fix-potential-sleep-in-atomic-con.patch new file mode 100644 index 00000000000..3d516378a0c --- /dev/null +++ b/queue-6.1/hwtracing-hisi_ptt-fix-potential-sleep-in-atomic-con.patch @@ -0,0 +1,96 @@ +From 7a422ad15e1c75f6fbd44c17e14c6fd5f2de1358 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Jun 2023 17:28:04 +0800 +Subject: hwtracing: hisi_ptt: Fix potential sleep in atomic context + +From: Yicong Yang + +[ Upstream commit 6c50384ef8b94a527445e3694ae6549e1f15d859 ] + +We're using pci_irq_vector() to obtain the interrupt number and then +bind it to the CPU start perf under the protection of spinlock in +pmu::start(). pci_irq_vector() might sleep since [1] because it will +call msi_domain_get_virq() to get the MSI interrupt number and it +needs to acquire dev->msi.data->mutex. Getting a mutex will sleep on +contention. So use pci_irq_vector() in an atomic context is problematic. + +This patch cached the interrupt number in the probe() and uses the +cached data instead to avoid potential sleep. + +[1] commit 82ff8e6b78fc ("PCI/MSI: Use msi_get_virq() in pci_get_vector()") + +Fixes: ff0de066b463 ("hwtracing: hisi_ptt: Add trace function support for HiSilicon PCIe Tune and Trace device") +Reviewed-by: Jonathan Cameron +Signed-off-by: Yicong Yang +Signed-off-by: Suzuki K Poulose +Link: https://lore.kernel.org/r/20230621092804.15120-6-yangyicong@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/ptt/hisi_ptt.c | 12 +++++------- + drivers/hwtracing/ptt/hisi_ptt.h | 2 ++ + 2 files changed, 7 insertions(+), 7 deletions(-) + +diff --git a/drivers/hwtracing/ptt/hisi_ptt.c b/drivers/hwtracing/ptt/hisi_ptt.c +index 30f1525639b57..4140efd664097 100644 +--- a/drivers/hwtracing/ptt/hisi_ptt.c ++++ b/drivers/hwtracing/ptt/hisi_ptt.c +@@ -341,13 +341,13 @@ static int hisi_ptt_register_irq(struct hisi_ptt *hisi_ptt) + if (ret < 0) + return ret; + +- ret = devm_request_threaded_irq(&pdev->dev, +- pci_irq_vector(pdev, HISI_PTT_TRACE_DMA_IRQ), ++ hisi_ptt->trace_irq = pci_irq_vector(pdev, HISI_PTT_TRACE_DMA_IRQ); ++ ret = devm_request_threaded_irq(&pdev->dev, hisi_ptt->trace_irq, + NULL, hisi_ptt_isr, 0, + DRV_NAME, hisi_ptt); + if (ret) { + pci_err(pdev, "failed to request irq %d, ret = %d\n", +- pci_irq_vector(pdev, HISI_PTT_TRACE_DMA_IRQ), ret); ++ hisi_ptt->trace_irq, ret); + return ret; + } + +@@ -757,8 +757,7 @@ static void hisi_ptt_pmu_start(struct perf_event *event, int flags) + * core in event_function_local(). If CPU passed is offline we'll fail + * here, just log it since we can do nothing here. + */ +- ret = irq_set_affinity(pci_irq_vector(hisi_ptt->pdev, HISI_PTT_TRACE_DMA_IRQ), +- cpumask_of(cpu)); ++ ret = irq_set_affinity(hisi_ptt->trace_irq, cpumask_of(cpu)); + if (ret) + dev_warn(dev, "failed to set the affinity of trace interrupt\n"); + +@@ -1018,8 +1017,7 @@ static int hisi_ptt_cpu_teardown(unsigned int cpu, struct hlist_node *node) + * Also make sure the interrupt bind to the migrated CPU as well. Warn + * the user on failure here. + */ +- if (irq_set_affinity(pci_irq_vector(hisi_ptt->pdev, HISI_PTT_TRACE_DMA_IRQ), +- cpumask_of(target))) ++ if (irq_set_affinity(hisi_ptt->trace_irq, cpumask_of(target))) + dev_warn(dev, "failed to set the affinity of trace interrupt\n"); + + hisi_ptt->trace_ctrl.on_cpu = target; +diff --git a/drivers/hwtracing/ptt/hisi_ptt.h b/drivers/hwtracing/ptt/hisi_ptt.h +index 5beb1648c93ab..948a4c4231527 100644 +--- a/drivers/hwtracing/ptt/hisi_ptt.h ++++ b/drivers/hwtracing/ptt/hisi_ptt.h +@@ -166,6 +166,7 @@ struct hisi_ptt_pmu_buf { + * @pdev: pci_dev of this PTT device + * @tune_lock: lock to serialize the tune process + * @pmu_lock: lock to serialize the perf process ++ * @trace_irq: interrupt number used by trace + * @upper_bdf: the upper BDF range of the PCI devices managed by this PTT device + * @lower_bdf: the lower BDF range of the PCI devices managed by this PTT device + * @port_filters: the filter list of root ports +@@ -180,6 +181,7 @@ struct hisi_ptt { + struct pci_dev *pdev; + struct mutex tune_lock; + spinlock_t pmu_lock; ++ int trace_irq; + u32 upper_bdf; + u32 lower_bdf; + +-- +2.39.2 + diff --git a/queue-6.1/i2c-xiic-don-t-try-to-handle-more-interrupt-events-a.patch b/queue-6.1/i2c-xiic-don-t-try-to-handle-more-interrupt-events-a.patch new file mode 100644 index 00000000000..4fb9f8c87da --- /dev/null +++ b/queue-6.1/i2c-xiic-don-t-try-to-handle-more-interrupt-events-a.patch @@ -0,0 +1,60 @@ +From daaebf1cd5b22603252040066a66720cd9065ca7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Jun 2023 12:25:58 -0600 +Subject: i2c: xiic: Don't try to handle more interrupt events after error + +From: Robert Hancock + +[ Upstream commit cb6e45c9a0ad9e0f8664fd06db0227d185dc76ab ] + +In xiic_process, it is possible that error events such as arbitration +lost or TX error can be raised in conjunction with other interrupt flags +such as TX FIFO empty or bus not busy. Error events result in the +controller being reset and the error returned to the calling request, +but the function could potentially try to keep handling the other +events, such as by writing more messages into the TX FIFO. Since the +transaction has already failed, this is not helpful and will just cause +issues. + +This problem has been present ever since: + +commit 7f9906bd7f72 ("i2c: xiic: Service all interrupts in isr") + +which allowed non-error events to be handled after errors, but became +more obvious after: + +commit 743e227a8959 ("i2c: xiic: Defer xiic_wakeup() and +__xiic_start_xfer() in xiic_process()") + +which reworked the code to add a WARN_ON which triggers if both the +xfer_more and wakeup_req flags were set, since this combination is +not supposed to happen, but was occurring in this scenario. + +Skip further interrupt handling after error flags are detected to avoid +this problem. + +Fixes: 7f9906bd7f72 ("i2c: xiic: Service all interrupts in isr") +Signed-off-by: Robert Hancock +Acked-by: Andi Shyti +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-xiic.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/i2c/busses/i2c-xiic.c b/drivers/i2c/busses/i2c-xiic.c +index effae4d467291..b41a6709e47f2 100644 +--- a/drivers/i2c/busses/i2c-xiic.c ++++ b/drivers/i2c/busses/i2c-xiic.c +@@ -431,6 +431,8 @@ static irqreturn_t xiic_process(int irq, void *dev_id) + wakeup_req = 1; + wakeup_code = STATE_ERROR; + } ++ /* don't try to handle other events */ ++ goto out; + } + if (pend & XIIC_INTR_RX_FULL_MASK) { + /* Receive register/FIFO is full */ +-- +2.39.2 + diff --git a/queue-6.1/i3c-master-svc-fix-cpu-schedule-in-spin-lock.patch b/queue-6.1/i3c-master-svc-fix-cpu-schedule-in-spin-lock.patch new file mode 100644 index 00000000000..9f16df60f82 --- /dev/null +++ b/queue-6.1/i3c-master-svc-fix-cpu-schedule-in-spin-lock.patch @@ -0,0 +1,78 @@ +From 8016b09c94d40e2fbfdc06be477af29a1a29b313 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 May 2023 11:30:29 +0800 +Subject: i3c: master: svc: fix cpu schedule in spin lock + +From: Clark Wang + +[ Upstream commit 33beadb3b1ab74e69db2c49d9663f3a93a273943 ] + +pm_runtime_resume_and_get() may call sleep(). It cannot be used in +svc_i3c_master_start_xfer_locked(), because it is in a spin lock. + +Move the pm runtime operations to svc_i3c_master_enqueue_xfer(). + +Signed-off-by: Clark Wang +Fixes: 05be23ef78f7 ("i3c: master: svc: add runtime pm support") +Reviewed-by: Miquel Raynal +Link: https://lore.kernel.org/r/20230517033030.3068085-2-xiaoning.wang@nxp.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/i3c/master/svc-i3c-master.c | 19 ++++++++++--------- + 1 file changed, 10 insertions(+), 9 deletions(-) + +diff --git a/drivers/i3c/master/svc-i3c-master.c b/drivers/i3c/master/svc-i3c-master.c +index d6e9ed74cdcf4..d47360f8a1f36 100644 +--- a/drivers/i3c/master/svc-i3c-master.c ++++ b/drivers/i3c/master/svc-i3c-master.c +@@ -1090,12 +1090,6 @@ static void svc_i3c_master_start_xfer_locked(struct svc_i3c_master *master) + if (!xfer) + return; + +- ret = pm_runtime_resume_and_get(master->dev); +- if (ret < 0) { +- dev_err(master->dev, "<%s> Cannot get runtime PM.\n", __func__); +- return; +- } +- + svc_i3c_master_clear_merrwarn(master); + svc_i3c_master_flush_fifo(master); + +@@ -1110,9 +1104,6 @@ static void svc_i3c_master_start_xfer_locked(struct svc_i3c_master *master) + break; + } + +- pm_runtime_mark_last_busy(master->dev); +- pm_runtime_put_autosuspend(master->dev); +- + xfer->ret = ret; + complete(&xfer->comp); + +@@ -1133,6 +1124,13 @@ static void svc_i3c_master_enqueue_xfer(struct svc_i3c_master *master, + struct svc_i3c_xfer *xfer) + { + unsigned long flags; ++ int ret; ++ ++ ret = pm_runtime_resume_and_get(master->dev); ++ if (ret < 0) { ++ dev_err(master->dev, "<%s> Cannot get runtime PM.\n", __func__); ++ return; ++ } + + init_completion(&xfer->comp); + spin_lock_irqsave(&master->xferqueue.lock, flags); +@@ -1143,6 +1141,9 @@ static void svc_i3c_master_enqueue_xfer(struct svc_i3c_master *master, + svc_i3c_master_start_xfer_locked(master); + } + spin_unlock_irqrestore(&master->xferqueue.lock, flags); ++ ++ pm_runtime_mark_last_busy(master->dev); ++ pm_runtime_put_autosuspend(master->dev); + } + + static bool +-- +2.39.2 + diff --git a/queue-6.1/ibmvnic-do-not-reset-dql-stats-on-non_fatal-err.patch b/queue-6.1/ibmvnic-do-not-reset-dql-stats-on-non_fatal-err.patch new file mode 100644 index 00000000000..a6172586273 --- /dev/null +++ b/queue-6.1/ibmvnic-do-not-reset-dql-stats-on-non_fatal-err.patch @@ -0,0 +1,82 @@ +From 2b3074663c8680396665d370fd6f725ea356c6d0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Jun 2023 13:22:44 -0500 +Subject: ibmvnic: Do not reset dql stats on NON_FATAL err + +From: Nick Child + +[ Upstream commit 48538ccb825b05544ec308a509e2cc9c013402db ] + +All ibmvnic resets, make a call to netdev_tx_reset_queue() when +re-opening the device. netdev_tx_reset_queue() resets the num_queued +and num_completed byte counters. These stats are used in Byte Queue +Limit (BQL) algorithms. The difference between these two stats tracks +the number of bytes currently sitting on the physical NIC. ibmvnic +increases the number of queued bytes though calls to +netdev_tx_sent_queue() in the drivers xmit function. When, VIOS reports +that it is done transmitting bytes, the ibmvnic device increases the +number of completed bytes through calls to netdev_tx_completed_queue(). +It is important to note that the driver batches its transmit calls and +num_queued is increased every time that an skb is added to the next +batch, not necessarily when the batch is sent to VIOS for transmission. + +Unlike other reset types, a NON FATAL reset will not flush the sub crq +tx buffers. Therefore, it is possible for the batched skb array to be +partially full. So if there is call to netdev_tx_reset_queue() when +re-opening the device, the value of num_queued (0) would not account +for the skb's that are currently batched. Eventually, when the batch +is sent to VIOS, the call to netdev_tx_completed_queue() would increase +num_completed to a value greater than the num_queued. This causes a +BUG_ON crash: + +ibmvnic 30000002: Firmware reports error, cause: adapter problem. +Starting recovery... +ibmvnic 30000002: tx error 600 +ibmvnic 30000002: tx error 600 +ibmvnic 30000002: tx error 600 +ibmvnic 30000002: tx error 600 +------------[ cut here ]------------ +kernel BUG at lib/dynamic_queue_limits.c:27! +Oops: Exception in kernel mode, sig: 5 +[....] +NIP dql_completed+0x28/0x1c0 +LR ibmvnic_complete_tx.isra.0+0x23c/0x420 [ibmvnic] +Call Trace: +ibmvnic_complete_tx.isra.0+0x3f8/0x420 [ibmvnic] (unreliable) +ibmvnic_interrupt_tx+0x40/0x70 [ibmvnic] +__handle_irq_event_percpu+0x98/0x270 +---[ end trace ]--- + +Therefore, do not reset the dql stats when performing a NON_FATAL reset. + +Fixes: 0d973388185d ("ibmvnic: Introduce xmit_more support using batched subCRQ hcalls") +Signed-off-by: Nick Child +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/ibm/ibmvnic.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c +index 9282381a438fe..bc97f24b08270 100644 +--- a/drivers/net/ethernet/ibm/ibmvnic.c ++++ b/drivers/net/ethernet/ibm/ibmvnic.c +@@ -1625,7 +1625,14 @@ static int __ibmvnic_open(struct net_device *netdev) + if (prev_state == VNIC_CLOSED) + enable_irq(adapter->tx_scrq[i]->irq); + enable_scrq_irq(adapter, adapter->tx_scrq[i]); +- netdev_tx_reset_queue(netdev_get_tx_queue(netdev, i)); ++ /* netdev_tx_reset_queue will reset dql stats. During NON_FATAL ++ * resets, don't reset the stats because there could be batched ++ * skb's waiting to be sent. If we reset dql stats, we risk ++ * num_completed being greater than num_queued. This will cause ++ * a BUG_ON in dql_completed(). ++ */ ++ if (adapter->reset_reason != VNIC_RESET_NON_FATAL) ++ netdev_tx_reset_queue(netdev_get_tx_queue(netdev, i)); + } + + rc = set_link_state(adapter, IBMVNIC_LOGICAL_LNK_UP); +-- +2.39.2 + diff --git a/queue-6.1/kernfs-fix-missing-kernfs_idr_lock-to-remove-an-id-f.patch b/queue-6.1/kernfs-fix-missing-kernfs_idr_lock-to-remove-an-id-f.patch new file mode 100644 index 00000000000..73d1f741bf5 --- /dev/null +++ b/queue-6.1/kernfs-fix-missing-kernfs_idr_lock-to-remove-an-id-f.patch @@ -0,0 +1,39 @@ +From 235b28f6bc30b918dc14aa40f3dd654f67083879 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 May 2023 10:40:17 +0800 +Subject: kernfs: fix missing kernfs_idr_lock to remove an ID from the IDR + +From: Muchun Song + +[ Upstream commit 30480b988f88c279752f3202a26b6fee5f586aef ] + +The root->ino_idr is supposed to be protected by kernfs_idr_lock, fix +it. + +Fixes: 488dee96bb62 ("kernfs: allow creating kernfs objects with arbitrary uid/gid") +Signed-off-by: Muchun Song +Acked-by: Tejun Heo +Link: https://lore.kernel.org/r/20230523024017.24851-1-songmuchun@bytedance.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + fs/kernfs/dir.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/fs/kernfs/dir.c b/fs/kernfs/dir.c +index f33b3baad07cb..44842e6cf0a9b 100644 +--- a/fs/kernfs/dir.c ++++ b/fs/kernfs/dir.c +@@ -652,7 +652,9 @@ static struct kernfs_node *__kernfs_new_node(struct kernfs_root *root, + return kn; + + err_out3: ++ spin_lock(&kernfs_idr_lock); + idr_remove(&root->ino_idr, (u32)kernfs_ino(kn)); ++ spin_unlock(&kernfs_idr_lock); + err_out2: + kmem_cache_free(kernfs_node_cache, kn); + err_out1: +-- +2.39.2 + diff --git a/queue-6.1/kvm-s390-diag-fix-racy-access-of-physical-cpu-number.patch b/queue-6.1/kvm-s390-diag-fix-racy-access-of-physical-cpu-number.patch new file mode 100644 index 00000000000..4a6ff6f1c8e --- /dev/null +++ b/queue-6.1/kvm-s390-diag-fix-racy-access-of-physical-cpu-number.patch @@ -0,0 +1,60 @@ +From d80a680169cd962fcde27848889e4d87bef276e9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 May 2023 10:42:34 +0200 +Subject: KVM: s390/diag: fix racy access of physical cpu number in diag 9c + handler + +From: Christian Borntraeger + +[ Upstream commit 0bc380beb78aa352eadbc21d934dd9606fcee808 ] + +We do check for target CPU == -1, but this might change at the time we +are going to use it. Hold the physical target CPU in a local variable to +avoid out-of-bound accesses to the cpu arrays. + +Cc: Pierre Morel +Fixes: 87e28a15c42c ("KVM: s390: diag9c (directed yield) forwarding") +Reported-by: Marc Hartmayer +Reviewed-by: Nico Boehr +Reviewed-by: Pierre Morel +Signed-off-by: Christian Borntraeger +Signed-off-by: Janosch Frank +Signed-off-by: Sasha Levin +--- + arch/s390/kvm/diag.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/arch/s390/kvm/diag.c b/arch/s390/kvm/diag.c +index 807fa9da1e721..3c65b8258ae67 100644 +--- a/arch/s390/kvm/diag.c ++++ b/arch/s390/kvm/diag.c +@@ -166,6 +166,7 @@ static int diag9c_forwarding_overrun(void) + static int __diag_time_slice_end_directed(struct kvm_vcpu *vcpu) + { + struct kvm_vcpu *tcpu; ++ int tcpu_cpu; + int tid; + + tid = vcpu->run->s.regs.gprs[(vcpu->arch.sie_block->ipa & 0xf0) >> 4]; +@@ -181,14 +182,15 @@ static int __diag_time_slice_end_directed(struct kvm_vcpu *vcpu) + goto no_yield; + + /* target guest VCPU already running */ +- if (READ_ONCE(tcpu->cpu) >= 0) { ++ tcpu_cpu = READ_ONCE(tcpu->cpu); ++ if (tcpu_cpu >= 0) { + if (!diag9c_forwarding_hz || diag9c_forwarding_overrun()) + goto no_yield; + + /* target host CPU already running */ +- if (!vcpu_is_preempted(tcpu->cpu)) ++ if (!vcpu_is_preempted(tcpu_cpu)) + goto no_yield; +- smp_yield_cpu(tcpu->cpu); ++ smp_yield_cpu(tcpu_cpu); + VCPU_EVENT(vcpu, 5, + "diag time slice end directed to %d: yield forwarded", + tid); +-- +2.39.2 + diff --git a/queue-6.1/kvm-s390-fix-kvm_s390_get_cmma_bits-for-gfns-in-mems.patch b/queue-6.1/kvm-s390-fix-kvm_s390_get_cmma_bits-for-gfns-in-mems.patch new file mode 100644 index 00000000000..a22b66311ad --- /dev/null +++ b/queue-6.1/kvm-s390-fix-kvm_s390_get_cmma_bits-for-gfns-in-mems.patch @@ -0,0 +1,74 @@ +From 60dcf7497f6f6494ae759e6eb60e85905642dcc6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Mar 2023 15:54:23 +0100 +Subject: KVM: s390: fix KVM_S390_GET_CMMA_BITS for GFNs in memslot holes + +From: Nico Boehr + +[ Upstream commit 285cff4c0454340a4dc53f46e67f2cb1c293bd74 ] + +The KVM_S390_GET_CMMA_BITS ioctl may return incorrect values when userspace +specifies a start_gfn outside of memslots. + +This can occur when a VM has multiple memslots with a hole in between: + ++-----+----------+--------+--------+ +| ... | Slot N-1 | | Slot N | ++-----+----------+--------+--------+ + ^ ^ ^ ^ + | | | | +GFN A A+B | | + A+B+C | + A+B+C+D + +When userspace specifies a GFN in [A+B, A+B+C), it would expect to get the +CMMA values of the first dirty page in Slot N. However, userspace may get a +start_gfn of A+B+C+D with a count of 0, hence completely skipping over any +dirty pages in slot N. + +The error is in kvm_s390_next_dirty_cmma(), which assumes +gfn_to_memslot_approx() will return the memslot _below_ the specified GFN +when the specified GFN lies outside a memslot. In reality it may return +either the memslot below or above the specified GFN. + +When a memslot above the specified GFN is returned this happens: + +- ofs is calculated, but since the memslot's base_gfn is larger than the + specified cur_gfn, ofs will underflow to a huge number. +- ofs is passed to find_next_bit(). Since ofs will exceed the memslot's + number of pages, the number of pages in the memslot is returned, + completely skipping over all bits in the memslot userspace would be + interested in. + +Fix this by resetting ofs to zero when a memslot _above_ cur_gfn is +returned (cur_gfn < ms->base_gfn). + +Signed-off-by: Nico Boehr +Reviewed-by: Claudio Imbrenda +Fixes: afdad61615cc ("KVM: s390: Fix storage attributes migration with memory slots") +Message-Id: <20230324145424.293889-2-nrb@linux.ibm.com> +Signed-off-by: Claudio Imbrenda +Signed-off-by: Janosch Frank +Signed-off-by: Sasha Levin +--- + arch/s390/kvm/kvm-s390.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c +index 26f89ec3062ba..3775363471f0c 100644 +--- a/arch/s390/kvm/kvm-s390.c ++++ b/arch/s390/kvm/kvm-s390.c +@@ -2147,6 +2147,10 @@ static unsigned long kvm_s390_next_dirty_cmma(struct kvm_memslots *slots, + ms = container_of(mnode, struct kvm_memory_slot, gfn_node[slots->node_idx]); + ofs = 0; + } ++ ++ if (cur_gfn < ms->base_gfn) ++ ofs = 0; ++ + ofs = find_next_bit(kvm_second_dirty_bitmap(ms), ms->npages, ofs); + while (ofs >= ms->npages && (mnode = rb_next(mnode))) { + ms = container_of(mnode, struct kvm_memory_slot, gfn_node[slots->node_idx]); +-- +2.39.2 + diff --git a/queue-6.1/kvm-s390-vsie-fix-the-length-of-apcb-bitmap.patch b/queue-6.1/kvm-s390-vsie-fix-the-length-of-apcb-bitmap.patch new file mode 100644 index 00000000000..13ec4899672 --- /dev/null +++ b/queue-6.1/kvm-s390-vsie-fix-the-length-of-apcb-bitmap.patch @@ -0,0 +1,52 @@ +From 0477b30ccaea8cde3d49435ed02288d99ba51486 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 May 2023 17:42:58 +0200 +Subject: KVM: s390: vsie: fix the length of APCB bitmap + +From: Pierre Morel + +[ Upstream commit 246be7d2720ea9a795b576067ecc5e5c7a1e7848 ] + +bit_and() uses the count of bits as the woking length. +Fix the previous implementation and effectively use +the right bitmap size. + +Fixes: 19fd83a64718 ("KVM: s390: vsie: allow CRYCB FORMAT-1") +Fixes: 56019f9aca22 ("KVM: s390: vsie: Allow CRYCB FORMAT-2") + +Signed-off-by: Pierre Morel +Reviewed-by: Janosch Frank +Link: https://lore.kernel.org/kvm/20230511094719.9691-1-pmorel@linux.ibm.com/ +Signed-off-by: Janosch Frank +Signed-off-by: Sasha Levin +--- + arch/s390/kvm/vsie.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/arch/s390/kvm/vsie.c b/arch/s390/kvm/vsie.c +index ace2541ababd3..740f8b56e63f9 100644 +--- a/arch/s390/kvm/vsie.c ++++ b/arch/s390/kvm/vsie.c +@@ -169,7 +169,8 @@ static int setup_apcb00(struct kvm_vcpu *vcpu, unsigned long *apcb_s, + sizeof(struct kvm_s390_apcb0))) + return -EFAULT; + +- bitmap_and(apcb_s, apcb_s, apcb_h, sizeof(struct kvm_s390_apcb0)); ++ bitmap_and(apcb_s, apcb_s, apcb_h, ++ BITS_PER_BYTE * sizeof(struct kvm_s390_apcb0)); + + return 0; + } +@@ -191,7 +192,8 @@ static int setup_apcb11(struct kvm_vcpu *vcpu, unsigned long *apcb_s, + sizeof(struct kvm_s390_apcb1))) + return -EFAULT; + +- bitmap_and(apcb_s, apcb_s, apcb_h, sizeof(struct kvm_s390_apcb1)); ++ bitmap_and(apcb_s, apcb_s, apcb_h, ++ BITS_PER_BYTE * sizeof(struct kvm_s390_apcb1)); + + return 0; + } +-- +2.39.2 + diff --git a/queue-6.1/lib-bitmap-drop-optimization-of-bitmap_-from-to-_arr.patch b/queue-6.1/lib-bitmap-drop-optimization-of-bitmap_-from-to-_arr.patch new file mode 100644 index 00000000000..815004a4b26 --- /dev/null +++ b/queue-6.1/lib-bitmap-drop-optimization-of-bitmap_-from-to-_arr.patch @@ -0,0 +1,75 @@ +From a3f503cf32e32dad1d57f4eb767f741d655560f4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Feb 2023 11:24:36 -0800 +Subject: lib/bitmap: drop optimization of bitmap_{from,to}_arr64 + +From: Yury Norov + +[ Upstream commit c1d2ba10f594046831d14b03f194e8d05e78abad ] + +bitmap_{from,to}_arr64() optimization is overly optimistic on 32-bit LE +architectures when it's wired to bitmap_copy_clear_tail(). + +bitmap_copy_clear_tail() takes care of unused bits in the bitmap up to +the next word boundary. But on 32-bit machines when copying bits from +bitmap to array of 64-bit words, it's expected that the unused part of +a recipient array must be cleared up to 64-bit boundary, so the last 4 +bytes may stay untouched when nbits % 64 <= 32. + +While the copying part of the optimization works correct, that clear-tail +trick makes corresponding tests reasonably fail: + +test_bitmap: bitmap_to_arr64(nbits == 1): tail is not safely cleared: 0xa5a5a5a500000001 (must be 0x0000000000000001) + +Fix it by removing bitmap_{from,to}_arr64() optimization for 32-bit LE +arches. + +Reported-by: Guenter Roeck +Link: https://lore.kernel.org/lkml/20230225184702.GA3587246@roeck-us.net/ +Fixes: 0a97953fd221 ("lib: add bitmap_{from,to}_arr64") +Signed-off-by: Yury Norov +Tested-by: Guenter Roeck +Reviewed-by: Andy Shevchenko +Reviewed-by: Alexander Lobakin +Signed-off-by: Sasha Levin +--- + include/linux/bitmap.h | 8 +++----- + lib/bitmap.c | 2 +- + 2 files changed, 4 insertions(+), 6 deletions(-) + +diff --git a/include/linux/bitmap.h b/include/linux/bitmap.h +index 7d6d73b781472..03644237e1efb 100644 +--- a/include/linux/bitmap.h ++++ b/include/linux/bitmap.h +@@ -302,12 +302,10 @@ void bitmap_to_arr32(u32 *buf, const unsigned long *bitmap, + #endif + + /* +- * On 64-bit systems bitmaps are represented as u64 arrays internally. On LE32 +- * machines the order of hi and lo parts of numbers match the bitmap structure. +- * In both cases conversion is not needed when copying data from/to arrays of +- * u64. ++ * On 64-bit systems bitmaps are represented as u64 arrays internally. So, ++ * the conversion is not needed when copying data from/to arrays of u64. + */ +-#if (BITS_PER_LONG == 32) && defined(__BIG_ENDIAN) ++#if BITS_PER_LONG == 32 + void bitmap_from_arr64(unsigned long *bitmap, const u64 *buf, unsigned int nbits); + void bitmap_to_arr64(u64 *buf, const unsigned long *bitmap, unsigned int nbits); + #else +diff --git a/lib/bitmap.c b/lib/bitmap.c +index 1c81413c51f86..ddb31015e38ae 100644 +--- a/lib/bitmap.c ++++ b/lib/bitmap.c +@@ -1495,7 +1495,7 @@ void bitmap_to_arr32(u32 *buf, const unsigned long *bitmap, unsigned int nbits) + EXPORT_SYMBOL(bitmap_to_arr32); + #endif + +-#if (BITS_PER_LONG == 32) && defined(__BIG_ENDIAN) ++#if BITS_PER_LONG == 32 + /** + * bitmap_from_arr64 - copy the contents of u64 array of bits to bitmap + * @bitmap: array of unsigned longs, the destination bitmap +-- +2.39.2 + diff --git a/queue-6.1/lkdtm-replace-ll_rw_block-with-submit_bh.patch b/queue-6.1/lkdtm-replace-ll_rw_block-with-submit_bh.patch new file mode 100644 index 00000000000..6f84ef880e3 --- /dev/null +++ b/queue-6.1/lkdtm-replace-ll_rw_block-with-submit_bh.patch @@ -0,0 +1,56 @@ +From 41be7a82c7ab428b5fe32d0bb07f07036353db3c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 May 2023 00:29:44 +0800 +Subject: lkdtm: replace ll_rw_block with submit_bh + +From: Yue Zhao + +[ Upstream commit b290df06811852d4cc36f4b8a2a30c2063197a74 ] + +Function ll_rw_block was removed in commit 79f597842069 ("fs/buffer: +remove ll_rw_block() helper"). There is no unified function to sumbit +read or write buffer in block layer for now. Consider similar sematics, +we can choose submit_bh() to replace ll_rw_block() as predefined crash +point. In submit_bh(), it also takes read or write flag as the first +argument and invoke submit_bio() to submit I/O request to block layer. + +Fixes: 79f597842069 ("fs/buffer: remove ll_rw_block() helper") +Signed-off-by: Yue Zhao +Acked-by: Kees Cook +Link: https://lore.kernel.org/r/20230503162944.3969-1-findns94@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + Documentation/fault-injection/provoke-crashes.rst | 2 +- + drivers/misc/lkdtm/core.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/Documentation/fault-injection/provoke-crashes.rst b/Documentation/fault-injection/provoke-crashes.rst +index 3abe842256139..1f087e502ca6d 100644 +--- a/Documentation/fault-injection/provoke-crashes.rst ++++ b/Documentation/fault-injection/provoke-crashes.rst +@@ -29,7 +29,7 @@ recur_count + cpoint_name + Where in the kernel to trigger the action. It can be + one of INT_HARDWARE_ENTRY, INT_HW_IRQ_EN, INT_TASKLET_ENTRY, +- FS_DEVRW, MEM_SWAPOUT, TIMERADD, SCSI_QUEUE_RQ, or DIRECT. ++ FS_SUBMIT_BH, MEM_SWAPOUT, TIMERADD, SCSI_QUEUE_RQ, or DIRECT. + + cpoint_type + Indicates the action to be taken on hitting the crash point. +diff --git a/drivers/misc/lkdtm/core.c b/drivers/misc/lkdtm/core.c +index b4712ff196b4e..0772e4a4757e9 100644 +--- a/drivers/misc/lkdtm/core.c ++++ b/drivers/misc/lkdtm/core.c +@@ -79,7 +79,7 @@ static struct crashpoint crashpoints[] = { + CRASHPOINT("INT_HARDWARE_ENTRY", "do_IRQ"), + CRASHPOINT("INT_HW_IRQ_EN", "handle_irq_event"), + CRASHPOINT("INT_TASKLET_ENTRY", "tasklet_action"), +- CRASHPOINT("FS_DEVRW", "ll_rw_block"), ++ CRASHPOINT("FS_SUBMIT_BH", "submit_bh"), + CRASHPOINT("MEM_SWAPOUT", "shrink_inactive_list"), + CRASHPOINT("TIMERADD", "hrtimer_start"), + CRASHPOINT("SCSI_QUEUE_RQ", "scsi_queue_rq"), +-- +2.39.2 + diff --git a/queue-6.1/mailbox-ti-msgmgr-fill-non-message-tx-data-fields-wi.patch b/queue-6.1/mailbox-ti-msgmgr-fill-non-message-tx-data-fields-wi.patch new file mode 100644 index 00000000000..f1c48d51493 --- /dev/null +++ b/queue-6.1/mailbox-ti-msgmgr-fill-non-message-tx-data-fields-wi.patch @@ -0,0 +1,75 @@ +From 63b8243f66a354bf369b893fa920ac617b40d7c2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jun 2023 20:00:22 -0500 +Subject: mailbox: ti-msgmgr: Fill non-message tx data fields with 0x0 + +From: Nishanth Menon + +[ Upstream commit 1b712f18c461bd75f018033a15cf381e712806b5 ] + +Sec proxy/message manager data buffer is 60 bytes with the last of the +registers indicating transmission completion. This however poses a bit +of a challenge. + +The backing memory for sec_proxy / message manager is regular memory, +and all sec proxy does is to trigger a burst of all 60 bytes of data +over to the target thread backing ring accelerator. It doesn't do a +memory scrub when it moves data out in the burst. When we transmit +multiple messages, remnants of previous message is also transmitted +which results in some random data being set in TISCI fields of +messages that have been expanded forward. + +The entire concept of backward compatibility hinges on the fact that +the unused message fields remain 0x0 allowing for 0x0 value to be +specially considered when backward compatibility of message extension +is done. + +So, instead of just writing the completion register, we continue +to fill the message buffer up with 0x0 (note: for partial message +involving completion, we already do this). + +This allows us to scale and introduce ABI changes back also work with +other boot stages that may have left data in the internal memory. + +While at this, be consistent and explicit with the data_reg pointer +increment. + +Fixes: aace66b170ce ("mailbox: Introduce TI message manager driver") +Signed-off-by: Nishanth Menon +Signed-off-by: Jassi Brar +Signed-off-by: Sasha Levin +--- + drivers/mailbox/ti-msgmgr.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/drivers/mailbox/ti-msgmgr.c b/drivers/mailbox/ti-msgmgr.c +index ddac423ac1a91..03048cbda525e 100644 +--- a/drivers/mailbox/ti-msgmgr.c ++++ b/drivers/mailbox/ti-msgmgr.c +@@ -430,14 +430,20 @@ static int ti_msgmgr_send_data(struct mbox_chan *chan, void *data) + /* Ensure all unused data is 0 */ + data_trail &= 0xFFFFFFFF >> (8 * (sizeof(u32) - trail_bytes)); + writel(data_trail, data_reg); +- data_reg++; ++ data_reg += sizeof(u32); + } ++ + /* + * 'data_reg' indicates next register to write. If we did not already + * write on tx complete reg(last reg), we must do so for transmit ++ * In addition, we also need to make sure all intermediate data ++ * registers(if any required), are reset to 0 for TISCI backward ++ * compatibility to be maintained. + */ +- if (data_reg <= qinst->queue_buff_end) +- writel(0, qinst->queue_buff_end); ++ while (data_reg <= qinst->queue_buff_end) { ++ writel(0, data_reg); ++ data_reg += sizeof(u32); ++ } + + /* If we are in polled mode, wait for a response before proceeding */ + if (ti_msgmgr_chan_has_polled_queue_rx(message->chan_rx)) +-- +2.39.2 + diff --git a/queue-6.1/md-raid10-fix-the-condition-to-call-bio_end_io_acct.patch b/queue-6.1/md-raid10-fix-the-condition-to-call-bio_end_io_acct.patch new file mode 100644 index 00000000000..9db5bbf77df --- /dev/null +++ b/queue-6.1/md-raid10-fix-the-condition-to-call-bio_end_io_acct.patch @@ -0,0 +1,63 @@ +From 1609e9ee3a51c95c22380f34f86d0ba7af0e7612 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Jun 2023 17:43:20 +0800 +Subject: md/raid10: fix the condition to call bio_end_io_acct() + +From: Li Nan + +[ Upstream commit 125bfc7cd750e68c99f1d446e2c22abea08c237f ] + +/sys/block/[device]/queue/iostats is used to control whether to count io +stat. Write 0 to it will clear queue_flags QUEUE_FLAG_IO_STAT which means +iostats is disabled. If we disable iostats and later endable it, the io +issued during this period will be counted incorrectly, inflight will be +decreased to -1. + + //T1 set iostats + echo 0 > /sys/block/md0/queue/iostats + clear QUEUE_FLAG_IO_STAT + + //T2 issue io + if (QUEUE_FLAG_IO_STAT) -> false + bio_start_io_acct + inflight++ + + echo 1 > /sys/block/md0/queue/iostats + set QUEUE_FLAG_IO_STAT + + //T3 io end + if (QUEUE_FLAG_IO_STAT) -> true + bio_end_io_acct + inflight-- -> -1 + +Also, if iostats is enabled while issuing io but disabled while io end, +inflight will never be decreased. + +Fix it by checking start_time when io end. If start_time is not 0, call +bio_end_io_acct(). + +Fixes: 528bc2cf2fcc ("md/raid10: enable io accounting") +Signed-off-by: Li Nan +Signed-off-by: Song Liu +Link: https://lore.kernel.org/r/20230609094320.2397604-1-linan666@huaweicloud.com +Signed-off-by: Sasha Levin +--- + drivers/md/raid10.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c +index ea6228ff3bb5e..d2098fcd6a270 100644 +--- a/drivers/md/raid10.c ++++ b/drivers/md/raid10.c +@@ -325,7 +325,7 @@ static void raid_end_bio_io(struct r10bio *r10_bio) + if (!test_bit(R10BIO_Uptodate, &r10_bio->state)) + bio->bi_status = BLK_STS_IOERR; + +- if (blk_queue_io_stat(bio->bi_bdev->bd_disk->queue)) ++ if (r10_bio->start_time) + bio_end_io_acct(bio, r10_bio->start_time); + bio_endio(bio); + /* +-- +2.39.2 + diff --git a/queue-6.1/media-amphion-drop-repeated-codec-data-for-vc1g-form.patch b/queue-6.1/media-amphion-drop-repeated-codec-data-for-vc1g-form.patch new file mode 100644 index 00000000000..6d20b79286a --- /dev/null +++ b/queue-6.1/media-amphion-drop-repeated-codec-data-for-vc1g-form.patch @@ -0,0 +1,56 @@ +From 7dbcc48120a128dda97cbc5c8a990389093bee78 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Apr 2023 09:55:43 +0800 +Subject: media: amphion: drop repeated codec data for vc1g format + +From: Ming Qian + +[ Upstream commit e1d2ccc2cdd6333584aa3d5386dc667d0837c48f ] + +For format V4L2_PIX_FMT_VC1_ANNEX_G, +the separate codec data is required only once. +The repeated codec data may introduce some decoding error. +so drop the repeated codec data. + +It's amphion vpu's limitation + +Fixes: e670f5d672ef ("media: amphion: only insert the first sequence startcode for vc1l format") +Signed-off-by: Ming Qian +Tested-by: xiahong.bao +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/platform/amphion/vpu_malone.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/media/platform/amphion/vpu_malone.c b/drivers/media/platform/amphion/vpu_malone.c +index 36e563d29621f..c2f4fb12c3b64 100644 +--- a/drivers/media/platform/amphion/vpu_malone.c ++++ b/drivers/media/platform/amphion/vpu_malone.c +@@ -1286,6 +1286,15 @@ static int vpu_malone_insert_scode_pic(struct malone_scode_t *scode, u32 codec_i + return sizeof(hdr); + } + ++static int vpu_malone_insert_scode_vc1_g_seq(struct malone_scode_t *scode) ++{ ++ if (!scode->inst->total_input_count) ++ return 0; ++ if (vpu_vb_is_codecconfig(to_vb2_v4l2_buffer(scode->vb))) ++ scode->need_data = 0; ++ return 0; ++} ++ + static int vpu_malone_insert_scode_vc1_g_pic(struct malone_scode_t *scode) + { + struct vb2_v4l2_buffer *vbuf; +@@ -1423,6 +1432,7 @@ static const struct malone_scode_handler scode_handlers[] = { + }, + { + .pixelformat = V4L2_PIX_FMT_VC1_ANNEX_G, ++ .insert_scode_seq = vpu_malone_insert_scode_vc1_g_seq, + .insert_scode_pic = vpu_malone_insert_scode_vc1_g_pic, + }, + { +-- +2.39.2 + diff --git a/queue-6.1/media-amphion-drop-repeated-codec-data-for-vc1l-form.patch b/queue-6.1/media-amphion-drop-repeated-codec-data-for-vc1l-form.patch new file mode 100644 index 00000000000..3e532cdbe9d --- /dev/null +++ b/queue-6.1/media-amphion-drop-repeated-codec-data-for-vc1l-form.patch @@ -0,0 +1,43 @@ +From b94cf7d36d9f5addb8a8e5ce7dc6d1b01d361db6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Apr 2023 09:55:42 +0800 +Subject: media: amphion: drop repeated codec data for vc1l format + +From: Ming Qian + +[ Upstream commit 668ee1a3a1870381225002c246972419b98e4253 ] + +For format V4L2_PIX_FMT_VC1_ANNEX_L, +the codec data is replaced with startcode, +and then driver drop it, otherwise it may led to decoding error. + +It's amphion vpu's limitation + +Driver has dropped the first codec data, +but need to drop the repeated codec data too. + +Fixes: e670f5d672ef ("media: amphion: only insert the first sequence startcode for vc1l format") +Signed-off-by: Ming Qian +Tested-by: xiahong.bao +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/platform/amphion/vpu_malone.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/media/platform/amphion/vpu_malone.c b/drivers/media/platform/amphion/vpu_malone.c +index ae094cdc9bfc8..36e563d29621f 100644 +--- a/drivers/media/platform/amphion/vpu_malone.c ++++ b/drivers/media/platform/amphion/vpu_malone.c +@@ -1317,6 +1317,8 @@ static int vpu_malone_insert_scode_vc1_l_seq(struct malone_scode_t *scode) + int size = 0; + u8 rcv_seqhdr[MALONE_VC1_RCV_SEQ_HEADER_LEN]; + ++ if (vpu_vb_is_codecconfig(to_vb2_v4l2_buffer(scode->vb))) ++ scode->need_data = 0; + if (scode->inst->total_input_count) + return 0; + scode->need_data = 0; +-- +2.39.2 + diff --git a/queue-6.1/media-amphion-initiate-a-drain-of-the-capture-queue-.patch b/queue-6.1/media-amphion-initiate-a-drain-of-the-capture-queue-.patch new file mode 100644 index 00000000000..3769f6d1472 --- /dev/null +++ b/queue-6.1/media-amphion-initiate-a-drain-of-the-capture-queue-.patch @@ -0,0 +1,127 @@ +From 77ad17ba26d290212171e55484e49939a152762b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 6 May 2023 16:47:35 +0800 +Subject: media: amphion: initiate a drain of the capture queue in dynamic + resolution change + +From: Ming Qian + +[ Upstream commit 076b6289b2c12d76fab248659896682830fa7766 ] + +The last buffer from before the change must be marked +with the V4L2_BUF_FLAG_LAST flag, +similarly to the Drain sequence above. + +initiate a drain of the capture queue in dynamic resolution change + +Fixes: 6de8d628df6e ("media: amphion: add v4l2 m2m vpu decoder stateful driver") +Signed-off-by: Ming Qian +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/platform/amphion/vdec.c | 7 ++++--- + drivers/media/platform/amphion/venc.c | 4 ++-- + drivers/media/platform/amphion/vpu_v4l2.c | 5 +++-- + drivers/media/platform/amphion/vpu_v4l2.h | 2 +- + 4 files changed, 10 insertions(+), 8 deletions(-) + +diff --git a/drivers/media/platform/amphion/vdec.c b/drivers/media/platform/amphion/vdec.c +index 4918547793dc1..c08b5a2bfc1df 100644 +--- a/drivers/media/platform/amphion/vdec.c ++++ b/drivers/media/platform/amphion/vdec.c +@@ -229,6 +229,7 @@ static void vdec_handle_resolution_change(struct vpu_inst *inst) + + vdec->source_change--; + vpu_notify_source_change(inst); ++ vpu_set_last_buffer_dequeued(inst, false); + } + + static int vdec_update_state(struct vpu_inst *inst, enum vpu_codec_state state, u32 force) +@@ -264,7 +265,7 @@ static void vdec_set_last_buffer_dequeued(struct vpu_inst *inst) + return; + + if (vdec->eos_received) { +- if (!vpu_set_last_buffer_dequeued(inst)) { ++ if (!vpu_set_last_buffer_dequeued(inst, true)) { + vdec->eos_received--; + vdec_update_state(inst, VPU_CODEC_STATE_DRAIN, 0); + } +@@ -517,7 +518,7 @@ static int vdec_drain(struct vpu_inst *inst) + return 0; + + if (!vdec->params.frame_count) { +- vpu_set_last_buffer_dequeued(inst); ++ vpu_set_last_buffer_dequeued(inst, true); + return 0; + } + +@@ -556,7 +557,7 @@ static int vdec_cmd_stop(struct vpu_inst *inst) + vpu_trace(inst->dev, "[%d]\n", inst->id); + + if (inst->state == VPU_CODEC_STATE_DEINIT) { +- vpu_set_last_buffer_dequeued(inst); ++ vpu_set_last_buffer_dequeued(inst, true); + } else { + vdec->drain = 1; + vdec_drain(inst); +diff --git a/drivers/media/platform/amphion/venc.c b/drivers/media/platform/amphion/venc.c +index 37212f087fdd9..e8cb22da938e6 100644 +--- a/drivers/media/platform/amphion/venc.c ++++ b/drivers/media/platform/amphion/venc.c +@@ -468,7 +468,7 @@ static int venc_encoder_cmd(struct file *file, void *fh, struct v4l2_encoder_cmd + vpu_inst_lock(inst); + if (cmd->cmd == V4L2_ENC_CMD_STOP) { + if (inst->state == VPU_CODEC_STATE_DEINIT) +- vpu_set_last_buffer_dequeued(inst); ++ vpu_set_last_buffer_dequeued(inst, true); + else + venc_request_eos(inst); + } +@@ -888,7 +888,7 @@ static void venc_set_last_buffer_dequeued(struct vpu_inst *inst) + struct venc_t *venc = inst->priv; + + if (venc->stopped && list_empty(&venc->frames)) +- vpu_set_last_buffer_dequeued(inst); ++ vpu_set_last_buffer_dequeued(inst, true); + } + + static void venc_stop_done(struct vpu_inst *inst) +diff --git a/drivers/media/platform/amphion/vpu_v4l2.c b/drivers/media/platform/amphion/vpu_v4l2.c +index 590d1084e5a5d..a74953191c221 100644 +--- a/drivers/media/platform/amphion/vpu_v4l2.c ++++ b/drivers/media/platform/amphion/vpu_v4l2.c +@@ -100,7 +100,7 @@ int vpu_notify_source_change(struct vpu_inst *inst) + return 0; + } + +-int vpu_set_last_buffer_dequeued(struct vpu_inst *inst) ++int vpu_set_last_buffer_dequeued(struct vpu_inst *inst, bool eos) + { + struct vb2_queue *q; + +@@ -116,7 +116,8 @@ int vpu_set_last_buffer_dequeued(struct vpu_inst *inst) + vpu_trace(inst->dev, "last buffer dequeued\n"); + q->last_buffer_dequeued = true; + wake_up(&q->done_wq); +- vpu_notify_eos(inst); ++ if (eos) ++ vpu_notify_eos(inst); + return 0; + } + +diff --git a/drivers/media/platform/amphion/vpu_v4l2.h b/drivers/media/platform/amphion/vpu_v4l2.h +index 795ca33a6a507..000af24a06ba0 100644 +--- a/drivers/media/platform/amphion/vpu_v4l2.h ++++ b/drivers/media/platform/amphion/vpu_v4l2.h +@@ -26,7 +26,7 @@ struct vb2_v4l2_buffer *vpu_find_buf_by_idx(struct vpu_inst *inst, u32 type, u32 + void vpu_v4l2_set_error(struct vpu_inst *inst); + int vpu_notify_eos(struct vpu_inst *inst); + int vpu_notify_source_change(struct vpu_inst *inst); +-int vpu_set_last_buffer_dequeued(struct vpu_inst *inst); ++int vpu_set_last_buffer_dequeued(struct vpu_inst *inst, bool eos); + void vpu_vb2_buffers_return(struct vpu_inst *inst, unsigned int type, enum vb2_buffer_state state); + int vpu_get_num_buffers(struct vpu_inst *inst, u32 type); + bool vpu_is_source_empty(struct vpu_inst *inst); +-- +2.39.2 + diff --git a/queue-6.1/media-atomisp-gmin_platform-fix-out_len-in-gmin_get_.patch b/queue-6.1/media-atomisp-gmin_platform-fix-out_len-in-gmin_get_.patch new file mode 100644 index 00000000000..3ecc732bb89 --- /dev/null +++ b/queue-6.1/media-atomisp-gmin_platform-fix-out_len-in-gmin_get_.patch @@ -0,0 +1,42 @@ +From 0769827bf12d2e03edfc1b67435c386a10040093 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 May 2023 12:53:23 +0100 +Subject: media: atomisp: gmin_platform: fix out_len in + gmin_get_config_dsm_var() + +From: Dan Carpenter + +[ Upstream commit 1657f2934daf89e8d9fa4b2697008909eb22c73e ] + +Ideally, strlen(cur->string.pointer) and strlen(out) would be the same. +But this code is using strscpy() to avoid a potential buffer overflow. +So in the same way we should take the strlen() of the smaller string to +avoid a buffer overflow in the caller, gmin_get_var_int(). + +Link: https://lore.kernel.org/r/26124bcd-8132-4483-9d67-225c87d424e8@kili.mountain + +Fixes: 387041cda44e ("media: atomisp: improve sensor detection code to use _DSM table") +Signed-off-by: Dan Carpenter +Signed-off-by: Hans de Goede +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c b/drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c +index 3d41fab661cf0..789b13db80b2f 100644 +--- a/drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c ++++ b/drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c +@@ -1280,7 +1280,7 @@ static int gmin_get_config_dsm_var(struct device *dev, + dev_info(dev, "found _DSM entry for '%s': %s\n", var, + cur->string.pointer); + strscpy(out, cur->string.pointer, *out_len); +- *out_len = strlen(cur->string.pointer); ++ *out_len = strlen(out); + + ACPI_FREE(obj); + return 0; +-- +2.39.2 + diff --git a/queue-6.1/media-cec-i2c-ch7322-also-select-regmap.patch b/queue-6.1/media-cec-i2c-ch7322-also-select-regmap.patch new file mode 100644 index 00000000000..ccb61b64b3e --- /dev/null +++ b/queue-6.1/media-cec-i2c-ch7322-also-select-regmap.patch @@ -0,0 +1,69 @@ +From e00c371d9f16157526ee68e71d227524d9b5f70b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Jun 2023 04:54:35 +0200 +Subject: media: cec: i2c: ch7322: also select REGMAP + +From: Randy Dunlap + +[ Upstream commit 29f96ac23648b2259f42d40703c47dd18fd172ca ] + +Selecting only REGMAP_I2C can leave REGMAP unset, causing build errors, +so also select REGMAP to prevent the build errors. + +../drivers/media/cec/i2c/ch7322.c:158:21: error: variable 'ch7322_regmap' has initializer but incomplete type + 158 | static const struct regmap_config ch7322_regmap = { +../drivers/media/cec/i2c/ch7322.c:159:10: error: 'const struct regmap_config' has no member named 'reg_bits' + 159 | .reg_bits = 8, +../drivers/media/cec/i2c/ch7322.c:159:21: warning: excess elements in struct initializer + 159 | .reg_bits = 8, +../drivers/media/cec/i2c/ch7322.c:160:10: error: 'const struct regmap_config' has no member named 'val_bits' + 160 | .val_bits = 8, +../drivers/media/cec/i2c/ch7322.c:160:21: warning: excess elements in struct initializer + 160 | .val_bits = 8, +../drivers/media/cec/i2c/ch7322.c:161:10: error: 'const struct regmap_config' has no member named 'max_register' + 161 | .max_register = 0x7f, +../drivers/media/cec/i2c/ch7322.c:161:25: warning: excess elements in struct initializer + 161 | .max_register = 0x7f, +../drivers/media/cec/i2c/ch7322.c:162:10: error: 'const struct regmap_config' has no member named 'disable_locking' + 162 | .disable_locking = true, +../drivers/media/cec/i2c/ch7322.c:162:28: warning: excess elements in struct initializer + 162 | .disable_locking = true, +../drivers/media/cec/i2c/ch7322.c: In function 'ch7322_probe': +../drivers/media/cec/i2c/ch7322.c:468:26: error: implicit declaration of function 'devm_regmap_init_i2c' [-Werror=implicit-function-declaration] + 468 | ch7322->regmap = devm_regmap_init_i2c(client, &ch7322_regmap); +../drivers/media/cec/i2c/ch7322.c:468:24: warning: assignment to 'struct regmap *' from 'int' makes pointer from integer without a cast [-Wint-conversion] + 468 | ch7322->regmap = devm_regmap_init_i2c(client, &ch7322_regmap); +../drivers/media/cec/i2c/ch7322.c: At top level: +../drivers/media/cec/i2c/ch7322.c:158:35: error: storage size of 'ch7322_regmap' isn't known + 158 | static const struct regmap_config ch7322_regmap = { + +Link: https://lore.kernel.org/linux-media/20230608025435.29249-1-rdunlap@infradead.org +Fixes: 21b9a47e0ec7 ("media: cec: i2c: ch7322: Add ch7322 CEC controller driver") +Signed-off-by: Randy Dunlap +Cc: Jeff Chase +Cc: Hans Verkuil +Cc: Joe Tessler +Cc: Arnd Bergmann +Cc: Mark Brown +Cc: Masahiro Yamada +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/cec/i2c/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/media/cec/i2c/Kconfig b/drivers/media/cec/i2c/Kconfig +index 70432a1d69186..d912d143fb312 100644 +--- a/drivers/media/cec/i2c/Kconfig ++++ b/drivers/media/cec/i2c/Kconfig +@@ -5,6 +5,7 @@ + config CEC_CH7322 + tristate "Chrontel CH7322 CEC controller" + depends on I2C ++ select REGMAP + select REGMAP_I2C + select CEC_CORE + help +-- +2.39.2 + diff --git a/queue-6.1/media-hi846-fix-usage-of-pm_runtime_get_if_in_use.patch b/queue-6.1/media-hi846-fix-usage-of-pm_runtime_get_if_in_use.patch new file mode 100644 index 00000000000..5597642e2e1 --- /dev/null +++ b/queue-6.1/media-hi846-fix-usage-of-pm_runtime_get_if_in_use.patch @@ -0,0 +1,44 @@ +From af577e72146f15f70c495f360b1fd36cad4cedb5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Apr 2023 11:47:47 +0200 +Subject: media: hi846: fix usage of pm_runtime_get_if_in_use() + +From: Martin Kepplinger + +[ Upstream commit 04fc06f6dc1592ed5d675311ac50d8fba5db62ab ] + +pm_runtime_get_if_in_use() does not only return nonzero values when +the device is in use, it can return a negative errno too. + +And especially during resuming from system suspend, when runtime pm +is not yet up again, -EAGAIN is being returned, so the subsequent +pm_runtime_put() call results in a refcount underflow. + +Fix system-resume by handling -EAGAIN of pm_runtime_get_if_in_use(). + +Signed-off-by: Martin Kepplinger +Fixes: e8c0882685f9 ("media: i2c: add driver for the SK Hynix Hi-846 8M pixel camera") +Signed-off-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/hi846.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/i2c/hi846.c b/drivers/media/i2c/hi846.c +index 306dc35e925fd..f8709cdf28b39 100644 +--- a/drivers/media/i2c/hi846.c ++++ b/drivers/media/i2c/hi846.c +@@ -1353,7 +1353,8 @@ static int hi846_set_ctrl(struct v4l2_ctrl *ctrl) + exposure_max); + } + +- if (!pm_runtime_get_if_in_use(&client->dev)) ++ ret = pm_runtime_get_if_in_use(&client->dev); ++ if (!ret || ret == -EAGAIN) + return 0; + + switch (ctrl->id) { +-- +2.39.2 + diff --git a/queue-6.1/media-i2c-correct-format-propagation-for-st-mipid02.patch b/queue-6.1/media-i2c-correct-format-propagation-for-st-mipid02.patch new file mode 100644 index 00000000000..a0fe1c649f3 --- /dev/null +++ b/queue-6.1/media-i2c-correct-format-propagation-for-st-mipid02.patch @@ -0,0 +1,47 @@ +From 7bacc9233f260cb9107521901364e0f3aae8d96b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 May 2023 11:35:46 +0100 +Subject: media: i2c: Correct format propagation for st-mipid02 + +From: Daniel Scally + +[ Upstream commit 306c3190b30d4d6a098888b9d7d4cefaa0ddcb91 ] + +Format propagation in the st-mipid02 driver is incorrect in that when +setting format for V4L2_SUBDEV_FORMAT_TRY on the source pad, the +_active_ rather than _try_ format from the sink pad is propagated. +This causes problems with format negotiation - update the function to +propagate the correct format. + +Fixes: 642bb5e88fed ("media: st-mipid02: MIPID02 CSI-2 to PARALLEL bridge driver") +Signed-off-by: Daniel Scally +Signed-off-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/st-mipid02.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/i2c/st-mipid02.c b/drivers/media/i2c/st-mipid02.c +index 31b89aff0e86a..f20f87562bf11 100644 +--- a/drivers/media/i2c/st-mipid02.c ++++ b/drivers/media/i2c/st-mipid02.c +@@ -736,8 +736,13 @@ static void mipid02_set_fmt_source(struct v4l2_subdev *sd, + { + struct mipid02_dev *bridge = to_mipid02_dev(sd); + +- /* source pad mirror active sink pad */ +- format->format = bridge->fmt; ++ /* source pad mirror sink pad */ ++ if (format->which == V4L2_SUBDEV_FORMAT_ACTIVE) ++ format->format = bridge->fmt; ++ else ++ format->format = *v4l2_subdev_get_try_format(sd, sd_state, ++ MIPID02_SINK_0); ++ + /* but code may need to be converted */ + format->format.code = serial_to_parallel_code(format->format.code); + +-- +2.39.2 + diff --git a/queue-6.1/media-mediatek-vcodec-using-decoder-status-instead-o.patch b/queue-6.1/media-mediatek-vcodec-using-decoder-status-instead-o.patch new file mode 100644 index 00000000000..7e05068a6e1 --- /dev/null +++ b/queue-6.1/media-mediatek-vcodec-using-decoder-status-instead-o.patch @@ -0,0 +1,152 @@ +From c91abf032421a6975c66ff353a4454c057a1a84b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 May 2023 02:40:07 +0100 +Subject: media: mediatek: vcodec: using decoder status instead of core work + count + +From: Yunfei Dong + +[ Upstream commit 2864e304faec04c2674328aad0e820a9cd84cdec ] + +Adding the definition of decoder status to separate different decoder +period for core hardware. + +core_work_cnt is the number of core work queued to work queue, the control +is very complex, leading to some unreasonable test result. + +Using parameter status to indicate whether queue core work to work queue. + +Fixes: 2e0ef56d81cb ("media: mediatek: vcodec: making sure queue_work successfully") +Signed-off-by: Yunfei Dong +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + .../platform/mediatek/vcodec/vdec_msg_queue.c | 33 ++++++++----------- + .../platform/mediatek/vcodec/vdec_msg_queue.h | 16 +++++++-- + 2 files changed, 28 insertions(+), 21 deletions(-) + +diff --git a/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c b/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c +index f3073d1e7f420..03f8d7cd8eddc 100644 +--- a/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c ++++ b/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.c +@@ -71,7 +71,6 @@ static void vdec_msg_queue_dec(struct vdec_msg_queue *msg_queue, int hardware_in + int vdec_msg_queue_qbuf(struct vdec_msg_queue_ctx *msg_ctx, struct vdec_lat_buf *buf) + { + struct list_head *head; +- int status; + + head = vdec_get_buf_list(msg_ctx->hardware_index, buf); + if (!head) { +@@ -87,12 +86,9 @@ int vdec_msg_queue_qbuf(struct vdec_msg_queue_ctx *msg_ctx, struct vdec_lat_buf + if (msg_ctx->hardware_index != MTK_VDEC_CORE) { + wake_up_all(&msg_ctx->ready_to_use); + } else { +- if (buf->ctx->msg_queue.core_work_cnt < +- atomic_read(&buf->ctx->msg_queue.core_list_cnt)) { +- status = queue_work(buf->ctx->dev->core_workqueue, +- &buf->ctx->msg_queue.core_work); +- if (status) +- buf->ctx->msg_queue.core_work_cnt++; ++ if (!(buf->ctx->msg_queue.status & CONTEXT_LIST_QUEUED)) { ++ queue_work(buf->ctx->dev->core_workqueue, &buf->ctx->msg_queue.core_work); ++ buf->ctx->msg_queue.status |= CONTEXT_LIST_QUEUED; + } + } + +@@ -261,7 +257,10 @@ static void vdec_msg_queue_core_work(struct work_struct *work) + container_of(msg_queue, struct mtk_vcodec_ctx, msg_queue); + struct mtk_vcodec_dev *dev = ctx->dev; + struct vdec_lat_buf *lat_buf; +- int status; ++ ++ spin_lock(&ctx->dev->msg_queue_core_ctx.ready_lock); ++ ctx->msg_queue.status &= ~CONTEXT_LIST_QUEUED; ++ spin_unlock(&ctx->dev->msg_queue_core_ctx.ready_lock); + + lat_buf = vdec_msg_queue_dqbuf(&dev->msg_queue_core_ctx); + if (!lat_buf) +@@ -278,17 +277,13 @@ static void vdec_msg_queue_core_work(struct work_struct *work) + vdec_msg_queue_qbuf(&ctx->msg_queue.lat_ctx, lat_buf); + + wake_up_all(&ctx->msg_queue.core_dec_done); +- spin_lock(&dev->msg_queue_core_ctx.ready_lock); +- lat_buf->ctx->msg_queue.core_work_cnt--; +- +- if (lat_buf->ctx->msg_queue.core_work_cnt < +- atomic_read(&lat_buf->ctx->msg_queue.core_list_cnt)) { +- status = queue_work(lat_buf->ctx->dev->core_workqueue, +- &lat_buf->ctx->msg_queue.core_work); +- if (status) +- lat_buf->ctx->msg_queue.core_work_cnt++; ++ if (!(ctx->msg_queue.status & CONTEXT_LIST_QUEUED) && ++ atomic_read(&msg_queue->core_list_cnt)) { ++ spin_lock(&ctx->dev->msg_queue_core_ctx.ready_lock); ++ ctx->msg_queue.status |= CONTEXT_LIST_QUEUED; ++ spin_unlock(&ctx->dev->msg_queue_core_ctx.ready_lock); ++ queue_work(ctx->dev->core_workqueue, &msg_queue->core_work); + } +- spin_unlock(&dev->msg_queue_core_ctx.ready_lock); + } + + int vdec_msg_queue_init(struct vdec_msg_queue *msg_queue, +@@ -303,13 +298,13 @@ int vdec_msg_queue_init(struct vdec_msg_queue *msg_queue, + return 0; + + msg_queue->ctx = ctx; +- msg_queue->core_work_cnt = 0; + vdec_msg_queue_init_ctx(&msg_queue->lat_ctx, MTK_VDEC_LAT0); + INIT_WORK(&msg_queue->core_work, vdec_msg_queue_core_work); + + atomic_set(&msg_queue->lat_list_cnt, 0); + atomic_set(&msg_queue->core_list_cnt, 0); + init_waitqueue_head(&msg_queue->core_dec_done); ++ msg_queue->status = CONTEXT_LIST_EMPTY; + + msg_queue->wdma_addr.size = + vde_msg_queue_get_trans_size(ctx->picinfo.buf_w, +diff --git a/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.h b/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.h +index a5d44bc97c16b..8f82d14847726 100644 +--- a/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.h ++++ b/drivers/media/platform/mediatek/vcodec/vdec_msg_queue.h +@@ -21,6 +21,18 @@ struct mtk_vcodec_ctx; + struct mtk_vcodec_dev; + typedef int (*core_decode_cb_t)(struct vdec_lat_buf *lat_buf); + ++/** ++ * enum core_ctx_status - Context decode status for core hardwre. ++ * @CONTEXT_LIST_EMPTY: No buffer queued on core hardware(must always be 0) ++ * @CONTEXT_LIST_QUEUED: Buffer queued to core work list ++ * @CONTEXT_LIST_DEC_DONE: context decode done ++ */ ++enum core_ctx_status { ++ CONTEXT_LIST_EMPTY = 0, ++ CONTEXT_LIST_QUEUED, ++ CONTEXT_LIST_DEC_DONE, ++}; ++ + /** + * struct vdec_msg_queue_ctx - represents a queue for buffers ready to be processed + * @ready_to_use: ready used queue used to signalize when get a job queue +@@ -77,7 +89,7 @@ struct vdec_lat_buf { + * @lat_list_cnt: used to record each instance lat list count + * @core_list_cnt: used to record each instance core list count + * @core_dec_done: core work queue decode done event +- * @core_work_cnt: the number of core work in work queue ++ * @status: current context decode status for core hardware + */ + struct vdec_msg_queue { + struct vdec_lat_buf lat_buf[NUM_BUFFER_COUNT]; +@@ -93,7 +105,7 @@ struct vdec_msg_queue { + atomic_t lat_list_cnt; + atomic_t core_list_cnt; + wait_queue_head_t core_dec_done; +- int core_work_cnt; ++ int status; + }; + + /** +-- +2.39.2 + diff --git a/queue-6.1/media-usb-check-az6007_read-return-value.patch b/queue-6.1/media-usb-check-az6007_read-return-value.patch new file mode 100644 index 00000000000..fae1d50b5e2 --- /dev/null +++ b/queue-6.1/media-usb-check-az6007_read-return-value.patch @@ -0,0 +1,38 @@ +From 811d2a179fa06565d8dd32fadfb8302bf1b2f08f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Mar 2023 10:04:49 -0700 +Subject: media: usb: Check az6007_read() return value + +From: Daniil Dulov + +[ Upstream commit fdaca63186f59fc664b346c45b76576624b48e57 ] + +If az6007_read() returns error, there is no sence to continue. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 3af2f4f15a61 ("[media] az6007: Change the az6007 read/write routine parameter") +Signed-off-by: Daniil Dulov +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/usb/dvb-usb-v2/az6007.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/usb/dvb-usb-v2/az6007.c b/drivers/media/usb/dvb-usb-v2/az6007.c +index 62ee09f28a0bc..7524c90f5da61 100644 +--- a/drivers/media/usb/dvb-usb-v2/az6007.c ++++ b/drivers/media/usb/dvb-usb-v2/az6007.c +@@ -202,7 +202,8 @@ static int az6007_rc_query(struct dvb_usb_device *d) + unsigned code; + enum rc_proto proto; + +- az6007_read(d, AZ6007_READ_IR, 0, 0, st->data, 10); ++ if (az6007_read(d, AZ6007_READ_IR, 0, 0, st->data, 10) < 0) ++ return -EIO; + + if (st->data[1] == 0x44) + return 0; +-- +2.39.2 + diff --git a/queue-6.1/media-usb-siano-fix-warning-due-to-null-work_func_t-.patch b/queue-6.1/media-usb-siano-fix-warning-due-to-null-work_func_t-.patch new file mode 100644 index 00000000000..078849196b6 --- /dev/null +++ b/queue-6.1/media-usb-siano-fix-warning-due-to-null-work_func_t-.patch @@ -0,0 +1,83 @@ +From 6974707c5463ef6a0a706292dc84c400256910ab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 May 2023 07:59:32 +0800 +Subject: media: usb: siano: Fix warning due to null work_func_t function + pointer + +From: Duoming Zhou + +[ Upstream commit 6f489a966fbeb0da63d45c2c66a8957eab604bf6 ] + +The previous commit ebad8e731c1c ("media: usb: siano: Fix use after +free bugs caused by do_submit_urb") adds cancel_work_sync() in +smsusb_stop_streaming(). But smsusb_stop_streaming() may be called, +even if the work_struct surb->wq has not been initialized. As a result, +the warning will occur. One of the processes that could lead to warning +is shown below: + +smsusb_probe() + smsusb_init_device() + if (!dev->in_ep || !dev->out_ep || align < 0) { + smsusb_term_device(intf); + smsusb_stop_streaming() + cancel_work_sync(&dev->surbs[i].wq); + __cancel_work_timer() + __flush_work() + if (WARN_ON(!work->func)) // work->func is null + +The log reported by syzbot is shown below: + +WARNING: CPU: 0 PID: 897 at kernel/workqueue.c:3066 __flush_work+0x798/0xa80 kernel/workqueue.c:3063 +Modules linked in: +CPU: 0 PID: 897 Comm: kworker/0:2 Not tainted 6.2.0-rc1-syzkaller #0 +RIP: 0010:__flush_work+0x798/0xa80 kernel/workqueue.c:3066 +... +RSP: 0018:ffffc9000464ebf8 EFLAGS: 00010246 +RAX: 1ffff11002dbb420 RBX: 0000000000000021 RCX: 1ffffffff204fa4e +RDX: dffffc0000000000 RSI: 0000000000000001 RDI: ffff888016dda0e8 +RBP: ffffc9000464ed98 R08: 0000000000000001 R09: ffffffff90253b2f +R10: 0000000000000001 R11: 0000000000000000 R12: ffff888016dda0e8 +R13: ffff888016dda0e8 R14: ffff888016dda100 R15: 0000000000000001 +FS: 0000000000000000(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 00007ffd4331efe8 CR3: 000000000b48e000 CR4: 00000000003506f0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +Call Trace: + + __cancel_work_timer+0x315/0x460 kernel/workqueue.c:3160 + smsusb_stop_streaming drivers/media/usb/siano/smsusb.c:182 [inline] + smsusb_term_device+0xda/0x2d0 drivers/media/usb/siano/smsusb.c:344 + smsusb_init_device+0x400/0x9ce drivers/media/usb/siano/smsusb.c:419 + smsusb_probe+0xbbd/0xc55 drivers/media/usb/siano/smsusb.c:567 +... + +This patch adds check before cancel_work_sync(). If surb->wq has not +been initialized, the cancel_work_sync() will not be executed. + +Reported-by: syzbot+27b0b464864741b18b99@syzkaller.appspotmail.com +Fixes: ebad8e731c1c ("media: usb: siano: Fix use after free bugs caused by do_submit_urb") +Signed-off-by: Duoming Zhou +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/usb/siano/smsusb.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/usb/siano/smsusb.c b/drivers/media/usb/siano/smsusb.c +index 6f443c542c6da..640737d3b8aeb 100644 +--- a/drivers/media/usb/siano/smsusb.c ++++ b/drivers/media/usb/siano/smsusb.c +@@ -179,7 +179,8 @@ static void smsusb_stop_streaming(struct smsusb_device_t *dev) + + for (i = 0; i < MAX_URBS; i++) { + usb_kill_urb(&dev->surbs[i].urb); +- cancel_work_sync(&dev->surbs[i].wq); ++ if (dev->surbs[i].wq.func) ++ cancel_work_sync(&dev->surbs[i].wq); + + if (dev->surbs[i].cb) { + smscore_putbuffer(dev->coredev, dev->surbs[i].cb); +-- +2.39.2 + diff --git a/queue-6.1/media-venus-helpers-fix-align-of-non-power-of-two.patch b/queue-6.1/media-venus-helpers-fix-align-of-non-power-of-two.patch new file mode 100644 index 00000000000..cbf863fb776 --- /dev/null +++ b/queue-6.1/media-venus-helpers-fix-align-of-non-power-of-two.patch @@ -0,0 +1,51 @@ +From 5ce054188097929e550a1104ed6b23f2128713b6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 12 Sep 2020 20:03:01 +0100 +Subject: media: venus: helpers: Fix ALIGN() of non power of two + +From: Rikard Falkeborn + +[ Upstream commit 927e78ac8bc58155316cf6f46026e1912bbbbcfc ] + +ALIGN() expects its second argument to be a power of 2, otherwise +incorrect results are produced for some inputs. The output can be +both larger or smaller than what is expected. + +For example, ALIGN(304, 192) equals 320 instead of 384, and +ALIGN(65, 192) equals 256 instead of 192. + +However, nestling two ALIGN() as is done in this case seem to only +produce results equal to or bigger than the expected result if ALIGN() +had handled non powers of two, and that in turn results in framesizes +that are either the correct size or too large. + +Fortunately, since 192 * 4 / 3 equals 256, it turns out that one ALIGN() +is sufficient. + +Fixes: ab1eda449c6e ("media: venus: vdec: handle 10bit bitstreams") +Signed-off-by: Rikard Falkeborn +Signed-off-by: Stanimir Varbanov +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/qcom/venus/helpers.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/platform/qcom/venus/helpers.c b/drivers/media/platform/qcom/venus/helpers.c +index ab6a29ffc81e2..ca6555bdc92fa 100644 +--- a/drivers/media/platform/qcom/venus/helpers.c ++++ b/drivers/media/platform/qcom/venus/helpers.c +@@ -1036,8 +1036,8 @@ static u32 get_framesize_raw_yuv420_tp10_ubwc(u32 width, u32 height) + u32 extradata = SZ_16K; + u32 size; + +- y_stride = ALIGN(ALIGN(width, 192) * 4 / 3, 256); +- uv_stride = ALIGN(ALIGN(width, 192) * 4 / 3, 256); ++ y_stride = ALIGN(width * 4 / 3, 256); ++ uv_stride = ALIGN(width * 4 / 3, 256); + y_sclines = ALIGN(height, 16); + uv_sclines = ALIGN((height + 1) >> 1, 16); + +-- +2.39.2 + diff --git a/queue-6.1/media-videodev2.h-fix-struct-v4l2_input-tuner-index-.patch b/queue-6.1/media-videodev2.h-fix-struct-v4l2_input-tuner-index-.patch new file mode 100644 index 00000000000..ea1b2194ad8 --- /dev/null +++ b/queue-6.1/media-videodev2.h-fix-struct-v4l2_input-tuner-index-.patch @@ -0,0 +1,62 @@ +From c625ea132d30a84941724b0da8fed8ab4ff9e664 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 May 2023 15:36:49 +0200 +Subject: media: videodev2.h: Fix struct v4l2_input tuner index comment + +From: Marek Vasut + +[ Upstream commit 26ae58f65e64fa7ba61d64bae752e59e08380c6a ] + +VIDIOC_ENUMINPUT documentation describes the tuner field of +struct v4l2_input as index: + +Documentation/userspace-api/media/v4l/vidioc-enuminput.rst +" +* - __u32 + - ``tuner`` + - Capture devices can have zero or more tuners (RF demodulators). + When the ``type`` is set to ``V4L2_INPUT_TYPE_TUNER`` this is an + RF connector and this field identifies the tuner. It corresponds + to struct :c:type:`v4l2_tuner` field ``index``. For + details on tuners see :ref:`tuner`. +" + +Drivers I could find also use the 'tuner' field as an index, e.g.: +drivers/media/pci/bt8xx/bttv-driver.c bttv_enum_input() +drivers/media/usb/go7007/go7007-v4l2.c vidioc_enum_input() + +However, the UAPI comment claims this field is 'enum v4l2_tuner_type': +include/uapi/linux/videodev2.h + +This field being 'enum v4l2_tuner_type' is unlikely as it seems to be +never used that way in drivers, and documentation confirms it. It seem +this comment got in accidentally in the commit which this patch fixes. +Fix the UAPI comment to stop confusion. + +This was pointed out by Dmitry while reviewing VIDIOC_ENUMINPUT +support for strace. + +Fixes: 6016af82eafc ("[media] v4l2: use __u32 rather than enums in ioctl() structs") +Signed-off-by: Marek Vasut +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + include/uapi/linux/videodev2.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/uapi/linux/videodev2.h b/include/uapi/linux/videodev2.h +index 29da1f4b4578e..45fa03882ef18 100644 +--- a/include/uapi/linux/videodev2.h ++++ b/include/uapi/linux/videodev2.h +@@ -1693,7 +1693,7 @@ struct v4l2_input { + __u8 name[32]; /* Label */ + __u32 type; /* Type of input */ + __u32 audioset; /* Associated audios (bitfield) */ +- __u32 tuner; /* enum v4l2_tuner_type */ ++ __u32 tuner; /* Tuner index */ + v4l2_std_id std; + __u32 status; + __u32 capabilities; +-- +2.39.2 + diff --git a/queue-6.1/mfd-intel-lpss-add-missing-check-for-platform_get_re.patch b/queue-6.1/mfd-intel-lpss-add-missing-check-for-platform_get_re.patch new file mode 100644 index 00000000000..1c08d538ae4 --- /dev/null +++ b/queue-6.1/mfd-intel-lpss-add-missing-check-for-platform_get_re.patch @@ -0,0 +1,38 @@ +From 705f42bb0bad2d24ebebe9a87eba246e3f4d097c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Jun 2023 09:48:18 +0800 +Subject: mfd: intel-lpss: Add missing check for platform_get_resource + +From: Jiasheng Jiang + +[ Upstream commit d918e0d5824495a75d00b879118b098fcab36fdb ] + +Add the missing check for platform_get_resource and return error +if it fails. + +Fixes: 4b45efe85263 ("mfd: Add support for Intel Sunrisepoint LPSS devices") +Signed-off-by: Jiasheng Jiang +Signed-off-by: Lee Jones +Link: https://lore.kernel.org/r/20230609014818.28475-1-jiasheng@iscas.ac.cn +Signed-off-by: Sasha Levin +--- + drivers/mfd/intel-lpss-acpi.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/mfd/intel-lpss-acpi.c b/drivers/mfd/intel-lpss-acpi.c +index a143c8dca2d93..212818aef93e2 100644 +--- a/drivers/mfd/intel-lpss-acpi.c ++++ b/drivers/mfd/intel-lpss-acpi.c +@@ -183,6 +183,9 @@ static int intel_lpss_acpi_probe(struct platform_device *pdev) + return -ENOMEM; + + info->mem = platform_get_resource(pdev, IORESOURCE_MEM, 0); ++ if (!info->mem) ++ return -ENODEV; ++ + info->irq = platform_get_irq(pdev, 0); + + ret = intel_lpss_probe(&pdev->dev, info); +-- +2.39.2 + diff --git a/queue-6.1/mfd-rt5033-drop-rt5033-battery-sub-device.patch b/queue-6.1/mfd-rt5033-drop-rt5033-battery-sub-device.patch new file mode 100644 index 00000000000..f880f89ffca --- /dev/null +++ b/queue-6.1/mfd-rt5033-drop-rt5033-battery-sub-device.patch @@ -0,0 +1,41 @@ +From 2d0eb680efa6fbc9e00ebcb2199fd9a5b1bcf654 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 May 2023 22:57:10 +0200 +Subject: mfd: rt5033: Drop rt5033-battery sub-device + +From: Stephan Gerhold + +[ Upstream commit 43db1344e0f8c1eb687a1d6cd5b0de3009ab66cb ] + +The fuel gauge in the RT5033 PMIC (rt5033-battery) has its own I2C bus +and interrupt lines. Therefore, it is not part of the MFD device +and needs to be specified separately in the device tree. + +Fixes: 0b271258544b ("mfd: rt5033: Add Richtek RT5033 driver core.") +Signed-off-by: Stephan Gerhold +Signed-off-by: Jakob Hauser +Reviewed-by: Linus Walleij +Signed-off-by: Lee Jones +Link: https://lore.kernel.org/r/6a8a19bc67b5be3732882e8131ad2ffcb546ac03.1684182964.git.jahau@rocketmail.com +Signed-off-by: Sasha Levin +--- + drivers/mfd/rt5033.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/mfd/rt5033.c b/drivers/mfd/rt5033.c +index f1236a9acf304..df095e91e2666 100644 +--- a/drivers/mfd/rt5033.c ++++ b/drivers/mfd/rt5033.c +@@ -41,9 +41,6 @@ static const struct mfd_cell rt5033_devs[] = { + { + .name = "rt5033-charger", + .of_compatible = "richtek,rt5033-charger", +- }, { +- .name = "rt5033-battery", +- .of_compatible = "richtek,rt5033-battery", + }, { + .name = "rt5033-led", + .of_compatible = "richtek,rt5033-led", +-- +2.39.2 + diff --git a/queue-6.1/mfd-stmfx-fix-error-path-in-stmfx_chip_init.patch b/queue-6.1/mfd-stmfx-fix-error-path-in-stmfx_chip_init.patch new file mode 100644 index 00000000000..634514e1e87 --- /dev/null +++ b/queue-6.1/mfd-stmfx-fix-error-path-in-stmfx_chip_init.patch @@ -0,0 +1,38 @@ +From 8469c140c3ad64584d7932310e819a44f381cc8b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Jun 2023 11:28:03 +0200 +Subject: mfd: stmfx: Fix error path in stmfx_chip_init + +From: Amelie Delaunay + +[ Upstream commit f592cf624531286f8b52e40dcfc157a5a7fb115c ] + +In error path, disable vdd regulator if it exists, but don't overload ret. +Because if regulator_disable() is successful, stmfx_chip_init will exit +successfully while chip init failed. + +Fixes: 06252ade9156 ("mfd: Add ST Multi-Function eXpander (STMFX) core driver") +Signed-off-by: Amelie Delaunay +Link: https://lore.kernel.org/r/20230609092804.793100-1-amelie.delaunay@foss.st.com +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/stmfx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/mfd/stmfx.c b/drivers/mfd/stmfx.c +index 5dd7d96884596..61a8aad564a4e 100644 +--- a/drivers/mfd/stmfx.c ++++ b/drivers/mfd/stmfx.c +@@ -387,7 +387,7 @@ static int stmfx_chip_init(struct i2c_client *client) + + err: + if (stmfx->vdd) +- return regulator_disable(stmfx->vdd); ++ regulator_disable(stmfx->vdd); + + return ret; + } +-- +2.39.2 + diff --git a/queue-6.1/mfd-stmfx-nullify-stmfx-vdd-in-case-of-error.patch b/queue-6.1/mfd-stmfx-nullify-stmfx-vdd-in-case-of-error.patch new file mode 100644 index 00000000000..7221b82765c --- /dev/null +++ b/queue-6.1/mfd-stmfx-nullify-stmfx-vdd-in-case-of-error.patch @@ -0,0 +1,41 @@ +From 0cacb5dc39c5f84d901869628aaa2c86e43337a6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Jun 2023 11:28:04 +0200 +Subject: mfd: stmfx: Nullify stmfx->vdd in case of error + +From: Amelie Delaunay + +[ Upstream commit 7c81582c0bccb4757186176f0ee12834597066ad ] + +Nullify stmfx->vdd in case devm_regulator_get_optional() returns an error. +And simplify code by returning an error only if return code is not -ENODEV, +which means there is no vdd regulator and it is not an issue. + +Fixes: d75846ed08e6 ("mfd: stmfx: Fix dev_err_probe() call in stmfx_chip_init()") +Signed-off-by: Amelie Delaunay +Link: https://lore.kernel.org/r/20230609092804.793100-2-amelie.delaunay@foss.st.com +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/stmfx.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/mfd/stmfx.c b/drivers/mfd/stmfx.c +index 61a8aad564a4e..b1ecd85ad2a8a 100644 +--- a/drivers/mfd/stmfx.c ++++ b/drivers/mfd/stmfx.c +@@ -330,9 +330,8 @@ static int stmfx_chip_init(struct i2c_client *client) + stmfx->vdd = devm_regulator_get_optional(&client->dev, "vdd"); + ret = PTR_ERR_OR_ZERO(stmfx->vdd); + if (ret) { +- if (ret == -ENODEV) +- stmfx->vdd = NULL; +- else ++ stmfx->vdd = NULL; ++ if (ret != -ENODEV) + return dev_err_probe(&client->dev, ret, "Failed to get VDD regulator\n"); + } + +-- +2.39.2 + diff --git a/queue-6.1/mfd-stmpe-only-disable-the-regulators-if-they-are-en.patch b/queue-6.1/mfd-stmpe-only-disable-the-regulators-if-they-are-en.patch new file mode 100644 index 00000000000..308d7c62096 --- /dev/null +++ b/queue-6.1/mfd-stmpe-only-disable-the-regulators-if-they-are-en.patch @@ -0,0 +1,45 @@ +From ffe7e651447359f734b9d258cc6c16fe2e8651c3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 17 Jun 2023 12:43:16 +0200 +Subject: mfd: stmpe: Only disable the regulators if they are enabled + +From: Christophe JAILLET + +[ Upstream commit 104d32bd81f620bb9f67fbf7d1159c414e89f05f ] + +In stmpe_probe(), if some regulator_enable() calls fail, probing continues +and there is only a dev_warn(). + +So, if stmpe_probe() is called the regulator may not be enabled. It is +cleaner to test it before calling regulator_disable() in the remove +function. + +Fixes: 9c9e321455fb ("mfd: stmpe: add optional regulators") +Signed-off-by: Christophe JAILLET +Reviewed-by: Linus Walleij +Link: https://lore.kernel.org/r/8de3aaf297931d655b9ad6aed548f4de8b85425a.1686998575.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/stmpe.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/mfd/stmpe.c b/drivers/mfd/stmpe.c +index 0c4f74197d3e0..aef29221d7c12 100644 +--- a/drivers/mfd/stmpe.c ++++ b/drivers/mfd/stmpe.c +@@ -1485,9 +1485,9 @@ int stmpe_probe(struct stmpe_client_info *ci, enum stmpe_partnum partnum) + + void stmpe_remove(struct stmpe *stmpe) + { +- if (!IS_ERR(stmpe->vio)) ++ if (!IS_ERR(stmpe->vio) && regulator_is_enabled(stmpe->vio)) + regulator_disable(stmpe->vio); +- if (!IS_ERR(stmpe->vcc)) ++ if (!IS_ERR(stmpe->vcc) && regulator_is_enabled(stmpe->vcc)) + regulator_disable(stmpe->vcc); + + __stmpe_disable(stmpe, STMPE_BLOCK_ADC); +-- +2.39.2 + diff --git a/queue-6.1/mfd-wcd934x-fix-an-error-handling-path-in-wcd934x_sl.patch b/queue-6.1/mfd-wcd934x-fix-an-error-handling-path-in-wcd934x_sl.patch new file mode 100644 index 00000000000..907c024b9a7 --- /dev/null +++ b/queue-6.1/mfd-wcd934x-fix-an-error-handling-path-in-wcd934x_sl.patch @@ -0,0 +1,54 @@ +From 7cfbbcaae53ee4cda32d447a3e18ede6cea50ec6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 20 May 2023 09:10:54 +0200 +Subject: mfd: wcd934x: Fix an error handling path in wcd934x_slim_probe() + +From: Christophe JAILLET + +[ Upstream commit f190b4891a3f9fac123a7afd378d4143a2723313 ] + +If devm_gpiod_get_optional() fails, some resources need to be released, as +already done in the .remove() function. + +While at it, remove the unneeded error code from a dev_err_probe() call. +It is already added in a human readable way by dev_err_probe() itself. + +Fixes: 6a0ee2a61a31 ("mfd: wcd934x: Replace legacy gpio interface for gpiod") +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/02d8447f6d1df52cc8357aae698152e9a9be67c6.1684565021.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/wcd934x.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/drivers/mfd/wcd934x.c b/drivers/mfd/wcd934x.c +index 68e2fa2fda99c..32ed2bd863758 100644 +--- a/drivers/mfd/wcd934x.c ++++ b/drivers/mfd/wcd934x.c +@@ -253,8 +253,9 @@ static int wcd934x_slim_probe(struct slim_device *sdev) + usleep_range(600, 650); + reset_gpio = devm_gpiod_get_optional(dev, "reset", GPIOD_OUT_LOW); + if (IS_ERR(reset_gpio)) { +- return dev_err_probe(dev, PTR_ERR(reset_gpio), +- "Failed to get reset gpio: err = %ld\n", PTR_ERR(reset_gpio)); ++ ret = dev_err_probe(dev, PTR_ERR(reset_gpio), ++ "Failed to get reset gpio\n"); ++ goto err_disable_regulators; + } + msleep(20); + gpiod_set_value(reset_gpio, 1); +@@ -264,6 +265,10 @@ static int wcd934x_slim_probe(struct slim_device *sdev) + dev_set_drvdata(dev, ddata); + + return 0; ++ ++err_disable_regulators: ++ regulator_bulk_disable(WCD934X_MAX_SUPPLY, ddata->supplies); ++ return ret; + } + + static void wcd934x_slim_remove(struct slim_device *sdev) +-- +2.39.2 + diff --git a/queue-6.1/misc-fastrpc-check-return-value-of-devm_kasprintf.patch b/queue-6.1/misc-fastrpc-check-return-value-of-devm_kasprintf.patch new file mode 100644 index 00000000000..de4dd947d1f --- /dev/null +++ b/queue-6.1/misc-fastrpc-check-return-value-of-devm_kasprintf.patch @@ -0,0 +1,39 @@ +From 978040058f7f3afca9014652a9e82e866d9b9dcf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Jun 2023 13:25:46 +0300 +Subject: misc: fastrpc: check return value of devm_kasprintf() + +From: Claudiu Beznea + +[ Upstream commit af2e19d82a116bc622eea84c9faadd5f7e20bec4 ] + +devm_kasprintf() returns a pointer to dynamically allocated memory. +Pointer could be NULL in case allocation fails. Check pointer validity. +Identified with coccinelle (kmerr.cocci script). + +Fixes: 3abe3ab3cdab ("misc: fastrpc: add secure domain support") +Signed-off-by: Claudiu Beznea +Link: https://lore.kernel.org/r/20230615102546.581899-1-claudiu.beznea@microchip.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/misc/fastrpc.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c +index 8b1e8661c3d73..e5cabb9012135 100644 +--- a/drivers/misc/fastrpc.c ++++ b/drivers/misc/fastrpc.c +@@ -2030,6 +2030,9 @@ static int fastrpc_device_register(struct device *dev, struct fastrpc_channel_ct + fdev->miscdev.fops = &fastrpc_fops; + fdev->miscdev.name = devm_kasprintf(dev, GFP_KERNEL, "fastrpc-%s%s", + domain, is_secured ? "-secure" : ""); ++ if (!fdev->miscdev.name) ++ return -ENOMEM; ++ + err = misc_register(&fdev->miscdev); + if (!err) { + if (is_secured) +-- +2.39.2 + diff --git a/queue-6.1/mlxsw-minimal-fix-potential-memory-leak-in-mlxsw_m_l.patch b/queue-6.1/mlxsw-minimal-fix-potential-memory-leak-in-mlxsw_m_l.patch new file mode 100644 index 00000000000..20953f691b6 --- /dev/null +++ b/queue-6.1/mlxsw-minimal-fix-potential-memory-leak-in-mlxsw_m_l.patch @@ -0,0 +1,40 @@ +From 306e5a516d905a13efedf937d35cc54f1dad884c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Jun 2023 09:26:47 +0800 +Subject: mlxsw: minimal: fix potential memory leak in mlxsw_m_linecards_init + +From: Zhengchao Shao + +[ Upstream commit 08fc75735fda3be97194bfbf3c899c87abb3d0fe ] + +The line cards array is not freed in the error path of +mlxsw_m_linecards_init(), which can lead to a memory leak. Fix by +freeing the array in the error path, thereby making the error path +identical to mlxsw_m_linecards_fini(). + +Fixes: 01328e23a476 ("mlxsw: minimal: Extend module to port mapping with slot index") +Signed-off-by: Zhengchao Shao +Reviewed-by: Petr Machata +Reviewed-by: Ido Schimmel +Link: https://lore.kernel.org/r/20230630012647.1078002-1-shaozhengchao@huawei.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlxsw/minimal.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/mellanox/mlxsw/minimal.c b/drivers/net/ethernet/mellanox/mlxsw/minimal.c +index 55b3c42bb0071..15116d9305f8e 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/minimal.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/minimal.c +@@ -430,6 +430,7 @@ static int mlxsw_m_linecards_init(struct mlxsw_m *mlxsw_m) + err_kmalloc_array: + for (i--; i >= 0; i--) + kfree(mlxsw_m->line_cards[i]); ++ kfree(mlxsw_m->line_cards); + err_kcalloc: + kfree(mlxsw_m->ports); + return err; +-- +2.39.2 + diff --git a/queue-6.1/net-add-a-couple-of-helpers-for-iph-tot_len.patch b/queue-6.1/net-add-a-couple-of-helpers-for-iph-tot_len.patch new file mode 100644 index 00000000000..1805c87793f --- /dev/null +++ b/queue-6.1/net-add-a-couple-of-helpers-for-iph-tot_len.patch @@ -0,0 +1,74 @@ +From 908fc3452bd6b93af1ffe28a9e1db4e1d418dc0c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 28 Jan 2023 10:58:30 -0500 +Subject: net: add a couple of helpers for iph tot_len + +From: Xin Long + +[ Upstream commit 058a8f7f73aae1cc22b53fcefec031b9e391b54d ] + +This patch adds three APIs to replace the iph->tot_len setting +and getting in all places where IPv4 BIG TCP packets may reach, +they will be used in the following patches. + +Note that iph_totlen() will be used when iph is not in linear +data of the skb. + +Signed-off-by: Xin Long +Reviewed-by: David Ahern +Reviewed-by: Eric Dumazet +Signed-off-by: Jakub Kicinski +Stable-dep-of: b2dc32dcba08 ("net/sched: act_ipt: add sanity checks on skb before calling target") +Signed-off-by: Sasha Levin +--- + include/linux/ip.h | 21 +++++++++++++++++++++ + include/net/route.h | 3 --- + 2 files changed, 21 insertions(+), 3 deletions(-) + +diff --git a/include/linux/ip.h b/include/linux/ip.h +index 3d9c6750af627..d11c25f5030a0 100644 +--- a/include/linux/ip.h ++++ b/include/linux/ip.h +@@ -35,4 +35,25 @@ static inline unsigned int ip_transport_len(const struct sk_buff *skb) + { + return ntohs(ip_hdr(skb)->tot_len) - skb_network_header_len(skb); + } ++ ++static inline unsigned int iph_totlen(const struct sk_buff *skb, const struct iphdr *iph) ++{ ++ u32 len = ntohs(iph->tot_len); ++ ++ return (len || !skb_is_gso(skb) || !skb_is_gso_tcp(skb)) ? ++ len : skb->len - skb_network_offset(skb); ++} ++ ++static inline unsigned int skb_ip_totlen(const struct sk_buff *skb) ++{ ++ return iph_totlen(skb, ip_hdr(skb)); ++} ++ ++/* IPv4 datagram length is stored into 16bit field (tot_len) */ ++#define IP_MAX_MTU 0xFFFFU ++ ++static inline void iph_set_totlen(struct iphdr *iph, unsigned int len) ++{ ++ iph->tot_len = len <= IP_MAX_MTU ? htons(len) : 0; ++} + #endif /* _LINUX_IP_H */ +diff --git a/include/net/route.h b/include/net/route.h +index 6e92dd5bcd613..fe00b0a2e4759 100644 +--- a/include/net/route.h ++++ b/include/net/route.h +@@ -35,9 +35,6 @@ + #include + #include + +-/* IPv4 datagram length is stored into 16bit field (tot_len) */ +-#define IP_MAX_MTU 0xFFFFU +- + #define RTO_ONLINK 0x01 + + #define RT_CONN_FLAGS(sk) (RT_TOS(inet_sk(sk)->tos) | sock_flag(sk, SOCK_LOCALROUTE)) +-- +2.39.2 + diff --git a/queue-6.1/net-bridge-keep-ports-without-iff_unicast_flt-in-br_.patch b/queue-6.1/net-bridge-keep-ports-without-iff_unicast_flt-in-br_.patch new file mode 100644 index 00000000000..8e6f2edbd87 --- /dev/null +++ b/queue-6.1/net-bridge-keep-ports-without-iff_unicast_flt-in-br_.patch @@ -0,0 +1,198 @@ +From 6d3954e12c1b9bb98860ea0660f32b6c3b2a101d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Jun 2023 19:41:18 +0300 +Subject: net: bridge: keep ports without IFF_UNICAST_FLT in BR_PROMISC mode + +From: Vladimir Oltean + +[ Upstream commit 6ca3c005d0604e8d2b439366e3923ea58db99641 ] + +According to the synchronization rules for .ndo_get_stats() as seen in +Documentation/networking/netdevices.rst, acquiring a plain spin_lock() +should not be illegal, but the bridge driver implementation makes it so. + +After running these commands, I am being faced with the following +lockdep splat: + +$ ip link add link swp0 name macsec0 type macsec encrypt on && ip link set swp0 up +$ ip link add dev br0 type bridge vlan_filtering 1 && ip link set br0 up +$ ip link set macsec0 master br0 && ip link set macsec0 up + + ======================================================== + WARNING: possible irq lock inversion dependency detected + 6.4.0-04295-g31b577b4bd4a #603 Not tainted + -------------------------------------------------------- + swapper/1/0 just changed the state of lock: + ffff6bd348724cd8 (&br->lock){+.-.}-{3:3}, at: br_forward_delay_timer_expired+0x34/0x198 + but this lock took another, SOFTIRQ-unsafe lock in the past: + (&ocelot->stats_lock){+.+.}-{3:3} + + and interrupts could create inverse lock ordering between them. + + other info that might help us debug this: + Chain exists of: + &br->lock --> &br->hash_lock --> &ocelot->stats_lock + + Possible interrupt unsafe locking scenario: + + CPU0 CPU1 + ---- ---- + lock(&ocelot->stats_lock); + local_irq_disable(); + lock(&br->lock); + lock(&br->hash_lock); + + lock(&br->lock); + + *** DEADLOCK *** + +(details about the 3 locks skipped) + +swp0 is instantiated by drivers/net/dsa/ocelot/felix.c, and this +only matters to the extent that its .ndo_get_stats64() method calls +spin_lock(&ocelot->stats_lock). + +Documentation/locking/lockdep-design.rst says: + +| A lock is irq-safe means it was ever used in an irq context, while a lock +| is irq-unsafe means it was ever acquired with irq enabled. + +(...) + +| Furthermore, the following usage based lock dependencies are not allowed +| between any two lock-classes:: +| +| -> +| -> + +Lockdep marks br->hash_lock as softirq-safe, because it is sometimes +taken in softirq context (for example br_fdb_update() which runs in +NET_RX softirq), and when it's not in softirq context it blocks softirqs +by using spin_lock_bh(). + +Lockdep marks ocelot->stats_lock as softirq-unsafe, because it never +blocks softirqs from running, and it is never taken from softirq +context. So it can always be interrupted by softirqs. + +There is a call path through which a function that holds br->hash_lock: +fdb_add_hw_addr() will call a function that acquires ocelot->stats_lock: +ocelot_port_get_stats64(). This can be seen below: + +ocelot_port_get_stats64+0x3c/0x1e0 +felix_get_stats64+0x20/0x38 +dsa_slave_get_stats64+0x3c/0x60 +dev_get_stats+0x74/0x2c8 +rtnl_fill_stats+0x4c/0x150 +rtnl_fill_ifinfo+0x5cc/0x7b8 +rtmsg_ifinfo_build_skb+0xe4/0x150 +rtmsg_ifinfo+0x5c/0xb0 +__dev_notify_flags+0x58/0x200 +__dev_set_promiscuity+0xa0/0x1f8 +dev_set_promiscuity+0x30/0x70 +macsec_dev_change_rx_flags+0x68/0x88 +__dev_set_promiscuity+0x1a8/0x1f8 +__dev_set_rx_mode+0x74/0xa8 +dev_uc_add+0x74/0xa0 +fdb_add_hw_addr+0x68/0xd8 +fdb_add_local+0xc4/0x110 +br_fdb_add_local+0x54/0x88 +br_add_if+0x338/0x4a0 +br_add_slave+0x20/0x38 +do_setlink+0x3a4/0xcb8 +rtnl_newlink+0x758/0x9d0 +rtnetlink_rcv_msg+0x2f0/0x550 +netlink_rcv_skb+0x128/0x148 +rtnetlink_rcv+0x24/0x38 + +the plain English explanation for it is: + +The macsec0 bridge port is created without p->flags & BR_PROMISC, +because it is what br_manage_promisc() decides for a VLAN filtering +bridge with a single auto port. + +As part of the br_add_if() procedure, br_fdb_add_local() is called for +the MAC address of the device, and this results in a call to +dev_uc_add() for macsec0 while the softirq-safe br->hash_lock is taken. + +Because macsec0 does not have IFF_UNICAST_FLT, dev_uc_add() ends up +calling __dev_set_promiscuity() for macsec0, which is propagated by its +implementation, macsec_dev_change_rx_flags(), to the lower device: swp0. +This triggers the call path: + +dev_set_promiscuity(swp0) +-> rtmsg_ifinfo() + -> dev_get_stats() + -> ocelot_port_get_stats64() + +with a calling context that lockdep doesn't like (br->hash_lock held). + +Normally we don't see this, because even though many drivers that can be +bridge ports don't support IFF_UNICAST_FLT, we need a driver that + +(a) doesn't support IFF_UNICAST_FLT, *and* +(b) it forwards the IFF_PROMISC flag to another driver, and +(c) *that* driver implements ndo_get_stats64() using a softirq-unsafe + spinlock. + +Condition (b) is necessary because the first __dev_set_rx_mode() calls +__dev_set_promiscuity() with "bool notify=false", and thus, the +rtmsg_ifinfo() code path won't be entered. + +The same criteria also hold true for DSA switches which don't report +IFF_UNICAST_FLT. When the DSA master uses a spin_lock() in its +ndo_get_stats64() method, the same lockdep splat can be seen. + +I think the deadlock possibility is real, even though I didn't reproduce +it, and I'm thinking of the following situation to support that claim: + +fdb_add_hw_addr() runs on a CPU A, in a context with softirqs locally +disabled and br->hash_lock held, and may end up attempting to acquire +ocelot->stats_lock. + +In parallel, ocelot->stats_lock is currently held by a thread B (say, +ocelot_check_stats_work()), which is interrupted while holding it by a +softirq which attempts to lock br->hash_lock. + +Thread B cannot make progress because br->hash_lock is held by A. Whereas +thread A cannot make progress because ocelot->stats_lock is held by B. + +When taking the issue at face value, the bridge can avoid that problem +by simply making the ports promiscuous from a code path with a saner +calling context (br->hash_lock not held). A bridge port without +IFF_UNICAST_FLT is going to become promiscuous as soon as we call +dev_uc_add() on it (which we do unconditionally), so why not be +preemptive and make it promiscuous right from the beginning, so as to +not be taken by surprise. + +With this, we've broken the links between code that holds br->hash_lock +or br->lock and code that calls into the ndo_change_rx_flags() or +ndo_get_stats64() ops of the bridge port. + +Fixes: 2796d0c648c9 ("bridge: Automatically manage port promiscuous mode.") +Signed-off-by: Vladimir Oltean +Reviewed-by: Ido Schimmel +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/bridge/br_if.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c +index 228fd5b20f109..0989074f316ef 100644 +--- a/net/bridge/br_if.c ++++ b/net/bridge/br_if.c +@@ -166,8 +166,9 @@ void br_manage_promisc(struct net_bridge *br) + * This lets us disable promiscuous mode and write + * this config to hw. + */ +- if (br->auto_cnt == 0 || +- (br->auto_cnt == 1 && br_auto_port(p))) ++ if ((p->dev->priv_flags & IFF_UNICAST_FLT) && ++ (br->auto_cnt == 0 || ++ (br->auto_cnt == 1 && br_auto_port(p)))) + br_port_clear_promisc(p); + else + br_port_set_promisc(p); +-- +2.39.2 + diff --git a/queue-6.1/net-dsa-felix-don-t-drop-ptp-frames-with-tag_8021q-w.patch b/queue-6.1/net-dsa-felix-don-t-drop-ptp-frames-with-tag_8021q-w.patch new file mode 100644 index 00000000000..9dafcb2e493 --- /dev/null +++ b/queue-6.1/net-dsa-felix-don-t-drop-ptp-frames-with-tag_8021q-w.patch @@ -0,0 +1,71 @@ +From b640761babc2557583a919e7b0f0a5ce54621e5f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Jun 2023 19:31:14 +0300 +Subject: net: dsa: felix: don't drop PTP frames with tag_8021q when RX + timestamping is disabled + +From: Vladimir Oltean + +[ Upstream commit 2edcfcbb3c5946609be1d8875473a240b170673b ] + +The driver implements a workaround for the fact that it doesn't have an +IRQ source to tell it whether PTP frames are available through the +extraction registers, for those frames to be processed and passed +towards the network stack. That workaround is to configure the switch, +through felix_hwtstamp_set() -> felix_update_trapping_destinations(), +to create two copies of PTP packets: one sent over Ethernet to the DSA +master, and one to be consumed through the aforementioned CPU extraction +queue registers. + +The reason why we want PTP packets to be consumed through the CPU +extraction registers in the first place is because we want to see their +hardware RX timestamp. With tag_8021q, that is only visible that way, +and it isn't visible with the copy of the packet that's transmitted over +Ethernet. + +The problem with the workaround implementation is that it drops the +packet received over Ethernet, in expectation of its copy being present +in the CPU extraction registers. However, if felix_hwtstamp_set() hasn't +run (aka PTP RX timestamping is disabled), the driver will drop the +original PTP frame and there will be no copy of it in the CPU extraction +registers. So, the network stack will simply not see any PTP frame. + +Look at the port's trapping configuration to see whether the driver has +previously enabled the CPU extraction registers. If it hasn't, just +don't RX timestamp the frame and let it be passed up the stack by DSA, +which is perfectly fine. + +Fixes: 0a6f17c6ae21 ("net: dsa: tag_ocelot_8021q: add support for PTP timestamping") +Signed-off-by: Vladimir Oltean +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/ocelot/felix.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/drivers/net/dsa/ocelot/felix.c b/drivers/net/dsa/ocelot/felix.c +index dd3a18cc89dd2..4faabc4364aa7 100644 +--- a/drivers/net/dsa/ocelot/felix.c ++++ b/drivers/net/dsa/ocelot/felix.c +@@ -1705,6 +1705,18 @@ static bool felix_rxtstamp(struct dsa_switch *ds, int port, + u32 tstamp_hi; + u64 tstamp; + ++ switch (type & PTP_CLASS_PMASK) { ++ case PTP_CLASS_L2: ++ if (!(ocelot->ports[port]->trap_proto & OCELOT_PROTO_PTP_L2)) ++ return false; ++ break; ++ case PTP_CLASS_IPV4: ++ case PTP_CLASS_IPV6: ++ if (!(ocelot->ports[port]->trap_proto & OCELOT_PROTO_PTP_L4)) ++ return false; ++ break; ++ } ++ + /* If the "no XTR IRQ" workaround is in use, tell DSA to defer this skb + * for RX timestamping. Then free it, and poll for its copy through + * MMIO in the CPU port module, and inject that into the stack from +-- +2.39.2 + diff --git a/queue-6.1/net-dsa-sja1105-always-enable-the-incl_srcpt-option.patch b/queue-6.1/net-dsa-sja1105-always-enable-the-incl_srcpt-option.patch new file mode 100644 index 00000000000..ef55872c557 --- /dev/null +++ b/queue-6.1/net-dsa-sja1105-always-enable-the-incl_srcpt-option.patch @@ -0,0 +1,77 @@ +From 2e9ad3c5c55d896502f2645040c62dcfed0e30c5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Jun 2023 12:42:06 +0300 +Subject: net: dsa: sja1105: always enable the INCL_SRCPT option + +From: Vladimir Oltean + +[ Upstream commit b4638af8885af93cd70351081da1909c59342440 ] + +Link-local traffic on bridged SJA1105 ports is sometimes tagged by the +hardware with source port information (when the port is under a VLAN +aware bridge). + +The tag_8021q source port identification has become more loose +("imprecise") and will report a plausible rather than exact bridge port, +when under a bridge (be it VLAN-aware or VLAN-unaware). But link-local +traffic always needs to know the precise source port. + +Modify the driver logic (and therefore: the tagging protocol itself) to +always include the source port information with link-local packets, +regardless of whether the port is standalone, under a VLAN-aware or +VLAN-unaware bridge. This makes it possible for the tagging driver to +give priority to that information over the tag_8021q VLAN header. + +The big drawback with INCL_SRCPT is that it makes it impossible to +distinguish between an original MAC DA of 01:80:C2:XX:YY:ZZ and +01:80:C2:AA:BB:ZZ, because the tagger just patches MAC DA bytes 3 and 4 +with zeroes. Only if PTP RX timestamping is enabled, the switch will +generate a META follow-up frame containing the RX timestamp and the +original bytes 3 and 4 of the MAC DA. Those will be used to patch up the +original packet. Nonetheless, in the absence of PTP RX timestamping, we +have to live with this limitation, since it is more important to have +the more precise source port information for link-local traffic. + +Fixes: d7f9787a763f ("net: dsa: tag_8021q: add support for imprecise RX based on the VBID") +Fixes: 91495f21fcec ("net: dsa: tag_8021q: replace the SVL bridging with VLAN-unaware IVL bridging") +Signed-off-by: Vladimir Oltean +Reviewed-by: Simon Horman +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/sja1105/sja1105_main.c | 9 ++------- + 1 file changed, 2 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/dsa/sja1105/sja1105_main.c b/drivers/net/dsa/sja1105/sja1105_main.c +index b70dcf32a26dc..8bd61f2ebb2ad 100644 +--- a/drivers/net/dsa/sja1105/sja1105_main.c ++++ b/drivers/net/dsa/sja1105/sja1105_main.c +@@ -866,11 +866,11 @@ static int sja1105_init_general_params(struct sja1105_private *priv) + .hostprio = 7, + .mac_fltres1 = SJA1105_LINKLOCAL_FILTER_A, + .mac_flt1 = SJA1105_LINKLOCAL_FILTER_A_MASK, +- .incl_srcpt1 = false, ++ .incl_srcpt1 = true, + .send_meta1 = false, + .mac_fltres0 = SJA1105_LINKLOCAL_FILTER_B, + .mac_flt0 = SJA1105_LINKLOCAL_FILTER_B_MASK, +- .incl_srcpt0 = false, ++ .incl_srcpt0 = true, + .send_meta0 = false, + /* Default to an invalid value */ + .mirr_port = priv->ds->num_ports, +@@ -2407,11 +2407,6 @@ int sja1105_vlan_filtering(struct dsa_switch *ds, int port, bool enabled, + general_params->tpid = tpid; + /* EtherType used to identify outer tagged (S-tag) VLAN traffic */ + general_params->tpid2 = tpid2; +- /* When VLAN filtering is on, we need to at least be able to +- * decode management traffic through the "backup plan". +- */ +- general_params->incl_srcpt1 = enabled; +- general_params->incl_srcpt0 = enabled; + + for (port = 0; port < ds->num_ports; port++) { + if (dsa_is_unused_port(ds, port)) +-- +2.39.2 + diff --git a/queue-6.1/net-dsa-sja1105-always-enable-the-send_meta-options.patch b/queue-6.1/net-dsa-sja1105-always-enable-the-send_meta-options.patch new file mode 100644 index 00000000000..ec03a15d786 --- /dev/null +++ b/queue-6.1/net-dsa-sja1105-always-enable-the-send_meta-options.patch @@ -0,0 +1,315 @@ +From 48e1417bf8b6cb026e9cc1d86a6230e71f9fb2cc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Jul 2023 01:05:45 +0300 +Subject: net: dsa: sja1105: always enable the send_meta options + +From: Vladimir Oltean + +[ Upstream commit a372d66af48506d9f7aaae2a474cd18f14d98cb8 ] + +incl_srcpt has the limitation, mentioned in commit b4638af8885a ("net: +dsa: sja1105: always enable the INCL_SRCPT option"), that frames with a +MAC DA of 01:80:c2:xx:yy:zz will be received as 01:80:c2:00:00:zz unless +PTP RX timestamping is enabled. + +The incl_srcpt option was initially unconditionally enabled, then that +changed with commit 42824463d38d ("net: dsa: sja1105: Limit use of +incl_srcpt to bridge+vlan mode"), then again with b4638af8885a ("net: +dsa: sja1105: always enable the INCL_SRCPT option"). Bottom line is that +it now needs to be always enabled, otherwise the driver does not have a +reliable source of information regarding source_port and switch_id for +link-local traffic (tag_8021q VLANs may be imprecise since now they +identify an entire bridging domain when ports are not standalone). + +If we accept that PTP RX timestamping (and therefore, meta frame +generation) is always enabled in hardware, then that limitation could be +avoided and packets with any MAC DA can be properly received, because +meta frames do contain the original bytes from the MAC DA of their +associated link-local packet. + +This change enables meta frame generation unconditionally, which also +has the nice side effects of simplifying the switch control path +(a switch reset is no longer required on hwtstamping settings change) +and the tagger data path (it no longer needs to be informed whether to +expect meta frames or not - it always does). + +Fixes: 227d07a07ef1 ("net: dsa: sja1105: Add support for traffic through standalone ports") +Signed-off-by: Vladimir Oltean +Reviewed-by: Simon Horman +Reviewed-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/sja1105/sja1105.h | 2 +- + drivers/net/dsa/sja1105/sja1105_main.c | 5 ++- + drivers/net/dsa/sja1105/sja1105_ptp.c | 48 +++----------------------- + include/linux/dsa/sja1105.h | 4 --- + net/dsa/tag_sja1105.c | 45 ------------------------ + 5 files changed, 7 insertions(+), 97 deletions(-) + +diff --git a/drivers/net/dsa/sja1105/sja1105.h b/drivers/net/dsa/sja1105/sja1105.h +index 9ba2ec2b966d9..fb3cd4c78faa8 100644 +--- a/drivers/net/dsa/sja1105/sja1105.h ++++ b/drivers/net/dsa/sja1105/sja1105.h +@@ -250,6 +250,7 @@ struct sja1105_private { + unsigned long ucast_egress_floods; + unsigned long bcast_egress_floods; + unsigned long hwts_tx_en; ++ unsigned long hwts_rx_en; + const struct sja1105_info *info; + size_t max_xfer_len; + struct spi_device *spidev; +@@ -287,7 +288,6 @@ struct sja1105_spi_message { + /* From sja1105_main.c */ + enum sja1105_reset_reason { + SJA1105_VLAN_FILTERING = 0, +- SJA1105_RX_HWTSTAMPING, + SJA1105_AGEING_TIME, + SJA1105_SCHEDULING, + SJA1105_BEST_EFFORT_POLICING, +diff --git a/drivers/net/dsa/sja1105/sja1105_main.c b/drivers/net/dsa/sja1105/sja1105_main.c +index 8bd61f2ebb2ad..947e8f7c09880 100644 +--- a/drivers/net/dsa/sja1105/sja1105_main.c ++++ b/drivers/net/dsa/sja1105/sja1105_main.c +@@ -867,11 +867,11 @@ static int sja1105_init_general_params(struct sja1105_private *priv) + .mac_fltres1 = SJA1105_LINKLOCAL_FILTER_A, + .mac_flt1 = SJA1105_LINKLOCAL_FILTER_A_MASK, + .incl_srcpt1 = true, +- .send_meta1 = false, ++ .send_meta1 = true, + .mac_fltres0 = SJA1105_LINKLOCAL_FILTER_B, + .mac_flt0 = SJA1105_LINKLOCAL_FILTER_B_MASK, + .incl_srcpt0 = true, +- .send_meta0 = false, ++ .send_meta0 = true, + /* Default to an invalid value */ + .mirr_port = priv->ds->num_ports, + /* No TTEthernet */ +@@ -2215,7 +2215,6 @@ static int sja1105_reload_cbs(struct sja1105_private *priv) + + static const char * const sja1105_reset_reasons[] = { + [SJA1105_VLAN_FILTERING] = "VLAN filtering", +- [SJA1105_RX_HWTSTAMPING] = "RX timestamping", + [SJA1105_AGEING_TIME] = "Ageing time", + [SJA1105_SCHEDULING] = "Time-aware scheduling", + [SJA1105_BEST_EFFORT_POLICING] = "Best-effort policing", +diff --git a/drivers/net/dsa/sja1105/sja1105_ptp.c b/drivers/net/dsa/sja1105/sja1105_ptp.c +index 30fb2cc40164b..a7d41e7813982 100644 +--- a/drivers/net/dsa/sja1105/sja1105_ptp.c ++++ b/drivers/net/dsa/sja1105/sja1105_ptp.c +@@ -58,35 +58,10 @@ enum sja1105_ptp_clk_mode { + #define ptp_data_to_sja1105(d) \ + container_of((d), struct sja1105_private, ptp_data) + +-/* Must be called only while the RX timestamping state of the tagger +- * is turned off +- */ +-static int sja1105_change_rxtstamping(struct sja1105_private *priv, +- bool on) +-{ +- struct sja1105_ptp_data *ptp_data = &priv->ptp_data; +- struct sja1105_general_params_entry *general_params; +- struct sja1105_table *table; +- +- table = &priv->static_config.tables[BLK_IDX_GENERAL_PARAMS]; +- general_params = table->entries; +- general_params->send_meta1 = on; +- general_params->send_meta0 = on; +- +- ptp_cancel_worker_sync(ptp_data->clock); +- skb_queue_purge(&ptp_data->skb_txtstamp_queue); +- skb_queue_purge(&ptp_data->skb_rxtstamp_queue); +- +- return sja1105_static_config_reload(priv, SJA1105_RX_HWTSTAMPING); +-} +- + int sja1105_hwtstamp_set(struct dsa_switch *ds, int port, struct ifreq *ifr) + { +- struct sja1105_tagger_data *tagger_data = sja1105_tagger_data(ds); + struct sja1105_private *priv = ds->priv; + struct hwtstamp_config config; +- bool rx_on; +- int rc; + + if (copy_from_user(&config, ifr->ifr_data, sizeof(config))) + return -EFAULT; +@@ -104,26 +79,13 @@ int sja1105_hwtstamp_set(struct dsa_switch *ds, int port, struct ifreq *ifr) + + switch (config.rx_filter) { + case HWTSTAMP_FILTER_NONE: +- rx_on = false; ++ priv->hwts_rx_en &= ~BIT(port); + break; + default: +- rx_on = true; ++ priv->hwts_rx_en |= BIT(port); + break; + } + +- if (rx_on != tagger_data->rxtstamp_get_state(ds)) { +- tagger_data->rxtstamp_set_state(ds, false); +- +- rc = sja1105_change_rxtstamping(priv, rx_on); +- if (rc < 0) { +- dev_err(ds->dev, +- "Failed to change RX timestamping: %d\n", rc); +- return rc; +- } +- if (rx_on) +- tagger_data->rxtstamp_set_state(ds, true); +- } +- + if (copy_to_user(ifr->ifr_data, &config, sizeof(config))) + return -EFAULT; + return 0; +@@ -131,7 +93,6 @@ int sja1105_hwtstamp_set(struct dsa_switch *ds, int port, struct ifreq *ifr) + + int sja1105_hwtstamp_get(struct dsa_switch *ds, int port, struct ifreq *ifr) + { +- struct sja1105_tagger_data *tagger_data = sja1105_tagger_data(ds); + struct sja1105_private *priv = ds->priv; + struct hwtstamp_config config; + +@@ -140,7 +101,7 @@ int sja1105_hwtstamp_get(struct dsa_switch *ds, int port, struct ifreq *ifr) + config.tx_type = HWTSTAMP_TX_ON; + else + config.tx_type = HWTSTAMP_TX_OFF; +- if (tagger_data->rxtstamp_get_state(ds)) ++ if (priv->hwts_rx_en & BIT(port)) + config.rx_filter = HWTSTAMP_FILTER_PTP_V2_L2_EVENT; + else + config.rx_filter = HWTSTAMP_FILTER_NONE; +@@ -413,11 +374,10 @@ static long sja1105_rxtstamp_work(struct ptp_clock_info *ptp) + + bool sja1105_rxtstamp(struct dsa_switch *ds, int port, struct sk_buff *skb) + { +- struct sja1105_tagger_data *tagger_data = sja1105_tagger_data(ds); + struct sja1105_private *priv = ds->priv; + struct sja1105_ptp_data *ptp_data = &priv->ptp_data; + +- if (!tagger_data->rxtstamp_get_state(ds)) ++ if (!(priv->hwts_rx_en & BIT(port))) + return false; + + /* We need to read the full PTP clock to reconstruct the Rx +diff --git a/include/linux/dsa/sja1105.h b/include/linux/dsa/sja1105.h +index 159e43171cccf..c177322f793d6 100644 +--- a/include/linux/dsa/sja1105.h ++++ b/include/linux/dsa/sja1105.h +@@ -48,13 +48,9 @@ struct sja1105_deferred_xmit_work { + + /* Global tagger data */ + struct sja1105_tagger_data { +- /* Tagger to switch */ + void (*xmit_work_fn)(struct kthread_work *work); + void (*meta_tstamp_handler)(struct dsa_switch *ds, int port, u8 ts_id, + enum sja1110_meta_tstamp dir, u64 tstamp); +- /* Switch to tagger */ +- bool (*rxtstamp_get_state)(struct dsa_switch *ds); +- void (*rxtstamp_set_state)(struct dsa_switch *ds, bool on); + }; + + struct sja1105_skb_cb { +diff --git a/net/dsa/tag_sja1105.c b/net/dsa/tag_sja1105.c +index d3f27cd5fe244..143348962a216 100644 +--- a/net/dsa/tag_sja1105.c ++++ b/net/dsa/tag_sja1105.c +@@ -53,11 +53,8 @@ + #define SJA1110_TX_TRAILER_LEN 4 + #define SJA1110_MAX_PADDING_LEN 15 + +-#define SJA1105_HWTS_RX_EN 0 +- + struct sja1105_tagger_private { + struct sja1105_tagger_data data; /* Must be first */ +- unsigned long state; + /* Protects concurrent access to the meta state machine + * from taggers running on multiple ports on SMP systems + */ +@@ -387,10 +384,6 @@ static struct sk_buff + + priv = sja1105_tagger_private(ds); + +- if (!test_bit(SJA1105_HWTS_RX_EN, &priv->state)) +- /* Do normal processing. */ +- return skb; +- + spin_lock(&priv->meta_lock); + /* Was this a link-local frame instead of the meta + * that we were expecting? +@@ -426,12 +419,6 @@ static struct sk_buff + + priv = sja1105_tagger_private(ds); + +- /* Drop the meta frame if we're not in the right state +- * to process it. +- */ +- if (!test_bit(SJA1105_HWTS_RX_EN, &priv->state)) +- return NULL; +- + spin_lock(&priv->meta_lock); + + stampable_skb = priv->stampable_skb; +@@ -467,30 +454,6 @@ static struct sk_buff + return skb; + } + +-static bool sja1105_rxtstamp_get_state(struct dsa_switch *ds) +-{ +- struct sja1105_tagger_private *priv = sja1105_tagger_private(ds); +- +- return test_bit(SJA1105_HWTS_RX_EN, &priv->state); +-} +- +-static void sja1105_rxtstamp_set_state(struct dsa_switch *ds, bool on) +-{ +- struct sja1105_tagger_private *priv = sja1105_tagger_private(ds); +- +- if (on) +- set_bit(SJA1105_HWTS_RX_EN, &priv->state); +- else +- clear_bit(SJA1105_HWTS_RX_EN, &priv->state); +- +- /* Initialize the meta state machine to a known state */ +- if (!priv->stampable_skb) +- return; +- +- kfree_skb(priv->stampable_skb); +- priv->stampable_skb = NULL; +-} +- + static bool sja1105_skb_has_tag_8021q(const struct sk_buff *skb) + { + u16 tpid = ntohs(eth_hdr(skb)->h_proto); +@@ -547,9 +510,6 @@ static struct sk_buff *sja1105_rcv(struct sk_buff *skb, + */ + source_port = hdr->h_dest[3]; + switch_id = hdr->h_dest[4]; +- /* Clear the DMAC bytes that were mangled by the switch */ +- hdr->h_dest[3] = 0; +- hdr->h_dest[4] = 0; + } else if (is_meta) { + sja1105_meta_unpack(skb, &meta); + source_port = meta.source_port; +@@ -780,7 +740,6 @@ static void sja1105_disconnect(struct dsa_switch *ds) + + static int sja1105_connect(struct dsa_switch *ds) + { +- struct sja1105_tagger_data *tagger_data; + struct sja1105_tagger_private *priv; + struct kthread_worker *xmit_worker; + int err; +@@ -800,10 +759,6 @@ static int sja1105_connect(struct dsa_switch *ds) + } + + priv->xmit_worker = xmit_worker; +- /* Export functions for switch driver use */ +- tagger_data = &priv->data; +- tagger_data->rxtstamp_get_state = sja1105_rxtstamp_get_state; +- tagger_data->rxtstamp_set_state = sja1105_rxtstamp_set_state; + ds->tagger_data = priv; + + return 0; +-- +2.39.2 + diff --git a/queue-6.1/net-dsa-tag_sja1105-always-prefer-source-port-inform.patch b/queue-6.1/net-dsa-tag_sja1105-always-prefer-source-port-inform.patch new file mode 100644 index 00000000000..a49acad8ed6 --- /dev/null +++ b/queue-6.1/net-dsa-tag_sja1105-always-prefer-source-port-inform.patch @@ -0,0 +1,104 @@ +From 0eca48440313cb507ecd93886107a5be3da9bdef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Jun 2023 12:42:07 +0300 +Subject: net: dsa: tag_sja1105: always prefer source port information from + INCL_SRCPT + +From: Vladimir Oltean + +[ Upstream commit c1ae02d876898b1b8ca1e12c6f84d7b406263800 ] + +Currently the sja1105 tagging protocol prefers using the source port +information from the VLAN header if that is available, falling back to +the INCL_SRCPT option if it isn't. The VLAN header is available for all +frames except for META frames initiated by the switch (containing RX +timestamps), and thus, the "if (is_link_local)" branch is practically +dead. + +The tag_8021q source port identification has become more loose +("imprecise") and will report a plausible rather than exact bridge port, +when under a bridge (be it VLAN-aware or VLAN-unaware). But link-local +traffic always needs to know the precise source port. With incorrect +source port reporting, for example PTP traffic over 2 bridged ports will +all be seen on sockets opened on the first such port, which is incorrect. + +Now that the tagging protocol has been changed to make link-local frames +always contain source port information, we can reverse the order of the +checks so that we always give precedence to that information (which is +always precise) in lieu of the tag_8021q VID which is only precise for a +standalone port. + +Fixes: d7f9787a763f ("net: dsa: tag_8021q: add support for imprecise RX based on the VBID") +Fixes: 91495f21fcec ("net: dsa: tag_8021q: replace the SVL bridging with VLAN-unaware IVL bridging") +Signed-off-by: Vladimir Oltean +Reviewed-by: Simon Horman +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/dsa/tag_sja1105.c | 38 +++++++++++++++++++++++++++++--------- + 1 file changed, 29 insertions(+), 9 deletions(-) + +diff --git a/net/dsa/tag_sja1105.c b/net/dsa/tag_sja1105.c +index 1a85125bda6da..731dc3a111ef3 100644 +--- a/net/dsa/tag_sja1105.c ++++ b/net/dsa/tag_sja1105.c +@@ -540,10 +540,7 @@ static struct sk_buff *sja1105_rcv(struct sk_buff *skb, + is_link_local = sja1105_is_link_local(skb); + is_meta = sja1105_is_meta_frame(skb); + +- if (sja1105_skb_has_tag_8021q(skb)) { +- /* Normal traffic path. */ +- sja1105_vlan_rcv(skb, &source_port, &switch_id, &vbid, &vid); +- } else if (is_link_local) { ++ if (is_link_local) { + /* Management traffic path. Switch embeds the switch ID and + * port ID into bytes of the destination MAC, courtesy of + * the incl_srcpt options. +@@ -557,16 +554,39 @@ static struct sk_buff *sja1105_rcv(struct sk_buff *skb, + sja1105_meta_unpack(skb, &meta); + source_port = meta.source_port; + switch_id = meta.switch_id; +- } else { ++ } ++ ++ /* Normal data plane traffic and link-local frames are tagged with ++ * a tag_8021q VLAN which we have to strip ++ */ ++ if (sja1105_skb_has_tag_8021q(skb)) { ++ int tmp_source_port = -1, tmp_switch_id = -1; ++ ++ sja1105_vlan_rcv(skb, &tmp_source_port, &tmp_switch_id, &vbid, ++ &vid); ++ /* Preserve the source information from the INCL_SRCPT option, ++ * if available. This allows us to not overwrite a valid source ++ * port and switch ID with zeroes when receiving link-local ++ * frames from a VLAN-unaware bridged port (non-zero vbid) or a ++ * VLAN-aware bridged port (non-zero vid). ++ */ ++ if (source_port == -1) ++ source_port = tmp_source_port; ++ if (switch_id == -1) ++ switch_id = tmp_switch_id; ++ } else if (source_port == -1 && switch_id == -1) { ++ /* Packets with no source information have no chance of ++ * getting accepted, drop them straight away. ++ */ + return NULL; + } + +- if (vbid >= 1) ++ if (source_port != -1 && switch_id != -1) ++ skb->dev = dsa_master_find_slave(netdev, switch_id, source_port); ++ else if (vbid >= 1) + skb->dev = dsa_tag_8021q_find_port_by_vbid(netdev, vbid); +- else if (source_port == -1 || switch_id == -1) +- skb->dev = dsa_find_designated_bridge_port_by_vid(netdev, vid); + else +- skb->dev = dsa_master_find_slave(netdev, switch_id, source_port); ++ skb->dev = dsa_find_designated_bridge_port_by_vid(netdev, vid); + if (!skb->dev) { + netdev_warn(netdev, "Couldn't decode source port\n"); + return NULL; +-- +2.39.2 + diff --git a/queue-6.1/net-dsa-tag_sja1105-fix-mac-da-patching-from-meta-fr.patch b/queue-6.1/net-dsa-tag_sja1105-fix-mac-da-patching-from-meta-fr.patch new file mode 100644 index 00000000000..758ccfeb877 --- /dev/null +++ b/queue-6.1/net-dsa-tag_sja1105-fix-mac-da-patching-from-meta-fr.patch @@ -0,0 +1,46 @@ +From b63408892bc0486d8e45e36c62623ea1a928cc67 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Jul 2023 01:05:44 +0300 +Subject: net: dsa: tag_sja1105: fix MAC DA patching from meta frames + +From: Vladimir Oltean + +[ Upstream commit 1dcf6efd5f0c1f4496b3ef7ec5a7db104a53b38c ] + +The SJA1105 manual says that at offset 4 into the meta frame payload we +have "MAC destination byte 2" and at offset 5 we have "MAC destination +byte 1". These are counted from the LSB, so byte 1 is h_dest[ETH_HLEN-2] +aka h_dest[4] and byte 2 is h_dest[ETH_HLEN-3] aka h_dest[3]. + +The sja1105_meta_unpack() function decodes these the other way around, +so a frame with MAC DA 01:80:c2:11:22:33 is received by the network +stack as having 01:80:c2:22:11:33. + +Fixes: e53e18a6fe4d ("net: dsa: sja1105: Receive and decode meta frames") +Signed-off-by: Vladimir Oltean +Reviewed-by: Simon Horman +Reviewed-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/dsa/tag_sja1105.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/dsa/tag_sja1105.c b/net/dsa/tag_sja1105.c +index 6e3699d859dbd..d3f27cd5fe244 100644 +--- a/net/dsa/tag_sja1105.c ++++ b/net/dsa/tag_sja1105.c +@@ -113,8 +113,8 @@ static void sja1105_meta_unpack(const struct sk_buff *skb, + * a unified unpacking command for both device series. + */ + packing(buf, &meta->tstamp, 31, 0, 4, UNPACK, 0); +- packing(buf + 4, &meta->dmac_byte_4, 7, 0, 1, UNPACK, 0); +- packing(buf + 5, &meta->dmac_byte_3, 7, 0, 1, UNPACK, 0); ++ packing(buf + 4, &meta->dmac_byte_3, 7, 0, 1, UNPACK, 0); ++ packing(buf + 5, &meta->dmac_byte_4, 7, 0, 1, UNPACK, 0); + packing(buf + 6, &meta->source_port, 7, 0, 1, UNPACK, 0); + packing(buf + 7, &meta->switch_id, 7, 0, 1, UNPACK, 0); + } +-- +2.39.2 + diff --git a/queue-6.1/net-dsa-tag_sja1105-fix-source-port-decoding-in-vlan.patch b/queue-6.1/net-dsa-tag_sja1105-fix-source-port-decoding-in-vlan.patch new file mode 100644 index 00000000000..52da00677c6 --- /dev/null +++ b/queue-6.1/net-dsa-tag_sja1105-fix-source-port-decoding-in-vlan.patch @@ -0,0 +1,62 @@ +From 772350116f40ff69008c98f1916f4264775a4251 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 1 Jul 2023 01:20:10 +0300 +Subject: net: dsa: tag_sja1105: fix source port decoding in vlan_filtering=0 + bridge mode + +From: Vladimir Oltean + +[ Upstream commit a398b9ea0c3b791b7a0f4c6029a62cf628f97f22 ] + +There was a regression introduced by the blamed commit, where pinging to +a VLAN-unaware bridge would fail with the repeated message "Couldn't +decode source port" coming from the tagging protocol driver. + +When receiving packets with a bridge_vid as determined by +dsa_tag_8021q_bridge_join(), dsa_8021q_rcv() will decode: +- source_port = 0 (which isn't really valid, more like "don't know") +- switch_id = 0 (which isn't really valid, more like "don't know") +- vbid = value in range 1-7 + +Since the blamed patch has reversed the order of the checks, we are now +going to believe that source_port != -1 and switch_id != -1, so they're +valid, but they aren't. + +The minimal solution to the problem is to only populate source_port and +switch_id with what dsa_8021q_rcv() came up with, if the vbid is zero, +i.e. the source port information is trustworthy. + +Fixes: c1ae02d87689 ("net: dsa: tag_sja1105: always prefer source port information from INCL_SRCPT") +Signed-off-by: Vladimir Oltean +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/dsa/tag_sja1105.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/net/dsa/tag_sja1105.c b/net/dsa/tag_sja1105.c +index 731dc3a111ef3..6e3699d859dbd 100644 +--- a/net/dsa/tag_sja1105.c ++++ b/net/dsa/tag_sja1105.c +@@ -568,11 +568,14 @@ static struct sk_buff *sja1105_rcv(struct sk_buff *skb, + * if available. This allows us to not overwrite a valid source + * port and switch ID with zeroes when receiving link-local + * frames from a VLAN-unaware bridged port (non-zero vbid) or a +- * VLAN-aware bridged port (non-zero vid). ++ * VLAN-aware bridged port (non-zero vid). Furthermore, the ++ * tag_8021q source port information is only of trust when the ++ * vbid is 0 (precise port). Otherwise, tmp_source_port and ++ * tmp_switch_id will be zeroes. + */ +- if (source_port == -1) ++ if (vbid == 0 && source_port == -1) + source_port = tmp_source_port; +- if (switch_id == -1) ++ if (vbid == 0 && switch_id == -1) + switch_id = tmp_switch_id; + } else if (source_port == -1 && switch_id == -1) { + /* Packets with no source information have no chance of +-- +2.39.2 + diff --git a/queue-6.1/net-dsa-vsc73xx-fix-mtu-configuration.patch b/queue-6.1/net-dsa-vsc73xx-fix-mtu-configuration.patch new file mode 100644 index 00000000000..1a655976292 --- /dev/null +++ b/queue-6.1/net-dsa-vsc73xx-fix-mtu-configuration.patch @@ -0,0 +1,54 @@ +From 015508a3707a7985b30de421f0eeac18aa1953d5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Jun 2023 21:43:27 +0200 +Subject: net: dsa: vsc73xx: fix MTU configuration + +From: Pawel Dembicki + +[ Upstream commit 3cf62c8177adb0db9e15c8b898c44f997acf3ebf ] + +Switch in MAXLEN register stores the maximum size of a data frame. +The MTU size is 18 bytes smaller than the frame size. + +The current settings are causing problems with packet forwarding. +This patch fixes the MTU settings to proper values. + +Fixes: fb77ffc6ec86 ("net: dsa: vsc73xx: make the MTU configurable") +Reviewed-by: Linus Walleij +Signed-off-by: Pawel Dembicki +Reviewed-by: Vladimir Oltean +Link: https://lore.kernel.org/r/20230628194327.1765644-1-paweldembicki@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/vitesse-vsc73xx-core.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/dsa/vitesse-vsc73xx-core.c b/drivers/net/dsa/vitesse-vsc73xx-core.c +index ae55167ce0a6f..ef1a4a7c47b23 100644 +--- a/drivers/net/dsa/vitesse-vsc73xx-core.c ++++ b/drivers/net/dsa/vitesse-vsc73xx-core.c +@@ -1025,17 +1025,17 @@ static int vsc73xx_change_mtu(struct dsa_switch *ds, int port, int new_mtu) + struct vsc73xx *vsc = ds->priv; + + return vsc73xx_write(vsc, VSC73XX_BLOCK_MAC, port, +- VSC73XX_MAXLEN, new_mtu); ++ VSC73XX_MAXLEN, new_mtu + ETH_HLEN + ETH_FCS_LEN); + } + + /* According to application not "VSC7398 Jumbo Frames" setting +- * up the MTU to 9.6 KB does not affect the performance on standard ++ * up the frame size to 9.6 KB does not affect the performance on standard + * frames. It is clear from the application note that + * "9.6 kilobytes" == 9600 bytes. + */ + static int vsc73xx_get_max_mtu(struct dsa_switch *ds, int port) + { +- return 9600; ++ return 9600 - ETH_HLEN - ETH_FCS_LEN; + } + + static const struct dsa_switch_ops vsc73xx_ds_ops = { +-- +2.39.2 + diff --git a/queue-6.1/net-fix-net_dev_start_xmit-trace-event-vs-skb_transp.patch b/queue-6.1/net-fix-net_dev_start_xmit-trace-event-vs-skb_transp.patch new file mode 100644 index 00000000000..6ce7a92d9cd --- /dev/null +++ b/queue-6.1/net-fix-net_dev_start_xmit-trace-event-vs-skb_transp.patch @@ -0,0 +1,72 @@ +From 3b057e8013a18bfac648f7e2d146f5308df04f4a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 1 Jul 2023 02:48:24 +0000 +Subject: net: fix net_dev_start_xmit trace event vs skb_transport_offset() + +From: Eric Dumazet + +[ Upstream commit f88fcb1d7d961b4b402d675109726f94db87571c ] + +After blamed commit, we must be more careful about using +skb_transport_offset(), as reminded us by syzbot: + +WARNING: CPU: 0 PID: 10 at include/linux/skbuff.h:2868 skb_transport_offset include/linux/skbuff.h:2977 [inline] +WARNING: CPU: 0 PID: 10 at include/linux/skbuff.h:2868 perf_trace_net_dev_start_xmit+0x89a/0xce0 include/trace/events/net.h:14 +Modules linked in: +CPU: 0 PID: 10 Comm: kworker/u4:1 Not tainted 6.1.30-syzkaller #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023 +Workqueue: bat_events batadv_iv_send_outstanding_bat_ogm_packet +RIP: 0010:skb_transport_header include/linux/skbuff.h:2868 [inline] +RIP: 0010:skb_transport_offset include/linux/skbuff.h:2977 [inline] +RIP: 0010:perf_trace_net_dev_start_xmit+0x89a/0xce0 include/trace/events/net.h:14 +Code: 8b 04 25 28 00 00 00 48 3b 84 24 c0 00 00 00 0f 85 4e 04 00 00 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc e8 56 22 01 fd <0f> 0b e9 f6 fc ff ff 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 86 f9 ff +RSP: 0018:ffffc900002bf700 EFLAGS: 00010293 +RAX: ffffffff8485d8ca RBX: 000000000000ffff RCX: ffff888100914280 +RDX: 0000000000000000 RSI: 000000000000ffff RDI: 000000000000ffff +RBP: ffffc900002bf818 R08: ffffffff8485d5b6 R09: fffffbfff0f8fb5e +R10: 0000000000000000 R11: dffffc0000000001 R12: 1ffff110217d8f67 +R13: ffff88810bec7b3a R14: dffffc0000000000 R15: dffffc0000000000 +FS: 0000000000000000(0000) GS:ffff8881f6a00000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 00007f96cf6d52f0 CR3: 000000012224c000 CR4: 0000000000350ef0 +Call Trace: + +[] trace_net_dev_start_xmit include/trace/events/net.h:14 [inline] +[] xmit_one net/core/dev.c:3643 [inline] +[] dev_hard_start_xmit+0x705/0x980 net/core/dev.c:3660 +[] __dev_queue_xmit+0x16b2/0x3370 net/core/dev.c:4324 +[] dev_queue_xmit include/linux/netdevice.h:3030 [inline] +[] batadv_send_skb_packet+0x3f3/0x680 net/batman-adv/send.c:108 +[] batadv_send_broadcast_skb+0x24/0x30 net/batman-adv/send.c:127 +[] batadv_iv_ogm_send_to_if net/batman-adv/bat_iv_ogm.c:393 [inline] +[] batadv_iv_ogm_emit net/batman-adv/bat_iv_ogm.c:421 [inline] +[] batadv_iv_send_outstanding_bat_ogm_packet+0x69a/0x840 net/batman-adv/bat_iv_ogm.c:1701 +[] process_one_work+0x8ac/0x1170 kernel/workqueue.c:2289 +[] worker_thread+0xaa8/0x12d0 kernel/workqueue.c:2436 + +Fixes: 66e4c8d95008 ("net: warn if transport header was not set") +Signed-off-by: Eric Dumazet +Reported-by: syzbot +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/trace/events/net.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/include/trace/events/net.h b/include/trace/events/net.h +index da611a7aaf970..f667c76a3b022 100644 +--- a/include/trace/events/net.h ++++ b/include/trace/events/net.h +@@ -51,7 +51,8 @@ TRACE_EVENT(net_dev_start_xmit, + __entry->network_offset = skb_network_offset(skb); + __entry->transport_offset_valid = + skb_transport_header_was_set(skb); +- __entry->transport_offset = skb_transport_offset(skb); ++ __entry->transport_offset = skb_transport_header_was_set(skb) ? ++ skb_transport_offset(skb) : 0; + __entry->tx_flags = skb_shinfo(skb)->tx_flags; + __entry->gso_size = skb_shinfo(skb)->gso_size; + __entry->gso_segs = skb_shinfo(skb)->gso_segs; +-- +2.39.2 + diff --git a/queue-6.1/net-mscc-ocelot-don-t-keep-ptp-configuration-of-all-.patch b/queue-6.1/net-mscc-ocelot-don-t-keep-ptp-configuration-of-all-.patch new file mode 100644 index 00000000000..8c266ccba56 --- /dev/null +++ b/queue-6.1/net-mscc-ocelot-don-t-keep-ptp-configuration-of-all-.patch @@ -0,0 +1,203 @@ +From 4bb2360eb911e6cc36e0eef26cfb5235c88097ff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Jun 2023 19:31:13 +0300 +Subject: net: mscc: ocelot: don't keep PTP configuration of all ports in + single structure + +From: Vladimir Oltean + +[ Upstream commit 45d0fcb5bc9558d0bf3d2fa7fabc5d8a88d35439 ] + +In a future change, the driver will need to determine whether PTP RX +timestamping is enabled on a port (including whether traps were set up +on that port in particular) and that is currently not possible. + +The driver supports different RX filters (L2, L4) and kinds of TX +timestamping (one-step, two-step) on its ports, but it saves all +configuration in a single struct hwtstamp_config that is global to the +switch. So, the latest timestamping configuration on one port +(including a request to disable timestamping) affects what gets reported +for all ports, even though the configuration itself is still individual +to each port. + +The port timestamping configurations are only coupled because of the +common structure, so replace the hwtstamp_config with a mask of trapped +protocols saved per port. We also have the ptp_cmd to distinguish +between one-step and two-step PTP timestamping, so with those 2 bits of +information we can fully reconstruct a descriptive struct +hwtstamp_config for each port, during the SIOCGHWTSTAMP ioctl. + +Fixes: 4e3b0468e6d7 ("net: mscc: PTP Hardware Clock (PHC) support") +Fixes: 96ca08c05838 ("net: mscc: ocelot: set up traps for PTP packets") +Signed-off-by: Vladimir Oltean +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mscc/ocelot.c | 1 - + drivers/net/ethernet/mscc/ocelot_ptp.c | 61 +++++++++++++++++--------- + include/soc/mscc/ocelot.h | 10 +++-- + 3 files changed, 48 insertions(+), 24 deletions(-) + +diff --git a/drivers/net/ethernet/mscc/ocelot.c b/drivers/net/ethernet/mscc/ocelot.c +index 13b14110a0603..01b6e13f4692f 100644 +--- a/drivers/net/ethernet/mscc/ocelot.c ++++ b/drivers/net/ethernet/mscc/ocelot.c +@@ -2728,7 +2728,6 @@ int ocelot_init(struct ocelot *ocelot) + } + } + +- mutex_init(&ocelot->ptp_lock); + mutex_init(&ocelot->mact_lock); + mutex_init(&ocelot->fwd_domain_lock); + mutex_init(&ocelot->tas_lock); +diff --git a/drivers/net/ethernet/mscc/ocelot_ptp.c b/drivers/net/ethernet/mscc/ocelot_ptp.c +index 673bfd70867a6..cb32234a5bf1b 100644 +--- a/drivers/net/ethernet/mscc/ocelot_ptp.c ++++ b/drivers/net/ethernet/mscc/ocelot_ptp.c +@@ -439,8 +439,12 @@ static int ocelot_ipv6_ptp_trap_del(struct ocelot *ocelot, int port) + static int ocelot_setup_ptp_traps(struct ocelot *ocelot, int port, + bool l2, bool l4) + { ++ struct ocelot_port *ocelot_port = ocelot->ports[port]; + int err; + ++ ocelot_port->trap_proto &= ~(OCELOT_PROTO_PTP_L2 | ++ OCELOT_PROTO_PTP_L4); ++ + if (l2) + err = ocelot_l2_ptp_trap_add(ocelot, port); + else +@@ -464,6 +468,11 @@ static int ocelot_setup_ptp_traps(struct ocelot *ocelot, int port, + if (err) + return err; + ++ if (l2) ++ ocelot_port->trap_proto |= OCELOT_PROTO_PTP_L2; ++ if (l4) ++ ocelot_port->trap_proto |= OCELOT_PROTO_PTP_L4; ++ + return 0; + + err_ipv6: +@@ -474,10 +483,38 @@ static int ocelot_setup_ptp_traps(struct ocelot *ocelot, int port, + return err; + } + ++static int ocelot_traps_to_ptp_rx_filter(unsigned int proto) ++{ ++ if ((proto & OCELOT_PROTO_PTP_L2) && (proto & OCELOT_PROTO_PTP_L4)) ++ return HWTSTAMP_FILTER_PTP_V2_EVENT; ++ else if (proto & OCELOT_PROTO_PTP_L2) ++ return HWTSTAMP_FILTER_PTP_V2_L2_EVENT; ++ else if (proto & OCELOT_PROTO_PTP_L4) ++ return HWTSTAMP_FILTER_PTP_V2_L4_EVENT; ++ ++ return HWTSTAMP_FILTER_NONE; ++} ++ + int ocelot_hwstamp_get(struct ocelot *ocelot, int port, struct ifreq *ifr) + { +- return copy_to_user(ifr->ifr_data, &ocelot->hwtstamp_config, +- sizeof(ocelot->hwtstamp_config)) ? -EFAULT : 0; ++ struct ocelot_port *ocelot_port = ocelot->ports[port]; ++ struct hwtstamp_config cfg = {}; ++ ++ switch (ocelot_port->ptp_cmd) { ++ case IFH_REW_OP_TWO_STEP_PTP: ++ cfg.tx_type = HWTSTAMP_TX_ON; ++ break; ++ case IFH_REW_OP_ORIGIN_PTP: ++ cfg.tx_type = HWTSTAMP_TX_ONESTEP_SYNC; ++ break; ++ default: ++ cfg.tx_type = HWTSTAMP_TX_OFF; ++ break; ++ } ++ ++ cfg.rx_filter = ocelot_traps_to_ptp_rx_filter(ocelot_port->trap_proto); ++ ++ return copy_to_user(ifr->ifr_data, &cfg, sizeof(cfg)) ? -EFAULT : 0; + } + EXPORT_SYMBOL(ocelot_hwstamp_get); + +@@ -509,8 +546,6 @@ int ocelot_hwstamp_set(struct ocelot *ocelot, int port, struct ifreq *ifr) + return -ERANGE; + } + +- mutex_lock(&ocelot->ptp_lock); +- + switch (cfg.rx_filter) { + case HWTSTAMP_FILTER_NONE: + break; +@@ -531,28 +566,14 @@ int ocelot_hwstamp_set(struct ocelot *ocelot, int port, struct ifreq *ifr) + l4 = true; + break; + default: +- mutex_unlock(&ocelot->ptp_lock); + return -ERANGE; + } + + err = ocelot_setup_ptp_traps(ocelot, port, l2, l4); +- if (err) { +- mutex_unlock(&ocelot->ptp_lock); ++ if (err) + return err; +- } +- +- if (l2 && l4) +- cfg.rx_filter = HWTSTAMP_FILTER_PTP_V2_EVENT; +- else if (l2) +- cfg.rx_filter = HWTSTAMP_FILTER_PTP_V2_L2_EVENT; +- else if (l4) +- cfg.rx_filter = HWTSTAMP_FILTER_PTP_V2_L4_EVENT; +- else +- cfg.rx_filter = HWTSTAMP_FILTER_NONE; + +- /* Commit back the result & save it */ +- memcpy(&ocelot->hwtstamp_config, &cfg, sizeof(cfg)); +- mutex_unlock(&ocelot->ptp_lock); ++ cfg.rx_filter = ocelot_traps_to_ptp_rx_filter(ocelot_port->trap_proto); + + return copy_to_user(ifr->ifr_data, &cfg, sizeof(cfg)) ? -EFAULT : 0; + } +diff --git a/include/soc/mscc/ocelot.h b/include/soc/mscc/ocelot.h +index 967ba30ea6363..195ca8f0b6f9d 100644 +--- a/include/soc/mscc/ocelot.h ++++ b/include/soc/mscc/ocelot.h +@@ -902,6 +902,11 @@ enum macaccess_entry_type { + ENTRYTYPE_MACv6, + }; + ++enum ocelot_proto { ++ OCELOT_PROTO_PTP_L2 = BIT(0), ++ OCELOT_PROTO_PTP_L4 = BIT(1), ++}; ++ + #define OCELOT_QUIRK_PCS_PERFORMS_RATE_ADAPTATION BIT(0) + #define OCELOT_QUIRK_QSGMII_PORTS_MUST_BE_UP BIT(1) + +@@ -939,6 +944,8 @@ struct ocelot_port { + unsigned int ptp_skbs_in_flight; + struct sk_buff_head tx_skbs; + ++ unsigned int trap_proto; ++ + u16 mrp_ring_id; + + u8 ptp_cmd; +@@ -1032,12 +1039,9 @@ struct ocelot { + u8 ptp:1; + struct ptp_clock *ptp_clock; + struct ptp_clock_info ptp_info; +- struct hwtstamp_config hwtstamp_config; + unsigned int ptp_skbs_in_flight; + /* Protects the 2-step TX timestamp ID logic */ + spinlock_t ts_id_lock; +- /* Protects the PTP interface state */ +- struct mutex ptp_lock; + /* Protects the PTP clock */ + spinlock_t ptp_clock_lock; + struct ptp_pin_desc ptp_pins[OCELOT_PTP_PINS_NUM]; +-- +2.39.2 + diff --git a/queue-6.1/net-mscc-ocelot-don-t-report-that-rx-timestamping-is.patch b/queue-6.1/net-mscc-ocelot-don-t-report-that-rx-timestamping-is.patch new file mode 100644 index 00000000000..a839213163c --- /dev/null +++ b/queue-6.1/net-mscc-ocelot-don-t-report-that-rx-timestamping-is.patch @@ -0,0 +1,49 @@ +From b3ecf4d2141bc60058f50693161df9f854410fca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Jun 2023 19:31:12 +0300 +Subject: net: mscc: ocelot: don't report that RX timestamping is enabled by + default + +From: Vladimir Oltean + +[ Upstream commit 4fd44b82b7aceaa35c2901c6546d2c4198e0799d ] + +PTP RX timestamping should be enabled when the user requests it, not by +default. If it is enabled by default, it can be problematic when the +ocelot driver is a DSA master, and it sidesteps what DSA tries to avoid +through __dsa_master_hwtstamp_validate(). + +Additionally, after the change which made ocelot trap PTP packets only +to the CPU at ocelot_hwtstamp_set() time, it is no longer even true that +RX timestamping is enabled by default, because until ocelot_hwtstamp_set() +is called, the PTP traps are actually not set up. So the rx_filter field +of ocelot->hwtstamp_config reflects an incorrect reality. + +Fixes: 96ca08c05838 ("net: mscc: ocelot: set up traps for PTP packets") +Fixes: 4e3b0468e6d7 ("net: mscc: PTP Hardware Clock (PHC) support") +Signed-off-by: Vladimir Oltean +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mscc/ocelot_ptp.c | 5 ----- + 1 file changed, 5 deletions(-) + +diff --git a/drivers/net/ethernet/mscc/ocelot_ptp.c b/drivers/net/ethernet/mscc/ocelot_ptp.c +index 2180ae94c7447..673bfd70867a6 100644 +--- a/drivers/net/ethernet/mscc/ocelot_ptp.c ++++ b/drivers/net/ethernet/mscc/ocelot_ptp.c +@@ -824,11 +824,6 @@ int ocelot_init_timestamp(struct ocelot *ocelot, + + ocelot_write(ocelot, PTP_CFG_MISC_PTP_EN, PTP_CFG_MISC); + +- /* There is no device reconfiguration, PTP Rx stamping is always +- * enabled. +- */ +- ocelot->hwtstamp_config.rx_filter = HWTSTAMP_FILTER_PTP_V2_EVENT; +- + return 0; + } + EXPORT_SYMBOL(ocelot_init_timestamp); +-- +2.39.2 + diff --git a/queue-6.1/net-sched-act_ipt-add-sanity-checks-on-skb-before-ca.patch b/queue-6.1/net-sched-act_ipt-add-sanity-checks-on-skb-before-ca.patch new file mode 100644 index 00000000000..635d5fcddce --- /dev/null +++ b/queue-6.1/net-sched-act_ipt-add-sanity-checks-on-skb-before-ca.patch @@ -0,0 +1,91 @@ +From 037d0ff744d1d19dc1dfeec1e9c485089b25ebca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Jun 2023 14:38:12 +0200 +Subject: net/sched: act_ipt: add sanity checks on skb before calling target + +From: Florian Westphal + +[ Upstream commit b2dc32dcba08bf55cec600caa76f4afd2e3614df ] + +Netfilter targets make assumptions on the skb state, for example +iphdr is supposed to be in the linear area. + +This is normally done by IP stack, but in act_ipt case no +such checks are made. + +Some targets can even assume that skb_dst will be valid. +Make a minimum effort to check for this: + +- Don't call the targets eval function for non-ipv4 skbs. +- Don't call the targets eval function for POSTROUTING + emulation when the skb has no dst set. + +v3: use skb_protocol helper (Davide Caratti) + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Florian Westphal +Reviewed-by: Simon Horman +Acked-by: Jamal Hadi Salim +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/sched/act_ipt.c | 33 +++++++++++++++++++++++++++++++++ + 1 file changed, 33 insertions(+) + +diff --git a/net/sched/act_ipt.c b/net/sched/act_ipt.c +index ea7f151e7dd29..a6b522b512dc3 100644 +--- a/net/sched/act_ipt.c ++++ b/net/sched/act_ipt.c +@@ -230,6 +230,26 @@ static int tcf_xt_init(struct net *net, struct nlattr *nla, + a, &act_xt_ops, tp, flags); + } + ++static bool tcf_ipt_act_check(struct sk_buff *skb) ++{ ++ const struct iphdr *iph; ++ unsigned int nhoff, len; ++ ++ if (!pskb_may_pull(skb, sizeof(struct iphdr))) ++ return false; ++ ++ nhoff = skb_network_offset(skb); ++ iph = ip_hdr(skb); ++ if (iph->ihl < 5 || iph->version != 4) ++ return false; ++ ++ len = skb_ip_totlen(skb); ++ if (skb->len < nhoff + len || len < (iph->ihl * 4u)) ++ return false; ++ ++ return pskb_may_pull(skb, iph->ihl * 4u); ++} ++ + TC_INDIRECT_SCOPE int tcf_ipt_act(struct sk_buff *skb, + const struct tc_action *a, + struct tcf_result *res) +@@ -244,9 +264,22 @@ TC_INDIRECT_SCOPE int tcf_ipt_act(struct sk_buff *skb, + .pf = NFPROTO_IPV4, + }; + ++ if (skb_protocol(skb, false) != htons(ETH_P_IP)) ++ return TC_ACT_UNSPEC; ++ + if (skb_unclone(skb, GFP_ATOMIC)) + return TC_ACT_UNSPEC; + ++ if (!tcf_ipt_act_check(skb)) ++ return TC_ACT_UNSPEC; ++ ++ if (state.hook == NF_INET_POST_ROUTING) { ++ if (!skb_dst(skb)) ++ return TC_ACT_UNSPEC; ++ ++ state.out = skb->dev; ++ } ++ + spin_lock(&ipt->tcf_lock); + + tcf_lastuse_update(&ipt->tcf_tm); +-- +2.39.2 + diff --git a/queue-6.1/net-sched-act_ipt-add-sanity-checks-on-table-name-an.patch b/queue-6.1/net-sched-act_ipt-add-sanity-checks-on-table-name-an.patch new file mode 100644 index 00000000000..581a353ce60 --- /dev/null +++ b/queue-6.1/net-sched-act_ipt-add-sanity-checks-on-table-name-an.patch @@ -0,0 +1,102 @@ +From 3159a8447b221a33ca87a5a70f73627a3b83122d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Jun 2023 14:38:11 +0200 +Subject: net/sched: act_ipt: add sanity checks on table name and hook + locations + +From: Florian Westphal + +[ Upstream commit b4ee93380b3c891fea996af8d1d3ca0e36ad31f0 ] + +Looks like "tc" hard-codes "mangle" as the only supported table +name, but on kernel side there are no checks. + +This is wrong. Not all xtables targets are safe to call from tc. +E.g. "nat" targets assume skb has a conntrack object assigned to it. +Normally those get called from netfilter nat core which consults the +nat table to obtain the address mapping. + +"tc" userspace either sets PRE or POSTROUTING as hook number, but there +is no validation of this on kernel side, so update netlink policy to +reject bogus numbers. Some targets may assume skb_dst is set for +input/forward hooks, so prevent those from being used. + +act_ipt uses the hook number in two places: +1. the state hook number, this is fine as-is +2. to set par.hook_mask + +The latter is a bit mask, so update the assignment to make +xt_check_target() to the right thing. + +Followup patch adds required checks for the skb/packet headers before +calling the targets evaluation function. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Florian Westphal +Reviewed-by: Simon Horman +Acked-by: Jamal Hadi Salim +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/sched/act_ipt.c | 27 ++++++++++++++++++++------- + 1 file changed, 20 insertions(+), 7 deletions(-) + +diff --git a/net/sched/act_ipt.c b/net/sched/act_ipt.c +index 1625e10374161..dc92975a9374f 100644 +--- a/net/sched/act_ipt.c ++++ b/net/sched/act_ipt.c +@@ -47,7 +47,7 @@ static int ipt_init_target(struct net *net, struct xt_entry_target *t, + par.entryinfo = &e; + par.target = target; + par.targinfo = t->data; +- par.hook_mask = hook; ++ par.hook_mask = 1 << hook; + par.family = NFPROTO_IPV4; + + ret = xt_check_target(&par, t->u.target_size - sizeof(*t), 0, false); +@@ -84,7 +84,8 @@ static void tcf_ipt_release(struct tc_action *a) + + static const struct nla_policy ipt_policy[TCA_IPT_MAX + 1] = { + [TCA_IPT_TABLE] = { .type = NLA_STRING, .len = IFNAMSIZ }, +- [TCA_IPT_HOOK] = { .type = NLA_U32 }, ++ [TCA_IPT_HOOK] = NLA_POLICY_RANGE(NLA_U32, NF_INET_PRE_ROUTING, ++ NF_INET_NUMHOOKS), + [TCA_IPT_INDEX] = { .type = NLA_U32 }, + [TCA_IPT_TARG] = { .len = sizeof(struct xt_entry_target) }, + }; +@@ -157,15 +158,27 @@ static int __tcf_ipt_init(struct net *net, unsigned int id, struct nlattr *nla, + return -EEXIST; + } + } ++ ++ err = -EINVAL; + hook = nla_get_u32(tb[TCA_IPT_HOOK]); ++ switch (hook) { ++ case NF_INET_PRE_ROUTING: ++ break; ++ case NF_INET_POST_ROUTING: ++ break; ++ default: ++ goto err1; ++ } ++ ++ if (tb[TCA_IPT_TABLE]) { ++ /* mangle only for now */ ++ if (nla_strcmp(tb[TCA_IPT_TABLE], "mangle")) ++ goto err1; ++ } + +- err = -ENOMEM; +- tname = kmalloc(IFNAMSIZ, GFP_KERNEL); ++ tname = kstrdup("mangle", GFP_KERNEL); + if (unlikely(!tname)) + goto err1; +- if (tb[TCA_IPT_TABLE] == NULL || +- nla_strscpy(tname, tb[TCA_IPT_TABLE], IFNAMSIZ) >= IFNAMSIZ) +- strcpy(tname, "mangle"); + + t = kmemdup(td, td->u.target_size, GFP_KERNEL); + if (unlikely(!t)) +-- +2.39.2 + diff --git a/queue-6.1/net-sched-act_ipt-zero-skb-cb-before-calling-target.patch b/queue-6.1/net-sched-act_ipt-zero-skb-cb-before-calling-target.patch new file mode 100644 index 00000000000..77e5b84d1b0 --- /dev/null +++ b/queue-6.1/net-sched-act_ipt-zero-skb-cb-before-calling-target.patch @@ -0,0 +1,101 @@ +From e30f7714a276eaf155fe312add3e12f7fc38ef61 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Jun 2023 14:38:13 +0200 +Subject: net/sched: act_ipt: zero skb->cb before calling target + +From: Florian Westphal + +[ Upstream commit 93d75d475c5dc3404292976147d063ee4d808592 ] + +xtables relies on skb being owned by ip stack, i.e. with ipv4 +check in place skb->cb is supposed to be IPCB. + +I don't see an immediate problem (REJECT target cannot be used anymore +now that PRE/POSTROUTING hook validation has been fixed), but better be +safe than sorry. + +A much better patch would be to either mark act_ipt as +"depends on BROKEN" or remove it altogether. I plan to do this +for -next in the near future. + +This tc extension is broken in the sense that tc lacks an +equivalent of NF_STOLEN verdict. + +With NF_STOLEN, target function takes complete ownership of skb, caller +cannot dereference it anymore. + +ACT_STOLEN cannot be used for this: it has a different meaning, caller +is allowed to dereference the skb. + +At this time NF_STOLEN won't be returned by any targets as far as I can +see, but this may change in the future. + +It might be possible to work around this via list of allowed +target extensions known to only return DROP or ACCEPT verdicts, but this +is error prone/fragile. + +Existing selftest only validates xt_LOG and act_ipt is restricted +to ipv4 so I don't think this action is used widely. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Florian Westphal +Reviewed-by: Simon Horman +Acked-by: Jamal Hadi Salim +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/sched/act_ipt.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/net/sched/act_ipt.c b/net/sched/act_ipt.c +index a6b522b512dc3..598d6e299152a 100644 +--- a/net/sched/act_ipt.c ++++ b/net/sched/act_ipt.c +@@ -21,6 +21,7 @@ + #include + #include + #include ++#include + + #include + +@@ -254,6 +255,7 @@ TC_INDIRECT_SCOPE int tcf_ipt_act(struct sk_buff *skb, + const struct tc_action *a, + struct tcf_result *res) + { ++ char saved_cb[sizeof_field(struct sk_buff, cb)]; + int ret = 0, result = 0; + struct tcf_ipt *ipt = to_ipt(a); + struct xt_action_param par; +@@ -280,6 +282,8 @@ TC_INDIRECT_SCOPE int tcf_ipt_act(struct sk_buff *skb, + state.out = skb->dev; + } + ++ memcpy(saved_cb, skb->cb, sizeof(saved_cb)); ++ + spin_lock(&ipt->tcf_lock); + + tcf_lastuse_update(&ipt->tcf_tm); +@@ -292,6 +296,9 @@ TC_INDIRECT_SCOPE int tcf_ipt_act(struct sk_buff *skb, + par.state = &state; + par.target = ipt->tcfi_t->u.kernel.target; + par.targinfo = ipt->tcfi_t->data; ++ ++ memset(IPCB(skb), 0, sizeof(struct inet_skb_parm)); ++ + ret = par.target->target(skb, &par); + + switch (ret) { +@@ -312,6 +319,9 @@ TC_INDIRECT_SCOPE int tcf_ipt_act(struct sk_buff *skb, + break; + } + spin_unlock(&ipt->tcf_lock); ++ ++ memcpy(skb->cb, saved_cb, sizeof(skb->cb)); ++ + return result; + + } +-- +2.39.2 + diff --git a/queue-6.1/net-sched-act_pedit-add-size-check-for-tca_pedit_par.patch b/queue-6.1/net-sched-act_pedit-add-size-check-for-tca_pedit_par.patch new file mode 100644 index 00000000000..ebe9fed4384 --- /dev/null +++ b/queue-6.1/net-sched-act_pedit-add-size-check-for-tca_pedit_par.patch @@ -0,0 +1,57 @@ +From 632f98db23d7b2f5dd49022f8211ee5b7d1086dc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Jul 2023 19:08:42 +0800 +Subject: net/sched: act_pedit: Add size check for TCA_PEDIT_PARMS_EX + +From: Lin Ma + +[ Upstream commit 30c45b5361d39b4b793780ffac5538090b9e2eb1 ] + +The attribute TCA_PEDIT_PARMS_EX is not be included in pedit_policy and +one malicious user could fake a TCA_PEDIT_PARMS_EX whose length is +smaller than the intended sizeof(struct tc_pedit). Hence, the +dereference in tcf_pedit_init() could access dirty heap data. + +static int tcf_pedit_init(...) +{ + // ... + pattr = tb[TCA_PEDIT_PARMS]; // TCA_PEDIT_PARMS is included + if (!pattr) + pattr = tb[TCA_PEDIT_PARMS_EX]; // but this is not + + // ... + parm = nla_data(pattr); + + index = parm->index; // parm is able to be smaller than 4 bytes + // and this dereference gets dirty skb_buff + // data created in netlink_sendmsg +} + +This commit adds TCA_PEDIT_PARMS_EX length in pedit_policy which avoid +the above case, just like the TCA_PEDIT_PARMS. + +Fixes: 71d0ed7079df ("net/act_pedit: Support using offset relative to the conventional network headers") +Signed-off-by: Lin Ma +Reviewed-by: Pedro Tammela +Link: https://lore.kernel.org/r/20230703110842.590282-1-linma@zju.edu.cn +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/sched/act_pedit.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c +index 613a1d777d5a6..c2aed8b056a1d 100644 +--- a/net/sched/act_pedit.c ++++ b/net/sched/act_pedit.c +@@ -29,6 +29,7 @@ static struct tc_action_ops act_pedit_ops; + + static const struct nla_policy pedit_policy[TCA_PEDIT_MAX + 1] = { + [TCA_PEDIT_PARMS] = { .len = sizeof(struct tc_pedit) }, ++ [TCA_PEDIT_PARMS_EX] = { .len = sizeof(struct tc_pedit) }, + [TCA_PEDIT_KEYS_EX] = { .type = NLA_NESTED }, + }; + +-- +2.39.2 + diff --git a/queue-6.1/net-sched-avoid-indirect-act-functions-on-retpoline-.patch b/queue-6.1/net-sched-avoid-indirect-act-functions-on-retpoline-.patch new file mode 100644 index 00000000000..e76826b3f71 --- /dev/null +++ b/queue-6.1/net-sched-avoid-indirect-act-functions-on-retpoline-.patch @@ -0,0 +1,543 @@ +From 122945ba62d821b786b51bd84aa4ca23619737fc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Dec 2022 10:55:12 -0300 +Subject: net/sched: avoid indirect act functions on retpoline kernels + +From: Pedro Tammela + +[ Upstream commit 871cf386dd16705b1e08942efd02c58801293d01 ] + +Expose the necessary tc act functions and wire up act_api to use +direct calls in retpoline kernels. + +Signed-off-by: Pedro Tammela +Reviewed-by: Jamal Hadi Salim +Reviewed-by: Victor Nogueira +Signed-off-by: David S. Miller +Stable-dep-of: b2dc32dcba08 ("net/sched: act_ipt: add sanity checks on skb before calling target") +Signed-off-by: Sasha Levin +--- + net/sched/act_api.c | 3 ++- + net/sched/act_bpf.c | 6 ++++-- + net/sched/act_connmark.c | 6 ++++-- + net/sched/act_csum.c | 6 ++++-- + net/sched/act_ct.c | 5 +++-- + net/sched/act_ctinfo.c | 6 ++++-- + net/sched/act_gact.c | 6 ++++-- + net/sched/act_gate.c | 6 ++++-- + net/sched/act_ife.c | 6 ++++-- + net/sched/act_ipt.c | 6 ++++-- + net/sched/act_mirred.c | 6 ++++-- + net/sched/act_mpls.c | 6 ++++-- + net/sched/act_nat.c | 7 ++++--- + net/sched/act_pedit.c | 6 ++++-- + net/sched/act_police.c | 6 ++++-- + net/sched/act_sample.c | 6 ++++-- + net/sched/act_simple.c | 6 ++++-- + net/sched/act_skbedit.c | 6 ++++-- + net/sched/act_skbmod.c | 6 ++++-- + net/sched/act_tunnel_key.c | 6 ++++-- + net/sched/act_vlan.c | 6 ++++-- + 21 files changed, 81 insertions(+), 42 deletions(-) + +diff --git a/net/sched/act_api.c b/net/sched/act_api.c +index b33f88e50aa90..60338a4ed0df3 100644 +--- a/net/sched/act_api.c ++++ b/net/sched/act_api.c +@@ -23,6 +23,7 @@ + #include + #include + #include ++#include + + #ifdef CONFIG_INET + DEFINE_STATIC_KEY_FALSE(tcf_frag_xmit_count); +@@ -1080,7 +1081,7 @@ int tcf_action_exec(struct sk_buff *skb, struct tc_action **actions, + + repeat_ttl = 32; + repeat: +- ret = a->ops->act(skb, a, res); ++ ret = tc_act(skb, a, res); + if (unlikely(ret == TC_ACT_REPEAT)) { + if (--repeat_ttl != 0) + goto repeat; +diff --git a/net/sched/act_bpf.c b/net/sched/act_bpf.c +index b79eee44e24eb..b0455fda7d0ba 100644 +--- a/net/sched/act_bpf.c ++++ b/net/sched/act_bpf.c +@@ -18,6 +18,7 @@ + + #include + #include ++#include + + #define ACT_BPF_NAME_LEN 256 + +@@ -31,8 +32,9 @@ struct tcf_bpf_cfg { + + static struct tc_action_ops act_bpf_ops; + +-static int tcf_bpf_act(struct sk_buff *skb, const struct tc_action *act, +- struct tcf_result *res) ++TC_INDIRECT_SCOPE int tcf_bpf_act(struct sk_buff *skb, ++ const struct tc_action *act, ++ struct tcf_result *res) + { + bool at_ingress = skb_at_tc_ingress(skb); + struct tcf_bpf *prog = to_bpf(act); +diff --git a/net/sched/act_connmark.c b/net/sched/act_connmark.c +index d41002e4613ff..7e63ff7e3ed7a 100644 +--- a/net/sched/act_connmark.c ++++ b/net/sched/act_connmark.c +@@ -20,6 +20,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -27,8 +28,9 @@ + + static struct tc_action_ops act_connmark_ops; + +-static int tcf_connmark_act(struct sk_buff *skb, const struct tc_action *a, +- struct tcf_result *res) ++TC_INDIRECT_SCOPE int tcf_connmark_act(struct sk_buff *skb, ++ const struct tc_action *a, ++ struct tcf_result *res) + { + const struct nf_conntrack_tuple_hash *thash; + struct nf_conntrack_tuple tuple; +diff --git a/net/sched/act_csum.c b/net/sched/act_csum.c +index 1366adf9b9091..95e9304024b7d 100644 +--- a/net/sched/act_csum.c ++++ b/net/sched/act_csum.c +@@ -32,6 +32,7 @@ + + #include + #include ++#include + + static const struct nla_policy csum_policy[TCA_CSUM_MAX + 1] = { + [TCA_CSUM_PARMS] = { .len = sizeof(struct tc_csum), }, +@@ -563,8 +564,9 @@ static int tcf_csum_ipv6(struct sk_buff *skb, u32 update_flags) + return 0; + } + +-static int tcf_csum_act(struct sk_buff *skb, const struct tc_action *a, +- struct tcf_result *res) ++TC_INDIRECT_SCOPE int tcf_csum_act(struct sk_buff *skb, ++ const struct tc_action *a, ++ struct tcf_result *res) + { + struct tcf_csum *p = to_tcf_csum(a); + bool orig_vlan_tag_present = false; +diff --git a/net/sched/act_ct.c b/net/sched/act_ct.c +index 4c7f7861ea967..bb1911071d9de 100644 +--- a/net/sched/act_ct.c ++++ b/net/sched/act_ct.c +@@ -24,6 +24,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -1019,8 +1020,8 @@ static int tcf_ct_act_nat(struct sk_buff *skb, + #endif + } + +-static int tcf_ct_act(struct sk_buff *skb, const struct tc_action *a, +- struct tcf_result *res) ++TC_INDIRECT_SCOPE int tcf_ct_act(struct sk_buff *skb, const struct tc_action *a, ++ struct tcf_result *res) + { + struct net *net = dev_net(skb->dev); + bool cached, commit, clear, force; +diff --git a/net/sched/act_ctinfo.c b/net/sched/act_ctinfo.c +index 7275ad869f8ea..4d15b6a6169c4 100644 +--- a/net/sched/act_ctinfo.c ++++ b/net/sched/act_ctinfo.c +@@ -18,6 +18,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -75,8 +76,9 @@ static void tcf_ctinfo_cpmark_set(struct nf_conn *ct, struct tcf_ctinfo *ca, + skb->mark = READ_ONCE(ct->mark) & cp->cpmarkmask; + } + +-static int tcf_ctinfo_act(struct sk_buff *skb, const struct tc_action *a, +- struct tcf_result *res) ++TC_INDIRECT_SCOPE int tcf_ctinfo_act(struct sk_buff *skb, ++ const struct tc_action *a, ++ struct tcf_result *res) + { + const struct nf_conntrack_tuple_hash *thash = NULL; + struct tcf_ctinfo *ca = to_ctinfo(a); +diff --git a/net/sched/act_gact.c b/net/sched/act_gact.c +index 62d682b96b885..54f1b13b2360b 100644 +--- a/net/sched/act_gact.c ++++ b/net/sched/act_gact.c +@@ -18,6 +18,7 @@ + #include + #include + #include ++#include + + static struct tc_action_ops act_gact_ops; + +@@ -145,8 +146,9 @@ static int tcf_gact_init(struct net *net, struct nlattr *nla, + return err; + } + +-static int tcf_gact_act(struct sk_buff *skb, const struct tc_action *a, +- struct tcf_result *res) ++TC_INDIRECT_SCOPE int tcf_gact_act(struct sk_buff *skb, ++ const struct tc_action *a, ++ struct tcf_result *res) + { + struct tcf_gact *gact = to_gact(a); + int action = READ_ONCE(gact->tcf_action); +diff --git a/net/sched/act_gate.c b/net/sched/act_gate.c +index 3049878e73153..9b8def0be41e9 100644 +--- a/net/sched/act_gate.c ++++ b/net/sched/act_gate.c +@@ -14,6 +14,7 @@ + #include + #include + #include ++#include + + static struct tc_action_ops act_gate_ops; + +@@ -113,8 +114,9 @@ static enum hrtimer_restart gate_timer_func(struct hrtimer *timer) + return HRTIMER_RESTART; + } + +-static int tcf_gate_act(struct sk_buff *skb, const struct tc_action *a, +- struct tcf_result *res) ++TC_INDIRECT_SCOPE int tcf_gate_act(struct sk_buff *skb, ++ const struct tc_action *a, ++ struct tcf_result *res) + { + struct tcf_gate *gact = to_gate(a); + +diff --git a/net/sched/act_ife.c b/net/sched/act_ife.c +index 41d63b33461dc..bc7611b0744c4 100644 +--- a/net/sched/act_ife.c ++++ b/net/sched/act_ife.c +@@ -29,6 +29,7 @@ + #include + #include + #include ++#include + + static int max_metacnt = IFE_META_MAX + 1; + static struct tc_action_ops act_ife_ops; +@@ -861,8 +862,9 @@ static int tcf_ife_encode(struct sk_buff *skb, const struct tc_action *a, + return action; + } + +-static int tcf_ife_act(struct sk_buff *skb, const struct tc_action *a, +- struct tcf_result *res) ++TC_INDIRECT_SCOPE int tcf_ife_act(struct sk_buff *skb, ++ const struct tc_action *a, ++ struct tcf_result *res) + { + struct tcf_ife_info *ife = to_ife(a); + struct tcf_ife_params *p; +diff --git a/net/sched/act_ipt.c b/net/sched/act_ipt.c +index dc92975a9374f..ea7f151e7dd29 100644 +--- a/net/sched/act_ipt.c ++++ b/net/sched/act_ipt.c +@@ -20,6 +20,7 @@ + #include + #include + #include ++#include + + #include + +@@ -229,8 +230,9 @@ static int tcf_xt_init(struct net *net, struct nlattr *nla, + a, &act_xt_ops, tp, flags); + } + +-static int tcf_ipt_act(struct sk_buff *skb, const struct tc_action *a, +- struct tcf_result *res) ++TC_INDIRECT_SCOPE int tcf_ipt_act(struct sk_buff *skb, ++ const struct tc_action *a, ++ struct tcf_result *res) + { + int ret = 0, result = 0; + struct tcf_ipt *ipt = to_ipt(a); +diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c +index 36395e5db3b40..a61482c5edbe7 100644 +--- a/net/sched/act_mirred.c ++++ b/net/sched/act_mirred.c +@@ -24,6 +24,7 @@ + #include + #include + #include ++#include + + static LIST_HEAD(mirred_list); + static DEFINE_SPINLOCK(mirred_list_lock); +@@ -224,8 +225,9 @@ static int tcf_mirred_forward(bool want_ingress, struct sk_buff *skb) + return err; + } + +-static int tcf_mirred_act(struct sk_buff *skb, const struct tc_action *a, +- struct tcf_result *res) ++TC_INDIRECT_SCOPE int tcf_mirred_act(struct sk_buff *skb, ++ const struct tc_action *a, ++ struct tcf_result *res) + { + struct tcf_mirred *m = to_mirred(a); + struct sk_buff *skb2 = skb; +diff --git a/net/sched/act_mpls.c b/net/sched/act_mpls.c +index f24f997a7aaf9..809f7928a1be6 100644 +--- a/net/sched/act_mpls.c ++++ b/net/sched/act_mpls.c +@@ -14,6 +14,7 @@ + #include + #include + #include ++#include + + static struct tc_action_ops act_mpls_ops; + +@@ -49,8 +50,9 @@ static __be32 tcf_mpls_get_lse(struct mpls_shim_hdr *lse, + return cpu_to_be32(new_lse); + } + +-static int tcf_mpls_act(struct sk_buff *skb, const struct tc_action *a, +- struct tcf_result *res) ++TC_INDIRECT_SCOPE int tcf_mpls_act(struct sk_buff *skb, ++ const struct tc_action *a, ++ struct tcf_result *res) + { + struct tcf_mpls *m = to_mpls(a); + struct tcf_mpls_params *p; +diff --git a/net/sched/act_nat.c b/net/sched/act_nat.c +index 9265145f10404..74c74be330484 100644 +--- a/net/sched/act_nat.c ++++ b/net/sched/act_nat.c +@@ -24,7 +24,7 @@ + #include + #include + #include +- ++#include + + static struct tc_action_ops act_nat_ops; + +@@ -98,8 +98,9 @@ static int tcf_nat_init(struct net *net, struct nlattr *nla, struct nlattr *est, + return err; + } + +-static int tcf_nat_act(struct sk_buff *skb, const struct tc_action *a, +- struct tcf_result *res) ++TC_INDIRECT_SCOPE int tcf_nat_act(struct sk_buff *skb, ++ const struct tc_action *a, ++ struct tcf_result *res) + { + struct tcf_nat *p = to_tcf_nat(a); + struct iphdr *iph; +diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c +index 180669aa9d097..613a1d777d5a6 100644 +--- a/net/sched/act_pedit.c ++++ b/net/sched/act_pedit.c +@@ -23,6 +23,7 @@ + #include + #include + #include ++#include + + static struct tc_action_ops act_pedit_ops; + +@@ -369,8 +370,9 @@ static int pedit_skb_hdr_offset(struct sk_buff *skb, + return ret; + } + +-static int tcf_pedit_act(struct sk_buff *skb, const struct tc_action *a, +- struct tcf_result *res) ++TC_INDIRECT_SCOPE int tcf_pedit_act(struct sk_buff *skb, ++ const struct tc_action *a, ++ struct tcf_result *res) + { + enum pedit_header_type htype = TCA_PEDIT_KEY_EX_HDR_TYPE_NETWORK; + enum pedit_cmd cmd = TCA_PEDIT_KEY_EX_CMD_SET; +diff --git a/net/sched/act_police.c b/net/sched/act_police.c +index 94be21378e7ca..2e9dce03d1ecc 100644 +--- a/net/sched/act_police.c ++++ b/net/sched/act_police.c +@@ -19,6 +19,7 @@ + #include + #include + #include ++#include + + /* Each policer is serialized by its individual spinlock */ + +@@ -242,8 +243,9 @@ static bool tcf_police_mtu_check(struct sk_buff *skb, u32 limit) + return len <= limit; + } + +-static int tcf_police_act(struct sk_buff *skb, const struct tc_action *a, +- struct tcf_result *res) ++TC_INDIRECT_SCOPE int tcf_police_act(struct sk_buff *skb, ++ const struct tc_action *a, ++ struct tcf_result *res) + { + struct tcf_police *police = to_police(a); + s64 now, toks, ppstoks = 0, ptoks = 0; +diff --git a/net/sched/act_sample.c b/net/sched/act_sample.c +index 09735a33e57e2..d5c745fbb1328 100644 +--- a/net/sched/act_sample.c ++++ b/net/sched/act_sample.c +@@ -20,6 +20,7 @@ + #include + #include + #include ++#include + + #include + +@@ -160,8 +161,9 @@ static bool tcf_sample_dev_ok_push(struct net_device *dev) + } + } + +-static int tcf_sample_act(struct sk_buff *skb, const struct tc_action *a, +- struct tcf_result *res) ++TC_INDIRECT_SCOPE int tcf_sample_act(struct sk_buff *skb, ++ const struct tc_action *a, ++ struct tcf_result *res) + { + struct tcf_sample *s = to_sample(a); + struct psample_group *psample_group; +diff --git a/net/sched/act_simple.c b/net/sched/act_simple.c +index 18d3761354611..4b84514534f39 100644 +--- a/net/sched/act_simple.c ++++ b/net/sched/act_simple.c +@@ -14,6 +14,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -21,8 +22,9 @@ + static struct tc_action_ops act_simp_ops; + + #define SIMP_MAX_DATA 32 +-static int tcf_simp_act(struct sk_buff *skb, const struct tc_action *a, +- struct tcf_result *res) ++TC_INDIRECT_SCOPE int tcf_simp_act(struct sk_buff *skb, ++ const struct tc_action *a, ++ struct tcf_result *res) + { + struct tcf_defact *d = to_defact(a); + +diff --git a/net/sched/act_skbedit.c b/net/sched/act_skbedit.c +index 7f598784fd305..fd7d0d3eae3e7 100644 +--- a/net/sched/act_skbedit.c ++++ b/net/sched/act_skbedit.c +@@ -16,6 +16,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -36,8 +37,9 @@ static u16 tcf_skbedit_hash(struct tcf_skbedit_params *params, + return netdev_cap_txqueue(skb->dev, queue_mapping); + } + +-static int tcf_skbedit_act(struct sk_buff *skb, const struct tc_action *a, +- struct tcf_result *res) ++TC_INDIRECT_SCOPE int tcf_skbedit_act(struct sk_buff *skb, ++ const struct tc_action *a, ++ struct tcf_result *res) + { + struct tcf_skbedit *d = to_skbedit(a); + struct tcf_skbedit_params *params; +diff --git a/net/sched/act_skbmod.c b/net/sched/act_skbmod.c +index d98758a639340..dffa990a9629f 100644 +--- a/net/sched/act_skbmod.c ++++ b/net/sched/act_skbmod.c +@@ -15,14 +15,16 @@ + #include + #include + #include ++#include + + #include + #include + + static struct tc_action_ops act_skbmod_ops; + +-static int tcf_skbmod_act(struct sk_buff *skb, const struct tc_action *a, +- struct tcf_result *res) ++TC_INDIRECT_SCOPE int tcf_skbmod_act(struct sk_buff *skb, ++ const struct tc_action *a, ++ struct tcf_result *res) + { + struct tcf_skbmod *d = to_skbmod(a); + int action, max_edit_len, err; +diff --git a/net/sched/act_tunnel_key.c b/net/sched/act_tunnel_key.c +index 2691a3d8e4511..2d12d26264153 100644 +--- a/net/sched/act_tunnel_key.c ++++ b/net/sched/act_tunnel_key.c +@@ -16,14 +16,16 @@ + #include + #include + #include ++#include + + #include + #include + + static struct tc_action_ops act_tunnel_key_ops; + +-static int tunnel_key_act(struct sk_buff *skb, const struct tc_action *a, +- struct tcf_result *res) ++TC_INDIRECT_SCOPE int tunnel_key_act(struct sk_buff *skb, ++ const struct tc_action *a, ++ struct tcf_result *res) + { + struct tcf_tunnel_key *t = to_tunnel_key(a); + struct tcf_tunnel_key_params *params; +diff --git a/net/sched/act_vlan.c b/net/sched/act_vlan.c +index 7b24e898a3e6b..0251442f5f29d 100644 +--- a/net/sched/act_vlan.c ++++ b/net/sched/act_vlan.c +@@ -12,14 +12,16 @@ + #include + #include + #include ++#include + + #include + #include + + static struct tc_action_ops act_vlan_ops; + +-static int tcf_vlan_act(struct sk_buff *skb, const struct tc_action *a, +- struct tcf_result *res) ++TC_INDIRECT_SCOPE int tcf_vlan_act(struct sk_buff *skb, ++ const struct tc_action *a, ++ struct tcf_result *res) + { + struct tcf_vlan *v = to_vlan(a); + struct tcf_vlan_params *p; +-- +2.39.2 + diff --git a/queue-6.1/ntfs-fix-panic-about-slab-out-of-bounds-caused-by-nt.patch b/queue-6.1/ntfs-fix-panic-about-slab-out-of-bounds-caused-by-nt.patch new file mode 100644 index 00000000000..abf18a0d1eb --- /dev/null +++ b/queue-6.1/ntfs-fix-panic-about-slab-out-of-bounds-caused-by-nt.patch @@ -0,0 +1,52 @@ +From 7a1e02f67ec85ddd57d9d3206d55bbb40dde64dc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Dec 2022 00:28:07 +0800 +Subject: ntfs: Fix panic about slab-out-of-bounds caused by ntfs_listxattr() + +From: Zeng Heng + +[ Upstream commit 3c675ddffb17a8b1e32efad5c983254af18b12c2 ] + +Here is a BUG report from syzbot: + +BUG: KASAN: slab-out-of-bounds in ntfs_list_ea fs/ntfs3/xattr.c:191 [inline] +BUG: KASAN: slab-out-of-bounds in ntfs_listxattr+0x401/0x570 fs/ntfs3/xattr.c:710 +Read of size 1 at addr ffff888021acaf3d by task syz-executor128/3632 + +Call Trace: + ntfs_list_ea fs/ntfs3/xattr.c:191 [inline] + ntfs_listxattr+0x401/0x570 fs/ntfs3/xattr.c:710 + vfs_listxattr fs/xattr.c:457 [inline] + listxattr+0x293/0x2d0 fs/xattr.c:804 + +Fix the logic of ea_all iteration. When the ea->name_len is 0, +return immediately, or Add2Ptr() would visit invalid memory +in the next loop. + +Fixes: be71b5cba2e6 ("fs/ntfs3: Add attrib operations") +Reported-by: syzbot+9fcea5ef6dc4dc72d334@syzkaller.appspotmail.com +Signed-off-by: Zeng Heng +[almaz.alexandrovich@paragon-software.com: lines of the patch have changed] +Signed-off-by: Konstantin Komarov +Signed-off-by: Sasha Levin +--- + fs/ntfs3/xattr.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/fs/ntfs3/xattr.c b/fs/ntfs3/xattr.c +index ea582b4fe1d9d..88866bcd1a218 100644 +--- a/fs/ntfs3/xattr.c ++++ b/fs/ntfs3/xattr.c +@@ -178,6 +178,9 @@ static ssize_t ntfs_list_ea(struct ntfs_inode *ni, char *buffer, + for (ret = 0, off = 0; off < size; off += unpacked_ea_size(ea)) { + ea = Add2Ptr(ea_all, off); + ++ if (!ea->name_len) ++ break; ++ + if (buffer) { + if (ret + ea->name_len + 1 > bytes_per_buffer) { + err = -ERANGE; +-- +2.39.2 + diff --git a/queue-6.1/nvmem-rmem-use-nvmem_devid_auto.patch b/queue-6.1/nvmem-rmem-use-nvmem_devid_auto.patch new file mode 100644 index 00000000000..eb52d71a7d7 --- /dev/null +++ b/queue-6.1/nvmem-rmem-use-nvmem_devid_auto.patch @@ -0,0 +1,41 @@ +From 5df61ad20124f4e32fed2c123bbab95514565366 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 11 Jun 2023 15:03:09 +0100 +Subject: nvmem: rmem: Use NVMEM_DEVID_AUTO + +From: Phil Elwell + +[ Upstream commit 09dd7b993eddb3b48634fd5ddf27aa799785a9ee ] + +It is reasonable to declare multiple nvmem blocks. Unless a unique 'id' +is passed in for each block there may be name clashes. + +Avoid this by using the magic token NVMEM_DEVID_AUTO. + +Fixes: 5a3fa75a4d9c ("nvmem: Add driver to expose reserved memory as nvmem") +Signed-off-by: Phil Elwell +Signed-off-by: Ivan T. Ivanov +Reviewed-by: Stefan Wahren +Signed-off-by: Srinivas Kandagatla +Message-ID: <20230611140330.154222-6-srinivas.kandagatla@linaro.org> +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/nvmem/rmem.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/nvmem/rmem.c b/drivers/nvmem/rmem.c +index 80cb187f14817..752d0bf4445ee 100644 +--- a/drivers/nvmem/rmem.c ++++ b/drivers/nvmem/rmem.c +@@ -71,6 +71,7 @@ static int rmem_probe(struct platform_device *pdev) + config.dev = dev; + config.priv = priv; + config.name = "rmem"; ++ config.id = NVMEM_DEVID_AUTO; + config.size = mem->size; + config.reg_read = rmem_read; + +-- +2.39.2 + diff --git a/queue-6.1/nvmem-sunplus-ocotp-release-otp-clk-before-return.patch b/queue-6.1/nvmem-sunplus-ocotp-release-otp-clk-before-return.patch new file mode 100644 index 00000000000..931b180a6e8 --- /dev/null +++ b/queue-6.1/nvmem-sunplus-ocotp-release-otp-clk-before-return.patch @@ -0,0 +1,59 @@ +From bcd8a9ceaa57cabfc640c77b70fdc65e18aa10c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 May 2023 16:52:36 +0800 +Subject: nvmem: sunplus-ocotp: release otp->clk before return + +From: Yi Yingao + +[ Upstream commit 095bb8ba45f28ed15296eb5b7662e03e57d5e34e ] + +Smatch reports: +drivers/nvmem/sunplus-ocotp.c:205 sp_ocotp_probe() +warn: 'otp->clk' from clk_prepare() not released on lines: 196. + +In the function sp_ocotp_probe(struct platform_device *pdev), otp->clk may +not be released before return. + +To fix this issue, using function clk_unprepare() to release otp->clk. + +Fixes: 8747ec2e9762 ("nvmem: Add driver for OCOTP in Sunplus SP7021") +Signed-off-by: Yi Yingao +Reviewed-by: Dongliang Mu +Message-ID: <20230509085237.5917-1-m202271736@hust.edu.cn> +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/nvmem/sunplus-ocotp.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/drivers/nvmem/sunplus-ocotp.c b/drivers/nvmem/sunplus-ocotp.c +index 52b928a7a6d58..f85350b17d672 100644 +--- a/drivers/nvmem/sunplus-ocotp.c ++++ b/drivers/nvmem/sunplus-ocotp.c +@@ -192,9 +192,11 @@ static int sp_ocotp_probe(struct platform_device *pdev) + sp_ocotp_nvmem_config.dev = dev; + + nvmem = devm_nvmem_register(dev, &sp_ocotp_nvmem_config); +- if (IS_ERR(nvmem)) +- return dev_err_probe(&pdev->dev, PTR_ERR(nvmem), ++ if (IS_ERR(nvmem)) { ++ ret = dev_err_probe(&pdev->dev, PTR_ERR(nvmem), + "register nvmem device fail\n"); ++ goto err; ++ } + + platform_set_drvdata(pdev, nvmem); + +@@ -203,6 +205,9 @@ static int sp_ocotp_probe(struct platform_device *pdev) + (int)OTP_WORD_SIZE, (int)QAC628_OTP_SIZE); + + return 0; ++err: ++ clk_unprepare(otp->clk); ++ return ret; + } + + static const struct of_device_id sp_ocotp_dt_ids[] = { +-- +2.39.2 + diff --git a/queue-6.1/octeontx-af-fix-hardware-timestamp-configuration.patch b/queue-6.1/octeontx-af-fix-hardware-timestamp-configuration.patch new file mode 100644 index 00000000000..e3dd1e61fbf --- /dev/null +++ b/queue-6.1/octeontx-af-fix-hardware-timestamp-configuration.patch @@ -0,0 +1,42 @@ +From b3d7519ac93cadae6c77c064813dd23693ae2d4b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Jul 2023 09:56:53 +0530 +Subject: octeontx-af: fix hardware timestamp configuration + +From: Hariprasad Kelam + +[ Upstream commit 14bb236b29922c4f57d8c05bfdbcb82677f917c9 ] + +MAC block on CN10K (RPM) supports hardware timestamp configuration. The +previous patch which added timestamp configuration support has a bug. +Though the netdev driver requests to disable timestamp configuration, +the driver is always enabling it. + +This patch fixes the same. + +Fixes: d1489208681d ("octeontx2-af: cn10k: RPM hardware timestamp configuration") +Signed-off-by: Hariprasad Kelam +Signed-off-by: Sunil Goutham +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c +index e284a14ca1203..c60b9580ca969 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c +@@ -751,7 +751,7 @@ static int rvu_cgx_ptp_rx_cfg(struct rvu *rvu, u16 pcifunc, bool enable) + cgxd = rvu_cgx_pdata(cgx_id, rvu); + + mac_ops = get_mac_ops(cgxd); +- mac_ops->mac_enadis_ptp_config(cgxd, lmac_id, true); ++ mac_ops->mac_enadis_ptp_config(cgxd, lmac_id, enable); + /* If PTP is enabled then inform NPC that packets to be + * parsed by this PF will have their data shifted by 8 bytes + * and if PTP is disabled then no shift is required +-- +2.39.2 + diff --git a/queue-6.1/octeontx2-af-add-validation-before-accessing-cgx-and.patch b/queue-6.1/octeontx2-af-add-validation-before-accessing-cgx-and.patch new file mode 100644 index 00000000000..9f1f8b310a6 --- /dev/null +++ b/queue-6.1/octeontx2-af-add-validation-before-accessing-cgx-and.patch @@ -0,0 +1,63 @@ +From abfdc229d42676f45f9fd0b7246b4309d51b7ed2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Jun 2023 11:58:44 +0530 +Subject: octeontx2-af: Add validation before accessing cgx and lmac + +From: Hariprasad Kelam + +[ Upstream commit 79ebb53772c95d3a6ae51b3c65f9985fdd430df6 ] + +with the addition of new MAC blocks like CN10K RPM and CN10KB +RPM_USX, LMACs are noncontiguous and CGX blocks are also +noncontiguous. But during RVU driver initialization, the driver +is assuming they are contiguous and trying to access +cgx or lmac with their id which is resulting in kernel panic. + +This patch fixes the issue by adding proper checks. + +[ 23.219150] pc : cgx_lmac_read+0x38/0x70 +[ 23.219154] lr : rvu_program_channels+0x3f0/0x498 +[ 23.223852] sp : ffff000100d6fc80 +[ 23.227158] x29: ffff000100d6fc80 x28: ffff00010009f880 x27: +000000000000005a +[ 23.234288] x26: ffff000102586768 x25: 0000000000002500 x24: +fffffffffff0f000 + +Fixes: 91c6945ea1f9 ("octeontx2-af: cn10k: Add RPM MAC support") +Signed-off-by: Hariprasad Kelam +Signed-off-by: Sunil Goutham +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/af/cgx.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/cgx.c b/drivers/net/ethernet/marvell/octeontx2/af/cgx.c +index afdddfced7e69..65c0373d34d12 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/cgx.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/cgx.c +@@ -167,6 +167,9 @@ void cgx_lmac_write(int cgx_id, int lmac_id, u64 offset, u64 val) + { + struct cgx *cgx_dev = cgx_get_pdata(cgx_id); + ++ /* Software must not access disabled LMAC registers */ ++ if (!is_lmac_valid(cgx_dev, lmac_id)) ++ return; + cgx_write(cgx_dev, lmac_id, offset, val); + } + +@@ -174,6 +177,10 @@ u64 cgx_lmac_read(int cgx_id, int lmac_id, u64 offset) + { + struct cgx *cgx_dev = cgx_get_pdata(cgx_id); + ++ /* Software must not access disabled LMAC registers */ ++ if (!is_lmac_valid(cgx_dev, lmac_id)) ++ return 0; ++ + return cgx_read(cgx_dev, lmac_id, offset); + } + +-- +2.39.2 + diff --git a/queue-6.1/octeontx2-af-fix-mapping-for-nix-block-from-cgx-conn.patch b/queue-6.1/octeontx2-af-fix-mapping-for-nix-block-from-cgx-conn.patch new file mode 100644 index 00000000000..6c732363206 --- /dev/null +++ b/queue-6.1/octeontx2-af-fix-mapping-for-nix-block-from-cgx-conn.patch @@ -0,0 +1,74 @@ +From 71218faff1005cbe178cc8650550aa3cb942a360 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Jun 2023 11:58:43 +0530 +Subject: octeontx2-af: Fix mapping for NIX block from CGX connection + +From: Hariprasad Kelam + +[ Upstream commit 2e7bc57b976bb016c6569a54d95c1b8d88f9450a ] + +Firmware configures NIX block mapping for all MAC blocks. +The current implementation reads the configuration and +creates the mapping between RVU PF and NIX blocks. But +this configuration is only valid for silicons that support +multiple blocks. For all other silicons, all MAC blocks +map to NIX0. + +This patch corrects the mapping by adding a check for the same. + +Fixes: c5a73b632b90 ("octeontx2-af: Map NIX block from CGX connection") +Signed-off-by: Hariprasad Kelam +Signed-off-by: Sunil Goutham +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/af/rvu.h | 11 +++++++++++ + drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c | 2 +- + 2 files changed, 12 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu.h b/drivers/net/ethernet/marvell/octeontx2/af/rvu.h +index d493b533cf76e..a3346ea7876c5 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu.h ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu.h +@@ -23,6 +23,7 @@ + #define PCI_DEVID_OCTEONTX2_LBK 0xA061 + + /* Subsystem Device ID */ ++#define PCI_SUBSYS_DEVID_98XX 0xB100 + #define PCI_SUBSYS_DEVID_96XX 0xB200 + #define PCI_SUBSYS_DEVID_CN10K_A 0xB900 + #define PCI_SUBSYS_DEVID_CNF10K_B 0xBC00 +@@ -646,6 +647,16 @@ static inline u16 rvu_nix_chan_cpt(struct rvu *rvu, u8 chan) + return rvu->hw->cpt_chan_base + chan; + } + ++static inline bool is_rvu_supports_nix1(struct rvu *rvu) ++{ ++ struct pci_dev *pdev = rvu->pdev; ++ ++ if (pdev->subsystem_device == PCI_SUBSYS_DEVID_98XX) ++ return true; ++ ++ return false; ++} ++ + /* Function Prototypes + * RVU + */ +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c +index 9eca38547b783..e284a14ca1203 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c +@@ -112,7 +112,7 @@ static void rvu_map_cgx_nix_block(struct rvu *rvu, int pf, + p2x = cgx_lmac_get_p2x(cgx_id, lmac_id); + /* Firmware sets P2X_SELECT as either NIX0 or NIX1 */ + pfvf->nix_blkaddr = BLKADDR_NIX0; +- if (p2x == CMR_P2X_SEL_NIX1) ++ if (is_rvu_supports_nix1(rvu) && p2x == CMR_P2X_SEL_NIX1) + pfvf->nix_blkaddr = BLKADDR_NIX1; + } + +-- +2.39.2 + diff --git a/queue-6.1/phy-tegra-xusb-check-return-value-of-devm_kzalloc.patch b/queue-6.1/phy-tegra-xusb-check-return-value-of-devm_kzalloc.patch new file mode 100644 index 00000000000..62a97e8072d --- /dev/null +++ b/queue-6.1/phy-tegra-xusb-check-return-value-of-devm_kzalloc.patch @@ -0,0 +1,40 @@ +From 8637ddd8383dc9ffc1fee7d1f52cf61a6ce290b2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 May 2023 10:39:50 +0300 +Subject: phy: tegra: xusb: check return value of devm_kzalloc() + +From: Claudiu Beznea + +[ Upstream commit 44faada0f38fc333d392af04c343b0e23f8f5d81 ] + +devm_kzalloc() returns a pointer to dynamically allocated memory. +Pointer could be NULL in case allocation fails. Check pointer validity. +Identified with coccinelle (kmerr.cocci script). + +Fixes: f67213cee2b3 ("phy: tegra: xusb: Add usb-role-switch support") +Signed-off-by: Claudiu Beznea +Acked-by: Thierry Reding +Link: https://lore.kernel.org/r/20230531073950.145339-1-claudiu.beznea@microchip.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/tegra/xusb.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/phy/tegra/xusb.c b/drivers/phy/tegra/xusb.c +index c3fa22ee2d8d4..4d5b4071d47d5 100644 +--- a/drivers/phy/tegra/xusb.c ++++ b/drivers/phy/tegra/xusb.c +@@ -670,6 +670,9 @@ static int tegra_xusb_setup_usb_role_switch(struct tegra_xusb_port *port) + port->dev.driver = devm_kzalloc(&port->dev, + sizeof(struct device_driver), + GFP_KERNEL); ++ if (!port->dev.driver) ++ return -ENOMEM; ++ + port->dev.driver->owner = THIS_MODULE; + + port->usb_role_sw = usb_role_switch_register(&port->dev, +-- +2.39.2 + diff --git a/queue-6.1/powerpc-allow-ppc_early_debug_cpm-only-when-serial_c.patch b/queue-6.1/powerpc-allow-ppc_early_debug_cpm-only-when-serial_c.patch new file mode 100644 index 00000000000..fbde5c2e8d7 --- /dev/null +++ b/queue-6.1/powerpc-allow-ppc_early_debug_cpm-only-when-serial_c.patch @@ -0,0 +1,46 @@ +From 74ee2c2796a74efd4431b51eefb7be87ab2b0a23 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Jun 2023 22:47:12 -0700 +Subject: powerpc: allow PPC_EARLY_DEBUG_CPM only when SERIAL_CPM=y +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Randy Dunlap + +[ Upstream commit 39f49684036d24af800ff194c33c7b2653c591d7 ] + +In a randconfig with CONFIG_SERIAL_CPM=m and +CONFIG_PPC_EARLY_DEBUG_CPM=y, there is a build error: +ERROR: modpost: "udbg_putc" [drivers/tty/serial/cpm_uart/cpm_uart.ko] undefined! + +Prevent the build error by allowing PPC_EARLY_DEBUG_CPM only when +SERIAL_CPM=y. + +Fixes: c374e00e17f1 ("[POWERPC] Add early debug console for CPM serial ports.") +Signed-off-by: Randy Dunlap +Reviewed-by: Pali Rohár +Reviewed-by: Christophe Leroy +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20230701054714.30512-1-rdunlap@infradead.org +Signed-off-by: Sasha Levin +--- + arch/powerpc/Kconfig.debug | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/powerpc/Kconfig.debug b/arch/powerpc/Kconfig.debug +index 6aaf8dc60610d..2a54fadbeaf51 100644 +--- a/arch/powerpc/Kconfig.debug ++++ b/arch/powerpc/Kconfig.debug +@@ -240,7 +240,7 @@ config PPC_EARLY_DEBUG_40x + + config PPC_EARLY_DEBUG_CPM + bool "Early serial debugging for Freescale CPM-based serial ports" +- depends on SERIAL_CPM ++ depends on SERIAL_CPM=y + help + Select this to enable early debugging for Freescale chips + using a CPM-based serial port. This assumes that the bootwrapper +-- +2.39.2 + diff --git a/queue-6.1/powerpc-dts-turris1x.dts-fix-pcie-mem-size-for-pci2-.patch b/queue-6.1/powerpc-dts-turris1x.dts-fix-pcie-mem-size-for-pci2-.patch new file mode 100644 index 00000000000..4ee79d55f49 --- /dev/null +++ b/queue-6.1/powerpc-dts-turris1x.dts-fix-pcie-mem-size-for-pci2-.patch @@ -0,0 +1,59 @@ +From 5bef14c3b74185c168ce38b8ee33fb07b266292e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 May 2023 19:28:18 +0200 +Subject: powerpc: dts: turris1x.dts: Fix PCIe MEM size for pci2 node +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pali Rohár + +[ Upstream commit abaa02fc944f2f9f2c2e1925ddaceaf35c48528c ] + +Freescale PCIe controllers on their PCIe Root Ports do not have any +mappable PCI BAR allocate from PCIe MEM. + +Information about 1MB window on BAR0 of PCIe Root Port was misleading +because Freescale PCIe controllers have at BAR0 position different register +PEXCSRBAR, and kernel correctly skipts BAR0 for these Freescale PCIe Root +Ports. + +So update comment about P2020 PCIe Root Port and decrease PCIe MEM size +required for PCIe controller (pci2 node) on which is on-board xHCI +controller. + +lspci confirms that on P2020 PCIe Root Port is no PCI BAR and /proc/iomem +sees that only c0000000-c000ffff and c0010000-c0011fff ranges are used. + +Fixes: 54c15ec3b738 ("powerpc: dts: Add DTS file for CZ.NIC Turris 1.x routers") +Signed-off-by: Pali Rohár +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20230505172818.18416-1-pali@kernel.org +Signed-off-by: Sasha Levin +--- + arch/powerpc/boot/dts/turris1x.dts | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/powerpc/boot/dts/turris1x.dts b/arch/powerpc/boot/dts/turris1x.dts +index e9cda34a140e0..9377055d5565c 100644 +--- a/arch/powerpc/boot/dts/turris1x.dts ++++ b/arch/powerpc/boot/dts/turris1x.dts +@@ -453,12 +453,12 @@ pci2: pcie@ffe08000 { + * channel 1 (but only USB 2.0 subset) to USB 2.0 pins on mPCIe + * slot 1 (CN5), channels 2 and 3 to connector P600. + * +- * P2020 PCIe Root Port uses 1MB of PCIe MEM and xHCI controller ++ * P2020 PCIe Root Port does not use PCIe MEM and xHCI controller + * uses 64kB + 8kB of PCIe MEM. No PCIe IO is used or required. +- * So allocate 2MB of PCIe MEM for this PCIe bus. ++ * So allocate 128kB of PCIe MEM for this PCIe bus. + */ + reg = <0 0xffe08000 0 0x1000>; +- ranges = <0x02000000 0x0 0xc0000000 0 0xc0000000 0x0 0x00200000>, /* MEM */ ++ ranges = <0x02000000 0x0 0xc0000000 0 0xc0000000 0x0 0x00020000>, /* MEM */ + <0x01000000 0x0 0x00000000 0 0xffc20000 0x0 0x00010000>; /* IO */ + + pcie@0 { +-- +2.39.2 + diff --git a/queue-6.1/pptp-fix-fib-lookup-calls.patch b/queue-6.1/pptp-fix-fib-lookup-calls.patch new file mode 100644 index 00000000000..6f20e55ae18 --- /dev/null +++ b/queue-6.1/pptp-fix-fib-lookup-calls.patch @@ -0,0 +1,116 @@ +From f095a0fd51792f51bd2a6c289a852bbe8decda32 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Jul 2023 19:14:46 +0200 +Subject: pptp: Fix fib lookup calls. + +From: Guillaume Nault + +[ Upstream commit 84bef5b6037c15180ef88ac4216dc621d16df1a6 ] + +PPTP uses pppox sockets (struct pppox_sock). These sockets don't embed +an inet_sock structure, so it's invalid to call inet_sk() on them. + +Therefore, the ip_route_output_ports() call in pptp_connect() has two +problems: + + * The tos variable is set with RT_CONN_FLAGS(sk), which calls + inet_sk() on the pppox socket. + + * ip_route_output_ports() tries to retrieve routing flags using + inet_sk_flowi_flags(), which is also going to call inet_sk() on the + pppox socket. + +While PPTP doesn't use inet sockets, it's actually really layered on +top of IP and therefore needs a proper way to do fib lookups. So let's +define pptp_route_output() to get a struct rtable from a pptp socket. +Let's also replace the ip_route_output_ports() call of pptp_xmit() for +consistency. + +In practice, this means that: + + * pptp_connect() sets ->flowi4_tos and ->flowi4_flags to zero instead + of using bits of unrelated struct pppox_sock fields. + + * pptp_xmit() now respects ->sk_mark and ->sk_uid. + + * pptp_xmit() now calls the security_sk_classify_flow() security + hook, thus allowing to set ->flowic_secid. + + * pptp_xmit() now passes the pppox socket to xfrm_lookup_route(). + +Found by code inspection. + +Fixes: 00959ade36ac ("PPTP: PPP over IPv4 (Point-to-Point Tunneling Protocol)") +Signed-off-by: Guillaume Nault +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ppp/pptp.c | 31 ++++++++++++++++++++----------- + 1 file changed, 20 insertions(+), 11 deletions(-) + +diff --git a/drivers/net/ppp/pptp.c b/drivers/net/ppp/pptp.c +index 0fe78826c8fa4..32183f24e63ff 100644 +--- a/drivers/net/ppp/pptp.c ++++ b/drivers/net/ppp/pptp.c +@@ -24,6 +24,7 @@ + #include + #include + #include ++#include + #include + + #include +@@ -128,6 +129,23 @@ static void del_chan(struct pppox_sock *sock) + spin_unlock(&chan_lock); + } + ++static struct rtable *pptp_route_output(struct pppox_sock *po, ++ struct flowi4 *fl4) ++{ ++ struct sock *sk = &po->sk; ++ struct net *net; ++ ++ net = sock_net(sk); ++ flowi4_init_output(fl4, sk->sk_bound_dev_if, sk->sk_mark, 0, ++ RT_SCOPE_UNIVERSE, IPPROTO_GRE, 0, ++ po->proto.pptp.dst_addr.sin_addr.s_addr, ++ po->proto.pptp.src_addr.sin_addr.s_addr, ++ 0, 0, sock_net_uid(net, sk)); ++ security_sk_classify_flow(sk, flowi4_to_flowi_common(fl4)); ++ ++ return ip_route_output_flow(net, fl4, sk); ++} ++ + static int pptp_xmit(struct ppp_channel *chan, struct sk_buff *skb) + { + struct sock *sk = (struct sock *) chan->private; +@@ -151,11 +169,7 @@ static int pptp_xmit(struct ppp_channel *chan, struct sk_buff *skb) + if (sk_pppox(po)->sk_state & PPPOX_DEAD) + goto tx_error; + +- rt = ip_route_output_ports(net, &fl4, NULL, +- opt->dst_addr.sin_addr.s_addr, +- opt->src_addr.sin_addr.s_addr, +- 0, 0, IPPROTO_GRE, +- RT_TOS(0), sk->sk_bound_dev_if); ++ rt = pptp_route_output(po, &fl4); + if (IS_ERR(rt)) + goto tx_error; + +@@ -438,12 +452,7 @@ static int pptp_connect(struct socket *sock, struct sockaddr *uservaddr, + po->chan.private = sk; + po->chan.ops = &pptp_chan_ops; + +- rt = ip_route_output_ports(sock_net(sk), &fl4, sk, +- opt->dst_addr.sin_addr.s_addr, +- opt->src_addr.sin_addr.s_addr, +- 0, 0, +- IPPROTO_GRE, RT_CONN_FLAGS(sk), +- sk->sk_bound_dev_if); ++ rt = pptp_route_output(po, &fl4); + if (IS_ERR(rt)) { + error = -EHOSTUNREACH; + goto end; +-- +2.39.2 + diff --git a/queue-6.1/pwm-ab8500-fix-error-code-in-probe.patch b/queue-6.1/pwm-ab8500-fix-error-code-in-probe.patch new file mode 100644 index 00000000000..229d6439095 --- /dev/null +++ b/queue-6.1/pwm-ab8500-fix-error-code-in-probe.patch @@ -0,0 +1,41 @@ +From 1078d9eb66db0c14a5232f46411ae8644ffe465c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 May 2023 14:07:42 +0300 +Subject: pwm: ab8500: Fix error code in probe() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Dan Carpenter + +[ Upstream commit cdcffafc4d845cc0c6392cba168c7a942734cce7 ] + +This code accidentally return positive EINVAL instead of negative +-EINVAL. + +Fixes: eb41f334589d ("pwm: ab8500: Fix register offset calculation to not depend on probe order") +Signed-off-by: Dan Carpenter +Reviewed-by: Uwe Kleine-König +Reviewed-by: Linus Walleij +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-ab8500.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pwm/pwm-ab8500.c b/drivers/pwm/pwm-ab8500.c +index ad37bc46f2721..5fa91f4cda7ac 100644 +--- a/drivers/pwm/pwm-ab8500.c ++++ b/drivers/pwm/pwm-ab8500.c +@@ -96,7 +96,7 @@ static int ab8500_pwm_probe(struct platform_device *pdev) + int err; + + if (pdev->id < 1 || pdev->id > 31) +- return dev_err_probe(&pdev->dev, EINVAL, "Invalid device id %d\n", pdev->id); ++ return dev_err_probe(&pdev->dev, -EINVAL, "Invalid device id %d\n", pdev->id); + + /* + * Nothing to be done in probe, this is required to get the +-- +2.39.2 + diff --git a/queue-6.1/pwm-imx-tpm-force-real_period-to-be-zero-in-suspend.patch b/queue-6.1/pwm-imx-tpm-force-real_period-to-be-zero-in-suspend.patch new file mode 100644 index 00000000000..774a966079a --- /dev/null +++ b/queue-6.1/pwm-imx-tpm-force-real_period-to-be-zero-in-suspend.patch @@ -0,0 +1,48 @@ +From 328d054a1bd259b261084022a24aae00271301e6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 May 2023 14:58:39 +0800 +Subject: pwm: imx-tpm: force 'real_period' to be zero in suspend +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Fancy Fang + +[ Upstream commit 661dfb7f46298e53f6c3deaa772fa527aae86193 ] + +During suspend, all the tpm registers will lose values. +So the 'real_period' value of struct 'imx_tpm_pwm_chip' +should be forced to be zero to force the period update +code can be executed after system resume back. + +Signed-off-by: Fancy Fang +Signed-off-by: Clark Wang +Acked-by: Uwe Kleine-König +Fixes: 738a1cfec2ed ("pwm: Add i.MX TPM PWM driver support") +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-imx-tpm.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/pwm/pwm-imx-tpm.c b/drivers/pwm/pwm-imx-tpm.c +index ed1aad96fff04..318dc0be974b4 100644 +--- a/drivers/pwm/pwm-imx-tpm.c ++++ b/drivers/pwm/pwm-imx-tpm.c +@@ -399,6 +399,13 @@ static int __maybe_unused pwm_imx_tpm_suspend(struct device *dev) + if (tpm->enable_count > 0) + return -EBUSY; + ++ /* ++ * Force 'real_period' to be zero to force period update code ++ * can be executed after system resume back, since suspend causes ++ * the period related registers to become their reset values. ++ */ ++ tpm->real_period = 0; ++ + clk_disable_unprepare(tpm->clk); + + return 0; +-- +2.39.2 + diff --git a/queue-6.1/pwm-mtk_disp-fix-the-disable-flow-of-disp_pwm.patch b/queue-6.1/pwm-mtk_disp-fix-the-disable-flow-of-disp_pwm.patch new file mode 100644 index 00000000000..4b568adb13b --- /dev/null +++ b/queue-6.1/pwm-mtk_disp-fix-the-disable-flow-of-disp_pwm.patch @@ -0,0 +1,57 @@ +From 75afdbafac8c2f573a43527470a531cb4a254ba3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 May 2023 11:10:01 +0800 +Subject: pwm: mtk_disp: Fix the disable flow of disp_pwm +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Shuijing Li + +[ Upstream commit bc13d60e4e1e945b34769a4a4c2b172e8552abe5 ] + +There is a flow error in the original mtk_disp_pwm_apply() function. +If this function is called when the clock is disabled, there will be a +chance to operate the disp_pwm register, resulting in disp_pwm exception. +Fix this accordingly. + +Fixes: 888a623db5d0 ("pwm: mtk-disp: Implement atomic API .apply()") +Signed-off-by: Shuijing Li +Reviewed-by: Matthias Brugger +Tested-by: Fei Shao +Acked-by: Uwe Kleine-König +Reviewed-by: Alexandre Mergnat +Reviewed-by: AngeloGioacchino Del Regno +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-mtk-disp.c | 13 +++++-------- + 1 file changed, 5 insertions(+), 8 deletions(-) + +diff --git a/drivers/pwm/pwm-mtk-disp.c b/drivers/pwm/pwm-mtk-disp.c +index 3811578fcff05..db286284f3ee0 100644 +--- a/drivers/pwm/pwm-mtk-disp.c ++++ b/drivers/pwm/pwm-mtk-disp.c +@@ -79,14 +79,11 @@ static int mtk_disp_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm, + if (state->polarity != PWM_POLARITY_NORMAL) + return -EINVAL; + +- if (!state->enabled) { +- mtk_disp_pwm_update_bits(mdp, DISP_PWM_EN, mdp->data->enable_mask, +- 0x0); +- +- if (mdp->enabled) { +- clk_disable_unprepare(mdp->clk_mm); +- clk_disable_unprepare(mdp->clk_main); +- } ++ if (!state->enabled && mdp->enabled) { ++ mtk_disp_pwm_update_bits(mdp, DISP_PWM_EN, ++ mdp->data->enable_mask, 0x0); ++ clk_disable_unprepare(mdp->clk_mm); ++ clk_disable_unprepare(mdp->clk_main); + + mdp->enabled = false; + return 0; +-- +2.39.2 + diff --git a/queue-6.1/pwm-sysfs-do-not-apply-state-to-already-disabled-pwm.patch b/queue-6.1/pwm-sysfs-do-not-apply-state-to-already-disabled-pwm.patch new file mode 100644 index 00000000000..8a516e12bad --- /dev/null +++ b/queue-6.1/pwm-sysfs-do-not-apply-state-to-already-disabled-pwm.patch @@ -0,0 +1,90 @@ +From 4d38c89ecc0294a87a19715ba2ef321fee1a762b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 May 2023 18:47:36 +0200 +Subject: pwm: sysfs: Do not apply state to already disabled PWMs +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Marek Vasut + +[ Upstream commit 38ba83598633373f47951384cfc389181c8d1bed ] + +If the PWM is exported but not enabled, do not call pwm_class_apply_state(). +First of all, in this case, period may still be unconfigured and this would +make pwm_class_apply_state() return -EINVAL, and then suspend would fail. +Second, it makes little sense to apply state onto PWM that is not enabled +before suspend. + +Failing case: +" +$ echo 1 > /sys/class/pwm/pwmchip4/export +$ echo mem > /sys/power/state +... +pwm pwmchip4: PM: dpm_run_callback(): pwm_class_suspend+0x1/0xa8 returns -22 +pwm pwmchip4: PM: failed to suspend: error -22 +PM: Some devices failed to suspend, or early wake event detected +" + +Working case: +" +$ echo 1 > /sys/class/pwm/pwmchip4/export +$ echo 100 > /sys/class/pwm/pwmchip4/pwm1/period +$ echo 10 > /sys/class/pwm/pwmchip4/pwm1/duty_cycle +$ echo mem > /sys/power/state +... +" + +Do not call pwm_class_apply_state() in case the PWM is disabled +to fix this issue. + +Fixes: 7fd4edc57bbae ("pwm: sysfs: Add suspend/resume support") +Signed-off-by: Marek Vasut +Fixes: ef2bf4997f7d ("pwm: Improve args checking in pwm_apply_state()") +Reviewed-by: Brian Norris +Reviewed-by: Uwe Kleine-König +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + drivers/pwm/sysfs.c | 17 +++++++++++++++++ + 1 file changed, 17 insertions(+) + +diff --git a/drivers/pwm/sysfs.c b/drivers/pwm/sysfs.c +index e7db8e45001cf..ba125253857ea 100644 +--- a/drivers/pwm/sysfs.c ++++ b/drivers/pwm/sysfs.c +@@ -424,6 +424,13 @@ static int pwm_class_resume_npwm(struct device *parent, unsigned int npwm) + if (!export) + continue; + ++ /* If pwmchip was not enabled before suspend, do nothing. */ ++ if (!export->suspend.enabled) { ++ /* release lock taken in pwm_class_get_state */ ++ mutex_unlock(&export->lock); ++ continue; ++ } ++ + state.enabled = export->suspend.enabled; + ret = pwm_class_apply_state(export, pwm, &state); + if (ret < 0) +@@ -448,7 +455,17 @@ static int pwm_class_suspend(struct device *parent) + if (!export) + continue; + ++ /* ++ * If pwmchip was not enabled before suspend, save ++ * state for resume time and do nothing else. ++ */ + export->suspend = state; ++ if (!state.enabled) { ++ /* release lock taken in pwm_class_get_state */ ++ mutex_unlock(&export->lock); ++ continue; ++ } ++ + state.enabled = false; + ret = pwm_class_apply_state(export, pwm, &state); + if (ret < 0) { +-- +2.39.2 + diff --git a/queue-6.1/revert-usb-common-usb-conn-gpio-set-last-role-to-unk.patch b/queue-6.1/revert-usb-common-usb-conn-gpio-set-last-role-to-unk.patch new file mode 100644 index 00000000000..06b15868d8f --- /dev/null +++ b/queue-6.1/revert-usb-common-usb-conn-gpio-set-last-role-to-unk.patch @@ -0,0 +1,98 @@ +From 4fe86e1c7a9f0afc0fb3bbd915968081c2ab5e97 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Jun 2023 11:30:35 +0200 +Subject: Revert "usb: common: usb-conn-gpio: Set last role to unknown before + initial detection" + +From: Greg Kroah-Hartman + +[ Upstream commit df49f2a0ac4a34c0cb4b5c233fcfa0add644c43c ] + +This reverts commit edd60d24bd858cef165274e4cd6cab43bdc58d15. + +Heikki reports that this should not be a global flag just to work around +one broken driver and should be fixed differently, so revert it. + +Reported-by: Heikki Krogerus +Fixes: edd60d24bd85 ("usb: common: usb-conn-gpio: Set last role to unknown before initial detection") +Link: https://lore.kernel.org/r/ZImE4L3YgABnCIsP@kuha.fi.intel.com +Cc: Prashanth K +Cc: AngeloGioacchino Del Regno +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/cdns3/core.c | 2 -- + drivers/usb/common/usb-conn-gpio.c | 3 --- + drivers/usb/musb/jz4740.c | 2 -- + drivers/usb/roles/intel-xhci-usb-role-switch.c | 2 -- + include/linux/usb/role.h | 1 - + 5 files changed, 10 deletions(-) + +diff --git a/drivers/usb/cdns3/core.c b/drivers/usb/cdns3/core.c +index 69d2921f2d3b5..dbcdf3b24b477 100644 +--- a/drivers/usb/cdns3/core.c ++++ b/drivers/usb/cdns3/core.c +@@ -252,8 +252,6 @@ static enum usb_role cdns_hw_role_state_machine(struct cdns *cdns) + if (!vbus) + role = USB_ROLE_NONE; + break; +- default: +- break; + } + + dev_dbg(cdns->dev, "role %d -> %d\n", cdns->role, role); +diff --git a/drivers/usb/common/usb-conn-gpio.c b/drivers/usb/common/usb-conn-gpio.c +index 30bdb81934bc8..e20874caba363 100644 +--- a/drivers/usb/common/usb-conn-gpio.c ++++ b/drivers/usb/common/usb-conn-gpio.c +@@ -257,9 +257,6 @@ static int usb_conn_probe(struct platform_device *pdev) + platform_set_drvdata(pdev, info); + device_set_wakeup_capable(&pdev->dev, true); + +- /* Set last role to unknown before performing the initial detection */ +- info->last_role = USB_ROLE_UNKNOWN; +- + /* Perform initial detection */ + usb_conn_queue_dwork(info, 0); + +diff --git a/drivers/usb/musb/jz4740.c b/drivers/usb/musb/jz4740.c +index df4e9d397d986..d1e4e0deb7535 100644 +--- a/drivers/usb/musb/jz4740.c ++++ b/drivers/usb/musb/jz4740.c +@@ -91,8 +91,6 @@ static int jz4740_musb_role_switch_set(struct usb_role_switch *sw, + case USB_ROLE_HOST: + atomic_notifier_call_chain(&phy->notifier, USB_EVENT_ID, phy); + break; +- default: +- break; + } + + return 0; +diff --git a/drivers/usb/roles/intel-xhci-usb-role-switch.c b/drivers/usb/roles/intel-xhci-usb-role-switch.c +index 4d6a3dd06e011..5c96e929acea0 100644 +--- a/drivers/usb/roles/intel-xhci-usb-role-switch.c ++++ b/drivers/usb/roles/intel-xhci-usb-role-switch.c +@@ -97,8 +97,6 @@ static int intel_xhci_usb_set_role(struct usb_role_switch *sw, + val |= SW_VBUS_VALID; + drd_config = DRD_CONFIG_STATIC_DEVICE; + break; +- default: +- break; + } + val |= SW_IDPIN_EN; + if (data->enable_sw_switch) { +diff --git a/include/linux/usb/role.h b/include/linux/usb/role.h +index 65e790a28913e..b5deafd91f67b 100644 +--- a/include/linux/usb/role.h ++++ b/include/linux/usb/role.h +@@ -11,7 +11,6 @@ enum usb_role { + USB_ROLE_NONE, + USB_ROLE_HOST, + USB_ROLE_DEVICE, +- USB_ROLE_UNKNOWN, + }; + + typedef int (*usb_role_switch_set_t)(struct usb_role_switch *sw, +-- +2.39.2 + diff --git a/queue-6.1/riscv-move-memblock_allow_resize-after-linear-mappin.patch b/queue-6.1/riscv-move-memblock_allow_resize-after-linear-mappin.patch new file mode 100644 index 00000000000..0086f99d405 --- /dev/null +++ b/queue-6.1/riscv-move-memblock_allow_resize-after-linear-mappin.patch @@ -0,0 +1,109 @@ +From ac49eae299f6f3f4c5fe156e8a051c18a811a4c3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Jun 2023 21:19:07 +0800 +Subject: riscv: move memblock_allow_resize() after linear mapping is ready + +From: Woody Zhang + +[ Upstream commit 85fadc0d04119c2fe4a20287767ab904c6d21ba1 ] + +The initial memblock metadata is accessed from kernel image mapping. The +regions arrays need to "reallocated" from memblock and accessed through +linear mapping to cover more memblock regions. So the resizing should +not be allowed until linear mapping is ready. Note that there are +memblock allocations when building linear mapping. + +This patch is similar to 24cc61d8cb5a ("arm64: memblock: don't permit +memblock resizing until linear mapping is up"). + +In following log, many memblock regions are reserved before +create_linear_mapping_page_table(). And then it triggered reallocation +of memblock.reserved.regions and memcpy the old array in kernel image +mapping to the new array in linear mapping which caused a page fault. + +[ 0.000000] memblock_reserve: [0x00000000bf01f000-0x00000000bf01ffff] early_init_fdt_scan_reserved_mem+0x28c/0x2c6 +[ 0.000000] memblock_reserve: [0x00000000bf021000-0x00000000bf021fff] early_init_fdt_scan_reserved_mem+0x28c/0x2c6 +[ 0.000000] memblock_reserve: [0x00000000bf023000-0x00000000bf023fff] early_init_fdt_scan_reserved_mem+0x28c/0x2c6 +[ 0.000000] memblock_reserve: [0x00000000bf025000-0x00000000bf025fff] early_init_fdt_scan_reserved_mem+0x28c/0x2c6 +[ 0.000000] memblock_reserve: [0x00000000bf027000-0x00000000bf027fff] early_init_fdt_scan_reserved_mem+0x28c/0x2c6 +[ 0.000000] memblock_reserve: [0x00000000bf029000-0x00000000bf029fff] early_init_fdt_scan_reserved_mem+0x28c/0x2c6 +[ 0.000000] memblock_reserve: [0x00000000bf02b000-0x00000000bf02bfff] early_init_fdt_scan_reserved_mem+0x28c/0x2c6 +[ 0.000000] memblock_reserve: [0x00000000bf02d000-0x00000000bf02dfff] early_init_fdt_scan_reserved_mem+0x28c/0x2c6 +[ 0.000000] memblock_reserve: [0x00000000bf02f000-0x00000000bf02ffff] early_init_fdt_scan_reserved_mem+0x28c/0x2c6 +[ 0.000000] memblock_reserve: [0x00000000bf030000-0x00000000bf030fff] early_init_fdt_scan_reserved_mem+0x28c/0x2c6 +[ 0.000000] OF: reserved mem: 0x0000000080000000..0x000000008007ffff (512 KiB) map non-reusable mmode_resv0@80000000 +[ 0.000000] memblock_reserve: [0x00000000bf000000-0x00000000bf001fed] paging_init+0x19a/0x5ae +[ 0.000000] memblock_phys_alloc_range: 4096 bytes align=0x1000 from=0x0000000000000000 max_addr=0x0000000000000000 alloc_pmd_fixmap+0x14/0x1c +[ 0.000000] memblock_reserve: [0x000000017ffff000-0x000000017fffffff] memblock_alloc_range_nid+0xb8/0x128 +[ 0.000000] memblock: reserved is doubled to 256 at [0x000000017fffd000-0x000000017fffe7ff] +[ 0.000000] Unable to handle kernel paging request at virtual address ff600000ffffd000 +[ 0.000000] Oops [#1] +[ 0.000000] Modules linked in: +[ 0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 6.4.0-rc1-00011-g99a670b2069c #66 +[ 0.000000] Hardware name: riscv-virtio,qemu (DT) +[ 0.000000] epc : __memcpy+0x60/0xf8 +[ 0.000000] ra : memblock_double_array+0x192/0x248 +[ 0.000000] epc : ffffffff8081d214 ra : ffffffff80a3dfc0 sp : ffffffff81403bd0 +[ 0.000000] gp : ffffffff814fbb38 tp : ffffffff8140dac0 t0 : 0000000001600000 +[ 0.000000] t1 : 0000000000000000 t2 : 000000008f001000 s0 : ffffffff81403c60 +[ 0.000000] s1 : ffffffff80c0bc98 a0 : ff600000ffffd000 a1 : ffffffff80c0bcd8 +[ 0.000000] a2 : 0000000000000c00 a3 : ffffffff80c0c8d8 a4 : 0000000080000000 +[ 0.000000] a5 : 0000000000080000 a6 : 0000000000000000 a7 : 0000000080200000 +[ 0.000000] s2 : ff600000ffffd000 s3 : 0000000000002000 s4 : 0000000000000c00 +[ 0.000000] s5 : ffffffff80c0bc60 s6 : ffffffff80c0bcc8 s7 : 0000000000000000 +[ 0.000000] s8 : ffffffff814fd0a8 s9 : 000000017fffe7ff s10: 0000000000000000 +[ 0.000000] s11: 0000000000001000 t3 : 0000000000001000 t4 : 0000000000000000 +[ 0.000000] t5 : 000000008f003000 t6 : ff600000ffffd000 +[ 0.000000] status: 0000000200000100 badaddr: ff600000ffffd000 cause: 000000000000000f +[ 0.000000] [] __memcpy+0x60/0xf8 +[ 0.000000] [] memblock_add_range.isra.14+0x12c/0x162 +[ 0.000000] [] memblock_reserve+0x6e/0x8c +[ 0.000000] [] memblock_alloc_range_nid+0xb8/0x128 +[ 0.000000] [] memblock_phys_alloc_range+0x5e/0x6a +[ 0.000000] [] alloc_pmd_fixmap+0x14/0x1c +[ 0.000000] [] alloc_p4d_fixmap+0xc/0x14 +[ 0.000000] [] create_pgd_mapping+0x98/0x17c +[ 0.000000] [] create_linear_mapping_range.constprop.10+0xe4/0x112 +[ 0.000000] [] paging_init+0x3ec/0x5ae +[ 0.000000] [] setup_arch+0xb2/0x576 +[ 0.000000] [] start_kernel+0x72/0x57e +[ 0.000000] Code: b303 0285 b383 0305 be03 0385 be83 0405 bf03 0485 (b023) 00ef +[ 0.000000] ---[ end trace 0000000000000000 ]--- +[ 0.000000] Kernel panic - not syncing: Attempted to kill the idle task! +[ 0.000000] ---[ end Kernel panic - not syncing: Attempted to kill the idle task! ]--- + +Fixes: 671f9a3e2e24 ("RISC-V: Setup initial page tables in two stages") +Signed-off-by: Woody Zhang +Tested-by: Song Shuai +Link: https://lore.kernel.org/r/tencent_FBB94CE615C5CCE7701CD39C15CCE0EE9706@qq.com +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + arch/riscv/mm/init.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/arch/riscv/mm/init.c b/arch/riscv/mm/init.c +index d8d97df801909..9390cdff39ffc 100644 +--- a/arch/riscv/mm/init.c ++++ b/arch/riscv/mm/init.c +@@ -255,7 +255,6 @@ static void __init setup_bootmem(void) + dma_contiguous_reserve(dma32_phys_limit); + if (IS_ENABLED(CONFIG_64BIT)) + hugetlb_cma_reserve(PUD_SHIFT - PAGE_SHIFT); +- memblock_allow_resize(); + } + + #ifdef CONFIG_MMU +@@ -1211,6 +1210,9 @@ void __init paging_init(void) + { + setup_bootmem(); + setup_vm_final(); ++ ++ /* Depend on that Linear Mapping is ready */ ++ memblock_allow_resize(); + } + + void __init misc_mem_init(void) +-- +2.39.2 + diff --git a/queue-6.1/rtc-st-lpc-release-some-resources-in-st_rtc_probe-in.patch b/queue-6.1/rtc-st-lpc-release-some-resources-in-st_rtc_probe-in.patch new file mode 100644 index 00000000000..60de99be555 --- /dev/null +++ b/queue-6.1/rtc-st-lpc-release-some-resources-in-st_rtc_probe-in.patch @@ -0,0 +1,40 @@ +From d1afa1a976c5d354e7e080834b31120e28d02cca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Jun 2023 21:11:42 +0200 +Subject: rtc: st-lpc: Release some resources in st_rtc_probe() in case of + error + +From: Christophe JAILLET + +[ Upstream commit 06c6e1b01d9261f03629cefd1f3553503291e6cf ] + +If an error occurs after clk_get(), the corresponding resources should be +released. + +Use devm_clk_get() to fix it. + +Fixes: b5b2bdfc2893 ("rtc: st: Add new driver for ST's LPC RTC") +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/866af6adbc7454a7b4505eb6c28fbdc86ccff39e.1686251455.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-st-lpc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/rtc/rtc-st-lpc.c b/drivers/rtc/rtc-st-lpc.c +index 0f8e4231098ef..d04d46f9cc65a 100644 +--- a/drivers/rtc/rtc-st-lpc.c ++++ b/drivers/rtc/rtc-st-lpc.c +@@ -228,7 +228,7 @@ static int st_rtc_probe(struct platform_device *pdev) + enable_irq_wake(rtc->irq); + disable_irq(rtc->irq); + +- rtc->clk = clk_get(&pdev->dev, NULL); ++ rtc->clk = devm_clk_get(&pdev->dev, NULL); + if (IS_ERR(rtc->clk)) { + dev_err(&pdev->dev, "Unable to request clock\n"); + return PTR_ERR(rtc->clk); +-- +2.39.2 + diff --git a/queue-6.1/s390-qeth-fix-vipa-deletion.patch b/queue-6.1/s390-qeth-fix-vipa-deletion.patch new file mode 100644 index 00000000000..9e2d83ada8a --- /dev/null +++ b/queue-6.1/s390-qeth-fix-vipa-deletion.patch @@ -0,0 +1,42 @@ +From 04a5c0bf8c3e5157b29f6d0baa8276f70f9c01f8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Jul 2023 16:41:21 +0200 +Subject: s390/qeth: Fix vipa deletion + +From: Thorsten Winkler + +[ Upstream commit 80de809bd35e2a8999edf9f5aaa2d8de18921f11 ] + +Change boolean parameter of function "qeth_l3_vipa_store" inside the +"qeth_l3_dev_vipa_del4_store" function from "true" to "false" because +"true" is used for adding a virtual ip address and "false" for deleting. + +Fixes: 2390166a6b45 ("s390/qeth: clean up L3 sysfs code") + +Reviewed-by: Alexandra Winter +Reviewed-by: Wenjia Zhang +Signed-off-by: Thorsten Winkler +Signed-off-by: Alexandra Winter +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/s390/net/qeth_l3_sys.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/s390/net/qeth_l3_sys.c b/drivers/s390/net/qeth_l3_sys.c +index 1082380b21f85..dba9b307020cb 100644 +--- a/drivers/s390/net/qeth_l3_sys.c ++++ b/drivers/s390/net/qeth_l3_sys.c +@@ -652,7 +652,7 @@ static QETH_DEVICE_ATTR(vipa_add4, add4, 0644, + static ssize_t qeth_l3_dev_vipa_del4_store(struct device *dev, + struct device_attribute *attr, const char *buf, size_t count) + { +- return qeth_l3_vipa_store(dev, buf, true, count, QETH_PROT_IPV4); ++ return qeth_l3_vipa_store(dev, buf, false, count, QETH_PROT_IPV4); + } + + static QETH_DEVICE_ATTR(vipa_del4, del4, 0200, NULL, +-- +2.39.2 + diff --git a/queue-6.1/sctp-fix-potential-deadlock-on-net-sctp.addr_wq_lock.patch b/queue-6.1/sctp-fix-potential-deadlock-on-net-sctp.addr_wq_lock.patch new file mode 100644 index 00000000000..0da38614fa3 --- /dev/null +++ b/queue-6.1/sctp-fix-potential-deadlock-on-net-sctp.addr_wq_lock.patch @@ -0,0 +1,57 @@ +From cdaa05df65d5f514e56f421f2f0c9d4fa68da74a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Jun 2023 12:03:40 +0000 +Subject: sctp: fix potential deadlock on &net->sctp.addr_wq_lock + +From: Chengfeng Ye + +[ Upstream commit 6feb37b3b06e9049e20dcf7e23998f92c9c5be9a ] + +As &net->sctp.addr_wq_lock is also acquired by the timer +sctp_addr_wq_timeout_handler() in protocal.c, the same lock acquisition +at sctp_auto_asconf_init() seems should disable irq since it is called +from sctp_accept() under process context. + +Possible deadlock scenario: +sctp_accept() + -> sctp_sock_migrate() + -> sctp_auto_asconf_init() + -> spin_lock(&net->sctp.addr_wq_lock) + + -> sctp_addr_wq_timeout_handler() + -> spin_lock_bh(&net->sctp.addr_wq_lock); (deadlock here) + +This flaw was found using an experimental static analysis tool we are +developing for irq-related deadlock. + +The tentative patch fix the potential deadlock by spin_lock_bh(). + +Signed-off-by: Chengfeng Ye +Fixes: 34e5b0118685 ("sctp: delay auto_asconf init until binding the first addr") +Acked-by: Xin Long +Link: https://lore.kernel.org/r/20230627120340.19432-1-dg573847474@gmail.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/sctp/socket.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/sctp/socket.c b/net/sctp/socket.c +index e1011311bc877..c806d272107ac 100644 +--- a/net/sctp/socket.c ++++ b/net/sctp/socket.c +@@ -363,9 +363,9 @@ static void sctp_auto_asconf_init(struct sctp_sock *sp) + struct net *net = sock_net(&sp->inet.sk); + + if (net->sctp.default_auto_asconf) { +- spin_lock(&net->sctp.addr_wq_lock); ++ spin_lock_bh(&net->sctp.addr_wq_lock); + list_add_tail(&sp->auto_asconf_list, &net->sctp.auto_asconf_splist); +- spin_unlock(&net->sctp.addr_wq_lock); ++ spin_unlock_bh(&net->sctp.addr_wq_lock); + sp->do_auto_asconf = 1; + } + } +-- +2.39.2 + diff --git a/queue-6.1/serial-8250-lock-port-for-stop_rx-in-omap8250_irq.patch b/queue-6.1/serial-8250-lock-port-for-stop_rx-in-omap8250_irq.patch new file mode 100644 index 00000000000..19831c7cec5 --- /dev/null +++ b/queue-6.1/serial-8250-lock-port-for-stop_rx-in-omap8250_irq.patch @@ -0,0 +1,39 @@ +From 0930980fb3f5d15a403a3827e4eebb669fc577ca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 May 2023 11:37:54 +0206 +Subject: serial: 8250: lock port for stop_rx() in omap8250_irq() + +From: John Ogness + +[ Upstream commit ca73a892c5bec4b08a2fa22b3015e98ed905abb7 ] + +The uarts_ops stop_rx() callback expects that the port->lock is +taken and interrupts are disabled. + +Fixes: 1fe0e1fa3209 ("serial: 8250_omap: Handle optional overrun-throttle-ms property") +Signed-off-by: John Ogness +Reviewed-by: Tony Lindgren +Link: https://lore.kernel.org/r/20230525093159.223817-4-john.ogness@linutronix.de +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/8250/8250_omap.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c +index 79bdf933c67e6..7ecd2d379292b 100644 +--- a/drivers/tty/serial/8250/8250_omap.c ++++ b/drivers/tty/serial/8250/8250_omap.c +@@ -641,7 +641,9 @@ static irqreturn_t omap8250_irq(int irq, void *dev_id) + + up->ier = port->serial_in(port, UART_IER); + if (up->ier & (UART_IER_RLSI | UART_IER_RDI)) { ++ spin_lock(&port->lock); + port->ops->stop_rx(port); ++ spin_unlock(&port->lock); + } else { + /* Keep restarting the timer until + * the input overrun subsides. +-- +2.39.2 + diff --git a/queue-6.1/serial-8250-lock-port-for-uart_ier-access-in-omap825.patch b/queue-6.1/serial-8250-lock-port-for-uart_ier-access-in-omap825.patch new file mode 100644 index 00000000000..b3c340a1ce3 --- /dev/null +++ b/queue-6.1/serial-8250-lock-port-for-uart_ier-access-in-omap825.patch @@ -0,0 +1,57 @@ +From b5cc2057c8b0cdb329c484aa336292bac67b9a5a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 May 2023 11:37:58 +0206 +Subject: serial: 8250: lock port for UART_IER access in omap8250_irq() + +From: John Ogness + +[ Upstream commit 25614735a647693c1260f253dc3ab32127697806 ] + +omap8250_irq() accesses UART_IER. This register is modified twice +by each console write (serial8250_console_write()) under the port +lock. omap8250_irq() must also take the port lock to guanentee +synchronized access to UART_IER. + +Since the port lock is already being taken for the stop_rx() callback +and since it is safe to call cancel_delayed_work() while holding the +port lock, simply extend the port lock region to include UART_IER +access. + +Fixes: 1fe0e1fa3209 ("serial: 8250_omap: Handle optional overrun-throttle-ms property") +Signed-off-by: John Ogness +Reviewed-by: Tony Lindgren +Link: https://lore.kernel.org/r/20230525093159.223817-8-john.ogness@linutronix.de +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/8250/8250_omap.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c +index 7ecd2d379292b..17a230281ebe0 100644 +--- a/drivers/tty/serial/8250/8250_omap.c ++++ b/drivers/tty/serial/8250/8250_omap.c +@@ -639,17 +639,18 @@ static irqreturn_t omap8250_irq(int irq, void *dev_id) + if ((lsr & UART_LSR_OE) && up->overrun_backoff_time_ms > 0) { + unsigned long delay; + ++ /* Synchronize UART_IER access against the console. */ ++ spin_lock(&port->lock); + up->ier = port->serial_in(port, UART_IER); + if (up->ier & (UART_IER_RLSI | UART_IER_RDI)) { +- spin_lock(&port->lock); + port->ops->stop_rx(port); +- spin_unlock(&port->lock); + } else { + /* Keep restarting the timer until + * the input overrun subsides. + */ + cancel_delayed_work(&up->overrun_backoff); + } ++ spin_unlock(&port->lock); + + delay = msecs_to_jiffies(up->overrun_backoff_time_ms); + schedule_delayed_work(&up->overrun_backoff, delay); +-- +2.39.2 + diff --git a/queue-6.1/serial-8250-omap-fix-freeing-of-resources-on-failed-.patch b/queue-6.1/serial-8250-omap-fix-freeing-of-resources-on-failed-.patch new file mode 100644 index 00000000000..219367f25b1 --- /dev/null +++ b/queue-6.1/serial-8250-omap-fix-freeing-of-resources-on-failed-.patch @@ -0,0 +1,42 @@ +From 65fdc46af165a5c8603bc1968aeb45a5b8a167c0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 May 2023 11:20:11 +0300 +Subject: serial: 8250: omap: Fix freeing of resources on failed register +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Tony Lindgren + +[ Upstream commit b9ab22c2bc8652324a803b3e2be69838920b4025 ] + +If serial8250_register_8250_port() fails, the SoC can hang as the +deferred PMQoS work will still run as is not flushed and removed. + +Fixes: 61929cf0169d ("tty: serial: Add 8250-core based omap driver") +Signed-off-by: Tony Lindgren +Reviewed-by: Ilpo Järvinen +Link: https://lore.kernel.org/r/20230508082014.23083-2-tony@atomide.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/8250/8250_omap.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c +index 3f33014022f0e..79bdf933c67e6 100644 +--- a/drivers/tty/serial/8250/8250_omap.c ++++ b/drivers/tty/serial/8250/8250_omap.c +@@ -1453,7 +1453,9 @@ static int omap8250_probe(struct platform_device *pdev) + err: + pm_runtime_dont_use_autosuspend(&pdev->dev); + pm_runtime_put_sync(&pdev->dev); ++ flush_work(&priv->qos_work); + pm_runtime_disable(&pdev->dev); ++ cpu_latency_qos_remove_request(&priv->pm_qos_request); + return ret; + } + +-- +2.39.2 + diff --git a/queue-6.1/serial-8250_omap-use-force_suspend-and-resume-for-sy.patch b/queue-6.1/serial-8250_omap-use-force_suspend-and-resume-for-sy.patch new file mode 100644 index 00000000000..9651756558e --- /dev/null +++ b/queue-6.1/serial-8250_omap-use-force_suspend-and-resume-for-sy.patch @@ -0,0 +1,78 @@ +From 8cf68843192c4a6315bcc61df6ec7f225b36bca3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Jun 2023 07:59:19 +0300 +Subject: serial: 8250_omap: Use force_suspend and resume for system suspend + +From: Tony Lindgren + +[ Upstream commit 20a41a62618df85f3a2981008edec5cadd785e0a ] + +We should not rely on autosuspend timeout for system suspend. Instead, +let's use force_suspend and force_resume functions. Otherwise the serial +port controller device may not be idled on suspend. + +As we are doing a register write on suspend to configure the serial port, +we still need to runtime PM resume the port on suspend. + +While at it, let's switch to pm_runtime_resume_and_get() and check for +errors returned. And let's add the missing line break before return to the +suspend function while at it. + +Fixes: 09d8b2bdbc5c ("serial: 8250: omap: Provide ability to enable/disable UART as wakeup source") +Signed-off-by: Tony Lindgren +Tested-by: Dhruva Gole +Message-ID: <20230614045922.4798-1-tony@atomide.com> +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/8250/8250_omap.c | 20 +++++++++++++++----- + 1 file changed, 15 insertions(+), 5 deletions(-) + +diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c +index 17a230281ebe0..adc85e250822c 100644 +--- a/drivers/tty/serial/8250/8250_omap.c ++++ b/drivers/tty/serial/8250/8250_omap.c +@@ -1505,25 +1505,35 @@ static int omap8250_suspend(struct device *dev) + { + struct omap8250_priv *priv = dev_get_drvdata(dev); + struct uart_8250_port *up = serial8250_get_port(priv->line); ++ int err; + + serial8250_suspend_port(priv->line); + +- pm_runtime_get_sync(dev); ++ err = pm_runtime_resume_and_get(dev); ++ if (err) ++ return err; + if (!device_may_wakeup(dev)) + priv->wer = 0; + serial_out(up, UART_OMAP_WER, priv->wer); +- pm_runtime_mark_last_busy(dev); +- pm_runtime_put_autosuspend(dev); +- ++ err = pm_runtime_force_suspend(dev); + flush_work(&priv->qos_work); +- return 0; ++ ++ return err; + } + + static int omap8250_resume(struct device *dev) + { + struct omap8250_priv *priv = dev_get_drvdata(dev); ++ int err; + ++ err = pm_runtime_force_resume(dev); ++ if (err) ++ return err; + serial8250_resume_port(priv->line); ++ /* Paired with pm_runtime_resume_and_get() in omap8250_suspend() */ ++ pm_runtime_mark_last_busy(dev); ++ pm_runtime_put_autosuspend(dev); ++ + return 0; + } + #else +-- +2.39.2 + diff --git a/queue-6.1/serial-core-lock-port-for-start_rx-in-uart_resume_po.patch b/queue-6.1/serial-core-lock-port-for-start_rx-in-uart_resume_po.patch new file mode 100644 index 00000000000..a5c4a73fa97 --- /dev/null +++ b/queue-6.1/serial-core-lock-port-for-start_rx-in-uart_resume_po.patch @@ -0,0 +1,44 @@ +From d6396ad2a147888585ac06f4f3233c7b50486755 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 May 2023 11:37:55 +0206 +Subject: serial: core: lock port for start_rx() in uart_resume_port() + +From: John Ogness + +[ Upstream commit 51e45fba14bf08b66bca764a083c7f2e2ff62f01 ] + +The only user of the start_rx() callback (qcom_geni) directly calls +its own stop_rx() callback. Since stop_rx() requires that the +port->lock is taken and interrupts are disabled, the start_rx() +callback has the same requirement. + +Fixes: cfab87c2c271 ("serial: core: Introduce callback for start_rx and do stop_rx in suspend only if this callback implementation is present.") +Signed-off-by: John Ogness +Reviewed-by: Douglas Anderson +Link: https://lore.kernel.org/r/20230525093159.223817-5-john.ogness@linutronix.de +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/serial_core.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c +index b0a4677172062..2cc5c68c8689f 100644 +--- a/drivers/tty/serial/serial_core.c ++++ b/drivers/tty/serial/serial_core.c +@@ -2431,8 +2431,11 @@ int uart_resume_port(struct uart_driver *drv, struct uart_port *uport) + if (console_suspend_enabled) + uart_change_pm(state, UART_PM_STATE_ON); + uport->ops->set_termios(uport, &termios, NULL); +- if (!console_suspend_enabled && uport->ops->start_rx) ++ if (!console_suspend_enabled && uport->ops->start_rx) { ++ spin_lock_irq(&uport->lock); + uport->ops->start_rx(uport); ++ spin_unlock_irq(&uport->lock); ++ } + if (console_suspend_enabled) + console_start(uport->cons); + } +-- +2.39.2 + diff --git a/queue-6.1/serial-core-lock-port-for-stop_rx-in-uart_suspend_po.patch b/queue-6.1/serial-core-lock-port-for-stop_rx-in-uart_suspend_po.patch new file mode 100644 index 00000000000..991344627fd --- /dev/null +++ b/queue-6.1/serial-core-lock-port-for-stop_rx-in-uart_suspend_po.patch @@ -0,0 +1,42 @@ +From bf0bb91ad503785e9740396636a6d8b4cfc7f25b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 May 2023 11:37:53 +0206 +Subject: serial: core: lock port for stop_rx() in uart_suspend_port() + +From: John Ogness + +[ Upstream commit abcb0cf1f5b2d99b1d117a4dbce334120e358d6d ] + +The uarts_ops stop_rx() callback expects that the port->lock is +taken and interrupts are disabled. + +Fixes: c9d2325cdb92 ("serial: core: Do stop_rx in suspend path for console if console_suspend is disabled") +Signed-off-by: John Ogness +Reviewed-by: Douglas Anderson +Link: https://lore.kernel.org/r/20230525093159.223817-3-john.ogness@linutronix.de +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/serial_core.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c +index 23a7ab0de4445..b0a4677172062 100644 +--- a/drivers/tty/serial/serial_core.c ++++ b/drivers/tty/serial/serial_core.c +@@ -2334,8 +2334,11 @@ int uart_suspend_port(struct uart_driver *drv, struct uart_port *uport) + * able to Re-start_rx later. + */ + if (!console_suspend_enabled && uart_console(uport)) { +- if (uport->ops->start_rx) ++ if (uport->ops->start_rx) { ++ spin_lock_irq(&uport->lock); + uport->ops->stop_rx(uport); ++ spin_unlock_irq(&uport->lock); ++ } + goto unlock; + } + +-- +2.39.2 + diff --git a/queue-6.1/series b/queue-6.1/series index faecdfd3e37..51ae3aefb74 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -390,3 +390,145 @@ block-change-all-__u32-annotations-to-__be32-in-affs_hardblocks.h.patch block-increment-diskseq-on-all-media-change-events.patch btrfs-fix-race-when-deleting-free-space-root-from-the-dirty-cow-roots-list.patch sunrpc-fix-uaf-in-svc_tcp_listen_data_ready.patch +w1-w1_therm-fix-locking-behavior-in-convert_t.patch +w1-fix-loop-in-w1_fini.patch +dt-bindings-power-reset-qcom-pon-only-allow-reboot-m.patch +f2fs-do-not-allow-to-defragment-files-have-fi_compre.patch +sh-j2-use-ioremap-to-translate-device-tree-address-i.patch +usb-dwc2-platform-improve-error-reporting-for-proble.patch +usb-dwc2-fix-some-error-handling-paths.patch +serial-8250-omap-fix-freeing-of-resources-on-failed-.patch +clk-qcom-mmcc-msm8974-use-array_size-instead-of-spec.patch +clk-qcom-mmcc-msm8974-move-clock-parent-tables-down.patch +clk-qcom-mmcc-msm8974-use-parent_hws-_data-instead-o.patch +clk-qcom-mmcc-msm8974-remove-oxili_ocmemgx_clk.patch +clk-qcom-camcc-sc7180-add-parent-dependency-to-all-c.patch +clk-qcom-gcc-ipq6018-use-floor-ops-for-sdcc-clocks.patch +clk-qcom-gcc-qcm2290-mark-rcgs-shared-where-applicab.patch +media-usb-check-az6007_read-return-value.patch +media-amphion-drop-repeated-codec-data-for-vc1l-form.patch +media-amphion-drop-repeated-codec-data-for-vc1g-form.patch +media-amphion-initiate-a-drain-of-the-capture-queue-.patch +media-videodev2.h-fix-struct-v4l2_input-tuner-index-.patch +media-usb-siano-fix-warning-due-to-null-work_func_t-.patch +media-i2c-correct-format-propagation-for-st-mipid02.patch +media-hi846-fix-usage-of-pm_runtime_get_if_in_use.patch +media-mediatek-vcodec-using-decoder-status-instead-o.patch +clk-qcom-reset-support-resetting-multiple-bits.patch +clk-qcom-ipq6018-fix-networking-resets.patch +clk-qcom-dispcc-qcm2290-fix-bi_tcxo_ao-handling.patch +clk-qcom-dispcc-qcm2290-fix-gpll0_out_div-handling.patch +clk-qcom-mmcc-msm8974-use-clk_rcg2_shared_ops-for-md.patch +staging-vchiq_arm-mark-vchiq_platform_init-static.patch +usb-dwc3-qcom-fix-potential-memory-leak.patch +usb-gadget-u_serial-add-null-pointer-check-in-gseria.patch +extcon-fix-kernel-doc-of-property-fields-to-avoid-wa.patch +extcon-fix-kernel-doc-of-property-capability-fields-.patch +usb-phy-phy-tahvo-fix-memory-leak-in-tahvo_usb_probe.patch +usb-hide-unused-usbfs_notify_suspend-resume-function.patch +usb-misc-eud-fix-eud-sysfs-path-use-qcom_eud.patch +serial-core-lock-port-for-stop_rx-in-uart_suspend_po.patch +serial-8250-lock-port-for-stop_rx-in-omap8250_irq.patch +serial-core-lock-port-for-start_rx-in-uart_resume_po.patch +serial-8250-lock-port-for-uart_ier-access-in-omap825.patch +kernfs-fix-missing-kernfs_idr_lock-to-remove-an-id-f.patch +lkdtm-replace-ll_rw_block-with-submit_bh.patch +i3c-master-svc-fix-cpu-schedule-in-spin-lock.patch +coresight-fix-loss-of-connection-info-when-a-module-.patch +mfd-rt5033-drop-rt5033-battery-sub-device.patch +media-venus-helpers-fix-align-of-non-power-of-two.patch +media-atomisp-gmin_platform-fix-out_len-in-gmin_get_.patch +sh-avoid-using-irq0-on-sh3-and-sh4.patch +gfs2-fix-duplicate-should_fault_in_pages-call.patch +f2fs-fix-potential-deadlock-due-to-unpaired-node_wri.patch +f2fs-fix-to-avoid-null-pointer-dereference-f2fs_writ.patch +kvm-s390-fix-kvm_s390_get_cmma_bits-for-gfns-in-mems.patch +usb-dwc3-qcom-release-the-correct-resources-in-dwc3_.patch +usb-dwc3-qcom-fix-an-error-handling-path-in-dwc3_qco.patch +usb-common-usb-conn-gpio-set-last-role-to-unknown-be.patch +usb-dwc3-meson-g12a-fix-an-error-handling-path-in-dw.patch +mfd-wcd934x-fix-an-error-handling-path-in-wcd934x_sl.patch +mfd-intel-lpss-add-missing-check-for-platform_get_re.patch +revert-usb-common-usb-conn-gpio-set-last-role-to-unk.patch +serial-8250_omap-use-force_suspend-and-resume-for-sy.patch +device-property-fix-documentation-for-fwnode_get_nex.patch +device-property-clarify-description-of-returned-valu.patch +drivers-fwnode-fix-fwnode_irq_get-_byname.patch +nvmem-sunplus-ocotp-release-otp-clk-before-return.patch +nvmem-rmem-use-nvmem_devid_auto.patch +bus-fsl-mc-don-t-assume-child-devices-are-all-fsl-mc.patch +mfd-stmfx-fix-error-path-in-stmfx_chip_init.patch +mfd-stmfx-nullify-stmfx-vdd-in-case-of-error.patch +kvm-s390-vsie-fix-the-length-of-apcb-bitmap.patch +kvm-s390-diag-fix-racy-access-of-physical-cpu-number.patch +cpufreq-mediatek-correct-voltages-for-mt7622-and-mt7.patch +misc-fastrpc-check-return-value-of-devm_kasprintf.patch +clk-qcom-mmcc-msm8974-fix-mdss_gdsc-power-flags.patch +hwtracing-hisi_ptt-fix-potential-sleep-in-atomic-con.patch +mfd-stmpe-only-disable-the-regulators-if-they-are-en.patch +phy-tegra-xusb-check-return-value-of-devm_kzalloc.patch +lib-bitmap-drop-optimization-of-bitmap_-from-to-_arr.patch +pwm-imx-tpm-force-real_period-to-be-zero-in-suspend.patch +pwm-sysfs-do-not-apply-state-to-already-disabled-pwm.patch +pwm-ab8500-fix-error-code-in-probe.patch +pwm-mtk_disp-fix-the-disable-flow-of-disp_pwm.patch +md-raid10-fix-the-condition-to-call-bio_end_io_acct.patch +blk-cgroup-optimize-blkcg_rstat_flush.patch +blk-cgroup-don-t-update-io-stat-for-root-cgroup.patch +blk-throttle-fix-io-statistics-for-cgroup-v1.patch +rtc-st-lpc-release-some-resources-in-st_rtc_probe-in.patch +drm-i915-psr-use-hw.adjusted-mode-when-calculating-i.patch +drm-i915-guc-slpc-apply-min-softlimit-correctly.patch +f2fs-check-return-value-of-freeze_super.patch +media-cec-i2c-ch7322-also-select-regmap.patch +sctp-fix-potential-deadlock-on-net-sctp.addr_wq_lock.patch +net-sched-act_ipt-add-sanity-checks-on-table-name-an.patch +net-sched-avoid-indirect-act-functions-on-retpoline-.patch +net-add-a-couple-of-helpers-for-iph-tot_len.patch +net-sched-act_ipt-add-sanity-checks-on-skb-before-ca.patch +net-sched-act_ipt-zero-skb-cb-before-calling-target.patch +spi-spi-geni-qcom-enable-spi_controller_must_tx-for-.patch +net-mscc-ocelot-don-t-report-that-rx-timestamping-is.patch +net-mscc-ocelot-don-t-keep-ptp-configuration-of-all-.patch +net-dsa-felix-don-t-drop-ptp-frames-with-tag_8021q-w.patch +net-dsa-sja1105-always-enable-the-incl_srcpt-option.patch +net-dsa-tag_sja1105-always-prefer-source-port-inform.patch +add-module_firmware-for-firmware_tg357766.patch +bluetooth-fix-invalid-bdaddr-quirk-for-non-persisten.patch +bluetooth-fix-use-bdaddr-property-quirk.patch +bluetooth-hci_bcm-do-not-mark-valid-bd_addr-as-inval.patch +bluetooth-iso-use-hci_sync-for-setting-cig-parameter.patch +bluetooth-mgmt-add-cis-feature-bits-to-controller-in.patch +bluetooth-mgmt-use-bit-macro-when-defining-bitfields.patch +bluetooth-mgmt-fix-marking-scan_rsp-as-not-connectab.patch +ibmvnic-do-not-reset-dql-stats-on-non_fatal-err.patch +net-dsa-vsc73xx-fix-mtu-configuration.patch +mlxsw-minimal-fix-potential-memory-leak-in-mlxsw_m_l.patch +spi-bcm-qspi-return-error-if-neither-hif_mspi-nor-ms.patch +drm-amdgpu-fix-number-of-fence-calculations.patch +drm-amd-don-t-try-to-enable-secure-display-ta-multip.patch +mailbox-ti-msgmgr-fill-non-message-tx-data-fields-wi.patch +f2fs-fix-error-path-handling-in-truncate_dnode.patch +octeontx2-af-fix-mapping-for-nix-block-from-cgx-conn.patch +octeontx2-af-add-validation-before-accessing-cgx-and.patch +ntfs-fix-panic-about-slab-out-of-bounds-caused-by-nt.patch +powerpc-allow-ppc_early_debug_cpm-only-when-serial_c.patch +powerpc-dts-turris1x.dts-fix-pcie-mem-size-for-pci2-.patch +net-bridge-keep-ports-without-iff_unicast_flt-in-br_.patch +net-dsa-tag_sja1105-fix-source-port-decoding-in-vlan.patch +net-fix-net_dev_start_xmit-trace-event-vs-skb_transp.patch +tcp-annotate-data-races-in-__tcp_oow_rate_limited.patch +bpf-btf-warn-but-return-no-error-for-null-btf-from-_.patch +xsk-honor-so_bindtodevice-on-bind.patch +net-sched-act_pedit-add-size-check-for-tca_pedit_par.patch +fanotify-disallow-mount-sb-marks-on-kernel-internal-.patch +riscv-move-memblock_allow_resize-after-linear-mappin.patch +pptp-fix-fib-lookup-calls.patch +net-dsa-tag_sja1105-fix-mac-da-patching-from-meta-fr.patch +net-dsa-sja1105-always-enable-the-send_meta-options.patch +octeontx-af-fix-hardware-timestamp-configuration.patch +afs-fix-accidental-truncation-when-storing-data.patch +s390-qeth-fix-vipa-deletion.patch +sh-dma-fix-dma-channel-offset-calculation.patch +apparmor-fix-missing-error-check-for-rhashtable_inse.patch +i2c-xiic-don-t-try-to-handle-more-interrupt-events-a.patch diff --git a/queue-6.1/sh-avoid-using-irq0-on-sh3-and-sh4.patch b/queue-6.1/sh-avoid-using-irq0-on-sh3-and-sh4.patch new file mode 100644 index 00000000000..4d6b68b0204 --- /dev/null +++ b/queue-6.1/sh-avoid-using-irq0-on-sh3-and-sh4.patch @@ -0,0 +1,123 @@ +From 942e6a9b8a7e10d690c9f0f52581b7e3f05e1722 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Jun 2023 23:22:17 +0300 +Subject: sh: Avoid using IRQ0 on SH3 and SH4 + +From: Sergey Shtylyov + +[ Upstream commit a8ac2961148e8c720dc760f2e06627cd5c55a154 ] + +IRQ0 is no longer returned by platform_get_irq() and its ilk -- they now +return -EINVAL instead. However, the kernel code supporting SH3/4-based +SoCs still maps the IRQ #s starting at 0 -- modify that code to start the +IRQ #s from 16 instead. + +The patch should mostly affect the AP-SH4A-3A/AP-SH4AD-0A boards as they +indeed are using IRQ0 for the SMSC911x compatible Ethernet chip. + +Fixes: ce753ad1549c ("platform: finally disallow IRQ0 in platform_get_irq() and its ilk") +Signed-off-by: Sergey Shtylyov +Reviewed-by: Geert Uytterhoeven +Tested-by: Geert Uytterhoeven +Reviewed-by: John Paul Adrian Glaubitz +Tested-by: John Paul Adrian Glaubitz +Link: https://lore.kernel.org/r/71105dbf-cdb0-72e1-f9eb-eeda8e321696@omp.ru +Signed-off-by: John Paul Adrian Glaubitz +Signed-off-by: Sasha Levin +--- + arch/sh/include/mach-common/mach/highlander.h | 2 +- + arch/sh/include/mach-common/mach/r2d.h | 2 +- + arch/sh/include/mach-dreamcast/mach/sysasic.h | 2 +- + arch/sh/include/mach-se/mach/se7724.h | 2 +- + arch/sh/kernel/cpu/sh3/entry.S | 4 ++-- + include/linux/sh_intc.h | 6 +++--- + 6 files changed, 9 insertions(+), 9 deletions(-) + +diff --git a/arch/sh/include/mach-common/mach/highlander.h b/arch/sh/include/mach-common/mach/highlander.h +index fb44c299d0337..b12c795584225 100644 +--- a/arch/sh/include/mach-common/mach/highlander.h ++++ b/arch/sh/include/mach-common/mach/highlander.h +@@ -176,7 +176,7 @@ + #define IVDR_CK_ON 4 /* iVDR Clock ON */ + #endif + +-#define HL_FPGA_IRQ_BASE 200 ++#define HL_FPGA_IRQ_BASE (200 + 16) + #define HL_NR_IRL 15 + + #define IRQ_AX88796 (HL_FPGA_IRQ_BASE + 0) +diff --git a/arch/sh/include/mach-common/mach/r2d.h b/arch/sh/include/mach-common/mach/r2d.h +index 0d7e483c7d3f5..69bc1907c5637 100644 +--- a/arch/sh/include/mach-common/mach/r2d.h ++++ b/arch/sh/include/mach-common/mach/r2d.h +@@ -47,7 +47,7 @@ + + #define IRLCNTR1 (PA_BCR + 0) /* Interrupt Control Register1 */ + +-#define R2D_FPGA_IRQ_BASE 100 ++#define R2D_FPGA_IRQ_BASE (100 + 16) + + #define IRQ_VOYAGER (R2D_FPGA_IRQ_BASE + 0) + #define IRQ_EXT (R2D_FPGA_IRQ_BASE + 1) +diff --git a/arch/sh/include/mach-dreamcast/mach/sysasic.h b/arch/sh/include/mach-dreamcast/mach/sysasic.h +index ed69ce7f20301..3b27be9a527ea 100644 +--- a/arch/sh/include/mach-dreamcast/mach/sysasic.h ++++ b/arch/sh/include/mach-dreamcast/mach/sysasic.h +@@ -22,7 +22,7 @@ + takes. + */ + +-#define HW_EVENT_IRQ_BASE 48 ++#define HW_EVENT_IRQ_BASE (48 + 16) + + /* IRQ 13 */ + #define HW_EVENT_VSYNC (HW_EVENT_IRQ_BASE + 5) /* VSync */ +diff --git a/arch/sh/include/mach-se/mach/se7724.h b/arch/sh/include/mach-se/mach/se7724.h +index 1fe28820dfa95..ea6c46633b337 100644 +--- a/arch/sh/include/mach-se/mach/se7724.h ++++ b/arch/sh/include/mach-se/mach/se7724.h +@@ -37,7 +37,7 @@ + #define IRQ2_IRQ evt2irq(0x640) + + /* Bits in IRQ012 registers */ +-#define SE7724_FPGA_IRQ_BASE 220 ++#define SE7724_FPGA_IRQ_BASE (220 + 16) + + /* IRQ0 */ + #define IRQ0_BASE SE7724_FPGA_IRQ_BASE +diff --git a/arch/sh/kernel/cpu/sh3/entry.S b/arch/sh/kernel/cpu/sh3/entry.S +index e48b3dd996f58..b1f5b3c58a018 100644 +--- a/arch/sh/kernel/cpu/sh3/entry.S ++++ b/arch/sh/kernel/cpu/sh3/entry.S +@@ -470,9 +470,9 @@ ENTRY(handle_interrupt) + mov r4, r0 ! save vector->jmp table offset for later + + shlr2 r4 ! vector to IRQ# conversion +- add #-0x10, r4 + +- cmp/pz r4 ! is it a valid IRQ? ++ mov #0x10, r5 ++ cmp/hs r5, r4 ! is it a valid IRQ? + bt 10f + + /* +diff --git a/include/linux/sh_intc.h b/include/linux/sh_intc.h +index 37ad81058d6ae..27ae79191bdc3 100644 +--- a/include/linux/sh_intc.h ++++ b/include/linux/sh_intc.h +@@ -13,9 +13,9 @@ + /* + * Convert back and forth between INTEVT and IRQ values. + */ +-#ifdef CONFIG_CPU_HAS_INTEVT +-#define evt2irq(evt) (((evt) >> 5) - 16) +-#define irq2evt(irq) (((irq) + 16) << 5) ++#ifdef CONFIG_CPU_HAS_INTEVT /* Avoid IRQ0 (invalid for platform devices) */ ++#define evt2irq(evt) ((evt) >> 5) ++#define irq2evt(irq) ((irq) << 5) + #else + #define evt2irq(evt) (evt) + #define irq2evt(irq) (irq) +-- +2.39.2 + diff --git a/queue-6.1/sh-dma-fix-dma-channel-offset-calculation.patch b/queue-6.1/sh-dma-fix-dma-channel-offset-calculation.patch new file mode 100644 index 00000000000..eeea8dac746 --- /dev/null +++ b/queue-6.1/sh-dma-fix-dma-channel-offset-calculation.patch @@ -0,0 +1,103 @@ +From d91d2339a31ce27a04eee7949a120c269d62ebb2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 27 May 2023 18:44:50 +0200 +Subject: sh: dma: Fix DMA channel offset calculation + +From: Artur Rojek + +[ Upstream commit e82e47584847129a20b8c9f4a1dcde09374fb0e0 ] + +Various SoCs of the SH3, SH4 and SH4A family, which use this driver, +feature a differing number of DMA channels, which can be distributed +between up to two DMAC modules. The existing implementation fails to +correctly accommodate for all those variations, resulting in wrong +channel offset calculations and leading to kernel panics. + +Rewrite dma_base_addr() in order to properly calculate channel offsets +in a DMAC module. Fix dmaor_read_reg() and dmaor_write_reg(), so that +the correct DMAC module base is selected for the DMAOR register. + +Fixes: 7f47c7189b3e8f19 ("sh: dma: More legacy cpu dma chainsawing.") +Signed-off-by: Artur Rojek +Reviewed-by: Geert Uytterhoeven +Reviewed-by: John Paul Adrian Glaubitz +Link: https://lore.kernel.org/r/20230527164452.64797-2-contact@artur-rojek.eu +Signed-off-by: John Paul Adrian Glaubitz +Signed-off-by: Sasha Levin +--- + arch/sh/drivers/dma/dma-sh.c | 37 +++++++++++++++++++++++------------- + 1 file changed, 24 insertions(+), 13 deletions(-) + +diff --git a/arch/sh/drivers/dma/dma-sh.c b/arch/sh/drivers/dma/dma-sh.c +index 96c626c2cd0a4..306fba1564e5e 100644 +--- a/arch/sh/drivers/dma/dma-sh.c ++++ b/arch/sh/drivers/dma/dma-sh.c +@@ -18,6 +18,18 @@ + #include + #include + ++/* ++ * Some of the SoCs feature two DMAC modules. In such a case, the channels are ++ * distributed equally among them. ++ */ ++#ifdef SH_DMAC_BASE1 ++#define SH_DMAC_NR_MD_CH (CONFIG_NR_ONCHIP_DMA_CHANNELS / 2) ++#else ++#define SH_DMAC_NR_MD_CH CONFIG_NR_ONCHIP_DMA_CHANNELS ++#endif ++ ++#define SH_DMAC_CH_SZ 0x10 ++ + /* + * Define the default configuration for dual address memory-memory transfer. + * The 0x400 value represents auto-request, external->external. +@@ -29,7 +41,7 @@ static unsigned long dma_find_base(unsigned int chan) + unsigned long base = SH_DMAC_BASE0; + + #ifdef SH_DMAC_BASE1 +- if (chan >= 6) ++ if (chan >= SH_DMAC_NR_MD_CH) + base = SH_DMAC_BASE1; + #endif + +@@ -40,13 +52,13 @@ static unsigned long dma_base_addr(unsigned int chan) + { + unsigned long base = dma_find_base(chan); + +- /* Normalize offset calculation */ +- if (chan >= 9) +- chan -= 6; +- if (chan >= 4) +- base += 0x10; ++ chan = (chan % SH_DMAC_NR_MD_CH) * SH_DMAC_CH_SZ; ++ ++ /* DMAOR is placed inside the channel register space. Step over it. */ ++ if (chan >= DMAOR) ++ base += SH_DMAC_CH_SZ; + +- return base + (chan * 0x10); ++ return base + chan; + } + + #ifdef CONFIG_SH_DMA_IRQ_MULTI +@@ -250,12 +262,11 @@ static int sh_dmac_get_dma_residue(struct dma_channel *chan) + #define NR_DMAOR 1 + #endif + +-/* +- * DMAOR bases are broken out amongst channel groups. DMAOR0 manages +- * channels 0 - 5, DMAOR1 6 - 11 (optional). +- */ +-#define dmaor_read_reg(n) __raw_readw(dma_find_base((n)*6)) +-#define dmaor_write_reg(n, data) __raw_writew(data, dma_find_base(n)*6) ++#define dmaor_read_reg(n) __raw_readw(dma_find_base((n) * \ ++ SH_DMAC_NR_MD_CH) + DMAOR) ++#define dmaor_write_reg(n, data) __raw_writew(data, \ ++ dma_find_base((n) * \ ++ SH_DMAC_NR_MD_CH) + DMAOR) + + static inline int dmaor_reset(int no) + { +-- +2.39.2 + diff --git a/queue-6.1/sh-j2-use-ioremap-to-translate-device-tree-address-i.patch b/queue-6.1/sh-j2-use-ioremap-to-translate-device-tree-address-i.patch new file mode 100644 index 00000000000..c5c17cbf3e7 --- /dev/null +++ b/queue-6.1/sh-j2-use-ioremap-to-translate-device-tree-address-i.patch @@ -0,0 +1,44 @@ +From 082b97bba219dbc47b04cd000b457814318f117d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 May 2023 14:57:41 +0200 +Subject: sh: j2: Use ioremap() to translate device tree address into kernel + memory + +From: John Paul Adrian Glaubitz + +[ Upstream commit bc9d1f0cecd2407cfb2364a7d4be2f52d1d46a9d ] + +Addresses the following warning when building j2_defconfig: + +arch/sh/kernel/cpu/sh2/probe.c: In function 'scan_cache': +arch/sh/kernel/cpu/sh2/probe.c:24:16: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast] + 24 | j2_ccr_base = (u32 __iomem *)of_flat_dt_translate_address(node); + | + +Fixes: 5a846abad07f ("sh: add support for J-Core J2 processor") +Reviewed-by: Geert Uytterhoeven +Tested-by: Rob Landley +Signed-off-by: John Paul Adrian Glaubitz +Link: https://lore.kernel.org/r/20230503125746.331835-1-glaubitz@physik.fu-berlin.de +Signed-off-by: John Paul Adrian Glaubitz +Signed-off-by: Sasha Levin +--- + arch/sh/kernel/cpu/sh2/probe.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/sh/kernel/cpu/sh2/probe.c b/arch/sh/kernel/cpu/sh2/probe.c +index d342ea08843f6..70a07f4f2142f 100644 +--- a/arch/sh/kernel/cpu/sh2/probe.c ++++ b/arch/sh/kernel/cpu/sh2/probe.c +@@ -21,7 +21,7 @@ static int __init scan_cache(unsigned long node, const char *uname, + if (!of_flat_dt_is_compatible(node, "jcore,cache")) + return 0; + +- j2_ccr_base = (u32 __iomem *)of_flat_dt_translate_address(node); ++ j2_ccr_base = ioremap(of_flat_dt_translate_address(node), 4); + + return 1; + } +-- +2.39.2 + diff --git a/queue-6.1/spi-bcm-qspi-return-error-if-neither-hif_mspi-nor-ms.patch b/queue-6.1/spi-bcm-qspi-return-error-if-neither-hif_mspi-nor-ms.patch new file mode 100644 index 00000000000..cd99626db01 --- /dev/null +++ b/queue-6.1/spi-bcm-qspi-return-error-if-neither-hif_mspi-nor-ms.patch @@ -0,0 +1,58 @@ +From cddcf5a54c8646d829b0b8b0c5b8d1df4aa7c9d1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Jun 2023 15:43:05 +0200 +Subject: spi: bcm-qspi: return error if neither hif_mspi nor mspi is available + +From: Jonas Gorski + +[ Upstream commit 7c1f23ad34fcdace50275a6aa1e1969b41c6233f ] + +If neither a "hif_mspi" nor "mspi" resource is present, the driver will +just early exit in probe but still return success. Apart from not doing +anything meaningful, this would then also lead to a null pointer access +on removal, as platform_get_drvdata() would return NULL, which it would +then try to dereference when trying to unregister the spi master. + +Fix this by unconditionally calling devm_ioremap_resource(), as it can +handle a NULL res and will then return a viable ERR_PTR() if we get one. + +The "return 0;" was previously a "goto qspi_resource_err;" where then +ret was returned, but since ret was still initialized to 0 at this place +this was a valid conversion in 63c5395bb7a9 ("spi: bcm-qspi: Fix +use-after-free on unbind"). The issue was not introduced by this commit, +only made more obvious. + +Fixes: fa236a7ef240 ("spi: bcm-qspi: Add Broadcom MSPI driver") +Signed-off-by: Jonas Gorski +Reviewed-by: Kamal Dasu +Link: https://lore.kernel.org/r/20230629134306.95823-1-jonas.gorski@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-bcm-qspi.c | 10 +++------- + 1 file changed, 3 insertions(+), 7 deletions(-) + +diff --git a/drivers/spi/spi-bcm-qspi.c b/drivers/spi/spi-bcm-qspi.c +index cad2d55dcd3d2..137e7315a3cfd 100644 +--- a/drivers/spi/spi-bcm-qspi.c ++++ b/drivers/spi/spi-bcm-qspi.c +@@ -1543,13 +1543,9 @@ int bcm_qspi_probe(struct platform_device *pdev, + res = platform_get_resource_byname(pdev, IORESOURCE_MEM, + "mspi"); + +- if (res) { +- qspi->base[MSPI] = devm_ioremap_resource(dev, res); +- if (IS_ERR(qspi->base[MSPI])) +- return PTR_ERR(qspi->base[MSPI]); +- } else { +- return 0; +- } ++ qspi->base[MSPI] = devm_ioremap_resource(dev, res); ++ if (IS_ERR(qspi->base[MSPI])) ++ return PTR_ERR(qspi->base[MSPI]); + + res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "bspi"); + if (res) { +-- +2.39.2 + diff --git a/queue-6.1/spi-spi-geni-qcom-enable-spi_controller_must_tx-for-.patch b/queue-6.1/spi-spi-geni-qcom-enable-spi_controller_must_tx-for-.patch new file mode 100644 index 00000000000..345dcce172b --- /dev/null +++ b/queue-6.1/spi-spi-geni-qcom-enable-spi_controller_must_tx-for-.patch @@ -0,0 +1,42 @@ +From a34e8b4af656c1ef0f446df8f2022ee4607b0f17 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Jun 2023 12:58:47 +0300 +Subject: spi: spi-geni-qcom: enable SPI_CONTROLLER_MUST_TX for GPI DMA mode + +From: Dmitry Baryshkov + +[ Upstream commit d10005837be83906bbd2078c3b4f9dfcbd6c95b6 ] + +The GPI DMA mode requires for TX DMA to be prepared. Force SPI core to +provide TX buffer even if the caller didn't provide one by setting the +SPI_CONTROLLER_MUST_TX flag. + +Fixes: b59c122484ec ("spi: spi-geni-qcom: Add support for GPI dma") +Signed-off-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20230629095847.3648597-1-dmitry.baryshkov@linaro.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-geni-qcom.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/spi/spi-geni-qcom.c b/drivers/spi/spi-geni-qcom.c +index 689b94fc5570a..7b76dcd11e2bb 100644 +--- a/drivers/spi/spi-geni-qcom.c ++++ b/drivers/spi/spi-geni-qcom.c +@@ -979,6 +979,12 @@ static int spi_geni_probe(struct platform_device *pdev) + if (mas->cur_xfer_mode == GENI_SE_FIFO) + spi->set_cs = spi_geni_set_cs; + ++ /* ++ * TX is required per GSI spec, see setup_gsi_xfer(). ++ */ ++ if (mas->cur_xfer_mode == GENI_GPI_DMA) ++ spi->flags = SPI_CONTROLLER_MUST_TX; ++ + ret = request_irq(mas->irq, geni_spi_isr, 0, dev_name(dev), spi); + if (ret) + goto spi_geni_release_dma; +-- +2.39.2 + diff --git a/queue-6.1/staging-vchiq_arm-mark-vchiq_platform_init-static.patch b/queue-6.1/staging-vchiq_arm-mark-vchiq_platform_init-static.patch new file mode 100644 index 00000000000..8035eae5480 --- /dev/null +++ b/queue-6.1/staging-vchiq_arm-mark-vchiq_platform_init-static.patch @@ -0,0 +1,72 @@ +From 25fd438a0099692a9797a6c0b3d11db5c6a0931a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 May 2023 22:25:55 +0200 +Subject: staging: vchiq_arm: mark vchiq_platform_init() static + +From: Arnd Bergmann + +[ Upstream commit e152c58d7a48194d6b530d8e004d650fd01568b6 ] + +This function has no callers from other files, and the declaration +was removed a while ago, causing a W=1 warning: + +drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:465:5: error: no previous prototype for 'vchiq_platform_init' + +Marking it static solves this problem but introduces a new warning +since gcc determines that 'g_fragments_base' is never initialized +in some kernel configurations: + +In file included from include/linux/string.h:254, + from include/linux/bitmap.h:11, + from include/linux/cpumask.h:12, + from include/linux/mm_types_task.h:14, + from include/linux/mm_types.h:5, + from include/linux/buildid.h:5, + from include/linux/module.h:14, + from drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:8: +In function 'memcpy_to_page', + inlined from 'free_pagelist' at drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:433:4: +include/linux/fortify-string.h:57:33: error: argument 2 null where non-null expected [-Werror=nonnull] +include/linux/highmem.h:427:9: note: in expansion of macro 'memcpy' + 427 | memcpy(to + offset, from, len); + | ^~~~~~ + +Add a NULL pointer check for this in addition to the static annotation +to avoid both. + +Fixes: 89cc4218f640 ("staging: vchiq_arm: drop unnecessary declarations") +Signed-off-by: Arnd Bergmann +Reviewed-by: Florian Fainelli +Reviewed-by: Umang Jain +Link: https://lore.kernel.org/r/20230516202603.560554-1-arnd@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c +index dc33490ba7fbb..705c5e283c27b 100644 +--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c ++++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c +@@ -415,7 +415,7 @@ free_pagelist(struct vchiq_instance *instance, struct vchiq_pagelist_info *pagel + pagelistinfo->scatterlist_mapped = 0; + + /* Deal with any partial cache lines (fragments) */ +- if (pagelist->type >= PAGELIST_READ_WITH_FRAGMENTS) { ++ if (pagelist->type >= PAGELIST_READ_WITH_FRAGMENTS && g_fragments_base) { + char *fragments = g_fragments_base + + (pagelist->type - PAGELIST_READ_WITH_FRAGMENTS) * + g_fragments_size; +@@ -462,7 +462,7 @@ free_pagelist(struct vchiq_instance *instance, struct vchiq_pagelist_info *pagel + cleanup_pagelistinfo(instance, pagelistinfo); + } + +-int vchiq_platform_init(struct platform_device *pdev, struct vchiq_state *state) ++static int vchiq_platform_init(struct platform_device *pdev, struct vchiq_state *state) + { + struct device *dev = &pdev->dev; + struct vchiq_drvdata *drvdata = platform_get_drvdata(pdev); +-- +2.39.2 + diff --git a/queue-6.1/tcp-annotate-data-races-in-__tcp_oow_rate_limited.patch b/queue-6.1/tcp-annotate-data-races-in-__tcp_oow_rate_limited.patch new file mode 100644 index 00000000000..499c3a336f1 --- /dev/null +++ b/queue-6.1/tcp-annotate-data-races-in-__tcp_oow_rate_limited.patch @@ -0,0 +1,55 @@ +From 38819409e4797edb36f4cc22d901d1da1da2b25f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Jun 2023 16:41:50 +0000 +Subject: tcp: annotate data races in __tcp_oow_rate_limited() + +From: Eric Dumazet + +[ Upstream commit 998127cdb4699b9d470a9348ffe9f1154346be5f ] + +request sockets are lockless, __tcp_oow_rate_limited() could be called +on the same object from different cpus. This is harmless. + +Add READ_ONCE()/WRITE_ONCE() annotations to avoid a KCSAN report. + +Fixes: 4ce7e93cb3fe ("tcp: rate limit ACK sent by SYN_RECV request sockets") +Signed-off-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_input.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index 5dabb38b857ff..e2d3ea2e34561 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -3590,8 +3590,11 @@ static int tcp_ack_update_window(struct sock *sk, const struct sk_buff *skb, u32 + static bool __tcp_oow_rate_limited(struct net *net, int mib_idx, + u32 *last_oow_ack_time) + { +- if (*last_oow_ack_time) { +- s32 elapsed = (s32)(tcp_jiffies32 - *last_oow_ack_time); ++ /* Paired with the WRITE_ONCE() in this function. */ ++ u32 val = READ_ONCE(*last_oow_ack_time); ++ ++ if (val) { ++ s32 elapsed = (s32)(tcp_jiffies32 - val); + + if (0 <= elapsed && + elapsed < READ_ONCE(net->ipv4.sysctl_tcp_invalid_ratelimit)) { +@@ -3600,7 +3603,10 @@ static bool __tcp_oow_rate_limited(struct net *net, int mib_idx, + } + } + +- *last_oow_ack_time = tcp_jiffies32; ++ /* Paired with the prior READ_ONCE() and with itself, ++ * as we might be lockless. ++ */ ++ WRITE_ONCE(*last_oow_ack_time, tcp_jiffies32); + + return false; /* not rate-limited: go ahead, send dupack now! */ + } +-- +2.39.2 + diff --git a/queue-6.1/usb-common-usb-conn-gpio-set-last-role-to-unknown-be.patch b/queue-6.1/usb-common-usb-conn-gpio-set-last-role-to-unknown-be.patch new file mode 100644 index 00000000000..4e224c6c98e --- /dev/null +++ b/queue-6.1/usb-common-usb-conn-gpio-set-last-role-to-unknown-be.patch @@ -0,0 +1,104 @@ +From 1ebf4c3675857e8c0d4ad3ee483de95d9977f07f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 May 2023 20:11:14 +0530 +Subject: usb: common: usb-conn-gpio: Set last role to unknown before initial + detection + +From: Prashanth K + +[ Upstream commit edd60d24bd858cef165274e4cd6cab43bdc58d15 ] + +Currently if we bootup a device without cable connected, then +usb-conn-gpio won't call set_role() since last_role is same as +current role. This happens because during probe last_role gets +initialised to zero. + +To avoid this, added a new constant in enum usb_role, last_role +is set to USB_ROLE_UNKNOWN before performing initial detection. + +While at it, also handle default case for the usb_role switch +in cdns3, intel-xhci-usb-role-switch & musb/jz4740 to avoid +build warnings. + +Fixes: 4602f3bff266 ("usb: common: add USB GPIO based connection detection driver") +Signed-off-by: Prashanth K +Reviewed-by: AngeloGioacchino Del Regno +Message-ID: <1685544074-17337-1-git-send-email-quic_prashk@quicinc.com> +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/cdns3/core.c | 2 ++ + drivers/usb/common/usb-conn-gpio.c | 3 +++ + drivers/usb/musb/jz4740.c | 2 ++ + drivers/usb/roles/intel-xhci-usb-role-switch.c | 2 ++ + include/linux/usb/role.h | 1 + + 5 files changed, 10 insertions(+) + +diff --git a/drivers/usb/cdns3/core.c b/drivers/usb/cdns3/core.c +index dbcdf3b24b477..69d2921f2d3b5 100644 +--- a/drivers/usb/cdns3/core.c ++++ b/drivers/usb/cdns3/core.c +@@ -252,6 +252,8 @@ static enum usb_role cdns_hw_role_state_machine(struct cdns *cdns) + if (!vbus) + role = USB_ROLE_NONE; + break; ++ default: ++ break; + } + + dev_dbg(cdns->dev, "role %d -> %d\n", cdns->role, role); +diff --git a/drivers/usb/common/usb-conn-gpio.c b/drivers/usb/common/usb-conn-gpio.c +index e20874caba363..30bdb81934bc8 100644 +--- a/drivers/usb/common/usb-conn-gpio.c ++++ b/drivers/usb/common/usb-conn-gpio.c +@@ -257,6 +257,9 @@ static int usb_conn_probe(struct platform_device *pdev) + platform_set_drvdata(pdev, info); + device_set_wakeup_capable(&pdev->dev, true); + ++ /* Set last role to unknown before performing the initial detection */ ++ info->last_role = USB_ROLE_UNKNOWN; ++ + /* Perform initial detection */ + usb_conn_queue_dwork(info, 0); + +diff --git a/drivers/usb/musb/jz4740.c b/drivers/usb/musb/jz4740.c +index d1e4e0deb7535..df4e9d397d986 100644 +--- a/drivers/usb/musb/jz4740.c ++++ b/drivers/usb/musb/jz4740.c +@@ -91,6 +91,8 @@ static int jz4740_musb_role_switch_set(struct usb_role_switch *sw, + case USB_ROLE_HOST: + atomic_notifier_call_chain(&phy->notifier, USB_EVENT_ID, phy); + break; ++ default: ++ break; + } + + return 0; +diff --git a/drivers/usb/roles/intel-xhci-usb-role-switch.c b/drivers/usb/roles/intel-xhci-usb-role-switch.c +index 5c96e929acea0..4d6a3dd06e011 100644 +--- a/drivers/usb/roles/intel-xhci-usb-role-switch.c ++++ b/drivers/usb/roles/intel-xhci-usb-role-switch.c +@@ -97,6 +97,8 @@ static int intel_xhci_usb_set_role(struct usb_role_switch *sw, + val |= SW_VBUS_VALID; + drd_config = DRD_CONFIG_STATIC_DEVICE; + break; ++ default: ++ break; + } + val |= SW_IDPIN_EN; + if (data->enable_sw_switch) { +diff --git a/include/linux/usb/role.h b/include/linux/usb/role.h +index b5deafd91f67b..65e790a28913e 100644 +--- a/include/linux/usb/role.h ++++ b/include/linux/usb/role.h +@@ -11,6 +11,7 @@ enum usb_role { + USB_ROLE_NONE, + USB_ROLE_HOST, + USB_ROLE_DEVICE, ++ USB_ROLE_UNKNOWN, + }; + + typedef int (*usb_role_switch_set_t)(struct usb_role_switch *sw, +-- +2.39.2 + diff --git a/queue-6.1/usb-dwc2-fix-some-error-handling-paths.patch b/queue-6.1/usb-dwc2-fix-some-error-handling-paths.patch new file mode 100644 index 00000000000..8ef1369b439 --- /dev/null +++ b/queue-6.1/usb-dwc2-fix-some-error-handling-paths.patch @@ -0,0 +1,81 @@ +From ecff4db2d131eaf3dc7c553ce1a0b45dbdd75fe5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 May 2023 19:15:08 +0200 +Subject: usb: dwc2: Fix some error handling paths + +From: Christophe JAILLET + +[ Upstream commit ada050c69108bc34be13ecc11f7fad0f20ebadc4 ] + +dwc2_driver_probe() calls dwc2_lowlevel_hw_init() which deassert some reset +lines. +Should an error happen in dwc2_lowlevel_hw_init() after calling +reset_control_deassert() or in the probe after calling +dwc2_lowlevel_hw_init(), the reset lines remain deasserted. + +Add some devm_add_action_or_reset() calls to re-assert the lines if needed. + +Update the remove function accordingly. + +This change is compile-tested only. + +Fixes: 83f8da562f8b ("usb: dwc2: Add reset control to dwc2") +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/c64537b5339342bd00f7c2152b8fc23792b9f95a.1683306479.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc2/platform.c | 16 +++++++++++++--- + 1 file changed, 13 insertions(+), 3 deletions(-) + +diff --git a/drivers/usb/dwc2/platform.c b/drivers/usb/dwc2/platform.c +index d1589ba7d322d..58f53faab340f 100644 +--- a/drivers/usb/dwc2/platform.c ++++ b/drivers/usb/dwc2/platform.c +@@ -175,6 +175,11 @@ int dwc2_lowlevel_hw_disable(struct dwc2_hsotg *hsotg) + return ret; + } + ++static void dwc2_reset_control_assert(void *data) ++{ ++ reset_control_assert(data); ++} ++ + static int dwc2_lowlevel_hw_init(struct dwc2_hsotg *hsotg) + { + int i, ret; +@@ -185,6 +190,10 @@ static int dwc2_lowlevel_hw_init(struct dwc2_hsotg *hsotg) + "error getting reset control\n"); + + reset_control_deassert(hsotg->reset); ++ ret = devm_add_action_or_reset(hsotg->dev, dwc2_reset_control_assert, ++ hsotg->reset); ++ if (ret) ++ return ret; + + hsotg->reset_ecc = devm_reset_control_get_optional(hsotg->dev, "dwc2-ecc"); + if (IS_ERR(hsotg->reset_ecc)) +@@ -192,6 +201,10 @@ static int dwc2_lowlevel_hw_init(struct dwc2_hsotg *hsotg) + "error getting reset control for ecc\n"); + + reset_control_deassert(hsotg->reset_ecc); ++ ret = devm_add_action_or_reset(hsotg->dev, dwc2_reset_control_assert, ++ hsotg->reset_ecc); ++ if (ret) ++ return ret; + + /* + * Attempt to find a generic PHY, then look for an old style +@@ -306,9 +319,6 @@ static int dwc2_driver_remove(struct platform_device *dev) + if (hsotg->ll_hw_enabled) + dwc2_lowlevel_hw_disable(hsotg); + +- reset_control_assert(hsotg->reset); +- reset_control_assert(hsotg->reset_ecc); +- + return 0; + } + +-- +2.39.2 + diff --git a/queue-6.1/usb-dwc2-platform-improve-error-reporting-for-proble.patch b/queue-6.1/usb-dwc2-platform-improve-error-reporting-for-proble.patch new file mode 100644 index 00000000000..cdd51972c09 --- /dev/null +++ b/queue-6.1/usb-dwc2-platform-improve-error-reporting-for-proble.patch @@ -0,0 +1,49 @@ +From b436bd52a3e8dd51370e8220dc1aac03fe21e7ca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Oct 2022 21:59:14 +0200 +Subject: usb: dwc2: platform: Improve error reporting for problems during + .remove() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 55f223b8b408cbfd85fb1c5b74ab85ccab319a69 ] + +Returning an error value in a platform driver's remove callback results in +a generic error message being emitted by the driver core, but otherwise it +doesn't make a difference. The device goes away anyhow. + +For each case where ret is non-zero the driver already emits an error +message, so suppress the generic error message by returning zero +unconditionally. (Side note: The return value handling was unreliable +anyhow as the value returned by dwc2_exit_hibernation() was overwritten +anyhow if hsotg->in_ppd was non-zero.) + +Signed-off-by: Uwe Kleine-König +Acked-by: Minas Harutyunyan +Link: https://lore.kernel.org/r/20221017195914.1426297-1-u.kleine-koenig@pengutronix.de +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: ada050c69108 ("usb: dwc2: Fix some error handling paths") +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc2/platform.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/dwc2/platform.c b/drivers/usb/dwc2/platform.c +index 0c02ef7628fd5..d1589ba7d322d 100644 +--- a/drivers/usb/dwc2/platform.c ++++ b/drivers/usb/dwc2/platform.c +@@ -309,7 +309,7 @@ static int dwc2_driver_remove(struct platform_device *dev) + reset_control_assert(hsotg->reset); + reset_control_assert(hsotg->reset_ecc); + +- return ret; ++ return 0; + } + + /** +-- +2.39.2 + diff --git a/queue-6.1/usb-dwc3-meson-g12a-fix-an-error-handling-path-in-dw.patch b/queue-6.1/usb-dwc3-meson-g12a-fix-an-error-handling-path-in-dw.patch new file mode 100644 index 00000000000..195a86c6829 --- /dev/null +++ b/queue-6.1/usb-dwc3-meson-g12a-fix-an-error-handling-path-in-dw.patch @@ -0,0 +1,51 @@ +From 00c0446807133abc8463ab85358afc915b137993 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Jun 2023 15:32:52 +0200 +Subject: usb: dwc3-meson-g12a: Fix an error handling path in + dwc3_meson_g12a_probe() + +From: Christophe JAILLET + +[ Upstream commit 01052b91c9808e3c3b068ae2721cb728ec9aa4c0 ] + +If dwc3_meson_g12a_otg_init() fails, resources allocated by the previous +of_platform_populate() call should be released, as already done in the +error handling path. + +Fixes: 1e355f21d3fb ("usb: dwc3: Add Amlogic A1 DWC3 glue") +Signed-off-by: Christophe JAILLET +Reviewed-by: Martin Blumenstingl +Reviewed-by: Neil Armstrong +Message-ID: <9d28466de1808ccc756b4cc25fc72c482d133d13.1686403934.git.christophe.jaillet@wanadoo.fr> +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc3/dwc3-meson-g12a.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/usb/dwc3/dwc3-meson-g12a.c b/drivers/usb/dwc3/dwc3-meson-g12a.c +index b282ad0e69c6d..eaea944ebd2ce 100644 +--- a/drivers/usb/dwc3/dwc3-meson-g12a.c ++++ b/drivers/usb/dwc3/dwc3-meson-g12a.c +@@ -805,7 +805,7 @@ static int dwc3_meson_g12a_probe(struct platform_device *pdev) + + ret = dwc3_meson_g12a_otg_init(pdev, priv); + if (ret) +- goto err_phys_power; ++ goto err_plat_depopulate; + + pm_runtime_set_active(dev); + pm_runtime_enable(dev); +@@ -813,6 +813,9 @@ static int dwc3_meson_g12a_probe(struct platform_device *pdev) + + return 0; + ++err_plat_depopulate: ++ of_platform_depopulate(dev); ++ + err_phys_power: + for (i = 0 ; i < PHY_COUNT ; ++i) + phy_power_off(priv->phys[i]); +-- +2.39.2 + diff --git a/queue-6.1/usb-dwc3-qcom-fix-an-error-handling-path-in-dwc3_qco.patch b/queue-6.1/usb-dwc3-qcom-fix-an-error-handling-path-in-dwc3_qco.patch new file mode 100644 index 00000000000..4edbe97b32d --- /dev/null +++ b/queue-6.1/usb-dwc3-qcom-fix-an-error-handling-path-in-dwc3_qco.patch @@ -0,0 +1,43 @@ +From 1490e9660ce585944493526670adc5d3573cc524 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 4 Jun 2023 16:56:34 +0200 +Subject: usb: dwc3: qcom: Fix an error handling path in dwc3_qcom_probe() + +From: Christophe JAILLET + +[ Upstream commit 4a944da707123686d372ec01ea60056902fadf35 ] + +If dwc3_qcom_create_urs_usb_platdev() fails, some resources still need to +be released, as already done in the other error handling path of the +probe. + +Fixes: c25c210f590e ("usb: dwc3: qcom: add URS Host support for sdm845 ACPI boot") +Signed-off-by: Christophe JAILLET +Reviewed-by: Andrew Halaney +Message-ID: +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc3/dwc3-qcom.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/usb/dwc3/dwc3-qcom.c b/drivers/usb/dwc3/dwc3-qcom.c +index 9c01e963ae467..72c22851d7eef 100644 +--- a/drivers/usb/dwc3/dwc3-qcom.c ++++ b/drivers/usb/dwc3/dwc3-qcom.c +@@ -865,9 +865,10 @@ static int dwc3_qcom_probe(struct platform_device *pdev) + if (IS_ERR_OR_NULL(qcom->urs_usb)) { + dev_err(dev, "failed to create URS USB platdev\n"); + if (!qcom->urs_usb) +- return -ENODEV; ++ ret = -ENODEV; + else +- return PTR_ERR(qcom->urs_usb); ++ ret = PTR_ERR(qcom->urs_usb); ++ goto clk_disable; + } + } + } +-- +2.39.2 + diff --git a/queue-6.1/usb-dwc3-qcom-fix-potential-memory-leak.patch b/queue-6.1/usb-dwc3-qcom-fix-potential-memory-leak.patch new file mode 100644 index 00000000000..7a4920caf4f --- /dev/null +++ b/queue-6.1/usb-dwc3-qcom-fix-potential-memory-leak.patch @@ -0,0 +1,53 @@ +From 3b781c54791790583da39e9d335fe492c84b8a2f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 May 2023 20:25:18 +0300 +Subject: usb: dwc3: qcom: Fix potential memory leak + +From: Vladislav Efanov + +[ Upstream commit 097fb3ee710d4de83b8d4f5589e8ee13e0f0541e ] + +Function dwc3_qcom_probe() allocates memory for resource structure +which is pointed by parent_res pointer. This memory is not +freed. This leads to memory leak. Use stack memory to prevent +memory leak. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 2bc02355f8ba ("usb: dwc3: qcom: Add support for booting with ACPI") +Signed-off-by: Vladislav Efanov +Acked-by: Shawn Guo +Link: https://lore.kernel.org/r/20230517172518.442591-1-VEfanov@ispras.ru +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc3/dwc3-qcom.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/usb/dwc3/dwc3-qcom.c b/drivers/usb/dwc3/dwc3-qcom.c +index 79b22abf97276..482260182d656 100644 +--- a/drivers/usb/dwc3/dwc3-qcom.c ++++ b/drivers/usb/dwc3/dwc3-qcom.c +@@ -800,6 +800,7 @@ static int dwc3_qcom_probe(struct platform_device *pdev) + struct device *dev = &pdev->dev; + struct dwc3_qcom *qcom; + struct resource *res, *parent_res = NULL; ++ struct resource local_res; + int ret, i; + bool ignore_pipe_clk; + bool wakeup_source; +@@ -851,9 +852,8 @@ static int dwc3_qcom_probe(struct platform_device *pdev) + if (np) { + parent_res = res; + } else { +- parent_res = kmemdup(res, sizeof(struct resource), GFP_KERNEL); +- if (!parent_res) +- return -ENOMEM; ++ memcpy(&local_res, res, sizeof(struct resource)); ++ parent_res = &local_res; + + parent_res->start = res->start + + qcom->acpi_pdata->qscratch_base_offset; +-- +2.39.2 + diff --git a/queue-6.1/usb-dwc3-qcom-release-the-correct-resources-in-dwc3_.patch b/queue-6.1/usb-dwc3-qcom-release-the-correct-resources-in-dwc3_.patch new file mode 100644 index 00000000000..00c51f251ba --- /dev/null +++ b/queue-6.1/usb-dwc3-qcom-release-the-correct-resources-in-dwc3_.patch @@ -0,0 +1,50 @@ +From 0397d10a6a496cca2fc51cae5f90608d9709161a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 4 Jun 2023 17:04:37 +0200 +Subject: usb: dwc3: qcom: Release the correct resources in dwc3_qcom_remove() + +From: Christophe JAILLET + +[ Upstream commit 8fd95da2cfb5046c4bb5a3cdc9eb7963ba8b10dd ] + +In the probe, some resources are allocated with +dwc3_qcom_of_register_core() or dwc3_qcom_acpi_register_core(). The +corresponding resources are already coorectly freed in the error handling +path of the probe, but not in the remove function. + +Fix it. + +Fixes: 2bc02355f8ba ("usb: dwc3: qcom: Add support for booting with ACPI") +Signed-off-by: Christophe JAILLET +Reviewed-by: Andrew Halaney +Message-ID: +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc3/dwc3-qcom.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/usb/dwc3/dwc3-qcom.c b/drivers/usb/dwc3/dwc3-qcom.c +index 482260182d656..9c01e963ae467 100644 +--- a/drivers/usb/dwc3/dwc3-qcom.c ++++ b/drivers/usb/dwc3/dwc3-qcom.c +@@ -950,11 +950,15 @@ static int dwc3_qcom_probe(struct platform_device *pdev) + static int dwc3_qcom_remove(struct platform_device *pdev) + { + struct dwc3_qcom *qcom = platform_get_drvdata(pdev); ++ struct device_node *np = pdev->dev.of_node; + struct device *dev = &pdev->dev; + int i; + + device_remove_software_node(&qcom->dwc3->dev); +- of_platform_depopulate(dev); ++ if (np) ++ of_platform_depopulate(&pdev->dev); ++ else ++ platform_device_put(pdev); + + for (i = qcom->num_clocks - 1; i >= 0; i--) { + clk_disable_unprepare(qcom->clks[i]); +-- +2.39.2 + diff --git a/queue-6.1/usb-gadget-u_serial-add-null-pointer-check-in-gseria.patch b/queue-6.1/usb-gadget-u_serial-add-null-pointer-check-in-gseria.patch new file mode 100644 index 00000000000..5be2f5df78b --- /dev/null +++ b/queue-6.1/usb-gadget-u_serial-add-null-pointer-check-in-gseria.patch @@ -0,0 +1,56 @@ +From 374e658b001c865b0ff620edd3cc6ec8d1883972 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 May 2023 14:48:37 +0530 +Subject: usb: gadget: u_serial: Add null pointer check in gserial_suspend + +From: Prashanth K + +[ Upstream commit 2f6ecb89fe8feb2b60a53325b0eeb9866d88909a ] + +Consider a case where gserial_disconnect has already cleared +gser->ioport. And if gserial_suspend gets called afterwards, +it will lead to accessing of gser->ioport and thus causing +null pointer dereference. + +Avoid this by adding a null pointer check. Added a static +spinlock to prevent gser->ioport from becoming null after +the newly added null pointer check. + +Fixes: aba3a8d01d62 ("usb: gadget: u_serial: add suspend resume callbacks") +Signed-off-by: Prashanth K +Link: https://lore.kernel.org/r/1683278317-11774-1-git-send-email-quic_prashk@quicinc.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/function/u_serial.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +diff --git a/drivers/usb/gadget/function/u_serial.c b/drivers/usb/gadget/function/u_serial.c +index db6fd0238d4b4..ea2c5b6cde8cd 100644 +--- a/drivers/usb/gadget/function/u_serial.c ++++ b/drivers/usb/gadget/function/u_serial.c +@@ -1419,10 +1419,19 @@ EXPORT_SYMBOL_GPL(gserial_disconnect); + + void gserial_suspend(struct gserial *gser) + { +- struct gs_port *port = gser->ioport; ++ struct gs_port *port; + unsigned long flags; + +- spin_lock_irqsave(&port->port_lock, flags); ++ spin_lock_irqsave(&serial_port_lock, flags); ++ port = gser->ioport; ++ ++ if (!port) { ++ spin_unlock_irqrestore(&serial_port_lock, flags); ++ return; ++ } ++ ++ spin_lock(&port->port_lock); ++ spin_unlock(&serial_port_lock); + port->suspended = true; + spin_unlock_irqrestore(&port->port_lock, flags); + } +-- +2.39.2 + diff --git a/queue-6.1/usb-hide-unused-usbfs_notify_suspend-resume-function.patch b/queue-6.1/usb-hide-unused-usbfs_notify_suspend-resume-function.patch new file mode 100644 index 00000000000..a478d7706ef --- /dev/null +++ b/queue-6.1/usb-hide-unused-usbfs_notify_suspend-resume-function.patch @@ -0,0 +1,52 @@ +From 37ff4f015e5ef61a1cc3cbe6e2f3f267ed993347 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 May 2023 22:17:42 +0200 +Subject: usb: hide unused usbfs_notify_suspend/resume functions + +From: Arnd Bergmann + +[ Upstream commit 8e6bd945e6dde64fbc60ec3fe252164493a8d3a2 ] + +The declaration is in an #ifdef, which causes warnings when building +with 'make W=1' and without CONFIG_PM: + +drivers/usb/core/devio.c:742:6: error: no previous prototype for 'usbfs_notify_suspend' +drivers/usb/core/devio.c:747:6: error: no previous prototype for 'usbfs_notify_resume' + +Use the same #ifdef check around the function definitions to avoid +the warnings and slightly shrink the USB core. + +Fixes: 7794f486ed0b ("usbfs: Add ioctls for runtime power management") +Signed-off-by: Arnd Bergmann +Reviewed-by: Sebastian Reichel +Acked-by: Alan Stern +Link: https://lore.kernel.org/r/20230516202103.558301-1-arnd@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/core/devio.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c +index 984de3f5e8eb9..4184cd65a6aac 100644 +--- a/drivers/usb/core/devio.c ++++ b/drivers/usb/core/devio.c +@@ -747,6 +747,7 @@ static int driver_resume(struct usb_interface *intf) + return 0; + } + ++#ifdef CONFIG_PM + /* The following routines apply to the entire device, not interfaces */ + void usbfs_notify_suspend(struct usb_device *udev) + { +@@ -765,6 +766,7 @@ void usbfs_notify_resume(struct usb_device *udev) + } + mutex_unlock(&usbfs_mutex); + } ++#endif + + struct usb_driver usbfs_driver = { + .name = "usbfs", +-- +2.39.2 + diff --git a/queue-6.1/usb-misc-eud-fix-eud-sysfs-path-use-qcom_eud.patch b/queue-6.1/usb-misc-eud-fix-eud-sysfs-path-use-qcom_eud.patch new file mode 100644 index 00000000000..824c49a9dc5 --- /dev/null +++ b/queue-6.1/usb-misc-eud-fix-eud-sysfs-path-use-qcom_eud.patch @@ -0,0 +1,42 @@ +From 3afcb093d430edc8f01664d4ebb6c09c9b9369c1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 May 2023 02:47:51 +0530 +Subject: usb: misc: eud: Fix eud sysfs path (use 'qcom_eud') + +From: Bhupesh Sharma + +[ Upstream commit f16135918b5f8b510db014ecf0a069e34c02382e ] + +The eud sysfs enablement path is currently mentioned in the +Documentation as: + /sys/bus/platform/drivers/eud/.../enable + +Instead it should be: + /sys/bus/platform/drivers/qcom_eud/.../enable + +Fix the same. + +Fixes: 9a1bf58ccd44 ("usb: misc: eud: Add driver support for Embedded USB Debugger(EUD)") +Reviewed-by: Konrad Dybcio +Acked-by: Manivannan Sadhasivam +Signed-off-by: Bhupesh Sharma +Link: https://lore.kernel.org/r/20230517211756.2483552-2-bhupesh.sharma@linaro.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + Documentation/ABI/testing/sysfs-driver-eud | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/Documentation/ABI/testing/sysfs-driver-eud b/Documentation/ABI/testing/sysfs-driver-eud +index 83f3872182a40..2bab0db2d2f0f 100644 +--- a/Documentation/ABI/testing/sysfs-driver-eud ++++ b/Documentation/ABI/testing/sysfs-driver-eud +@@ -1,4 +1,4 @@ +-What: /sys/bus/platform/drivers/eud/.../enable ++What: /sys/bus/platform/drivers/qcom_eud/.../enable + Date: February 2022 + Contact: Souradeep Chowdhury + Description: +-- +2.39.2 + diff --git a/queue-6.1/usb-phy-phy-tahvo-fix-memory-leak-in-tahvo_usb_probe.patch b/queue-6.1/usb-phy-phy-tahvo-fix-memory-leak-in-tahvo_usb_probe.patch new file mode 100644 index 00000000000..d308d3bd077 --- /dev/null +++ b/queue-6.1/usb-phy-phy-tahvo-fix-memory-leak-in-tahvo_usb_probe.patch @@ -0,0 +1,43 @@ +From a2452eb81700444947486d9144f3c2fced95e69b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Apr 2023 22:08:31 +0800 +Subject: usb: phy: phy-tahvo: fix memory leak in tahvo_usb_probe() + +From: Li Yang + +[ Upstream commit 342161c11403ea00e9febc16baab1d883d589d04 ] + +Smatch reports: +drivers/usb/phy/phy-tahvo.c: tahvo_usb_probe() +warn: missing unwind goto? + +After geting irq, if ret < 0, it will return without error handling to +free memory. +Just add error handling to fix this problem. + +Fixes: 0d45a1373e66 ("usb: phy: tahvo: add IRQ check") +Signed-off-by: Li Yang +Reviewed-by: Dongliang Mu +Link: https://lore.kernel.org/r/20230420140832.9110-1-lidaxian@hust.edu.cn +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/phy/phy-tahvo.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/phy/phy-tahvo.c b/drivers/usb/phy/phy-tahvo.c +index f2d2cc586c5b7..da63d7e4d2709 100644 +--- a/drivers/usb/phy/phy-tahvo.c ++++ b/drivers/usb/phy/phy-tahvo.c +@@ -391,7 +391,7 @@ static int tahvo_usb_probe(struct platform_device *pdev) + + tu->irq = ret = platform_get_irq(pdev, 0); + if (ret < 0) +- return ret; ++ goto err_remove_phy; + ret = request_threaded_irq(tu->irq, NULL, tahvo_usb_vbus_interrupt, + IRQF_ONESHOT, + "tahvo-vbus", tu); +-- +2.39.2 + diff --git a/queue-6.1/w1-fix-loop-in-w1_fini.patch b/queue-6.1/w1-fix-loop-in-w1_fini.patch new file mode 100644 index 00000000000..89c4f6d598b --- /dev/null +++ b/queue-6.1/w1-fix-loop-in-w1_fini.patch @@ -0,0 +1,43 @@ +From 27faf4b2fd52fc92cc81be6ee0bfd67889badf0a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 May 2021 17:17:45 +0300 +Subject: w1: fix loop in w1_fini() + +From: Dan Carpenter + +[ Upstream commit 83f3fcf96fcc7e5405b37d9424c7ef26bfa203f8 ] + +The __w1_remove_master_device() function calls: + + list_del(&dev->w1_master_entry); + +So presumably this can cause an endless loop. + +Fixes: 7785925dd8e0 ("[PATCH] w1: cleanups.") +Signed-off-by: Dan Carpenter +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Sasha Levin +--- + drivers/w1/w1.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/w1/w1.c b/drivers/w1/w1.c +index 4a2ddf730a3ac..2eee26b7fc4a3 100644 +--- a/drivers/w1/w1.c ++++ b/drivers/w1/w1.c +@@ -1263,10 +1263,10 @@ static int __init w1_init(void) + + static void __exit w1_fini(void) + { +- struct w1_master *dev; ++ struct w1_master *dev, *n; + + /* Set netlink removal messages and some cleanup */ +- list_for_each_entry(dev, &w1_masters, w1_master_entry) ++ list_for_each_entry_safe(dev, n, &w1_masters, w1_master_entry) + __w1_remove_master_device(dev); + + w1_fini_netlink(); +-- +2.39.2 + diff --git a/queue-6.1/w1-w1_therm-fix-locking-behavior-in-convert_t.patch b/queue-6.1/w1-w1_therm-fix-locking-behavior-in-convert_t.patch new file mode 100644 index 00000000000..6780bc74125 --- /dev/null +++ b/queue-6.1/w1-w1_therm-fix-locking-behavior-in-convert_t.patch @@ -0,0 +1,91 @@ +From 8dece5aba276fea7c4203ce98b78f4250ee7f4e8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Apr 2023 13:21:52 +0200 +Subject: w1: w1_therm: fix locking behavior in convert_t + +From: Stefan Wahren + +[ Upstream commit dca5480ab7b77a889088ab7cac81934604510ac7 ] + +The commit 67b392f7b8ed ("w1_therm: optimizing temperature read timings") +accidentially inverted the logic for lock handling of the bus mutex. + +Before: + pullup -> release lock before sleep + no pullup -> release lock after sleep + +After: + pullup -> release lock after sleep + no pullup -> release lock before sleep + +This cause spurious measurements of 85 degree (powerup value) on the +Tarragon board with connected 1-w temperature sensor +(w1_therm.w1_strong_pull=0). + +In the meantime a new feature for polling the conversion +completion has been integrated in these branches with +commit 021da53e65fd ("w1: w1_therm: Add sysfs entries to control +conversion time and driver features"). But this feature isn't +available for parasite power mode, so handle this separately. + +Link: https://lore.kernel.org/regressions/2023042645-attentive-amends-7b0b@gregkh/T/ +Fixes: 67b392f7b8ed ("w1_therm: optimizing temperature read timings") +Signed-off-by: Stefan Wahren +Link: https://lore.kernel.org/r/20230427112152.12313-1-stefan.wahren@i2se.com +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Sasha Levin +--- + drivers/w1/slaves/w1_therm.c | 31 ++++++++++++++----------------- + 1 file changed, 14 insertions(+), 17 deletions(-) + +diff --git a/drivers/w1/slaves/w1_therm.c b/drivers/w1/slaves/w1_therm.c +index 067692626cf07..99c58bd9d2df0 100644 +--- a/drivers/w1/slaves/w1_therm.c ++++ b/drivers/w1/slaves/w1_therm.c +@@ -1159,29 +1159,26 @@ static int convert_t(struct w1_slave *sl, struct therm_info *info) + + w1_write_8(dev_master, W1_CONVERT_TEMP); + +- if (strong_pullup) { /*some device need pullup */ ++ if (SLAVE_FEATURES(sl) & W1_THERM_POLL_COMPLETION) { ++ ret = w1_poll_completion(dev_master, W1_POLL_CONVERT_TEMP); ++ if (ret) { ++ dev_dbg(&sl->dev, "%s: Timeout\n", __func__); ++ goto mt_unlock; ++ } ++ mutex_unlock(&dev_master->bus_mutex); ++ } else if (!strong_pullup) { /*no device need pullup */ + sleep_rem = msleep_interruptible(t_conv); + if (sleep_rem != 0) { + ret = -EINTR; + goto mt_unlock; + } + mutex_unlock(&dev_master->bus_mutex); +- } else { /*no device need pullup */ +- if (SLAVE_FEATURES(sl) & W1_THERM_POLL_COMPLETION) { +- ret = w1_poll_completion(dev_master, W1_POLL_CONVERT_TEMP); +- if (ret) { +- dev_dbg(&sl->dev, "%s: Timeout\n", __func__); +- goto mt_unlock; +- } +- mutex_unlock(&dev_master->bus_mutex); +- } else { +- /* Fixed delay */ +- mutex_unlock(&dev_master->bus_mutex); +- sleep_rem = msleep_interruptible(t_conv); +- if (sleep_rem != 0) { +- ret = -EINTR; +- goto dec_refcnt; +- } ++ } else { /*some device need pullup */ ++ mutex_unlock(&dev_master->bus_mutex); ++ sleep_rem = msleep_interruptible(t_conv); ++ if (sleep_rem != 0) { ++ ret = -EINTR; ++ goto dec_refcnt; + } + } + ret = read_scratchpad(sl, info); +-- +2.39.2 + diff --git a/queue-6.1/xsk-honor-so_bindtodevice-on-bind.patch b/queue-6.1/xsk-honor-so_bindtodevice-on-bind.patch new file mode 100644 index 00000000000..2444cb7c35d --- /dev/null +++ b/queue-6.1/xsk-honor-so_bindtodevice-on-bind.patch @@ -0,0 +1,101 @@ +From ce5a1e02a3139e887cb4a454e46c175e800509fe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Jul 2023 19:53:29 +0200 +Subject: xsk: Honor SO_BINDTODEVICE on bind + +From: Ilya Maximets + +[ Upstream commit f7306acec9aae9893d15e745c8791124d42ab10a ] + +Initial creation of an AF_XDP socket requires CAP_NET_RAW capability. A +privileged process might create the socket and pass it to a non-privileged +process for later use. However, that process will be able to bind the socket +to any network interface. Even though it will not be able to receive any +traffic without modification of the BPF map, the situation is not ideal. + +Sockets already have a mechanism that can be used to restrict what interface +they can be attached to. That is SO_BINDTODEVICE. + +To change the SO_BINDTODEVICE binding the process will need CAP_NET_RAW. + +Make xsk_bind() honor the SO_BINDTODEVICE in order to allow safer workflow +when non-privileged process is using AF_XDP. + +The intended workflow is following: + + 1. First process creates a bare socket with socket(AF_XDP, ...). + 2. First process loads the XSK program to the interface. + 3. First process adds the socket fd to a BPF map. + 4. First process ties socket fd to a particular interface using + SO_BINDTODEVICE. + 5. First process sends socket fd to a second process. + 6. Second process allocates UMEM. + 7. Second process binds socket to the interface with bind(...). + 8. Second process sends/receives the traffic. + +All the steps above are possible today if the first process is privileged +and the second one has sufficient RLIMIT_MEMLOCK and no capabilities. +However, the second process will be able to bind the socket to any interface +it wants on step 7 and send traffic from it. With the proposed change, the +second process will be able to bind the socket only to a specific interface +chosen by the first process at step 4. + +Fixes: 965a99098443 ("xsk: add support for bind for Rx") +Signed-off-by: Ilya Maximets +Signed-off-by: Daniel Borkmann +Acked-by: Magnus Karlsson +Acked-by: John Fastabend +Acked-by: Jason Wang +Link: https://lore.kernel.org/bpf/20230703175329.3259672-1-i.maximets@ovn.org +Signed-off-by: Sasha Levin +--- + Documentation/networking/af_xdp.rst | 9 +++++++++ + net/xdp/xsk.c | 5 +++++ + 2 files changed, 14 insertions(+) + +diff --git a/Documentation/networking/af_xdp.rst b/Documentation/networking/af_xdp.rst +index 60b217b436be6..5b77b9e5ac7e6 100644 +--- a/Documentation/networking/af_xdp.rst ++++ b/Documentation/networking/af_xdp.rst +@@ -433,6 +433,15 @@ start N bytes into the buffer leaving the first N bytes for the + application to use. The final option is the flags field, but it will + be dealt with in separate sections for each UMEM flag. + ++SO_BINDTODEVICE setsockopt ++-------------------------- ++ ++This is a generic SOL_SOCKET option that can be used to tie AF_XDP ++socket to a particular network interface. It is useful when a socket ++is created by a privileged process and passed to a non-privileged one. ++Once the option is set, kernel will refuse attempts to bind that socket ++to a different interface. Updating the value requires CAP_NET_RAW. ++ + XDP_STATISTICS getsockopt + ------------------------- + +diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c +index 13f62d2402e71..371d269d22fa0 100644 +--- a/net/xdp/xsk.c ++++ b/net/xdp/xsk.c +@@ -886,6 +886,7 @@ static int xsk_bind(struct socket *sock, struct sockaddr *addr, int addr_len) + struct sock *sk = sock->sk; + struct xdp_sock *xs = xdp_sk(sk); + struct net_device *dev; ++ int bound_dev_if; + u32 flags, qid; + int err = 0; + +@@ -899,6 +900,10 @@ static int xsk_bind(struct socket *sock, struct sockaddr *addr, int addr_len) + XDP_USE_NEED_WAKEUP)) + return -EINVAL; + ++ bound_dev_if = READ_ONCE(sk->sk_bound_dev_if); ++ if (bound_dev_if && bound_dev_if != sxdp->sxdp_ifindex) ++ return -EINVAL; ++ + rtnl_lock(); + mutex_lock(&xs->mutex); + if (xs->state != XSK_READY) { +-- +2.39.2 +